From mb5 at eom.net Wed Oct 1 01:08:46 1997 From: mb5 at eom.net (mb5 at eom.net) Date: Wed, 1 Oct 1997 01:08:46 -0700 (PDT) Subject: .... Message-ID: <2384358439fr33474@mail.net> Do you need to drive more business to your website immediately? We can generate traffic to your website. Boost your on-line business! Reply today and ask about SPECIAL RATES offered for a limited time only. PLEASE CLICK HERE TO REQUEST INFORMATION Subject: Boost Traffic From success at nowhere.com Wed Oct 1 02:23:38 1997 From: success at nowhere.com (success at nowhere.com) Date: Wed, 1 Oct 1997 02:23:38 -0700 (PDT) Subject: $6,000 In 10 Days! Month End Special Message-ID: <199702170025.GAA08056@nowhere.com> $6,000 In 10 Days! PROVEN MAIL ORDER PLAN, makes believers of skeptics! This is not MLM, nor is it betting or stocks. Not a chain letter scheme nor a 900 number business. Simple, easy to operate, small business program, that you can easily add to your existing programs or start your first home based business. Includes everything you need to get started. This is opportunity knocking ...don't pass it by. This is risk free with our 30 day money-back guarantee! For more no obligation details, click here: http://www.privatesite.com/WarriorMall/liontwin/6000.htm Thank you for your time. =================================================== Visit the only bulk friendly mall on the Internet. If you would like to get the exposure for your business that only direct email marketing can bring, check it out: http://www.privatesite.com/WarriorMall If you want to sign up, you will need reference #235. =================================================== REMOVE INSTRUCTIONS This is a direct emailing. As a member of the Online Marketeers Association, we do not wish to send you commercial emails if you don't want them. If you would like to be removed from our inhouse list, please click on this link: mailto:lionsroar2 at answerme.com?subject=remove (or simply hit reply and type remove in the subject field). Your email address will be removed immediately from our list. Your email address will also be submitted to the master remove list of the Online Marketeers Association. * Promote Responsible Direct Commercial Emailing * * Have A Nice Mail Order Day * =================================================== From shamrock at cypherpunks.to Wed Oct 1 00:15:33 1997 From: shamrock at cypherpunks.to (Lucky Green) Date: Wed, 1 Oct 1997 15:15:33 +0800 Subject: USRobotics Palm Pilot and PGP In-Reply-To: <199710010219.WAA25642@cti06.citenet.net> Message-ID: On Tue, 30 Sep 1997 jf_avon at citenet.net wrote: > > Hi. > > Is there anybody that know if there is a PGP compiled for the Palm > Pilot? I looked around but didn't find anything. Ian Goldberg ported some of PGP to the Pilot. His Pilot hacking page is at http://www.isaac.cs.berkeley.edu/pilot/ -- Lucky Green PGP encrypted email preferred. "Tonga? Where the hell is Tonga? They have Cypherpunks there?" From stewarts at ix.netcom.com Wed Oct 1 00:37:39 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Wed, 1 Oct 1997 15:37:39 +0800 Subject: Encrypting Pagers is Easy! [Overview, technical tradeoffs, crypto] Message-ID: <3.0.3.32.19971001000255.006abcec@popd.ix.netcom.com> One of the articles on the White House Pager Hack quoted a government official saying that encrypting pagers would be complicated and difficult. http://jya.com/potus-hack.htm http://www.inch.com/~esoteric/pam_suggestion/formal.html In fact, it's available today from several sources: 1)Digital PCS, in TDMA, GSM1900, and CDMA, though US coverage isn't complete (as of May 97, AT&T had service in 40% of the US land area, 80% population, and the GSM1900 players are expecting wide coverage later this year (e.g. PacBell and OmniPoint), plus Sprint PCS and other players are there.) There's a white paper on AT&T's Digital PCS at http://jya.com/digipcs.html which talks somewhat about the security. Phil Karn's posted some articles in the past about on the NSA's armtwisting that kept the cellphone encryption from being strong enough for serious security, but if it's not good enough for the White House, that's somewhat their fault. 2)Motorola's extremely cool PageWriter 2000 is a ~2"x2" programmable beeper with keyboard, 160x240 screen, crypto, operating system, and infrared. http://www.mot.com/MIMS/MSPG/Products/Two-way/pagewriter/ says it uses the Flex Operating System and ReFLEX 2-way paging; the person who showed me the beta version said OS9 and GSM. I'd guess that Flex is OS9 with bells and whistles added, and that the pager's CPU is a 68000-family chip, and that either he's wrong about GSM or there's a second flavor coming out that does GSM. In any case, it's user-programmable, and Motorola has crypto support. 3)If you insist on pager service that's not part of the cellphone or beeper you were carrying already, or want wider coverage, it's still not very hard, and it can be done with or without the paging service's cooperation. 4)PCMCIA cards in your PDA can get alpha pager, CDPD, ARDIS, RadioMail, etc. A cypherpunk replied that the difficulty is the fault of US anti-crypto policy. It's also the fault of spectrum licensing policies creating a small number of players in most markets and restricting what they can do "in the public interest", which has slowed deployment of new radio technology. Making money at it may still be hard, since the government interference fragments on the market and raises costs, but that's a separate problem, and if you can piggyback on existing developments like PCS and CDPD, it's a lot easier. Technology tradeoffs -------------------- Pager-company approaches vs. end-user-based - for the former, you have to convince the pager service and hardware companies there's a market; for the latter, you don't change the service, just send encrypted data using the alpha pager protocols, and soup up your pager to decrypt it. For PCS or CDPD or other radio data systems, it's also just data. If the pager company does the encryption, it's vulnerable to wiretaps and escrow. Relays - in a user-based system, you can either have the message sender do the encryption, which means distributing your code and keys widely, or run a relay box, e.g. Web page with SSL that handles the crypto and paging, letting people who want to page you use a standard web browser. Pager technology vs. crypto horsepower - basic pagers don't have a lot of horsepower, but a general-purpose 8-bit processor chip should be able to do RC4 in near-real-time, and maybe other symmetric-key algorithms. Public-key needs more horsepower - is it too slow for a pager-sized system? Digital cellphones use plenty of CPU to handle voice and dumb crypto, in not much more space, though they do use a lot more battery. If you don't want to custom-build your own pagers, use a pager card in a PDA - the Newton's had this for a while, and has a RISC CPU, so it's fast, and there are HP DOS-based palmtops which are slower, though the new Windows CE machines are probably faster than the previous generation. There'll probably be Pilot PCMCIA versions, though that's slower, and you can use Pilot with Metricom today and use Ian's PGP tools. The upcoming Psion 5 uses a StrongArm CPU; don't know if it does PCMCIA. Crypto issues ------------- What about the crypto protocols themselves? Public-key is straightforward; if you use 1024-bit keys you can even skip the symmetric-key layer and just send 128-character messages (or longer if you want to do Baudot or 7-bit ASCII :-) If you do public-key from the end user, it's secure, but all users need to use your public key to send you messages. If you do public-key from the pager company, all messages are encrypted, but the system is vulnerable to eavesdroppers and Escrow Cops. Does the response channel for two-way paging let you send arbitrary data, e.g. a Diffie-Hellman keypart? Secret key has more choices, with varying vulnerabilities - shared secret with pager company - dumb, works fine, you'd probably have the pager company set the secret key along with the pager parameters, and of course it's an obvious target for escrow and eavesdropping. For a mass-market service, this would be the most likely approach. Alternatively, you could have the manufacturer set the keys, along with setting the pager's internal ID, though that's a major security risk for both official and unofficial escrow (or, as Eric Hughes put it, "an opportunity for simultaneous employment" :-) - user-managed relay from public-key to user's secret-key - instead of paging you, people send public-key messages to your computer (email, web page, etc.), which decrypts and re-encrypts with your secret key. For larger organizations, like the White House Communication Agency or corporate or military groups, this could be run by a shared system which knows all the group's keys. - in either of these cases, you'd probably want to use the shared secret key to exchange a random session key rather than to encrypt the message directly, to reduce known and chosen plaintext attacks. Using RC4 directly doesn't work (known plaintext -> you lose), but can you do things like send IV, and encrypt using (Secretkey,IV) as a key? Or use secretkey XOR IV? Hash(Secretkey,IV) would be better, but probably too slow, though I suppose you could do some cheap hash? traffic analysis questions - if you buy the pager service in cash, it's not very traceable - but how long will this be legal? The relay approaches let your users send you pages without knowing your pager number, which is good, but a phone tap or other eavesdropper can presumably figure out who your relay is sending the message to. Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From anon at anon.efga.org Wed Oct 1 00:44:09 1997 From: anon at anon.efga.org (Anonymous) Date: Wed, 1 Oct 1997 15:44:09 +0800 Subject: Ecash Remailer #1 Message-ID: <2fc89321ff44b393cf69c6c38a291e0f@anon.efga.org> -----BEGIN PGP SIGNED MESSAGE----- Bill Stewart wrote: >At 08:25 PM 09/29/1997 -0400, Anonymous wrote: >>This is a test of the first modern remailer to accept ecash. Sorry for the >>inconvenience. > >Which remailer is it? anon.efga.org? Or something forwarding >through there? Maybe Ian Goldberg would be kind enough to explain? Messages sent to ecash-remailer at cypherpunks.ca with payment pop out at anon.efga.org. That's all I know. Personally, I would like to see the message come from the "ecash-remailer". My guess is that people who pay 25 cents will write more interesting messages. Also, it (or a remailer after it) seems to be eating subject lines, which is less than ideal. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDHlQZaWtjSmRH/5AQGgZQf+IxxZ2Gqw28A/YtsVeqvEoI81z8+2Cznd zqWUUY15RJSqOJpLhhK5XhJriNTgA5kA6encZkl3u3HtiMzj1UK9QWsbYbgQqYGD Ue0XNE7m3R2EExu8q9+xk4Vk1dHyUMzPdBrHGUzFTzKBnfyL/InKirdtFFqZchhn pOZjd1eClDyQskXP6NUIkoc+NSybkw4yBoFgVqcqWUJInxvDRdNQq+aSGL5IZ1ew X1le5FtWviqqRAfkLPhLENRhEmn0Wgr7G6nnlDcOQbh/o8z+fcs7o3aCBmvAJCud Vct6n+FqrDvgmr9Jm0WJXb4gehOb1iE18T7sR9cmPm3FV6WOUXEZVA== =jlTZ -----END PGP SIGNATURE----- From nobody at REPLAY.COM Wed Oct 1 01:07:51 1997 From: nobody at REPLAY.COM (Anonymous) Date: Wed, 1 Oct 1997 16:07:51 +0800 Subject: Secure HTTP servers. Message-ID: <199710010732.JAA25131@basement.replay.com> Jim wrote: > I just started working vfor a local ISP and they found out, i was on > this list and knew a little about crypto. Anyway they seem to have the > impression this would qualify me to know something. At any rate, on to > the point of the mail. Could someone point me in the right direction for > info on secure http servers ?? Also maybe info on which is better than > the other ?? Jim, Congratulations on your new job at Microsoft. For info on secure http servers, you might want to check with Netscape, for starters. Always willing to help out newbies. THE .987 LIE From bbg at dev.null Wed Oct 1 01:09:03 1997 From: bbg at dev.null (Bad BillyG) Date: Wed, 1 Oct 1997 16:09:03 +0800 Subject: Windows 95 -- succinctly In-Reply-To: <9709302122.AA02758@apache.BASISinc.com> Message-ID: <3431F49B.203E@dev.null> Someone attempting to have Mike Denney assassinated wrote: > Windows 95: n. > 32 bit extensions and a graphical shell for a 16 bit > patch to an 8 bit operating system originally coded > for a 4 bit microprocessor, written by a 2 bit company, > that can't stand 1 bit of competition. Anyone with information relating to the original author of the above definition is encouraged to call 1-800-HIT-MAN1, or to contact Microsoft Corporate Headquarters. Please note that the above definition is considered to be proprietary information owned by the Microsoft Corporation and any unauthorized use of the definition will be considered grounds for the offending party and everyone they know to have their web sites rated 'Non-Existent' by the InterNet Content Coalition, as described in Section 178.a, Sub. C-23, of the 'InterNet Secret Government Manifesto' of Sept. 5, 1997. Bad BillyG "Sure, I could tell you what operating system *I* use...but then I'd have to 'kill -9' you." From hua at chromatic.com Wed Oct 1 01:13:19 1997 From: hua at chromatic.com (Ernest Hua) Date: Wed, 1 Oct 1997 16:13:19 +0800 Subject: "I'm a programmer and I vote" Message-ID: <199710010653.XAA17108@ohio.chromatic.com> How about a bumper sticker that says: "I'm a programmer and I vote" Check out: http://www.news.com/Perspectives/tc/tc9_29_97a.html Ern From nobody at REPLAY.COM Wed Oct 1 01:28:30 1997 From: nobody at REPLAY.COM (Anonymous) Date: Wed, 1 Oct 1997 16:28:30 +0800 Subject: Remailers and ecash Message-ID: <199710010759.JAA27558@basement.replay.com> -----BEGIN PGP SIGNED MESSAGE----- Bill Stewart wrote: >Latency is essential to security, though high volume reduces the >latency that's needed to get a given level of security. Latency may be a means to get security in the current remailer design, but it is a means to the end and not the end itself. This doesn't mean we shouldn't use latency to get security, but it is undesirable, like using cinderblocks for construction. The reason I point this out is that it is important to separate design choices to achieve a goal from the goal itself. If we had a remailer network in which each customer had a constant bandwidth connection to one or more remailers, you could have zero latency mail. (Actually, this would be nice to use with those Comsec phones.) It is my understanding that serious naval vessels like aircraft carriers use constant bandwidth channels to defeat traffic analysis. That is, to every place they might wish to communicate, they continuously broadcast encrypted information. Most of the time the channel is empty, of course, but nobody outside can tell when. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDHpnZaWtjSmRH/5AQF2Awf6AoTd0EnojWRoLGsTqVgkZdirRWqFcNNk nYE7Eh455GxPPfsapn/Q811cmzflrC6TUE6sY0sga/hdpQy4IgPsgRDnC5d+LCWR gO8CEwGXkd6Gl3DEduIL2k7eKeuXoZqK1VVgcEnY4Vsci4yJhcl/FLOx5yGcEVNM 850LGQz/PgEg1XhoMpeOkSBh7vtX+nMOyENzALwf11sg/64tKRCCTHfqgfKSn1tC IT6yrZ2NqUvMPxbomZ4U9DPsc0oz0TggrqHQneNWw1lYjzPDpXRn8jiSlalTZcFs kYFeyQQbw23e0Y/Qevtjn8/QngF/4BcyC21mPxaz35U1EwiFV0Lp/Q== =tfWS -----END PGP SIGNATURE----- From cpmd at dev.null Wed Oct 1 16:50:16 1997 From: cpmd at dev.null (CypherPunks Mail Daemon) Date: Wed, 1 Oct 1997 16:50:16 -0700 (PDT) Subject: Please Remove In-Reply-To: <19971001212226535.AAA164@TECH01.wl.net> Message-ID: <3432C2DA.AB4@dev.null> contest wrote: > > Please remove setzer at wl.net from this mailing list Dear CypherPunks mailing list subscriber: Your request has been received and duly noted. In order to complete the unsbiviving process, please reply to this auto-genitalia'd message, putting the secret subscription code number you received upon subrivibing in the Subject header, and sign the message with the official CypherPunks mailing list PGP-signature that you were assigned. If you have lost your secret code number and your CypherPunks mailing list PGP-signature, then you are a lifetime member of the mailing list. As of October 1, 1997, the CypherPunks mailing list will be instituting a $200.00/month charge for subscriptions to the list. Please do not be late with your payment, or we will be forced to ruin your credit rating. A. Hoir Chief CypherPunks Spokesperson -----Begin PGP Signature----- Version 7.3 uuhhh... 8v -----End PGP Signature----- From nobody at neva.org Wed Oct 1 02:06:02 1997 From: nobody at neva.org (Neva Remailer) Date: Wed, 1 Oct 1997 17:06:02 +0800 Subject: The Color of Money Message-ID: <199710010836.BAA24269@mail-gw2.pacbell.net> -----BEGIN PGP SIGNED MESSAGE----- Some might find this entertaining: yesterday the bits at the end of this message were worth $50 for a few hours. It still seems like magic. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html - -----BEGIN ECASH PAYMENT----- oLmQgwATEKGgiqCukIFPkIECkIITiJCBBJCBF5GENDBMUpCENELBUpCBT5KSQ3lw aGVycHVua3MgQ2FuYWRhlJTcAC4Xtq2/aPqJlBJHTQKyJI4zf5SUS3qD875VWBkt FL2RkbAOjZV8n36QgRCShkJvdW50eZKAlICQgRKRhAAAAACQgQChoLigq5CCAimT 4Amz7nuyoT3QLoWR1hPvvNvi27IVA6bC2PLm4qAyqjzuZLm2lcUHN1RiMGggEi64 c++CB5YwNVGW+mEWyG/7dIyj7nEhWQIXw5i0Ewil8XOTDrsQZLASX27iCVXKMYYz H5PgnNABlSEry0skvOzs35JMFPaNdpdcNbgMqp9ondbLWVKhLHu9cnR0LzOw4GW5 T8C6N83Zt/etEXMzevH9s1YwXgnrXR5dSB8pF/y8DdI3ds8k4nOcP+PaHQtvQLKc 1ybnkIICAKGgq5CCAimT4C+av71F2PeFP6vSH8ChCKHDq4gxWau236NbOvgVOi2U qfHJcGGPG19Oys1idq/rabmtiuIZk2D/1XwFKVIM6uNA5qyp3lCJbf4uTbmefPiO Rd9zEEwTLb7a3rRZWZ8gVpPgBSXmRmVqRRJ9gbpq2mg7uk3jo3cPG0fO8jsnJAxa 24CBrDZ5rX4P4mePITGmdWjiTGcxG0L0l37/+vdgpjmPBdMiRe957JopxRPia0z5 tDPbFkCCrw1HOuRgH04JQ7HHkIICAKGgq5CCAimT4DOWSJ9IHElgb6GZ6Fq/J9Q0 OIbdrD/Zh1t4d7DKtRjb3KbFgDP3Rq4Agd5UrdB1vW+R/VOmsU1Kg94E1Q06t5kz l73lCPt35Bfi9hVs2OUrva8cZ/+WyA8BnnFHgYQwnJPgDF434a0TBpSqwRVumU8I bBRVUYi2p1WFhf6XNFDxjinObC3HxBBYY5Kjf+wxhyzRWs03WjB7hYzkQ3JhZ7rN u84llCm081fDbVfRTpu/FizLrhyuK+5ku2ymKnkb2J+LkIICAKGgq5CCAiiT4AG6 T2qzxSMqI3qElt6JXGPv9CYf5DHt1m/PtP/x2YlNIKvdkSWqhgedTxpms4s/Xwbx cMYxXPqIX+dJXmYZO8qs5y9p4wvbYxPwVUDvFzvyEQ5XSuWOBEkfi8WFvLW2rJPg D0mf7dd2n/FQsbtePIMNi78F1aaO99V6v28OrWtFhCblcEWHFr0+AiprbEVNbStV zHbLVx3Gi9ZTiJXdXHjrbUZ0DuFCqSbdRMWWnMor0Y/WEzFFaybzbW9orUsEXlqG kIIBAKGgq5CCAiiT4DAag2QgaLmfoTbPe2tmjHMVS9o/OADfhPpw9KeRwoP6D2kY xWfdpWxdiozsqNccxIOQOlIhXKQh7o8EyBuwupXvLa/sdacAmiMmLJcvdSf2rSTd GGaEfhNqCewo8XsTkZPgkW8pijEll8ZigrE14B9uCMhFeuo0Rv543OiQ+rz875WC 0/MWdDnEGPfqzW4ddoIP4x4vheUbqoh32EoU5iqnOUhMFfWasJUHR2l5piN7BaqZ uERYscEv5uWAxXJHPgrQkIIBAKGgq5CCAiiT4BFwWcDzAwOE7t3feJ2Enu8ElCii sGKyKusqfSsPgMiDgJUO9XXdChKFHDHL2zAThQgfo90oUjZpzC6bDNmZc+pP30fY +qXlRexb9IodmLNlsptm/CGNNezImhqXhk4DIJPgfVhl4xyAxcK3sYMPvpHROTO8 9Hw8lgk3tmjR7Yv3W41jXRWx0Reg8jkMN9qmkMtj7XaGBT7rJUmKxqo3i0IQmbIJ pJ9WLd8b+/PQ+2ChAjEPdRUmONb/jpDdM9xHYtqgkIIBAKGgq5CCAiiT4BLgxWsX n08GH6wQqqlFLA2DYb3RuGNXqD1niSxJZ6npHZudwKoBepKBoL3SLw20knyyLWDo sVvAzdzrkImURLCzHOrG/4ySCiQEPDpX0gOOZNg6s0CbUXfNyyrUswC7MZPgHOjs nnWR0TsZ6/mpDHEJFDnAotIg5/ptZhOJPEHApipSaeXOe36SDuO1ccprlyUBohle 33Y+gz41wPy5YnGSCtA5eSTbyvjGAAHcY+reN4uY4ZqHtz+2dgApwtQ/hF7TkIIB AKGgq5CCAiiT4CPludht9HSpjCQU1UD6aLhhzN2EDt0/MXC5KjadSVUuqm3acKSl P3w5ezmgyk44GeHJcrIllC2VkchqZNE7Ht+3Iql7SIfmXd7G3plWEdRv6AABbFFh uSAvmcG4lkiLIJPgrsdBxSTG8mpGJC8EmfTzfcaMOEUUgqAK7rdi6vbKRQwj9wGb FPhh4weIsv9akjs4AGn3zaiDz39/yEM8j7sUDkvApMALcto3E5DsyKf1kc4i2cSp Ykht7Ups1jfppagDkIIBAKGgq5CCAiiT4A5sRodoGN7TPs2BCIFsG5JN7yRx5a1w EQRKPqkTkkzlyW0N4YV4wxXSZR56FRU1FfzI7A9Zp/cRg4GvKAD9Z/b1cW46YLCf J23ju83zg0O07yBxuJlZ0a8paUpv41TUA5PgJSMD3JNsJE197oVwMP+w1vTMQvVL lGmNzFsFR/RqhRGb9qw76H4+Bz3fKXn5n4vkA6h+QUU1tKxgZcSljv4PLv3Z8UtI H/G2y5SWqr5WJBW3fP6DzuiU1FhOxJ8NZKQKkIIBAKGgq5CCAiiT4BFZiaH+iERB aKq2lmykVilwSR1FtrroQn+zr/DbSc7ihjoV5HUlkjp1PYuSVYJdm2rXrIIBTM0+ V1iMiKW8BgLUBP1lBI7egFmZs4JqVu7nyha/bCE5PkfTuz8XpTDsPZPgbVpEDROA 2XOZde5q25ekhOsMGuOcQWAsf+4a1s9gmu+6ruVBjQST9TBXQxxuk9bSQ9BnyeJq xfMwNuege1T8zPHK6Wnqb9wPiZKp9mK2o8dg34oVESeR0N23ZLom2G9ekIIBAKGg q5CCAiiT4AwATk6Yp3bi0W2bzXD2roTCYGHdkLcn8f7xW8S9odIY3PB8fuike9Km gAdoRCkhQIUiJprS3KvpdruuNXR5YDPf75Ika1jYgt48PcA5YUn0f+yKGKOdbz1Z d7mfC7i2YZPgXNlRVDbgwP/C/9GtDl4X4XiVFlmefs3fW9iRVCdV7t0U0MHMtVS9 HKLHlGYb506JIuoqJsJHxTMBTRv/UPmQDZ49hBwcCjus/ckDz1leSiGK6/MJZHBY UPq+iR0bP3hZkIIBAKGgq5CCAiiT4AFaSUz5Xev5QaCrwcDmlYjMqe+lIXpPV0b+ Qcaa321/cCrO2HYGYY3bSh6h0rwOBDibsZyXCry54tcJzN+j8ABj9iF83aDnqaC+ lVOx/nIvTL8Ph66NY9skJQ6/75MGhJPgfAJikc0uNOhRb7y6xRUFuIZrwVSU1JsB 7WCAt7sObTchO0gaGQarx/P3+ae+F0M9aDGHdCvIXvOyPQ6RzU6BBzQMYS6rdncL eZVFMyXGE5mYTZwOuFKflMSNy98uxc5qkIIBAKGgq5CCAieT4C7Mqwj5SPklubWo CWDeDqNN11rvZr3V9Bo+nLL30+7d6qkrApT+W9lRNVnuMhXp/k2qjdTJeEFqfBWI YdRUoOUeQvGXlluAf6af8bfO0KIw8cxUymqjSV4rmygDPSvGspPgSyCoesCD7AA6 tRWSfHmlg6xxccH+/cV3TDCnQw62C7RBhwBX1hNgz1qlR855Jz7yl43CZTbIOQAw KwSSYCZsJjOCIPr8vFnN7IaqwyTCw0WA+xctNic0jeZI+4+9n2uEkIGAoaCrkIIC J5PgCQZp7ya1hDbyZXcZcx/+XP1y0hfbVYSw0T1YQxB72RSK2JN9JZSiNC5HXhwX c3JvK1QxMopGGsrXw/Iwmggb28tougp1IiIrwqKqAwl3YpJFXuWAjbHACxfd9zZp +GY4k+CP0rtmZnnTH8bvIydGhIUPx7zdjfJevHFJKmPCsellWJF1k+VVxCJcn9cC uQUX9e1mTh6JtjSYihqV9TUztTUwCLAR/jXcs/IwbIoZ6SAT5Gf456Dbi09D4X2d QWqW3FmQgYChoKuQggInk+A0X360KrsNJ25xKl6i/3EiwniTCLz8UxaKJivgDqtL GHKfTtGDyKMXL2pqQTPn7L/Ur8rjPaoCZLn1FnHXuxmvbAcPLViN5FNsvFNaOvRV b/C/vTmnSZ8VA+fd/dcHKRuT4D/9Th133c65QLb9VW8CPKhHLR7l0Vvnh0jdcoU1 PiVkd99gSDzB9kdKCuJRw5KgTNz2jQnmYNk+05wnQonViSLm7014FbF1Pm70qEXC ukIboSTsMcC8TKFnIHm3J/jJ3pCBgKGgq5CCAieT4DDlLgtrD0cRUnpcM2RW0KG8 LM8UQlH5LE6XU6DUPJ9P5sQ06GAk2PDTPpqCpgHS1skDx0AF/gEzZSklRJ1xoCqX xKVLfCLibgXhbYPtiP/3OEsQ60Re4uBAwk98c1nKo5PggKYCx7M6isb6XvSVFCCl kduHtEsdDvAhsCZEl7A+z4qKBAxzRka2jzbPirKtYorToKxMiZIvrFlV7YR0xLLz kkAwXQ0ZalEzccETJXScnepSXeZxKaFTDZLvN+JxoWV9kIGAoaCrkIICJ5PgF878 ZNil1WHCLIaSwbBPNJyPuLnlWz7UTikHLYhoecQC7uxr23p6uFUwRyuq26hRH8zp HDZ0ri9zOQZOJEgaWawK7elopDmOEKZfCBIEx0wlhWI32CugxvrUJ2FUJ8Cck+AF h+tXMEWbbiy0MTI+g0pVnQMvNAccLjOY9qtZM6i1B3Eevu9ifPm04hElc5rLS7Wj 1v409TBWf1sHaNIX+Y1cn3DF+QUS7EzP57Nm2S7XkH77ClkWLed0cF0UfonuqGuQ gYChoKuQggInk+AZ4H8H3yyOeSUh5hcKCafnYOwzTzBkuYU7QNbjM+NOjjlm5l8b Js0PJWxMsc2R51+iEOZHVLEDr8dy5RAXp3SzWd4PfbkrVEmvbthHrHSaB78Dys2W 0AntJ4I9qe0Vo/uT4I7VayCrMfiqFTRewN/rSvSrWGVyJ5UzQEKry6+5PnHT07ev sEfBSpb0WAsv2xFbU3Yj2HKP/xQerG9KaBLDUM27ZrUbwDWTp6Qqm2GUzuxTsD3l id81htGuJvHu0kPfC5CBgKGgq5CCAieT4CEPYMP/nB9t1empzHSLLHhpmhk+DWEw CqU6gq6VAlttN3C6MNO+swiQq/JePYtV9LX6MOwfCVjJDKJSVB08eQnb1kU7SrJB wqWPxtm/ze4qx6PNJdjf8wpfS+z6mWkhspPgDtvm2/haNE3HWPWLYwarCqus+Lwz 8e3R/TuNz4BRlNBenkVhVd2PSOpC+vMej5VplBXffPlHvANC2Q4+w5glZ7CW+DLf Bp/3Vq45F3xtSOXgPcByfHcUPvoYrqSyckdCkIGAoaCrkIICJ5PgMzLfYWK7OwNt Q3AAD2Tb3Mz6BUZD62dP++ZYkFN3IwxU7AaXKGapZwGY3Us21b5gJFRufx1VeRw6 uEdDK6YAB/rQ70BIEc2y2dwD6Jp4xuMrN6dRD+354TV8T5vQWWrbk+ArGn3euMuR m/BOY96cooekaF3VG1FEp7h2uzgzNWU2AHcZO5Un40ZvUkTPLcS51zNInoe0qwNE k3FRtshcctbuO7vuOvOACIo/fjALSuRh9ksXFjGX/RE2wsICHq0ayi2QgYChoKuQ ggImk+AUUkgu47ERmRfJeT3HrVgWXcibtyanpTNjU3uFS+Gz8qM6PoYKJGyalzES PNMKbblz04Q9TYLesL8VYJhg9glu1VuVfa14UnRV10Ixr3iPjfmmLj/ePvJsVWy3 UE2sVlGT4JrnQ161PW7gw3iQeT4Z6oUUioqJVHoNp+meEsPlbt7gJ2qPmTB1Ov/s BLQNvoJ6oyNdt1epNJ5otKs2dvakmCOhaqoDRps3DqhSWCgkC1ztZGu7JAq1cBgX BIuHKlUVZJCBQKGgq5CCAiaT4BYurUasej9P2448ufGF0QHs2O59ZNCByL0VYOBW daGRAqZJrfBt9/oPSVDevifCebxZT4IegZ2sztn2tlh2WdJw97UI/APzGmDOK3PL /Nf/npMAbfZYLwvWtYn8qZsYDpPggFjzD/Hpc8jBtVMmj9Je0AhxBarobrhVDO1g LV+r3VPQFKrf1ioneIQgsbOIoTtTv4QGtdfdD52CwBbaTSMVuACm4sPEcNIv5HRY JdRxyTiIewfwtpnocLh5KMWdj3oOkIFAoaCrkIICI5PgKpbYknSCD4tevc4YGf3R aWU/hDioGvXQvW+mKkAJQwoB1hwVCT2fFNdyC2b950vYF3iDT5Fd9touky4VbfFU Y9u2/mFCCAMTbhqQqBOp8dKsZk1RrZX6gBuxxx36U4WIk99TxeZoVZ2HhP333AFA 1XBX+x2Ge915ro+ksT4PZP7NXasmvIeT0YJ5PYRc9iqKTM0gtRG5yCOggbVWzfOw WjcTA35GQC97TQtJR/XHzy8JmL3Vm+OXUnyOLOtEGcgQJJCBCKGhoQ== - -----END ECASH PAYMENT----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDHrDJaWtjSmRH/5AQG16Qf/Rlaa2nANzsaZx3t8ylmj1vZyv3qIGX0Y Ox/d7k6hJ+GEAZfp7R64bBJiS9tkX9jMhh5C9KEE3mOGUjUtI3isSIpCNssjM+20 ovPkfN8wKxmW+p5tEgd6iQqdVvUS+PrjbIftyGSCCUEMb9csR3ScO+BYicWdwFXD 6+ZBSrl/VY3IDaOKfKQzsRP7ZOnk6QCHYjVm+Mk0O0U0kfTCTBus8YFv+tbsIOJP r220g6pev6WJCHN/Z971yLp0+KuomBYpiDlv5YQB03hrLXajPoezSz97ODJi08uP i9dE9W+nTet8MPtKknH/Qffyxg1xoWsbRuvAKuZDl5ANnDkPzh8HdQ== =/0XW -----END PGP SIGNATURE----- From blancw at cnw.com Wed Oct 1 02:13:15 1997 From: blancw at cnw.com (Blanc) Date: Wed, 1 Oct 1997 17:13:15 +0800 Subject: DejaVu: Cypherpunks as Philosopher Kings Message-ID: <3.0.32.19971001014341.0068afe0@cnw.com> Attila T. Hun wrote: > the sleezeball, who intends to make J Edger look like a piker at > surveillance, has the gleam of unabridged power in his eyes. Louis > F[reeh,uck] is charming, even disarming, as he tells a Congressional > committee: > > "We are potentially the most dangerous agency in the > country if we are not scrutinized carefully." (Jun '97) ............................................................................ Since he says "we are ... dangerous ... if .... we are not scrutinized carefully", I interpret this to mean that he is advising and warning that the agency therefore *needs* to be kept under watchful surveillance, lest it develop to the level of its worst potential. .. Blanc From pooh at efga.org Wed Oct 1 02:25:37 1997 From: pooh at efga.org (Robert A. Costner) Date: Wed, 1 Oct 1997 17:25:37 +0800 Subject: Remailers and ecash In-Reply-To: <199710010759.JAA27558@basement.replay.com> Message-ID: <3.0.3.32.19971001050358.0363ee34@mail.atl.bellsouth.net> At 09:59 AM 10/1/97 +0200, Anonymous (Monty Cantsin) wrote: >It is my understanding that serious naval vessels like aircraft >carriers use constant bandwidth channels to defeat traffic analysis. >That is, to every place they might wish to communicate, they >continuously broadcast encrypted information. Most of the time the >channel is empty, of course, but nobody outside can tell when. > >If we had a remailer network in which each customer had a constant >bandwidth connection to one or more remailers, you could have zero >latency mail. Let me get this straight. You are suggesting that anyone who wishes to be anonymous should send a continuous 24 hour stream of low bandwidth data to a central point in an effort to help keep anyone from knowing that they wish to be anonymous. While this may help correct the latency problem, how do you think this will effect anonymity? Do you think that by sending a continuos stream of data to the remailer, the sender will be less identifiable? -- Robert Costner Phone: (770) 512-8746 Electronic Frontiers Georgia mailto:pooh at efga.org http://www.efga.org/ run PGP 5.0 for my public key From gwb at gwb.com.au Wed Oct 1 17:38:49 1997 From: gwb at gwb.com.au (Global Web Builders) Date: Wed, 1 Oct 1997 17:38:49 -0700 (PDT) Subject: Pauline hanson's One Nation Newsletter Message-ID: <1.5.4.16.19971002102420.2967cf3e@mail.pronet.net.au> Pauline Hanson's Monthly electronic newsletter: October 1997 Issue: 1.3 nsw There are several issues that we would like to cover this month. They are all very important and need your support to create the momentum we need to address the wrongs that are currently taking place in Australia. ___________________________ 1) Petition to the Prime Minister: Firstly please take a moment to sign the on-line petition to the Prime Minister's office demanding that he not be pressured into putting One Nation last on the How to Vote cards at the next Federal Election: The petition is at: http://www.gwb.com.au/petition.html ___________________________ 2) The Canadian experience - Canada is now being divvyed up into independent states. Pauline Hanson's press release at: http://www.gwb.com.au/onenation/press/011097.html looks at the implications to you. The architect of Canada's break up is now living in Brisbane and advising the Aboriginal Central Land Council on how to go about divvying Australia up into a number of Aboriginal States financed by the Australian Federal Government! ___________________________ D O N A T I O N S P L E A S E...... 3) One Nation is growing (we now have nearly 200 branch offices established) and we need you to put your hand in your pocket to keep this growth on course. We have established a web site called 'Take a byte for Australia'. http://www.gwb.com.au/pledge.html We aim to raise $100,000 through the Internet during this financial year. We know that this is a big ask but if you believe that the on-line service provides value and if you would like to help One Nation please 'Take YOUR byte for Australia now'. A gauge will display how well we are going towards achieving this target of on-line donations to One Nation. You can print out a donation form and send it to Pauline Hanson's One Nation head office in Sydney. Donations of up to $100 are fully tax deductable. ___________________________ 4) Important Internet addresses: Pauline Hanson's One Nation: http://www.gwb.com.au/onenation Pauline Hanson's One Nation press releases: http://www.gwb.com.au/onenation/press/press.html The Hanson Phenomenon: http://www.gwb.com.au/hanson.html Archive of One Nation launch and branch launches: http://www.gwb.com.au/gwb/onenation ____________________________ Thank you for your support. From smithh at mwr.kic.or.jp Wed Oct 1 02:40:17 1997 From: smithh at mwr.kic.or.jp (H. Smith) Date: Wed, 1 Oct 1997 17:40:17 +0800 Subject: please send cyberpunk remailing list Message-ID: <3431B69B.3D4CFB0E@mwr.kic.or.jp> Thamks H. Smith From nobody at REPLAY.COM Wed Oct 1 03:20:00 1997 From: nobody at REPLAY.COM (Anonymous) Date: Wed, 1 Oct 1997 18:20:00 +0800 Subject: Remailer Attack Message-ID: <199710010850.KAA03994@basement.replay.com> -----BEGIN PGP SIGNED MESSAGE----- Robert A. Costner wrote: >If Monty would like to send a suitable 486, I'll see to it that it >becomes a remailer. If you would like to send two 486's, I'll see to >it that they both become remailers and at least one of them has a >latency under 60 secs average. Donated machines (stuffed with ecash, >I hope) may be sent to:... I will seriously consider it. Were I to do this, I would like to donate the money to the EFF, preferably through an ecash payment. Then, you can buy a 486 you consider to be suitable. Also, donations to the EFF are tax deductible, are they not? What would be the odds of naming it the "Cantsin Remailer"? Just curious. ;-) The more I think about affinity remailers, the less off the wall they seem to me. It would really be rather neat if EFF supporters could send a message through your remailer and then have the outgoing message stamped with the amount contributed. For those operating anonymously it buys a mild amount of credibility, but you could also imagine people sending non-anonymous messages through it: "See everybody! I gave $100 to the EFF!" The publicity alone would probably be worth it for the first organization to start doing this. It should be good for a few newspaper articles. And it's certainly a novel and fun way to raise money. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDHh/ZaWtjSmRH/5AQFVWwf9HS0YNywx71oHR3mS7BzPQcIjmWpkxhs5 8f99d+obelQ1Wpxmnxnv/9a4hX2HmPS1ZVJXYjgxUmDARiMtR1kQBEGBX82Mlrv6 w4VGEvBUM5Kc41eKLgm2E9pjaeN3uyUvXXk3S+cPkIcNCp4KrzzM1fA/COwwXk3u aI4ke/aAoJrmql09guIlH5K5D1fNjN5npnipy50OqB+hSarZZZeKTJY7XLDX2BE7 Cuvz1dVoC4WulmoKxUuCv6emsR8jSAMW05N2QoY/+c+SZwnMLMz80qXTSELO0gXl L4EYMHYNgwF396oYKSB1uDBNytJX8GadgtIm/jOJbGIuUctPvifzBA== =1a6m -----END PGP SIGNATURE----- From lutz at iks-jena.de Wed Oct 1 05:20:32 1997 From: lutz at iks-jena.de (Lutz Donnerhacke) Date: Wed, 1 Oct 1997 20:20:32 +0800 Subject: Secure HTTP servers. In-Reply-To: <3431DF24.E4E9C578@one.net.au> Message-ID: <199710011148.NAA01115@taranis.iks-jena.de> In iks.lists.cypherpunks, you wrote: >the point of the mail. Could someone point me in the right direction for >info on secure http servers ?? Also maybe info on which is better than >the other ?? Secure HTTP ist the HTTP protocol based on SSL sockets. You may choose any server you like or which fits your needs (database connections, ...). There are not so many cryptographic failtures a developer can do. Keep you hands away from servers only supporting exportable protocols. Ask you next Certification Authority for help, they must support your server software. (we do run one ;->) From ravage at ssz.com Wed Oct 1 05:28:19 1997 From: ravage at ssz.com (Jim Choate) Date: Wed, 1 Oct 1997 20:28:19 +0800 Subject: Forwarded mail... Message-ID: <199710011236.HAA18770@einstein.ssz.com> Forwarded message: > Date: Wed, 1 Oct 1997 09:59:23 +0200 (MET DST) > From: nobody at REPLAY.COM (Anonymous) > Subject: Re: Remailers and ecash > It is my understanding that serious naval vessels like aircraft > carriers use constant bandwidth channels to defeat traffic analysis. Got a reference on this? All my experience (setting up networks and providing technical support during Desert Storm) and references indicate they use SS and burst transmitters for this. An aircraft carrier with a continous CW is a sitting duck. It's like being a grunt and wearing a floodlight. Consider, if you can use the transmissions to strike the target who cares what they are sending now, they won't be sending anything in a couple of minutes. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Wed Oct 1 05:37:45 1997 From: ravage at ssz.com (Jim Choate) Date: Wed, 1 Oct 1997 20:37:45 +0800 Subject: INFO-RUSS: Reuters: Threat to West (fwd) Message-ID: <199710011243.HAA18892@einstein.ssz.com> Forwarded message: >From INFO-RUSS-request at smarty.ece.jhu.edu Tue Sep 30 23:10:03 1997 Message-Id: <9709302124.AA14693 at smarty.ece.jhu.edu> Errors-To: INFO-RUSS-request at smarty.ece.jhu.edu Sender: INFO-RUSS-request at smarty.ece.jhu.edu From: info-russ at smarty.ece.jhu.edu To: info-russ at smarty.ece.jhu.edu Date: Tue, 30 Sep 1997 17:05:10 +0100 Subject: INFO-RUSS: Reuters: Threat to West Priority: normal --------------------------------------------------------------------- This is INFO-RUSS broadcast (1200+ subscribers). Home page, information, and archives: http://psi.ece.jhu.edu/~kaplan/IRUSS/inforuss.html To post, or to subscribe/unsubscribe, mail to info-russ at smarty.ece.jhu.edu INFO-RUSS assumes no responsibility for the information/views of its users. --------------------------------------------------------------------- [ Reuters New Media] ---------------------------------------------------------------------------- Monday September 29 9:06 PM EDT Russia Crime Crisis is Threat to West - Report By Jim Wolf WASHINGTON (Reuter) - Russia is an increasingly unreliable partner on international issues because of the power of corrupt officials, crooked businessmen and organized crime, a U.S. public policy research group said Monday. A panel of the Center for Strategic and International Studies (CSIS) said criminalization of its economy would make normal state-to-state relations with Russia impossible if left unchecked. Some 200 Russian organized crime groups operated worldwide after thrusting their "tentacles throughout Russia's economy" and gaining the ability to manipulate its banking system and financial markets, the CSIS panel said in a report. It said the erosion of legitimate government authority in Russia endangered international efforts in peacekeeping, nuclear non-proliferation and economic restructuring. "The most important, and perhaps the most significant and troubling finding of the task force, is that, at the level of state-to-state interaction, it will become impossible for the United States and other states to have traditional satisfactory dealings with an emergent Russian criminal-syndicalist state," the CSIS panel report said. It defined such a state as one shot through with bureaucratic corruption, full-time "professional criminals" and businessmen for whom existing Russian law was simply an obstacle to be overcome. "In many respects such a criminal-syndicalist state already exists in Russia today," said the CSIS panel, citing government, business and academic leaders. It said corruption that pervades "every level of Russia's bureaucracy" was the major hurdle to thwarting organized crime there. William Webster, who headed both the Federal Bureau of Investigation and the Central Intelligence Agency in the 1980s, was chairman of the steering committee under which the CSIS report on Russian organized crime was prepared. In a preface to the report, Webster and Arnaud de Borchgrave, the CSIS Global Organized Crime project director, said roughly two-thirds of Russia's economy was already "under the sway" of crime syndicates involved in protection rackets. "The majority of private enterprises and commercial banks are compelled, by force if necessary, to pay protection in the amount of 10 percent to 30 percent of their profits" to organized crime groups, it said. The CSIS panel urged President Clinton to describe Russian organized crime publicly as a threat to U.S. national security, notably because of the danger of losing control of its nuclear arsenal. It said the United States should prod partners in the Group of Seven rich industrial nations to discuss an investment treaty to deny export credits to Western firms doing business with organized-crime controlled firms in Russia. ---------------------------------------------------------------------------- From ravage at ssz.com Wed Oct 1 05:41:04 1997 From: ravage at ssz.com (Jim Choate) Date: Wed, 1 Oct 1997 20:41:04 +0800 Subject: INFO-RUSS: Reuter: Russian+Russian Drug Cartels (fwd) Message-ID: <199710011242.HAA18855@einstein.ssz.com> Forwarded message: >From INFO-RUSS-request at smarty.ece.jhu.edu Wed Oct 1 00:10:46 1997 Message-Id: <9709302124.AA14700 at smarty.ece.jhu.edu> Errors-To: INFO-RUSS-request at smarty.ece.jhu.edu Sender: INFO-RUSS-request at smarty.ece.jhu.edu Precedence: bulk From: info-russ at smarty.ece.jhu.edu To: info-russ at smarty.ece.jhu.edu Date: Tue, 30 Sep 1997 17:09:10 +0100 Subject: INFO-RUSS: Reuter: Russian+Russian Drug Cartels Priority: normal --------------------------------------------------------------------- This is INFO-RUSS broadcast (1200+ subscribers). Home page, information, and archives: http://psi.ece.jhu.edu/~kaplan/IRUSS/inforuss.html To post, or to subscribe/unsubscribe, mail to info-russ at smarty.ece.jhu.edu INFO-RUSS assumes no responsibility for the information/views of its users. --------------------------------------------------------------------- [ Reuters New Media] ---------------------------------------------------------------------------- Monday September 29 9:06 AM EDT Post: Russian Mob, Drug Cartels Joining Forces WASHINGTON (Reuter) - Russian organized crime groups, flush with dollars, are forming alliances with Colombian drug traffickers in the Caribbean, acquiring cocaine for delivery to Europe and providing weapons to Latin American mafias, The Washington Post reported Monday. The newspaper, quoting U.S., European and Latin American law enforcement officials, said the Russian groups were also opening banks and front companies across the Caribbean, largely using them to launder millions of dollars from drug sales and other criminal activities. The officials were quoted as saying that the growing alliances between Russian and Colombian criminal organizations were the most dangerous trend in drug smuggling in the Western Hemisphere. Barry McCaffrey, the Clinton administration's national drug control policy director, said the Russian groups were among the "most threatening criminal organizations based in the United States." The newspaper quoted him and other sources as saying that the Russian groups offered drug cartels access to sophisticated weapons and brought access to new drug markets in the former Soviet Union at a time when consumption was falling in the United States. The sources told the Post recent undercover operations had detected attempts by Russian groups to sell Colombian drug traffickers a submarine, helicopters and surface-to-air missiles. From pooh at efga.org Wed Oct 1 07:49:28 1997 From: pooh at efga.org (Robert A. Costner) Date: Wed, 1 Oct 1997 22:49:28 +0800 Subject: Remailer Attack In-Reply-To: <199710010850.KAA03994@basement.replay.com> Message-ID: <3.0.3.32.19971001102751.033e8a64@mail.atl.bellsouth.net> At 10:50 AM 10/1/97 +0200, Anonymous (Monty Cantsin) wrote: >Were I to do this, I would like to donate the money to the EFF, >preferably through an ecash payment. Then, you can buy a 486 you >consider to be suitable. Also, donations to the EFF are tax >deductible, are they not? > >What would be the odds of naming it the "Cantsin Remailer"? Just >curious. ;-) I'm sure a remailer could be named the Cantsin Remailer if you donated the equipment for it. Yes, I understand that donations to EFF are tax deductible. However, I don't know where EFF stands on remailers, or what they would do with the ecash you send them. If EFF does not want to become involved in a remailer with you, then you still have the offer to send the donation to EFGA if you would like. -- Robert Costner Phone: (770) 512-8746 Electronic Frontiers Georgia mailto:pooh at efga.org http://www.efga.org/ run PGP 5.0 for my public key From frantz at netcom.com Wed Oct 1 08:21:05 1997 From: frantz at netcom.com (Bill Frantz) Date: Wed, 1 Oct 1997 23:21:05 +0800 Subject: Why? (fwd) In-Reply-To: <199710010249.VAA17613@einstein.ssz.com> Message-ID: At 7:49 PM -0700 9/30/97, Jim Choate wrote: >My original question still stands, why would I or any other party choose to >use an anonymous remailer for anything other than the original 3 items I >mentioned previously. Black Unicorn uses a nym to express opinions he expects his coworkers and acquaintances would not like. Anonymous remailers can be used for the same purpose. I have heard of people's posts being brought up in employment interviews. A rational person might want to express controversial opinions anonymously. ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz at netcom.com | nation it is today. | Los Gatos, CA 95032, USA From anon at anon.efga.org Wed Oct 1 08:21:19 1997 From: anon at anon.efga.org (Anonymous) Date: Wed, 1 Oct 1997 23:21:19 +0800 Subject: Remailers and ecash Message-ID: <46ee864da2b5a3279142ba5c3ce1deea@anon.efga.org> Using a remailer doesn't hide the fact that the sender is using a remailer. An eavesdropper who monitors incoming messages to the remailers can easily learn who is using them. A constant bandwidth connection will at least disguise *when* the messages are sent. From toto at sk.sympatico.ca Wed Oct 1 08:27:42 1997 From: toto at sk.sympatico.ca (Toto) Date: Wed, 1 Oct 1997 23:27:42 +0800 Subject: InfoWar 26 / TEXT Message-ID: <34326150.500A@sk.sympatico.ca> ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * Everything You Know Is Wrong ---------------------------------------------------------------------------- Everything You Know Is Wrong ---------------------------------------------------------------------------- "I think that we're all Bozos on this bus!" Alexis glanced at Bubba Rom Dos with a worried look showing on her face. Was he drifting back toward Never-Never Land as a result of a fresh backlash of InformEnergy from their renewed use of the Trei Transponder? "Don't crush that dwarf, hand me the pliers." the Cowboy said, seemingly in response to Bubba's strange statement. Bubba and the Cowboy sat grinning like banshees at each other and Alexis, but she couldn't discern whether their lunacy was their 'normal' lunacy, or the 'abnormal' lunacy coming from a hundred years in the past, compliments of Peter Trei and ? the Lunatic. Alexis threw up her hands, and said, "I give up! Are you you crazy, or are you him crazy?" "Firesign Theater crazy." the Cowboy responded, with a chuckle, as if that was supposed to mean something. Alexis was happy to see Priscilla, d'Shauneaux and Melissa approaching, thinking that there was safety in numbers when faced with the combined mirth and madness of Bubba and the Cowboy. Still, she couldn't resist saying to the three as they approached the table, "I think that we're all Bozos on this bus!" As the three gave Alexis a puzzled look, Cowboy added, "Don't crush that dwarf, hand me the pliers." Bubba rose to speak to the assembled group, but d'Shauneaux stopped him short with a wave of his hand. "Hold it!" he said, abruptly. He reached for the Jack Daniel's, poured the three newcomers a shot, knocked back his shot and poured himself another, tipped his hat to Bubba, and said, "OK, Bubba. Damn the torpedoes, full speed ahead!" Priscilla and Melissa hurriedly knocked back the shots of bourbon sitting in front of them, as if failing to do so would result in their being left vulnerable to the unspeakable evil that was the inevitable result of remaining sober during one of the grizzled sage's grand monologues. Bubba nodded to the group, gave himself a hitch in the crotch, lifted his arms upward and outward, as if blessing the masses gathered at the base of the Holy Mount, waiting for the Word from On High, and told those gathered before him, "Everything you know is wrong!" The small assembly looked at each other, nodded in agreement that this was obviously one of the great truths of life that everyone instinctively knew was true, but which nobody would ever be able to explain, and they rose as a group, as the Cowboy said, "Well, that's all for today. Let's go home�" "Sit down!" Bubba commanded, trying to look offended. As the group retook their seats, Jonathan arrived, saying, "Bubba, are you about to explain one of those things that is unexplainable, and draw us into your sticky web of beyond the fringe reality, convincing us, once again, that we actually understand and agree with your madness?" Bubba looked hurt. "Of course not. You're much too smart for me to even hope to accomplish such a thing." He pushed the bottle of Jack Daniel's toward Jonathan with a grin and a wink. "I am hoping to accomplish this devious task with the Magic Circle and CypherPunks who currently stand at a crucial point in history where their actions have the potential to make a difference between a Global Electronic Renaissance taking shape, or a Fascist ElectroMagnetic Curtain slamming down around them, imprisoning all on earth within a virtual reality that will be structured and controlled by a privileged few who pay tribute to the diablerie of their own opportunistic self-interest." Bubba paused to gauge his small audience's reaction, thus far, and decided that he was on a roll and could pull out all of the stops. He sat down, poured himself a shot of Jim Beam, and leaned over to whisper to his coconspirators in their desperate fight against the tide of history and humanity which strove to sweep them into the great ocean of group mind. "Everything you know is wrong�" he whispered, his eyes taking on a great sadness that swept over those gathered with him around the old oak table. "�which is why we laugh." he added, breaking into a melancholy, ironic grin. "All truth lies in comedy." the Cowboy interjected, with a slightly less sad smile, indicating that the theme for the day was going to be "The only way out is through.", meaning that he and Bubba were about to help them step into a world where reality lay on the other side of the laughter or lunacy, the happiness or sadness, the Yin and the Yang of every conceivable thought, belief and emotion imaginable. "George Carlin said it best." Bubba nodded to the Cowboy, thanking him for his support in treading boldly into the arms of the illogical in a journey toward the unthinkable. "I make my living telling people things they already know, but forgot they knew." Bubba quoted the Zen master of uncommon sense. "Lenny Bruce also said it best." the Cowboy added, proceeding to stand and pace like a junkie speed-freak whose feet were trying to keep his brain in close proximity to his racing mind, "People tell me 'You're Jewish. You killed Jesus.' I tell them, 'Hey, it was a party, it got a little out of hand.' "Lenny Bruce was Jesus." the Cowboy continued. "That's why he was crucified by the Pharisees of his time, as Jesus was in his own�they both spoke the truth and refused to renounce their own perception of reality. "This is why the CypherPunks will be crucified as well." the Cowboy touched Jonathan gently on the shoulder, knowing that this statement would cause him to relive some of the tempestuous memories of his childhood. "And the Author also said it best." Bubba lightened the atmosphere a bit. "There's no niggers left in Oakland, babe, and all my lies are true." The small group laughed, remembering one of the legends surrounding the Author, who was, in one of his incarnations, the King of Country Porno. It seems that he was in Africa, serving as a bodyguard for a group of white Berkeley intellectuals who spent all of their time hanging out in the tourist areas where they ran little risk of running into too many of the original citizens of the country they were visiting. At night, the Author would cruise the city proper, seeking good booze and good music. He was in a beer and music hall holding close to a couple thousand party animals, all of whom were of a different pigmentation than himself, and the band that was playing, upon learning that he was a musician, invited him to get up and sing a few tunes. He had launched into "All My Lies Are True," not realizing, until he approached the chorus, that the last line might be considered politically incorrect in certain circles. The Author bit the bullet, and sang it the way he wrote it. "I just talked to the President and he sends you his regards. And Willie Nelson told me he wants to make you a star. They just found Howard Hughes' real will, and he left it all to you. There's no niggers left in Oakland, babe, and all my lies are true." "So why wasn't the Author crucified, if he also spoke the truth, as he saw it." Alexis asked the question which everyone immediately recognized as something they were also wondering about, but forgot that they were, until she asked it. Bubba grinned, and told them all what they already knew. "Because�he was crazy." The small group all slapped their foreheads. "We knew that!" they said, in unison, and then broke out in laughter. Bubba stood, once again, to explain some of the oddities of the era they were currently studying, saying, "People who spoke the 'uncomfortable' truths that no one wanted to hear were generally classified as 'crazy' and given special dispensation, since nobody paid any serious attention to them. "Claiming to be Jesus, or to be speaking for this or that God, got you hospitalized or ignored," Bubba continued, "unless you gathered a following who believed you." The Cowboy spoke up, saying, "David Koresh, the messiah from Waco was really no different from a number of other self-proclaimed saviors of his day, except that he was claiming to be Jesus, in the heart of the Bible belt, and he had black followers agreeing with him. It is an anathema to claim to be Caesar, in the heart of Rome, as well. "People want to worship symbols. They wish to worship 'from afar.' If they are faced with the embodiment of their beliefs, then they are forced to confront their beliefs, and to act on them. If someone appears whose presence threatens to force you to face yourself, your hopes and dreams, your fears and shortcomings-then you have to kill them." The group sat in silence�each contemplating in their own way the things that the Cowboy had just spoken of. "The comedians of the Author's time were similar to the Fools in the courts of the Kings, were they not?" Alexis asked Bubba. "Very astute, my dear." Bubba lifted his shotglass in toast to her. Then he proceeded, saying, "The Fool in the royal court was granted a special dispensation to relieve the stress that comes with political intrigue. The Fool was allowed to speak the unspoken truths which were known to one and all, but which had to remain unspoken in daily life so that secret foes could remain public allies in their alliance against their public adversaries. "Likewise, the comedians of the Author's time," Bubba said, "were allowed to 'poke fun' at the sacred cows and authorities of their day, although it was an open secret that they were, in reality, 'poking truth' at the object of their humor." "The CypherPunks," Jonathan broke in, "were originally the equivalent of the Fools in the King's court." "They appeared on the cover of 'Wired' magazine, early in its existence, wearing hockey masks with bar-code numbers, and the like, on them." "Wired Magazine," the Cowboy explained, "was one of the first public indications that, not only was it true that 'The Medium is the Message,' but also that the operant, or user, was the medium. "The Department of Defense had designed the InterNet to consolidate the communications of the scientists and intelligentsia of their era, supposedly in the interests of security, but actually in the interests of control of and access to those communications. The development and dissemination of this cutting edge technology via the system of higher education of that era, meant that both the structure and the use of the technology were being influenced in a major way by youth who stood halfway between the foolishness of childhood and the seriousness of adulthood." Priscilla, the designated 'mother' of the group, picked up the thread of logic, instinctively knowing where it was going, although she knew little of the details surrounding the technology of the era being discussed. "We have to remember that the time period we are discussing was a transition point between the education of the masses moving out of the hands of the state and into the hands of the media. The governments of the time had gone to great trouble to use the media as a tool to reinforce the role of the education system in turning out well-formed cogs in the wheels of society. "Even those parents who still strove to keep the ultimate results of their children's education and the development of their belief systems in their parents own hands, little realized that their own values and beliefs were mostly the end product of public education and media reinforcement of those same values and beliefs." Jonathan, being more familiar with the details of the educational system of that period, backed up Priscilla's statements, by adding, "Quite so." "As Priscilla has pointed out, as the end of the millennium approached, the preceding generations of adults had been increasingly programmed by a benevolent system of 'free' education which had as its aim the alignment of psychological development of the masses with the goals of the industrial revolution. "The benefits of the printing press and the factory for society meant that they were seen as 'good' and of 'value,' which led to a common error that has been perpetrated throughout history, namely, turning what was seen as 'good' into a 'god' and proceeding to institute and worship it in every area of daily life. Public education was promoted as an efficient way to give the benefits of equal intellectual and societal development to the commoners, through structuring the education system around the 'mass production' techniques which had proven to be beneficial in many ways in the arena of industrial technology." "In many ways," Jonathan continued, "the system of public education was of benefit to both society and the individual." "Unless you were a 'round peg,' in a society that had established 'square holes' as the 'standard' of the time." Bubba cut in. "Exactly." Alexis agreed, picking up the thread of the conversation from the perspective of the anomalies of that time period, according to the areas she had been investigating. "And throughout history, the role of adults has largely been to shape the round eggs," she paused to let the others recognize her subtle humor, "into a shape which would fit the particular sociological-religious-political structures of their day. "I can see where Cowboy is leading with his indication that one of the defining features of the InterNet, which made the Digital Revolution it launched vastly different from the Industrial Revolution which proceeded it, was that it was now the youth who were shaping the technology of the medium of the future." "Yes!" the Cowboy got up and walked to where Alexis was sitting, giving her a kiss on the forehead and then hugging her. He turned to the rest of the group, and continued from where he had left off. "The advances of the Industrial Revolution had made possible the development of the computer. However, the original computers suffered from their propensity for the software written for them being molded to fit the design of the physical product. In short, the machines produced were just that-machines. "One of the reasons the Author attributed to his becoming a computer guru in an amazingly short period of time, was his entry into the computer arena as the apprentice of Bill Campbell, one of the designers of the Adam motherboards, and the Authors work with retarded children early in life." Bubba broke in, to explain, "At the time, the general consensus in the industry was, 'Computers can't think.' Even during his initial learning stage in the computer arena, the Author always rebelled against this view. "His would always protest, 'Of course they can think! They think like retarded children.' And then he would proceed to recount a period of time when he received room and board from a woman who also had boarders who were outpatients from a local mental health facility, and who were considered mentally deficient. "He would tell of a fellow boarder, Paul, to whom the lady of the house would say, 'Paul, please take out the garbage.'" Bubba smiled along with the others, as they all knew the story, but always loved to hear it again. "The Author would then tell those listening to his analogy, 'After a few minutes, the lady would stick her head out of the doorway, and holler, "Paul�come back!"'" The small group broke into laughter, although they had heard the story many times in the past. The Cowboy spoke up, telling the others, "My research has indicated that the first computer software was a dismal failure, because the programmer had merely programmed it to 'go.' After he had sold it to 'a billionaire to be named later' it was rewritten to add, 'come back' to the command structure, and computer software was born." "Like the 'find' command, in UNIX." Jonathan laughed at the memory of his own foolishness. "Upon hearing that it was one of the most powerful and useful commands included in the operating system, I spent a considerable amount of time 'book-learning' all of the intricacies of the command. When I applied the results of my efforts to use of the command on the computer, itself, however, nothing ever seemed to happen. "My mentor was watching me entering all of these complicated, esoteric commands designed to do this, or that, only to have the end result once again be an empty prompt staring back at me from the computer screen. He leaned over me, calling up my last command, and added the '-print' option to it." Jonathan laughed at the memory. "As he walked away, with my screen scrolling madly, reporting the voluminous results of the command, he smiled and said, 'come back.' Point taken�" Bubba rose, once again, to continue his dissertation to the group. "Which brings us back to my original statement." Bubba nodded to Jonathan for his contribution to the thread of the conversation. "Despite having spent a great deal of time and effort in 'learning by rote' the details and intricacies of the 'find' command,' everything Jonathan knew was wrong. "Why?" Bubba challenged the assembled members of the Magic Circle. "Because what he had learned didn't do him any good." Priscilla spoke up. "He didn't know the importance and the purpose of the various aspects of the command whose details he had memorized." Alexis suggested. Bubba looked to Jonathan, who had told this story before, without ever really seeking the true lesson which it potentially held for him. "I was expecting to be spoon-fed." Jonathan said, in awe of what he had just realized. "Yes!" cried all of the small group, at once. The tattered remnants of the Magic Circle each sat quietly, writing, typing, or thinking about the full implications of their discussion, so far, on the possibility that, as Bubba and Firesign Theater had informed them, everything they knew was wrong. "Everything you know can be as right as rain," Alexis pointed out, "until you take a step back, and a step to the left�and then it is all wrong." Jonathan scanned what he had written on the GraphiScreen and added, "You may be the consummate master of hand-to-hand combat, but if you bring a knife to a gunfight, then everything you know is wrong." The Cowboy laughed, understanding perfectly the line of thinking that had at one time been used in Texas as an argument for the superiority of one race over another. "AND, OR, IF!" All eyes turned to the Cowboy. "After 'GO' and 'COME BACK' had been established as the essence of computer programming," he smiled, "the 'retards' in charge of programming computers began to get fancy, including the basics of elementary logic in their programming structures. "They began to realize that 1 AND 0 would inherently return results that were different from 1 OR 0, in certain situations. Upon recognizing that the same command would return different results in dissimilar situations, then they began to realize the power of being able to qualify the command with IF." "And for many years," Bubba added, "these 'geniuses' became the elite of the computer industry for their ability to say AND, OR, IF, at a much faster rate than the pencil-pushers were able to do. "While ridiculing the idea that a 'mentally retarded' member of their society could be classified as a genius for deciding that 'IF' his hand hurt like hell when he told it to 'GO' to a hot burner on a stove, 'THEN' he would remove it, they nonetheless held themselves and one another in high esteem for their rudimentary ability to write code that said, "IF I>0�" Those gathered were laughing at Bubba, at each other, and at themselves, as they recalled the passage from "The Xenix Chainsaw Massacre" which said, For men...it's like sex. You get half-decent at it, and you think you goddamn invented it. You look at those poor fools passing by on the street below and wonder what they would think if they knew you could make the variable 'i' count to a hundred, in increments of two, nonetheless, (or four, or ten, or whatever I decide---I have the power, the watch will do my bidding). But you could never explain it to them, they wouldn't understand. They don't have your knowledge. Or Power. It's a Secret that mere mortals can't fathom Priscilla, having become enamored with the rise of the FemiNazis in the Author's era, could not resist mentioning, "As long as computers remained the exclusive domain of the male members of the species, their development was basically limited to the production of 'bigger and better' penises, which performed at increasingly faster rates of speed." Alexis, seeing the chagrin of the male members of the group, backed up her mother's perspective by adding, "It wasn't until the female members of the tribe began to educate the male members that bigger and faster was not necessarily better, not only in sexual matters, but also in the realm of computer technology," she paused to receive a high-five from Priscilla, "that computers began to become somewhat useful for serving humans, rather than humans increasingly adapting their lifestyles to fit the design of the machine." "Yes�yes�a thousand times, yes!" Bubba roared, toasting the ladies, who returned his toast with an appreciative smile. Nonetheless, Bubba could not resist adding, "Now shut up and quit butting into men's business." After the women had finished pelting the old coot with ice cubes from their water glasses, Alexis returned Bubba's belittlement, kind for kind. "Yes, Priscilla," Alexis said, "we should let the man wearing the dress have the floor." Bubba smiled, smoothed his robe as if he was a debutante at her coming-out party, and continued. "Although both women and men were capable of fighting for survival when faced with a hostile world, the men tended to become the warmongers of various societies, since the hormones of the homo sapiens seemed to lean toward 'fight' in the males and 'flight' in the females. Thus the males tended to fight aggressively, to 'conquer' new territories, and the females tended to fight defensively, in order to 'defend' their territory, when it was invaded. "This was reflected in their respective roles in procreation," Bubba pointed out, "wherein the males would seek to penetrate the inner space of the woman, and the woman would seek to limit access to the inner parts of her physical being by exercising the power of personal choice as to who she would allow to penetrate her physical space and, therefore, her inner being." Alexis spoke up, saying, "Is it time for the children to leave the room?" "No, dear, you may stay." Bubba responded, winking at her. The Cowboy got things back on track by asking Bubba, "Wasn't the Author's era a time when humanity began moving past enslavement to the physical attributes of their bodies and their hormones, and toward accessing both the Yin and Yang aspects of the potentials that they all shared in common?" "Yes." Bubba stated, happy for the opportunity to move the discussion back toward the original starting point of the dialogue he had engendered. "To everything, there is a season. And a time to every purpose, under heaven." Bubba declared. "The Byrds." Jonathan said, then adding, "Or the Bible, if you are the religious type." "Exactly!" Bubba recognized the unwitting flow of the Tao in Jonathan's statement. "Everything you know is wrong." "When Jesus was the popular figure of the day, then one was 'right' in attributing the statement to the Bible. "However, once the Beatles became more popular than Jesus," Bubba was humorously referring to one of the meaningless, but important, ten-second sound bytes of the Author's era, "then attributing the statement to a musical group called the Byrds was 'right.'" "Does the warm or the cold water lie at the top of the lake?" Bubba asked, rhetorically. "It depends on the time, the place, and the season." "Twice a year, the lake turns over, with the warm water rising to the top, and the cold water sinking to the bottom, or vice versa. So no matter how 'right' you are at any particular point in time, then hours, seconds, or minutes later, you may be 'wrong.'" Bubba was about to bring his arguments full circle, bringing great metaphysical meaning to the things they had been discussing, but he realized that his mind had gone blank, and he could not remember what his original point had been. He motioned for the Cowboy to proceed. The Cowboy laughed, picking up the thread that Bubba had left hanging in mid-air. "Everything you know is wrong�why?" "Because the universe is in motion, and knowledge is static." Alexis replied. The Cowboy nodded his appreciation to Alexis for cutting to the heart of the matter. "Jonathan mentioned that the problem he had with the 'find' command in UNIX was the result of his studying the details of the command, but expecting to be 'spoon-fed' the results. "At the tail end of the Industrial Revolution, when the education of the masses had been brought into alignment with the goals of the mechanization of society, the common view was that survival was now contingent on fitting in as a cog of the societal and governmental machines that had been created. "No longer was evolution and adaptation to a changing environment the secret to survival. Now, survival was contingent upon forcing the environment to fit into the structures that society and government had created in order to bend the universe to the will of mankind. And the survival of the individual within the society was therefore contingent upon staying within the confines of the defined societal and governmental structures of the day." "In the society that came about as a result of the Industrial Revolution, 'jigs' became the rule of the day. If the 'jig' in the factory required you to put a square peg in the square hole, in order to turn out a final product, then you did so. If all you had was round pegs, then you 'adjusted' them into the shape of a square. "The public education system of the Author's time was geared toward shaping the future adults of society to fit properly into the 'jigs' that had been designed to produce a pre-designed end product. Upon entry into the educational system, the children were ill-suited to being fitted into a slot of a particular size and shape, but they were 'broken down' and 're-formed' to fit their predestined slots in life, over a period of time as they advanced through the educational system." Bubba noted, "And if they failed to be broken down and 're-formed' by the regular educational system, then they were sent to 'reform school.'" The Cowboy laughed at his mentor's astute observation. "The Medium is the Message." the Cowboy reiterated one of the themes of their current discussion. "And the medium of the Industrial Revolution was the 'jig' which enabled mass production by turning the labor of the masses into a no-brainer." "Yes!" Bubba jumped to his feet, rejoining the land of people with functional brains. "Until the Industrial Revolution was overtaken by the Digital Revolution." Bubba was in his element, once again. "The technology, and thus the structure, of the Digital Revolution, was very much in the hands of the youth of the day, who were progressing from childhood to adulthood in a system of higher education in which they were the hands and feet of the intellectual elite of that point in history. "The InterNet was designed by the DOD to facilitate the efficient exchange of ideas and information between the scientific titans of the era, as well as allowing those in charge of the technology to monitor and manipulate both the source and ultimate directions that this sharing of InformEnergy would take." "They didn't realize that they were dealing with InformEnergy, did they?" Alexis asked, beginning to realize why it took so long for those using the technology of the Digital Revolution to begin to understand the true power of the forces they were dealing with. "No, Alexis, they didn't." Bubba motioned for the Cowboy to explain further. "The youth of the day understood the essence and potential of the technology that they were working with." the Cowboy stated. "But the dinosaurs in positions of power and authority, who failed to realize that the Industrial Revolution was coming to a close, thought of the InterNet as a way to pass data, and information. When the government of the US began to recognize the enormous potential of the InterNet, they promoted it as the 'Information Highway,' never suspecting that their children, who were still capable of creating and shaping their world in tune with their own ongoing growth processes, saw it, not as a tool to manipulate static information and data, but as a living, breathing entity, which would ultimately endow the static information of their forefathers with the energy which they, themselves, generated by the methods and processes they chose to employ in the use and development of the technology and the media, itself." "We make our gods, and do battle with them�and they bless us." Bubba quoted one of the sages of the Author's era, Herman Hesse. "Interactive media!" Jonathan exclaimed, realizing for the first time the full import of what this early InterNet aphorism implied. "Precisely." the Cowboy agreed with Jonathan's unspoken train of thought. "Bob Dylan, one of the poets of the Net-Generation's parents, had said something to the effect that those who aren't busy living, are busy dying. "The parents had heard, and understood, the poets of their time, during the flower of their youth, but as they grew older, they settled into the statism of their programmed, mechanized education. " "The saints and sages of each generation were recognized and truly heard only by a small portion of those existing in the epoch within which they lived and died. It was invariably the youth of succeeding generations who separated the wheat from the chaff in the knowledge to which they were exposed in their formative years. "When Jesus said, "I Am the Way, and the Truth, and the Light." many of those of his own generation recognized the truth of what he spoke, but did not understand the import of what these words could mean in the process of daily life. "The Net-Generation understood, 'I Am the Medium, and the Message.' They understood that they were living in an interactive universe, in which they were the eternal Tao which has moved the universe from the beginning of time. Bubba interjected, "While the titans of the computer industry were busy finding ways to wrestle dynamic InformEnergy into predefined slots corresponding to their own narrow desires, there were groups of individuals, such as those in Taos, New Mexico, who were exploring such things as Chaos Theory, and the like, which took into account the role of randomness in the creation of the structure of the universe." "And with the recognition of the role of chaos in the flow of the universe," Bubba continued, "came the possibility that humankind, through the use of logic and rationale, could dance with the chaos surrounding them, taking part in the creation of the universe in which they lived." "Everything you know is wrong�" Alexis said, pausing to complete the thought that was taking shape in her mind, "�if what you know remains static." "Everything you know is right�" Jonathan expanded Alexis' line of thought, "�if you recognize that you are living in an interactive reality which is a creation of your own thoughts and actions, as well as those of others�a co-creation of yourself and of the chaos around you." The tattered remnants of the Circle of Eunuchs sat in quiet contemplation of the surprising turn that their investigation into a period of time which lay a hundred years in the past had taken. "We are the world�" Priscilla quoted a song which had touched a nerve in the generation of humanity that they had been scrutinizing. Bubba smiled, taking Priscilla's hand in his own, and kissing it gently. He turned to his compatriots in the Magic Circle and spoke softly. "One of the terrible moments of each generation is when they look in the mirror and exclaim, in horror, 'I have become my parents.'" The group laughed, recognizing one of the verities of life that each generation of humanity had to face at a certain crossroads in the course of their life. "But they need not say it in shame," Bubba continued, "if they can honestly say that they have also, at some point in their life, gone beyond what their parents were, and beyond what their parents were capable of becoming. "The epitome of human development is to raise the children, whether they be your own, or the children of others, to go beyond the limitations of what you, yourself, have learned in the course of your lifetime." Bubba turned to Jonathan to bring their meeting to a close, knowing that he was the member of their small group who best understood the mentality of the time which they had accessed through use of the Trei Transponder, in the hope of making a difference in their past, and their future. Jonathan's countenance took on a seriousness that reflected a wisdom that went far beyond the number of years he had resided in physical existence. "In my grandfather's era," he said, "when the CypherPunks stood at a point in time where the future of humanity's movement into the arms of the Digital Revolution was as yet undecided�" Jonathan paused, to gather his thoughts in a manner that would fully express one of the defining issues of that era, then continued. "The battle cry of the day was, 'For the children.'" "Save the children�protect the children�in the interests of the children�" Jonathan sat, immobile, repeating, "�the children�the children �the children." After a few moments, he looked up at those around him, and said, "As governments based on physical location began to become an anachronism, those who sought to disguise their evil intentions by 'wrapping themselves in the flag' of their particular country, began to 'wrap themselves' in the cloak of 'defenders of the innocent' in all areas of life, across the face of the globe. "The cry of 'Save the children!' was used to justify every evil action under the face of the sun, as those in power strove to maintain their position in a civilization that was in the process of dying and decaying around them." "In order to save the children, we had to kill them." Priscilla said, weeping at the thought of the innocents who died in the government assault on the Branch Davidian compound in Waco, Texas. "The sins of the fathers shall be visited upon the children." Alexis, added, referring to the actions of Timothy McVeigh in bombing the Murrah Federal Building in Oklahoma City. "Nuke the children!" Bubba bellowed, causing the others to pelt him with a fresh round of ice cubes. The Cowboy stood up and raised his shotglass in toast to the youth who currently existed a hundred years in the past of those gathered around the antique oak table. "A tribute to those to whom the future truly belongs�and to those who are truly our only hope for the future." "To the children�" Copyright "Anonymous TruthMonger " "That's not my boss. That's my lover!" ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ---------------------------------------------------------------------------- From nobody at REPLAY.COM Wed Oct 1 08:47:51 1997 From: nobody at REPLAY.COM (Anonymous) Date: Wed, 1 Oct 1997 23:47:51 +0800 Subject: The War on Drugs--Surrender! / Re: INFO-RUSS: Reuter: Russian+Russian Drug Cartels (fwd) Message-ID: <199710011514.RAA10457@basement.replay.com> Jim Choate wrote: > Forwarded message: > Subject: INFO-RUSS: Reuter: Russian+Russian Drug Cartels > Post: Russian Mob, Drug Cartels Joining Forces > The officials were quoted as saying that the growing alliances between > Russian and Colombian criminal organizations were the most dangerous trend > in drug smuggling in the Western Hemisphere. Legalize drugs! The War on Drugs *created* all of the current problems in this area by making minute amounts of forbidden substances worth more than precious metals. If we make sugar illegal, so that it sells for hundreds of dollars a gram, people will steal and kill over it. If we legalize it, the deaths will stop. The government would have us believe that the 'bad guys' are killing each other and ourselves and our neighbors over substances that cost mere pennies to produce. Bullshit. They are killing over the insane profits to be had from cheap products which are selling for outrageous prices as a result of the War on Drugs. Bottom Line: You and I may have to die in order for the government to attempt to prevent someone else from killing themself. Makes sense to me... Duhhh.... From dlv at bwalk.dm.com Wed Oct 1 08:52:33 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Wed, 1 Oct 1997 23:52:33 +0800 Subject: Secure HTTP servers. In-Reply-To: <199710011148.NAA01115@taranis.iks-jena.de> Message-ID: Lutz Donnerhacke writes: > In iks.lists.cypherpunks, you wrote: > >the point of the mail. Could someone point me in the right direction for > >info on secure http servers ?? Also maybe info on which is better than > >the other ?? > > Secure HTTP ist the HTTP protocol based on SSL sockets. You may choose any > server you like or which fits your needs (database connections, ...). There > are not so many cryptographic failtures a developer can do. Keep you hands > away from servers only supporting exportable protocols. > > Ask you next Certification Authority for help, they must support your server > software. (we do run one ;->) Are the posters in this thread unwilling to criticize C2Net's StrongHold because they're afraid to get obnoxious threatening letters from Sameer Parekh's shysters? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From shamrock at cypherpunks.to Wed Oct 1 09:17:49 1997 From: shamrock at cypherpunks.to (Lucky Green) Date: Thu, 2 Oct 1997 00:17:49 +0800 Subject: Remailers and ecash In-Reply-To: <46ee864da2b5a3279142ba5c3ce1deea@anon.efga.org> Message-ID: On Wed, 1 Oct 1997, Anonymous wrote: > > Using a remailer doesn't hide the fact that the sender is using a > remailer. An eavesdropper who monitors incoming messages to the > remailers can easily learn who is using them. A constant bandwidth > connection will at least disguise *when* the messages are sent. Using a constant bandwidth connection just to the remailer network is a waste. Better set up such a connection to a Pipe-net or Onion Router network. The you can use the pipe for other services then mail. A welcome side benefit would be that this conceals the use of "mail" remailers -- Lucky Green PGP encrypted email preferred. "Tonga? Where the hell is Tonga? They have Cypherpunks there?" From ravage at ssz.com Wed Oct 1 09:27:56 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 00:27:56 +0800 Subject: Remailers and ecash (fwd) Message-ID: <199710011624.LAA19524@einstein.ssz.com> Forwarded message: > Date: Wed, 1 Oct 1997 11:03:36 -0400 > From: Anonymous > Subject: Re: Remailers and ecash > Using a remailer doesn't hide the fact that the sender is using a > remailer. An eavesdropper who monitors incoming messages to the > remailers can easily learn who is using them. A constant bandwidth > connection will at least disguise *when* the messages are sent. Huh? An eavsdropper can't use a clock to note when the packet was sent? I don't think so... ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From lutz at taranis.iks-jena.de Wed Oct 1 09:37:09 1997 From: lutz at taranis.iks-jena.de (Lutz Donnerhacke) Date: Thu, 2 Oct 1997 00:37:09 +0800 Subject: Secure HTTP servers. In-Reply-To: Message-ID: * Dr.Dimitri Vulis KOTM wrote: >Lutz Donnerhacke writes: >> Secure HTTP ist the HTTP protocol based on SSL sockets. You may choose any >> server you like or which fits your needs (database connections, ...). There >> are not so many cryptographic failtures a developer can do. Keep you hands >> away from servers only supporting exportable protocols. >Are the posters in this thread unwilling to criticize C2Net's StrongHold >because they're afraid to get obnoxious threatening letters from Sameer >Parekh's shysters? Why should we deal with Stronghold while other alteratives work fine? From tcmay at got.net Wed Oct 1 09:54:33 1997 From: tcmay at got.net (Tim May) Date: Thu, 2 Oct 1997 00:54:33 +0800 Subject: Traffic Analysis and Cover Traffic In-Reply-To: <199710010759.JAA27558@basement.replay.com> Message-ID: At 2:03 AM -0700 10/1/97, Robert A. Costner wrote: >Let me get this straight. You are suggesting that anyone who wishes to be >anonymous should send a continuous 24 hour stream of low bandwidth data to >a central point in an effort to help keep anyone from knowing that they >wish to be anonymous. He was describing how a constant-traffic pipe defeats "sudden burst of activity" types of traffic analysis. (As, for example, when nightime activity in the White House is signalled by deliveries of lots of pizzas.) In fact, this constant traffic approach is the basis of PipeNet, proposed and described by Wei Dai, and, I think, being implemented. Obviously not everyone will want this, or want to pay for it, etc. Nothing surprising there. But some may. In particular, it makes more economic sense for sites already full-time on the Net, e.g., remailers not on dial-up lines. (And even on dial-up lines, a call every hour, with a packet of traffic, can implement this cover traffic scheme, albeit in a different form.( > >While this may help correct the latency problem, how do you think this will >effect anonymity? Do you think that by sending a continuos stream of data >to the remailer, the sender will be less identifiable? Again, _latency_ per se is not important, _mixing_ is. As I understand your example above, the sender becomes less identifiable because he can always be counted on to send some packets; an attacker cannot see a message after a long period of no messages and correlate it to a similar sudden increase of activity at a possible recipient machine. Traffic analysis is something you should look at. And think about. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From frantz at netcom.com Wed Oct 1 10:03:13 1997 From: frantz at netcom.com (Bill Frantz) Date: Thu, 2 Oct 1997 01:03:13 +0800 Subject: Secure HTTP servers. In-Reply-To: <3431DF24.E4E9C578@one.net.au> Message-ID: At 10:27 PM -0700 9/30/97, Jim wrote: >Hi all, > >I just started working vfor a local ISP and they found out, i was on >this list and knew a little about crypto. Anyway they seem to have the >impression this would qualify me to know something. At any rate, on to >the point of the mail. Could someone point me in the right direction for >info on secure http servers ?? Also maybe info on which is better than >the other ?? Stronghold is available internationally (http://www.c2.net). Also Netscape and Microsoft have secure HTTP servers with weak encryption in the export versions. I noticed that Lonely Planet in Australia was running Stronghold. ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz at netcom.com | nation it is today. | Los Gatos, CA 95032, USA From tcmay at got.net Wed Oct 1 10:20:58 1997 From: tcmay at got.net (Tim May) Date: Thu, 2 Oct 1997 01:20:58 +0800 Subject: please send cyberpunk remailing list In-Reply-To: <3431B69B.3D4CFB0E@mwr.kic.or.jp> Message-ID: At 7:34 PM -0700 9/30/97, H. Smith wrote: >Thamks H. Smith Yure wemcome! Cyberpunk remailing list am being sunt to yu. Get big disk ready. --Klaus The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From anon at anon.efga.org Wed Oct 1 10:34:12 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 2 Oct 1997 01:34:12 +0800 Subject: None Message-ID: <17450f976975427f087e75255043e2b0@anon.efga.org> Dr.Dimitri Vulis KOTM writes: > Are the posters in this thread unwilling to criticize C2Net's StrongHold > because they're afraid to get obnoxious threatening letters from Sameer > Parekh's shysters? Those who are newcomers to the list should know that Vulis has never presented any evidence substantiating his vague claims that Stronghold is insecure or has backdoors (or whatever the claims were). Vulis is conducting a personal vendetta against one of C2Net's staff members and anyone who happened to be or become associated with him. From anon at anon.efga.org Wed Oct 1 10:39:27 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 2 Oct 1997 01:39:27 +0800 Subject: Remailers and ecash Message-ID: <84fa661e1a86318df409114a4763e5a5@anon.efga.org> -----BEGIN PGP SIGNED MESSAGE----- >On Wed, 1 Oct 1997, Anonymous wrote: >> Using a remailer doesn't hide the fact that the sender is using a >> remailer. An eavesdropper who monitors incoming messages to the >> remailers can easily learn who is using them. A constant bandwidth >> connection will at least disguise *when* the messages are sent. > >Using a constant bandwidth connection just to the remailer network is >a waste. Better set up such a connection to a Pipe-net or Onion >Router network. The you can use the pipe for other services then >mail. A welcome side benefit would be that this conceals the use of >"mail" remailers Agreed, mostly. But your solution would be more expensive. "Constant bandwidth" does not mean you have to soak up every available bit, it just means you your usage should be consistent and look the same from the outside whether you are sending things or not. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDJ3+5aWtjSmRH/5AQHmxQf9EMHzudkOYcFu6eCB2saHw7DVZqaIesfL KCsPrszA8HlE6UrsiaRGbF9z+8etGOnTrQT0ApConGDpGoOj97oUpN4wy2xy0BwJ eo3dXG3uihH3IyesgHLbYEYlqgyZVx2hrpbQ/Hfz0SaWbfunBLgswnemhIyt5jEO kuxBkG/YrFiO4ZTIAcnBVku2xcPKxL4cRsNNE3CrqJZTVcmM9Kk/OoIuYKjBoDa1 5X+/b3JNQZE2e4Rdra0DljmSq4fE1o6vswNuMhKh0wzRXi7hm3D+irS2xtX7bg25 5tw+CquYwRJaJ8PfyTX2DrBl0C4R2HvFpZUr1X89CTwM1xlFbzpKwg== =mmcG -----END PGP SIGNATURE----- From alexlh at yourchoice.nl Wed Oct 1 10:41:48 1997 From: alexlh at yourchoice.nl (Alex Le Heux) Date: Thu, 2 Oct 1997 01:41:48 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" Message-ID: In article <34302d8d.8163438 at newshost.cyberramp.net> you wrote: [lots of ranting deleted] : Banning guns because criminals might use them equates to banning : encryption because criminals might use it. And if you really believe : that both should be banned, then perhaps you should be banned from : using oxygen, because criminals breath it too. You people just don't get it do you? A gun has one purpose: To kill. Just like any other tool, a gun, if it is available _will_ be used at some point. So making sure there are lots of guns around only serves to make a lot of people very dead. This is a Bad Thing. Gun control laws are not the issue. It's a matter of mentality. In Europe, where we have rather strict guncontrol laws, and have had them for a long time a decent human being will not even think of shooting someone else. In the US, where guns are tradition and part of the American way, many people would not think twice before shooting someone. The result of this is that the number of people getting killed by guns is enourmous, be they criminals, little kids, old grannies, or presidents. This sucks. We are not trying to export our stupidity, we're just trying to explain to you how we live. We live in a place where we don't even have to think about getting a gun, because the chances of us encountering a gun in the hands of an adversary are negligible. Wake up and smell the coffee, dude. If you have lots of guns around, you're gonna end up with lots of people getting shot. Alex --- /// I dabble in techno-house and sometimes, /// I do that badass hip-hop thang... /// But the F U N K gets me every time! From whgiii at invweb.net Wed Oct 1 11:28:42 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 2 Oct 1997 02:28:42 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: Message-ID: <199710011747.NAA21027@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In , on 10/01/97 at 07, alexlh at yourchoice.nl (Alex Le Heux) said: >In article <34302d8d.8163438 at newshost.cyberramp.net> you wrote: >[lots of ranting deleted] >: Banning guns because criminals might use them equates to banning >: encryption because criminals might use it. And if you really believe >: that both should be banned, then perhaps you should be banned from >: using oxygen, because criminals breath it too. >You people just don't get it do you? A gun has one purpose: To kill. Just >like any other tool, a gun, if it is available _will_ be used at some >point. >So making sure there are lots of guns around only serves to make a lot of >people very dead. This is a Bad Thing. >Gun control laws are not the issue. It's a matter of mentality. In >Europe, where we have rather strict guncontrol laws, and have had them >for a long time a decent human being will not even think of shooting >someone else. In the US, where guns are tradition and part of the >American way, many people would not think twice before shooting someone. >The result of this is that the number of people getting killed by guns is >enourmous, be they criminals, little kids, old grannies, or presidents. >This sucks. >We are not trying to export our stupidity, we're just trying to explain >to you how we live. We live in a place where we don't even have to think >about getting a gun, because the chances of us encountering a gun in the >hands of an adversary are negligible. >Wake up and smell the coffee, dude. If you have lots of guns around, >you're gonna end up with lots of people getting shot. What a crock of shit!! Europe has been in a perpetual state of war for the past 2,000 years where countless tens of millions of people have been slaughtered. Chances are very high that you will face an advisatory with a gun, the fact that he collects a paycheck from a government wont make you any less dead from his bullets. You must be getting some good drugs over there to conjure up this fantasy land where everyone loves one another and would never think of killing someone because it sure as hell doesn't exist in Europe. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNDKAPo9Co1n+aLhhAQFUWgQAuk9PWtRBxSX1NkTBtLiUIovEmlXBZOIm McghiyPovkCdx8zmqjLuhi3e4x4LpbfBq5EaNwrPxYEZlC39pg3ubZk4LR1n+n4p vXgCWLPl0KHntonNsh8STI3TxuzRMUzUvTz5H5hrIJVOn3URkUwkxVBAx8kPquGB ROL+fZNqJag= =LTCe -----END PGP SIGNATURE----- From alexlh at yourchoice.nl Wed Oct 1 11:34:36 1997 From: alexlh at yourchoice.nl (Alex Le Heux) Date: Thu, 2 Oct 1997 02:34:36 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: Message-ID: William H. Geiger III writes: > > What a crock of shit!! > > Europe has been in a perpetual state of war for the past 2,000 years where > countless tens of millions of people have been slaughtered. Chances are > very high that you will face an advisatory with a gun, the fact that he > collects a paycheck from a government wont make you any less dead from his > bullets. Maybe you haven't noticed, but seen on 2000 year scales, the entire world is constantly in a state of war. Europe isn't special in that regard. Even though it doesn't look like there's many countries that are about to take war to us here, it still might happen. And even if I had my AR15 then, it wouldn't help me a lot against guided missiles and mortar fire. And anyway, "to defend yourself in a war" is not one of the usual arguments against gun control. > You must be getting some good drugs over there to conjure up this fantasy > land where everyone loves one another and would never think of killing > someone because it sure as hell doesn't exist in Europe. Well, we're a lot closer to it over here than you guys are over there. Alex -- /// I dabble in techno-house and sometimes, /// I do that badass hip-hop thang... /// But the F U N K gets me every time! From whgiii at invweb.net Wed Oct 1 11:35:49 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 2 Oct 1997 02:35:49 +0800 Subject: Traffic Analysis and Cover Traffic In-Reply-To: Message-ID: <199710011820.OAA21380@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In , on 10/01/97 at 09, Tim May said: >At 2:03 AM -0700 10/1/97, Robert A. Costner wrote: >>Let me get this straight. You are suggesting that anyone who wishes to be >>anonymous should send a continuous 24 hour stream of low bandwidth data to >>a central point in an effort to help keep anyone from knowing that they >>wish to be anonymous. >He was describing how a constant-traffic pipe defeats "sudden burst of >activity" types of traffic analysis. (As, for example, when nightime >activity in the White House is signalled by deliveries of lots of >pizzas.) In Ian Slater's book Showdown such "burst activity" was put to use. In order to find where the rebel headquarters was located rummors were spread that the rebel leader was dead. Soon afterwards there was an increase in radio trafic from the headquarters in an attempt to kill the rummors thereby giving away their location as the "sudden burst of activity" stood out like a sore thumb over the normal radio traffic. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNDKH7o9Co1n+aLhhAQEITwQAh9rnbIYkX++cfXI9eT/E8Pv8y+6aUKqE qMP0NhQ7BAjg+emr2h8P2DNR0/wNtfEnsLj2PYozTYRlf+i1Qwh/V6/rBjvCUyLi 1aRPSwN09QbneeH7PgutlnNcHIyVh9+AXAgxSQEisK/N/mIpnSVXDflhu4TwFnKH 8k0QYhBefzY= =YEYR -----END PGP SIGNATURE----- From rah at shipwright.com Wed Oct 1 11:37:29 1997 From: rah at shipwright.com (Robert Hettinga) Date: Thu, 2 Oct 1997 02:37:29 +0800 Subject: An e$Lab competitor? Message-ID: Now I know how the Wright Brothers felt when they found out about Langley and Bell... ;-). Cheers, Bob Hettinga --- begin forwarded text Mime-Version: 1.0 Date: Wed, 1 Oct 1997 09:37:44 -0700 From: jmuller at brobeck.com (John D. Muller) Subject: An e$Lab competitor? To: e$lab at vmeng.com Sender: Precedence: Bulk List-Software: LetterRip 2.0.1 by Fog City Software, Inc. List-Subscribe: List-Unsubscribe: From MecklerMedia's http:/www.internetnews.com E-Transaction Lab for Financial Firms Opens in NYC [October 1] New York City-based Transaction Information Systems (TIS), an integration and information technology consulting company, opened FLITE , an open software factory dedicated to building electronic commerce solutions for the financial industry. In addition to TIS, the founder of FLITE, there are approximately 20 member firms, including Digital Equipment Corp., ad agency Foote, Cone and Belding, IBM, Lotus Development Corp., Reuters, Sybase, and Visa. FLITE is physically located in the former home of the historic New York Lawyers' Club at 115 Broadway in downtown Manhattan. FLITE allows sales, marketing, and information technology executives to interact with a variety of online trading systems, 401(k) management products, three-dimensional visualizations of financial data, and other electronic commerce and interactive customer service solutions. "This one-of-a-kind software factory enables financial institutions to increase sales and market reach via the rapid deployment of their financial products through multiple distribution vehicles, including the Internet, kiosks, display cellular phones and TV sets," said Bob Gold, President of TIS. "In one place, they can experience and visualize more electronic commerce and customer service applications for the financial industry than anywhere else. FLITE's design process and electronic commerce tools allow us to roll out transactional Web sites in half the time and at half the cost of the industry average." FLITE is a working lab that financial institutions can use to produce innovative products. Marketing/sales executives use the facility to learn to think interactively and develop Internet strategies, build product prototypes rapidly and conduct focus groups. Technology staffs can use the facility for jointly developing interactive products with FLITE engineers, use FLITE's specialty rooms (user interface optimization, 3-D visualization and quality assurance testing), and get hands-on training and knowledge transfer. As a factory, FLITE has specialized machinery and tools for building transactional Web sites and delivering products through interactive distribution channels, TIS said. FLITE has a variety of hardware servers, workstations, laptops, kiosks, televisions, display phones, touchscreen monitors, and financial trading equipment. "FLITE combines the promise of new technology with the city's financial heritage," said Gold. "Unlike other companies who have put research and development facilities in the suburbs, TIS believes that its downtown location in the heart of Wall Street attracts the top talent in the industry and makes it accessible to financial industry executives." --- end forwarded text ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ From jeffb at issl.atl.hp.com Wed Oct 1 11:57:35 1997 From: jeffb at issl.atl.hp.com (Jeff Barber) Date: Thu, 2 Oct 1997 02:57:35 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: Message-ID: <199710011924.PAA15341@jafar.issl.atl.hp.com> Alex Le Heux writes: > And anyway, > "to defend yourself in a war" is not one of the usual arguments against gun > control. Actually, most of us prefer the `defend yourself against the government' argument around here. That's one of the reasons why the right to arms is enshrined in our constitution. -- Jeff From die at pig.die.com Wed Oct 1 12:25:05 1997 From: die at pig.die.com (Dave Emery) Date: Thu, 2 Oct 1997 03:25:05 +0800 Subject: Encrypting Pagers is Easy! [Overview, technical tradeoffs, crypto] In-Reply-To: <3.0.3.32.19971001000255.006abcec@popd.ix.netcom.com> Message-ID: <199710011846.OAA25691@pig.die.com> Bill Stewart wrote : > One of the articles on the White House Pager Hack quoted a government official > saying that encrypting pagers would be complicated and difficult. > > 1)Digital PCS, in TDMA, GSM1900, and CDMA, though US coverage isn't complete > (as of May 97, AT&T had service in 40% of the US land area, 80% population, > and the GSM1900 players are expecting wide coverage later this year I would expect this kind of paging to be encrypted under the same CAVE or A5 encryption as encrypts the rest of the call setup, but don't have the IS standards handy here to check. At the very least it would be much more complex to intercept than regular beeper paging because of the much more complex signal multiplexing and modulation. Regular POCSAG paging is simple FSK, receivable on an umodified scanner, whilst CDMA and TDMA tranmissions require special demodulator hardware and DSP software not available at Radio Shack (except as modifiable phones). But more significant, like REFLEX, the system generally knows where a specific mobile phone is located and sends the paging only to that cell site whereas regional and national paging systems used with conventional beepers send the message to tens to hundreds of transmitters scattered all over the place making it possible to intercept messages at locations far removed from the intended recipiant (continent wide in the case of the satellite feeds for the paging transmitters used by many regional and national paging carriers). > > 2)Motorola's extremely cool PageWriter 2000 is a ~2"x2" programmable beeper > with keyboard, 160x240 screen, crypto, operating system, and infrared. > http://www.mot.com/MIMS/MSPG/Products/Two-way/pagewriter/ > says it uses the Flex Operating System and ReFLEX 2-way paging; > the person who showed me the beta version said OS9 and GSM. > I'd guess that Flex is OS9 with bells and whistles added, and that > the pager's CPU is a 68000-family chip, and that either he's wrong about > GSM or there's a second flavor coming out that does GSM. > In any case, it's user-programmable, and Motorola has crypto support. Flex and Reflex are physical, link and transport level protocols for sending paging data over the rf link. They are not an operating system. Motorola does offer implementations of these protocols integrated with a real time OS, but properly they are link protocols and not an OS. Much of the common carrier paging infrastructure in the US is being converted to flex on the existing VHF and UHF narrow band channels, and clearly Motorola is aiming at that market. Whether Moto put their flex stack on top of OS-9 I don't offhand know. GSM is a completely different link protocol that has nothing to do with flex at all - so a flex pager would not be able compatible with GSM (although some DSP based dual mode wireless hardware exists that will do various combinations of otherwise incompatible air interfaces). Flex is m-ary FSK (4 level FSK) on narrow band carriers, and GSM is TDMA BPSK on much wider carriers BTW.. Motorola has aimed their paging applications software at the 68HC11 family in the past, but may well be upgrading to 32 bit stuff... > > 3)If you insist on pager service that's not part of the cellphone or beeper > you were carrying already, or want wider coverage, it's still not very hard, > and it can be done with or without the paging service's cooperation. > > 4)PCMCIA cards in your PDA can get alpha pager, CDPD, ARDIS, RadioMail, etc. > There are lots of cards that will allow PDAs to receive existing common carrier flex and POCSAG paging streams - and flex explicitly is capable of forwarding binary data unaltered making it pretty trivial to implement end to end unescrowed secure messaging over the existing VHF/UHF paging infrastructure. That nobody has is a tribute to the FUD factor... > Making money at it may still be hard, since the government interference > fragments on the market and raises costs, but that's a separate problem, > and if you can piggyback on existing developments like PCS and CDPD, > it's a lot easier. > > Technology tradeoffs > -------------------- > much good stuff elided... -- Dave Emery N1PRE, die at die.com DIE Consulting, Weston, Mass. PGP fingerprint = 2047/4D7B08D1 DE 6E E1 CC 1F 1D 96 E2 5D 27 BD B0 24 88 C3 18 From nobody at REPLAY.COM Wed Oct 1 13:07:17 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 2 Oct 1997 04:07:17 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" Message-ID: <199710011942.VAA09393@basement.replay.com> -----BEGIN PGP SIGNED MESSAGE----- Alex Le Heux wrote: >You people just don't get it do you? A gun has one purpose: To >kill. Just like any other tool, a gun, if it is available _will_ be >used at some point. Although guns are obviously designed for killing things, this does not mean that they will be used. This can be seen from the statistics. There are far fewer murders than there are guns. Almost all of them are never used for killing someone. You are also not considering the case where one person has a gun and another does not. The situation is more stable if both people are armed. (And don't claim you are talking about disarming a whole society. You aren't, just part of it.) >So making sure there are lots of guns around only serves to make a >lot of people very dead. This is a Bad Thing. Depends who they are. Bet the Dutch resistance made good use of their weaponry, eh? >In the US, where guns are tradition and part of the American way, >many people would not think twice before shooting someone. This is simply untrue. TV and movies are not the best way to form an understanding of another country. >The result of this is that the number of people getting killed by >guns is enourmous, be they criminals, little kids, old grannies, or >presidents. I read recently that 9000 people a year die in the United States from food poisoning. This should be almost entirely preventable. Why isn't this a big political issue? Could it be that the people pushing gun control do not have entirely pure motives? Be aware that the gun control lobby has often used misleading statistics. For instance, you will hear a lot about "handgun deaths". It turns out that most of these are suicides. While undesirable, most people perceive a difference between somebody killing themselves and a nutcase doing his thing at a school. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDKPA5aWtjSmRH/5AQFgoAf7B3MxcsPsF1CHke4aaGHjERMCcmEt/4lk 9Z9l9qCD6zysodKlXX5W5qlpY6okE1LEFxMitb3royeBOqbxksj9t0b+/p0Py2Bl /lQYZ+Km6bsO/ooVMy5Ub+3W1XyqgYwoXPOoO7+6vOUMQijCmekm3Zquj8t5YY4M o8wq2p935GlXOu6efTxMSnRY5+r2SZDI4aWPIzHmXWqjMfUnIRVmmQ1WBQ2h1X2U 4BoTcKQAi7rEdC1UXI7kKtNO246lgyHj/P+G6H645iRdgFAyjFKmyLzM+6ai8Bpq oE5yWnpfq4nTQ7WhdNe8XmKFQY+sxD4xhFzcNkxR1+3yzShK9shSLg== =sHEL -----END PGP SIGNATURE----- From cynthb at sonetis.com Wed Oct 1 13:38:13 1997 From: cynthb at sonetis.com (Cynthia Brown) Date: Thu, 2 Oct 1997 04:38:13 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: Message-ID: On Wed, 1 Oct 1997, Alex Le Heux wrote: > You people just don't get it do you? A gun has one purpose: To kill. Just like > any other tool, a gun, if it is available _will_ be used at some point. > > So making sure there are lots of guns around only serves to make a lot of > people very dead. This is a Bad Thing. > > Gun control laws are not the issue. It's a matter of mentality. In Europe, > where we have rather strict guncontrol laws, and have had them for a long > time a decent human being will not even think of shooting someone else. In the > US, where guns are tradition and part of the American way, many people would > not think twice before shooting someone. The result of this is that the > number of people getting killed by guns is enourmous, be they criminals, > little kids, old grannies, or presidents. > > This sucks. I agree wholeheartedly. Uncontrolled guns do not solve problems, they create them. If most households have at least one firearm, it makes it that much easier for a criminal to obtain one by stealing yours while you are at work. Canada may be regulated to death according to most libertarians, but I for one like it that way. I can walk alone and unarmed at night in Ottawa, Toronto, etc. without fearing for my life. Can a female resident of Washington or New York say the same? Our schools do not have metal detectors at the entrances because they are not needed. IMNSHO the best way to fight crime is not with bigger guns than the "bad guys", but with better social programs such as universal health care, and improved day care so single parents can show their kids what a productive lifestyle looks like. This takes longer than blowing the brains out of some teenager that feels his only path to a better life is through crime, and it doesn't give the same adrenalin rush. However, it works at the source of crime, and not the consequences. Cynthia, unrepentant bleeding-heart liberal =============================================================== Cynthia H. Brown, P.Eng. E-mail: cynthb at iosphere.net | PGP Key: See Home Page Home Page: http://www.iosphere.net/~cynthb/ Junk mail will be ignored in the order in which it is received. Klein bottle for rent; enquire within. From dlv at bwalk.dm.com Wed Oct 1 13:51:10 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Thu, 2 Oct 1997 04:51:10 +0800 Subject: Secure HTTP servers. In-Reply-To: Message-ID: lutz at taranis.iks-jena.de (Lutz Donnerhacke) writes: > > * Dr.Dimitri Vulis KOTM wrote: > >Lutz Donnerhacke writes: > >> Secure HTTP ist the HTTP protocol based on SSL sockets. You may choose any > >> server you like or which fits your needs (database connections, ...). Ther > >> are not so many cryptographic failtures a developer can do. Keep you hands > >> away from servers only supporting exportable protocols. > > >Are the posters in this thread unwilling to criticize C2Net's StrongHold > >because they're afraid to get obnoxious threatening letters from Sameer > >Parekh's shysters? > > Why should we deal with Stronghold while other alteratives work fine? > Good question, especially when other vendors don't seek to suppress the discussion of theirt products. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From anon at anon.efga.org Wed Oct 1 14:34:21 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 2 Oct 1997 05:34:21 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" Message-ID: <6489040e71db5edc2ab5e653cb709620@anon.efga.org> -----BEGIN PGP SIGNED MESSAGE----- Alex Le Heux wrote: >Maybe you haven't noticed, but seen on 2000 year scales, the entire >world is constantly in a state of war. Europe isn't special in that >regard. I guess the conclusion, then, is that gun control is bad for the whole world, not just Europe. >And even if I had my AR15 then, it wouldn't help me a lot against >guided missiles and mortar fire. It's harder to police a hostile population which is well armed. >And anyway, "to defend yourself in a war" is not one of the usual >arguments against gun control. The popularity of an argument can be independent of its worth. "To defend yourself in general" is commonly used. War, oppressive government, and political turbulence are the most likely situations in which people need their weapons, even in the United States. >> You must be getting some good drugs over there to conjure up this >> fantasy land where everyone loves one another and would never think >> of killing someone because it sure as hell doesn't exist in Europe. > >Well, we're a lot closer to it over here than you guys are over >there. You mean like the former Yugoslavia? Or do you mean like the parts of Europe where people are not slaughtering each other at the moment? I have to confess that I am surprised at the level of resentment among the members of various Europeans countries feel towards other European countries. For example, the Germans don't like the Dutch because when they visit they are treated badly by, among others, the police. The Dutch don't like the Germans because, well, they got to know them a little too well in the 1940s and they are nursing the grudge. With that sort of situation, anything can happen and it can happen quickly, even if things seem mellow right now. And these little resentments and jealousies are felt between far more groups in Europe than just between the Dutchies and the Germans. Let's also take a look at the Dutch performance during their occupation. While there certainly were many courageous Dutch people who helped refugees (at great personal risk, to say the least), and there were many courageous Dutch people who were in the resistance, there were also many Dutch people who did not perform so well. Not only were a large number of Jewish people turned in by Dutch informers, but there were even Dutch SS units. I basically think well of the Netherlands and its people, but it is important to recognize that certain unpleasant characteristics exist in a large portion of the population of even a nice country. It is unlucky to pretend that these characteristics can never be expressed. Let's turn to the Western Hemisphere: El Salvador. During much of the 1980s, the U.S. government supported groups of people in El Salvador who were sending out death squads to murder their suspected opponents. The U.S. certainly acquiesced in this activity - of this there is no doubt. But, it is not unlikely the U.S. was more directly involved. (Only fifteen years earlier the U.S. was doing the same thing in Vietnam.) What would have happened if the citizens of El Salvador were adequately armed? One thing you wouldn't see is a death squad going into a neighborhood to kick down some innocent's door and murder him or his family. At least, you wouldn't see it twice. Likewise, when the communist guerrillas were forcing (maybe) the peasantry to support them, the peasants would have no need to cooperate unwillingly if they were well armed. People who are well armed are less likely to become pawns, victims, or slaves. That is desirable. Incidentally, the consistent support the U.S. government has shown for murderous or even genocidal governments is of great concern to those of us who live in the U.S. It is unlikely that these tactics won't be used here were there a serious political struggle and a disarmed population. An issue that might possibly blossom into such a political struggle is mass surveillance. While the mass media is, for the most part, giving everything the government's spin, and while large numbers of Congressmen and other denizens of Washington, D.C. think it's a good idea, the bulk of the population is not happy about this at all. They can read the writing on the wall. The potential for conflict between the political class, which has a long history of murder and even assassination, and the American people exists right now. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDKo45aWtjSmRH/5AQG/KAf/ViGabpr8OnP2UYZ/CZAKQ4czRzVlx7Az Dcb0mqxnhNmQ7o5YJQlodbrmI3cEbXb0/YeTaX9r2pmxhtz06hekCTa28ZoycspB aCzoWLuZW1et9zNTYQzfDADLPPoLDizHG/zHPpWH97t/8NgQOXmQXS1qccNkylMl LghngUR+2YXlmB0omNLy1e6hQCzjkgUlxYE5T5Aimn0WpTmHk4yn9HwOdGXC2gvU idX5qlQUkwhxuEqOgN/p++tzv22Fi8W3RaIusrMzJV2dU3326IEwsJzFY3UI8xh2 M1bZCWTA6TlBBJoqbugt4gqvhAT0/yH6kJdLjDdYlKsEUVM3nfctfQ== =STNd -----END PGP SIGNATURE----- From scr at dev.null Wed Oct 1 14:35:11 1997 From: scr at dev.null (Small Cajones Remailer) Date: Thu, 2 Oct 1997 05:35:11 +0800 Subject: Show me an example of Dictators using Gun Control / Re: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: Message-ID: <3432B7D8.516F@dev.null> Alex Le Heux wrote: > In article <34302d8d.8163438 at newshost.cyberramp.net> you wrote: > : Banning guns because criminals might use them equates to banning > : encryption because criminals might use it. And if you really believe > : that both should be banned, then perhaps you should be banned from > : using oxygen, because criminals breath it too. > You people just don't get it do you? A gun has one purpose: To kill. Just like > any other tool, a gun, if it is available _will_ be used at some point. A remailer has one purpose: To spam. Just like any other tool, a remailer, if it is available *_*will*_* be used at some point. > So making sure there are lots of guns around only serves to make a lot of > people very dead. This is a Bad Thing. Making sure there are lots of remailers around only serves to make a lot of people very spammed. This is a **_**Bad Thing**_**. > Gun control laws are not the issue. It's a matter of mentality. In Europe, > where we have rather strict gun control laws, and have had them for a long > time a decent human being will not even think of shooting someone else. That's right. Since Hitler instituted gun control in Europe, the decent human beings in Europe gas people en masse. > In the > US, where guns are tradition and part of the American way, many people would > not think twice before shooting someone. The result of this is that the > number of people getting killed by guns is enourmous, be they criminals, > little kids, old grannies, or presidents. In Europe, where ovens are a tradition, and part of the European way, many people would not think twice before gassing someone. The result of this is that the number of people getting killed by ovens is enourmous, be they little Jews, old Jews, or Jew lovers. > Wake up and smell the coffee, dude. If you have lots of guns around, you're > gonna end up with lots of people getting shot. Not many Europeans complained when the American gun-loving people came to visit and a lot of Nazis got shot. Wake up and smell the burning Jews, dude. > /// I dabble in techno-house and sometimes, > /// I do that badass hip-hop thang... > /// But the F U N K gets me every time! /// I dabble in techno-arms and sometimes, /// I do that badass boom-bang thang... /// And I get the F U C K every time! Axel Le Hoir From setzer at wl.net Wed Oct 1 14:48:40 1997 From: setzer at wl.net (contest) Date: Thu, 2 Oct 1997 05:48:40 +0800 Subject: Please Remove Message-ID: <19971001212226535.AAA164@TECH01.wl.net> Please remove setzer at wl.net from this mailing list From ravage at ssz.com Wed Oct 1 14:53:43 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 05:53:43 +0800 Subject: Why? (fwd) Message-ID: <199710012159.QAA20763@einstein.ssz.com> Forwarded message: > Date: Tue, 30 Sep 1997 22:54:15 -0700 > From: Bill Frantz > Subject: Re: Why? (fwd) > > At 7:49 PM -0700 9/30/97, Jim Choate wrote: > >My original question still stands, why would I or any other party choose to > >use an anonymous remailer for anything other than the original 3 items I > >mentioned previously. > > Black Unicorn uses a nym to express opinions he expects his coworkers and > acquaintances would not like. Anonymous remailers can be used for the same > purpose. Ok, I believe that falls under the 'bitching' category. > I have heard of people's posts being brought up in employment > interviews. A rational person might want to express controversial opinions > anonymously. And your point is? My personal opinions have nothing to do with my professional career and yours shouldn't either. I would love to have a company bring up my past posts, makes it easy to decide if I want to work there or not. If you want to work for such a company and you know their views and your views are in conflict then I would say you need a shrink not an anon. remailer. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From scr at dev.null Wed Oct 1 14:55:00 1997 From: scr at dev.null (Small Cajones Remailer) Date: Thu, 2 Oct 1997 05:55:00 +0800 Subject: Show me an example of Canadians stopping criminals with guns / Re: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: Message-ID: <3432BDD0.232@dev.null> Cynthia Brown wrote: > Canada may be regulated to death according to most libertarians, but I for > one like it that way. I can walk alone and unarmed at night in Ottawa, > Toronto, etc. without fearing for my life. I can walk alone and armed anywhere I damn please, without fearing for my life. > Can a female resident of > Washington or New York say the same? Our schools do not have metal detectors > at the entrances because they are not needed. Without fascist gun control measures in place, Canada had never had a big problem with gun-related violence. The fact that the Canadian government has gone to such great lengths to 'solve' a problem which does not exist, speaks volumes. > IMNSHO the best way to fight crime is not with bigger guns than the "bad > guys", but with better social programs such as universal health care, and > improved day care so single parents can show their kids what a productive > lifestyle looks like. This takes longer than blowing the brains out of some > teenager that feels his only path to a better life is through crime, and it > doesn't give the same adrenalin rush. However, it works at the source of > crime, and not the consequences. This is precisely the reason that governments are pushing for stronger and stronger gun control laws. The government has no interest in removing the source of crime. Crime- -violent crime, in particular--is the government's best friend. By using gun control to disarm *only* the law-abiding citizens, they put the safety of the citizens in the hands of their own LEA's. And by failing to provide safety for the law-abiding citizens, they force more and more of them to break the law in order to protect themself. > Cynthia, unrepentant bleeding-heart liberal Suzie, unrepentant bleeding-pussy hoir. > Klein bottle for rent; enquire within. Calvin Kleins for rent; enquire within. Suzy Creamcheese From attila at hun.org Wed Oct 1 15:03:19 1997 From: attila at hun.org (Attila T. Hun) Date: Thu, 2 Oct 1997 06:03:19 +0800 Subject: DejaVu: Cypherpunks as Philosopher Kings In-Reply-To: <3.0.32.19971001014341.0068afe0@cnw.com> Message-ID: <1997.1001.2150.19@hun.org> -----BEGIN PGP SIGNED MESSAGE----- on or about 971001:0144 Blanc purported to expostulate: +Since he says "we are ... dangerous ... if .... we are not scrutinized +carefully", I interpret this to mean that he is advising and warning +that the agency therefore *needs* to be kept under watchful +surveillance, lest it develop to the level of its worst potential. Blanc: At the end of the document I repeat the quote another way. To me, stating that "your" FBI is potentially the most dangerous agency, is a facetious attempt on the part of F[reeh,uck] to disarm, or at least give everyone the warm fuzzies, that the FBI is _not_ dangerous. backhand disinformation. what he is waiting for is his straight man to say, "Oh, Louie, you know that's not true; we trust you implicitely." --start excerpt Louis F]reeh,uck], did you really state this hoping everyone would think you are joking? "We are potentially the most dangerous agency in the country if we are not scrutinized carefully." Louis F[reeh,uck], you obviously know that telling the truth, before the truth is really the truth, disarms your opposition since they can plainly see that it is not true. --end excerpt sarcasm, like revenge, is a dish best served up cold. -- "When I die, please cast my ashes upon Bill Gates. For once, let him clean up after me! " ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDLFYb04kQrCC2kFAQHdlAQAvUqo+bypr3ZFWD+BJz56+JsjV7lzzxSq ntdpxygsqBnQ9j6//GNQNTg8vnBYybMSR676y19oPrccWI2CLlIhtprCaRlsi4YM R/Ad+HF883jLVhyg5A68MxpZKB3WaBMmApX5snqwvwqRZ/v5fDpCLXEdWRvEaJ6g vcatntMwCv4= =MDkn -----END PGP SIGNATURE----- From rab at stallion.oz.au Wed Oct 1 15:08:10 1997 From: rab at stallion.oz.au (rab at stallion.oz.au) Date: Thu, 2 Oct 1997 06:08:10 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" Message-ID: <82E14F2F282AD11180330000010380310152E6@mallory.stallion.oz.au> Cynthia Brown wrote: > On Wed, 1 Oct 1997, Alex Le Heux wrote: > > > You people just don't get it do you? A gun has one purpose: To kill. > Just like > > any other tool, a gun, if it is available _will_ be used at some > point. > > > > So making sure there are lots of guns around only serves to make a > lot of > > people very dead. This is a Bad Thing. > > > > Gun control laws are not the issue. It's a matter of mentality. In > Europe, > > where we have rather strict guncontrol laws, and have had them for a > long > > time a decent human being will not even think of shooting someone > else. In the > > US, where guns are tradition and part of the American way, many > people would > > not think twice before shooting someone. The result of this is that > the > > number of people getting killed by guns is enourmous, be they > criminals, > > little kids, old grannies, or presidents. > > > > This sucks. > > I agree wholeheartedly. Uncontrolled guns do not solve problems, they > > create them. If most households have at least one firearm, it makes > it > that much easier for a criminal to obtain one by stealing yours while > you > are at work. > > Canada may be regulated to death according to most libertarians, but I > for > one like it that way. I can walk alone and unarmed at night in > Ottawa, > Toronto, etc. without fearing for my life. Can a female resident of > Washington or New York say the same? Our schools do not have metal > detectors > at the entrances because they are not needed. > > IMNSHO the best way to fight crime is not with bigger guns than the > "bad > guys", but with better social programs such as universal health care, > and > improved day care so single parents can show their kids what a > productive > lifestyle looks like. This takes longer than blowing the brains out > of some > teenager that feels his only path to a better life is through crime, > and it > doesn't give the same adrenalin rush. However, it works at the source > of > crime, and not the consequences. This kind of talk makes me sick. For a start universal healthcare is totally unaffordable, when there is little or no cost the end-user over use of the services provided are inevitable, just look at Medicare here in Australia. Social security above certain levels leave recipients unmotivated to take responsibility for their own lives and is a bad example to their children, who will probably number largely among those teenagers who do turn to crime. > Cynthia, unrepentant bleeding-heart liberal Robert, unrepentant dry. > =============================================================== > Cynthia H. Brown, P.Eng. > E-mail: cynthb at iosphere.net | PGP Key: See Home Page > Home Page: http://www.iosphere.net/~cynthb/ > Junk mail will be ignored in the order in which it is received. > > Klein bottle for rent; enquire within. > > > From janzen at idacom.hp.com Wed Oct 1 15:41:57 1997 From: janzen at idacom.hp.com (Martin Janzen) Date: Thu, 2 Oct 1997 06:41:57 +0800 Subject: new in EFC's media archives - Mondex, crypto (fwd) Message-ID: <9710012220.AA05578@sabel.idacom.hp.com> Electronic Frontier Canada's David Jones (djones at insight.dcss.McMaster.CA) posted the following to the EFC mailing list: ------------------------------------------------------------------------------- New in EFC's media archives: 1. Plastic treasure ... not so smart after all http://www.efc.ca/pages/media/guardian.24sep97.html This article reports that a team in the Netherlands made a "successful attack" on a Mondex chip (Hitachi H8/3101) by activating a test mode in which the chip dumps its contents to a serial port. John Beric, security manager for Mondex simply says "I have never SEEN a report saying they have broken Mondex". (Is this plausible deniability?? ;-) The article also makes mention of EFC getting hassled by the National Bank of New Zealand over a leaked memo. In the mean time, Mondex is trying to ramp up deployment of its new chip, the Hitachi H8/3109, which (for the first time apparently) implements public key crypto. 2. If cops can read E-mail, so can the bad guys http://www.efc.ca/pages/media/gazette.24sep97.html Some coverage of the "crypto" issue in the context of a major international privacy conference held in Montreal last week. EFC scored some coverage for its position statement on crypto: http://www.efc.ca/pages/crypto/policy.html including a quote in favour of strong crypto: "There is a far greater risk to individuals, businesses, and the government if we are unable to effectively prevent criminals from gaining unauthorized access to our records and communications." ------------------------------------------------------------------------------- From ghio at temp0122.myriad.ml.org Wed Oct 1 15:45:21 1997 From: ghio at temp0122.myriad.ml.org (Matthew Ghio) Date: Thu, 2 Oct 1997 06:45:21 +0800 Subject: Remailers and ecash (fwd) In-Reply-To: <199709300125.UAA14206@einstein.ssz.com> Message-ID: <199710012227.SAA17395@myriad> Jim Choate wrote: > What would motivate an average consumer to use an anonymous remailer? > > Clearly simple anonymity or writing nasty letters to Grandma anonymously are > not going to motivate most folks irrespective of cost - they simply have no > interest in such activities. So, the question becomes: > > What besides raising hell anonymously, laundering money, and defeating > merchant purchase traffic analysis are commercial anonymous remailers good > for? Okay, let's take a look at what remailers are actually being used for. Go to dejanews and type in the addresses of all the remailers you know of, count the number of posts to each newsgroup and add them up. Here are the top twenty newsgroups that I got when I did this little experiment: 10471 alt.anonymous.messages 7272 alt.test 6236 alt.hackintosh 4392 alt.binaries.mac.games 1326 misc.test 1253 alt.religion.scientology 1109 alt.sex.stories 1023 soc.culture.singapore 915 alt.amazon-women.admirers 877 soc.culture.iranian 770 alt.anonymous 622 fj.news.usage 573 alt.politics.nationalism.white 571 alt.sex.spanking 557 talk.politics.guns 543 alt.tv.real-world 518 alt.cracks 517 alt.drugs.pot.cultivation 512 alt.privacy.anon-server 498 alt.revisionism So what are remailers being used for? 1) Private communication in the form of anonymous message pools 2) Test posts 3) Discussion of Macintosh computers 4) Discussion of obscure religions 5) Sharing erotic fantasy stories 6) Avoiding censorship in Singapore 7) Avoiding censorship in Iran 8) Discussion of remailers themselves 9) Discussion of controvertial political topics (racism, guns, drugs) 10) Discussion about a TV show Note that this list does not include harassing Grandma, money laundering, and all your other delusional terrorist fantasies. Welcome to the real world. From anon at anon.efga.org Wed Oct 1 15:53:03 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 2 Oct 1997 06:53:03 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" Message-ID: <51a02138f43e8a0225034edf2603b563@anon.efga.org> -----BEGIN PGP SIGNED MESSAGE----- Cynthia Brown wrote: >On Wed, 1 Oct 1997, Alex Le Heux wrote: >> This sucks. > >I agree wholeheartedly. >IMNSHO the best way to fight crime is not with bigger guns than the >"bad guys", but with better social programs such as universal health >care, and improved day care so single parents can show their kids >what a productive lifestyle looks like. Of course you agree wholeheartedly, you are an exploiter. It is wrong. You should be ashamed of yourself. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDLA95aWtjSmRH/5AQFykwf+Nh/3MKqyK30Tc90Wj0MCvKLvyZYzkKiZ KV/H8+7Of5hPh0pUEZNDBxr7A3x02+0jhYwJymzYcHJuXAP0+RmXtWRyAWz9TFE3 AB23HgLODI2IrsD1NvlwbjHQzpLVqfT99QEYIaolZScilc5hw1uZV8dAK4SjXDnZ +K4QG3RZpAxpKZUSWduErtJ+8JAzavH4ybeR95hO2uY2na1ckmwWm39ERg+u+N4k rP2wd3E4IQ7XWbPCrHWEPoDs4PHMg09lK/Y+fv9ejE8+ehq/YeO1WYtZtlaCURtU CE7JXH4b60+NmDuISybaMWdv70IFOneukz64zasAT1wp9w4Mxqjw7Q== =VYI9 -----END PGP SIGNATURE----- From anon at anon.efga.org Wed Oct 1 15:56:27 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 2 Oct 1997 06:56:27 +0800 Subject: None Message-ID: How good will it be to have total conformity? What will be left of singularity? And personality? And you and me? CM From The.Global.Lotto.Agency at news.NetVision.net.il Thu Oct 2 07:00:17 1997 From: The.Global.Lotto.Agency at news.NetVision.net.il (The.Global.Lotto.Agency at news.NetVision.net.il) Date: Thu, 2 Oct 1997 07:00:17 -0700 (PDT) Subject: Work from home Message-ID: <199710021359.PAA16988@news.NetVision.net.il> The Global Lottorie Agency ------------------------------------------- You can make extra income,with global lotto agency. Now open for all countries,you can become an agent, sale lottorie ticket's all over the globe,earn comissions on sales and members referals.The Global Agency is binded and supervised by the german goverment. Your monthly checks,of comissions and bonuses,mailed straigth to your mail box,evry month like a clock.No experience is nessacerie,fully automated,your part is just referals,and there is no limit of how much you can earn. For complet details refer to http://www.totolotto.com/rafibeny for contact rafibeny at netvision.net.il The Global Lotto Agency rafi ben Executive Sales Mnager TEL 972-536-1902 FAX 972-536-1204 givat hadar suite 2345 tel-aviv israel From tcmay at got.net Wed Oct 1 16:57:16 1997 From: tcmay at got.net (Tim May) Date: Thu, 2 Oct 1997 07:57:16 +0800 Subject: Mr. Policeman is Your Friend In-Reply-To: <9710012220.AA05578@sabel.idacom.hp.com> Message-ID: At 3:20 PM -0700 10/1/97, Martin Janzen wrote: >Electronic Frontier Canada's David Jones (djones at insight.dcss.McMaster.CA) >posted the following to the EFC mailing list: >2. If cops can read E-mail, so can the bad guys > http://www.efc.ca/pages/media/gazette.24sep97.html Let's not forget that cops are often the bad guys. And I don't mean this in a macho, off-the-pigs way. I mean that throughout history the "cops" are those who have enforced the laws and whims of tyrants, who have arrested and tortured and executed dissidents and nonconformists of all flavors, and who were the "King's men" in the times of the Founders. Even in more recent decades in the U.S., don't forget it was "cops" who harassed civil rights workers, who broke up perfectly legal strikes, who arrested and imprisoned Eugene Debs for speaking out against the draft in particular and a foolish war, WW 1, in general, and so on. One need only look to J. Edgar Hoover and his police state measures. (In fact, the very term "police state" tells us all we need to know about whether or not "Mr. Policeman is Your Friend" is always, or even most of the time, true.) And with full awareness that I am invoking Godwin's Law, the "cops" in Europe in the 1933-45 period were the enforcers of Hitler's policies. Here's a list of some folks throughout history and in various regimes who would likely have reason not to want to escrow their keys with the local police: Jews, Catholics, Protestants, atheists, heretics, schismatics, heathens, poets, authors, Scharansky, Solzhenitsyn, refuseniks, Chinese dissidents, students in front of tanks, Branch Davidians, Scientologists, Jesus, Gandhi, Nelson Mandela, African National Congress, UNITA, Thomas Jefferson, Patrick Henry, colonial rebels, patriots, Tories, Basque separatists, Algerian separatists, secessionists, abolitionists, John Brown, draft opponents, communists, capitalists, imperialist lackeys, anarchists, Charlie Chaplin, Galileo, Joan of Arc,, Martin Luther, Martin Luther King, Malcolm X, Stokely Carmichael, civil rights workers, Margaret Sanger, birth control activists, abortionists, anti-abortionists, Michael Milken, Robert Vesco, Marc Rich, Nixon's Enemies, Hoover's enemies, Clinton's enemies, Republicans, Democrate, anarchists, labor organizers, pornographers, readers of "Playboy," viewers of images of women whose faces are uncovered, Amateur Action, Jock Sturges, violators of the CDA, alt.fan.karla-homulka readers, Internet Casino customers, Scientologists, Rosicrucians, royalists, Jacobins, Hemlock Society activists, Jimmy Hoffa, John L. Lewis, Cesar Chavez, opponents of United Fruit, land reformers, Simon Bolivar, Robin Hood, Dennis Banks, American Indian Movement, Jack Anderson, Daniel Ellsberg, peace activists, Father Berrigan, Mormons, Joseph Smith, missionaries, Greenpeace, Animal Liberation Front, gypsies, diplomats, U.N. ambassadors, Randy Weaver, David Koresh, Ayotollah Khomeini, John Gotti, Papists, Ulstermen, IRA, Shining Path, militia members, tax protestors, Hindus, Sikhs, Lech Walesa, Polish labor movement, freedom fighters, revolutionaries, Ben Franklin, Thomas Paine, and "suspects" --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From ravage at ssz.com Wed Oct 1 17:05:01 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 08:05:01 +0800 Subject: Remailers and ecash (fwd) Message-ID: <199710020003.TAA22891@einstein.ssz.com> Forwarded message: > Date: Wed, 1 Oct 1997 18:27:10 -0400 > From: ghio at temp0122.myriad.ml.org (Matthew Ghio) > Subject: Re: Remailers and ecash (fwd) > Jim Choate wrote: > > > What besides raising hell anonymously, laundering money, and defeating > > merchant purchase traffic analysis are commercial anonymous remailers good > > for? > > So what are remailers being used for? We are talking commercial remailers here right? . As famous as you are, you don't get to change the rules in the middle of the game. > 1) Private communication in the form of anonymous message pools You don't need anonymous remailers for this since simple crypto will provide just as good private communications security than anonymous remailers will because there is no central choke point where traffic analysis occurs . Now if one of the parties is actualy under surveillance then the anonymous remailers won't help because they will be tapping at the source, if anything it would provide further evidence of the parties complicity in a conspiracy. If you want your communications to stay private (if I understand your use of the word) use encryption and use underground remailers which isn't open to commercial exploitation, or else simply purchase a different account on your current ISP. > 2) Test posts Irrelevant, people don't pay for test posts enough to keep a commercial remailer in business - unless we vastly increase the total traffic level by quite a few orders of magnitude. > 3) Discussion of Macintosh computers irrelevant, people won't pay for this either. > 4) Discussion of obscure religions irrelevant (and I'm a Pantheist, they don't get more obscure than that) since people ain't gonna pay for this unless they are persecuted in their country of residence. If so the easiest thing to do would be to outlaw anonymous remailers (with the same logic they use to oppress the religion). [see #6 for more details on this] > 5) Sharing erotic fantasy stories And you suspect they will actualy pay for this? This line of reasoning I would love to hear more on... > 6) Avoiding censorship in Singapore Let's look at this a moment. I believe we can take as a given that Singapore is a oppressive regime. Furthermore all traffic in Singapore goes through government operated and regulated POP's. In that environment you really want to send traffic to an anonymous remailer? Can you say 'man-in-the-middle', and not only that but all the outgoing traffic from Singapore won't be through an anonymous remailers making it trivial for Singapore officials to determine exactly who to go hassle. So it is clear that the only parties discussing Singapore safely will be outside Singapore which makes the supposition that Singapore is going to come after you a bit suspect. You're talking about a country that outlaws private satellite dishes - get real. Furthermore commercial enterprises are open to much closer scrutiny in areas like Singapore making it even harder to stay in business unless the operator happens to be a government stooly, hardly the stuff of security. My thesis would be that any remailer (commercial or not) in a country with an oppresive regime is the last place you want to consider secure. > 7) Avoiding censorship in Iran See #6. Applies to China, Korea, Iraq, etc. > 8) Discussion of remailers themselves I would also like to see your explanation of exactly why they would pay for this. > 9) Discussion of controvertial political topics (racism, guns, drugs) The only reason that anonymous remailers are useful here is that the originating party doesn't want to deal with the results of being known. The flip side to this is that the reputation of anonymous discussions in these sorts of areas would have little political impact. A person who won't discuss such issues under their own name certainly won't go out and become actively involved in some political movement. Now if your claim is that such activity might hold some weight with an elected official I would appreciate an explanation as well - especialy considering that the anonymity provides just enough 'cover' so that the politician can safely ignore any and all traffic made through this mechanism, "They aren't one of my constituents." If you have some reasoning outside this please share it. > 10) Discussion about a TV show Irrelevant because people won't pay for this. Free remailers are useful for all sorts of mental masturbation, for actual business there doesn't seem to be a lot of uses. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From brianbr at together.net Wed Oct 1 17:23:31 1997 From: brianbr at together.net (Brian B. Riley) Date: Thu, 2 Oct 1997 08:23:31 +0800 Subject: Remailers and ecash Message-ID: <199710012356.TAA03115@mx02.together.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/1/97 5:03 AM, Robert A. Costner (pooh at efga.org) passed this wisdom: >At 09:59 AM 10/1/97 +0200, Anonymous (Monty Cantsin) wrote: >>It is my understanding that serious naval vessels like aircraft >>carriers use constant bandwidth channels to defeat traffic analysis. >>That is, to every place they might wish to communicate, they >>continuously broadcast encrypted information. Most of the time the >>channel is empty, of course, but nobody outside can tell when. >> >>If we had a remailer network in which each customer had a constant >>bandwidth connection to one or more remailers, you could have zero >>latency mail. > >Let me get this straight. You are suggesting that anyone who wishes to be >anonymous should send a continuous 24 hour stream of low bandwidth data to >a central point in an effort to help keep anyone from knowing that they >wish to be anonymous. > >While this may help correct the latency problem, how do you think this will >effect anonymity? Do you think that by sending a continuos stream of data >to the remailer, the sender will be less identifiable? No, but I see that someone with a fulltime connection or even a fulltime machine with an hourly or half hourly dialup would setup a program to send randomly generated "Null:" messages to the randomly selected remailers so that when he does have something to send that is meaningful it will not change the apparent flow ... -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDLjFMdZgC62U/gIEQI1wgCg22mCFVbWn77DwG1CUlIRJah7oooAnic0 e0J0D1IOLP85CNvadBh9cBVA =5UGm -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys "First say to your self what you would be; then do what you have to do." Epictetus (35-135 A.D.) From ravage at ssz.com Wed Oct 1 17:24:06 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 08:24:06 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" (fwd) Message-ID: <199710020034.TAA23126@einstein.ssz.com> Forwarded message: > Date: Wed, 1 Oct 1997 19:16:22 +0100 > From: alexlh at yourchoice.nl (Alex Le Heux) > Subject: Re: "Show me an example of terrorists using the Internet or crypto" > You people just don't get it do you? A gun has one purpose: To kill. Just like > any other tool, a gun, if it is available _will_ be used at some point. Actualy I have never killed anything with my current .22, but a lot of tin cans and paper targets have been holed. And, no, I would NEVER consider a .22 anything close to a self-defence weapon since even a head shot doesn't guarantee anything other than pissing the target off. I might use it as a club but it is not nearly that stout, I'd go for my shovel or hoe or maybe my nunchakus (assuming they didn't have a gun -which most burglars and such don't have). > So making sure there are lots of guns around only serves to make a lot of > people very dead. This is a Bad Thing. Actualy it cuts down on crime because the criminal is afraid they might get shot. A perfect example of this is Florida or Texas where the vast majority of people have guns. If you catch a burglar in your house or car do they run? No. Why? In the vast majority of cases the perp states that they were afraid of being shot - in effect saving both lives. I can say this, I would never consider staying in a place for very long that prevented me from owning a gun legaly. Well, actualy there is one way, guarantee that I get my own personal police officer to go around with me (and they should be armed). Here in Texas we have a law that permits the owner of property to kill without warning any party stealing their property after dark. It's amazing that the vast majority of burglaries and such happen during the day. It's further interesting that in both Texas and Florida after legalizing handguns the number of robberies and such went down, as well as the number of violent crimes using guns. The only thing that went up was domestic violence where one spouse killed another in a fit of rage. Had the gun not been there they would have gone back to knives and frying pans which used to be the weapon of choice. Are you proposing that we outlaw knives and frying pans as well? > Gun control laws are not the issue. It's a matter of mentality. In Europe, > where we have rather strict guncontrol laws, and have had them for a long > time a decent human being will not even think of shooting someone else. Not mentality, maturity. I am shure they think about it all the time, they just can't find an underground gun dealer. Yeah, they not only blow up the individual target but a couple of dozen other bystanders in the process. If it's so damn safe how come the cops over there all carry machine pistols and such. Something you never see here in the states even during a bank robbery. > In the > US, where guns are tradition and part of the American way, many people would > not think twice before shooting someone. The result of this is that the > number of people getting killed by guns is enourmous, be they criminals, > little kids, old grannies, or presidents. First, not that many little kids are killed by guns. Most die many other ways much more horrible. Two presidents and if Illinois is any show the Grandma's can take care of themselves. Secondly, in this country more people are killed each year by hands, feet, and clubs than guns. Thirdly, the vast majority of gun owners would no more shoot somebody without thinking than they would run over them in their car. Beside, it takes a moment of reflection to get the sites lined up. > We are not trying to export our stupidity, we're just trying to explain to > you how we live. We live in a place where we don't even have to think about > getting a gun, because the chances of us encountering a gun in the hands > of an adversary are negligible. You have accepted your over-bearing invasive jackbooted police with a equinimaty that would never occur here - we'd shoot the SOB's. Sounds like when it comes to sheeple the US has a long way to go when compared to Europe. > Wake up and smell the coffee, dude. If you have lots of guns around, you're > gonna end up with lots of people getting shot. And if some of those aren't shot we'd have a lot of people running around with other peoples property against their will. Shooting a person is in and of itself not bad, if you believe it is then I take it you support disarming the police and military as well. Do you support capital punishment? Apparently it's you and your ilk that haven't gotten the clue: It isn't that a gun was used but under what circumstances. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Wed Oct 1 17:44:33 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 08:44:33 +0800 Subject: Remailers and ecash (fwd) Message-ID: <199710020038.TAA23185@einstein.ssz.com> Forwarded message: > Subject: Re: Remailers and ecash > Date: Wed, 1 Oct 97 19:56:26 -0400 > From: "Brian B. Riley" > No, but I see that someone with a fulltime connection or even a > fulltime machine with an hourly or half hourly dialup would setup a > program to send randomly generated "Null:" messages to the randomly > selected remailers so that when he does have something to send that is > meaningful it will not change the apparent flow ... And why does this by any security when it's the header info and contents that Mallet looks at, not the frequency. The only thing such approaches do is impliment security by obscurity, and that ain't security. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Wed Oct 1 17:44:37 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 08:44:37 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" (fwd) Message-ID: <199710020047.TAA23239@einstein.ssz.com> Forwarded message: > Date: Wed, 1 Oct 1997 16:20:11 -0400 (EDT) > From: Cynthia Brown > Subject: Re: "Show me an example of terrorists using the Internet or crypto" > I agree wholeheartedly. Uncontrolled guns do not solve problems, they > create them. If most households have at least one firearm, it makes it > that much easier for a criminal to obtain one by stealing yours while you > are at work. Most households in the US do have firearms, most criminals don't steal guns they buy them from the underground. If they do steal them they sell them pretty quickly afterward. Very few gun crimes in the US are committed with stolen guns, or guns stolen by the possessor at the time of the shooting. > Canada may be regulated to death according to most libertarians, but I for > one like it that way. I can walk alone and unarmed at night in Ottawa, > Toronto, etc. without fearing for my life. Can a female resident of > Washington or New York say the same? Our schools do not have metal detectors > at the entrances because they are not needed. Bullshit, they have muggings and such there just like everywhere else. Are you seriously claiming that sort of stuff doesn't happen? The schools here in Austin don't either. Most schools in the US don't have this sort of stuff. > IMNSHO the best way to fight crime is not with bigger guns than the "bad > guys", but with better social programs such as universal health care, and > improved day care so single parents can show their kids what a productive > lifestyle looks like. This takes longer than blowing the brains out of some > teenager that feels his only path to a better life is through crime, and it > doesn't give the same adrenalin rush. However, it works at the source of > crime, and not the consequences. The way to fight crime is to stop putting 1st time offenders, drug offenses, non-violent crimes, etc. in jails AND to make consensual crimes non-crimes like they ethicaly should be. We have over a million people in jail in the US, more than any other country, the vast majority of whom shouldn't be in jail because what they did shouldn't be a crime. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Wed Oct 1 17:59:28 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 08:59:28 +0800 Subject: Forwarded mail... Message-ID: <199710020103.UAA23344@einstein.ssz.com> Forwarded message: > Date: Wed, 1 Oct 1997 21:42:39 +0200 (MET DST) > From: nobody at REPLAY.COM (Anonymous) > Subject: Re: "Show me an example of terrorists using the Internet or crypto" > You are also not considering the case where one person has a gun and > another does not. The situation is more stable if both people are > armed. (And don't claim you are talking about disarming a whole > society. You aren't, just part of it.) Why is the situation more stable if both parties are armed? If I were confronted by a armed burglar and we were facing off I would pull the trigger as soon as I got a lock. If their gun wasn't in a ready position I would warn them and if they so much as flinched I'd drop them. If they were unarmed I might beat them senseless with the gun but I would not shoot them unless they made a motion to rush me, then I would go for a non-lethal shot unless the distance was less than a dozen feet (rushing distance) or so in which case I prefer head shots followed by center-torso (heart) shots. I'd also train to fire 3 shot groups. The one exception would be center-torso shots if they were wearing heavy or bulky clothing that might hide a vest. In that situation (assuming it wasn't a rush) I would shoot for the inside of the thigh at the hip-joint. Hit that artery and your dead without immediate medical attention (which I am not likely to give after just shooting the SOB). If it was a rush situation I would dump the clip into their chest moving upward, hoping the KE would slow them down enough to get a clear head shot (this would be what I practiced the most as well). No, despite your claim the most stable situation is to not have the invasion in the first place, followed by the victim being the only one armed. Anything else is a gun-battle waiting for a twitch. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From dlv at bwalk.dm.com Wed Oct 1 18:01:23 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Thu, 2 Oct 1997 09:01:23 +0800 Subject: None In-Reply-To: <17450f976975427f087e75255043e2b0@anon.efga.org> Message-ID: <4swwDe1w165w@bwalk.dm.com> Anonymous writes: > > Dr.Dimitri Vulis KOTM writes: > > > Are the posters in this thread unwilling to criticize C2Net's StrongHold > > because they're afraid to get obnoxious threatening letters from Sameer > > Parekh's shysters? > > Those who are newcomers to the list should know that Vulis has never > presented any evidence substantiating his vague claims that Stronghold > is insecure or has backdoors (or whatever the claims were). Vulis is > conducting a personal vendetta against one of C2Net's staff members and > anyone who happened to be or become associated with him. > > Nor do I have to present any evidence. I'm not the one selling StrongHold. I have received several threatening communications from C2Net's lawyers, which were discussed at length on this list. To avoid unpleasant disputes I agreed not to disseminate my opinions about StrongHold. Please keep this in mind if you consider buying it. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From ravage at ssz.com Wed Oct 1 18:12:13 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 09:12:13 +0800 Subject: None (fwd) Message-ID: <199710020109.UAA23398@einstein.ssz.com> Forwarded message: > Subject: Re: None > From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) > Date: Wed, 01 Oct 97 16:15:50 EDT > > Those who are newcomers to the list should know that Vulis has never > > presented any evidence substantiating his vague claims that Stronghold > > is insecure or has backdoors (or whatever the claims were). Vulis is > > conducting a personal vendetta against one of C2Net's staff members and > > anyone who happened to be or become associated with him. > > Nor do I have to present any evidence. I'm not the one selling StrongHold. Exactly, StrongHold is the one making the claims of security, it behooves them to address any and all criticisms of their product. > I have received several threatening communications from C2Net's lawyers, > which were discussed at length on this list. To avoid unpleasant disputes > I agreed not to disseminate my opinions about StrongHold. > Please keep this in mind if you consider buying it. Which is sufficient reason not to use the StrongHold product or anything else put out by them. Any company which desires to suppress opinions or discussion over their product clearly has something to hide. This is what I tell my customers and they seem to understand the utility of such an approach. Never support strong-arm tactics, honest people don't need them. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Wed Oct 1 18:17:38 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 09:17:38 +0800 Subject: Traffic Analysis and Cover Traffic (fwd) Message-ID: <199710020120.UAA23468@einstein.ssz.com> Forwarded message: > Date: Wed, 1 Oct 1997 09:33:13 -0700 > From: Tim May > Subject: Traffic Analysis and Cover Traffic > As I understand your example above, the sender becomes less identifiable > because he can always be counted on to send some packets; an attacker > cannot see a message after a long period of no messages and correlate it to > a similar sudden increase of activity at a possible recipient machine. > > Traffic analysis is something you should look at. And think about. This holds if it is a one-time occurance. If Mallet is looking at the traffic over a very long time it is completely reasonable to expect some correlation to become clear. To address the example another presented about some book example of burst analysis. Look at real-world examples such as the underground in France in WWII. They would generate a single message on a known frequency at a specific time. Thus interested parties could dial-in and get the info but would not provide the Nazi's with sufficient traffic or time to get a bearing. The revolutionaries in the book are amateurs and deserve what they get since it is clear they are incompentent and by extension not fit to run a country. Anyone with a clue will use times single instance transmissions and if available burst or SS transmitters to reduce the transmission time even more. With current technology like full-time satellite surveillance and transmitter characteristic analysis anything more than a single burst transmission with the radio from a random location will provide sufficient traffic to get a fix. You should also throw the transmitter away or change the drivers in the finals after each use as characteristic analysis will provide Mallet with the means to track the transmitter and thereby apply traffic analysis (just like they use in some cell systems). ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From wendigo at ne-wendigo.jabberwock.org Wed Oct 1 18:23:30 1997 From: wendigo at ne-wendigo.jabberwock.org (Mark Rogaski) Date: Thu, 2 Oct 1997 09:23:30 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: Message-ID: <199710020101.VAA16390@deathstar.jabberwock.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 An entity claiming to be Cynthia Brown wrote: : : I agree wholeheartedly. Uncontrolled guns do not solve problems, they : create them. If most households have at least one firearm, it makes it : that much easier for a criminal to obtain one by stealing yours while you : are at work. So take your gun to work ;) Yeah, I know ... that's not the point. : : IMNSHO the best way to fight crime is not with bigger guns than the "bad : guys", but with better social programs such as universal health care, and : improved day care so single parents can show their kids what a productive : lifestyle looks like. This takes longer than blowing the brains out of some : teenager that feels his only path to a better life is through crime, and it : doesn't give the same adrenalin rush. However, it works at the source of : crime, and not the consequences. I agree, but here's the catch: once you place the responsibility in the hands of the gov't, the system comes to a screeching halt. That which is mandated is corrupt, inefficient, and utterly useless. I'll tell you the first step to reducing crime ... get to know your neighbors. The problem that we have here in the U.S. is mobile society. How many Americans know the people on their street or in their complex? We have very little community left. A cow-orker of mine lives in the Oranges (near Newark, NJ), and she doesn't feel fearful when she walks through her complex at night. The tenants meet at least once a month on a semi-social basis, and so they know each other. It makes a big difference. I don't see most gov't funded social programs making even that amount of difference. The change has to be internal to the community, essentially decentralized. You can seed the ideas, but you have to understand that simply improving day care and health care isn't going to solve the problem, there has to be the internal process. Doc - -- [] Mark Rogaski "That which does not kill me [] wendigo at pobox.com only makes me stranger." -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDLyS8HFI4kt/DQOEQJQeACg/faa10X1VKsvrxupS+FVNhDHI7IAnRbK 2WZq4js/Ont5zmkHsh8KzCYT =1sal -----END PGP SIGNATURE----- From mbp at pharos.com.au Wed Oct 1 18:40:47 1997 From: mbp at pharos.com.au (Martin Pool) Date: Thu, 2 Oct 1997 09:40:47 +0800 Subject: Secure HTTP servers. In-Reply-To: Message-ID: On Wed, 1 Oct 1997, Dr.Dimitri Vulis KOTM wrote: > Are the posters in this thread unwilling to criticize C2Net's StrongHold > because they're afraid to get obnoxious threatening letters from Sameer > Parekh's shysters? For what it's worth, we use Stronghold and are very happy with it. They ship almost all the code, and they provide worthwhile crypto outside of the States. Being based on Apache it has a fairly vibrant development community, so you can obtain modules to do Java servlets, inline Perl, access to various DBs, and so on, and participate in the development of those modules. It's moderately easy to install, configure, and customize, although you'd probably want a little bit of Unix sysadmin experience. I believe an NT port is in alpha. Criticism? A few times I've run into SIGSEGV's in the crypto libraries. To be fair, the problems are only visible when you plug in third-party modules, there are workarounds, and they may in fact be not Stronghold's fault. Also, their manual seems to have been out of print for months -- not such a problem because there's an online version, but still a bit annoying. UKWeb's technical support are quite good and compare extremely well to that of some large organizations. I have no evidence in support or rebuttal of C2Net's alleged harrassment of Dr Vulis, so I won't comment on that. -- Martin Pool Pharos From vznuri at netcom.com Wed Oct 1 18:43:36 1997 From: vznuri at netcom.com (Vladimir Z. Nuri) Date: Thu, 2 Oct 1997 09:43:36 +0800 Subject: money laundering book review Message-ID: <199710020135.SAA03140@netcom13.netcom.com> some new books that might be of interest to some cpunks ------- Forwarded Message Date: Wed, 1 Oct 1997 11:59:12 -0400 From: Kris Millegan RoadsEnd Subject: Fwd: piml] Free Life Commentary - The New World Order To: CTRL at LISTSERV.AOL.COM - --------------------- Forwarded message: From: ke4yqz at mindspring.com (Roger Cravens) To: c-news at world.std.com, piml at mars.galstar.com Date: 97-09-30 16:54:38 EDT >From: "Chris R. Tame" >Date: Mon, 29 Sep 1997 19:45:58 +0100 >Subject: Free Life Commentary - The New World Order >To: libnw at circuit.com (Multiple recipients of Liberty_NW) > >I hope the third issue of my colleague Sean's Free Life Commentary will >prove of interest. > >Chris R. Tame >Director >Libertarian Alliance > > ------- Forwarded message follows ------- > >Free Life Commentary >Editor: Sean Gabb >Issue Number Three >29th September 1997 > >========================== >"Over himself, over his own mind and body, >the individual is sovereign" >(J.S. Mill, On Liberty, 1859) >========================== > >Free Life Commentary is an independent journal of comment, >published on the Internet. To recieve regular issues, send >e-mail to Sean Gabb at old.whig at virgin.net > >Issues are archived at http://freespace.virgin.net/old.whig/ > >Contact Address: 25 Chapter Chambers, Esterbrooke Street, >London, SW1P 4NN; Telephone: 0181 858 0841 > >========================== > > On the New World Order: > Two Book Reviews > by Sean Gabb > > > > International Efforts to Combat Money Laundering > William C. Gilmore (ed.) > Grotius Publications Limited, > Cambridge, 1992, 335pp, 48 (pbk) > (ISBN 0 521 46305 X) > > Money Laundering: A Practical Guide to the New >Legislation > Rowan Bosworth-Davies and Graham Saltmarsh > Chapman & Hall, London, 1994, > xii and 304pp, 49.50 (hbk) > (ISBN 0 412 57530 2) > > >The first of these books is a collection of treaties, plus other >documents, concerned with the international fight against >money laundering. The second explains how these treaties >have been enacted into, and are enforced under, the laws of >the United Kingdom. Both works will repay the closest >study. In clear detail, they show the growth of what must >be called a New World Order, and how, without some >interposing cause, this may produce a universal slide into >despotism. > >The fight against money laundering begins with realising >that the "War on Drugs" has been lost. When goods are >portable and easily concealed, and when demand for them is >strong enough to bear almost any cost of bringing them to >market, the main effect of prohibition will be to put a >bounty on crime. For all the efforts of the past three >generations, illegal drugs are available in most high security >prisons. In much of the West, street prices have been >stable or even falling since 1980. > >The official response, however, has not been to give in and >legalise the trade, but to expand the War to a front where >previously there had been few hostilities. While keeping up >their efforts against the trade itself, the authorities have >turned increasingly to confiscating its proceeds. This new >approach has three alleged benefits: > >First, it will deprive criminals of their incentive to enter >and remain in the trade; > >Second, it will allow the punishing of those in charge of the >trade - people who never touch or see illegal drugs, but to >whom the main profits ultimately flow; > >Third, it can make the War on Drugs self-supporting, and >perhaps yield a surplus for other public spending. > >There is, however, one practical difficulty. Before the >authorities can confiscate the money, they must find it. To >do this, they must keep it from being merged beyond recall >into the general flow of investment. This involves ending >bank secrecy and imposing a mass of financial regulation. >Now, most people - especially the rich - dislike having their >lives pried into. Nor do banks like higher costs and >limitations on what business they can do. And so, given >the present freedom of capital markets, no government >acting alone can afford a strict policy of confiscation. It >would, sooner or later, cause a flight of transactions to >more liberal places. > >The solution has been to try making everywhere in the >world equally illiberal. Such was the purpose of the >United Nations Convention Against Illicit Traffic in >Narcotic Drugs and Narcotic Substances, signed in Vienna >in December 1988 [full text in Gilmore, pp.75-97]. This is >one of the most important international treaties of the past >50 years. It not merely requires its signatory states to >criminalise the laundering of drug money, and to confiscate >it where found, but lays down so far as possible a common >wording for the criminal statutes, and a common mode of >enforcement. It also requires full and prompt cooperation >between the signatory states for the enforcement of these >laws anywhere in the world. > >The Convention had little direct or immediate effect on >British law. Many of its requirements, indeed, had already >been met in the Drug Trafficking Offences Act 1986. Most >others were only met in the Criminal Justice Act 1993, >which enacts the European Community Directive of 1991 >on the Prevention of the Use of the Financial System for the >Purpose of Money Laundering [full text in Gilmore, >pp.250-67]. This itself derives from the Vienna Convention >only through the Council of Europe Convention on >Laundering, Search, Seizure and Confiscation of the >Proceeds from Crime 1990 [full text in Gilmore, pp.177- >91]. Even so, this country is fast becoming a financial >police state of the kind agreed at Vienna - and where the >process cannot be traced to the Convention, it can be traced >to the same international pressures of which the Convention >is itself a result. > >Let me explain. When I talk about a New World Order, I >do not mean some grand conspiracy of bankers, or Jews, or >Illuminati, or even - with far more probability - the >American Government. There are countries where policy is >largely dictated from outside. But for rich and powerful >countries, the truth is more complex. Most international >obligations imposed on this country, for example, were not >only consented to by our rulers, but were usually proposed >by them, and are enforced by agencies in which our own >countrymen often occupy senior positions. > >Where others see conspiracies, I see public choice >economics. Whenever a government tries to do something >dangerous or unnecessary, like banning drugs or educating >the poor, it must set up an agency through which to spend >the allocated funds. Once employed, the agents will - as if >directed by an invisible hand - start to find more and more >justifications for expanding their status and numbers. They >collect the statistics. They know which ones to publish and >which to hold back. They are the politicians' first and >favoured source of advice. They have their pet journalists. >They trade favours with the relevant interest groups. They >know exactly how to give themselves a pleasing life, and >how to see off threats to it. Unless the money runs out, or >the public turns really nasty, they can write their own >budget cheques. > >By natural extension, the same is now happening at the >international level - though with potentially far worse >consequences. In the first place, there is limitless money: >budgets would need to swell unimaginably large to reach >even one per cent of gross planetary product. In the >second, public anger seldom crosses borders; and, if all else >fails, the politicians and bureaucrats in one country can >shelter behind the excuse of treaty obligations that cannot be >unilaterally be cast off - not, at least, without consequences >more horrible than words exist to describe. Third, the >enforcement of international treaties means the growth of >what is in effect an international bureaucracy. The local >enforcers of a treaty may be citizens of the signatory states, >who will live and work in their home countries, and may >even occupy positions in the domestic administration. Yet >these are people who, by virtue of the agreements they >enforce, and the contacts they make and maintain in other >countries, are members of an international order. And, in >at least the case of money laundering, they will share an >agenda that is often deeply hostile to their native >institutions. > >This can be seen - expressed with almost naive honesty - in >the book by Messrs Bosworth-Davies and Saltmarsh. Both >are British police officers: the latter is a departmental head >at the National Criminal Intelligence Service. Both take it >for granted that the world needs an international police >force. Both are unable to believe that anyone can >disinterestedly object to the necessary harmonisations of >law, and the corresponding abolition of Common Law >protections. They "know one senior clearing banker who >has described this [money laundering] legislation as the >nearest thing he has experienced to >'McCarthyism'...".[p.172] Of course, they see things >differently. The legislation > > discloses, on mature reflection, a set of carefully > structured laws which, with good will, due > diligence and a modicum of responsible attention > from the industry as a whole, should not prove > too burdensome. Indeed, the authors believe that > some of the regulatory requirements have been > diluted too much already, in a misguided attempt > to placate the sensibilities of certain sectors of the > industry....[Ibid.] > >With people like this advising the politicians and lecturing >the rest of us, little wonder the Drug Trafficking Offences >Act predates the Vienna Convention by two years! Though >they will hotly disagree - and even perhaps consider a libel >writ - Messrs Bosworth-Davies and Saltmarsh cannot be >regarded as our countrymen. More at home in a gathering >of Bulgarian or Filipino police chiefs than with any of us, >they are foreigners with British passports. > >Somewhat less honest, though still interesting, is the >Explanatory Report of the Committee of Experts who >drafted the Council of Europe Convention [full text in >Gilmore, pp.192-237]. Though formally subordinate to a >committee of the various European Ministers of Justice, >these experts plainly saw their first duty as lying elsewhere. >Call it "the international community" or their own order, >their duty was collective and not to any single country. > >Look at their dislike of the narrow focus of the Vienna >Convention. They wanted something that would also allow >confiscation for > > terrorist offences, organised crime, violent crimes, > offences involving the sexual exploitation of > children and young persons, extortion, > kidnapping, environmental offences, economic > fraud, insider trading and other serious offences. > [Gilmore, p.204] > >But they had to concede that not every European country >might like its own laws against these acts to be written by >an international committee. And so they allowed each >signatory state to reserve whatever of these acts to its own >legislative process. > > The experts agreed, however, that such states > should review their legislation periodically and > expand the applicability of confiscation measures, > in order to be able to restrict the reservations > subsequently as much as possible. [Ibid.] > >And this is only the beginning. As yet, the shape of world >government exists barely in outline. But the tendency ought >to be plain. Power is moving from national - and mostly >democratic - governments to unaccountable and even >invisible bureaucracies. Liberal institutions that are often >the work of ages are being hammered into the transmitters >of unlimited power. We are beginning to known how >people in the Greek city states felt after absorption into the >Roman Empire. > >When the American militiamen cry out that the United >Nations is about to invade in black helicopters and plant >microcomputers in their bottoms, I am at least sceptical. >This is not the New World Order that I see. What I do see >is actually worse. We can shoot the helicopters down, and >dig out the microcomputers, and put the ringleaders on >trial. We can go about playing the hero of our choice from >Star Wars. But in the real world, there is no Death Star to >blow up - no Darth Vadar to push into the void. There is >just a huge, elastic network of people, all acting in what >they believe is the public good, most with some degree of >public support. > >How this kind of despotism can be resisted is another >question, and I have said enough already. But I will repeat >- the books here reviewed do repay a very close study. At >the very least, it is useful to see the enemy's future plan >laid out in such detail. > >Sean Gabb > >========================== >If you like Free Life Commentary, you may also care to >subscribe to my longer, hard copy journal: > >Free Life >The Libertarian Alliance >25 Chapter Chambers >London SW1P 4NN > >A 10 Pound subscription buys you four issues. > >========================== >Legal Notice: Though using the name Free Life, this >journal is owned by me and not by the Libertarian Alliance, >which in consequence bears no liability of whatever kind >for the contents. >-- >Sean Gabb | "Over himself, over his own | >E-mail: old.whig at virgin.net | mind and body, the individual| >Web Page: | is sovereign" | >http://freespace.virgin.net/old.whig/ | J.S. Mill, On Liberty, 1859 | > >-- >Chris R. Tame, Director >Libertarian Alliance | "The secret of Happiness is Freedom, | >25 Chapter Chambers | and the secret of Freedom is Courage" | >Esterbrooke Street | Thucydides, Pericles' Funeral Oration | >London SW1P 4NN >England >Tel: 0171 821 5502 >Fax: 0171 834 2031 >Email: chris at rand.demon.co.uk >LA Web Site: http://www.digiweb.com/igeldard/LA/ >Free Life Web Site: http://freespace.virgin.net/old.whig > > >+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ >LIBERTY NORTHWEST CONFERENCE Fidonet 1:346/16 (208) 267-9851 >"The only libertarian-oriented political discussion conference on >the Fidonet Backbone..." SysOps AREAFIX: LIB_NW >Visit Liberty Northwest on the Web: http://www.saldivar.com/lib_nw/ >Subscribe: libnw-on at circuit.com -- Unsubscribe: libnw-off at circuit.com > >...Liberty is never an option... only a condition to be lost >+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > ******************************************************************** * Liberty is NEVER an option ... only a condition to be lost! * * http://www.jbs.org * ******************************************************************** * Roger Cravens, SYSOP * * South East Signals Intelligence Group BBS: (770-) 942-1089 * * Atlanta, GA * ******************************************************************** * Signals Intelligence: "... and the truth will set you free"! * ******************************************************************** ------- End of Forwarded Message From golddot at nym.alias.net Wed Oct 1 19:44:00 1997 From: golddot at nym.alias.net (Gold Dot) Date: Thu, 2 Oct 1997 10:44:00 +0800 Subject: Encrypting Pagers is Easy! [Overview, technical tradeoffs, crypto] Message-ID: <19971002023208.29615.qmail@nym.alias.net> Y'all: Since I design pagers for a living, I thought I might comment on encryption in pagers. I've been thinking about encryption in pagers for several years now. RC4 was suggested, and it is probably a good choice for the low end microcontrollers used in pagers. The problem with encryption in pagers is not algorithms, hardware, software or even technology. The problem is getting awareness that there is a problem transmitting pages in the clear. Most people have no clue and I've seen not one request from a customer (meaning large paging companies) for encrypted pagers. A few more well-publisized hacks will help, though. Code space is at a premium in a pager, so widespread awareness of the inherent insecurity of paging protocols will be necessary to get encryption into the products. So, here's a project for any hacker with time on their hands. Input the audio signal from a garden variety scanner into your sound card (just about any variety will do) and decode the signal. It's just 4 level FM. I'd do it myself, but I value my job. :-) Or, if you're lazy and have money, buy yourself a SignalPro and decode two channels simulaneously. Then, scan paging systems in strategic locations and post the juicy tidbits to the 'net. TTFN, Gold Dot golddot at nym.alias.net "Gold is money, and nothing else is." -- some dead guy From ravage at ssz.com Wed Oct 1 19:53:28 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 10:53:28 +0800 Subject: index.html Message-ID: <199710020252.VAA23787@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Main banner Price Waterhouse rule DOOR-TO-DOOR SCHOOL SALES DEBATED AFTER BOY'S SLAYING Werner October 1, 1997 Web posted at: 10:02 p.m. EDT (0202 GMT) TOMS RIVER, New Jersey (CNN) -- During the school year, it's a scene that takes place across the United States -- children selling merchandise door-to-door, raising money to benefit their schools or activity groups. But now, the rape and murder of an 11-year-old New Jersey boy who tragically knocked on the wrong door has brought renewed attention to the issue of whether door-to-door sales should be discouraged, or even outlawed. Prosecutors say Edward Werner was attacked and murdered by a 15-year-old boy who opened the door at a house in Toms River. Edward hoped to win a walkie talkie by selling the most merchandise in a contest. Authorities say they know of no other connection between the victim and the teen who has been charged -- that it was a "chance encounter" brought about by Edward's door-to-door selling in what a prosecutor describes as a "very safe" neighborhood. The teen-ager was charged Wednesday with murder and aggravated sexual assault. Authorities did not release his name because he is a juvenile. Raising money for the PTA Schools and non-profit groups pull down an estimated $2 billion a year from product sales, and no state has a law restricting door-to-door fund-raising sales by school children. But in the wake of Edward's slaying, a New Jersey legislator has suggested a ban. Neighborhood Ironically, Edward was raising money for the PTA -- though the national Parent Teacher Association has a policy discouraging students from selling merchandise door-to-door. The sales kits provided to the students warned them to sell only to "family, friends and neighbors with whom you are familiar." The Association of Fund Raisers and Direct Sellers, a trade group representing about half of the estimated 1,500 companies that deal with school and youth groups, has also adopted a policy saying it does not endorse door-to-door sales. Instead, the association suggests that children sell to relatives, friends or neighbors they know, while having parents sell to their co-workers, according to Russell Lemieux, the association's executive director. "That's really the bulk of sales in fund raising," Lemieux said. "The instance of a child going door-to-door is quite rare." However, children are often offered incentives that encourage them to sell as much as they can -- incentives which could have a tendency to encourage, rather than discourage, door-to-door sales. "Our members say incentives ... make a big difference," Lemieux said. Robbery thought the motive When he was last seen, Edward had about $200 on him, and police say he had been showing that money to friends. Robbery is believed to have been a motive in his murder, but no robbery charge has been filed. In the wake of the tragedy Edward's school district has banned door-to-door sales, as green ribbons have begun to appear in his memory. Correspondent Christine Negroni contributed to this report. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Message Boards Sound off on our message boards You said it... [INLINE] Price Waterhouse rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From declan at well.com Wed Oct 1 19:58:50 1997 From: declan at well.com (Declan McCullagh) Date: Thu, 2 Oct 1997 10:58:50 +0800 Subject: Request for illegal electronic surveillance examples and cases Message-ID: So I'm putting together a special report featuring examples of illegal wiretapping by governments -- to show why we shouldn't trust them with mandatory domestic key escrow. Also illegal electronic surveillance, generally speaking. Especially more recent ones. Maybe non-U.S. examples too. Any suggestions? I'm thinking things like: MLKjr, Mrs. Roosevelt, _Irvine_, _Socialist Workers Party_, Dewey-FBI alliance, mail opening, Emma Goldman, Brownell's blanket microphone surveillance, _Katz_, _Alderman_, CISPES. -Declan ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ From ghio at temp0124.myriad.ml.org Wed Oct 1 20:07:45 1997 From: ghio at temp0124.myriad.ml.org (Matthew Ghio) Date: Thu, 2 Oct 1997 11:07:45 +0800 Subject: Remailers and ecash (fwd) In-Reply-To: <199710020003.TAA22891@einstein.ssz.com> Message-ID: <199710020250.WAA02067@myriad> Jim Choate wrote: >What would motivate an average consumer to use an anonymous remailer? > >Clearly simple anonymity or writing nasty letters to Grandma anonymously are >not going to motivate most folks irrespective of cost - they simply have no >interest in such activities. I gave several examples. >Irrelevant because people won't pay for this. I never said they would. You asked what motivates people to use an anonymous remailer irrespective of cost. >What besides raising hell anonymously, laundering money, and defeating >merchant purchase traffic analysis are commercial anonymous remailers good >for? I think you answered your own question: >Free remailers are useful for all sorts of mental masturbation, for actual >business there doesn't seem to be a lot of uses. The money laundering issue has very little to do with the remailers, and more to do with the structure of the economic/banking system, how easily one can convert wealth from one form to another, and whether there is incentive to do so. You seem to feel that people are unlikely to pay for any of the most common uses of remailers - you're probably right - which brings us back full circle. From anon at anon.efga.org Wed Oct 1 20:29:14 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 2 Oct 1997 11:29:14 +0800 Subject: Remailers and ecash Message-ID: <2e8e2dc2b1d38583b7f28b77d4ac847d@anon.efga.org> On Wed, 1 Oct 1997, Anonymous wrote: > Bill Stewart wrote: > >Latency is essential to security, though high volume reduces the > >latency that's needed to get a given level of security. > > Latency may be a means to get security in the current remailer design, > but it is a means to the end and not the end itself. This doesn't > mean we shouldn't use latency to get security, but it is undesirable, > like using cinderblocks for construction. The reason I point this out > is that it is important to separate design choices to achieve a goal > from the goal itself. > > If we had a remailer network in which each customer had a constant > bandwidth connection to one or more remailers, you could have zero > latency mail. (Actually, this would be nice to use with those Comsec > phones.) Or use something like anonymous broadcast. Send (fixed sized, constant rate) packets continuously around a fixed set of remailers. Messages may or may not be inserted into these packets, and with encryption it is impossible to tell which node inserted a message (and only until the packet completed the circuit could you tell - inside the machine originating the broadcast). Messages would be resent through the set of remailers, and could be PK encrypted to one of the other nodes. With the broadcast being anonymous, the reciever within the set cannot know who it came from (and theoretically because it is encrypted, no one could know who it is to except the sender, and you can do something to create anonymous target packets). You would still need some mixing for low usage times (or wait for N messages and circulate a control "forward now" message, so that 10 messages come in sequentially and are held, and then at an even interval, 10 messages go out from random nodes. From ravage at ssz.com Wed Oct 1 20:36:28 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 11:36:28 +0800 Subject: http:--www.cnn.com-US-9710-01-shooting.update- Message-ID: <199710020251.VAA23745@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Main banner Visit Regal at Buick.com rule TEEN KILLS 2 AT SCHOOL; MOTHER FOUND DEAD AT HOME Woodham October 1, 1997 Web posted at: 3:38 p.m. EDT (1938 GMT) PEARL, Mississippi (CNN) -- A Mississippi teen-ager slashed his mother's throat Wednesday morning before going on a shooting rampage at his high school that left two students dead and at least six wounded, authorities said. The high school junior, Luke Woodham, was arrested and charged with three counts of murder shortly after the shooting at Pearl High School, about three miles east of the state capital, Jackson. Police Chief Bill Slade choked back tears as he told reporters, "This was a disgruntled girlfriend-boyfriend thing... We talked to the youth. He gave us a statement and his manifesto was that he felt he had been wronged." _______________________________________________________________ A L S O : Message Board: Violence in U.S. Schools _______________________________________________________________ Pearl Mayor Jimmy Foster describes what happened icon 308K/27 sec. AIFF or WAV sound Pearl Police Chief Bill Slade explains what measures will be taken to help traumatized students icon 219K/20 sec. AIFF or WAV sound One student's mother is shocked icon 255KB/19 sec. AIFF or WAV sound A former girlfriend of the suspect was one of two students killed at the school. Slade also said police suspect that the student had killed his mother, Mary T. Woodham, 50, at home earlier Wednesday by slashing her throat. The shooting happened about 8:10 a.m. as buses were arriving at the school. David Williams, a sophomore, said the gunman walked into the commons area inside the front of the school, pulled a rifle from his jacket and opened fire. "He was shooting anybody he could find. He shot at me and hit the staircase," said Mark Wilkerson, a freshman. "I saw fragments going everywhere." Medic offering help One student described the accused youth as reserved. "He was a very quiet person," said Alan Burrow. Four wounded students, ranging in age from 14 to 18, were taken to Rankin Medical Center in Brandon, Mississippi, where one student had already been treated and released. Grieving students gathered in hospital waiting rooms. "The injuries are non-critical gunshot wounds," hospital spokesman Mark Lee said. "In layman's terms they are flesh wounds." Officials shut down the school almost immediately after the shooting and sent all students home. Rhonda Marks, a spokeswoman at River Oaks Hospital, said two students had been brought into the hospital for treatment. Marks did not know if the hospital would receive any more wounded. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Message Boards Sound off on our message boards You said it... [INLINE] Visit Regal at Buick.com rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From brianbr at together.net Wed Oct 1 21:01:28 1997 From: brianbr at together.net (Brian B. Riley) Date: Thu, 2 Oct 1997 12:01:28 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" Message-ID: <199710020338.XAA08905@mx02.together.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/1/97 4:20 PM, Cynthia Brown (cynthb at sonetis.com) passed this wisdom: >I agree wholeheartedly. Uncontrolled guns do not solve problems, >they create them. If most households have at least one firearm, it >makes it that much easier for a criminal to obtain one by stealing >yours while you are at work. > >Canada may be regulated to death according to most libertarians, >but I for one like it that way. I can walk alone and unarmed at >night in Ottawa, Toronto, etc. without fearing for my life. Can a >female resident of Washington or New York say the same? Our schools >do not have metal detectorsat the entrances because they are not >needed. I live in the state of Vermont, where we have more guns per household than most of the states in the US. We are one of the only (if not *the* only) states in the Union that permits concealed carry without requiring a permit (with the not surprising exceptions of USG buildings and schools). Our record high murder year was a few years ago, twenty three murders (that high because we had a woman go crazy at the Eveready plant in Bennington and killed five people in one sitting) in more recent years the figure generally stays under ten per year ...three years ago the figure was five and only one of them was with a gun ... a shotgun, not a handgun. We go where we please with little fear as well; It has to do with a frame of mind, a set of values, not with a lack of availability or opportunity. There is something to be said for living in a place where a man can come right down off the hills during deer season and walk into a liquor store with a shotgun to buy a bottle of hooch without drawing a SWAT team! Try that in NYC or Toronto! -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDMWG8dZgC62U/gIEQLX+gCfZ+GzaNlvSx+xQPszw8cD/1VrDxkAoJ7Y aESM15SJSCwdbYKjDRG2zCIi =69FK -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys "Give a man a fish and you have fed him for a day, but give him a case of dynamite and soon the village will be showered with mud and seaweed and unidentifiable chunks of fish." -Joe Chew From brianbr at together.net Wed Oct 1 21:07:37 1997 From: brianbr at together.net (Brian B. Riley) Date: Thu, 2 Oct 1997 12:07:37 +0800 Subject: Remailers and ecash (fwd) Message-ID: <199710020356.XAA19326@mx01.together.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/1/97 8:38 PM, Jim Choate (ravage at ssz.com) passed this wisdom: >> From: "Brian B. Riley" > >> No, but I see that someone with a fulltime connection or even a >> fulltime machine with an hourly or half hourly dialup would setup a >> program to send randomly generated "Null:" messages to the randomly >> selected remailers so that when he does have something to send that is >> meaningful it will not change the apparent flow ... > >And why does this by any security when it's the header info and >contents that Mallet looks at, not the frequency. The only thing >such approaches do is impliment security by obscurity, and that >ain't security. What header info?, its all messages to the remailer with nondescript info .. from that point the latency and mix takes over. The meaningful message looks no different from the 'cover' traffic. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDMZusdZgC62U/gIEQIk+wCdFC7SjEcydQjGaec9VWwvTVa6fGEAoK6Y dAjcP7WI0TBubRcYPBHFIBFJ =ZUbr -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys "Americans are so enamored of equality that they would rather be equal in slavery than unequal in freedom." - Alexis deToqueville From nobody at REPLAY.COM Wed Oct 1 21:19:09 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 2 Oct 1997 12:19:09 +0800 Subject: Request for illegal electronic surveillance examples and cases Message-ID: <199710020349.FAA06007@basement.replay.com> Declan writes: >So I'm putting together a special report featuring examples of illegal >wiretapping by governments -- to show why we shouldn't trust them with >mandatory domestic key escrow. Also illegal electronic surveillance, >generally speaking. Especially more recent ones. Maybe non-U.S. examples >too. > >Any suggestions? I'm thinking things like: MLKjr, Mrs. Roosevelt, _Irvine_, >_Socialist Workers Party_, Dewey-FBI alliance, mail opening, Emma Goldman, >Brownell's blanket microphone surveillance, _Katz_, _Alderman_, CISPES. I'd figure pretty much anything from Bamford's _The Puzzle Palace_ would work, but the stuff on Operation Shamrock (interception of cable traffic) might be of particular interest. Also the parts about "intelligence sharing" with the Brits and Australians -- just because the NSA can't tap it doesn't mean they can't get it from our "friends." No doubt the Men From Fort Meade have been as helpful in the other direction as well. A particularly nice detail about Shamrock is that the FBI was using the NSA to conduct warrantless electronic surveillance of "un-American" groups by using ELINT, which was -- of course -- "born classified." I'd cite details, but my Bamford seems to be MIA. Maybe the MIB came for it. . . Ratbert From brianbr at together.net Wed Oct 1 21:29:09 1997 From: brianbr at together.net (Brian B. Riley) Date: Thu, 2 Oct 1997 12:29:09 +0800 Subject: Forwarded mail... Message-ID: <199710020409.AAA19702@mx01.together.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/1/97 9:03 PM, Jim Choate (ravage at ssz.com) passed this wisdom: >Why is the situation more stable if both parties are armed? If I >were confronted by a armed burglar and we were facing off I would >pull the trigger as soon as I got a lock. If their gun wasn't in a >ready position Iwould warn them and if they so much as flinched I'd >drop them. If they wereunarmed I might beat them senseless with the >gun but I would not shoot themunless they made a motion to rush me, >then I would go for a non-lethal shotunless the distance was less >than a dozen feet (rushing distance) or so >in ... nothing personal, but why is it people keep deluding themselves with the idea that they can shoot to wound. You cannot know what a shot will do ... if you shoot someone the odds are pretty high that you will kill him or seriously injure. You cannot count on 'non-lethally' wounding anyone. Leg shots have a very high incidence of hitting bone and deflecting up into the torso and really raising havoc. A shot to the thigh could easily hit the femoral artery and a total bleedout .... if you are going to shoot assume your are going to kill, if the guys lives, then you get to sleep a little easier that night and later. I hear so much talk about killing like its something really easy to do ... it isn't ... unfortunately it gets easier each time, and the sleeping gets tougher ... the only consolation to the bad dreams is that it means you haven't lost your humanity, yet! -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDMc3sdZgC62U/gIEQKPVACgnbr0UQGw0Lx8j7tJhOii6bVWB/MAnjM6 euuGEBAmFLhxWsULQLNTOFSs =LFzV -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys "...Those of you who turned your swords into plowshares will soon find yourselves under the yokes of those of us who kept our swords..." -- author unknown From nobody at REPLAY.COM Wed Oct 1 21:59:27 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 2 Oct 1997 12:59:27 +0800 Subject: Remailers and ecash (fwd) In-Reply-To: <199710020003.TAA22891@einstein.ssz.com> Message-ID: <199710020435.GAA10957@basement.replay.com> [snip stuff about message pools, singapore, clams, tv shows, etc] > The only reason that anonymous remailers are useful here is that the > originating party doesn't want to deal with the results of being known. > The flip side to this is that the reputation of anonymous discussions in > these sorts of areas would have little political impact. A person who won't > discuss such issues under their own name certainly won't go out and become > actively involved in some political movement. Now if your claim is that such > activity might hold some weight with an elected official I would appreciate > an explanation as well - especialy considering that the anonymity provides > just enough 'cover' so that the politician can safely ignore any and all > traffic made through this mechanism, "They aren't one of my constituents." > If you have some reasoning outside this please share it. The question is will people pay money for this. Nobody gives a damn if you think it's useful or not. The customer is always right, and all that. Obviously, some people had a reason to take the time to write those thousands of posts, the question is will they pay the remailers to post them. From nobody at REPLAY.COM Wed Oct 1 22:27:14 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 2 Oct 1997 13:27:14 +0800 Subject: Remailers and ecash Message-ID: <199710020500.HAA13819@basement.replay.com> Given: We want more (reliable) remailers But someone has to pay for them Conjecture: New remailers can be financed by charging the users a fee per message to use the remailers. If a remailer charges a fee, the number of users will be reduced to those who are willing to pay the fee. When the number of users is reduced, the potential for traffic analysis is increased, which reduces the value of the remailer. If the value of the remailer is reduced, it will not be worth the cost to many users, and those users will seek a less expensive, higher traffic remailer. Thus, the commercial remailer is forced to lower its prices until it is unprofitable. Conclusion: Pay-per-message commecial remailers are not economically viable. Hence we need a new economic model to finance remailers. Several have been proposed: - Advertiser supported - Pay a flat fee per month for remailer access - Everyone a remailer. Remailers only accept messages from other remailers. To use remailers you must run a remailer. - Get companies to run remailers on their firewalls to reduce traffic analysis by competitors/spies - Pay for access to an anonymous message pool - Sell a spam filtering service to fund remailers - Sell a spamming service to fund remailers - Sell cpu cycles in exchange for remailer access - Charge people for extra services, such as low-latency - Pay for a nym account, nymserver subsidizes remailers - Have the money launderers subsidize the remailers - Somehow get all those Mac users to pay - Offer $50 to the first person to set up a remailer, as Monty Cantsin did - Fund social programs for universal remailer access and universal health care like Cynthia wants From ravage at ssz.com Wed Oct 1 22:27:56 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 13:27:56 +0800 Subject: Remailers and ecash (fwd) Message-ID: <199710020532.AAA24556@einstein.ssz.com> Forwarded message: > Subject: Re: Remailers and ecash (fwd) > Date: Wed, 1 Oct 97 23:56:19 -0400 > From: "Brian B. Riley" > >And why does this by any security when it's the header info and > >contents that Mallet looks at, not the frequency. The only thing > >such approaches do is impliment security by obscurity, and that > >ain't security. > > What header info?, its all messages to the remailer with nondescript > info .. from that point the latency and mix takes over. The meaningful > message looks no different from the 'cover' traffic. Mallet will be following the cover traffic, since it is cover there will be no correllation uncovered between input and output traffic because the output traffic header info will either be a small class of destinations used over and over or else it will be chosen randomly using something like a spider on webpages or a usenet newsgroup crawler. Just send the bogus packets to random addresses, talk about spam with a bite... For the sender to chain from remailer to remailer to destination the destination has to be in the header info somewhere. Now in the most secure system each packet header will only contain the address of the next hop. When the next site gets it the packet contents are de-crypted (otherwise reading the chaining info is trivial) and the contents are uncovered to reveal another packet with the next hop header and another encrypted block. And on and on we go. Now if I were tasked with traffic analysis of this sort I would look at each incoming header and each outgoing header. I would look for some sort of correlation (ie some percentage of the time when I see this source address I see this destination address within some period) over time between the steps in the chain. Realisticaly it would take at least a dozen or so transmissions using the same remailer chain before a clear pattern would emerge. In general there are two types of classes in traffic analysis. The first is monitoring of a specific entity involved in the transfer, usualy source or destination. The second is passive traffic monitoring where I simply go from remailer to remailer and find statistical correlation between the various packets in the hope that somewhere somewhen I would come across something of use. The first type is the most commen currently but with the various requests by the FBI and other LEA's it is becoming clear they want to get into the second class of traffic analysis in a big way. Guess they are finding it harder and harder to get the big-wigs like the drug cartels because they use a higher degree of technology than the LEA's do, they're simply out-classed. With the second class they could catch a email (for example) from some end user buying a couple of quarters of pot and then chase that chain in reverse. Without the passive second class monitoring they would have never gotten that lead in the first place. Now consider the LEA's think nothing of monitoring a suspect for years if required. I know of one case where the DEA spent 2 years tracking a 'kingpin' for 45 tons of herb. They even brought in specialist from the NSA and military to do covert monitoring for the over-seas participants, including traffic analysis of their communications. If they ain't LEA's then a whole new set of options become available. Also consider, if they aren't LEA's then they are probably doing a class one traffic analysis which is only a matter of time to resolve. Considering the current number of anonymous remailers it would not surprise me if the CIA/NSA/Massad/MI5/etc. are not currently monitoring them all. It is a given that countries like Iraq, Singapore, China, etc. are currently doing about all they can to monitor the remailers because they are known to be used by 'terrorist' organizations. It seems to me that many people have an inherent (and unrecognized) assumption that Mallet will have access only to a single remailer and won't bother actualy tracing the traffic. A bad assumption. It is also worth remembering, the government as a whole is quite slow but there are some quite capable individuals. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Wed Oct 1 22:37:32 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 13:37:32 +0800 Subject: Remailers and ecash (fwd) Message-ID: <199710020549.AAA24606@einstein.ssz.com> Forwarded message: > Date: Thu, 2 Oct 1997 06:35:55 +0200 (MET DST) > Subject: Re: Remailers and ecash (fwd) > From: nobody at REPLAY.COM (Anonymous) > The question is will people pay money for this. Nobody gives a damn if you > think it's useful or not. Shure they do because one of the things I would love to do is run a commercial anon remailer. If I as a businessman motivated to get into it can't justify it how in the world can somebody with less technical experience justify it? How would you justify it to your bank for a $10k loan? I suspect that if I can find a way to overcome my anal retentive penny pinching then it will sell others as well. > The customer is always right, and all that. You obviously have never done business with me. I've turned more than one customer away because they were either stupid or wanted something that was completely out of line. I provide my customers a specific set of services at specific fees with specific results, period. If they don't like the way their baby looks that is their problem, I just deliver 'em. I do this out of love, not a need to feed. > Obviously, some people had a reason to take the time to write those thousands > of posts, the question is will they pay the remailers to post them. Depends on their motivation...a question we all seem to be grappling with. If it's possible I am shure that one of the thousands of posts that we generate on this issue will be the trigger. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From mitch at duzen.com.tr Wed Oct 1 22:53:26 1997 From: mitch at duzen.com.tr (S. M. Halloran) Date: Thu, 2 Oct 1997 13:53:26 +0800 Subject: "Show me an example of terrorists using the Internet or cryp In-Reply-To: Message-ID: <199710020531.HAA22918@ankara.duzen.com.tr> William H. Geiger III wrote on 1 Oct 97: ..PGP sig data of WHG deleted... > In , on 10/01/97 > at 07, alexlh at yourchoice.nl (Alex Le Heux) said: > > >In article <34302d8d.8163438 at newshost.cyberramp.net> you wrote: > > >[lots of ranting deleted] > > >: Banning guns because criminals might use them equates to banning > >: encryption because criminals might use it. And if you really believe > >: that both should be banned, then perhaps you should be banned from > >: using oxygen, because criminals breath it too. > > >You people just don't get it do you? A gun has one purpose: To kill. Just > >like any other tool, a gun, if it is available _will_ be used at some > >point. > > >So making sure there are lots of guns around only serves to make a lot of > >people very dead. This is a Bad Thing. > > >Gun control laws are not the issue. It's a matter of mentality. In > >Europe, where we have rather strict guncontrol laws, and have had them > >for a long time a decent human being will not even think of shooting > >someone else. In the US, where guns are tradition and part of the > >American way, many people would not think twice before shooting someone. > >The result of this is that the number of people getting killed by guns is > >enourmous, be they criminals, little kids, old grannies, or presidents. > > >This sucks. > > >We are not trying to export our stupidity, we're just trying to explain > >to you how we live. We live in a place where we don't even have to think > >about getting a gun, because the chances of us encountering a gun in the > >hands of an adversary are negligible. > > >Wake up and smell the coffee, dude. If you have lots of guns around, > >you're gonna end up with lots of people getting shot. > > What a crock of shit!! > > Europe has been in a perpetual state of war for the past 2,000 years > where countless tens of millions of people have been slaughtered. > Chances are very high that you will face an advisatory with a gun, > the fact that he collects a paycheck from a government wont make you > any less dead from his bullets. > This Californian now living abroad hears a great deal about what a violent place America is largely because we have the right to bear arms. Of course, I remind these cretins that no other place on the world has a greater degree and respect for civil rights than does America. Amazing when you consider that America is also the ultimate melting pot too. Sure a lot of ethnic and racial tension still exists in America, but let's tour Europe: 1) Northern Ireland, where you have two groups who speak the same language and basically are cut from the same cultural cloth but religions differ 2) The Bosnia region: different languages and religions, possibly different cultures although the years under Tito must have forced the people represented here (the Catholic Croats, the Eastern Orthodox Serbs, and the Muslims) to understand a little of each other's culture 3) Cyprus: different languages and religions for sure, but Greeks and Turks are really brothers and sisters under the skin (i.e., are more alike than they care to admit to) Look at the savagery and genocidal activities of the groups involved in those conflicts now and historically. The kind of ethnic/subcultural strife and difficulties in America pales in comparison to the kind of savage killing and cold-blooded enmity that these "Europeans" have for one another. That'll be the day when any European gives me a sanctimonius lecture about civil and human rights as they oughta be! Don't tell me about the Americans who have left their homeland--maybe moved to Europe ;-) --and said, "Man, am I glad to be rid of my motherland and glad to be here." You will always find the anecdote here and there. And sure for some Americans it will be a step up from whatever hell they thought they were living in the States. But don't expect in the next 10 generations to see Americans in a mass migration to get away from all urban violence ("because of our stupid gun freedom laws") to move to the relative police states that exist everywhere outside of America (with the possible exception of Canada--I love those Canadians). You European snobs should really get a grip yourselves! From ravage at ssz.com Wed Oct 1 23:33:49 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 14:33:49 +0800 Subject: Forwarded mail... (fwd) Message-ID: <199710020635.BAA24724@einstein.ssz.com> Forwarded message: > Subject: Re: Forwarded mail... > Date: Thu, 2 Oct 97 00:09:24 -0400 > From: "Brian B. Riley" > ... nothing personal, but why is it people keep deluding themselves > with the idea that they can shoot to wound. You cannot know what a > shot will do Remember: A gun is like a finger, just point it at what you want to hit. I have met hundreds of great shots in my life, there are many people for whom this sort of behaviour would not be delusional. My grandfather (who you'll hear more about in a minute) used to delight us as small kids by lighting matches stuck in wood fence posts with a .22 pistol from about 50 yds. My cousin from Louisiana likes to shoot squirrels (if you can call it that) by passing the bullet just in front of their nose, causes lung hemorraghes and they just fall off the limb. Me, I always miss or blow their teeny little head off, it's apparently a game of 1/4 inches. I work with an ex-gomer (ie USMC) pilot who is quite phenomenal with his .357 Desert Eagle, his groupings are just about an inch at 25 yds. I have 20/10 eyesight (in one eye now, the L. is blind) and I've been shooting guns since I was 6 years old. By the time I was 12 I was killing Nutria in Louisiana's swamps every summer for bounty with a single shot of .22 from 100+ yds. I once got a nice heart shot on a deer at 400 yds. over iron sites with a .308. I hit what I aim at with a pistol or rifle assuming I have fired it a few times (which if I own the gun is a given). The first thing I do is range a weapon when I buy it. It's also why I practice shooting in groups of 3. Better chance of hitting, and hitting something important. Being shot at doesn't bother me, been there done that several times now, so I don't think that will be much of a factor. I agree a snap shot is inaccurate but if I have time to get the gun and get to my bedroom door nobody is going to get a chance for a snap shot. Hell, if I had a reasonable idea where they were I'd shoot their wormy ass through the wall. I seriously doubt anyone can get to my bedroom without me being warned (my burglar alarm isn't electronic). >... if you shoot someone the odds are pretty high that > you will kill him or seriously injure. If you break into my house at 1AM this is a given. I'll either shoot you or beat you to death with a skillet. If you don't want to die don't break into my house. It's the Golden Rule. There is absolute NOTHING that justifies breaking into my house at any time let alone in the middle of the night. It's called 'cause and effect' unfortunately most folks now a-days just don't seem to have caught the clue. There is a saying that my grandfather tought me (he was a medic in WWI because he was a contientous (sp?) objecter): If you pull a gun on somebody shoot, and shoot to kill. If you can't bring yourself to kill then don't use a gun. > You cannot count on > 'non-lethally' wounding anyone. Who the hell wants to non-lethaly wound a burglar, I'm betting on them flinching when I start yelling at them... > Leg shots have a very high incidence > of hitting bone and deflecting up into the torso and really raising > havoc. A shot to the thigh could easily hit the femoral artery and a > total bleedout Absolutely great reasons to shoot the asshole there. Look, when a person breaks into your house, robs you, rapes you, or whatever they are basicly saying "I am going it on my own, I apply no rules or recognition of civilization. Your life means nothing to me because I am willing to trade it for a few measly bucks". It is silly to try to deal with such people reasonably, if they were reasonable they wouldn't be there in the first place (they'd be home protecting their own possessions). They are a clear and present danger with long-term intent. Save your life and their next victim or your tax dollars to put them in jail and train them to be better criminals, do everyone a favor kill them now. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From mitch at duzen.com.tr Wed Oct 1 23:36:36 1997 From: mitch at duzen.com.tr (S. M. Halloran) Date: Thu, 2 Oct 1997 14:36:36 +0800 Subject: "Show me an example of terrorists using the Internet or cryp In-Reply-To: Message-ID: <199710020617.IAA23092@ankara.duzen.com.tr> Cynthia Brown wrote on 1 Oct 97: > Canada may be regulated to death according to most libertarians, but > I for one like it that way. I can walk alone and unarmed at night > in Ottawa, Toronto, etc. without fearing for my life. Can a female > resident of Washington or New York say the same? Our schools do not > have metal detectors at the entrances because they are not needed. Painting America with a rather broad brush, aren't you? I never went to a school--and I attended public schools for ALL of my education--which had a metal detector. But comparing America and Canada is pretty much apples and oranges again. Do you [in Canada] really have our ethnic mix? America's violence problem is not one bit related to guns everywhere in the street. There are much deeper problems, including distrust between ethnic groups. The O.J.Simpson was a real eye-opener on black-white relations, for example, and I think the Native Americans have yet really to speak about the shitty way they have been treated over the years. By the way, have Canada's European descendants come to proper terms with its native American neighbors? > > IMNSHO the best way to fight crime is not with bigger guns than the > "bad guys", but with better social programs such as universal health > care, and improved day care so single parents can show their kids > what a productive lifestyle looks like. This takes longer than > blowing the brains out of some teenager that feels his only path to > a better life is through crime, and it doesn't give the same > adrenalin rush. However, it works at the source of crime, and not > the consequences. > > Cynthia, unrepentant bleeding-heart liberal > Cynthia H. Brown, P.Eng. Now you're talking! Don't ever repent for thinking clearly. But do keep in mind that not all people who own guns and wear red plaid Pendletons and sport scraggly beards are the neoFascists of tomorrow. I don't own a gun myself, but I wouldn't hesitate to obtain one to defend my civil rights against a corrupt police force or government "just doing its job" (how many horror stories do we hear about a bureaucracy going by the rules as it sees them and with a stroke of the pen, a mid-level govt official puts a family on to the street? And this can happen in the US? Book recommendation: Dark Rivers of The Heart by Dean Koontz; think it's all fiction?) Yours in paranoia, ;-) From mitch at duzen.com.tr Wed Oct 1 23:47:27 1997 From: mitch at duzen.com.tr (S. M. Halloran) Date: Thu, 2 Oct 1997 14:47:27 +0800 Subject: Mr. Policeman is Your Friend In-Reply-To: <9710012220.AA05578@sabel.idacom.hp.com> Message-ID: <199710020639.IAA23181@ankara.duzen.com.tr> Tim May wrote on 1 Oct 97: > At 3:20 PM -0700 10/1/97, Martin Janzen wrote: > >Electronic Frontier Canada's David Jones (djones at insight.dcss.McMaster.CA) > >posted the following to the EFC mailing list: > > >2. If cops can read E-mail, so can the bad guys > > http://www.efc.ca/pages/media/gazette.24sep97.html > [much interesting exposition on the police as servants of government deleted] I have a question: has any jurisdiction (local, state, federal) in the U.S. resolved the hyprocrisy--maybe better to phrase "double standard"--wherein citizens who commit crimes against persons who perform duties under the color and badge of authority--namely the police--are charged with additional offenses specific for crimes against govt officers--but govt officers who commit crimes against citizens while in the performance of duties under the color and badge of authority would suffer the same penalty as citizens who commit crimes against "just" citizens? (hope you can follow that perhaps awkward question) It is my opinion that if I am charged with felony assault on a police officer, and the judge gives me 2 years for the assault + 1 year for doing it to an officer, that if that cop gets rough with me beyond what is legally necessary (excessive force?) or does it in the commission of other crimes and does so having informed others that the officer is performing his duties (this resolves disputes between the concept of "on-duty" and "off-duty"), then he should get 2 years for the crime + 1 year for having violated the public trust vested in him (i.e., doing while "under the color and badge of authority"). I don't know why I think this way, but it's a concept I call FAIRNESS or maybe JUSTICE. Mitch Halloran Research Biochemist/C programmer/Sequioa's (dob 12-20-95) daddy Duzen Laboratories Group mitch at duzen.com.tr From 72384400 at 13117.com Thu Oct 2 14:49:05 1997 From: 72384400 at 13117.com (72384400 at 13117.com) Date: Thu, 2 Oct 1997 14:49:05 -0700 (PDT) Subject: Stop Dreaming & Start Making Money! Message-ID: <893789370989.HON98237@aol.com> Are you interested in making an extra $10,000, $50,000, or $100,000 a month? YES! $100,000 a month. If you believe that someday you'll get that big break, get ready because THIS IS IT! Just imagine, no more living from paycheck to paycheck. Become FINANCIALLY INDEPENDENT. Buy your dream home. Purchase that sports car in cash. Never again worry about living in debt. "I currently make $1,350 to $1,800 a day doing this part-time. One week after I started, the checks showed up in my mailbox. I can't believe it!" - Lynette from Glendale, CA. I'm sure you've seen couples on TV, sitting on a couch, holding each other's hand & claiming to make this sort of MONEY. If all these people were lying, don't you think you would have heard about it from the Attorney General or Hard Copy? STOP thinking that no one can possibly make this kind of money. WE ARE!! "I was probably the most skeptical person out there, until I saw how much my brother-in-law was making. Then I HAD to try it. The first day, I got checks that totaled $5,693. Yesterday I made $4,374." - Michael from Everette, WA $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Are you ready to change your life forever? $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ MAKE HUGE PROFITS IN THE INFORMATION AGE Selling information is one of the FASTEST and EASIEST ways to get into the mail order business. Ordinary people just like you and me are doing this and smiling all the way to the bank. It is only in this amazing business can you start out with practically NO CAPITAL and with literally NO LIMIT to your profits. I bet you know someone who would PAY YOU $5-$15 to know: HOW TO GET $1,000,000 WORTH OF LIFE INSURANCE WITH NO CASH! HOW TO STOP PAYING PROPERTY TAXES ON YOUR HOME WIPE OUT DEBTS WITHOUT BANKRUPTCY INSIDER SECRETS TO PERSONAL TAX SHELTERS HOW TO REDUCE YOUR GROCERY BILLS BY 50% TOP 10 WAYS TO MAKE MONEY ON THE INTERNET All you have to do is buy our CD-ROM which contain over 650+ how to money making reports, reprint on diskettes or paper & SELL, SELL, SELL. CD-ROM comes with Unlimited Reprint & Resell license. You can sell the reports individually or in sets through classified ads, personal contacts, flyers, or on the Net. Sell them HOWEVER you want and for as MUCH as you want. YOU KEEP ALL THE PROFIT. HERE'S HOW THIS AMAZING PROGRAM WILL MAKE YOU $$$$$ Let's say that you decide to start small, just to see how it goes, and you send out only 2,000 email ads a day. (You obviously already have an internet connection so e-mail advertising is FREE.) Your email would read: SPECIAL REPORT "Live in a $100,000 Home without ANY Money" Send $10 & self- addressed stamped envelope to: YOUR NAME YOUR ADDRESS YOUR CITY AND STATE Let's also say that the mailing only receives a tiny response rate of not 5% , not 1% but 0.5%. That comes out to 10 orders a day X $10.00 per order. That's $100 in additional income a day for 5 minutes of work. Imagine, that comes out to an additional $36,500 a year. Can you use an extra $36,500 a year for 5 minutes of work? BUT what would happen if you sent out 100,000 emails? At the smaller response rate of 0.35% , YOU WILL EARN $105,000.00 OF SPENDABLE CASH IN JUST ONE MONTH! Note: Some programs out there send email at 250,000 - 330,000 emails an HOUR with a 28.8 modem. Note: Currently there are over 90 million email accounts users & predicted to be 500 million by the year 2000 When you order from us, you get: *Our BEST-SELLING 650+ money making reports on CD-ROM. *Step-by-step proven instructions on how you can start a huge business selling information & become financially successful. *The best methods for bulk e-mailing and obtaining e-mail lists. Other money making programs sound great, they say place tiny classified ads. They forget to tell you that, you have to WRITE A BOOK. With our CD-ROM, you can begin selling, TODAY! E-Z ORDER FORM : Please print out this form and fill in the blanks legibly to send along with payment. I WOULD LIKE TO ORDER THE FOLLOWING: QTY TITLE _______ CD-ROM (650+ Reports with Full Reprint Rights) Advertised before for $99.00 NOW *ONLY $59.00* Name ____________________________________________________ Street Address ____________________________________________ City, State, Zip_____________________________________________ Phone Number_____________________________________________ Email Address_____________________________________________ Payment method ____ credit card ____ check ____ money order Account Number _____________________________________ Expiration Date ________________ Name on Card _______________________________________ Signature ___________________________________________ ORDER AMOUNT __________________________ + $4.00 shipping/handling = _______________ TOTAL Send payment along with this completed form to: Micro Info Publishing 2107 W. Commonwealth Ave. #264 Alhambra, CA 91803 Comes with a 30 DAY MONEY BACK GUARANTEE From pooh at efga.org Thu Oct 2 00:45:09 1997 From: pooh at efga.org (Robert A. Costner) Date: Thu, 2 Oct 1997 15:45:09 +0800 Subject: Remailers and ecash In-Reply-To: <199710020500.HAA13819@basement.replay.com> Message-ID: <3.0.3.32.19971002024633.032b0028@mail.atl.bellsouth.net> At 07:00 AM 10/2/97 +0200, Anonymous wrote: >Hence we need a new economic model to finance remailers. >Several have been proposed: > > - Advertiser supported I've thought about putting ads in the headers of remailer messages. No one I've approached, even for free advertising, has thought this was something they wanted to be connected with. -- Robert Costner Phone: (770) 512-8746 Electronic Frontiers Georgia mailto:pooh at efga.org http://www.efga.org/ run PGP 5.0 for my public key From nobody at REPLAY.COM Thu Oct 2 01:13:23 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 2 Oct 1997 16:13:23 +0800 Subject: Fwd: Re: Quor's cypher In-Reply-To: <199709292301.AAA04109@notatla.demon.co.uk> Message-ID: <199710020752.JAA02737@basement.replay.com> Antonomasia wrote: > My attack takes a long chunk of known text and looks for repetition. > > ppppppppppppppp.11.pppppppppppppppppppppp > ccccccccccccccc.22.cccccccccccccccccccccc > > When a two neighbouring p-c pairs are the same you can test > whether they have the same value of a and b. > (That is a_n == a_n+1 and b_n == b+n+1, a != b usually.) > > This involves 16 inputs to each byte - very cheap. > What I really want next is to know "a". Wouldn't this only happen (on average) in one out of every 65536 p-c pairs? Since the state array is changed entirely with every 128 bytes encrypted, 1 out of 2^16 doesn't seem to help much. From stewarts at ix.netcom.com Thu Oct 2 02:41:49 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Thu, 2 Oct 1997 17:41:49 +0800 Subject: throw away accounts? (was Re: Remailer Attack) In-Reply-To: Message-ID: <3.0.3.32.19971002004308.006a256c@popd.ix.netcom.com> >> * throwaway accounts, and yet with some robustness or reputation capital >> backing them >We've kind of got throw away accounts recently, Ian Goldberg wrote a >perl script to open accounts and sendmail through a couple of the free >web based email services. ... >There might even be a remailer or two using this ... perhaps some >remailer operators could fill us in. There are remailer programs for both Hotmail (web-based) and Juno (dialup), and several people are actually operating remailers from Juno. The remailers accept mail un the usual fashion, including PGP support, and take care of working around the advertising that comes with the free mail. Both services have anti-spamming terms of service, which probably block running general-purpose remailers from them because they send unsolicited mail to non-previously-consenting users. But there's no problem with the TOS in running remailers that only send mail to subscribed users, and it may or may not be acceptable to run the kind of remailer that sends "Subject: You have anonymous mail - message#12432; reply to pick it up" and doesn't bother the user further unless they ask for the mail. I also don't know about posting to Usenet from them. So what can you do with a limited-target-area remailer? - Entry remailer, with well-known name, that only forwards its mail to other remailers. Recopients don't complain, though you can still get flooded with SPAM. - Middleman remailer, accepting mail only from remailers and sending only to other remailers. Nobody complains. Easy to maintain. Great for forwarding cover traffic through other remailers. - nymserver target remailers, though obviously if you're the only recipient of mail, it's a bit visible, though you could set them up to chain to another remailer - forwarders to message pools - subscription-only remailers. - maybe spam filters? - - your suggestion here - Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From stewarts at ix.netcom.com Thu Oct 2 02:42:14 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Thu, 2 Oct 1997 17:42:14 +0800 Subject: [GUNS] Re: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: Message-ID: <3.0.3.32.19971002000649.006db3a8@popd.ix.netcom.com> [Guns aren't really a cypherpunks topic, though the below-mentioned clueless power-hungry terrorists do use the Internet and crypto to help maintain their position relative to their victims and to other competing clueless power-hungry terrorists.] >Uncontrolled guns do not solve problems, they create them. I used to take the traditional U.S. Liberal-Statist view that Guns Are Bad, and Guns Need Controlling. But the way Americans and Europeans control guns is to hire a bunch of armed thugs and use them to terrorize the population into giving these people their guns and not buying more. And, well, I decided it was pretty hypocritical to hire armed thugs to take away peoples' guns at gunpoint. I had to give up that position. (A Conservative-Statist wouldn't have any contradiction - the rabble can't be trusted with guns, so we'll take them away at gunpoint, and we'll be safer. Trust us. Or we'll shoot you too. No problem :-) Now, if the Amish want to do gun control, it's a different story. If people want to keep around guns for killing people, keep talking to them about it until they reform, and if that doesn't work, _stop_ talking to them until they reform. No hypocrisy, no problem. >IMNSHO the best way to fight crime is not with bigger guns than the "bad >guys", but with better social programs such as universal health care, Those things are fine, but one of the big reasons people shoot each other in this country is fighting over the money involved in the Black Market for drugs. After all, in a War On , you can't expect one side to do all the shooting. All this crime and violence over drugs with a free-market value of <$3/day for coke and <$1/day for heroin. You'd think the people in power are either ravingly clueless or they like Power for its own sake. And you certainly shouldn't trust either the clueless or the power-greedy to do the right thing with guns... >improved day care so single parents can show their kids what a productive >lifestyle looks like. .... >Cynthia, unrepentant bleeding-heart liberal The traditional solution to day care was people taking care of each other's kids, either within the family or their neighbors, at home. Do-gooder liberals have made this more difficult by making laws mandating quality control over day care, government certification for day care workers, and safety certifications that the average home has trouble getting. So the single parent can't show their kids a productive lifestyle by taking care of the neighbors' kids for money, which would also free up the neighbors to work. And it's not just single parents who do this, it's married women whose husbands aren't making enough to support them in an Ozzie&Harriet lifestyle. I do agree with you that blowing away the neighbor's teenager who's trying to steal you TV isn't a good thing. If it's just the kid, he'll be gone before your police get there, and if it's someone dangerous you may not have a chance to call them. I keep a fire-extinguisher by the bed, not only for fires, but for shooting first, asking questions later, and clubbing them with as a fallback. :-) On the other hand, back when I lived in Jersey, one of those grannies y'all were worried about was on the front page of her local paper holding her pistol -- "Police? Are you kidding? They don't come to _my_ neighborhood, it's too dangerous!" Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From alexlh at xs4all.nl Thu Oct 2 02:45:51 1997 From: alexlh at xs4all.nl (Alex Le Heux) Date: Thu, 2 Oct 1997 17:45:51 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: <6489040e71db5edc2ab5e653cb709620@anon.efga.org> Message-ID: <34336fad.32095813@news.xs4all.nl> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2 Oct 1997 00:24:27 +0200, Anonymous wrote: >Alex Le Heux wrote: >>Maybe you haven't noticed, but seen on 2000 year scales, the entire >>world is constantly in a state of war. Europe isn't special in that >>regard. > >I guess the conclusion, then, is that gun control is bad for the whole >world, not just Europe. Eh, no. The conclusion would be that gun control or no gun control does not affect the amount of war in the world at all. >>And even if I had my AR15 then, it wouldn't help me a lot against >>guided missiles and mortar fire. > >It's harder to police a hostile population which is well armed. True, but imho this will only result in more people getting killed. Any invader would not beat about the bush in the US, they'll make very clear that they'll have nothing to do with citicens defending their own homes. They'll just blow up the home from a distance. >>And anyway, "to defend yourself in a war" is not one of the usual >>arguments against gun control. > >The popularity of an argument can be independent of its worth. > >"To defend yourself in general" is commonly used. War, oppressive >government, and political turbulence are the most likely situations in >which people need their weapons, even in the United States. Bullshit. People in the US rarely use their weapons against oppressive governments or political turbulence. Most guns that are used against another person there are used to commit crime or to defend against those armed criminals. >>> You must be getting some good drugs over there to conjure up this >>> fantasy land where everyone loves one another and would never think >>> of killing someone because it sure as hell doesn't exist in Europe. >> >>Well, we're a lot closer to it over here than you guys are over >>there. > >You mean like the former Yugoslavia? Or do you mean like the parts of >Europe where people are not slaughtering each other at the moment? > >I have to confess that I am surprised at the level of resentment among >the members of various Europeans countries feel towards other European >countries. For example, the Germans don't like the Dutch because when >they visit they are treated badly by, among others, the police. The >Dutch don't like the Germans because, well, they got to know them a >little too well in the 1940s and they are nursing the grudge. > >With that sort of situation, anything can happen and it can happen >quickly, even if things seem mellow right now. And these little >resentments and jealousies are felt between far more groups in Europe >than just between the Dutchies and the Germans. Excuse me? Have you ever even been in Europe? In the last 50 years I mean? You are so full of shit here, it's incredible. I hereby invite you to come over, and stay a while. I have a comfy couch. Anyone in Europe can go anywhere else, and be treated reasonably to very well. We in Europe have put the crap of WWII behind us a long time ago. Something that you haven't managed to do apparently. The Dutch are absolutely not 'nursing a grudge'. Come and visit. You'll see. >Let's also take a look at the Dutch performance during their >occupation. While there certainly were many courageous Dutch people >who helped refugees (at great personal risk, to say the least), and >there were many courageous Dutch people who were in the resistance, >there were also many Dutch people who did not perform so well. Not >only were a large number of Jewish people turned in by Dutch >informers, but there were even Dutch SS units. You have a nerve. You, coming from a country where people are still regularly killed in the name of racism, tell me this?! >I basically think well of the Netherlands and its people, but it is >important to recognize that certain unpleasant characteristics exist >in a large portion of the population of even a nice country. It is >unlucky to pretend that these characteristics can never be expressed. We absolutely not pretending that this can never be expressed. In fact, it's being expressed every day. We have our neo-nazi political parties too. It's just that we here have learned our lesson, and very few people actually listen to them. >Let's turn to the Western Hemisphere: El Salvador. During much of the >1980s, the U.S. government supported groups of people in El Salvador >who were sending out death squads to murder their suspected opponents. >The U.S. certainly acquiesced in this activity - of this there is no >doubt. But, it is not unlikely the U.S. was more directly involved. >(Only fifteen years earlier the U.S. was doing the same thing in >Vietnam.) > >What would have happened if the citizens of El Salvador were >adequately armed? One thing you wouldn't see is a death squad going >into a neighborhood to kick down some innocent's door and murder him >or his family. At least, you wouldn't see it twice. Sure you would. It just would be that more bloody. The fact that someone is armed has never stopped anyone from attacking. You just make sure that your shot is the first and hits. >Likewise, when the communist guerrillas were forcing (maybe) the >peasantry to support them, the peasants would have no need to >cooperate unwillingly if they were well armed. > >People who are well armed are less likely to become pawns, victims, or >slaves. That is desirable. They are just more likely to become dead. >Incidentally, the consistent support the U.S. government has shown for >murderous or even genocidal governments is of great concern to those >of us who live in the U.S. It is unlikely that these tactics won't be >used here were there a serious political struggle and a disarmed >population. - From over here it appears that the majority of Americans doesn't really give a shit. Correct me if I'm wrong. >An issue that might possibly blossom into such a political struggle is >mass surveillance. While the mass media is, for the most part, giving >everything the government's spin, and while large numbers of >Congressmen and other denizens of Washington, D.C. think it's a good >idea, the bulk of the population is not happy about this at all. They >can read the writing on the wall. The potential for conflict between >the political class, which has a long history of murder and even >assassination, and the American people exists right now. Yes, things are a bit of a shambles at the other side of the pond. Maybe for you it's a good thing to be armed to the teeth. For us over here, arming the population would only serve to fill the morgues. Alex -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDNpTNuYAh4dUSo/EQK3bwCeKJv4AW0kOwjSRitLi7HDa7KEaW8AoN4F OwK1wOG19pazc93T1twP1Evp =FsmU -----END PGP SIGNATURE----- From alexlh at xs4all.nl Thu Oct 2 02:48:51 1997 From: alexlh at xs4all.nl (Alex Le Heux) Date: Thu, 2 Oct 1997 17:48:51 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: <51a02138f43e8a0225034edf2603b563@anon.efga.org> Message-ID: <343377a8.34139044@smtp.xs4all.nl> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2 Oct 1997 01:29:33 +0200, in list.cypherpunks you wrote: >Cynthia Brown wrote: >>On Wed, 1 Oct 1997, Alex Le Heux wrote: >>> This sucks. >> >>I agree wholeheartedly. > >>IMNSHO the best way to fight crime is not with bigger guns than the >>"bad guys", but with better social programs such as universal health >>care, and improved day care so single parents can show their kids >>what a productive lifestyle looks like. > >Of course you agree wholeheartedly, you are an exploiter. It is >wrong. You should be ashamed of yourself. Can you explain who exactly exploits who here? Alex >Monty Cantsin PS. What's the point in posting anonymous when you have this sig? >Editor in Chief >Smile Magazine >http://www.neoism.org/squares/smile_index.html >http://www.neoism.org/squares/cantsin_10.html > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 > >iQEVAwUBNDLA95aWtjSmRH/5AQFykwf+Nh/3MKqyK30Tc90Wj0MCvKLvyZYzkKiZ >KV/H8+7Of5hPh0pUEZNDBxr7A3x02+0jhYwJymzYcHJuXAP0+RmXtWRyAWz9TFE3 >AB23HgLODI2IrsD1NvlwbjHQzpLVqfT99QEYIaolZScilc5hw1uZV8dAK4SjXDnZ >+K4QG3RZpAxpKZUSWduErtJ+8JAzavH4ybeR95hO2uY2na1ckmwWm39ERg+u+N4k >rP2wd3E4IQ7XWbPCrHWEPoDs4PHMg09lK/Y+fv9ejE8+ehq/YeO1WYtZtlaCURtU >CE7JXH4b60+NmDuISybaMWdv70IFOneukz64zasAT1wp9w4Mxqjw7Q== >=VYI9 >-----END PGP SIGNATURE----- > > > > -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDNp29uYAh4dUSo/EQKAHgCeOSqJJoMIg0JU2v+XvKTR0UBpvtgAoOt/ 6xvXft58qraGvb3E5Lw16xFH =R367 -----END PGP SIGNATURE----- From stewarts at ix.netcom.com Thu Oct 2 03:06:24 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Thu, 2 Oct 1997 18:06:24 +0800 Subject: Request for illegal electronic surveillance examples and cases In-Reply-To: <199710020349.FAA06007@basement.replay.com> Message-ID: <3.0.3.32.19971002003347.006e2b74@popd.ix.netcom.com> >Declan writes: >>So I'm putting together a special report featuring examples of illegal >>wiretapping by governments -- to show why we shouldn't trust them with >>mandatory domestic key escrow. Also illegal electronic surveillance, >>generally speaking. Especially more recent ones. Maybe non-U.S. examples >>too. >>Any suggestions? I'm thinking things like: MLKjr, Mrs. Roosevelt, _Irvine_, >>_Socialist Workers Party_, Dewey-FBI alliance, mail opening, Emma Goldman, >>Brownell's blanket microphone surveillance, _Katz_, _Alderman_, CISPES. The year before the Supreme Court mandated the Exclusionary Rule back in the 60s (go ask Mike Godwin for specifics :-), the New York City Police Department didn't bother getting any search warrants. They just searched, and if they found something, they used it. The year _after_ the Exclusionary Rule, they got warrants. Obviously the Feds don't keep statistics of illegal wiretaps, just legal ones. And they certainly don't keep stats of cellphone conversations local police pick up with scanners. Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From alexlh at xs4all.nl Thu Oct 2 03:06:53 1997 From: alexlh at xs4all.nl (Alex Le Heux) Date: Thu, 2 Oct 1997 18:06:53 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: <199710011942.VAA09393@basement.replay.com> Message-ID: <343378d6.34441147@smtp.xs4all.nl> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 1 Oct 1997 23:06:24 +0200, in list.cypherpunks you wrote: >Alex Le Heux wrote: >>You people just don't get it do you? A gun has one purpose: To >>kill. Just like any other tool, a gun, if it is available _will_ be >>used at some point. > >Although guns are obviously designed for killing things, this does not >mean that they will be used. This can be seen from the statistics. >There are far fewer murders than there are guns. Almost all of them >are never used for killing someone. You can't deny that the more guns there are available, the more people will get shot. There may be some people that are capable of owning a gun and using it wisely (ie. not), but I don't believe that this is a significant fraction of any population. >You are also not considering the case where one person has a gun and >another does not. The situation is more stable if both people are >armed. (And don't claim you are talking about disarming a whole >society. You aren't, just part of it.) Urgl? The situation only becomes more explosive if both sides are armed. Look at the arms race, which is now, thank god, over. I am amazed at the amount of restraint both sides displayed during that time, although it's been really close a few times. It's really simple: If there are no guns, no one will get shot. I _am_ talking about disarming a population. I don't know which 'it' I'm not part of, but I am definately not part of the 'it' that promotes death by gunshot. >>So making sure there are lots of guns around only serves to make a >>lot of people very dead. This is a Bad Thing. > >Depends who they are. Bet the Dutch resistance made good use of their >weaponry, eh? Even if they did, dead people are still a Bad Thing. We had no quarrel with the soldiers the resistance killed. Neither did most of them had any quarrel with us. Just like the US troopers in Vietnam or some other place. >>In the US, where guns are tradition and part of the American way, >>many people would not think twice before shooting someone. > >This is simply untrue. TV and movies are not the best way to form an >understanding of another country. Ok, you have a point there. Only it's not TV and movies (I don't have a TV), it's reading the Cypherpunks list too often :) >>The result of this is that the number of people getting killed by >>guns is enourmous, be they criminals, little kids, old grannies, or >>presidents. > >I read recently that 9000 people a year die in the United States from >food poisoning. This should be almost entirely preventable. Why >isn't this a big political issue? Could it be that the people pushing >gun control do not have entirely pure motives? > >Be aware that the gun control lobby has often used misleading >statistics. For instance, you will hear a lot about "handgun deaths". >It turns out that most of these are suicides. While undesirable, most >people perceive a difference between somebody killing themselves and a >nutcase doing his thing at a school. I am not the gun control lobby, I am a citizen in a mostly gun-free society, and glad of it. People getting shot here, be it robbery, suicide, police violence or self defence is a rare occurence. Over her, drive-by shootings are something from fairy tales. Alex -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDNtftuYAh4dUSo/EQLE2gCffYR+ts7CX9xg6oRvJNFCmegxUwQAoIjG Iqef+Vam9dffETvGpMnUdsPY =JRW2 -----END PGP SIGNATURE----- From dformosa at st.nepean.uws.edu.au Thu Oct 2 03:15:22 1997 From: dformosa at st.nepean.uws.edu.au (? the Platypus {aka David Formosa}) Date: Thu, 2 Oct 1997 18:15:22 +0800 Subject: The War on Drugs--Surrender! / Re: INFO-RUSS: Reuter: Russian+Russian Drug Cartels (fwd) In-Reply-To: <199710011514.RAA10457@basement.replay.com> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On Wed, 1 Oct 1997, Anonymous wrote: [...] > Legalize drugs! > The War on Drugs *created* all of the current problems in this area > by making minute amounts of forbidden substances worth more than > precious metals. I have to aggry with Anon here, the legalisation of drugs combined with a harm minimisation program has a good chance in resulting in less deaths and crime. - -- Please excuse my spelling as I suffer from agraphia see the url in my header. Never trust a country with more peaple then sheep. ex-net.scum and proud You Say To People "Throw Off Your Chains" And They Make New Chains For Themselves? --Terry Pratchett -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBNDNuTaQK0ynCmdStAQH5ggP+KqyheKyVTkkckWx+UrHZF5Z1r1ejWaXq 6t5t3rJ6u7M1ghO4H12XNnjhQOCkCqWkg1dy8W4DNXfynfZI8RXLyiqxV3hWez3D I0zWTMCcGZak+72aDMqlAvMOCt0C68dxY1dfbdX3D2ma3V6TUwsllVFfc5LiInQ6 5crAzL+auaA= =Wd01 -----END PGP SIGNATURE----- From rr at dev.null Thu Oct 2 03:35:02 1997 From: rr at dev.null (Racist Remailer) Date: Thu, 2 Oct 1997 18:35:02 +0800 Subject: Kill All The NIGGERS (Vote for Bob Dole)) In-Reply-To: <3.0.3.32.19971002024633.032b0028@mail.atl.bellsouth.net> Message-ID: <34337389.21D9@dev.null> GREENPEACE NEEDS YOUR SUPPORT TO STOP WHALING! Robert A. Costner wrote: > I've thought about putting ads in the headers of remailer messages. No one > I've approached, even for free advertising, has thought this was something > they wanted to be connected with. BOTHERED BY PESKY CRITTERS INTERFERING WITH YOUR FISHING? CALL SMITH & WESSON Robert, Perhaps the idea will become more realistic once Web tools are fine- tuned to the extent that we can selectively target everyone on the face of the earth. (In about 6 months, time...) Just think of the potential for a politician to be able to send out advertising via anonymous remailers which matched the predelictions of each and every recipient. Bob Dole needs your support to SAVE THE CHILDREN! Bob Dole needs your support to NUKE THE CHILDREN! Bob Dole needs your support to KISS THE CHILDREN! Bob Dole needs your support to KISS THE CHILDREN IN BAD PLACES! Bob Dole needs your support to LEGALIZE FARTING IN PUBLIC! Bob Dole needs your support to CRIMINALIZE FARTING IN PUBLIC! The advantage that anonymous remailer advertising has is that it gives the impression that the unknown masses are of like mind, and it allows plausible deniability. Also, advertising could be sent to the originator of anonymous remail, depending on the content of their messages. Money launderers could receive ads for Gucci products. Perverts could receive ads for Victoria's Secrets. Spammers could receive ads for Dr. Kevorkian. Whistleblowers could receive ads for Funeral Parlors. Toto could receive ads for Mental Health Facilities. A. Nonymous From search10 at earthlink.net Thu Oct 2 18:52:25 1997 From: search10 at earthlink.net (search10 at earthlink.net) Date: Thu, 2 Oct 1997 18:52:25 -0700 (PDT) Subject: Your Listing on Yahoo Message-ID: <199710030150.SAA19789@sweden.it.earthlink.net> Hi: This email is in reference to YOUR LISTING ON YAHOO! If you are interested in placing your web site in the TOP TEN on the major search engines, please read on. (If not, please disregard this email and accept our apology for any intrusion.) reply with remove in the subject. For those of you who are interested, please read on! (Ed. note: Yahoo asked that we mention that our group and Yahoo are not affiliated --they probably wouldn't let us publish this if we were affiliated). ____________________________________________________________ SEARCH ENGINE SECRETS HOW YOU CAN GET YOUR SITE CONSISTENTLY IN THE TOP 10 ON MAJOR SEARCH ENGINES (and watch your hit count skyrocket) http://www.leedspublishing.com/SES5/ As you probably noticed with the listing of your site on the search engines, it is becoming more and more difficult to be found among the MILLIONS of listings. If you"re like the rest of us you have found it extremely frustrating. You spend lots of time and money developing your site and then you're listed number 30, or 80, or even 200th. You're NEVER FOUND. *************************** GOOD NEWS The good news is we have found a SOLUTION. After months of fighting the search engine battle we got LUCKY. A programmer recently became associated with our firm who had done some CONSULTING WORK for six months with one of the major search engines. With his help we developed a REPORT on the major search engines and how they really work. ***************************** REPORT His report is excellent. We have been using the material in the report for over five months. IT WORKS! With it, our sites are in the top TEN listings on all major search engines and we have experienced a virtual stampede of people to the web sites. HITS ARE UP, SALES ARE UP, and most importantly, everyone is HAPPY. > > *************************** YOUR COPY > > Now, YOU CAN HAVE A COPY of his report. In it you will find: > > > > How to vault in the TOP TEN on any search engine using any keyword. Strategies that put you ahead of 95% of the other sites online. How to STAY in that TOP TEN. How to improve your chances of being found in about 10 MINUTES. > > How the search engines calculate CONFIDENCE ratings (and what that means to you). > > Killer META TAGS that totally blow away your competitors. > > Which search engines are the very BEST FOR YOU. > > How to get your site REGISTERED for FREE at over 200 locations, in one easy step (it takes 10 minutes). > > How to BLOCK out part of your site from the search engines (and why you should do it). > > The effect of REPEATING KEY WORDS. (good or bad?) What happens when you repeat them too many times? > > LATEST FORMS for developing the best meta tags. Meta Tag strategies that can broaden your audience and build high volume web traffic for you. We tell you exactly what to do and show you SPECIFIC EXAMPLES. And it's SIMPLE and EASY to understand. So you can put the principles to immediate use. > > The benefits of site UPDATING. How often? What NOT to do! Avoid making those errors which can cost you. > > > and even > > How to legally "steal" your competitor's web traffic and send it to your site. Type in your competitor's name and YOUR NAME will appear FIRST! > > > *************************** > > WHAT DOES IT COST? > > The material is only $19.95, and is unconditionally guaranteed to work for you. Just follow the instructions and you will find your site in the top ten too. Ordering is SAFE and EASY. For more information, or to RECEIVE this 18 page report by email just go to our INSTANT-DELIVERY SECURE order form at: http://www.leedspublishing.com/SES5/ (Order on line and you will receive your report in JUST 60 SECONDS.) Now that your site is up shouldn't you take this MOST IMPORTANT LAST STEP so people can find it. ****************************** UNCONDITIONAL GUARANTEE Remember, we UNCONDITIONALLY GUARANTEE IT WORKS. You can't lose. ******************************** SPECIAL FREE BONUS Order within 48 hours, we and will include, AS A FREE BONUS, information on over 500 SEARCH ENGINES and directories where you can list your site for free. (Some are very specialized and targeted). SPECIAL NOTE: If you are busy and don't have time to go to our web site INSTANT-DELIVERY SECURE ORDER FORM, you can order by FAX. (The unconditional guarantee still applies!) Just fill in the FAX FORM AT THE BOTTOM OF THIS PAGE. Then FAX it to us at: > > 1-305-289-1884 > If you order by FAX your copy of the report will be sent to you by email within 24 hrs. Or, if you prefer, you can send your order with a CHECK by snail mail to the address below. (Be sure to include your email address for delivery.) Whichever method you choose to order, YOU'LL BE GLAD YOU DID! Best of luck with your web site! Leeds Publishing 5800 Overseas Hwy., St. 35-154 Marathon Key, Fl. 33050 Fax 305-289-1884 http://www.leedspublishing.com/SES5/ ________________________________________________________________________ >________________________________________________________________________ > FAX ORDER FORM > (Please print clearly) > >FAX TO: Leeds Publishing > >FAX NUMBER: 1-305-289-1884 Hi: Here is my order for Search Engine Secrets at $19.95 only. I understand it is unconditionally guaranteed. Include my FREE BONUS of 500 search engines. Send by email ASAP. Date:__________________ > NAME:_______________________________________________ > E-MAIL ADDRESS:______________________________________________________________ (PLEASE be accurate. One small error and we can't send your order). > >CARD TYPE:_________________ > >CARD NUMBER:_________________________________________________ > >EXPIRATION DATE:______________ > >NAME ON CARD:________________________________________________ > > >Thanks for ordering. Your copy of the report will be sent to you by email ASAP. > >____________________________________________________________ >____________________________________________________________ > > >Copyright 1997 Leeds and Rousseau Publishing. All rights reserved. Form 102 GD-Yahoo > From blr at dev.null Thu Oct 2 04:00:53 1997 From: blr at dev.null (Born Loser Remailer) Date: Thu, 2 Oct 1997 19:00:53 +0800 Subject: throw away accounts? (was Re: Remailer Attack) In-Reply-To: Message-ID: <3433774B.181D@dev.null> Bill Stewart wrote: > So what can you do with a limited-target-area remailer? > - Entry remailer, with well-known name, that only forwards > its mail to other remailers. Recopients don't complain, > though you can still get flooded with SPAM. > - Middleman remailer, accepting mail only from remailers and sending > only to other remailers. Nobody complains. Easy to maintain. > Great for forwarding cover traffic through other remailers. > - nymserver target remailers, though obviously if you're the only > recipient of mail, it's a bit visible, though you could > set them up to chain to another remailer > - forwarders to message pools > - subscription-only remailers. > - maybe spam filters? > - > - your suggestion here - use a cheap throw-away account on a different ISP to direct abuse compaints to, and never use the account to 'send' email. (most people can't read headers, and just attack whoever you point them toward. an ISP would be hard-pressed to justify cancelling an account which never sent out email, for 'abuse'.) B. Loser, Remailer From trg at dev.null Thu Oct 2 04:10:17 1997 From: trg at dev.null (The Right Guy) Date: Thu, 2 Oct 1997 19:10:17 +0800 Subject: [GUNS] Re: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: Message-ID: <3433787A.6DB5@dev.null> Bill Stewart wrote: > > [Guns aren't really a cypherpunks topic, though the below-mentioned > clueless power-hungry terrorists do use the Internet and crypto > to help maintain their position relative to their victims and to > other competing clueless power-hungry terrorists.] Munitions is munitions. The Right Guy has Left the building... From dlv at bwalk.dm.com Thu Oct 2 04:10:34 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Thu, 2 Oct 1997 19:10:34 +0800 Subject: Secure HTTP servers. In-Reply-To: Message-ID: Martin Pool writes: > I have no evidence in support or rebuttal of C2Net's alleged > harrassment of Dr Vulis, so I won't comment on that. Are you questioning whether I, Tim May, and several other people on this mailing list were threatened by C2Net';s lawyers? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From jya at pipeline.com Thu Oct 2 04:51:51 1997 From: jya at pipeline.com (John Young) Date: Thu, 2 Oct 1997 19:51:51 +0800 Subject: Request for illegal electronic surveillance examples and cases Message-ID: <1.5.4.32.19971002112355.0085f4b8@pop.pipeline.com> Declan wrote: >So I'm putting together a special report featuring examples of illegal >wiretapping by governments -- to show why we shouldn't trust them with >mandatory domestic key escrow. Also illegal electronic surveillance, >generally speaking. Especially more recent ones. Maybe non-U.S. examples >too. There are a number of US cases in the just published "Secrets: The CIA's War at Home," by Angus Mackenzie. What is worth exploring to supplement the perhaps too facile gov-bash is the burgeoning private industry of illegal electronic surveillance, staffed with mostly ex-gov folks (and those not deft enough to get a global Cold War sinecure) who are not always as scrupulous as the government. These operations are growing worldwide as governments down-size, up-size and sneaky-rig their NatSec and LE programs, often most slyly by privatizing them behind false fronts. Indeed, the bigger story may be the ways illegal electronic snooping is being hidden behind "legal" operations by both government and industry, often working in concert to camouflage the bastardly deeds by pointing fingers at each other to justify higher budgets and higher fees and more restrictions on free expression. Get Stewart Baker looped and talkative. Then John Deutch, William Perry, and on and on. The media and DC public interest groups are not outside this long-running covert loop of mutual back-scratchers. Read "Secrets." Trace for example where the heads and legal counsels of military, spy and law enforcement agencies go in private industry, and the affiliations they form in commerce and non-profit orgs, beginning with SAIC, say, and the Council on Foreign Relations, the lobby-law firms and schools, but do not stop with the obvious, easy to find. Get Stewart Baker looped and talkative. Then John Deutch, William Perry, ex-legislators, and on and on. Be prepared to have your not-so-secure comm systems hacked by the New Terrorists as dirty secrets are threatened. Read "Secrets:" some of the characters in the crypto debate are mentioned in earlier disguises and, in a few case, where they show now. From zooko at xs4all.nl Thu Oct 2 05:04:08 1997 From: zooko at xs4all.nl (Zooko Journeyman) Date: Thu, 2 Oct 1997 20:04:08 +0800 Subject: counter-intuitive -- spam is good for you. anonymous assholes are your friend Message-ID: <199710021138.NAA23846@xs1.xs4all.nl> I just got through reading another hilarious post from Anonymous, and I realized that instead of filtering anonymous posts _out_ of my reading list like I used to, I've gradually started filtering them _in_. I was thinking about why, and it illustrates a counter- intuitive hypothesis that's been germinating in my head for a few days/months/years. I'll call it "Zooko's Law of Evolutionary, Counter-Intuitive, Painful Serendipity": In an evolving ecosystem, things which appear to do harm often result in benefit. For example, if you consider having lots of healthy, happy bunnies to be a benefit, you might consider an influx of voracious wolves to be bad news. But in many cases the selective pressure exerted by the wolf population will result in stronger bunny genes, healthier bunnies, more bunny babies and cetera. In the case that the wolves leave again, or some other aspect of the environment changes (winter comes, etc.) then the population of passive grass-nibbling bunnies will turn out to be disappointingly fragile compared to the population of well-exercised wolf-fleeing bunnies. Now you might complain that I am not playing fair by tossing in these hypothetical environment changes late in the game. If we are evaluating _just_ the influx of wolves, and not some possible developments such as the wolves passing on, winter coming and so forth, then "obviously" the bunnies were better off without wolves. But perhaps that's just the point. In an evolving ecosystem, you _can't_ measure success without considering the likelihood of continual change. You might also object that I am sneaking in some unfounded Platonic concept of "bunny goodness" which only holds in certain contexts. I.e. maybe the environment will change in a way that penalizes bunnies with sinewy muscles and fast hearts and rewards big fat stupid bunnies who only think of the next nibble. Okay. Maybe I am. But my intuition tells me that this isn't some human-prejudice Platonic Ideal slipping in, but that in fact competition _does_ usually make the competitors better suited for all sorts of likely environmental changes. Now why do the cpunks care? Because I think the invasion of flaming, spamming Vulisses and "Graham-John Buellers" was good for the cpunks list. It drives away people with too little intelligence, stomache-strength, technical know-how or egostic attitude manage their own list input without depending on group dynamics to manage it for them. Okay, so like all "natural" selections, it takes out a few of the good guys too. I still miss Perry Metzger's involvement, but if we had to lose Perry in order to lose a few dozen clueless loudmouths, then so be it. Anyway, I consider it a Bad Thing that anonymous remailers are so difficult to learn and use. I would approve if point-n- click remailers and remailer clients were widely distributed. But in another application of Zooko's Law of Evolutionary Serendipity, the fact that remailers are hard to use means that the people who use them are smarter than average. So maybe _that's_ why I've found it rewarding to select _for_ anonymous posts instead of against in recent times. And why I toy with the notion of fomenting the kind of infowar "war games" that Phill Hallam-Baker hates. Damn, I wish Daniel Dennett were reading this list. Regards, Zooko Journeyman P.S. Just to tie up one loose end-- you might notice that I counted the flame-invasion as a goodness because it drove off "clueless loudmouths". But what's the difference between a "Graham-John Buellers" and a normal crypto-groupie? Is this a double-standard? Not at all. The clueless loudmouths that I am glad to be rid of are an insidious sort, like William H. Geiger III, Paul Bradley, and rest-his-soul Jim Bell who are on-topic and sane enough to attract attention from the real thinkers, but who are prolific and mediocre enough to pull down the over-all quality of discourse. Apologies to the named people for hurting your feelings. It's nothing personal, but I have to call 'em like I see 'em. Cut down the volume of your output to just the very best of your articles, and maybe I'll stop filtering you out. From mitch at duzen.com.tr Thu Oct 2 05:51:17 1997 From: mitch at duzen.com.tr (S. M. Halloran) Date: Thu, 2 Oct 1997 20:51:17 +0800 Subject: Kill All The NIGGERS (Vote for Bob Dole)) In-Reply-To: <34337389.21D9@dev.null> Message-ID: <199710021227.OAA24207@ankara.duzen.com.tr> Racist Remailer wrote on 2 Oct 97: [manifest immaturity deleted] Okay, on whose watch did this one get out? (Yes, I did reply, and yes, I plead guilty for keeping this thread going by having done so...so do you too have to reply?) Mitch Halloran Research Biochemist/C programmer/Sequioa's (dob 12-20-95) daddy Duzen Laboratories Group mitch at duzen.com.tr From nobody at REPLAY.COM Thu Oct 2 05:53:42 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 2 Oct 1997 20:53:42 +0800 Subject: Stronghold Message-ID: <199710021247.OAA00552@basement.replay.com> Dr.Dimitri Vulis KOTM writes: > > Anonymous writes: > > Dr.Dimitri Vulis KOTM writes: > > Those who are newcomers to the list should know that Vulis has never > > presented any evidence substantiating his vague claims that Stronghold > > is insecure or has backdoors (or whatever the claims were). Vulis is > > conducting a personal vendetta against one of C2Net's staff members and > > anyone who happened to be or become associated with him. > Nor do I have to present any evidence. You misordered this: it should say "Nor do I have any evidence to present." > I'm not the one selling StrongHold. No, you're the one trying to torpedo its sales to get back at certain individuals for some perceived slight. > I have received several threatening communications from C2Net's lawyers, > which were discussed at length on this list. To avoid unpleasant disputes > I agreed not to disseminate my opinions about StrongHold. Amazingly, C2Net doesn't like to see its product publicly slandered by reptiles like Vulis. If Vulis' opinion were based on anything other than personal ill will - ie, if he had ever actually downloaded and examined Stronghold and found any problems with it - he would have a leg to stand on. As it is, his allegations are completely unfounded. > Please keep this in mind if you consider buying it. Keep in mind that anything Vulis says is in all likelihood a complete lie. From dlv at bwalk.dm.com Thu Oct 2 06:10:09 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Thu, 2 Oct 1997 21:10:09 +0800 Subject: The War on Drugs--Surrender! / Re: INFO-RUSS: Reuter: Russian+Russian Drug C In-Reply-To: Message-ID: <4a6XDe8w165w@bwalk.dm.com> ? the Platypus {aka David Formosa} writes: > -----BEGIN PGP SIGNED MESSAGE----- > > On Wed, 1 Oct 1997, Anonymous wrote: > > [...] > > > Legalize drugs! > > The War on Drugs *created* all of the current problems in this area > > by making minute amounts of forbidden substances worth more than > > precious metals. > > I have to aggry with Anon here, the legalisation of drugs combined with a > harm minimisation program has a good chance in resulting in less deaths > and crime. Check out the fairly successful Swiss program, distributing heroin cheaply to registered addicts. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From ravage at ssz.com Thu Oct 2 07:07:24 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 22:07:24 +0800 Subject: index.html Message-ID: <199710021409.JAA26061@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Main banner AST. Working for your business. rule BOY SHOOTS SISTER FOR TALKING ON PHONE TOO LONG October 1, 1997 Web posted at: 11:11 p.m. EDT (0311 GMT) ORANGE PARK, Florida (AP) -- A 14-year-old boy shot his sister for talking on the telephone too long, a law enforcement official said. The boy, who was not identified because of his age, was charged with attempted murder. His 15-year-old sister was treated for a gunshot wound to her chest and released from a hospital. The boy said that his sister was getting on his nerves for talking on the phone too long, the sheriff's office said. He said he took his mother's .22-caliber revolver from a locked box in her bedroom. The girl was reading a book when she was shot Monday. When officers arrived, the boy was talking on the phone. "I could understand a temper thing, but this kid had the gun for four or five hours before he went into his sister's bedroom and shot at her twice," said sheriff's Sgt. Wes Gronikowski. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Message Boards Sound off on our message boards You said it... [INLINE] AST. Working for your business. rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From ravage at ssz.com Thu Oct 2 07:09:48 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 2 Oct 1997 22:09:48 +0800 Subject: index.html Message-ID: <199710021408.JAA26033@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Main banner Visit Regal at Buick.com rule NATIONWIDE CRACKDOWN ON MAIL FRAUD BEGINS Mail fraud graphic October 1, 1997 Web posted at: 11:11 p.m. EDT (0311 GMT) WASHINGTON (CNN) -- Federal, state and local law enforcement agencies joined hands with more than 1,500 private sector volunteers Wednesday to launch a nationwide crackdown on mail fraud. "Project Mailbox," initiated by the Federal Trade Commission, U.S. Postal Inspection Service, the National Association of Attorneys General and the American Association of Retired People, targets con artists who use mass mail to defraud consumers. The FBI estimated several years ago that an estimated $40 billion a year is lost to mail and telemarketing scams that include a range of deceptive claims such as phony bills, bogus advance-fee card offers and false contest claims. One goal of the new effort is to get a more accurate and up-to-date estimate on the size and nature of this problem. To assist, AARP is asking members to turn over unsolicited and suspicious mail to law enforcement officials. The coalition is also launching a consumer education campaign. rule Related sites: Note: Pages will open in a new browser window * AARP * Federal Trade Commission * United States Postal Service External sites are not endorsed by CNN Interactive. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Message Boards Sound off on our message boards You said it... [INLINE] Visit Regal at Buick.com rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From 53199432 at hotmail.com Thu Oct 2 23:00:10 1997 From: 53199432 at hotmail.com (53199432 at hotmail.com) Date: Thu, 2 Oct 1997 23:00:10 -0700 (PDT) Subject: Upgrade to first class - nearly every time you fly... Message-ID: <199876432.GAA98685498@aol.com> To respond to this message, DO NOT HIT REPLY! (nothing will happen) Rather, use the link at the end of the message. ***********************************************************
UPGRADES to first class (domestic and international), the latest 'Two-for
Ones', analysis of the many frequent flyer �perks�, double and triple miles,
comparisons of premium class amenities and unpublicized bank card �perks� - sound
interesting? Read on!!!
     You deserve the best first and business class comfort the airlines have to offer
and these days domestic and international airlines are offering the most easily
attainable upgrades in air travel history, many of them either without charge or even a
membership in their frequent flier programs!
     Every issue of The Front Row Advisor bimonthly newsletter compiles and packs
no-nonsense, insider air travel tips, disclosing the little-known first class promotions
for all passengers and lots more; all presented in a well-organized, concise yet
thorough, easily readable format. Our current issue is up to 20 pages with over 70
articles dedicated to FIRST CLASS AIR TRAVEL ONLY, NO ADVERTISING!!!
     The Front Row Advisor is the only thorough industry resource of low cost and
no cost upgrades blended with timely, unbiased reporting from worldwide sources
covering all the airlines, not just a few.


Like to read more?  We'd like to send you a FREE "Sneak Preview" issue!
                     ***************
CLICK HERE TO REQUEST A FREE "SNEAK PREVIEW"

                     ***************

end END From pooh at efga.org Thu Oct 2 08:02:27 1997 From: pooh at efga.org (Robert A. Costner) Date: Thu, 2 Oct 1997 23:02:27 +0800 Subject: Remailer advertising In-Reply-To: <3.0.3.32.19971002024633.032b0028@mail.atl.bellsouth.net> Message-ID: <3.0.3.32.19971002103137.03132df0@mail.atl.bellsouth.net> At 04:12 AM 10/2/97 -0600, Racist Remailer wrote: > Also, advertising could be sent to the originator of anonymous >remail, This does seem like a second place that remailer advertising could be "sold." Advertising to the sender side seems like a better idea than recipient advertising, but I'm not sure it would go over very well either. When the crypto vote recently came up in Congress, I suggested putting "advertising" about the vote on outgoing remailer messages. This would have involved promotion of non EFGA web pages. The owners of such web pages, who are pro-crypto, did not care for the association with a remailer. For a recipient side ad, I thought of simply sending out a terms of service message, perhaps replaced in the future by paid advertising. We discussed this, and decided that users would be bothered by getting return email when they send the remailer a message. We considered sending a return message not with each message, but say only once per month, or only once every two weeks. Feedback I got on this was that users would not like the remailer acknowledging them. Obviously we would have to build some database of who sent something when in order to make this work. A database of who has sent a message in the last two weeks is just another chink in the armor waiting to be exploited. -- Robert Costner Phone: (770) 512-8746 Electronic Frontiers Georgia mailto:pooh at efga.org http://www.efga.org/ run PGP 5.0 for my public key From frantz at netcom.com Thu Oct 2 08:11:08 1997 From: frantz at netcom.com (Bill Frantz) Date: Thu, 2 Oct 1997 23:11:08 +0800 Subject: Why? (fwd) In-Reply-To: <199710012159.QAA20763@einstein.ssz.com> Message-ID: At 2:59 PM -0700 10/1/97, Jim Choate wrote: >> From: Bill Frantz >> At 7:49 PM -0700 9/30/97, Jim Choate wrote: >> >My original question still stands, why would I or any other party choose to >> >use an anonymous remailer for anything other than the original 3 items I >> >mentioned previously. > >> I have heard of people's posts being brought up in employment >> interviews. A rational person might want to express controversial opinions >> anonymously. > >And your point is? My personal opinions have nothing to do with my >professional career and yours shouldn't either. I would love to have a >company bring up my past posts, makes it easy to decide if I want to work >there or not. > >If you want to work for such a company and you know their views and your >views are in conflict then I would say you need a shrink not an anon. >remailer. You see my stand in the .sig below. (Hint, it is my "true name".) However, I am willing to admit that others may see it differently and want to use remailers. ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz at netcom.com | nation it is today. | Los Gatos, CA 95032, USA From theSameGuy at theSamePlace.Old Thu Oct 2 08:19:41 1997 From: theSameGuy at theSamePlace.Old (The Same Guy) Date: Thu, 2 Oct 1997 23:19:41 +0800 Subject: InfoWar 27 / Part III of The True Story of the InterNet In-Reply-To: <6489040e71db5edc2ab5e653cb709620@anon.efga.org> Message-ID: <3433B3D6.28DB@theSamePlace.Old> A non-text attachment was scrubbed... Name: not available Type: text/html Size: 12587 bytes Desc: not available URL: From frantz at netcom.com Thu Oct 2 08:20:02 1997 From: frantz at netcom.com (Bill Frantz) Date: Thu, 2 Oct 1997 23:20:02 +0800 Subject: "Show me an example of terrorists using the Internet orcrypto" In-Reply-To: Message-ID: At 11:16 AM -0700 10/1/97, Alex Le Heux wrote: >You people just don't get it do you? A gun has one purpose: To kill. Just like >any other tool, a gun, if it is available _will_ be used at some point. When I was on my high school rifle team, I thought the one purpose of guns was to poke holes in a piece of paper closer to the center of the bull's-eye than the other team could. ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz at netcom.com | nation it is today. | Los Gatos, CA 95032, USA From theSameGuy at theSamePlace.Old Thu Oct 2 08:24:01 1997 From: theSameGuy at theSamePlace.Old (The Same Guy) Date: Thu, 2 Oct 1997 23:24:01 +0800 Subject: InfoWar 27 / TEXT Message-ID: <3433B47B.7D3F@theSamePlace.Old> ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * Anarchist Post of the Century Alex Le Clue ---------------------------------------------------------------------------- Anarchist Post of the Century ---------------------------------------------------------------------------- Subject: Mr. Policeman is Your Friend From: Tim May To: cypherpunks at cyberpass.net >Electronic Frontier Canada's David Jones (djones at insight.dcss.McMaster.CA) >posted the following to the EFC mailing list: >2. If cops can read E-mail, so can the bad guys > http://www.efc.ca/pages/media/gazette.24sep97.html Let's not forget that cops are often the bad guys. And I don't mean this in a macho, off-the-pigs way. I mean that throughout history the "cops" are those who have enforced the laws and whims of tyrants, who have arrested and tortured and executed dissidents and nonconformists of all flavors, and who were the "King's men" in the times of the Founders. Even in more recent decades in the U.S., don't forget it was "cops" who harassed civil rights workers, who broke up perfectly legal strikes, who arrested and imprisoned Eugene Debs for speaking out against the draft in particular and a foolish war, WW 1, in general, and so on. One need only look to J. Edgar Hoover and his police state measures. (In fact, the very term "police state" tells us all we need to know about whether or not "Mr. Policeman is Your Friend" is always, or even most of the time, true.) And with full awareness that I am invoking Godwin's Law, the "cops" in Europe in the 1933-45 period were the enforcers of Hitler's policies. Here's a list of some folks throughout history and in various regimes who would likely have reason not to want to escrow their keys with the local police: Jews, Catholics, Protestants, atheists, heretics, schismatics, heathens, poets, authors, Scharansky, Solzhenitsyn, refuseniks, Chinese dissidents, students in front of tanks, Branch Davidians, Scientologists, Jesus, Gandhi, Nelson Mandela, African National Congress, UNITA, Thomas Jefferson, Patrick Henry, colonial rebels, patriots, Tories, Basque separatists, Algerian separatists, secessionists, abolitionists, John Brown, draft opponents, communists, capitalists, imperialist lackeys, anarchists, Charlie Chaplin, Galileo, Joan of Arc,, Martin Luther, Martin Luther King, Malcolm X, Stokely Carmichael, civil rights workers, Margaret Sanger, birth control activists, abortionists, anti-abortionists, Michael Miliken, Robert Vesco, Marc Rich, Nixon's Enemies, Hoover's enemies, Clinton's enemies, Republicans, Democrats, anarchists, labor organizers, pornographers, readers of "Playboy," viewers of images of women whose faces are uncovered, Amateur Action, Jock Sturges, violators of the CDA, alt.fan.karla-homulka readers, Internet Casino customers, Scientologists, Rosicrucians, royalists, Jacobeans, Hemlock Society activists, Jimmy Hoffa, John L. Lewis, Cesar Chavez, opponents of United Fruit, land reformers, Simon Bolivar, Robin Hood, Dennis Banks, American Indian Movement, Jack Anderson, Daniel Ellesberg, peace activists, Father Berrigan, Mormons, Joseph Smith, missionaries, Greenpeace, Animal Liberation Front, gypsies, diplomats, UN ambassadors, Randy Weaver, David Koresh, Ayatollah Khomeini, John Gotti, Papists, Ulstermen, IRA, Shining Path, militia members, tax protesters, Hindus, Sikhs, Lech Walesa, Polish labor movement, freedom fighters, revolutionaries, Ben Franklin, Thomas Paine, and "suspects" --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." ---------------------------------------------------------------------------- Alex Le Clue ---------------------------------------------------------------------------- Axle Le Clue shook his head in disbelief, as he read the CypherPunks list post that had been sent by his clueless Doppelganger, Alex Le Heux. Subject: Re: "Show me an example of terrorists using the Internet or crypto" From: alexlh at xs4all.nl (Alex Le Heux) To: cypherpunks at cyberpass.net Bullshit. People in the US rarely use their weapons against oppressive governments or political turbulence. Most guns that are used against another person there are used to commit crime or to defend against those armed criminals. Anonymous wrote: >Let's also take a look at the Dutch performance during their >occupation. While there certainly were many courageous Dutch people >who helped refugees (at great personal risk, to say the least), and >there were many courageous Dutch people who were in the resistance, >there were also many Dutch people who did not perform so well. Not >only were a large number of Jewish people turned in by Dutch >informers, but there were even Dutch SS units. You have a nerve. You, coming from a country where people are still regularly killed in the name of racism, tell me this?! Alex -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDNpTNuYAh4dUSo/EQK3bwCeKJv4AW0kOwjSRitLi7HDa7KEaW8AoN4F OwK1wOG19pazc93T1twP1Evp =FsmU -----END PGP SIGNATURE----- Axle Le Clue had been following this thread, in which a large number of CypherPunks had contributed their perspective, to little effect, for the most part. Alex Le H[clu]e[less]ux, despite a variety of sensible, well-reasoned posts by a number of different American CypherPunks, seemed to remain, in his own mind, a world-class expert on a country in which he did not reside. What was especially sad, was that the poor, dumb fucker wasn't even a spook. Axle Le Clue decided that, since the rather civil posts by the other list members were not helping his clueless twin from across the sea to come half-way to his senses, that he would step into his VerityMonger suit and bring the boy up to speed on what an ignorant asshole he was making of himself. It was the least he could do for an evil twin� Subject: When you realize that you're too stupid to live, you can borrow my gun. From: Axellc at xsDRUGS4all.hi (Axle Le Clue) To: cypherpunks at Algebra.COM Alex, Did you know that all Europeans are exactly 5' 7" tall, have light brown hair and limp slightly when they walk? I know this because I watch TV and that makes me a goddamn fucking expert on you low-life foreigners who aren't like us, over here. If you disagree with my view of your region of the world, then why don't you get your head out of your fucking ass so that you have an outside chance of expressing an opinion or viewpoint that you didn't suck out of the cocks of the mass media when it comes to our region of the world. I saw a news story on TV the other day about two senior citizens who drew down on a would-be robber in a restaurant, or some such, using their illegal guns, which they carried for their own protection. Yep, I saw it in the news once. Today some kid slashed his mater's throat, and then went to school and whacked out a couple of his classmates with a rifle. I have seen this every half-fucking-hour since it happened, and will no doubt be shown all of the messy details another few hundred times before the mass media who seem to be in charge of spoon-feeding people like yourself their world-view is done creating your reality for you. You want nerve, pal? I've got the fucking nerve to suggest that you petition your fucking government to take in a few million US government created nigger crack-heads, so that your country can teach our citizens how to treat them with love and respect. To tell the truth, I'd rather you took the white-bread junkies, because my nigger drug addict acquaintances have treated me much better than my honkey junkie pals. Correct me if I'm wrong (but I never am), but it seems to me that Europe is not even interested in saving our Black-African Americans from the horrible abuse they suffer as a result of our country's racism. Come and get 'em�see if they'll go. The US has racial problems because we have different races. We also have a whole shitload of racial harmony. All over the world, there are a variety of countries engaged in mass murder and genocide, at any given point in time. You try coming to the US and slaughtering even a few thousand of any particular race, religion, or ethnic group, and you won't even be able to take a wild guess at the number of people of various races, religions and ethnic groups that will be on your ass like shit on stink. You hypocritical piece of shit--having the fucking audacity to conceitedly brag about how the people of Europe have "put the crap of WWII behind us" and suggest that it is something that we "haven't managed to do." Want the cold, hard facts of life, Bubba? You didn't put WWII 'behind' you. We did! Gun-loving Americans conquered your continent and gave you your countries back instead of enslaving you, like every other winner in history has done. Some of us discriminate against Jews. Do you know why? Because we HAVE some! We were giving them refuge while Europe was massacring them by the millions. Now you have the balls to say we're not all treating them right all of the time. Buy a fucking clue! NEWS FLASH!!! Fascism hadn't died, it has just gone underground and crept into every facet of life through the corporate and government power mongers. The government and the mass media are working the citizens like dumb fish on a hook, who are still trying to swallow the worm. There is a New World Order on the way, and it isn't going to be any prettier than the last time it was tried. You can dismiss as paranoid ranters and ravers, those who decry the increasing loss of our freedom and privacy, but you would be better served to listen and learn from them, rather than criticize their determination to defend their liberty, to the death, if necessary. Why? Because these are the same people who defended Europe's liberty, to the death. The danger is not the freedom lovers who are armed and declaring the line they will not let others step over, in compromising their rights and freedoms. The danger is the sheeple who believe the government and their media shills when they say that the Thought Police only want Austria. The Privacy Police only want the Jews. The danger is the sheeple who buy the government lie that they need to deny us our rights and freedoms to solve the problems that they, themselves, have created. If you can't see this clearly, then there is nothing that I or any of the other CypherPunks can say to change your perception of the source of creeping fascism that is leading to yet another attempt to create a New World Order. I love the American people. I despise the secret American government. I feel the same about many other countries I have lived in or visited. I do not want to see your children, or mine, fighting in the future over what color to paint their prison cells, instead of fighting to escape, and be free. When the cattle cars stop at the end of the line, the people you find there are not nearly as civil and reasonable as the ones who checked your identity cards at the beginning of the trip, to make sure that you were properly processed according to your rights under the law. I think you are an idiot to believe that the threat of weapons in the hands of the citizens is a greater threat than weapons only in the hands of the rich and powerful. However, if Europe is conquered by the forces of evil, once again, I am sure that myself and many other Americans will do what we can to come pull your ass out of the fire. It may take a little longer, this time, though, since we may have to kick our own fascist government's ass before we come kick the shit out of your dictators. No need to thank us�it's just the way Americans are. VerityMonger "If you want to conquer the world, you're going to have to come through me." ("Do you feel lucky, Hitler? Well�do you?) Copyright "Anonymous TruthMonger " "You can't get there from here." ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ---------------------------------------------------------------------------- From anon at anon.efga.org Thu Oct 2 08:34:29 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 2 Oct 1997 23:34:29 +0800 Subject: Remailers and ecash (fwd) Message-ID: Jim Choate: >For the sender to chain from remailer to remailer to destination the >destination has to be in the header info somewhere. Now in the most secure >system each packet header will only contain the address of the next hop. When >the next site gets it the packet contents are de-crypted (otherwise reading >the chaining info is trivial) and the contents are uncovered to reveal another >packet with the next hop header and another encrypted block. And on and on >we go. > > packet system?> Jim Choate has been amazingly clueless throughout this discussion, but this takes the cake. Does he really not know about encrypted nested chaining? My God! Of course remailers work this way, Jim. They've worked this way practically from the beginning. All remailers work this way. The mixmaster remailers are built around this idea, making each packet a constant size and adding dummy packets as new ones are stripped off, so outgoing messages look just like incoming ones. How can you be arguing about remailers when you know so little about how they work? > hop header depended on which key was used to decode it. > In other words, remailer A's key will produce one next hop > address while remailer B's key will send it elsewhere. This > is a subset of the different plaintext - same cyphertext > problem - a hard problem as I understand it. Find two > distinct texts that encrypt with different keys to the > same cyphertext> That won't help. There would be no point in doing this. I'd ask you to explain, but that would just prolong the agony. From nobody at REPLAY.COM Thu Oct 2 08:42:21 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 2 Oct 1997 23:42:21 +0800 Subject: Stronghold Message-ID: <199710021515.RAA14546@basement.replay.com> C2Net was wrong to censor the cypherpunks list in the guise of moderation. It was wrong to send threatening letters to people who claimed its products were weak. The whole moderation/censorship experiment was a terrible mistake. The actions taken by C2Net were completely unjustified. At the same time, it is dishonest to say that its products have backdoors or are weak. There is no evidence whatsoever that this is the case. It may stretch the intellects of some cypherpunks beyond the breaking point to hold these two views about matters at the same time. In the black and white world where some cypherpunks live, a company which tries to prevent criticism is evil, hence it must be fraudulent as well. More mature list readers will recognize that a company or a person can be wrong in some actions while being right in other ways. The burden of proof in claiming that there is a weakness in someone's security product is on those making the claim. Compare the unfounded statements by Vulis with the carefully documented breaks of weak software by Ian Goldberg, David Wagner, John Kelsey, and Bruce Schneier. What if Goldberg and Wagner had claimed that Netscape's RNG seeding was weak, without providing any more evidence than that claim? What if Schneier et al had broken cellular phone encryption without backing it up? They would have been justifiably ignored. If anyone really does believe that C2Net's products have backdoors or weaknesses, why don't they present them? Either they want people to keep using C2Net's supposedly broken products, which reflects badly on them, or they want people to stop but they are unable to present any evidence of these purported weaknesses. When Vulis or anyone else claims Stronghold is broken, ask him why he is presenting his claims in a form which will cause people to keep using this "broken" software. Does he want people to have weak encryption? Is he in favor of backdoors? If not, he would surely present evidence of the weaknesses, if there is any. Make Vulis explain his motivations when he makes these claims. From dlv at bwalk.dm.com Thu Oct 2 08:51:53 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Thu, 2 Oct 1997 23:51:53 +0800 Subject: Stronghold In-Reply-To: <199710021247.OAA00552@basement.replay.com> Message-ID: nobody at REPLAY.COM (Anonymous) writes: > > Dr.Dimitri Vulis KOTM writes: > > > > Anonymous writes: > > > > Dr.Dimitri Vulis KOTM writes: > > > > Those who are newcomers to the list should know that Vulis has never > > > presented any evidence substantiating his vague claims that Stronghold > > > is insecure or has backdoors (or whatever the claims were). Vulis is > > > conducting a personal vendetta against one of C2Net's staff members and > > > anyone who happened to be or become associated with him. > > > Nor do I have to present any evidence. > > You misordered this: it should say "Nor do I have any evidence to > present." Nope. Like I said, I'm not selling Stronghold or any competing product, I don't lose anything when someone foolishly buys it, so why should I present any evidence? I (and several other people on this mailing list) were threatened by C2Net's lawyers; so to avoid unpleasant disputes, I told them I won't be publishing whatever I might know about their product. > > I'm not the one selling StrongHold. > > No, you're the one trying to torpedo its sales to get back at certain > individuals for some perceived slight. No I'm not. What do I lose if someone not affiliated with me makes a foolish purchasing decision? That's why I complied with C2Net's request not to publish my opinions of their product. > > > I have received several threatening communications from C2Net's lawyers, > > which were discussed at length on this list. To avoid unpleasant disputes > > I agreed not to disseminate my opinions about StrongHold. > > Amazingly, C2Net doesn't like to see its product publicly slandered > by reptiles like Vulis. If Vulis' opinion were based on anything > other than personal ill will - ie, if he had ever actually downloaded > and examined Stronghold and found any problems with it - he would have > a leg to stand on. As it is, his allegations are completely unfounded. If this were true, then C2Net would encourage me to publicly present whatever "evidence" I have so they'd be able to refute it. This is not what they asked me to do. > > Please keep this in mind if you consider buying it. > > Keep in mind that anything Vulis says is in all likelihood a complete > lie. Keep in mind that "anonymous" is probably an employee of C2Net. Several of C2Net's shills used to post C2Net propaganda withouy revealing their C2Net affiliation; they switched to anonymous remailers when their nyms were exposed. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From wendigo at ne-wendigo.jabberwock.org Thu Oct 2 08:54:47 1997 From: wendigo at ne-wendigo.jabberwock.org (Mark Rogaski) Date: Thu, 2 Oct 1997 23:54:47 +0800 Subject: Forwarded mail... In-Reply-To: <199710020409.AAA19702@mx01.together.net> Message-ID: <199710021536.LAA19561@deathstar.jabberwock.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 An entity claiming to be Brian B. Riley wrote: : : ... nothing personal, but why is it people keep deluding themselves : with the idea that they can shoot to wound. You cannot know what a Because that's what all the cops on TV do. Most people see non-lethal leg shots on TV all the time, so they assume that it's probable. Even worse was "The A-Team" where hundreds of rounds were fired, but no one ever got hurt. It was intended to reduce the amount of violence on TV, but (in my opinion) only made gunplay seem like a safe recreational activity. Most of the people who talk about non-lethal wounding have very little experience with firearms. A few years ago, I was in school in a small PA town. The local cops shot and killed a kid who rushed at them with a knife. Most of the people I knew couldn't understand why the cop (who was in no way a gung-ho type, but competent and stable) didn't "just shoot him in the leg". I would ask them if they knew what shooting a moving target, in an uncertain situation, in the middle of the night was like. Most of them had never even held a gun, but they had seen the cop show last night and KNEW it was possible. Doc - -- [] Mark Rogaski "That which does not kill me [] wendigo at pobox.com only makes me stranger." -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDO/esHFI4kt/DQOEQKZIACglKhTcPb4lTLI48qwL+sCpeeFDB4AoPdh lbgiVT8iz4AWvTNJfXZT61MC =JuBW -----END PGP SIGNATURE----- From attila at hun.org Thu Oct 2 09:24:32 1997 From: attila at hun.org (Attila T. Hun) Date: Fri, 3 Oct 1997 00:24:32 +0800 Subject: counter-intuitive -- spam is good for you. anonymous assholes are your friend In-Reply-To: <199710021138.NAA23846@xs1.xs4all.nl> Message-ID: <19971002.155729@hun.org> -----BEGIN PGP SIGNED MESSAGE----- on or about 971002:1338 Zooko Journeyman purported to expostulate: +So maybe _that's_ why I've found it rewarding to select _for_ +anonymous posts instead of against in recent times. +And why I toy with the notion of fomenting the kind of infowar "war +games" that Phill Hallam-Baker hates. yes, Zooko, go for it; Phill needs all the help he can get to shake out his obviously poorly maintained and porous node which he has claimed to be secure. if Phill is secure, what difference does it make if you assault him? my guess is he is not secure, and probably has no clue how to get from there to secure. -- "When I die, please cast my ashes upon Bill Gates. For once, let him clean up after me! " ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDPFib04kQrCC2kFAQGeWQQAicvwLYBdP0ruI7Br+GYWzHS1s+Rje7Pg KV0U7nX9ogpKWYZQIbt9nXJnCUn03e4uwqqUT/j7uj8V5RV/39djRRj5uvq/XVqk vk80CdcVWahjM/tPWoFiM/B6T5qGjNIrYlSYkhoCmIViNczsXBzYAKUOkmS8NSco P+XIKe5FuGo= =JPnI -----END PGP SIGNATURE----- From tcmay at got.net Thu Oct 2 09:41:43 1997 From: tcmay at got.net (Tim May) Date: Fri, 3 Oct 1997 00:41:43 +0800 Subject: Kill All The NIGGERS (Vote for Bob Dole)) In-Reply-To: <34337389.21D9@dev.null> Message-ID: At 6:28 AM -0700 10/2/97, S. M. Halloran wrote: >Racist Remailer wrote on 2 Oct 97: > >[manifest immaturity deleted] > >Okay, on whose watch did this one get out? > >(Yes, I did reply, and yes, I plead guilty for keeping this thread >going by having done so...so do you too have to reply?) > I expect you're new on the list, having only seen your name the last few days. Welcome to the list. As for "on whose watch did this one get out?" question, I hope you are not assuming or expecting that remailer operators screen messages for politeness, or even for sedition, libel, and copyright violation? Remailers simply remail. Some remailers have elected to have lists of addresses they will not send to (like *.whitehouse.gov), and some limit sizes, and a few other such things. But neither _content_ nor _title_ is a screening criterion by any remailer I have heard of. Get used to it. (Oh, and please send posts to one of the "real" Cypherpunks lists, not the temporary toad.com address.) --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From attila at hun.org Thu Oct 2 10:06:48 1997 From: attila at hun.org (Attila T. Hun) Date: Fri, 3 Oct 1997 01:06:48 +0800 Subject: Mr. Policeman is Your Friend In-Reply-To: Message-ID: <19971002.164428@hun.org> -----BEGIN PGP SIGNED MESSAGE----- on or about 971001:1644 Tim May purported to expostulate: [snip antecedent] +Let's not forget that cops are often the bad guys. [read Tim's excellent analysis and list in original] the thin blue line: just whose side are the police on? "the police are the lowest element of our society" (either Cato or Marcellus at the time of Julius Caesar) the cop is often a thug with a clean enough record to join the force and continue his trade. if you want to break heads, join the police; if you want to destroy buildings, join the fire department. these [wo]men may be public servants, but as Tim points out, just who is the master. In the US, "We the people" should be the masters, but are we? obviously not. read my DejaVu - Cypherpunks as Philosopher Kings. yes, it is inflammatory, but the cards are on the table. we're being set up to have less rights that are available under the UN declaration which has the same right of assembly and protest --as long as it is not against the security of the state. if guns are outlawed, only outlaws will have guns. obvious, particularly in America; but think of another implication: if the government of the US no longer truly represents "We the people," is not the government an outlaw government? "if guns are outlawed, only outlaws will have guns" takes on a whole new meaning... and, remember, we are not fighting a war with guns; we are fighting a war for the control of communication and information and that is one of the primary functions of cypherpunks: to ensure the freedom of speech, including [specifically] encrypted speech. -- "Experience keeps a dear school, but fools will learn in no other." --Benjamin Franklin ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDPP1L04kQrCC2kFAQH5cgP/dfDgD4fZuzp/2yLN6RUwkr0UMiCcjR9F IYSiW4aosOPiG2cZSWZOJn+trwvWYjKU4sLRos0c+W/9gRDh99URz1cG93iIDb71 iWbX4Qn4c57LU0pEGZaDygKtOzVZHAramN9yucIFlBy5bkYS65x7HMmco5OkmBtA Fx7kaiXlIP8= =OPCA -----END PGP SIGNATURE----- From nobody at REPLAY.COM Thu Oct 2 10:08:15 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 3 Oct 1997 01:08:15 +0800 Subject: Stronghold In-Reply-To: Message-ID: <199710021649.SAA24741@basement.replay.com> Dr.Dimitri Vulis KOTM writes: > > I (and several other people on this mailing list) were threatened > by C2Net's lawyers; so to avoid unpleasant disputes, I told them I won't be > publishing whatever I might know about their product. You obviously didn't know anything about it anyway. > > No, you're the one trying to torpedo its sales to get back at certain > > individuals for some perceived slight. > > No I'm not. An obvious lie. Big surprise. > That's why I complied with C2Net's request not to publish my opinions of > their product. You complied no doubt because you knew that your 'opinions' were baseless, and that you had no defense to a libel suit. > If this were true, then C2Net would encourage me to publicly present whatever > "evidence" I have so they'd be able to refute it. This is not what they > asked me to do. You have no evidence, Liar. I'm sure they simply asked you to stop publishing lies about them. > Keep in mind that "anonymous" is probably an employee of C2Net. Actually I'm not. Even so, this is just another wormy tactic to deflect attention from the fact that you're lying. > Several of > C2Net's shills used to post C2Net propaganda withouy revealing their C2Net > affiliation; they switched to anonymous remailers when their nyms were exposed. I have little doubt that this is just another unfounded allegation from the mouth of Dimitri Vulis, Noted Liar. -Frondeur From attila at hun.org Thu Oct 2 10:30:16 1997 From: attila at hun.org (Attila T. Hun) Date: Fri, 3 Oct 1997 01:30:16 +0800 Subject: Mr. Policeman is Your Friend In-Reply-To: <199710020639.IAA23181@ankara.duzen.com.tr> Message-ID: <19971002.171414@hun.org> -----BEGIN PGP SIGNED MESSAGE----- on or about 971002:0941 "S. M. Halloran" purported to expostulate: [snip - part of original text follows at the end of new message] the US initiated "Civil Rights" legislation at the Federal level to deal with the abuse of a persons liberty. It has been used many ways, but its original intent was to be able to charge, convict, and punish racist miscreants in the South for murdering Civil Rights activists who would walk scott free when tried for murder as white juries would not convict them (twelve "good" men unanimously). The statue was effectively retroactive. another perfect example, although I personally think poorly applied as I knew the Sergeant who was scapegoated when they convicted the animal who deserved it: The Rodney King case. A suburban white jury not-guiltied the four officers, except one "hung" count on the animal. The Feds stepped in and charged them with Civil Rights violations. for a hilarious exposition on impartial juries, read Mark Twain's Virginia City writings. The animal and the Sergeant were convicted; the judge sentenced them to 30 months or something; the Feds appealed since it was less than the guidelines, and the appeals court sent it back for resentencing; the judge repeated the sentence; by this time they were free anyway. The argument on the sentence is probably still going on... however, specifically to your question of an additive sentence for a person operating under the colour of law: no --except, the prosecutor could file additional charges of 'operating under the colour of law' --and the judge could specify that the sentence for that violation is to run after the others which would extend the time (often referred to as "running wild"). The remedy is there; the difficulty is in getting it applied unless the case is notorious. and, it provides for penalties ranging all the way to the death penalty. a very comprehensive, catch-all law which is rarely applied equally. another great American legal innovation which is even more of travesty: RICO --Racketeering Influenced Corrupt Organizations. it only takes 3 in the conspiracy to invoke it, and by itself it has a mandatory 20 years no parole; if it is 6 or more people, it is life without parole. common law no longer exists in the US. the courts are all Admiralty Courts where the only habeus corpus you have is what the court might gratuitously grant you. FDR sold the country into legal bankruptcy on 9 Mar 33 pledging all Americans and their property as collateral. Bankruptcy is a contract matter, and as such is not subject to common law. Americans live by being licensed to exist --the license starts with the social security number which is now required to be issued at birth. -- "When I die, please cast my ashes upon Bill Gates. For once, let him clean up after me! " ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 +I have a question: has any jurisdiction (local, state, federal) in +the U.S. resolved the hyprocrisy--maybe better to phrase "double +standard"--wherein citizens who commit crimes against persons who +perform duties under the color and badge of authority--namely the +police--are charged with additional offenses specific for crimes +against govt officers--but govt officers who commit crimes against +citizens while in the performance of duties under the color and badge +of authority would suffer the same penalty as citizens who commit +crimes against "just" citizens? -- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDPXbL04kQrCC2kFAQETtQP9HhOCKwFhrG//bLoWvlRF1yAEwGwxuWFB MuFcTp7kVCn1vKEifKQzXUFN/ZyEVG1VkS/Woxl8pW0zLsddefFxEPmveJtXvqTf NyTYbyOane9oNvIFimR/JE45WTrOdsECdn9jwIC2vE+SG2LeYo1d1Nck1XPdK0U+ z6sd0Ch+NgU= =ozSY -----END PGP SIGNATURE----- From rah at shipwright.com Thu Oct 2 10:33:42 1997 From: rah at shipwright.com (Robert Hettinga) Date: Fri, 3 Oct 1997 01:33:42 +0800 Subject: new release of Crowds Message-ID: --- begin forwarded text X-Authentication-Warning: akalice.research.att.com: majordomo set sender to owner-crowds-talk at research.att.com using -f Date: Thu, 2 Oct 1997 10:28:06 -0400 (EDT) From: Mike Reiter To: crowds-talk at research.att.com Subject: new release of Crowds Sender: owner-crowds-talk at research.att.com Precedence: bulk Crowds 1.0.3 is now available. If you already agreed to our license on our web page, there's no need to do it again; just send email to crowds-support at research.att.com from the previous email address that you gave us, and we'll send 1.0.3 to you. The main change in 1.0.3 is a configuration file that eliminates the need for command-line arguments to anon.pl, and that also enables us to ship distributions ready to join our crowd (i.e., the registration step is eliminated). Hopefully this will make Crowds easier to use. - Mike --- end forwarded text ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ From anon at anon.efga.org Thu Oct 2 11:03:30 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 3 Oct 1997 02:03:30 +0800 Subject: CDA protects against liability Message-ID: <066c1dbe1946e2f31eaf54f722772af6@anon.efga.org> Another case where the CDA protected against liability. Remailer ops should look into this. http://www.wired.com/news/news/politics/story/7361.html: A San Francisco judge has ruled that a lawsuit that sought to force an Internet service provider to silence a Usenet participant is barred by the federal Communications Decency Act. At issue was a claim by San Francisco Satanists Michael and Lilith Aquino that San Diego-based ElectriCiti Inc. "breached its duty to the [plaintiffs] and to other Internet users" by failing to take action against an anonymous Usenet poster. The newsgroup participant allegedly harassed Michael Aquino, a former US Army lieutenant colonel and the leader of the Temple of Set, and his wife, Lilith. The claimed harassment took the form of messages referring to the Aquinos' involvement in a ritual child-abuse investigation in San Francisco in the 1980s. The couple was never charged with any wrongdoing. Superior Court judge David Garcia accepted ElectriCiti's contention that the lawsuit violated a little-discussed and still-in-force CDA provision that exempts ISPs from liability for content transmitted on their networks. The law states that "no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider." The decision is one of three such cases nationwide that have been thrown out because they attempted to hold ISPs responsible for subscribers' speech, said ElectriCiti's attorney, Roger Myers. From tcmay at got.net Thu Oct 2 11:35:38 1997 From: tcmay at got.net (Tim May) Date: Fri, 3 Oct 1997 02:35:38 +0800 Subject: Request for illegal electronic surveillance examples and cases In-Reply-To: Message-ID: At 7:40 PM -0700 10/1/97, Declan McCullagh wrote: >So I'm putting together a special report featuring examples of illegal >wiretapping by governments -- to show why we shouldn't trust them with >mandatory domestic key escrow. Also illegal electronic surveillance, >generally speaking. Especially more recent ones. Maybe non-U.S. examples >too. > >Any suggestions? I'm thinking things like: MLKjr, Mrs. Roosevelt, _Irvine_, >_Socialist Workers Party_, Dewey-FBI alliance, mail opening, Emma Goldman, >Brownell's blanket microphone surveillance, _Katz_, _Alderman_, CISPES. As others have noted, Bamford's "The Puzzle Palace" is chock-full of examples of government surveillance of cable and telephone traffic, including cozy deals with ITT to have them turn over all cable traffic. Ditto for other telecom carriers. And the UK-USA agreement enables "cross-surveillance," where GCHQ can do COMINT in the U.S., and NSA can do COMINT in the U.K and its colonies, without technically violating charters and laws. (Someone described a room at Fort Meade where a full-time staff of British and American agents cross-fertilize their products--if the NSA wants some traffic surveilled, the GCHQ can punch in a few commands, get the traffic, and then "share" it with their American counterpart). Bamford's updated edition is not out yet, so far as I know. Maybe it'll have more recent examples, especially involving computers and networks. As I'm not a professional telecom exec, or spook, most of my examples either comes from books (Bamford, Kahn, Burnham, etc.), or from anecdotal examples given. Anecdotes are hard to verify. But here are a few: - a Minneapolis friend of mine told me that the huge Cargill operation, the world's largest grain-trading company, and privately held, was using crypto in messages to Europe and Asia. They were asked by the NSA to stop, or to provide NSA with a key. Obviously this could only have happened if NSA or GCHQ were intercepting and attempting to decode. (My Minneapolis friend told me this in 1988. I don't have any details beyond this.) - someone told me that transcontinental telephone lines were routed in the 60s and 70s deliberately over Indian reservations in the Rocky Mountain states, and that the NSA used their "sovereign nation" status to skirt U.S. laws about domestic surveillance. (True or not, I can't say. Maybe a telecom buff here can see if any unusual jogs in the routing of the LongLines can be seen, jogs that take them into Indian Reservations in Utah, Colorado, etc., which is where I heard the intercept sites are located.) - more locally, I have been struck by the confluence of certain capabilities right in my own area. The Defense Language School is in Monterey, California. AT&T also operated their "simultaneous translation" service there (or did, last time I heard)...this service allows a speaker of Arabic, say, to speak to a speaker of Bantu, by means of experts in these areas. And not far away is a major signal processing Cray complex, ostensibly related to undersea sonar analysis, but usable in other ways. The Naval Postgraduate School and a couple of foreign relations think tanks are also in the area. Finally, or maybe not finally, the major West Coast satellite earth station is located in Jamesburg, California, in an RF quiet valley at the end of Carmel Valley. (Bamford also discusses this. Some of the other major earth stations have already been identified as NSA intercept points, such as the one in the valley in West Virginia.) (Were I writing a novel, I would use this confluence to suggest that this site is used for translating a lot of foreign language conversations crossing this major West Coast earth station. The huge pool of foreign language experts in the Monterey Bay area, what with DLS and ancillary facilities, including the Naval Postgraduate School, and the presence of a good cover for a major computer installation....) - look also into the Red Squads in major American cities, where cops ignored surveillance warrants to compile dossiers. (I believe the State of Israel, often involved in such things as a cutout for the U.S., was involved in some of these. In L.A., at least.) - Frederick Forsythe has a fine new novel out, "Icon," which details exhaustively (and probably correctly, given his other research) how Russia's version of the NSA, now called FAPSI (standing for something in Russian about radio), is supplementing its meader state funding by freelancing for corporations and mafia groups which want ELINT and COMINT on their rivals. Anyway, finding _concrete_ evidence for surveillance, at least in recent years, is not a lightweight project. It took Bamford years of research, FOIAs, and so on. Good luck. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From declan at well.com Thu Oct 2 11:48:16 1997 From: declan at well.com (Declan McCullagh) Date: Fri, 3 Oct 1997 02:48:16 +0800 Subject: Request for illegal electronic surveillance examples and cases In-Reply-To: Message-ID: Thanks, all, for the suggestions. Unfortunately my time is limited: my deadline is tonight. I'm working on a roundup of pre-reported cases, not reporting out new ones. (at least for this project) My best source so far is the 1976 Church Committee documents. Gentry's bio of J. Edgar Hoover is a good one too. Burnham lent me a copy of his "Above the Law" book about the DoJ which I haven't finished yet. Haven't read Puzzle Palace in a while, probably don't have time to reread that. -Declan From shamrock at cypherpunks.to Thu Oct 2 12:09:24 1997 From: shamrock at cypherpunks.to (Lucky Green) Date: Fri, 3 Oct 1997 03:09:24 +0800 Subject: Stronghold In-Reply-To: <199710021515.RAA14546@basement.replay.com> Message-ID: On Thu, 2 Oct 1997, Anonymous wrote: > > C2Net was wrong to censor the cypherpunks list in the guise of moderation. > It was wrong to send threatening letters to people who claimed its > products were weak. The whole moderation/censorship experiment was a > terrible mistake. The actions taken by C2Net were completely unjustified. Where do people get these bizarre ideas? C2 didn't censor the list. A guy who happened to work for C2 dropped some messages from one list. The messages still went out on the unfiltered list. Had he worked for Mc Donald's or the the NYC Sanitiation Department, would you blame them for this as well? -- Lucky Green PGP encrypted email preferred. "Tonga? Where the hell is Tonga? They have Cypherpunks there?" From tcmay at got.net Thu Oct 2 12:34:55 1997 From: tcmay at got.net (Tim May) Date: Fri, 3 Oct 1997 03:34:55 +0800 Subject: Request for illegal electronic surveillance examples and cases In-Reply-To: Message-ID: At 11:33 AM -0700 10/2/97, Declan McCullagh wrote: >Thanks, all, for the suggestions. Unfortunately my time is limited: my >deadline is tonight. I'm working on a roundup of pre-reported >cases, not reporting out new ones. (at least for this project) Meaning nothing against Declan personally, this "my deadline is tonight" is one of the reasons I almost never read news magazines anymore. (I stupidly bought a copy of something "Time" calls "Time Digital," as it seemed to have some of my acquaintances in it. I should've spotted the jive by the title on the cover, "Our Exclusive Ranking of the Cyber Elite." Lots of one-line quoting of pundits, shots of the overexposed geekbabe Pohlese, and fatuous nonsense about what it means to be rich in Silicon Valley. I wouldn't have believed it could be possible, but "Time Digital" is far, far worse than "Wired." Here's to hoping it dies a merciful death in the next few months.) --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From minow at apple.com Thu Oct 2 12:44:25 1997 From: minow at apple.com (Martin Minow) Date: Fri, 3 Oct 1997 03:44:25 +0800 Subject: Possible Security Hole in Internet Explorer 4.0 Message-ID: >From a message in MacOSRumors (I have not independently verified this) --- Begin quote --- Internet Explorer 4.0 ships with major security hole.... With the Microsoft Internet Explorer 4.0 for Windows release only hours old, users have already discovered a major security hole that smacks painfully of Big Brother: Most folks will remember the Netscape java bug that allowed you to snoop on what people where visiting. Well IE4.0 goes a bit further than this - Logging of your actions, even when you would otherwise be shielded by proxies is BUILT-IN. The channel definition format (.CDF) http://www.microsoft.com/standards/cdf-f.htm includes a LOGTARGET feature that allows a web site provider to make your browser deliver logs of your usage via an http post or put. Even hits from cache are logged. This is all not so good and getting worse. Not only is the information posted material, you wouldn't want to give to a provider, (considering) "http post/put" is normally spoofable anyway. Unanswered question for next time - or for folks with more time than me to follow up Can you put other sites in your channel definition and get logs of when they read your competitor's site (with this system)? Definitely not confidence-inspiring. It appears the Mac version is affected by this same problem, as well...and neither platform has any means of disabling this "feature" at present. --- [Internet Explorer 4.0 has not yet been released for the Macintosh platform.] Martin Minow minow at apple.com From declan at well.com Thu Oct 2 12:46:10 1997 From: declan at well.com (Declan McCullagh) Date: Fri, 3 Oct 1997 03:46:10 +0800 Subject: Request for illegal electronic surveillance examples and cases In-Reply-To: Message-ID: Heh. I've never actually published anything in Time Digital. The one piece I worked on for them was a full-page interview with Crypto-czar David Aaron that was supposed to happen when he was in town in January. But he blew me and the photographer off and left town without being interviewed. I learned much later that he always hated the term "crypto-czar," which I (and my co-authors) coined in an article we wrote a year ago breaking the news on his appointment. Maybe that's why he ducked out. -Declan On Thu, 2 Oct 1997, Tim May wrote: > At 11:33 AM -0700 10/2/97, Declan McCullagh wrote: > >Thanks, all, for the suggestions. Unfortunately my time is limited: my > >deadline is tonight. I'm working on a roundup of pre-reported > >cases, not reporting out new ones. (at least for this project) > > Meaning nothing against Declan personally, this "my deadline is tonight" is > one of the reasons I almost never read news magazines anymore. > > (I stupidly bought a copy of something "Time" calls "Time Digital," as it > seemed to have some of my acquaintances in it. I should've spotted the jive > by the title on the cover, "Our Exclusive Ranking of the Cyber Elite." Lots > of one-line quoting of pundits, shots of the overexposed geekbabe Pohlese, > and fatuous nonsense about what it means to be rich in Silicon Valley. I > wouldn't have believed it could be possible, but "Time Digital" is far, > far worse than "Wired." Here's to hoping it dies a merciful death in the > next few months.) From declan at well.com Thu Oct 2 12:49:57 1997 From: declan at well.com (Declan McCullagh) Date: Fri, 3 Oct 1997 03:49:57 +0800 Subject: CDA protects against liability In-Reply-To: <066c1dbe1946e2f31eaf54f722772af6@anon.efga.org> Message-ID: Remember that the CDA "protects against liability" since the online services cut a deal during the legislative process. In other words AOL & co lobbied to have provisions inserted to get them off the hook, even though individual users would still be screwed when the act became law. Another case of corporations selling out civil liberties. -Declan At 13:46 -0400 10/2/97, Anonymous wrote: >Another case where the CDA protected against liability. Remailer ops >should look into this. > >http://www.wired.com/news/news/politics/story/7361.html: From nobody at REPLAY.COM Thu Oct 2 13:26:03 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 3 Oct 1997 04:26:03 +0800 Subject: NoneRe: Remailers and ecash (fwd) In-Reply-To: <199710020549.AAA24606@einstein.ssz.com> Message-ID: <199710022004.WAA17386@basement.replay.com> Jim Choate wrote: > Shure they do because one of the things I would love to do is run a > commercial anon remailer. [snip] > You obviously have never done business with me. I've turned more than > one customer away because they were either stupid or wanted something that > was completely out of line. When all your customers are anonymous, you don't get to be very choosy. From alexlh at xs4all.nl Thu Oct 2 13:40:27 1997 From: alexlh at xs4all.nl (alexlh at xs4all.nl) Date: Fri, 3 Oct 1997 04:40:27 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: Message-ID: On Wed, 1 Oct 1997, Matt Elliott wrote: [snip] > >You people just don't get it do you? A gun has one purpose: To kill. Just like > >any other tool, a gun, if it is available _will_ be used at some point. > > Yea, so what is your point. As long as it is lawfull killing that seems to > me to be the point to use a gun. For lawfull purposes. Criminals will > always be using guns anyway. If they take away guns people will just find > another just as forcefull method of defending them selves. I have a potato > gun that will put a 3 inch hole in just about any living creature. I'm > going to take it deer hunting this winter. It will be cool to say I shot a > dear with a potato and a can of hair spray (the propelant) I completely disagree. I bet you'd disagree too when the cops come to take you away for using illegal crypto. It would be totally lawful. But that's besides the point. Killing people is NOT a good thing. It never is. It might be unavoidable in a you-or-him situation, but that doesn't make it a good thing. Would you like to be shot? No? Not even if someone else claims he has a good reason to? I think this goes for most people. So the best that you can do it claim that _you_ think there's a good reason to kill someone. This is not a working theory for a community. Alex --- I dabble in techno-house and sometimes, I do that badass hip-hop thang... But the F U N K gets me every time! From anon at anon.efga.org Thu Oct 2 14:04:52 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 3 Oct 1997 05:04:52 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Alex Le Heux wrote: >On 2 Oct 1997 01:29:33 +0200, in list.cypherpunks you wrote: >>Cynthia Brown wrote: >>>On Wed, 1 Oct 1997, Alex Le Heux wrote: >>>> This sucks. >>> >>>I agree wholeheartedly. >> >>>IMNSHO the best way to fight crime is not with bigger guns than the >>>"bad guys", but with better social programs such as universal health >>>care, and improved day care so single parents can show their kids >>>what a productive lifestyle looks like. >> >>Of course you agree wholeheartedly, you are an exploiter. It is >>wrong. You should be ashamed of yourself. > >Can you explain who exactly exploits who here? How about our friend J.F. Avon? He has the misfortune to share citizenship with Ms. Brown. Thus, while he may be minding his own business, doing nobody any harm, and pursuing happiness, should he decline to spend thousands of hours of his life working to pay money into Ms. Brown's socialist schemes, armed men will come to his house, put him in a cage, and leave him there for years. That's not a very friendly way to treat a neighbor, is it? In the United States, many thousands of people correctly recognize this situation. Many thousands of people are gun owners. Many thousands of people are not only gun owners, but combat veterans. The logical outcome would be great violence directed towards the government. Yet, this has not happened (recently ;-). Why? Certainly if the sums at stake were involved between governments, there would be fodder for many wars. The only conclusion that can be drawn is that civilians, even armed civilians with combat experience, are so overwhelmingly peace loving that they will bend very far backwards to avoid trouble, even if it means thousands of hours of work. Can the same be said of career military or government people? >PS. What's the point in posting anonymous when you have this sig? > >>Editor in Chief >>Smile Magazine >>http://www.neoism.org/squares/smile_index.html >>http://www.neoism.org/squares/cantsin_10.html Tools which are not used are not improved. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDPgFZaWtjSmRH/5AQEQ8wf+PwFFagIxuwKkoR5rUAxnseSP8DzrRsrw tQD5gCZ0t1JTBdXUinhZzr2NsyKDtGoPcauDtrxqWyMdAem5ZCf2v6D8Cgm34n3Q bkmvSJbo2bSuD9ggzboENp6rhvsbJ7THf7I4eMHRIUrnPgnQbaWTOXKqBPtG5w+W qPrgHAb7s6oaB8aRqX0sPByWKqbd853RLjsy62Tl3oMc7hp70TAKwXCtXKQTUhL+ CeNBpNFvnN1nR1L3AqL5aji0/BaN+7foptPRDH3eZfUwLx547+1R+DdLKAb7u5tL RJaza5h0O3Zkg+ImlqR2cKe5awxwB6NNkm2oR1GD1p0f80+mGUHtcQ== =C9wS -----END PGP SIGNATURE----- From anon at anon.efga.org Thu Oct 2 14:07:24 1997 From: anon at anon.efga.org (Georgia Cracker Remailer Administrator) Date: Fri, 3 Oct 1997 05:07:24 +0800 Subject: CDA protects against liability In-Reply-To: Message-ID: On Thu, 2 Oct 1997, Declan McCullagh wrote: > At 13:46 -0400 10/2/97, Anonymous wrote: > >Another case where the CDA protected against liability. Remailer ops > >should look into this. > > > >http://www.wired.com/news/news/politics/story/7361.html: This remailer-op, while not previously aware of the case, is well-aware of that provision of the CDA, but has not yet had the need or opportunity to use it as a legal defense. The reference is Public Law 104-104, Title V, Subtitle A, Sec. 502 as it amends (47 U.S.C. 223). The text of this law is available on-line at: http://thomas.loc.gov/cgi-bin/query/z?c104:S.652.ENR: My interpretation of this is: Anonymous remailers are internet service providers. -- For information on this anonymous remailing system, send the subject "remailer-help" to or visit our web pages at http://anon.efga.org/anon/. To contact the operator directly, send mail to . For general information and discussion about anonymous remailers, send a message with "subscribe" in the body to . From anon at anon.efga.org Thu Oct 2 14:10:17 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 3 Oct 1997 05:10:17 +0800 Subject: Remailers and ecash Message-ID: <5e155060a3b43cba398de593edc98bd6@anon.efga.org> -----BEGIN PGP SIGNED MESSAGE----- An anonymous brother wrote: >Given: We want more (reliable) remailers > But someone has to pay for them > >Conjecture: New remailers can be financed by charging the users a fee per > message to use the remailers. > > If a remailer charges a fee, the number of users will be reduced to > those who are willing to pay the fee. > > When the number of users is reduced, the potential for traffic analysis > is increased, which reduces the value of the remailer. > > If the value of the remailer is reduced, it will not be worth the cost > to many users, and those users will seek a less expensive, higher > traffic remailer. > > Thus, the commercial remailer is forced to lower its prices until it is > unprofitable. > >Conclusion: Pay-per-message commecial remailers are not economically viable. You know how the remailer operators do all their work now for free because they believe in it? And how all this software has been written and given away because people believe in it? Maybe some other people will help pay for the maintenance of the remailers because they believe it is the right thing to do. Especially since it need not be forever. And, I have to believe that out of the millions of well heeled Internet users, there are enough privacy oriented people to pay for a small remailer network, at the very least. We just have to get the ball rolling, that's all. > - Pay a flat fee per month for remailer access This is isormorphic to using ecash if you want to keep the messages of each user disassociated from each other. > - Everyone a remailer. Remailers only accept messages from other > remailers. To use remailers you must run a remailer. I don't grow my own wheat, grind it up, and then make my own bread. I also prefer not to run a remailer. > - Pay for access to an anonymous message pool Interesting! > - Sell cpu cycles in exchange for remailer access If we use ecash, you can sell anything in exchange for remailer access. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDP8VpaWtjSmRH/5AQEMNgf9FY0zq4+p1R6F4GPIvLCqQQsXJ9TeeNSX v8sH99yUpYm+FmJuxwoGzel0Q0VRaR6NakuTx/Q1tKzSA4H2cnslEixyft9c0CsE 5dWEXe7694x/el4xXJcoX3+XNrKjo8qAERe9jcttPUtEgwT+2+JnfcMOudX7UZd6 LL8OvpD9CJrwQuJIeaNgbftwuVukuLkCRWJ1wrsJAs37Y9w9GqA+RTlqNXbElyi6 ryC17sysWOaFVryjLEHYXL9r60Ct9ZHp1hQoP0O1yCyKa5BMrTsVfXWOXuU/qSDe w0cfkcZ6lI8EmZObcOLr3sRdblq7nojoBctypSkILwEtEqgbpW0HXg== =TgmT -----END PGP SIGNATURE----- From declan at well.com Thu Oct 2 14:12:41 1997 From: declan at well.com (Declan McCullagh) Date: Fri, 3 Oct 1997 05:12:41 +0800 Subject: CDA protects against liability In-Reply-To: Message-ID: There have been a bunch of other cases involving the deal-cutting portion of the CDA. I believe the Drudge lawsuit complaint refers to them. If not, AOL's response to the complaint certainly will. -Declan On Thu, 2 Oct 1997, Georgia Cracker Remailer Administrator wrote: > On Thu, 2 Oct 1997, Declan McCullagh wrote: > > > At 13:46 -0400 10/2/97, Anonymous wrote: > > >Another case where the CDA protected against liability. Remailer ops > > >should look into this. > > > > > >http://www.wired.com/news/news/politics/story/7361.html: > > This remailer-op, while not previously aware of the case, is well-aware of > that provision of the CDA, but has not yet had the need or opportunity to > use it as a legal defense. The reference is Public Law 104-104, Title V, > Subtitle A, Sec. 502 as it amends (47 U.S.C. 223). The text of this law is > available on-line at: > > http://thomas.loc.gov/cgi-bin/query/z?c104:S.652.ENR: > > My interpretation of this is: Anonymous remailers are internet service > providers. > > -- > For information on this anonymous remailing system, send the subject > "remailer-help" to or visit our web pages at > http://anon.efga.org/anon/. To contact the operator directly, send mail > to . For general information and discussion about > anonymous remailers, send a message with "subscribe" in the body to > . > > > From jad at dsddhc.com Thu Oct 2 14:20:26 1997 From: jad at dsddhc.com (John Deters) Date: Fri, 3 Oct 1997 05:20:26 +0800 Subject: Secure phone In-Reply-To: <199710021621.JAA26807@proxy4.ba.best.com> Message-ID: <3.0.3.32.19971002155954.00bfc7e0@labg30> At 09:21 AM 10/2/97 -0700, you wrote: >At 11:13 PM 10/1/97 -0700, Lucky Green wrote: >> Bad idea. You don't want people to have to look up keys to use your device. >> Some people may not want to be listed in the phone book. Not to mention >> that a PKI adds an additional and unnecessary layer of complexity. Just use >> DH and have the parties each read half of a hash of the public >> exponentials. No keys to store, no keys to remember, no keys to compromise. > >Trouble is this exposes the system to the man-in-the-middle attack. Perhaps >you could take advantage of the real time nature of the system to prevent >man in the middle, by constructing a protocol such that man in the middle >will invariably time out during the connection setup, or produce an >audible lag problem in speech. The MITM attack is thwarted by Lucky's note: >> DH and have the parties each read half of a hash of the public ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >> exponentials. No keys to store, no keys to remember, no keys to compromise. ^^^^^^^^^^^^^ Each party reads off a series of digits displayed on their screen. Out loud. To each other. Over the secure phone. The MITM attacker can't duplicate the hash on both ends, because a hash of the public keys used to make the connection are different between the MITM's public key and the real public keys. Here's a secure conversation (assume for the moment that the addition below represents a strong hash): Alice <-------------------------------------> Bob PK=1234 PK=5678 1234+5678=6912 5678+1234=6912 Alice reads 69 over the phone, and Bob reads 12 back to her. Alice and Bob proceed to have a private conversation. Now, since Mallory has to create a PK, he cannot just duplicate Alice's 1234, because he'd also need the private key to decrypt the conversation. Likewise, he cannot duplicate Bob's 5678. He has to generate his own PKs in an attempt to fool Bob & Alice. Alice <-----> Mallory <-> Mallory <---------> Bob PK=1234 PK=1111 PK=2222 PK=5678 1234+1111=2345 5678+2222=7900 Alice reads "23" over the phone, and Bob reads "00" back. Since Alice's hash function said she should hear "45" back from Bob, and Bob's screen said he should have heard "79" from Alice, Alice and Bob decide to talk about the weather, and how pretty the trees are in certain cities. Mallory could try to thwart this by impersonating Bob's voice to Alice, saying "45", and Alice's voice to Bob, saying "79" (Mallory does, of course, know these numbers), but if Bob & Alice know each other, this probably won't work too well. Mallory would have to be able to cut into the conversation real-time, undetected. Now, of course, Mallory could hire Anna & Barry to pull the whole impersonation thing off, so that for the entire conversation Alice talks to Barry and Anna talks to Bob, each thinking that they're really talking to the other, but that's also fraught with risk. I'm sure they could pull it off on TV, though :-) So, it'd go full circle back to pass phrases again. "I hear the cherry trees are lovely in Washington D.C." "I wouldn't know, I've never visited Washington in the spring." "I agree, the weather is usually too wet." John -- J. Deters "Don't think of Windows programs as spaghetti code. Think of them as 'Long sticky pasta objects in OLE sauce'." +--------------------------------------------------------------------+ | NET: mailto:jad at dsddhc.com (work) mailto:jad at pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'36"N by 93^16'27"W Elev. ~=290m (work) | | For my public key, send mail with the exact subject line of: | | Subject: get pgp key | +--------------------------------------------------------------------+ From anon at anon.efga.org Thu Oct 2 14:26:00 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 3 Oct 1997 05:26:00 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" Message-ID: <306a8be32556b32fa66d425f7b89bcfd@anon.efga.org> -----BEGIN PGP SIGNED MESSAGE----- My brother VerityMonger wrote: >Fascism hadn't died, it has just gone underground and crept into >every facet of life through the corporate and government power >mongers. The government and the mass media are working the citizens >like dumb fish on a hook, who are still trying to swallow the >worm. There is a New World Order on the way, and it isn't going to be >any prettier than the last time it was tried. No doubt VerityMonger knows this, but many others may not: "New World Order" was a phrase originally coined by Josef Goebbels. Interestingly, the term "European Community" arose out of German industrial discussion groups in ~1944 who were trying to find a way to salvage the German position at the time. One idea was to make peace and attempt to establish a "European Community". Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDP5BJaWtjSmRH/5AQFnGwf9HBs0DDAjhc0PPHjnKsGQ1JRaB797fIaO Cbz+QvUs/OzClpSrPQAighJ5DlE3yNWseBxCaYDQ/dOxhpB/vnFI509FRBqgDgOp qaYqaQVdWjeirrAlWFpeMV9yjKlk09fTe3ospvenDFkNvrJedTeP73t8bCceq/Iz +I2dWn3/eCmm0+Xlblm/ljETBXCh6i4WpfnRuA0htJQQJwctPjopuxOo3vpde4JH //clHjOckrkqo/H4+D1iX7BeAJOYUnToGO4r/w1vvGEWEZG4pGfB9MNZ74P71JFs 3lmCXJ2p+D55fmhjmHrNQFfi+oFmbnt0u/yuxlI2O0Qr/obwje7oIA== =6SBY -----END PGP SIGNATURE----- From cynthb at sonetis.com Thu Oct 2 14:31:00 1997 From: cynthb at sonetis.com (Cynthia Brown) Date: Fri, 3 Oct 1997 05:31:00 +0800 Subject: "Show me an example of terrorists using the Internet or cryp In-Reply-To: <199710020617.IAA23092@ankara.duzen.com.tr> Message-ID: On Thu, 2 Oct 1997, S. M. Halloran wrote: > Painting America with a rather broad brush, aren't you? I never went > to a school--and I attended public schools for ALL of my > education--which had a metal detector. But comparing America and > Canada is pretty much apples and oranges again. Do you [in Canada] > really have our ethnic mix? Not identical, but we have large groups from various parts of the world, and we are by no means ethnically uniform. The two most numerous, of French and British Isles descent, have very different cultures; Vancouver has large communities from Asia; etc. etc. And my brush is no broader than the "all government workers are lazy, corrupt little power-trippers" mantra that appears here so often, uncontested. > America's violence problem is not one bit related to guns everywhere > in the street. There are much deeper problems, including distrust > between ethnic groups. The O.J.Simpson was a real eye-opener on > black-white relations, for example, and I think the Native Americans > have yet really to speak about the shitty way they have been treated > over the years. By the way, have Canada's European descendants come > to proper terms with its native American neighbors? Granted that the guns are a symptom and not the underlying problem. However, having them readily available makes it that much more likely that a person will do something regrettable in a fit of rage (or just plain annoyance). Our history is not squeaky clean either, but at least we're trying to settle things by negotiation and referenda instead of violence. > Now you're talking! Don't ever repent for thinking clearly. But do > keep in mind that not all people who own guns and wear red plaid > Pendletons and sport scraggly beards are the neoFascists of tomorrow. Agreed. There are also dedicated, hard-working, community-oriented policemen out there. (I'm probably going to get flamed for daring to say that, but tough.) Cynthia =============================================================== Cynthia H. Brown, P.Eng. E-mail: cynthb at iosphere.net | PGP Key: See Home Page Home Page: http://www.iosphere.net/~cynthb/ Junk mail will be ignored in the order in which it is received. Klein bottle for rent; enquire within. From nobody at REPLAY.COM Thu Oct 2 14:31:58 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 3 Oct 1997 05:31:58 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" Message-ID: <199710022114.XAA25096@basement.replay.com> -----BEGIN PGP SIGNED MESSAGE----- Alex Le Heux wrote: >>>You people just don't get it do you? A gun has one purpose: To >>>kill. Just like any other tool, a gun, if it is available _will_ be >>>used at some point. >> >>Although guns are obviously designed for killing things, this does >>not mean that they will be used. This can be seen from the >>statistics. There are far fewer murders than there are guns. >>Almost all of them are never used for killing someone. > >You can't deny that the more guns there are available, the more >people will get shot. Oh yes, I can. In fact, I believe the opposite is the case. The statistics bear this out. But, your claim was that a weapon will eventually be used to kill somebody. I guess it's clear at this point that this was wildly inaccurate. >There may be some people that are capable of owning a gun and using >it wisely (ie. not), but I don't believe that this is a significant >fraction of any population. You should come to the United States and spend some time around the shooting community. The people are real pleasant, real easy to get along with, and real careful with their weapons. >>You are also not considering the case where one person has a gun and >>another does not. The situation is more stable if both people are >>armed. (And don't claim you are talking about disarming a whole >>society. You aren't, just part of it.) > >Urgl? The situation only becomes more explosive if both sides are >armed. That can occur, but in general nobody likes to be shot. Even if you are going to shoot your opponent regardless, if he has a gun you move more cautiously. >Look at the arms race, which is now, thank god, over. I am amazed at >the amount of restraint both sides displayed during that time, >although it's been really close a few times. What would have happened if the Russians didn't develop nuclear weapons? I think they would have been nuked sooner or later, don't you? And, we aren't talking about an arms race, here. We are talking about whether citizens are allowed to own a few rifles. >It's really simple: If there are no guns, no one will get shot. You will find this difficult to achieve, however. >I _am_ talking about disarming a population. I don't know which 'it' >I'm not part of, but I am definately not part of the 'it' that >promotes death by gunshot. You are not talking about disarming the police and the military are you? Just as I thought: you only want to disarm the civilians. That's not such a great idea, judging by history. >>>So making sure there are lots of guns around only serves to make a >>>lot of people very dead. This is a Bad Thing. >> >>Depends who they are. Bet the Dutch resistance made good use of >>their weaponry, eh? > >Even if they did, dead people are still a Bad Thing. We had no >quarrel with the soldiers the resistance killed. Neither did most of >them had any quarrel with us. Just like the US troopers in Vietnam or >some other place. Are you arguing that the Dutch resistance should not have resisted? I believe they did the right thing, myself. I do not believe it was a Bad Thing. I believe it was a Good Thing. I believe they did not kill enough people. >>Be aware that the gun control lobby has often used misleading >>statistics. For instance, you will hear a lot about "handgun >>deaths". It turns out that most of these are suicides. While >>undesirable, most people perceive a difference between somebody >>killing themselves and a nutcase doing his thing at a school. > >I am not the gun control lobby,... No, but it appeared that you may have been misled by them. >I am a citizen in a mostly gun-free society, and glad of it. People >getting shot here, be it robbery, suicide, police violence or self >defence is a rare occurence. Police violence is caused by gun ownership? I doubt this very much. >Over her, drive-by shootings are something from fairy tales. Oddly enough, this is mostly true here as well. It is unclear what is magical about the words "drive by shooting." I believe this phrase lacks real content and is simply a trigger for hysteria. The implication is that people are randomly firing on people in the streets. While this may occur once in a great while, it is extremely uncommon. Usually people kill for a reason. Usually they are trying to kill their enemies. In the U.S., this is often related to the black market. Whether somebody kills their enemy from a car or not is irrelevant. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDP3UZaWtjSmRH/5AQEHIQf/RaA4NODawPxLEEI5mMGPnMG/+7ASceoL p6i2oM8c0w2Qu7yx7FfK5uC0wtRpyQFZXFaPpZ7AoMUYumAXCnnVLdksKaxMdsCP 0Dv0I1Bg5lh+Ko5XEyCHBl472MQH5P7rg6sWil3+X6D4KPEh6IhfQ/WAdczAOhGG h1pDDTHOiRYO52x4Lb5vyH58OtyzxAqoBUH2YD6ReVcdYbgUXcXD54UGTbzsPbzw 5Rlx/M5gCMXOpKoISZnsCPhZyPrw8a/kG3VPdbmJC4XbE4evohCeA+CDZzy2HTDb x3S2iUnmPEw6Cg4KhXeKfyznIXNgLWLDUu5tOpc9qtuCNrWeBc1DzA== =/9qs -----END PGP SIGNATURE----- From declan at well.com Thu Oct 2 14:51:45 1997 From: declan at well.com (Declan McCullagh) Date: Fri, 3 Oct 1997 05:51:45 +0800 Subject: Crypto-continuation in Washington: FBI/DoJ keep up the pressure Message-ID: Crypto is hot in Washington. Don't think the battle's over; it's just beginning: * This afternoon when the Senate Intelligence committee met to consider a new CIA deputy director, Sen. Bob Kerrey said "there's a real urgency" to get an encryption bill passed. (Presumably, that would be his bill, the "Key Escrow Infrastructure" McCain-Kerrey/S.909.) Anyone still think that the Senate will do the right thing on crypto? Think again... * Last week Janet Reno talked at her weekly press conference about balancing law enforcement rights with privacy rights -- through mandatory domestic key escrow. * Yesterday Louis Freeh spoke at length before the House International Relations committee about the spread of nuclear weapons... and reminded committee members about the problems the FBI has with nonescrowed crypto... * Sen. Jon "Mandatory Domestic Key Escrow" Kyl said on Sunday that the Clinton administration's export controls on crypto were *not tight enough*... More info: http://cgi.pathfinder.com/netly/opinion/0,1042,1385,00.html http://www.jya.com/declan8.htm -Declan **************** HEARING OF THE SENATE INTELLIGENCE COMMITTEE NOMINATION OF LT.-GEN. JOHN A. GORDON TO BE DEPUTY DIRECTOR OF THE CENTRAL INTELLIGENCE AGENCY CHAIRMAN: SENATOR RICHARD SHELBY (R-AL) 106 DIRKSEN SENATE OFFICE BUILDING WASHINGTON, DC 2:00 P.M. EDT WEDNESDAY, OCTOBER 1, 1997 SEN. KERREY: I hope no doubt that you've heard of and perhaps had the opportunity to read the recommendations made by Senators Helms and Moynihan, but I think they're excellent. It's an excellent examination of, first, the need in some instances to classify, as well as the need to examine that classification system. It's not really a question, General Gordon. I think it's imperative that, on the issue of encryption, that the president exert some authority and try to pull together the congressional leaders and say, "We need a secure public network." There's counter-intelligence concerns. There's national security issues here at stake, obviously, balanced against the concerns for civil liberties and the concern for commercial interests and the need to develop. But there's lots of action up here on the Hill, both in the House and the Senate, in half a dozen committees or eight or nine committees, or Lord knows how many altogether, more than I realized existed. And I think there's a real urgency to get something passed both for the private sector, so they can have some stability, but also on the public-sector side, so we can protect the nation's interests. MR. GORDON: Senator, I have not delved that deeply into the encryption issue. I certainly take your point on this point. But I do know that if the Senate does confirm me that that will be squarely on my plate. **************** ATTORNEY GENERAL JANET RENO'S WEEKLY MEDIA AVAILABILITY U.S. DEPARTMENT OF JUSTICE WASHINGTON, DC THURSDAY, SEPTEMBER 26, 1997 Q No, wait - ATTY GEN. RENO: You've got to be quicker than that. Q (Inaudible) - yes, ma'am. Director Freeh and Director Constantine both have complained that U.S.-made encryption devices are giving the drug cartels an advantage whereby interdiction becomes impaired. Would you favor, as Mr. Freeh does, some kind of giving of the keys to these devices to the FBI and DEA? ATTY GEN. RENO: I don't think that Director Freeh favors giving keys to the FBI and to the DEA. Q No? ATTY GEN. RENO: What Director Freeh has talked about is what we have today - if someone is going to tap a phone, they don't just go in and tap the phone, if they're going to do it legally. What law enforcement does is it develops probable cause to believe that the telephone is being used to commit a crime and that to overhear would provide evidence of a crime. That is submitted to a judge, both in federal court and in many states courts where wiretapping is authorized. The judge reviews the sufficiency of the affidavits in support of the petition and enters an order directing the telephone company to provide that opportunity. What Director Freeh is hoping to achieve is the same thing with respect to encrypted products; so that the court would direct that the key be provided to the telecommunications system, or the other system, in order to decrypt the encoded message. What we're trying - what the administration is trying to do is to recognize that there are two important interests at stake here. One is the law enforcement interest, which is so vital with respect to terrorists, with respect to being able to decrypt the drug dealer's computer when I - I can get a search warrant now and seize his black book and I can read his black book or decipher what he's talking about. But if he can encrypt the information on his computer, that will be a significant obstacle to law enforcement. At the same time, the whole purpose of encryption with modern telecommunication is to provide for the privacy interest, of commercial interest of the average citizen. And so I think it's important that we work together to ensure the law enforcement capacity and ensure that the present capacity to get court-ordered authorities for surveillance are continued and are made real, while at the same time ensuring privacy. Q So you're saying that the phone company would have the responsibility? Do they have the capability of encrypting? ATTY GEN. RENO: The phone company doesn't have it. There would be a system whereby a key would be provided through third parties or otherwise. But this is something that we need to work together on to ensure that law enforcement interests are protected and that privacy interests are protected as well. **************** HEARING OF THE HOUSE INTERNATIONAL RELATIONS COMMITTEE SUBJECT: ORGANIZED CRIME CHAIRED BY: REPRESENTATIVE BEN GILMAN (R-NY) LOUIS FREEH, DIRECTOR, FEDERAL BUREAU OF INVESTIGATION 2172 RAYBURN HOUSE OFFICE BUILDING WEDNESDAY, OCTOBER 1, 1997 10:00 A.M EDT REP. : Following up on what Mr. Hyde said on your need to fight international crime and terrorism, what do you need, as an agency director and for your agency, in terms of specifics to wage a fight that you can win? MR. FREEH: Yes, sir. As I mentioned in my statement, I think we need it on three levels. We need the permanent and minimal FBI presence overseas to develop the kinds of relationships that Dr. de Gennaro and I have had now for 18 years. We have asked for, and the Congress approved last year, in August of 1996, a plan to expand the FBI's Ligat (sp) program from approximately 23 to 43 Ligats. That would call for, by the end of 1999, 146 special agents in 42 different countries with 116 support employees. That's a total of 262 people. As I mentioned, the plan was submitted last year. It wasn't just an FBI plan. It was jointly submitted by the State Department and the attorney general. And we've asked for funding in the 1998 and 1999 budgets to reach that level. We've also asked for a continuation of the training. As I mentioned, we've been able to train thousands of police officers around the world. The benefit of that training is two-fold. First of all, we can give them what they need most of all, which are the basic tools to conduct their own investigations. Just as importantly, we develop through those relationships, as Dr. de Gennaro described it, the cop-to-cop contacts and relationships. So an FBI agent or a DEA agent can pick up the phone and speak to a police commander in Uzbekistan or Kazakhstan, if that's the place where we need to do our work. So the training is a very important part of the whole program. And again, and finally, we need the technological tools to do our work. We have to be able to communicate rapidly and securely. We have to deal with encryption. We have to deal with cyber-crime. And those are all part of a larger technological challenge which we're trying to meet. [...] REP. LINDSEY GRAHAM (R-SC): Thank you, John. Director Freeh, appreciate your testimony. It's been quite riveting, actually. One of the briefing papers we have indicates that the American public, in a recent poll, whatever you want to take polls worth, say that 70 percent of the American people who were surveyed found it likely that the United States could be attacked by terrorist groups within the next decade using smuggled nuclear devices. If you were asked that, what category would you be in? MR. FREEH: I think it's a threat and a possibility that should occupy our highest priority. I think we've seen attacks certainly in Oklahoma, in New York City. We know that many of the state sponsors of terror, including Iran, are rapidly and very aggressively acquiring nuclear technology, both in terms of warheads and launching devices. We know that many of the state sponsors of terrorism, particularly Iran, sponsor and fund and control Hezbollah groups, including groups which have connections and operations in the United States. So the links, although I don't think I've seen them in a documented form, clearly suggest that if a terrorist is willing to use a truck bomb to blow up a building with thousands of people at risk, the accomplishment of the particular objective would not be changed or influenced by the opportunity to use a much more devastating (nuclear?) or biological or chemical agent. So I think we have to take the possibility extremely seriously and we have to take drastic steps to try to prevent and detect that. **************** [This thanks to John Young. --Declan] Remarks by Senator Jon Kyl at the First International Conservative Congress--September 28, 1997 [...] The Clinton Administration pursues a foreign policy without clear goals or the will to act decisively and is squandering the national security means left to it by a dozen years of Republican presidency. It emphasizes hope over reality and reliance on arms control agreements like the Comprehensive Test Ban Treaty (CTBT), the Anti-Ballistic Missile (ABM) Treaty, and the Chemical Weapons Convention (CWC) over a stronger defense. And political benefit over national security, as in its decisions to cave in to the concerns of some in industry in irresponsibly relaxing export controls on key items like encryption technology and supercomputers. **************** ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ From brianbr at together.net Thu Oct 2 15:02:48 1997 From: brianbr at together.net (Brian B. Riley) Date: Fri, 3 Oct 1997 06:02:48 +0800 Subject: Forwarded mail... Message-ID: <199710022139.RAA31541@mx02.together.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/2/97 11:36 AM, Mark Rogaski (wendigo at ne-wendigo.jabberwock.org) passed this wisdom: >An entity claiming to be Brian B. Riley wrote: > >:: ... nothing personal, but why is it people keep deluding >themselves : with the idea that they can shoot to wound. You cannot >know what a > >Because that's what all the cops on TV do. Most people see >non-lethal leg shots on TV all the time, so they assume that it's >probable. Even worse was "The A-Team" where hundreds of rounds were >fired, but no one ever got hurt. It was intended to reduce the >amount of violence on TV, but (in my opinion) only made gunplay >seem like a safe recreational activity. ... oh, I well know the answer to the question ... just waxing a little bit rhetorical ... I would seriously like to be there to look into they eyes of the yahoos who so bithely espouse dropping the hammer on a person right after they have watched the life drain from someones eyes the for very first time and see just how well they feel and how cocky and cavalier they still are. I wouldn't wish that burden on anyone. You just can have no idea unless you have been there. We send men off to war and then get all upset when so many come back with there brains on crooked ... the sheeple have no idea what they have done to these men (and now women) !!! -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDQS3sdZgC62U/gIEQLMfACdEDkNNtzbeccxGJGcuvuUkp810IoAoJZV 0HbGxZ0ogu2gzzGNIYhilxM+ =8vrU -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For my PGP Keys "...error reading WinOS. (A)bort, (R)etry, (M)acintosh?" From anon at anon.efga.org Thu Oct 2 15:15:31 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 3 Oct 1997 06:15:31 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" Message-ID: <49688cba207d1bb86d63bc14117aab4e@anon.efga.org> -----BEGIN PGP SIGNED MESSAGE----- Alex Le Heux wrote: >On 2 Oct 1997 00:24:27 +0200, Anonymous (sic) wrote: >>Alex Le Heux wrote: >>>Maybe you haven't noticed, but seen on 2000 year scales, the entire >>>world is constantly in a state of war. Europe isn't special in that >>>regard. >> >>I guess the conclusion, then, is that gun control is bad for the >>whole world, not just Europe. > >Eh, no. The conclusion would be that gun control or no gun control >does not affect the amount of war in the world at all. It certainly affect civilians! Most of the people who die in wars are not in armies. They are in villages, towns, and cities. Roughly 50 million people died in World War II. Perhaps 15 million (numbers approximate) were soldiers. Being unarmed is often unlucky. >>>And even if I had my AR15 then, it wouldn't help me a lot against >>>guided missiles and mortar fire. >> >>It's harder to police a hostile population which is well armed. > >True, but imho this will only result in more people getting killed. It can result in that, certainly. But somehow the next time your country is overrun, I doubt you would take your weapons (assuming you had any) and give them to the invader in the hope that this will increase the likelihood of your survival. >Any invader would not beat about the bush in the US, they'll make >very clear that they'll have nothing to do with citicens defending >their own homes. They'll just blow up the home from a distance. Ah, if they know which home to blow up they will. But they won't. (Unless they get their hands on the government gun registration records. Then they'll know which homes to go to.) >>>And anyway, "to defend yourself in a war" is not one of the usual >>>arguments against gun control. >> >>The popularity of an argument can be independent of its worth. >> >>"To defend yourself in general" is commonly used. War, oppressive >>government, and political turbulence are the most likely situations >>in which people need their weapons, even in the United States. > >Bullshit. People in the US rarely use their weapons against oppressive >governments or political turbulence. Sometimes we do. Study the Black Panthers. You raise a good point, though. I believe that widespread gun ownership acts as a dampener on conflict. People discover that they really can respect Group X enough to cut some kind of deal rather than herding them into concentration camps. The dynamic here is probably complicated. It isn't as simple as "Oh, we don't want to go after them, they have guns!" That underlies the process, but usually it translates into respect. (Look at how people feel about a "Mafia Don" versus "some greaseball working in a restaurant". Most people despise the man in the restaurant, even though when presented in neutral terms they claim to respect his behavior. What's the difference between these two people? It isn't that one is the nicer guy.) Should things progress to the point where armed troops are attempting to haul people out of their homes, the availability of firearms acts to drawn attention to what is happening. The people committing the acts are getting very strong signals that Something Is Wrong. The cost of collecting people increases dramatically when they are armed. In Berlin the assembly area for Jewish people was originally somewhere in the center of the city where other civilians could see what was going on. This caused discomfort and a certain amount of unrest amongst the population, so they moved the assembly area to the outskirts. But, there would be no denying the implications of automatic weapons fire all over the city. Would this guarantee survival? No, it would not. But, in my opinion, it would increase the odds. You can imagine it going wrong: "We won't be safe until we get rid of all those Jews and they damned assault rifles!" But, probably it would go the right way. >Most guns that are used against another person there are used to >commit crime or to defend against those armed criminals. - From day to day this may be true. But we are talking about those exceptional circumstances that arise every few decades, especially in countries where the peasants are not allowed to own weapons. And, you might want to take a look at the numbers. How many people have been murdered outright by their own governments in the 20th century? (This number excludes wars, which probably isn't reasonable.) It clocks in at well over 100 million. (Anybody have the actual number?) It takes a lot of bar shootings to get up to those kinds of numbers. >>I have to confess that I am surprised at the level of resentment >>among the members of various Europeans countries feel towards other >>European countries. For example, the Germans don't like the Dutch >>because when they visit they are treated badly by, among others, the >>police. The Dutch don't like the Germans because, well, they got to >>know them a little too well in the 1940s and they are nursing the >>grudge. >> >>With that sort of situation, anything can happen and it can happen >>quickly, even if things seem mellow right now. And these little >>resentments and jealousies are felt between far more groups in >>Europe than just between the Dutchies and the Germans. > >Excuse me? Have you ever even been in Europe? In the last 50 years I >mean? You are so full of shit here, it's incredible. I hereby invite >you to come over, and stay a while. I have a comfy couch. Thank you for your kind offer. If things go to hell here in the U.S. in the next couple of years I may take you up on it. Yes, I have been in Europe. I drew my conclusions from talking to and observing many Europeans. It wasn't what I expected, but it caused me to understand European history a little better. In the U.S., even when we are ragging on another ethnic group or another country, there is always this feeling in the air that is sort of naughty and low class to be doing it. In Europe, I did not sense this at all. (That's not all bad. It's not hypocritical.) People had all sorts of interesting views about people in other countries. I was particularly shocked by European anti-semitism. You can find people in the U.S. who will talk about "those New York Jew bankers" and the like, but I hadn't really seen hardcore anti-semitism before. By hardcore, I mean people who see all Jewish people as belonging to the same nationality, regardless of their passport. And, they don't think of this as a particularly remarkable thing. They see it as just one of those obvious facts that it would be foolish to deny. Jewish friends who travel in Europe have had repeated experiences where people want to treat them as Jews, rather than as Americans of the Jewish religion, which is what they are. >Anyone in Europe can go anywhere else, and be treated reasonably to >very well. We in Europe have put the crap of WWII behind us a long >time ago. Something that you haven't managed to do apparently. > >The Dutch are absolutely not 'nursing a grudge'. Come and visit. >You'll see. I did see. It was most interesting. I had a long conversation with a Dutch man once. He was very pleasant, civilized, and intelligent. Then he started telling me about the Germans and how pushy they were, how they always butt in line, etc. etc. I've heard similar things from other Dutch people. I personally witnessed a (very minor) incident. I have some German friends who were foully treated by the police in the Netherlands, too. These people are decent, polite, professional people. I have no doubt they did nothing whatsoever to provoke this treatment. (By "no doubt" I mean that we are talking about the most civilized people I have ever known.) But, they will never return to the Netherlands and I don't blame them. You might want to try a little experiment. Are you capable of appearing to be German? If you can get the style and the body language down, try coming into the Netherlands as a German visitor and see what kinds of response you get. If you can really fool people into thinking you are German you will probably learn something interesting about your country. (It might be hard to pull this off, though.) >>Let's also take a look at the Dutch performance during their >>occupation. While there certainly were many courageous Dutch people >>who helped refugees (at great personal risk, to say the least), and >>there were many courageous Dutch people who were in the resistance, >>there were also many Dutch people who did not perform so well. Not >>only were a large number of Jewish people turned in by Dutch >>informers, but there were even Dutch SS units. > >You have a nerve. You, coming from a country where people are still >regularly killed in the name of racism, tell me this?! Now, now, now. Don't get all excited. I said it was nice country, didn't I? I said some bad things about my own country, didn't I? The fact is, I think if you randomly selected people from the Netherlands, in general you would do pretty well. However, let's not deny what happened historically. Even nice appearing people do bad things. And they aren't always Nazis, either. As for racism, Europe is not without racism. It's hard to quantify it and hard to compare, but I suspect to a very great extent, America is seen as being racist because we discuss it, feel guilty about it, and try (sort of) to do something about it. (Never mind all of the ethnic groups in the U.S. that find they are able to live together harmoniously, even though their ancestors in Europe were continuously at each other's throats.) I've had two American friends who were beaten in Europe in racial incidents. One was white, one was black. One of them spent time in the hospital. Both crossed the racial line all the time in the U.S. without incident. >>I basically think well of the Netherlands and its people, but it is >>important to recognize that certain unpleasant characteristics exist >>in a large portion of the population of even a nice country. It is >>unlucky to pretend that these characteristics can never be expressed. > >We absolutely not pretending that this can never be expressed. In >fact, it's being expressed every day. We have our neo-nazi political >parties too. It's just that we here have learned our lesson, and very >few people actually listen to them. This may be true, but it's hard to tell. The climate is not conducive right now, either. What would happen if it suddenly became clear that anti-semitism would promote one's career? I think you would find them coming out of the woodwork again. >>What would have happened if the citizens of El Salvador were >>adequately armed? One thing you wouldn't see is a death squad going >>into a neighborhood to kick down some innocent's door and murder him >>or his family. At least, you wouldn't see it twice. > >Sure you would. It just would be that more bloody. The fact that >someone is armed has never stopped anyone from attacking. You just >make sure that your shot is the first and hits. What are people in death squads like? Believe it or not, they are not so different from ourselves. They also have fears. People do, in fact, act on their fear from time to time. If you think that while you are busy "shooting first" at some guy that maybe his neighbors won't mind blowing your head off for it, you are going to behave more cautiously. At the very least, it will cut down your nightly "take" by at least 70%. That's a big deal if you are part of the surviving group. >>People who are well armed are less likely to become pawns, victims, >>or slaves. That is desirable. > >They are just more likely to become dead. If you were faced with somebody you believed would enslave you, would you throw away your weapon in the hopes your life would be spared? I doubt this very much. >>Incidentally, the consistent support the U.S. government has shown >>for murderous or even genocidal governments is of great concern to >>those of us who live in the U.S. It is unlikely that these tactics >>won't be used here were there a serious political struggle and a >>disarmed population. > >- From over here it appears that the majority of Americans doesn't >really give a shit. Correct me if I'm wrong. It was hypothetical. I don't know if such a serious political struggle will arise in the near future. If most Americans don't give a damn, it will be very unlucky for troublemakers like the cypherpunks. In fact, though, most Americans do give a damn. Look at the great effort the government has to go through to get Americans into wars. It is a source of endless frustration to the elite that the population won't just hop into wars. Wilson and Roosevelt were both elected on peace platforms before getting us into the World Wars. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDPwxpaWtjSmRH/5AQHswAf/WD4jWejWmUX4GAaEkWcJW5uhnEXjiLap G2lhu5E4/htFDe791IK6iZ1Pn9i7y8FnyzQMKwoA4sFlgFl4ZAZWCGktnLPBryOY Mqk2ckQGdYEa87vsFVSPZsVCJ51vJadqeAE/dZgWSbB+Vhck+2AcNypw5gCFHT3F N92K+KGvw/bKMS4oucomNaD1kpEsGcCBL95zcv/ZbgMKCz9LkdgHoS/GyzdssNCj BCZWhnUci5gFM1Pa1AAM7HNwkohFMfEsX1dpKr56NbziT1QwUXLHUzW8Qxf+OB2h 6p+xLwcWzFNzpyN6CzJHbxaB0S9PVIuy9zMDz3xMynaAy3S+2zmVaw== =tIFo -----END PGP SIGNATURE----- From anon at anon.efga.org Thu Oct 2 15:39:08 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 3 Oct 1997 06:39:08 +0800 Subject: Stronghold Message-ID: <7e7cbf50cd157c6bdeb66f4d1f93136a@anon.efga.org> >> C2Net was wrong to censor the cypherpunks list in the guise of >> moderation. It was wrong to send threatening letters to people who >> claimed its products were weak. The whole moderation/censorship >> experiment was a terrible mistake. The actions taken by C2Net were >> completely unjustified. > >Where do people get these bizarre ideas? C2 didn't censor the list. A >guy who happened to work for C2 dropped some messages from one >list. The messages still went out on the unfiltered list. Had he >worked for Mc Donald's or the the NYC Sanitiation Department, would >you blame them for this as well? C2 employees informally mentioned libel suits to several cypherpunks, such as Tim May. Given that a good percentage of the company, perhaps a majority, was involved with this incident, it seems reasonable to judge the character of the company based on these actions. This incident changed my view of C2 considerably. Initially I held them in the highest regard. No longer. (Your employment by C2 should have been mentioned in your post. Many people on the list may not know about it. It is relevant.) From brianbr at together.net Thu Oct 2 16:07:42 1997 From: brianbr at together.net (Brian B. Riley) Date: Fri, 3 Oct 1997 07:07:42 +0800 Subject: Forwarded mail... (fwd) Message-ID: <199710022252.SAA29198@mx01.together.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/2/97 2:35 AM, Jim Choate (ravage at ssz.com) passed this wisdom: >Remember: A gun is like a finger, just point it at what you want to >hit. > >I have met hundreds of great shots in my life, there are many >people forwhom this sort of behaviour would not be delusional. My >grandfather (who you'll hear more about in a minute) used to >delight us as small kids by lighting matches stuck in wood fence >posts with a .22 pistol from about 50 yds. My cousin from Louisiana >likes to shoot squirrels (if you can callit that) by passing the >bullet just in front of their nose, causes lung hemorraghes and >they just fall off the limb. Me, I always miss or blow theirteeny >little head off, it's apparently a game of 1/4 inches. I work with >anex-gomer (ie USMC) pilot who is quite phenomenal with his .357 >Desert Eagle,his groupings are just about an inch at 25 yds. None of these targets shoots back ... none of these targets pump up much adrenaline. I would never call myself a great shot (I did qualify expert at both rifle, M-14, "A" course and pistol, .45, 1911A1), and I can tell you of making several 25-35 yard snap shots in the jungle at moving shooting targets with the adrenaline driving my eyeballs through the roof ... but they were exactly that, pure reflex, center of body mass shots, under max pressure. I must in all fairness recall the other three to six shots each time that could have gone anywhere and probably did. The point is, "shooting to wound" is a dangerous delusion! *no one* can predict what a bullet will do when it enters the body. The rule I have always followed is don't take out your gun unless you are going to use it; don't use it unless you intend to kill. Makes decisions much easier on that basis. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDQjysdZgC62U/gIEQL2pwCfYadqKN/3+wKF1BYC7MZxp8y3ud0An1L4 yXD3o+rsefpV8FO8MqD6OEtl =GHfD -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys "The Box said Win '95 or better - So I used a Macintosh!" -- Harold Herbert Tessman From ant at notatla.demon.co.uk Thu Oct 2 16:27:50 1997 From: ant at notatla.demon.co.uk (Antonomasia) Date: Fri, 3 Oct 1997 07:27:50 +0800 Subject: Quor's cipher Message-ID: <199710022135.WAA02655@notatla.demon.co.uk> Antonomasia wrote: > My attack takes a long chunk of known text and looks for repetition. > > ppppppppppppppp.11.pppppppppppppppppppppp > ccccccccccccccc.22.cccccccccccccccccccccc > > When a two neighbouring p-c pairs are the same you can test > whether they have the same value of a and b. > (That is a_n == a_n+1 and b_n == b+n+1, a != b usually.) > > This involves 16 inputs to each byte - very cheap. > What I really want next is to know "a". nobody at REPLAY.COM wrote: > Wouldn't this only happen (on average) in one out of every 65536 p-c > pairs? Yes (counting only those we test). > Since the state array is changed entirely with every 128 bytes > encrypted, 1 out of 2^16 doesn't seem to help much. This finding doesn't uncover a great deal, I agree, and what it does uncover is transient. 1 out of 2^16 is the number of pairs we test to find a point with the property we're looking for. The measures to compare this to are: message length several times 65k is fairly low cost of testing low benefit of test when passed also low :-( The changes are regular though, progressing through the array in two places. That's why I proposed testing neighbouring p-c pairs because you can be almost sure the relevant state (and it's which part of the state array is relevant that's uncertain) is the same for the two. In fact it would be nice to spot this: ppppppppppppppp.11.ppppppppppppppppppppp ccccccccccccccc.22.ccccccccccccccccccccc and see that a and b were the same, but the underlying state array changed in a relevant way. This would be indicated by a slightly less than total match, but still rare enough not to be a fluke. This could allow you to test possible values of a and b, and perhaps get 4 bits of a. But a and b don't persist over nearby bytes so I'm not clear what I'd do if I got them. What it would be nice to have next is a more damaging result emerge from this or some other observation so that we could determine more of the state without going to long range comparisons. This cypher is constructed differently from RC4 or fish - not as simple as WAKE but broadly comparable to Sapphire II. I think I'll enlist the help of a search engine. It's more than likely there other things waiting to be done to this. Quor's friend 'nobody' has actually put some crypto on the list -let's see what we can do with/to it. -- ############################################################## # Antonomasia ant at notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # ############################################################## From rah at shipwright.com Thu Oct 2 16:31:22 1997 From: rah at shipwright.com (Robert Hettinga) Date: Fri, 3 Oct 1997 07:31:22 +0800 Subject: Hansa.net's LOCI encourages development of e-commerce financial products and services Message-ID: --- begin forwarded text X-Authentication-Warning: fma66.fma.com: majordomo set sender to owner-espam at lists.espace.net using -f X-Orig-From: "Bell, Lynwood" X-e$pam-source: Various X-Sender: rah at pop.sneaker.net Mime-Version: 1.0 Date: Thu, 2 Oct 1997 13:44:21 -0400 To: espam at intertrader.com From: Robert Hettinga Subject: Hansa.net's LOCI encourages development of e-commerce financial products and services Sender: owner-espam at lists.espace.net Precedence: bulk Reply-To: e$@thumper.vmeng.com --------------------------------------------------------------------- This mail is brought to you by the e$pam mailing list --------------------------------------------------------------------- From: "Bell, Lynwood" Reply-To: hansa at ibm.net Organization: The Span-Hansa Group MIME-Version: 1.0 To: "Hettinga, Robert" CC: "Cate, Vince" Subject: Hansa.net's LOCI encourages development of e-commerce financial products and services Bob, I just announced this today for our public company. It might be appropriate to send it to either or both of your e$lab and FC98 mailing lists. I am not going to be able to accommodate hundreds of ventures but, given that some will have their own resources, money, etc. and only want the venue and the Bank to play with... it may be very interesting for all of us. Add this to the pot in whatever way you feel is appropriate. Cheers, Lyn ------------- Hansa.net Global Commerce, Inc. The Hansa Bank Bldg, Box 213, Landsome Road, The Valley, Anguilla, B.W.I., TV1 02P Phone (264) 497-3800, Fax 497-3801, email hansa at ibm.net PRESS RELEASE FOR IMMEDIATE RELEASE Hansa.net and Hansa Bank join forces to encourage the development of e-commerce financial products and services to further expand Hansa.net's offerings of Location Optimized Commerce on the Internet (LOCI ). October 1, 1997 - Hansa.net Global Commerce, Inc. together with Hansa Bank & Trust Company Limited, both of Anguilla, British West Indies, and both members of the Span-Hansa Group, have agreed to jointly sponsor emerging Internet technologies which will enhance e-commerce through specifically tailored banking and financial applications. Lynwood S. Bell, Chairman of Hansa Bank, the controlling shareholder of Hansa.net a publicly traded company, said "Many excellent start-up companies lack a vehicle through which to perfect their product or service and to test their market acceptance. Most traditional domestic banks, encumbered with vast legacy systems and bureaucracies are reluctant to entertain these developers in live trials. The Hansa Bank, a British regulated private merchant and investment bank offering a full range of banking and brokerage services, has agreed to provide platforms for approved developers and to participate actively with them. All applications will be thoroughly screened, carefully controlled in their development and testing phases and will be completely isolated from the Bank's existing business. The Bank expects that some of these products may eventually result in leading edge products and services for the Bank." Hansa.net's role will be to assist in marketing any developed products to other banks and financial institutions. As well Hansa.net's existing LOCI clients are expected to benefit from the Bank's new or enhanced services. The first project, currently undergoing final review prior to being accepted by the Bank for testing, involves a Dutch developer of digital chequing. Plans are to demonstrate the product at the Financial Cryptograph 98 Conference, February 23-26, 1998 (see http:www.fc98.ai). Hansa Bank is one of the sponsors of this conference. Vince Cate, an Internet and cryptography expert recently featured in Forbes and Wired Magazines is participating with Hansa.net and Hansa Bank on this project. He said, "Many brilliant e-commerce ideas and products never reach the market because they have no incubator or no real life environment in which to test. Hansa.net and Hansa Bank provide both. As well, Anguilla is the perfect venue for such development in terms of sample size, global perspective, government support, and of course, the absence of any taxes. We fully expect that many of the products developed will end up in companies which are incorporated and reside here in Anguilla." About Hansa.net and the related Span-Hansa Group Hansa.net was founded in 1978 for computer systems development and software design. In 1985 the company went public, and subsequently expanded into software product development, marketing, and international trade technology. Hansa.net's primary role is to coordinate all of the elements of Location Optimized Commerce on the Internet (LOCI pronounced "low-see") for its clients. Hansa.net trades on the Vancouver Stock Exchange under the symbol "HAN" Both companies are part of the Span-Hansa Group comprised of ten organizations doing business in as many international locations. The Group's activities also include the financing of intellectual property, public stock offerings, acquisitions and mergers, and consulting on international business structures and trade. The Group maintains offices in Amsterdam, Barbados, and Anguilla, More information on the Span-Hansa Group and on other Span-Hansa strategic partners can be found on the Company's Internet home page: http://www.hansa.net. Lynwood S. Bell President Contact: Hansa.net - Lynwood Bell Vince Cate (264) 497-3800 hansa at ibm.net (264) 497-3255 vince at offshore.com.ai The Vancouver Stock Exchange has neither approved nor disapproved of this release. ====================================================================== LYNWOOD BELL - Span-Hansa Group, Hansa.net Global Commerce, Hansa Bank http://www.hansa.net ====================================================================== --------------------------------------------------------------------- Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info at hyperion.co.uk --------------------------------------------------------------------- Like e$? Help pay for it! See Or, for e$/e$pam sponsorship, --------------------------------------------------------------------- --- end forwarded text ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ From anon at anon.efga.org Thu Oct 2 18:16:52 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 3 Oct 1997 09:16:52 +0800 Subject: Stronghold Message-ID: <8cd59c62a1a9f29e5e18bebd3faa1b3f@anon.efga.org> Lucky Green writes: > On Thu, 2 Oct 1997, Anonymous wrote: > > > > > C2Net was wrong to censor the cypherpunks list in the guise of moderation. > > It was wrong to send threatening letters to people who claimed its > > products were weak. The whole moderation/censorship experiment was a > > terrible mistake. The actions taken by C2Net were completely unjustified. > > Where do people get these bizarre ideas? C2 didn't censor the list. A guy > who happened to work for C2 dropped some messages from one list. The > messages still went out on the unfiltered list. Had he worked for Mc > Donald's or the the NYC Sanitiation Department, would you blame them for > this as well? Are you serious? The messages dropped were those which made (spurious) claims of weaknesses in C2 products. And later messages were dropped which attempted to discuss the dropping of earlier messages. The effect was that subscribers to the filtered list not only were not exposed to the messages critical of C2, they were prevented from knowing that a controversy existed about the filtering policies. There can be little doubt of the truth of these facts. One of us is remembering things wrongly. And yes, if the moderator were a McDonalds employee and he not only dropped messages which criticized McDonalds, but also filtered out later messages complaining about his actions, then I'd jolly well blame him. From blancw at cnw.com Thu Oct 2 18:34:37 1997 From: blancw at cnw.com (Blanc) Date: Fri, 3 Oct 1997 09:34:37 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" Message-ID: <3.0.32.19971002182138.006b0274@cnw.com> Individuals need ways to defend themselves from the physical aggression of others. One of the reasons why people associate into societies, cities, and governments, is for the advantages of protection which can be achieved by large numbers of people acting in concert against their common enemy. They also insitute police forces and national defense agencies for the same reason: defense against physical aggression. Everyone on the planet has enemies, and anyone can become, or behave essentially as, an enemy - even someone's physically stronger kid brother who decides to hit them with a stone because of talking on the phone too long, even a former lover/husband who decides to kill their girlfriend/wife out of jealousy. Stalkers, thieves, rapists, drug addicts, perverts, etc., or just real animals from the animal kingdom, strike at the most inopportune times, when there are no officially sanctioned police forces around to be of help. But even if there were security guards constantly available at every street corner or planted inside one's house, the principle is the same: people are physially vulnerable and need defense from those who would take advantage of them, who would by weaken them and do physical harm. Guns are imperfect tools and humans are often imperfect fools in the use of them. Se la vie. Nevertheless, until the design of guns is improved, or until there is a better weapon, a better tool invented which can be used by individuals - independently of organized defense agencies - for their own use in regard of their own safety, guns will be manufactured, sold, and bought. And used. Killing people is a Bad Thing, but there exist people who don't prevent themselves from doing harmful, destructive things to others. At that particular point in time, when they are about to commit their crime against another, their potential victims are in the position of having to do something of practical use, and quickly. They could use karate, or ju-jitsu, or ninja stars, or call their dog to attack, or yell for help, or use their special pocket knife, or run, or use a gun. But they must do *something*, they must employ some means to prevent from being harmed, or from having their valuables taken, or else suffer the consequences of debility or death. Such is the position which an "out-of-control" person can put one in. It is possible to reason that such uncontrolled people need to have been raised better, could have received psychological assistance, should have been given an alternative view of life, might have been presented with better values and philosophies, etc. But you have to also consider how much intellectual support any individual must be provided - must they be programmed from birth with the proper structure of behavior, in order to have around oneself the convenience of living with "good people" who are not inimical to the society? (and would that be a society of real humans, of interest to other real humans) Is what a person makes of themselves ultimately a personal project, or is it to be pre-determined and continuously managed by others (parents, teachers, guidance counselors, psychologists, government clerks, policing agencies, government agencies, government leaders). When you relate to a person, will you be relating to someone with their own identity and personal ambitions, who make independent decisions about the actions they take, or only to a product of other people's influence? In any case, when someone behaves counter to your own wishes and seeks do with you what they will, or to take from you what they will, including your life, you must determine whether to allow it or how to prevent it - and if moved to prevent it, what will work to accomplish that. It might be necessary to kill that Bad Person (though not their whole family or relatives or neighborhood or race or country). .. Blanc From ravage at ssz.com Thu Oct 2 18:39:29 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 09:39:29 +0800 Subject: Forwarded mail... (fwd) Message-ID: <199710030143.UAA28689@einstein.ssz.com> Forwarded message: > Subject: Re: Forwarded mail... (fwd) > Date: Thu, 2 Oct 97 18:52:18 -0400 > From: "Brian B. Riley" > None of these targets shoots back ... none of these targets pump up > much adrenaline. I have been shot at several times, some were hunting accidents and some were intentional. I did not freek out nor did my adrenalin rush impede my ability to think or to react. I did shoot back in each case. I am still alive and don't have a single bullet hole in my body so I must be doing something right. Don't know about them, I left the area in every case ASAP. > can tell you of making several 25-35 yard snap shots in the jungle at > moving shooting targets with the adrenaline driving my eyeballs > through the roof My house at 1am is not comparable to the jungle nor is the psychological situation comparable either. I am not confused about where or what is going on nor am I worried about making my tour. I am faced with the clear situation of somebody who wants to do me bodily harm. That doesn't scare me, it pisses me off to no end. When I get a rush I don't shake and such, I get very calm and methodical. It's only after the crisis has passed that I tend to sit down and shake like hell. > The point is, "shooting to wound" is a dangerous delusion! No shit. Let me make this clear. The ONLY way I would even consider shooting to wound was if the burglar was CLEARLY UNARMED, and the only reason that would happen was because in Texas shooting unarmed persons, even burglars, is illegal other than that you'd be dead. In any other situation my intent is to kill, kill, kill. As I said before, I would start with a center chest body shot and work up (which is natural since the aim point for successive shots will rise). > have always followed is don't take out your gun unless you are going > to use it; don't use it unless you intend to kill. Makes decisions > much easier on that basis. We agree on this point. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Thu Oct 2 18:50:54 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 09:50:54 +0800 Subject: "Show me an example of terrorists using the Internet or (fwd) Message-ID: <199710030155.UAA28754@einstein.ssz.com> Forwarded message: > Date: Thu, 02 Oct 1997 18:22:26 -0700 > From: Blanc > Subject: Re: "Show me an example of terrorists using the Internet or > crypto" > Stalkers, thieves, rapists, drug addicts, perverts, etc., or just real > animals from the animal kingdom, strike at the most inopportune times, when > there are no officially sanctioned police forces around to be of help. I have to object to the inclusion of drug addicts, they do what they do because the legislators and police want to stick their noses in other peoples business. If drug addicts resort to crime then society as a whole must garner some of the responsibility of putting them in that situation. In short the methods we use to control drug use in this country promote crime. This does not apply to others who would do this anyway and happen to take drugs, which means the drug laws are clearly unreasonable. > something of practical use, and quickly. They could use karate, or > ju-jitsu, or ninja stars, or call their dog to attack, or yell for help, or Isn't killing dogs a bad thing? I am shure my dog thinks so. Perhaps their is a lesson to be had in comparative psychology here. It's much easier to ask another entity to die for you because you consider them different and therefore of less value in the grand scheme of things. Human history is full of such instances. This also happens to be the rationale a lot if not all burglars use to justify their actions as well. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Thu Oct 2 19:16:57 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 10:16:57 +0800 Subject: None (fwd) Message-ID: <199710030225.VAA28934@einstein.ssz.com> Forwarded message: > Date: Thu, 2 Oct 1997 22:04:09 +0200 (MET DST) > Subject: Re: Remailers and ecash (fwd) > From: nobody at REPLAY.COM (Anonymous) > When all your customers are anonymous, you don't get to be very choosy. Shure you can. The operator offers a simple service, resend email anonymously. If the result of that email is the anon user bringing hardship on the remailer cancel their account. If they do it again, cancel it again. Such is the woes of a commercial remailer. Outside of that, if they don't like the fact that I won't do other things for them when they are anonymous that is too bad. Like I said, I offer specific services with specific goals for a specific fee. If the results are not what you wanted, too bad. You want my other services then you'll have to give up the anonymity because I need a certain level of security that dealing with anonymous customers simply can't provide. I would operate a commercial remailer, I would limit my services to keeping the remailer up and the accounts valid so long as the money flowed in from the users, period. I don't do dedicated lines, security audits, development, etc. to anonymous customers. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Thu Oct 2 19:17:00 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 10:17:00 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" (fwd) Message-ID: <199710030217.VAA28885@einstein.ssz.com> Forwarded message: > Date: Thu, 2 Oct 1997 16:47:32 -0400 > From: Anonymous > Subject: Re: "Show me an example of terrorists using the Internet or crypto" > The only conclusion that can be drawn is that civilians, even armed > civilians with combat experience, are so overwhelmingly peace loving > that they will bend very far backwards to avoid trouble, even if it > means thousands of hours of work. Can the same be said of career > military or government people? A D E C L A R A T I O N By the REPRESENTATIVES of the U N I T E D S T A T E S O F A M E R I C A, In GENERAL CONGRESS assembled. [deleted material] Prudence, indeed, will dictate that Governments long established should not be changed for light and transient Causes; and accordingly all Experience hath shewn, that Mankind are more disposed to suffer, while evils are sufferable, than to right themselves by abolishing the Forms to which they are accustomed. [deleted material] ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From nobody at REPLAY.COM Thu Oct 2 19:36:45 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 3 Oct 1997 10:36:45 +0800 Subject: NoneRe: Remailers and ecash In-Reply-To: <5e155060a3b43cba398de593edc98bd6@anon.efga.org> Message-ID: <199710030205.EAA01934@basement.replay.com> Monty Cantsin wrote: > > - Everyone a remailer. Remailers only accept messages from other > > remailers. To use remailers you must run a remailer. > > I don't grow my own wheat, grind it up, and then make my own bread. I > also prefer not to run a remailer. You don't have to. You pay someone to bake your bread for you, and you can pay someone to run your remailer for you. This idea has been around since remailers began. The basic premise is that a group of remailers are set up which only accept mail from other remailers. A pinging system can be set up to verify that all the remailers are operating correctly. The catch is that in practice each remailer is only required to accept mail from other remailers, but can actually accept mail from anybody the operator wants to. So if you don't want to run a remailer, just pay someone to run a remailer on your behalf, and then you can send anonymous messages through that person's site. Thus forwarding within the remailer network is free, but it costs money to insert new messages. This scheme is a little more flexible than attaching ecash to each message because you can arrange any type of fee schedule you like, such as a flat rate per month. There's also the reverse of this, where remailers accept from anyone, but only send to other remailers. Thus you have to pay to get your messages out of the remailer network. This is more restrictive because the payment must be anonymous. > > - Pay for access to an anonymous message pool > > Interesting! Sign up with an ISP that offers alt.anonymous.messages. This one is a no-brainer. (and profitable for the ISP) This results in a system where sending messages is essentially free (since free remailers exist) but it costs money to receive them. So far it seems to be successful, at least for those who pay a flat fee for usenet access. From hallam at ai.mit.edu Thu Oct 2 19:53:15 1997 From: hallam at ai.mit.edu (Phillip Hallam-Baker) Date: Fri, 3 Oct 1997 10:53:15 +0800 Subject: counter-intuitive -- spam is good for you. anonymous assholes are your friend Message-ID: <01BCCF84.84FC2100.hallam@ai.mit.edu> On Thursday, October 02, 1997 11:54 AM, Attila T. Hun [SMTP:attila at hun.org] wrote: > if Phill is secure, what difference does it make if you assault > him? my guess is he is not secure, and probably has no clue how > to get from there to secure. Because when you ring the alarm bell on my system it is answered by law enforcement and it costs about $10,000 a time to deal with the issue. Setting off fire alarms costs real money. Incidentally the security line you are pushing is a crock. To get real security I believe you have to have feedback and monitoring. This is especially important in an institutional setting where you may not have complete control of critical infrastructure. For my application simply hoping the guys with the white hats find security holes before those in the black ones do is simply not enough. In any case I'm not as complacent as Attila seems to think the security model has been amply reviewed by the best in the field. Threatening to catch the malefactor and put him behind bars is a valuable additional security tool. The more bad guys there are behind bars the less time I have to spend worrying. Phill From dlv at bwalk.dm.com Thu Oct 2 19:54:10 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Fri, 3 Oct 1997 10:54:10 +0800 Subject: Request for illegal electronic surveillance examples and cases In-Reply-To: Message-ID: <2TRyDe3w165w@bwalk.dm.com> Declan McCullagh writes: > > Heh. I've never actually published anything in Time Digital. The one piece > I worked on for them was a full-page interview with Crypto-czar David > Aaron that was supposed to happen when he was in town in January. > > But he blew me and the photographer off and left town without being > interviewed. Mabe he didn't want Declan to forge quotations from him, as Declan was shown to do in his Netly news hatched jobs. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From dlv at bwalk.dm.com Thu Oct 2 19:57:02 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Fri, 3 Oct 1997 10:57:02 +0800 Subject: CDA protects against liability In-Reply-To: Message-ID: Declan McCullagh writes: > > Remember that the CDA "protects against liability" since the online > services cut a deal during the legislative process. > > In other words AOL & co lobbied to have provisions inserted to get them off > the hook, even though individual users would still be screwed when the act > became law. > > Another case of corporations selling out civil liberties. Remind me how some crypto-peddlers endorse bills that would criminalize domestic crypto use in exchange for their being able to export their (weak) systems. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From dlv at bwalk.dm.com Thu Oct 2 19:57:58 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Fri, 3 Oct 1997 10:57:58 +0800 Subject: Stronghold In-Reply-To: Message-ID: Lucky Green writes: > > On Thu, 2 Oct 1997, Anonymous wrote: > > > > > C2Net was wrong to censor the cypherpunks list in the guise of moderation. > > It was wrong to send threatening letters to people who claimed its > > products were weak. The whole moderation/censorship experiment was a > > terrible mistake. The actions taken by C2Net were completely unjustified. > > Where do people get these bizarre ideas? C2 didn't censor the list. A guy > who happened to work for C2 dropped some messages from one list. The > messages still went out on the unfiltered list. Had he worked for Mc > Donald's or the the NYC Sanitiation Department, would you blame them for > this as well? Lucky is lying: the censored articles were also filtered from the list which was billed as being unfiltered. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From ravage at ssz.com Thu Oct 2 20:12:35 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 11:12:35 +0800 Subject: Remailers and ecash (fwd) Message-ID: <199710030325.WAA29273@einstein.ssz.com> Forwarded message: > Date: Thu, 2 Oct 1997 11:33:00 -0400 > From: Anonymous > Subject: Re: Remailers and ecash (fwd) > Jim Choate: > > >For the sender to chain from remailer to remailer to destination the > >destination has to be in the header info somewhere. Now in the most secure > >system each packet header will only contain the address of the next hop. When > >the next site gets it the packet contents are de-crypted (otherwise reading > >the chaining info is trivial) and the contents are uncovered to reveal another > >packet with the next hop header and another encrypted block. And on and on > >we go. > > > > > packet system?> > > Jim Choate has been amazingly clueless throughout this discussion, but > this takes the cake. Does he really not know about encrypted nested > chaining? My God! Of course remailers work this way, Jim. They've > worked this way practically from the beginning. All remailers work this > way. No they don't, all remailers do not encrypt their outgoing as a matter of course (do any currently do it as a matter of course? I would bet not if I were a gambler). The remailer you used to send this didn't use encryption on its outgoing or else I wouldn't be able to read it. The last time I looked about a year ago the vast majority of remailers didn't encrypt their outgoing traffic as a matter of course, it required the user to do it (I suspect this is still true). Furthermore I specificaly used the word 'set' to mean a group of remailers acting in concert such that this encryption happened automaticaly - I know the answer already - No, there are no sets (ie a cooperative network) of remailers (Mixmaster operaters included) implimenting this unless the user goes to extreme and does it all themselves. As a matter of fact there appears to be little to no cooperation between remailer operators. There are no remailer key servers to manage the server and user keys so the user must contact each remailer and obtain the key which is itself open to traffic analysis, note that such first contacts by definition have to be in the clear. Hope that Mallet starts their analysis AFTER you get your keys or else. If this process can't occur automagicaly there is little commercial utility for the system - it's too cumbersome. > The mixmaster remailers are built around this idea, making each > packet a constant size and adding dummy packets as new ones are stripped > off, so outgoing messages look just like incoming ones. First off, the size of the packets in no way effects the succes of a traffic analysis, only a cryptanalysis of their contents. Traffic analysis looks at four things: the incoming packet header, the outgoing packet header, and the times of receipt and transmission. The idea behind latency is that if it is chosen correctly and the packet re-transmission falls outside the analysis window there is no way to correlate the incoming and outgoing traffic. From the analysis engines perspective the events are distinct and non-related. Simply re-ordering the packets at re-transmission time does nothing if I set the window larger than the time it takes to resend the original traffic and the cover traffic. Setting the analysis window to infinity also causes the analysis overhead to grow quickly though this means that re-ordering and latency are irrelevant. A party implimenting traffic analysis is probably not going to look at the contents until they have a clear understanding of the traffic flow between the surveiled parties. At that point it is cheaper to look at the involved parties and see if one of them has a weakness that can be exploited (ie offer immunity to a herion addict) over doing actual expensive cryptanalysis. If you can subvert a member you are in the classic man-in-the-middle position. When the Austin Cpunks looked at Mixmaster about 1.5 years ago for several months it became clear that as implimented currently Mixmaster can't easily support public remailer key servers or automated non-user-involved chaining and processing (encryption & decryption). Shure the packets look the same, but unless you as the sender go in and manage that material you are shit out of luck. The remailers can't do it themselves without user intervention, that's economicly not viable. > > > hop header depended on which key was used to decode it. > > In other words, remailer A's key will produce one next hop > > address while remailer B's key will send it elsewhere. This > > is a subset of the different plaintext - same cyphertext > > problem - a hard problem as I understand it. Find two > > distinct texts that encrypt with different keys to the > > same cyphertext> > > That won't help. There would be no point in doing this. I'd ask you > to explain, but that would just prolong the agony. It is actualy quite simple why you would want to do this. You could then in effect send the same packet (identical in every bit) to a set of remailers. Each remailer would then decode the packet and send it on. All but one would go to bogus addresses and the one remailer with the right key would get to resend to the next remailer(s). Plus none of the outgoing traffic would be to the same server, further complicating analysis. This also gives the user some control over how much cover traffic gets generated. However Mallet doesn't know which packets are which and therefore must follow every packet. This multiplies the number of hops in the traffic analysis that need to be analyzed. As mentioned in one of my previous posts, in this situation the complexity goes up by a power causing the required computing resources to trace the traffic to quickly become excessive. Sine this is so painful for you, I assume this is the end of this discussion. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Thu Oct 2 20:28:33 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 11:28:33 +0800 Subject: None (fwd) Message-ID: <199710030342.WAA29338@einstein.ssz.com> Forwarded message: > Date: Fri, 3 Oct 1997 04:05:48 +0200 (MET DST) > Subject: Re: Remailers and ecash > From: nobody at REPLAY.COM (Anonymous) > A pinging system can be set up to verify that all the remailers are > operating correctly. It will certaily tell you if the system is network aware, as to internal operation and its validity it says nothing. If you want to test it you must send each remailer in the network a message with a final destination of the source. If you don't get it back you know the remailer is not online. This is called a 'loopback'. > Thus forwarding within the remailer network is free, So as long as I only send traffic to other remailers the electricity and such are not charged? How does my local electric company measure this? If the remailer is turned on there is a cost. Unless you are getting charged by the packet the cost of operating is indipenant of the traffic until you have to increase your clogged pipe. Commercialy irrelevant approach. > insert new messages. This scheme is a little more flexible than attaching > ecash to each message because you can arrange any type of fee schedule you > like, such as a flat rate per month. But it doesn't pay for the cover traffic. It also short changes the man-in-the-middle remailers since they have to spend resources without getting recompensed. This would indicate that there is little financial motive to operate a remailer that deals only with other remailers. > There's also the reverse of this, where remailers accept from anyone, but > only send to other remailers. Thus you have to pay to get your messages > out of the remailer network. This is more restrictive because the payment > must be anonymous. So what keeps me from submitting message after message and never pulling them out? I guess you just keep paying the bills to pay for the increasing traffic and the need to increase your pipe to carry it. Commercialy irrelevant. Also, consider the exponential expansion from cover traffic. > Sign up with an ISP that offers alt.anonymous.messages. This one is a > no-brainer. (and profitable for the ISP) > > This results in a system where sending messages is essentially free (since > free remailers exist) but it costs money to receive them. So far it seems > to be successful, at least for those who pay a flat fee for usenet access. So what if I use a free-net or perhaps one of the free machines at the public library or at the local college? Or the system at work? ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From theSameGuy at theSamePlace.Old Thu Oct 2 20:33:17 1997 From: theSameGuy at theSamePlace.Old (The Same Guy) Date: Fri, 3 Oct 1997 11:33:17 +0800 Subject: And with the money you save on rent, you can... Message-ID: <34345F32.A8C@theSamePlace.Old> * A Washington Post report in March on prison corruption in Mexico revealed that drug traffickers supposedly under maximum security actually have "spacious rooms, cooks and maids, cellular phones, a gymnasium, a sauna, and manicured gardens where they host barbecues," among other things. And in May, the New York Times revealed that a federal jail in Brooklyn has been run as a "Mafia social club," where family business "sit-downs" featured smuggled-in meatballs, manicotti, vodka, and wine. And in May, imprisoned Gangster Disciple leader Larry Hoover was convicted in Chicago of running a vast prison drug operation in which he typically issued memos and gave orders by cellular phone while wearing $400 alligator boots and eating specially prepared food in his cell. To read these News of the Weird newspaper columns from the past six months, go to http://www.nine.org/notw/notw.html (That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it.) From anon at anon.efga.org Thu Oct 2 20:33:46 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 3 Oct 1997 11:33:46 +0800 Subject: Kitsch! Message-ID: <75c67c8f9904d007da656e3085a83f1b@anon.efga.org> -----BEGIN PGP SIGNED MESSAGE----- - From the "Unberable Lightness of Being" by Milan Kundera. Part Six, "The Grand March" Section 6 Sabina's initial inner revolt against Communism was aesthetic rather than ethical in character. What repelled her was not nearly so much the ugliness of the Communist world (ruined castles transformed into cow sheds) as the mask of beauty it tried to wear - in other words, Communist kitsch. The model of Communist kitsch is the ceremony called May Day. She had seen May Day parades during the time when people were still enthusiastic or still did their best to feign enthusiasnm. The women all wore red, white, adn blue blouses, and the public, looking on from balconies and windows, could make out various five-pointed stars, hearts, and letters when the marchers went into formation. Small brass bands accompanied the individual groups, keeping everyone in step. As a group approached the reviewing stand, even the most blase faces would beam with dazzling smiles, as if trying to prove they were properly joyful or, to be more precise, in proper agreement. Nor were they merely expressing political agreement with Communism; no, theirs was an agreement with being as such. The May Day ceremony drew its inspiration from the deep well of the categorical agreement with being. The unwritten, unsung motto of the parade was not "Long live Communism!" but "Long live life!" The power and cunning of Communist politics lay in the fact that it appropriated this slogan. For it was this idiotic tautology ("Long live life!") which attracted people indifferent to the theses of Communism to the Communist parade. Section 7 Ten years later (by which time she was living in America), a friend of some friends, an American senator, took Sabina for a drive in his gigantic car, his four children bouncing up and down in the back. The senator stopped the car in front of a stadium with an artificial skating rink, and the children jumped out and started running along the large expanse of grass surrounding it. Sitting behind the wheel and gazing dreamily after the four little bounding figures, he said to Sabina, "Just look at them." And describing a circle with his arm, a circle that was meant to take in stadium, grass, and children, he added, "Now, that's what I call happiness." Behind his words there was more than joy at seeing children run and grass grow; there was a deep understanding of the plight of a refugee from a Communist country where, the senator was convinced, no grass grew and no children ran. At that moment an image of the senator standing on a reviewing stand in a Prague square flashed through Sabina's mind. The smile on his face was the smile Communist statesmen beamed from the height of their reviewing stand to the identically smiling citizens in the parade below. Section 8 How did the senator know that children meant happiness? Could he see into their souls? What if, the moment they were out of sight, three of them jumped the fourth and began beating him up? The senator had only one argument in his favor: his feeling. When the heart speaks, the mind finds it indecent to object. In the realm of kitsch, the dictatorship of the heart reigns supreme. The feeling induced by kitsch must be a kind the multitudes can share. Kitsch may not, therefore, depend on an unusual situation; it must derive from the basic images people have engraved in their memories: the ungrateful daughter, the neglected father, children running on the grass, the motherland betrayed, first love. Kitsch causes two tears to flow in quick succession. The first tear says: How nice to see children running on the grass! The second tear says: How nice to be moved, together with all mankind, by children running on the grass! It is the second tear that makes kitsch kitsch. The brotherhood of man on earth will be possible only on a base of kitsch. Section 9 And no one knows this better than politicians. Whenever a camera is in the offing, they immediately run to the nearest child, lift it in the air, kiss it on the cheek. Kitsch is the aesthetic ideal of all politicians and all political parties and movements. Those of us who live in a society where various political tendencies exist side by side and competing influences cancel or limit one another can manage more or less to escape the kitsch inquisition: the individual can preserve his individuality; the artist can create unusual works. But whenever a single political movement corners power, we find ourselves in the realm of totalitarian kitsch. When I say "totalitarian," what I mean is that everything that infringes on kitsch must be banished for life: every display of individualism (because a deviation from the collective is a spit in the eye of the smiling brotherhood); every doubt (because anyone who starts doubting details will end by doubting life itself); all irony (because in the realm of kitsch everything must be taken quite seriously); and the mother who abandons her family or the man who prefers men to women, thereby calling into question the holy decree "Be fruitful and multiply." In this light, we can regard the gulag as a septic tank used by totalitarian kitsch to dispose of its refuse. Section 10 The decade immediately following the Second World War was a time of the most horrible Stalinist terror. It was the time when Tereza's father was arrested on some piddling charge and ten-year-old Tereza was thrown out of their flat. It was also the time when twenty-year-old Sabina was studying at the Academy of Fine Arts. There, her professor of Marxism expounded on the following theory of socialist art: Soviet society had made such progress that the basic conflict was no longer between good and evil but between good and better. So shit (that is, whatever is essentially unacceptable) could exist only "on the other side" (in America, for instance), and only from there, from the outside, as something alien (a spy, for instance), could it penetrate the world of "good and better." And in fact, Soviet films, which flooded the cinemas of all Communist countries in that cruelest of times, were saturated with incredible innocence and chastity. The greatest conflict that could occur between two Russians was a lovers' misunderstanding: he thought she no longer loved him; she thought he no longer loved her. But in the final scene they would fall into each other's arms, tears of happiness trickling down their cheeks. The current conventional interpretation of these films is this: that they showed the Communist ideal, whereas Communist reality was worse. Sabina always rebelled against that interpretation. Whenever she imagined the world of Soviet kitsch becoming a reality, she felt a shiver run down her back. She would unhesitatingly prefer life in a real Communist regime with all its persecution and meat queues. Life in the real Communist world was still livable. In the world of the Communist ideal made real, in that world of grinning idiots, she would have nothing to say, she would die of horror within a week. The feeling Soviet kitsch evoked in Sabina strikes me as very much like the horror Tereza experienced in her dream of being marched around a swimming pool with a group of naked women and forced to sing cheerful songs with them while corpses floated just below the surface of the pool. Tereza could not address a single question, a single word, to any of the women; the only response she would have got was the next stanza of the current song. She could not even give any of them a secret wink; they would immediately have pointed her out to the man standing in the basket above the pool, and he would have shot her dead. Tereza's dream reveals the true function of kitsch: kitsch is a folding screen set up to curtain off death. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDRQjT7jyGKQlFZpAQFY2wf+OVzGMbHNobPuwJERYJm5NWVUicscI+8I k+6GI7tHbj+g5XnKU8xCjB6k69AFTWTP9YOC4M6+WUsQx17BrbKd6rlZIQ95xh8o aleWPsdsESFgarGO6PV7496I8xl6BXixqiySHCkUlZ7YQXsTMFknGO/81ndrJqMU UgZLGIem6CMkc8qAOvwa6bd3N8qvv8ShBFnkYZ+8SFWC3I5EhCARLYjlijhVYqcK EPnBZVmKcpP6ojOxCWiKzARh1Z66y1Xf+GBdsRCYrHU7NoUfqqo9quMyNFX6eM7u AehRJZ7rOG30mhWcRfuCrT++uGKOFfKUsWLDJIzG/4mkEmhU9801GQ== =qoeS -----END PGP SIGNATURE----- From pooh at efga.org Thu Oct 2 20:35:40 1997 From: pooh at efga.org (Robert A. Costner) Date: Fri, 3 Oct 1997 11:35:40 +0800 Subject: Traffic Analysis Message-ID: <3.0.3.32.19971002232810.03514efc@rboc.net> I'm curious about traffic analysis capability. While I don't know the exact figures involved, I'd say that Cracker throws away about 10% of the messages it receives. Admittedly, these are probably not encrypted messages (I don't know. Humans do not get to read the messages.) Does this make traffic analysis more difficult? On the other side, if Cracker were to send out more messages that it takes in, or just replace these thrown away messages with random noise messages, perhaps encrypted, would this foil traffic analysis? Or suppose Redneck sent each nym an encrypted message each day, or more often? This would be a pure nonsense message just sent out to foil traffic analysis. Since the server generated the nonsense message internally, there would be no matching incoming message for Redneck. -- Robert Costner Phone: (770) 512-8746 Electronic Frontiers Georgia mailto:pooh at efga.org http://www.efga.org/ run PGP 5.0 for my public key From twm at dev.null Thu Oct 2 20:35:58 1997 From: twm at dev.null (Tim W. May) Date: Fri, 3 Oct 1997 11:35:58 +0800 Subject: Not that I'm a troublemaker... Message-ID: <3434631F.4451@dev.null> THE CLASSIC MIDDLE NAME (continued) * In Alabama, murderer Billy Wayne Waldrop was executed in January, and the next month, murderer Dudley Wayne Kyzer was turned down for parole. Two weeks later, murderer Coleman Wayne Gray was executed in Virginia. In May, murderer Larry Wayne White was executed in Texas. In July, Maryland inmate Richard Wayne Willoughby was sentenced to life in prison for killing another inmate. And once again this April 19, the nation was reminded that the Oklahoma City bombing date commemorated not only the seige at Waco, but the 1995 Arkansas execution of murderer and militia hero Richard Wayne Snell. AUTHENTICITY: All news stories mentioned in News of the Weird are from news stories appearing in daily newspapers in the U. S. and Canada (or occasionally, reputable daily newspapers in other countries or other reputable magazines and journals). No so-called supermarket tabloid, and no story that was not intended to be "news," is ever the source of a News of the Weird story. From ravage at ssz.com Thu Oct 2 20:39:40 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 11:39:40 +0800 Subject: Remailer advertising (fwd) Message-ID: <199710030353.WAA29549@einstein.ssz.com> Forwarded message: > Date: Thu, 02 Oct 1997 10:31:37 -0400 > From: "Robert A. Costner" > Subject: Re: Remailer advertising > this, and decided that users would be bothered by getting return email when > they send the remailer a message. We considered sending a return message > not with each message, but say only once per month, or only once every two > weeks. Feedback I got on this was that users would not like the remailer > acknowledging them. Of course not: - it provides even more non-covered traffic for Mallet to analyze - it proves that the remailer is keeping long-term records of its activity, further prompting Mallet to use rubber-hose crypto or a covert break-in to recover the data. A commercial remailers should keep no records and this means that each submission must include some form of token for immediate payment of access fees. Further, a secure remailer should NEVER send traffic to a subscriber as the result of anything other than normal traffic handling. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Thu Oct 2 21:09:25 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 12:09:25 +0800 Subject: Traffic Analysis (fwd) Message-ID: <199710030423.XAA29605@einstein.ssz.com> Forwarded message: > Date: Thu, 02 Oct 1997 23:28:10 -0400 > From: "Robert A. Costner" > Subject: Traffic Analysis > I'm curious about traffic analysis capability. While I don't know the > exact figures involved, I'd say that Cracker throws away about 10% of the > messages it receives. Admittedly, these are probably not encrypted > messages (I don't know. Humans do not get to read the messages.) Does > this make traffic analysis more difficult? Why/how does it decide to throw them away? Does the incoming produce cover traffic even if its thrown away? Traffic analysis generaly does not look at the contents of the packets, encrypted or not is irrelevant. I suspect it would lower the estimated ratio of cover traffic if nothing gets sent out. This would in general lower the cost to analyse the traffic. I would set it up to send bogus outgoing even if the message was dropped. That way the analysis would correlate the dropped message to the outgoing and produce a cover ratio closer to the actual value. Also remember to send n+1 bogus traffic to make up for the dropped outgoing. > Or suppose Redneck sent each nym an encrypted message each day, or more > often? By 'nym' you mean each subscribed address or to each address used in the outgoing? I would say it is bad to send to subscribers. It provides non-covered traffic that identifies your subscribers specificaly (really not a threat since Mallet already has their original incoming and therefore their source address) as well as demonstrating that you are keeping long-term traffic records. The long-term records represent a clear threat to the security and stability of the remailer. If you send out this cover traffic regularly then be shure to use some mechanism to select email addresses randomly or else Mallet will get a list of your bogus addresses and begins to filter them immediately. A commercial remailer should not keep records of its use. However, I suspect that eventualy remailers will be required to keep usage records by law. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From tcmay at got.net Thu Oct 2 21:27:58 1997 From: tcmay at got.net (Tim May) Date: Fri, 3 Oct 1997 12:27:58 +0800 Subject: Intruder Alert! In-Reply-To: <01BCCF84.84FC2100.hallam@ai.mit.edu> Message-ID: At 7:32 PM -0700 10/2/97, Phillip Hallam-Baker wrote: >On Thursday, October 02, 1997 11:54 AM, Attila T. Hun >[SMTP:attila at hun.org] wrote: >> if Phill is secure, what difference does it make if you assault >> him? my guess is he is not secure, and probably has no clue how >> to get from there to secure. > >Because when you ring the alarm bell on my system >it is answered by law enforcement and it costs about >$10,000 a time to deal with the issue. Hmmmhhh, you must have a law enforcement arrangement different from the ones around here (here being the Bay Area/Silicon Valley). Around here, law enforcement is usually the last to be brought in, and they in fact have little interest in answering computer intrusion alert calls. If it costs you, or the taxpayers (through your law enforcement situation), $10,000 for each quiver of your alarm system, maybe you ought to find ways to cut the costs. And setting off an alarm is not necessarily a crime, of course. Depends on where the alarm was placed. If someone bumps a car in a parking lot and sets off a motion sensor alarm, no crime has generally been committed. At least this is the situation in all the places I know of. And if dealing with a false car alarm cost $10,000, or even $100, this would tell the alarm owner to do something to reduce the number of false alarms. >Setting off fire alarms costs real money. Indeed, because people panic, evacuate, leave work in progress, lose manufacturing runs, etc. But I can't think of many computer intrusion alarms which have the same effect, nor should they. If someone sets off panic alarms because an incorrect password is typed too many times, or some biometric test fails, or access to some files is unexplained, or whatever the alarms are, then this is an overreaction. Better security, better firewalls, write protecting Web sites, air gaps with the Net, or whatever, these would seem to be better alternatives than calling in the cops and running up a $10,000 bill for each alarm. (In any case, cops in my area will definitely _not_ come to my aid if I call them to report an attempted incursion into my system. Your cops must be different.) --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From ravage at ssz.com Thu Oct 2 21:46:22 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 12:46:22 +0800 Subject: update.339 (fwd) Message-ID: <199710030500.AAA29731@einstein.ssz.com> Forwarded message: > From physnews at aip.org Thu Oct 2 16:07:42 1997 > Date: Thu, 2 Oct 97 12:42:29 EDT > From: physnews at aip.org (AIP listserver) > Message-Id: <9710021642.AA00390 at aip.org> > To: physnews-mailing at aip.org > Subject: update.339 > > > PHYSICS NEWS UPDATE > The American Institute of Physics Bulletin of Physics News > Number 339 October 1, 1997 by Phillip F. Schewe and Ben > Stein > > A NEW THEORY OF NMR FOR EXTENDED OBJECTS. > Nuclear magnetic resonance (NMR) isn't just an imaging > technique, but a valuable spectroscopic tool for deducing the > chemical environment and structural layout of atoms in different > environments. This is because the NMR spectrum of an atom (or > to be more precise, the spectrum of the atom's nuclear magnetic > states) is different depending on the local geometry, just as an > atom's allowed electron energies will be different if the atom is > suddenly lodged in a crystal with many other atoms. Previous > NMR theories have been able to explain accurately what the > NMR spectrum ought to be only for atoms or atom clusters in > isolation. Now, physicists at UC Berkeley (Steven Louie, > louie at jungle.berkeley.edu, 510-642-1709) have devised a > method which for the first time makes possible rigorous > calculations of the NMR spectra of extended systems such as > crystals, surfaces, polymers, or even amorphous materials; given > the coordinates of the atoms, the Berkeley researchers were able > to predict the spectrum. They tried out their theory on an > industrially important material---synthetic diamond films used, > for example, as coatings for tools and engine parts. The > prediction of the NMR spectrum for carbon atoms in the diamond > films was in close agreement with the observed spectrum. > (Francesco Mauri et al., Physical Review Letters, 22 Sept. > 1997.) Hell of a way to reverse-engineer just about anything. How long you figure it will be before they start coming out wit industrial units just for materials analysis? I wonder how good it would be at determing the layout of a die through the carrier... > PARTICLE IDENTIFICATION WITH PROBE MICROSCOPY. > Scanning tunneling microscopes (STM) provide pretty pictures of > atoms and can even be used to pluck single atoms from the > sample surface. But often the identity of that atom (especially if > it is an impurity) remains unknown. Physicists at Arizona State > (John Spence, Uwe Weierstall, weierstall at asu.edu) have > addressed this problem. First, they use a small voltage to remove > a surface atom or molecule with an STM probe; then a larger > voltage launches the object from the probe toward a distant > detector. A measurement of the time of flight (TOF) supplies a > mass-to-charge ratio for the mystery particle, which in most cases > will supply the identity of the unknown species. The best > resolution achieved by other methods of chemical identification > on surfaces is about 2 nm. This new STM + TOF identification, > with essentially atomic-level resolution, should be handy in a > number of research areas, such as catalysis and the study of the > role of foreign atoms at kinks and steps in crystal growth. This > work will be reported in a session (NS-TuA, Oct. 21) at the > upcoming meeting of the American Vacuum Society (Oct. 20-24 > in San Jose). The program for this meeting can be viewed on the > Internet at this address: > www.vacuum.org/symposium/program.html. (General press > contact at the meeting: 408-271-6000.) Pretty nifty materials analysis tool. Maybe they should shoot the atom toward the NMR... > FISSION HELPS SUPERCONDUCTIVITY. One of the > problems of using high temperature superconductors as wires in > magnets is that the bundles of magnetic field lines that normally > stay put in the presence of low currents start to move around > (dissipating energy thereby) when larger currents are sent through > the wire sample. Scientists working at Los Alamos have now > used a proton beam to induce nuclear fission in mercury atoms in > a mercury/copper oxide superconductor. The defects caused by > the fissioning atoms splay out in all directions in the > superconductor crystal and help to snag the wayward field lines. > This permits the sample to carry much more current. (Nature, 18 > Sept.) ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Thu Oct 2 21:47:17 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 12:47:17 +0800 Subject: index.html Message-ID: <199710030502.AAA29773@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Main banner Move the corporate ladder to your back yard. Because you can. VAIO/Sony rule JUDGE THROWS OUT RUBY RIDGE CHARGES Randy Weaver's house October 2, 1997 Web posted at: 8:36 p.m. EDT (0036 GMT) Latest developments: * Judge invokes double-jeopardy law * Harris accused of killing U.S. marshal * Charges against FBI agent unaffected BONNERS FERRY, Idaho (CNN) -- An Idaho judge dismissed a state murder charge against a man accused of killing a federal agent in the Ruby Ridge shootout, saying he can't be tried again after his acquittal of murder in federal court. Idaho Magistrate Judge Quentin Harden ruled Thursday that the charge against Kevin Harris violate a state law barring prosecution of someone who faced the same charges in another "state, territory or country." Prosecutor Denise Woodbury, who charged Harris and FBI marksman Lon Horiuchi in state court in August, had argued that the state double-jeopardy law was meant to cover prosecutions in other countries, not the United States. "I find that (Idaho law) bars further prosecution of Kevin Harris for the acts set forth ... in the complaint in this case," Harden said. "To rule that the courts of the United States of America do not come under 'another state, territory, or country' would be an anomalous result -- giving more credence to the courts of another country than to the courts of our own nation," Harden wrote. Harris accused of killing U.S. marshal Standoff scene Harris, 29, of Republic, Washington, was accused in the shooting death of deputy U.S. Marshal William Degan and of shooting at another agent in the August 21, 1992, shootout that precipitated an 11-day siege at the cabin of white separatist Randy Weaver. A friend of Weaver's, Harris was staying at the cabin during the shootout and was wounded by an FBI sniper's bullet. Weaver's 14-year-old son, Sam, was killed in the gunfight. His wife, Vicki Weaver, was later shot and killed during the siege by the FBI's Horiuchi. The shootout has become a rallying point for some groups who believe federal law enforcement has encroached too much on citizens' rights. Weaver and Harris were tried and acquitted of federal charges in 1993. But in August, Woodbury charged Harris with first-degree murder in Degan's death and assault with a deadly weapon against Arthur Roderick, another law enforcement officer. Harden also dismissed the assault charge. Woodbury also charged Horiuchi with involuntary manslaughter in the death of Vicki Weaver. Charges against FBI agent unaffected Harden's ruling doesn't affect the charge against Horiuchi, who has never been tried in any court. His lawyers have indicated they will try to move his case to a federal court. Harris was at his job as a welder when he received the news that the murder charge against him had been dismissed, said Diane Peters, his business partner at Eagle Industries. "We were hoping what was fair and just would turn out," Peters said. Harris himself did not return a phone call, and Woodbury declined to comment on Harden's ruling. Reuters contributed to this report. rule Related stories: * Both sides decry new Ruby Ridge charges - August 21, 1997 * FBI senior officials won't be charged in Ruby Ridge siege - August 15, 1997 * Former FBI section chief pleads guilty, admits destroying Ruby Ridge report - October 30, 1996 * FBI official charged with obstruction after concealing Ruby Ridge report - October 22, 1996 Related sites: Note: Pages will open in a new browser window * United States Department of Justice Home Page * Federal Bureau of Investigation External sites are not endorsed by CNN Interactive. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Message Boards Sound off on our message boards You said it... [INLINE] Move the corporate ladder to your back yard. Because you can. VAIO/Sony rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From geeman at best.com Thu Oct 2 21:49:06 1997 From: geeman at best.com (geeman at best.com) Date: Fri, 3 Oct 1997 12:49:06 +0800 Subject: http:--www.cnn.com-US-9710-01-shooting.update- Message-ID: <3.0.32.19971002203627.006f3128@best.com> Crypto relevance? Naturally: this wouldn't have happened if strong crypto were outlawed! At 09:51 PM 10/1/97 -0500, Jim Choate wrote: > > CNN logo > Navigation > > Infoseek/Big Yellow > > TEEN KILLS 2 AT SCHOOL; MOTHER FOUND DEAD AT HOME > > Woodham October 1, 1997 > Web posted at: 3:38 p.m. EDT (1938 GMT) > > PEARL, Mississippi (CNN) -- A Mississippi teen-ager slashed his > mother's throat Wednesday morning before going on a shooting rampage > at his high school that left two students dead and at least six > wounded, authorities said. > > The high school junior, Luke Woodham, was arrested and charged with > three counts of murder shortly after the shooting at Pearl High > School, about three miles east of the state capital, Jackson. > > Police Chief Bill Slade choked back tears as he told reporters, > "This was a disgruntled girlfriend-boyfriend thing... We talked to > the youth. He gave us a statement and his manifesto was that he felt > he had been wronged." > etc,..,. obligatory pgp key: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 4.5 mQENAjMPX3sAAAEIAL8U6IqpMkqM3TcIqU/q7iot8pYk4ifVNaNlIYwwoYmPXH/T dabDzgkQg7h1QsEJU71Ze8EdHmKksfeBEVppJV6X9SyzpFOCgrI/Qr7hMbxnecci SVk2/B2lf4tUPuqm/DGRfAUcd4iG7Gjhw5GRh9Us/jrEtkqr3iIES+9pSNvrEsgB xYYR39eaYwe0gheExaO7vtvDDPUM7C3spbcnwOyLCpURpLCAMHUO8DQc2FO/fN4z TqqIFOect2ea4LYHr0o29RrtY9J85lQj3df8LQvIJWjwzAFfBqOU1KUdXqTayzUj rvY4ZL/1vhTJ5QmlBJ6ognqwk7PVN0SesspU2okABRG0IGdyZWdnIHBlcnNvbmFs IDxnZWVtYW5AYmVzdC5jb20+ =H0bC -----END PGP PUBLIC KEY BLOCK----- From ravage at ssz.com Thu Oct 2 21:55:01 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 12:55:01 +0800 Subject: http:--www.cnn.com-US-9710-01-shooting.update- (fwd) Message-ID: <199710030508.AAA29887@einstein.ssz.com> Forwarded message: > From: geeman at best.com > Date: Thu, 02 Oct 1997 20:47:35 -0700 > Subject: Re: http:--www.cnn.com-US-9710-01-shooting.update- > Crypto relevance? Naturally: this wouldn't have happened if strong crypto > were outlawed! > > TEEN KILLS 2 AT SCHOOL; MOTHER FOUND DEAD AT HOME > > > > Woodham October 1, 1997 > > Web posted at: 3:38 p.m. EDT (1938 GMT) > > > > PEARL, Mississippi (CNN) -- A Mississippi teen-ager slashed his > > mother's throat Wednesday morning before going on a shooting rampage > > at his high school that left two students dead and at least six > > wounded, authorities said. This list is involved with much more than just crypto. These were submitted as further datum in the ongoing guns discussion. You might try using procmail filtering on 'gun' to eliminate such traffic. The Cypherpunks Creedo: Empower yourself and quit bothering me. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From snow at smoke.suba.com Thu Oct 2 22:13:21 1997 From: snow at smoke.suba.com (snow) Date: Fri, 3 Oct 1997 13:13:21 +0800 Subject: Digital Postage (fwd) In-Reply-To: <199709282104.QAA09234@einstein.ssz.com> Message-ID: <199710030509.AAA00490@smoke.suba.com> He of the Hyperlong .sig said: > Ask yourself this, how attractive would the Internet have been if it had > required users to install and manage multiple communications protocols for > every connection? You mean like FTP, NNTP, HTTP, SMTP & etc.? Rudy can't fail. From nobody at neva.org Thu Oct 2 22:41:00 1997 From: nobody at neva.org (Neva Remailer) Date: Fri, 3 Oct 1997 13:41:00 +0800 Subject: Remailers and ecash Message-ID: <199710030536.WAA16213@mail-gw2.pacbell.net> -----BEGIN PGP SIGNED MESSAGE----- Anonymous wrote: >> > - Everyone a remailer. Remailers only accept messages from other >> > remailers. To use remailers you must run a remailer. >> >> I don't grow my own wheat, grind it up, and then make my own bread. I >> also prefer not to run a remailer. > >You don't have to. You pay someone to bake your bread for you, and >you can pay someone to run your remailer for you. > >This idea has been around since remailers began. The basic premise >is that a group of remailers are set up which only accept mail from >other remailers. A pinging system can be set up to verify that all >the remailers are operating correctly. > >The catch is that in practice each remailer is only required to >accept mail from other remailers, but can actually accept mail from >anybody the operator wants to. So if you don't want to run a >remailer, just pay someone to run a remailer on your behalf, and then >you can send anonymous messages through that person's site. > >Thus forwarding within the remailer network is free, but it costs >money to insert new messages. This scheme is a little more flexible >than attaching ecash to each message because you can arrange any type >of fee schedule you like, such as a flat rate per month. This is interesting. One nice feature is that there doesn't need to be a standardized payment arrangement with all remailers, just the one you use for your entry point. And, there's nothing that prevents many remailer networks from overlapping. (Actually, the geometry could create some neat problems.) This would be fairly easy to set up, not even really needing client software modifications. However, it does have a "commons" problem. No remailer operator has an incentive to provide really good service. They are all encouraged to provide the bare minimum remailer service and take advantage of the other remailers in the network. For example, what would encourage somebody to have a 24 x 7 remailer service with continuous staffing? This would be desirable because when the bad guys kick down the door, there is somebody awake to pull the plug. There are a zillion other features which won't happen if there isn't a proper incentive. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDR4w5aWtjSmRH/5AQEG4gf+M/7L0iR3qLoXB1jhLkCyuq2iasP+7dO8 nv3QkA3LcTk6gcIMvJKYAfGUlsqISOFOhIfB2G37bLIQ9PjPeP99x48lBklwZ61A 64JeiD187qEkS0bXy5Q5OLNnoQ1jhsQOF9dSqDgA7c3n6kDVv0fsIZ3gdCimFNqR 53qBcUQG14NcPIsYURmNUfX8p68T01yc+8rQUkh3xmmXCr89cgodCFoFpwKUojYp tumpPTdDYMZkjflAm2ZQxOgfrKryvtI/ESjy5R2xFxEcxB4nvJ1qZ2fVhhy/dQbS 9EdjT1WSG99rfOKRkJNd/ANeB3HU5ynq1WdrBq95TCRb+/znnguyaw== =HbZJ -----END PGP SIGNATURE----- From enoch at zipcon.net Thu Oct 2 22:45:36 1997 From: enoch at zipcon.net (Mike Duvos) Date: Fri, 3 Oct 1997 13:45:36 +0800 Subject: Kevin Harris Charges Dismissed Message-ID: <19971003054144.19104.qmail@zipcon.net> An Idaho magistrate dismissed state murder and other charges against Ruby Ridge defendent Kevin Harris today, citing double jeopardy. -- Mike Duvos $ PGP 2.6 Public Key available $ enoch at zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell} From ravage at ssz.com Thu Oct 2 22:54:55 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 13:54:55 +0800 Subject: Digital Postage (fwd) Message-ID: <199710030610.BAA30179@einstein.ssz.com> Forwarded message: > Subject: Re: Digital Postage (fwd) > Date: Fri, 3 Oct 1997 00:09:22 -0500 (CDT) > From: "snow" > He of the Hyperlong .sig said: I could make it even longer if it would irritate you more... > > Ask yourself this, how attractive would the Internet have been if it had > > required users to install and manage multiple communications protocols for > > every connection? > > You mean like FTP, NNTP, HTTP, SMTP & etc.? > > Rudy can't fail. No, not services, network protocols TCP/IP/UDP...IPX...NetBUI...Lantastic...MosesLAN...ParNet...etc. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From pooh at efga.org Thu Oct 2 23:07:24 1997 From: pooh at efga.org (Robert A. Costner) Date: Fri, 3 Oct 1997 14:07:24 +0800 Subject: Traffic Analysis In-Reply-To: <199710030423.XAA29605@einstein.ssz.com> Message-ID: <3.0.3.32.19971003013456.0356271c@mail.atl.bellsouth.net> At 11:23 PM 10/2/97 -0500, Jim Choate wrote: >Why/how does it decide to throw them away? Does the incoming produce cover >traffic even if its thrown away? Traffic analysis generaly does not look at >the contents of the packets, encrypted or not is irrelevant. Remailers in general will throw away messages at times. Sometimes on purpose, sometimes by accident. This is not replaced by any cover traffic. For purposes of argument, we could say that a remailer throws away messages that violate usage policies. This accounts for some amount of traffic, let's just say 10% to name a figure. Of course this sounds reprehensible, so you ask what sort of message gets thrown out? Some examples might be: * 3,000 copies of the same message to the same person * Any mail from Sanford Wallace at Cyberpromo.com * A 300MB mailbomb Basically some messages that constitute abuse (without examining actual content) get tossed. These are "valid" messages from people which the remailer might decide to not continue to send. Much of this mail never even reaches the remailer code as it gets tossed at an earlier level. Since about 10% of incoming traffic gets tossed, it would seem that this would somehow effect traffic analysis. This traffic is not replaced, and much of the dropped traffic is not even know to the remailer. How much would this actually effect traffic analysis? As a side point, software problems will at times cause chained messages to get tossed. From time to time certain remailers become incompatible with each other, or user held public keys do not get updated properly. This will also cause messages to get tossed. >By 'nym' you mean each subscribed address or to each address used in the >outgoing? I would say it is bad to send to subscribers. Cracker sends messages as "Anonymous" and does not allow replies to be returned to the sender. Redneck on the other hand allows each user to pick a pseudonym and allows relies to be returned to the sender. This is known as a "nym". The whole point of a nym is to be able to receive replies (as well as establish reputation capital). People who have nyms on the remailer want to receive email back to them. Nyms are managed and authenticated with PGP. My question is would it foil traffic analysis if a number of remailer server generated messages were to go out to the nyms without ever having matching incoming traffic? >A commercial remailer should not keep records of its use. However, I suspect >that eventualy remailers will be required to keep usage records by law. I'd be willing to be involved in a first amendment challenge against any such law. I suspect we would win in the US. At least we won the last 1st amendment challenge against remailers. (ACLU vs Miller) -- Robert Costner Phone: (770) 512-8746 Electronic Frontiers Georgia mailto:pooh at efga.org http://www.efga.org/ run PGP 5.0 for my public key From lac at dev.null Thu Oct 2 23:27:01 1997 From: lac at dev.null (Law Abiding Citizen) Date: Fri, 3 Oct 1997 14:27:01 +0800 Subject: Newbie Question Message-ID: <34348B4C.6B63@dev.null> I'm new to encryption, having just purchased PGP. I want to abide by the law, but I don't know who to send a copy of my secret key to. Do I send it to the FBI guy who shot the unarmed woman, the FBI guy, Kahoe, who ordered evidence of the FBI murder of citizens destroyed, or to one of the other four top FBI officials who helped with the cover-up? Do I have to send a copy of my secret key to the CIA, as well? If so, do I just give it to my drug dealer and have him pass it along to his connection, or should I just give it to a Jewish person and tell them to have the Mossad pass it along to the CIA? Also, I like sticking large, foreign objects in my rectum. Can I legally do that myself, with a toilet plunger, or are they restricted to only use by LEA's in meeting the legitimate needs of law enforcement. Insincerely, A.L-A. Citizen From ravage at ssz.com Thu Oct 2 23:50:48 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 14:50:48 +0800 Subject: Traffic Analysis (fwd) Message-ID: <199710030707.CAA30296@einstein.ssz.com> Forwarded message: > Date: Fri, 03 Oct 1997 01:34:56 -0400 > From: "Robert A. Costner" > Subject: Re: Traffic Analysis > Remailers in general will throw away messages at times. Sometimes on > purpose, sometimes by accident. This is not replaced by any cover traffic. Perhaps this should be added. > For purposes of argument, we could say that a remailer throws away > messages that violate usage policies. This accounts for some amount of > traffic, let's just say 10% to name a figure. Way too high for commercial use. Get it down to something like .01 and that would be workable I suspect (haven't done the math). Course this raises the issue of who pays for dumped mail on a commercial box. Should the customer pay since it was their action that instigated the drop? Or perhaps the remailer since they were selling a service which they didn't provide at their discretion? > Of course this sounds > reprehensible, Not to me. It's your box and your money, set any policy that you desire. If I as a user don't like it, I'll beat feet... > so you ask what sort of message gets thrown out? Some > examples might be: > > * 3,000 copies of the same message to the same person > * Any mail from Sanford Wallace at Cyberpromo.com > * A 300MB mailbomb Let's generalize a bit to see if we can get a clearer picture. - traffic that seems to be duplicate. What if the digital signature on each one is valid implying the originator intended to send the 3,000 pieces. Do you dump them and take the money? - traffic from specific parties whose reputation capital is low. As a business should this really matter as long as the creetin pays the bill? - traffic of an abnormal format Don't see any issues with this one. Are there any other classes that you can think of that you might want to filter on? > Basically some messages that constitute abuse (without examining actual > content) get tossed. Ok, so you are doing header filtering. > These are "valid" messages from people which the > remailer might decide to not continue to send. Much of this mail never > even reaches the remailer code as it gets tossed at an earlier level. > Since about 10% of incoming traffic gets tossed, it would seem that this > would somehow effect traffic analysis. This traffic is not replaced, and > much of the dropped traffic is not even know to the remailer. How much > would this actually effect traffic analysis? Let's see if we can put some numbers to it... We receive n pieces of mail. n/10 is tossed at reception based on header filtering. For each mail that gets to the remailer code we sent m cover messages and 1 real message. So the remailer handles a total of (n - n/10) + (m + 1)(n-n/10) pieces in a given time period, t. Let z stand for (n - n/10) the actual number of processible traffic, we can reduce this to z + (m + 1) z. Let's assume now that we go ahead and transmit cover for those emails we get something like z + (m + 1) z + m ( n/10 ). We don't add a 1 to the m(n/10) because we don't have a real outgoing to process. So the total traffic load of the remailer can be represented by: L = z + (m + 1) z + m ( n/10 ) or, L = (n - n/10) + (m + 1)(n - n/10) + m(n/10) Now if you look at a travelling salesman problem you see quickly that the complexity grows quite quickly. This produces a traffic analysis load of something of the form, T = L ^ v Where v represents the complexity factor in dealing with the possible combinations possible. So, without actualy plugging numbers in there, I would say it looks like a small increase in output could grow pretty quickly because of the power growth factor in the extra traffic and processing it. > As a side point, software problems will at times cause chained messages to > get tossed. From time to time certain remailers become incompatible with > each other, or user held public keys do not get updated properly. This > will also cause messages to get tossed. Ok, let's add a 'software failure' category. > Cracker sends messages as "Anonymous" and does not allow replies to be > returned to the sender. Redneck on the other hand allows each user to pick > a pseudonym and allows relies to be returned to the sender. This is known > as a "nym". The whole point of a nym is to be able to receive replies (as > well as establish reputation capital). People who have nyms on the > remailer want to receive email back to them. Nyms are managed and > authenticated with PGP. My question is would it foil traffic analysis if a > number of remailer server generated messages were to go out to the nyms > without ever having matching incoming traffic? If I understand you the remailer would send outbound traffic to its input for distribution to your subscribers? I don't believe it would factor into the analysis at all if all the source destinations are the same. Outbound traffic from party A that went to party B would be important to track. So, if you wanted to do this sort of stuff and you wanted Mallet to chase their tail I would randomly pick source addresses from my subscriber base and send the bogus messages to my subscribers making shure nobody received an email from themselves. Then it looks like everyone is involved in a conspiracy... > >A commercial remailer should not keep records of its use. However, I suspect > >that eventualy remailers will be required to keep usage records by law. > > I'd be willing to be involved in a first amendment challenge against any > such law. I suspect we would win in the US. At least we won the last 1st > amendment challenge against remailers. (ACLU vs Miller) It has nothing to do with limiting speech so I doubt you'd have a 1st leg to stand on. Furthermore, the 1st doesn't guarantee the right to anonymity. If you want to claim that as a fundamental right you'd need to use the 9th and 10th. It does have to do with being able to trace the perp back if needed. I am not saying I agree with it, just recognize that reasonable people will see this lack of tracability via a court order as a clear threat to their security at all levels. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From blancw at cnw.com Fri Oct 3 01:03:33 1997 From: blancw at cnw.com (Blanc) Date: Fri, 3 Oct 1997 16:03:33 +0800 Subject: "Show me an example of terrorists using the Internet or (fwd) Message-ID: <3.0.32.19971003000347.006ac138@cnw.com> Jim Choate wrote: >> Stalkers, thieves, rapists, drug addicts, perverts, etc., or just real >> animals from the animal kingdom, strike at the most inopportune times, when >> there are no officially sanctioned police forces around to be of help. > >I have to object to the inclusion of drug addicts, they do what they do >because the legislators and police want to stick their noses in other >peoples business. If drug addicts resort to crime then society as a whole >must garner some of the responsibility of putting them in that situation. .................................................... We weren't discussing why people commit crimes against others, Jim. We were discussing the disagreeability of having & using guns. And yes, killing doggies is also a Bad Thing. Generally. ('cept when they're foaming at the mouth, snarling, with red blazing eyes, lunging directly at you. That is a Very Bad Doggie.) .. Blanc From attila at hun.org Fri Oct 3 01:10:56 1997 From: attila at hun.org (Attila T. Hun) Date: Fri, 3 Oct 1997 16:10:56 +0800 Subject: counter-intuitive -- spam is good for you. anonymous assholes are your friend In-Reply-To: <01BCCF84.84FC2100.hallam@ai.mit.edu> Message-ID: <199710030803.CAA17846@infowest.com> -----BEGIN PGP SIGNED MESSAGE----- on or about 971002:2232 Phillip Hallam-Baker purported to expostulate: +On Thursday, October 02, 1997 11:54 AM, Attila T. Hun [SMTP:attila at hun.org] wrote: +> if Phill is secure, what difference does it make if you assault +> him? my guess is he is not secure, and probably has no clue how +> to get from there to secure. +Because when you ring the alarm bell on my system +it is answered by law enforcement and it costs about +$10,000 a time to deal with the issue. +Setting off fire alarms costs real money. my only comment is: "may you have many false alarms." waving the big stick of law enforcement as a warning is nothing more than a pre-potty trained bully with a bunch of goons to back him up as he stomps around his playpen. law enforcement did not deterred the hacks on the state department, the FBI, and even the CIA. I dont advocate the hacks, but it is amusing to watch the great watchdogs of security take a hit. with your spoiled brat rantings, you make your site as tempting as some of the other nose tweakers who need a serious attitude adjustment in other words, get off your fucking horse, it has a broken leg. dont forget to call home, your mums waiting. attila out +Incidentally the security line you are pushing is a crock. To get real +security I believe you have to have feedback +and monitoring. This is especially important in an institutional +setting where you may not have complete control of critical +infrastructure. For my application simply hoping the guys with the +white hats find security holes before those in the black ones do is +simply not enough. +In any case I'm not as complacent as Attila seems to think the security +model has been amply reviewed by the best +in the field. +Threatening to catch the malefactor and put him behind bars is a +valuable additional security tool. The more bad guys there are behind +bars the less time I have to spend worrying. + Phill -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDSmob04kQrCC2kFAQHc3AP/aHozQ2yGoAV29tBc3E7Jy4afe1qc6IJw o5jKmAAV5mXBS13Vvm8EBb+Z4znGlyFxrW8WB+Tx9TXwYSAENKvGt2fnMkv82yuK DJwUefSCtibVMZAolT3iwVsJpxe6s+rHfqVOrC987dTwK7kxTIitF4qrp9zhq9ML OQ5j/wh/rqc= =Ezsh -----END PGP SIGNATURE----- From attila at hun.org Fri Oct 3 01:32:32 1997 From: attila at hun.org (Attila T. Hun) Date: Fri, 3 Oct 1997 16:32:32 +0800 Subject: Crypto-continuation in Washington: FBI/DoJ keep up the pressure In-Reply-To: Message-ID: <130bbbb.13e6d@hun.org> -----BEGIN PGP SIGNED MESSAGE----- anyone have any doubt about my "Call to arms against F[reeh,uck]"? read what Declan said; the Congresscritters are just regrouping. the man must be stopped: Freeh Fuck wants to make J. Edgar Hoover look like a saint, garter belt and all. Hoover looked like the slimeball he was; F[reeh,uck] looks like the Hollywood stereotype of the valiant and honest defender of the American way. just wait for the hammer to fall in some rider to a spending bill; American legislative morality is pure snake shit amorality. -- "Experience keeps a dear school, but fools will learn in no other." --Benjamin Franklin ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDSp7704kQrCC2kFAQH5rQQAtRZ58c0ESjzspWgYI2zhJLW8yhDTYRAD Wa0mPoYVDijwdFLqO5WCqCvIPxAdi0dG67TdYTd5zd07ViFdNJS9fwNEI5M4TPh5 /SXae6MgAzonphYXThyn4QtsF377qZySXNNTpBMXFx50XhPMs/fvYmYRmEVInAQV VGOIfqCpI0w= =Gonb -----END PGP SIGNATURE----- From attila at hun.org Fri Oct 3 02:29:21 1997 From: attila at hun.org (Attila T. Hun) Date: Fri, 3 Oct 1997 17:29:21 +0800 Subject: NYTimes Editorial slams F[reeh,uck] and calls on Clinton to stamp it out! Message-ID: <130bbbb.14ef7@hun.org> -----BEGIN PGP SIGNED MESSAGE----- The lead editorial, the stated opinion of the paper itself, in this mornings NYTimes slams F[reeh.uck]'s initiative as "crossing the line" and that Clinton "needs to stamp out a bad idea." strong words, newspaper policy editorial, important words. The NYTimes actually has a clue, a strong clue. support the NYTimes! The NYTimes syndicate feeds thousands of the US papers, particularly the small town papers and is considered gospel by many. http://www.nytimes.com/yr/mo/day/editorial/03fri4.html The Clinton Administration has proposed several unworkable plans over the years to keep powerful encryption programs that scramble telephone and computer messages out of the hands of foreign terrorists and criminals. But it has never tried to put the need to eavesdrop on criminals above the privacy rights of ordinary Americans. Last month the F.B.I. Director, Louis Freeh, crossed that line by urging Congress to outlaw the manufacture and distribution of encryption programs the Government cannot instantly crack.... ...The plan is unworkable because uncrackable encryption software is readily available abroad. Congress could try to forbid Americans to use any unbreakable encryption, regardless of who makes it. But that would trample on rights that Americans jealously protect to communicate free of Washington's interference. The best way to reduce many types of industrial and financial crime is to provide citizens powerful encryption so they can communicate without fear of corporate spies and thieves.... ... Before encryption controls pick up more momentum, the White House needs to stamp out a bad idea. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDS47L04kQrCC2kFAQFFJAQA1/jnXjczlvUyVZ/8G6iVnLdD7+dmGw5k 8DnMy5Gw4nuR6cPBFjGLnomvZI2OXgJ4RFR/8Mv3pG9MBohPxOKq6nGdWjZV60F/ 8GpInE/Unb6hzFIxjET7a3wbjgt93PrmZjjSwfHCSiUBqUQXYcH0RUpyNF9zl0o8 HD7uS5WgVow= =7ZNz -----END PGP SIGNATURE----- From pooh at efga.org Fri Oct 3 02:44:59 1997 From: pooh at efga.org (Robert A. Costner) Date: Fri, 3 Oct 1997 17:44:59 +0800 Subject: Traffic Analysis In-Reply-To: <199710030707.CAA30296@einstein.ssz.com> Message-ID: <3.0.3.32.19971003054158.006d9664@mail.atl.bellsouth.net> At 02:07 AM 10/3/97 -0500, Jim Choate wrote: >> For purposes of argument, we could say that a remailer throws away >> messages that violate usage policies. > >Way too high for commercial use. Get it down to something like .01 and that >would be workable I suspect (haven't done the math). You may be confusing actual traffic, with valid customer traffic. (BTW - the 10% reject figure was totally pulled out of the air. Since there is no logging on a remailer, I'm just making an educated guess.) Almost all commercial sendmail implementations reject a large amount of traffic and call it "spam filtering". It's very effective, but the fact is that incoming mail traffic is blocked before any program such as a remailer can see the messages. Some of this is done by IP address, some is done through other methods. I'm merely suggesting that a commercial remailer will have similar policies. A remailer will also toss any email that is not addressed to a deliverable recipient. Apparently some people can't type. :) I'm not suggesting anything is happening here other than what occurs with an ISP and normal email. Or what usage polices claim are allowable. I'm merely pointing out that like any ISP, some mail is tossed. >Course this raises the >issue of who pays for dumped mail on a commercial box. Should the customer >pay since it was their action that instigated the drop? Or perhaps the >remailer since they were selling a service which they didn't provide at >their discretion? For usage policies, I would think it is the originating user's fault. For middleman mail rejects, it is the middleman remailer's fault. For public key errors, it is the originating user's fault. For the cases mentioned, I wouldn't put the blame on the initial remailer. >Let's generalize a bit to see if we can get a clearer picture. .... >Are there any other classes that you can think of that you might want to >filter on? You can sum it up by saying messages are tossed due to * Spam * Denial Of Service (DOS) attacks * typing errors >If I understand you the remailer would send outbound traffic to its input >for distribution to your subscribers? I don't believe it would factor into >the analysis at all if all the source destinations are the same. Outbound >traffic from party A that went to party B would be important to track. Giving an example that overly simplifies things... I think my idea here was that for some number of nyms, they would each receive an average of, say, five messages each day. All five messages would be addressed from the remailer and PGP encrypted. Four of the messages would be from real people trying to communicate with the owner of the nym. One would be a bogus message sent to confuse traffic analysis. All four real messages would come into the remailer encrypted to the remailer and addressed to the remailer. My thought was that fake outgoing messages to the nym would look identical to real messages, thereby helping obscure the "mix" just a little better. This helps hide the identity of the sender of the email that is headed to a nym. To define nym again, a nym is someone who has registered a real email address with the remailer. For instance, ravage at anon.efga.org might remail to ravage at ssz.com. So it would be possible for someone to send a message to remailer at anon.efga.org that would ultimately arrive at ravage at ssz.com, but the sender would have no idea of who the final destination of the email. The remailer keeps this info in an internal database (as it must) and is not available to anyone other than the remailer software. There would be no way, without traffic analysis, for a connection to be made between the sender and the recipient. >It has nothing to do with limiting speech so I doubt you'd have a 1st leg to >stand on. Furthermore, the 1st doesn't guarantee the right to anonymity. Having just spent a year and a half involved in a federal court case over the 1st amendment right to anonymity on the net, and winning, I'd have to disagree with you here. Our affidavit specifically mentioned remailers, among other things. -- Robert Costner Phone: (770) 512-8746 Electronic Frontiers Georgia mailto:pooh at efga.org http://www.efga.org/ run PGP 5.0 for my public key From nobody at REPLAY.COM Fri Oct 3 03:44:04 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 3 Oct 1997 18:44:04 +0800 Subject: Low blow (but a *good* one!) Message-ID: <199710031022.MAA22951@basement.replay.com> Alex Le Heux wrote: Anonymous wrote: >Let's also take a look at the Dutch performance during their >occupation. While there certainly were many courageous Dutch people >who helped refugees (at great personal risk, to say the least), and >there were many courageous Dutch people who were in the resistance, >there were also many Dutch people who did not perform so well. Not >only were a large number of Jewish people turned in by Dutch >informers, but there were even Dutch SS units. You have a nerve. You, coming from a country where people are still regularly killed in the name of racism, tell me this?! Alex ------------ The Same Old Guy replied: Want the cold, hard facts of life, Bubba? You didn't put WWII 'behind' you. We did! Gun-loving Americans conquered your continent and gave you your countries back instead of enslaving you, like every other winner in history has done. *** Certified Low Blow *** Some of us discriminate against Jews. Do you know why? Because we HAVE some! *** Certified Low Blow *** We were giving them refuge while Europe was massacring them by the millions. Now you have the balls to say we're not all treating them right all of the time. Buy a fucking clue! From edwin at witcapital.com Fri Oct 3 04:14:44 1997 From: edwin at witcapital.com (edwin at witcapital.com) Date: Fri, 3 Oct 1997 19:14:44 +0800 Subject: IPO ALERT: C.H. Robinson Worldwide, Inc. Available Through Wit Capital Message-ID: <199710031057.DAA22277@toad.com> Wit Capital Corporation is pleased to announce that we are able to provide first-come first-serve participation in the following initial public offering: Issuer: C.H. Robinson Worldwide, Inc. is the largest third party logistics company in North America with 1996 gross revenue of $1.6 billion. The company is a global provider of multimodal transportation services and logistics solutions through a network of 116 offices in 38 states and Canada, Mexico, Belguim, The United Kingdom, France, Spain, Italy, Singapore and South Africa. Security: Common Stock Expected Size of Offering: 10,578,396 shares Expected Price Range: $15.00 to $17.00 Managing Underwriters: BT Alex Brown Incorporated, Morgan Stanley & Co. Incorporated, Piper Jaffray Inc. If you think you may be interested in this Initial Public Offering available first- come first-serve through Wit Capital, please visit http://www.witcapital.com. You can view, print or download the Preliminary Prospectus from our New Issues Section. Investors can also call Wit Capital at (888) 4-WITCAP for more information. A REGISTRATION STATEMENT RELATING TO THESE SECURITIES HAS BEEN FILED WITH THE SECURITIES AND EXCHANGE COMMISSION BUT HAS NOT YET BECOME EFFECTIVE. THESE SECURITIES MAY NOT BE SOLD NOR MAY OFFERS TO BUY BE ACCEPTED PRIOR TO THE TIME THE REGISTRATION STATEMENT BECOMES EFFECTIVE. THIS COMMUNICATION SHALL NOT CONSTITUTE AN OFFER TO SELL OR THE SOLICITATION OF AN OFFER TO BUY, NOR SHALL THERE BE ANY SALE OF THESE SECURITIES IN ANY JURISDICTION IN WHICH SUCH OFFER, SOLICITATION OR SALE WOULD BE UNLAWFUL PRIOR TO REGISTRATION OR QUALIFICATION UNDER THE SECURITIES LAWS OF SUCH JURISDICTION. Wit Capital Corporation Member NASD SIPC From phelix at vallnet.com Fri Oct 3 04:46:55 1997 From: phelix at vallnet.com (phelix at vallnet.com) Date: Fri, 3 Oct 1997 19:46:55 +0800 Subject: Stronghold Message-ID: <3438505d.13845235@128.2.84.191> >Nope. Like I said, I'm not selling Stronghold or any competing product, I >don't lose anything when someone foolishly buys it, so why should I present >any evidence? I (and several other people on this mailing list) were threatened >by C2Net's lawyers; so to avoid unpleasant disputes, I told them I won't be >publishing whatever I might know about their product. > So, why don't you (and several other people on this mailing list) use the ananymous remailers to present your evidence. Others have wondered why people would use remailers. Here's a prime example. Use the remailer (if you have anything to say). From ravage at ssz.com Fri Oct 3 05:22:03 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 20:22:03 +0800 Subject: "Show me an example of terrorists using the Internet or (fwd) Message-ID: <199710031234.HAA30845@einstein.ssz.com> Forwarded message: > Date: Fri, 03 Oct 1997 00:08:09 -0700 > From: Blanc > Subject: Re: "Show me an example of terrorists using the Internet or > (fwd) > >> Stalkers, thieves, rapists, drug addicts, perverts, etc., or just real > >> animals from the animal kingdom, strike at the most inopportune times, when > >> there are no officially sanctioned police forces around to be of help. > > > >I have to object to the inclusion of drug addicts, they do what they do > >because the legislators and police want to stick their noses in other > >peoples business. If drug addicts resort to crime then society as a whole > >must garner some of the responsibility of putting them in that situation. > > We weren't discussing why people commit crimes against others, Jim. We > were discussing the disagreeability of having & using guns. True but my objection is to the line of reasoning you use to get to where you are. Let me try another example... "Stalkers, thieves, rapists, Jews, perverts, etc., or just real animals..." ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From jeffb at issl.atl.hp.com Fri Oct 3 07:03:16 1997 From: jeffb at issl.atl.hp.com (Jeff Barber) Date: Fri, 3 Oct 1997 22:03:16 +0800 Subject: Stronghold In-Reply-To: Message-ID: <199710031359.JAA17350@jafar.issl.atl.hp.com> Dr.Dimitri Vulis KOTM writes: > > Lucky Green writes: > > Where do people get these bizarre ideas? C2 didn't censor the list. A guy > > who happened to work for C2 dropped some messages from one list. The > > messages still went out on the unfiltered list. > Lucky is lying: the censored articles were also filtered from the list which > was billed as being unfiltered. This is revisionist history. I can't recall any intimation at the time that any messages were filtered from the unfiltered list. Obviously I can't say whether _all_ the censored articles came out on the unfiltered list. But I do know that I received at least one message from Vulis with an unsubstantiated allegation [of a secret backdoor, I think?] in Stronghold on the unfiltered list, as well as some later complaints from Vulis that Sandy's filtering was unfair and hypocritical. Unfortunately I didn't save the original message-- I just wrote it off as the typical Vulis spew. -- Jeff From ulf at fitug.de Fri Oct 3 07:06:10 1997 From: ulf at fitug.de (Ulf =?iso-8859-1?Q?M=F6ller?=) Date: Fri, 3 Oct 1997 22:06:10 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: <6489040e71db5edc2ab5e653cb709620@anon.efga.org> Message-ID: Anonymous writes: >I have to confess that I am surprised at the level of resentment among >the members of various Europeans countries feel towards other European >countries. For example, the Germans don't like the Dutch because when >they visit they are treated badly by, among others, the police. Nonsense. From ravage at ssz.com Fri Oct 3 07:46:09 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 3 Oct 1997 22:46:09 +0800 Subject: Traffic Analysis (fwd) Message-ID: <199710031449.JAA31060@einstein.ssz.com> Forwarded message: > Date: Fri, 03 Oct 1997 05:41:58 -0400 > From: "Robert A. Costner" > Subject: Re: Traffic Analysis > At 02:07 AM 10/3/97 -0500, Jim Choate wrote: > >> For purposes of argument, we could say that a remailer throws away > >> messages that violate usage policies. > > > >Way too high for commercial use. Get it down to something like .01 and that > >would be workable I suspect (haven't done the math). > > You may be confusing actual traffic, with valid customer traffic. (BTW - > the 10% reject figure was totally pulled out of the air. Since there is no > logging on a remailer, I'm just making an educated guess.) Almost all > commercial sendmail implementations reject a large amount of traffic and > call it "spam filtering". It's very effective, but the fact is that > incoming mail traffic is blocked before any program such as a remailer can > see the messages. Some of this is done by IP address, some is done through > other methods. I'm merely suggesting that a commercial remailer will have > similar policies. Duh. Look you picked the numbers and the scenarios, if you got a bitch about 'em talk to yourself...their your ugly baby. > >Course this raises the > >issue of who pays for dumped mail on a commercial box. Should the customer > >pay since it was their action that instigated the drop? Or perhaps the > >remailer since they were selling a service which they didn't provide at > >their discretion? > > For usage policies, I would think it is the originating user's fault. Acceptable. > For > middleman mail rejects, it is the middleman remailer's fault. So how do we rollback the payments if say the nth hop breaks the delivery? If I were a user and one of the remailers dropped the traffic I would want all my money back, I'm paying for delivery to a specific party. It is clear that the n-1 remailers has no claim to the charges since the email was not delivered to the recipient. Yet, it is not fair to take their income simply because some other remailer dropped mail due to a policy problem, which they clearly didn't have since they delivered the traffic to the next hop successfuly. Perhaps the remailer with the restrictive hop should pay the n-1 remailers. This would certainly provide clear financial incentive for remailers to have liberal fair use policies (which I support fully) and act as true commen-carries simply doing a job mechanicaly like the phone system or the network infrastructure itself. The bottem line is that if commercial anonymous remailers will survive they have to be as liberal with handling traffic as my routed is. > For public > key errors, it is the originating user's fault. Is it? If this were commercial systems the key server would NOT be on any remailers involved otherwise we have a prime target for man-in-the-middle attacks. So, assuming the user gets the key and the remailers get the keys from a 3rd party server which delivers the incorrect keys for whatever reason. Who pays for the failure then? To me it looks like the key server, but they aren't involved in traffic control but key control. While it is clearly fair to charge them for costs (say 1 remailer hop) incurred due to bad keys (which could be the original submitters fault), who pays the other remailers who handle the traffic and loose the income through no fault of their own? Also, what happens if the key is good but the software glitches (which is indistinguishable from a bad key at the source level)? Are you proposing we re-send for free all along the chain? I don't think the remailers which succeded will take kindly to that. If the MTBF for a remailer is n then the MTBF for m remailers is n*m. In other words the remailer chain gets less reliable as it gets longer. > >If I understand you the remailer would send outbound traffic to its input > >for distribution to your subscribers? I don't believe it would factor into > >the analysis at all if all the source destinations are the same. Outbound > >traffic from party A that went to party B would be important to track. > > Giving an example that overly simplifies things... I think my idea here was > that for some number of nyms, they would each receive an average of, say, > five messages each day. All five messages would be addressed from the > remailer and PGP encrypted. Let me say it again, traffic analysis doesn't look at the contents, cryptanalysis does. Whether the contents are encrypted or not is irrelevant. The word 'encrypted' NEVER occurs in traffic analysis. You encrypt the contents because it is assumed that the network analysis has already succeeded. Ok, so the recipient has no way to reply to specific parties unless the contents contain the source address in a source encrypted block. In such a case Mallet is going to look at the recipient and begin traffic analysis on them. Which Mallet is going to do as soon as they either submit or recieve traffic from that node anyway. Seems moot. An effective Mallet collects statistics on all participants indiscrimenantly. This is another example of the apparently unrecognized and implicit assumption that Mallet is only going to look at one party in the chain. Bad assumption. Traffic analysis will succeed ONLY if the *network* is analyzed, not some specific node in that network. This sounds like a message pool where a recipient must attempt decode on every packet they recieve. The ones not meant for them fail. I don't believe this is a commercialy viable process because of the amount of work on the recipients machine. I have a further question. The cover traffic that shows up in the recipients mailbox unrequested is spam isn't it? Also, when the recipient uncovers the last block is it going to say "This space intentionaly left blank"? Or can users of your remailer expect to recieve email full of hex gibberish they can't decode since they don't have a key? My suspicion is that if you are sending cover traffic to anything other than a /dev/null recipient with an a priori agreement you are not going to keep your users long. > Four of the messages would be from real people > trying to communicate with the owner of the nym. One would be a bogus > message sent to confuse traffic analysis. Turn those numbers around and you might manage to cover the traffic. The cover traffic MUST be greater than the 'real' traffic to be effective. My suspicion based on about 4 months of playing with MixMaster 1.5 years ago is that this ratio must be several orders of magnitude unless your traffic is measured in the millions+ of transactions per day. > All four real messages would > come into the remailer encrypted to the remailer and addressed to the > remailer. My thought was that fake outgoing messages to the nym would look > identical to real messages, thereby helping obscure the "mix" just a little > better. This helps hide the identity of the sender of the email that is > headed to a nym. All the outgoing traffic better look the 'same' it's nothing but a standard TCP/IP routing header and the contents (which we never look at). The remailer software is irrelevant on this issue. Traffic analysis relies on the stability of the protocols and their source & destination info not what they are used for. As for the rest of it, take the equation I gave in a previous email and feed it into a spreadsheet. Develop the equations that define the network using the same sort of structures and proceedures you use for a travelling salesman problem (check a local library). If you're asking me to do that work then I need money, I'll talk about work for free - I don't do work for free. > email. The remailer keeps this info in an internal database (as it must) > and is not available to anyone other than the remailer software. The remailer only needs records of transactions while a transaction remains un-committed. The only long term record it should keep is the number of transactions processed and how much money is currently on the books. The records are not available unless somebody cracks the box and begins to tool around the OS ... Mallet is pretty sneaky he reads CERT and collects hacker software too. If your remailer is keeping records of transactions after the transactions close you are not secure. You are actualy providing further incentive to Mallet. > Having just spent a year and a half involved in a federal court case over > the 1st amendment right to anonymity on the net, and winning, I'd have to > disagree with you here. Our affidavit specifically mentioned remailers, > among other things. Just exactly where is anonymity mentioned in the 1st? And since it clearly is not how do you extend: ARTICLE I. Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances. Is your claim that the remailer is a press? (I rhetoricaly bet not) If so then every computer irrespective of use is a press and protected. Are you going to follow this line in future cases? Or is your argument that the traffic is speech and therefore the carrier of the traffic is immune to prosecution? If so you may have some problems in the future when the judges and prosecutors get a better clue. Because the 1st's speech clause protects the source of speech not the carrier - that's why the founding fathers specificaly mention freedom of the press - to extend that protection to the carrier. Or did you use the commen-carrier approach? My money is that you used the second line of reasoning which means you can expect it to be over-turned in the coming years. Unless somebody manages to get a court to recognize computers as presses and extend those protections fully or networked computers (not the applications they are put to) in general as commen-carrier the battle isn't over. Now if you throw the 9th and 10th in there (which I further rhetoricaly bet you didn't) you got a winning combo. Rhetorical question: do you realize that all networked computers are remailers at the routed level? Did you extend your argument thusly? ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From minow at apple.com Fri Oct 3 08:00:59 1997 From: minow at apple.com (Martin Minow) Date: Fri, 3 Oct 1997 23:00:59 +0800 Subject: New PGP "Everything the FBI ever dreamed of" Message-ID: An article in today's (Fri, Oct 3) New York Times (CyberTimes) describes the new release of "PGP for Business Security 5.5," which contains mechanisms that incorporate key recovery mechanism that can either be volontary or be enforced by using PGP's software for controlling a company's SMTP server -- the server can verify that all encrypted messages include the corporate public key (or conform to other corporate policies): "The new version also includes some of the most sophisticated techniques for enforcing this policy through the corporation. The most novel may be a new version of software controlling a company's SMTP server, the machine that acts as the central mailroom for a corporation. PGP provides a software agent that will read all of the mail to make sure that it complies with the corporate policy. This may include requiring all messages to be signed with digital signatures or include a backdoor that the management can use to read the message. If the software agent discovers a message violates the policy, it can either return it to sender or simply log a copy. "PGP implements the backdoor with a central key. Each message is encrypted with both the public key of the recipient and the public key of the management. The message can only be read by someone holding the corresponding private keys, in this case the recipient and the management. The software allows the management to use different master keys for different departments by customizing the software. ... "Bruce Schneier, an encryption expert and author of the popular book Applied Cryptography, said that the new announcement "sounds like everything the FBI ever dreamed of." He also predicts that criminals will find ways to circumvent the restrictions while honest people may be more vulnerable to illicit use of the master key." --- Coincidently, the same issue of the New York Times has an editorial attacking FBI director Louis Freeh's request that Congress "outlaw the manufacture and distribution of encryption programs the Government cannot instantly crack. Martin Minow minow at apple.com From stutz at dsl.org Fri Oct 3 08:04:00 1997 From: stutz at dsl.org (Michael Stutz) Date: Fri, 3 Oct 1997 23:04:00 +0800 Subject: Crowds as an anonymous remailer In-Reply-To: Message-ID: On the subject of Crowds (), a distributed system for anonymous Web browsing, I was wondering if anyone knew of any attempts or efforts to create a decentralized remailer network in the same manner -- can such a thing be done, and be useful? Such a system might work quite like Crowds (or could even be a subset of Crowds itself, or based on it, as the source is available), with a small "jondo" program running on each host in the remailer network. To send an anonymous message you must be running a jondo, hence you are part of the network. The jondo takes your message, encrypts and randomly forwards it to any jondo in the network, which then either re-forwards it to another jondo or its final destination. There is no way for the recipient to know who the original sender was other than that sender was part of the crowd running the jondos, and there is no central remailer machine to target since the "remailer" consists of a network of machines running these jondos. As members increase, the network performance as well as the degree of anonymity increases (imagine, for instance, if such a program came with Linux as a standard part of the OS). m email stutz at dsl.org Copyright (c) 1997 Michael Stutz; this information is free and may be reproduced under GNU GPL, and as long as this sentence remains; it comes with absolutely NO WARRANTY; for details see . From anon at anon.efga.org Fri Oct 3 09:31:14 1997 From: anon at anon.efga.org (Anonymous) Date: Sat, 4 Oct 1997 00:31:14 +0800 Subject: legal question of DSA-based signatures? Message-ID: <7d2e0ce68df7b504bbaa2caf842eb8f4@anon.efga.org> I have before me a statement made by Information Security Corp.: "The Comptroller General has ruled that, for the purposes of electronic commerce, DSA-based digital signatures are as legally binding as hand- written signatures." Can anyone verify this? From alan at ctrl-alt-del.com Fri Oct 3 10:00:48 1997 From: alan at ctrl-alt-del.com (Alan) Date: Sat, 4 Oct 1997 01:00:48 +0800 Subject: Stronghold In-Reply-To: <199710021247.OAA00552@basement.replay.com> Message-ID: <3.0.3.32.19971003094023.0352ea6c@ctrl-alt-del.com> At 10:45 AM 10/2/97 EDT, Dr.Dimitri Vulis KOTM wrote: >> Amazingly, C2Net doesn't like to see its product publicly slandered >> by reptiles like Vulis. If Vulis' opinion were based on anything >> other than personal ill will - ie, if he had ever actually downloaded >> and examined Stronghold and found any problems with it - he would have >> a leg to stand on. As it is, his allegations are completely unfounded. > >If this were true, then C2Net would encourage me to publicly present whatever >"evidence" I have so they'd be able to refute it. This is not what they >asked me to do. But it is what you *SHOULD* do. If you have evidence, then present it. If not, then you are just blowing smoke and FUD. C2Net should have demanded proof instead of getting defensive. That worries me, not because of "hidden backdoors", but because it shows lack of confidence in their own products. But lack of confidence has nothing to do with actual strength of the product. >> > Please keep this in mind if you consider buying it. >> >> Keep in mind that anything Vulis says is in all likelihood a complete >> lie. > >Keep in mind that "anonymous" is probably an employee of C2Net. Several of >C2Net's shills used to post C2Net propaganda withouy revealing their C2Net >affiliation; they switched to anonymous remailers when their nyms were exposed. Well, I am *NOT* an employee of C2Net. Put up or shut up. If you have evidence, then show it. This "stronghold is weak" rant sounds much like the Creationists on talk.origins. They make pronouncements and then expect others to disprove them. The real world does not work like that. (I guess they do not teach the scientific method at any school you have ever attended. Or maybe you just skipped class...) I personally think the reason you do not show it is because you do not HAVE any evidence. You have lied about people to justify your petty little hatreds before. (Accusing people you do not know of child mollestation is an old favorite of yours.) This one seems to fall into that category as well. If you do have evidence and refuse to post it, then you are just helping C2Net. --- | "That'll make it hot for them!" - Guy Grand | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano at teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan at ctrl-alt-del.com| From declan at well.com Fri Oct 3 11:05:25 1997 From: declan at well.com (Declan McCullagh) Date: Sat, 4 Oct 1997 02:05:25 +0800 Subject: Netly News special report: "The Privacy Snatchers" Message-ID: Recently the FBI has started to demand a creepy new anti-privacy law. It requires that all future technologies -- from cell phones to WordPerfect -- include a kind of electronic peephole to let law enforcement agents snoop through your private files and communications without your knowledge or permission. One House committee has already approved the FBI's bill. Such easy access is the fantasy of every unethical policeman and corrupt bureaucrat. Now, the police say they'll never peek through this peephole without a judge's approval. But history reveals that time and again, the FBI, the military and other law enforcement organizations have ignored the law and spied on Americans illegally, without court authorization. Government agencies have subjected hundreds of thousands of law-abiding Americans to unjust surveillance, illegal wiretaps and warrantless searches. Eleanor Roosevelt, Martin Luther King, feminists, gay rights leaders and Catholic priests were spied on. Even Supreme Court justices were monitored. Can we trust the FBI? Visit the Netly News for a special report on The Privacy Snatchers: http://cgi.pathfinder.com/netly/opinion/0,1042,1466,00.html -Declan ------ http://cgi.pathfinder.com/netly/opinion/0,1042,1466,00.html The Netly News (http://netlynews.com/) October 3, 1997 The Privacy Snatchers By Declan McCullagh (declan at well.com) ------ ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ From anon at anon.efga.org Fri Oct 3 11:13:56 1997 From: anon at anon.efga.org (Anonymous) Date: Sat, 4 Oct 1997 02:13:56 +0800 Subject: Stronghold Message-ID: <7b12b2df380aa9e3ba09439e3676b9b1@anon.efga.org> Jeff Barber writes: > This is revisionist history. I can't recall any intimation at the > time that any messages were filtered from the unfiltered list. There were three lists. The unfiltered list did not go through the moderator's hands in any way and continued to received all messages (which is how unfiltered subscribers found out about the problem). The filtered list had the posts approved by the moderated. Then there was supposed to be a "flames" list where the moderator sent posts he had rejected. In theory, the moderated+flames lists should have the same contents as the unfiltered list. Here is the original statement by the moderator laying out his policy: > 3) Cypherpunks who wish to read all posts to the list may do so > by taking advantage of either of two optional lists. The first > (cypherpunk-flames at toad.com), will consist solely of messages > expurgated from the main Cypherpunks list. (Those who subscribe > to "flames" will be able to easily monitor my moderating > decisions.) The second (cypherpunks-unedited at toad.com), will > contain all posts sent to Cypherpunks. It will be the equivalent > of the current open, unmoderated list. It will appeal to those > who don't want list moderation. > > 6) Because every message submitted to Cypherpunk will be posted > to two of the three sister lists, I don't intend to lose much > sleep over whether or not this or that moderating decision was > perfect. I will do the best job I can, within the constraints > listed here. If I err, it isn't fatal. Everyone who wants one > will have two Cypherpunk venues for their posts. Sounds fair > enough to me. What do you think? Here is a message from a pseudonymous poster laying out what actually happened. Many list members may not have seen this message, unless they were subscribed to the unfiltered list. > Well, as it turns out, a number of messages have made it neither to > cypherpunks nor to cypherpunks-flames. Making matters worse, however, > not only are certain messages being suppressed from both lists, but > even messages mentioning that fact get suppressed from both the > cypherpunks and the cypherpunks-flames lists! and here is a letter to him from the moderator, confirming this fact: > Hi, > > On 7 Feb 1997, Against Moderation wrote: > > > What I object to more strongly and think is wrong is the > > fact that it went to *neither* list. > > Unfortunately, it's not as simple as that. As soon as I can > arrange it with John, I am going to stop moderating the list. > In the interim, I *will not* be sending your post onto either > the Flames or the Moderated lists. This is done for legal > reason. As it is, you have already published a libel on the > unedited list by repeating Dimitri's libel. This exposes you to > legal liability, but as an anonymous poster, you are somewhat > insulated from the consequences of your act. In sum, no messages were filtered from the unfiltered list, which is how cypherpunks who avoided moderation learned of the situation. The messages were eliminated from the regular (moderated) list, but they were not sent to the "flames" list, contrary to the stated policies. No hint was given to the subscribers to the moderated list, which was the majority, that this was being done. Messages referring to these facts were also filtered. A sad episode indeed. From pooh at efga.org Fri Oct 3 11:25:56 1997 From: pooh at efga.org (Robert A. Costner) Date: Sat, 4 Oct 1997 02:25:56 +0800 Subject: legal question of DSA-based signatures? In-Reply-To: <7d2e0ce68df7b504bbaa2caf842eb8f4@anon.efga.org> Message-ID: <3.0.3.32.19971003133109.03358310@mail.atl.bellsouth.net> At 12:17 PM 10/3/97 -0400, Anonymous wrote: >I have before me a statement made by Information Security Corp.: > >"The Comptroller General has ruled that, for the purposes of electronic >commerce, DSA-based digital signatures are as legally binding as hand- >written signatures." > >Can anyone verify this? My first thought is.. which country are you talking about? The question is a complex one. The first question is, what is meant by a signature? Courts have rules that valid signatures include and "X", spitting on the document, and signing "Mickey Mouse" (an actual case). Even a "/s" at the end of a document would constitute a signature. The second question is of more concern. Signatures are linked in law to "writings." In order to consider a digital signature, you must first define the concept of a "writing." Is electronic mail or an electronic document a writing? Is a facsimile copy a writing? Recently, a US based state level supreme court ruled that faxes were not writings, but rather were "beeps and chirps". Since faxes are not writings, a faxed signature was ruled to not be a valid signature anywhere within the state. This is a problem that digital signature law must consider. How to make an electronic document a writing. Currently states are doing so by passing laws that explicitly define electronic documents as writings. -- Robert Costner Phone: (770) 512-8746 Electronic Frontiers Georgia mailto:pooh at efga.org http://www.efga.org/ run PGP 5.0 for my public key From declan at well.com Fri Oct 3 13:03:34 1997 From: declan at well.com (Declan McCullagh) Date: Sat, 4 Oct 1997 04:03:34 +0800 Subject: Anne Wells Branscomb and other information Message-ID: Anne Wells Branscomb has died. She was 68. A longtime communications and computer lawyer, she significantly shaped the world of information and Net-policy. (I met her once, at a Computers Freedom and Privacy conference.) Her short biography is at: http://www.ngi.org/AWB/ On a different note, congratulations to: * Solveig Singleton, the new director of information studies at the Cato Institute. * Bruce Schneier and EPIC's Dave Banisar, for their book released last month, "The Electronic Privacy Papers." * EPIC's Marc Rotenberg and Phil Agre, for their book released this month: Technology and Privacy: The New Landscape, edited by Philip E. Agre and Marc Rotenberg (Cambridge: MIT Press, 1997). * Bob Palacios, former webmaster for the Center for Democracy and Technology, who's moving on to a new job at a Rockville, MD software company. (I understand CDT needs a new webmaster.) Also, I hear the Competitive Enterprise Institute, a free-market thinktank in Washington, DC, is looking for a full-time analyst to do Internet policy work for them. Stuff like privacy, Net-regulation, free speech. Email me for contact info. -Declan ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ From rah at shipwright.com Fri Oct 3 13:45:07 1997 From: rah at shipwright.com (Robert Hettinga) Date: Sat, 4 Oct 1997 04:45:07 +0800 Subject: legal question of DSA-based signatures? Message-ID: --- begin forwarded text X-Sender: kaye at popd.ix.netcom.com Mime-Version: 1.0 Date: Fri, 3 Oct 1997 12:18:36 -0700 Reply-To: Digital Signature discussion Sender: Digital Signature discussion From: Kaye Caldwell Subject: Re: legal question of DSA-based signatures? To: DIGSIG at VM.TEMPLE.EDU The document to which this refers is posted at: http://www.softwareIndustry.org/issues/docs-org/cg-opinion.pdf At 01:23 PM 10/3/97 -0400, you wrote: >I think I already know the answer to this, but it might be fun to have the >word with the bark on it... > >If you reply to this, I'll pass it on to the cypherpunks list. > >Notice that the question comes through an anonymous remailer. > >Cheers, >Bob Hettinga >--- begin forwarded text > > >Date: Fri, 3 Oct 1997 12:17:32 -0400 >From: Anonymous >Comments: This message was remailed by a FREE automated > remailing service. For additional information on this service, > send a message with the subject "remailer-help" to > remailer at anon.efga.org. The body of the message will be > discarded. To report abuse, contact the operator at > admin at anon.efga.org. Headers below this point were > inserted by the original sender. >Subject: legal question of DSA-based signatures? >To: cypherpunks at cyberpass.net >Sender: owner-cypherpunks at cyberpass.net >Precedence: bulk >Reply-To: Anonymous >X-Loop: cypherpunks at cyberpass.net > >I have before me a statement made by Information Security Corp.: > >"The Comptroller General has ruled that, for the purposes of electronic >commerce, DSA-based digital signatures are as legally binding as hand- >written signatures." > >Can anyone verify this? > >--- end forwarded text > > > >----------------- >Robert Hettinga (rah at shipwright.com), Philodox >e$, 44 Farquhar Street, Boston, MA 02131 USA >"... however it may deserve respect for its usefulness and antiquity, >[predicting the end of the world] has not been found agreeable to >experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' >The e$ Home Page: http://www.shipwright.com/ >Ask me about FC98 in Anguilla!: > > --- end forwarded text ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: From devnull at bureau42.ml.org Fri Oct 3 13:45:18 1997 From: devnull at bureau42.ml.org (Anonymous (via bureau42 remailer)) Date: Sat, 4 Oct 1997 04:45:18 +0800 Subject: C'Punk Action Project - Help the Newbie Message-ID: A Law Abiding Citizen wrote: > > I'm new to encryption, having just purchased PGP. I want to abide by > the law, but I don't know who to send a copy of my secret key to. We need to compile a list of people that law-abiding citizens can send copies of their secret keys. I will start the list with those that the LAC has already mentioned. Surely other C'punks will have their own nominees for this position of supreme trust. 1. The FBI guy who shot Randy Weaver's wife. 2. The FBI guy, Kahoe, who ordered evidence of the FBI murder of citizens destroyed. 3. One of the other four top FBI officials who helped with the cover-up? 4. Your drug drug dealer, to pass along to his CIA connection. 5. A Jewish person, to give to the Mossad, to pass on to the CIA. 6. The NYC cop with the toilet plunger in his hand. From declan at well.com Fri Oct 3 14:05:43 1997 From: declan at well.com (Declan McCullagh) Date: Sat, 4 Oct 1997 05:05:43 +0800 Subject: Note to cypherpunks in Chile Message-ID: Next week I'll be speaking at REUNA-InternetWorld'97 in Santiago, Chile, staying at the Hotel Plaza San Francisco. I'd love to meet anyone who wants an update on U.S. Net-politics (or vice versa). -Declan ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ From thorel at netpress.fr Fri Oct 3 14:21:52 1997 From: thorel at netpress.fr (Jerome Thorel) Date: Sat, 4 Oct 1997 05:21:52 +0800 Subject: D. DENNING's report Message-ID: A non-text attachment was scrubbed... Name: not available Type: text/enriched Size: 513 bytes Desc: not available URL: From nobody at REPLAY.COM Fri Oct 3 14:21:56 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sat, 4 Oct 1997 05:21:56 +0800 Subject: Guilt Message-ID: <199710032110.XAA00881@basement.replay.com> -----BEGIN PGP SIGNED MESSAGE----- Anonymous wrote: >Alex Le Heux wrote: >Anonymous wrote: >>Let's also take a look at the Dutch performance during their >>occupation. While there certainly were many courageous Dutch people >>who helped refugees (at great personal risk, to say the least), and >>there were many courageous Dutch people who were in the resistance, >>there were also many Dutch people who did not perform so well. Not >>only were a large number of Jewish people turned in by Dutch >>informers, but there were even Dutch SS units. > >You have a nerve. You, coming from a country where people are still >regularly killed in the name of racism, tell me this?! >Alex >------------ >The Same Old Guy replied: > >Want the cold, hard facts of life, Bubba? >You didn't put WWII 'behind' you. We did! >Gun-loving Americans conquered your continent and gave you your >countries back instead of enslaving you, like every other winner in >history has done. > >*** Certified Low Blow *** >Some of us discriminate against Jews. Do you know why? >Because we HAVE some! >*** Certified Low Blow *** > >We were giving them refuge while Europe was massacring them by the >millions. Now you have the balls to say we're not all treating them >right all of the time. >Buy a fucking clue! Monty Cantsin is feeling a bit guilty about starting this. While there is some value in taking the smug Europeans down a few notches, it is beginning to look as if some Americans need to be taken down a few notches as well. "The Secret War Against the Jews: How Western Espionage Betrayed the Jewish People" by John Loftus and Mark Aarons. Pages 49-50: "In 1943 the Holocaust was in full operation, but in April of that year in Bermuda, a conference of British and American officials formally decided that nothing should be done about it. They 'ruled out all plans for mass rescue.' The British Foreign Office and the U.S. State Department were both afraid that the Third Reich would be quite willing, indeed eager, to stop the gas chambers, empty the concentration camps, and let hundreds of thousands, if not millions, of Jewish survivors emigrate to freedom in the West. The Foreign Office 'revealed in confidence' to the State Department its fear that Hitler might permit a mass exodus. If approaches to Germany to release Jews were 'pressed too much that is exactly what might happen.'[46] "The bigoted reality behind the Secret Report of the Easter 1943 Bermuda Conference was that not a single Allied nation wanted to let teh Jews settle in its country. The unspoken consensus was that it was better to let Hitler handle them than arrange a mass evacuation to the United States, England, or Canada. In short, the Jews were expendable to the war effort.[47] Only after the war was it confirmed that a rescue operation to the Nazi concentration camps could have been successful. 'Marshal of the RAF Sir Arthur `Bomber` Harris declared afterwards that a rescue plan was `perfectly feasible, but I was never asked to undertake it.`'[48] "No one campaigned to rescue the Jews because the leaders of the Western nations had deliberately withheld the truth about the Holocaust from their own citizens. After verification by each of the Allied intelligence services, the body counts of murdered Jews were quietly classified as early as September 1941." Pages 70-71: "Ibn Saud had no intention of ever letting a single Jew emigrate to Palestine. President Roosevelt discovered this for himself, but too late. "In February 1945, just before he died, President Roosevelt personally met Ibn Saud. He attempted to enlist the king's support for the Zionist solution, but Ibn Saud firmly rejected the idea, instead suggesting that the Allies should give 'them and their descendants the choicest lands and homes of the Germans who oppressed them' or that the Allied countries take in the Jews themselves.[57] "The king's vehement opposition to Jewish migration was a bit of a shock to Roosevelt, who was strongly sympathetic to the Zionist cause. Yet none of the Western nations was ever prepared to take more than a handful of Holocaust survivors. As one book showed, the Canadian policy was 'none is too many.' The king seemed to recognize this, and he reminded Roosevelt that Palestine had already taken 'its fair share of refugees from Europe.' "Suddenly the president's sympathy for the Jews was wavering. He told Ibn Saud that 'he would do nothing to assist the Jews against the Arabs and would make no move hostile to the Arab people.' Roosevelt's new policy was to be netural, but neutral in favor of the Arabs.[58] It was an uncomfortable lesson for the ailing president. The choice seemed clear enough. The United States could help the Jews found their home in Palestine, or it could have Saudi Arabia's oil as the engine room for postwar dominance. It seemed to Roosevelt that could not have both. He chose oil." Footnotes, Chapter 2: [46] David Wyman, "The Abandonment of the Jews" (New York: Pantheon, 1984), p. 342 [47] For accounts of the official policies of the various Allied governments, see Walter Laqueur, "The Terrible Secret" (London: Weidenfeld & Nicolson, 1981); and Martin Gilbert, "Auschwitz and the Allies" (London: Michael Joseph/Rainbird, 1981). [48] Ricahrd Deacon, "The Israeli Secret Service" (London: Sphere, 1979), p. 29. Footnotes, Chapter 3: [57] The king's ". . . firmness disconcerted Roosevelt, who seems to have believed a few hours' personal chitchat and some lavish Lend-Lease assistance would win the King of Arabia to his purpose. "The president tried another tack. He was counting on the legendary hospitality of the Arab, he said, to help solve the problem of Zionism. But [the king] did not see why the Arabs of Palestine should feel especially hospitable towards the Jews. "'Make the enemy and the oppressor pay,' he said; 'that is how we Arabs wage war.' "It was not the Arabs of Palestine who had massacred the Jews. It was the Germans and, as 'a simple bedouin,' the Sa'udi king could not understand why the president seemed so eager to save Germany from the consequences of its crimes. . . ." Kelly, "Arabia, the Gulf and the West" (New York: Basic Books, 1980), pp. 271-272. [58] Returning to Washington, a chastened Roosevelt told Congress that "from Ibn Saud, of Arabia, I learned more of the whole problem of the Moslems and more about the Jewish people in 5 minutes than I could have learned by the exchange of a dozen letters." Ibid., p. 272. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDVRD5aWtjSmRH/5AQGxqgf+Mc4zodAP9o7ymAVZpslQbrI+EuZhqhqA Wp86+KRsihdDU67YsqlEFAUz8gZXVeWsx7yJEIf94byDlP2BkeZoXhTaafrOpsne yj8tlpjhgVgFJopM3FX8PmNHK0YHrGdv7O2G+2k02z6B9jlDIv3VXbcvleX2O0iW 1o7syi6sUE9yt9ZozQS8H4AQZypPxg0OmkY/O0WunyXGOZJcSWthCgomwNAt/tz6 OBzj7csVq1lw4/+yUegEQmsimWSy+Q88HJeuiS5jJH3/jiNCaIStsBLBMYv+ql0X 7aNK7F48ckoVbC/OC5QobH2ELYs56BjqZ3N2yRnuOudhtVUO/b8Iqw== =QySR -----END PGP SIGNATURE----- From jim.burnes at n-o--s-p-a-m.ssds.com Fri Oct 3 14:27:16 1997 From: jim.burnes at n-o--s-p-a-m.ssds.com (Jim Burnes) Date: Sat, 4 Oct 1997 05:27:16 +0800 Subject: C'Punk Action Project - Help the Newbie In-Reply-To: Message-ID: <199710032105.PAA07558@denver.ssds.com> > Date: Fri, 3 Oct 1997 16:18:53 GMT > From: Anonymous (via bureau42 remailer) > Subject: C'Punk Action Project - Help the Newbie > To: cypherpunks at toad.com > A Law Abiding Citizen wrote: > > > > I'm new to encryption, having just purchased PGP. I want to abide by > > the law, but I don't know who to send a copy of my secret key to. > > We need to compile a list of people that law-abiding citizens can send > copies of their secret keys. > I will start the list with those that the LAC has already mentioned. > Surely other C'punks will have their own nominees for this position > of supreme trust. > > 1. The FBI guy who shot Randy Weaver's wife. > 2. The FBI guy, Kahoe, who ordered evidence of the FBI murder of > citizens destroyed. > 3. One of the other four top FBI officials who helped with the > cover-up? > 4. Your drug drug dealer, to pass along to his CIA connection. > 5. A Jewish person, to give to the Mossad, to pass on to the CIA. > 6. The NYC cop with the toilet plunger in his hand. > 7. How about the hit sqaud (from BATF, DEA, Border Patrol, Forest Service, etc [I'm not kidding]) who killed Donald Scott in Orange County because they wanted his primo land surround by national forest. Crufted some excuse about pot on his land. No pot, but when they forcibly entered early in the morning and accosted his wife, they shot him when he tried to protect her. The local DA said they lost their "moral compass". 8. The military guys who killed the shepard in Texas. 9. The police chief currently Wacoizing an elderly woman cuz she refused to be hauled off (for psychiatric treatment) and sacrifice her land to the hungry wolves waiting to sell it off. 10. The wonderful people who organize the presidential debates which denied the libertarian cadidate (on the ballot in all 50, before Perot) participation in the debates. When libertarians peaceably assembled at the debate site they were cordoned off by SS in black ninja suits, MP5 submachine guns and german shepards. Local police then descended on one of the libertarians taking pictures and beat him senseless, saying "we know what your up to!". I guess he was trying to excercise his right to disagree with fascism. (personally witnessed this one and got it on hi-q video). Little to no news coverage. 11. Any number of participants at Waco. 12. We could just go on and on.... Jim Burnes Engineer, Western Security, SSDS Inc jim.burnes at ssds.com ---- Sometimes it is said that man cannot be trusted with the government of himself. Can he, then, be trusted with the government of others? Or have we found angels in the forms of kings to govern him? Let history answer this question. -Thomas Jefferson, 1st Inaugural Addr From wfgodot at advicom.net Fri Oct 3 14:49:26 1997 From: wfgodot at advicom.net (Michael Pierson) Date: Sat, 4 Oct 1997 05:49:26 +0800 Subject: Freedom of Encryption: Is it SAFE? Message-ID: <199710032138.QAA29873@vespucci.advicom.net> -----BEGIN PGP SIGNED MESSAGE----- There has been much discussion recently concerning how to fix certain flaws, or block various amendments in encryption legislation being shepherded through Congress. A far more fundamental problem with these legislative efforts from the beginning was that they involved an implicit concession to the idea that a U.S. citizen's freedom to privately exchange information in whatever coding scheme he or she might choose required some kind of government affirmation or ratification as validation. Once one seeks for the government's deigning to "affirm the rights of United States persons to use and sell encryption", it can (and does) then easily proceed to attach conditions and caveats to these "affirmed" rights. In the process the surveillance hawks within the government have managed, with hardly any struggle, to advance the appearance of legitimacy for their claims of authority to regulate this form of expression. Now comes an expectation that the nature of these "affirmed rights" should be tailored to address "the concerns of national security and the federal law enforcement community." This same community has on occasion complained about how their efforts to fight organized crime and terrorism are being thwarted by not having the modern newspeak disguised equivalent of "Writs of Assistance" (and they are arguably making progress toward acquiring just such powers IMO). Very few politicians are willing to commit the heresy of clearly and staunchly asserting that the information coding methods used by citizens are under no obligation to pass any litmus test, or to be subject to any kind of prior approval or restraint determined by criteria of the law enforcement establishment or anyone else. If the Feds lament that this will make their job harder, too bad. In the words of Orson Welles: "Only in a police state is the job of a policeman easy." When these various legislative efforts attempted to reach beyond the issues of export restrictions to address those of domestic use, they became a doubtful and dangerous fix to something that wasn't broke in the first place. If the Government is intent on "abridging the freedom" to use strong encryption domestically, a legislative affirmation of these rights is feeble comfort at best. If I'm seeking to protect my possessions, I don't ask a thief to affirm my property rights. Of course, even the export question is really about the aims of the state's surveillance constituency to obstruct the wide deployment of strong encryption domestically, and its interoperability on the internet as a whole. Challenging the derisible bogosity of the "preventing the Evil Ones from acquiring this technology" rationale that is invoked to justify these restrictions was not something legislation was likely to do with any great vigor. Legislation to "relax" these restrictions involves lending credence to the dubious assumption that these restrictions had any constitutional validity to begin with. Any bill that would have truly provided for the statutory endorsement of the acceptably uncompromised use of strong encryption never really had much more than a snowball's chance in hell of actually being signed into law given the current political balance of power, did it? Far more likely, was that it could be corrupted and hijacked as a vehicle to further the very type of restrictions it was purportedly intended to relieve. A collateral consequence is an increased arrogance and presumption among lawmakers that it is their prerogative to act to define for us citizens, what freedoms for domestic use of encryption we should be permitted. The growing gallery of GAK amendments and competing legislative proposals now emerging appears to support this sad scenario. It's starting to look like the prospects for meaningfully improving the situation with encryption legislation in the current political environment were about as promising as the prospects of a neophyte gambler coming out ahead at a crooked casino. I expect any apparent winnings in the end will come with a catch between the lines in the fine print, if they come at all. In any case, whatever is legislatively affirmed can later be legislatively denied. What a King presumes is his to grant, he usually presumes is his to revoke as well. In the end, what will have really been gained by this legislative venture, and what will have been explicitly or implicitly surrendered? As I see it, at this point the issue isn't about counting wins, it's about cutting losses. Freedom of encryption.... Is it SAFE? I don't think so. - -Michael -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: noconv iQCVAwUBNDVks9GJlWF+GPx9AQGctwQAlE+SKB3/rqG7kz3qdcF2I5eBedz3/DDK f5Vg0Zd8PbhowwT9gWAvyt+ysIZCqRJWMu3vPmWP2iN2ZghLaiGRVv8piXhyUQYl rhv/rOz1Yc1raJbU5Wk+9Qr9zxQqxHZiAk1G0Irye4yDfi72ar8ndD5CqUegBnaF QAoyFGtiJZ4= =2zJO -----END PGP SIGNATURE----- From anon at anon.efga.org Fri Oct 3 15:20:37 1997 From: anon at anon.efga.org (Anonymous) Date: Sat, 4 Oct 1997 06:20:37 +0800 Subject: Stronghold Message-ID: At 09:40 AM 10/3/97 -0700, Alan wrote: >At 10:45 AM 10/2/97 EDT, Dr.Dimitri Vulis KOTM wrote: > >>> Amazingly, C2Net doesn't like to see its product publicly slandered >>> by reptiles like Vulis. If Vulis' opinion were based on anything >>> other than personal ill will - ie, if he had ever actually downloaded >>> and examined Stronghold and found any problems with it - he would have >>> a leg to stand on. As it is, his allegations are completely unfounded. >> >>If this were true, then C2Net would encourage me to publicly present whatever >>"evidence" I have so they'd be able to refute it. This is not what they >>asked me to do. > >But it is what you *SHOULD* do. If you have evidence, then present it. If >not, then you are just blowing smoke and FUD. While it is true that Dmitri is a proven liar in the grand tradtion of the Soviet Union (shout a lie long enough and loud enough and eventually some people will start to believe it), and a pathological homophobic bigot (who secretly enjoys sucking cock but wears womens clothing to disguise himself), he was absolutely right in decrying the moderation experiment that was thrown at the list earlier. Sandy did drop his C2 rantings from both moderated and flames lists, because he considered them libelous. That's a line of bullshit -- it wasn't for him to decide libel or not. It's for a jury to decide. Sandy wouldn't have been held responsible in either case because he could have hidden behind the "ISP protection" clause of the CDA. As a moderator who was tasked with spreading the bullshit in one of two places, he simply could have thrown it to either of the lists and claimed it was his duty as moderator to put it out. Of course, by that time Dmitri had so little reputation capital that Gilmore patched Majordomo so it wouldn't even respect a subscription request for him. Dmitri's allegations shouldn't even have gone to the flames list -- they should have gone to the moderated list. If Stronghold has a weakness, or even a perceived weakness, it's crypto relevant. But, when Dmitri writes anything, he's got to attach a "cocksucker this" or "molester that", which makes everything he writes libelous. So, even if he had proof that Lying Fuck Freeh were a axe-murderer, he'd fuck it up and call him "Louis Freeh (cocksucker)", which would continue to throw his credibility down the toilet. Ultimately, Dmitri's allegations of weaknesses in Stronghold, true or not, are totally irrelevant. Without mathematical proof of a weakness, he simply cannot be believed to ever be telling the truth. So, if C2 said to him in private e-mail, "if you call Sameer a cocksucker one more time, we'll slap a libel suit across your emigrant ass, take back your green card, deport you and tell Russia that you called Yeltsin a cocksucker," well, I can understand why he shut up. Actually, I don't think Dmitri knows of any real weaknesses. As I recall, I think he made up some fictitious homosexual connection between Sameer and a law-enforcement agent and suggested that there was a "back door" in Stronghold (pun intended.) Of course, I didn't archive any of his spew from back then. Nobody did, he raved so long and loud at the moderation and Gilmore and everybody that it was all my delete key could do to keep up with his shit. So, don't hold your breath waiting for a repost of previous lies from our dear Kook of the Fucking Century. He might get caught, so he's moved on to new lies now. Cannonymous From eb at comsec.com Fri Oct 3 16:52:34 1997 From: eb at comsec.com (Eric Blossom) Date: Sat, 4 Oct 1997 07:52:34 +0800 Subject: Secure phone In-Reply-To: <3.0.3.32.19971002155954.00bfc7e0@labg30> Message-ID: <199710032326.QAA19691@comsec.com> >The MITM attack is thwarted by Lucky's note: >>> DH and have the parties each read half of a hash of the public > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >>> exponentials. No keys to store, no keys to remember, no keys to compromise. > ^^^^^^^^^^^^^ > >Each party reads off a series of digits displayed on their screen. Out >loud. To each other. Over the secure phone. > >The MITM attacker can't duplicate the hash on both ends, because a hash of >the public keys used to make the connection are different between the >MITM's public key and the real public keys. In addition, to keep life even more interesting, prior to exchanging the public exponentials g^x and g^y, commitments (hashes) to those values are exchanged... If the commitments don't match the final values, the protocol terminates. See http://www.comsec.com/vp1-protocol.ps for all the details. Eric From dlv at bwalk.dm.com Fri Oct 3 17:22:21 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Sat, 4 Oct 1997 08:22:21 +0800 Subject: C'Punk Action Project - Help the Newbie In-Reply-To: Message-ID: Anonymous (via bureau42 remailer) writes: > 6. The NYC cop with the toilet plunger in his hand. This would make a nice GAK icon... (Bloody) blunger in one hand, keys or an oversized telephone received in the other. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From ghio at temp0126.myriad.ml.org Fri Oct 3 18:06:08 1997 From: ghio at temp0126.myriad.ml.org (Matthew Ghio) Date: Sat, 4 Oct 1997 09:06:08 +0800 Subject: Quor's cipher In-Reply-To: <199710022135.WAA02655@notatla.demon.co.uk> Message-ID: <199710040102.VAA21655@myriad> > Antonomasia wrote: > > > My attack takes a long chunk of known text and looks for repetition. > > > > ppppppppppppppp.11.pppppppppppppppppppppp > > ccccccccccccccc.22.cccccccccccccccccccccc > > > > When a two neighbouring p-c pairs are the same you can test > > whether they have the same value of a and b. > > (That is a_n == a_n+1 and b_n == b+n+1, a != b usually.) > > > > This involves 16 inputs to each byte - very cheap. > > What I really want next is to know "a". > > > nobody at REPLAY.COM wrote: > > > Wouldn't this only happen (on average) in one out of every 65536 p-c > > pairs? > > Yes (counting only those we test). > > > Since the state array is changed entirely with every 128 bytes > > encrypted, 1 out of 2^16 doesn't seem to help much. > > This finding doesn't uncover a great deal, I agree, and what it does > uncover is transient. What about this: If (a+b)^(a0+b0) == 0, then the plaintext is the same as the ciphertext. This happens for one out of every 256 bytes. Ordinarilly this isn't a problem, but if the key is reused, and there is no IV, it can leak a byte of plaintext. So it seems that you would need to change the key for each message, or at least use a random initialization vector. From stewarts at ix.netcom.com Fri Oct 3 20:38:46 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Sat, 4 Oct 1997 11:38:46 +0800 Subject: commercial remailers and anonymous customers In-Reply-To: <199710030225.VAA28934@einstein.ssz.com> Message-ID: <3.0.3.32.19971003103708.0069ee68@popd.ix.netcom.com> >> When all your customers are anonymous, you don't get to be very choosy. Sameer's C2.Net used to be an ISP business, providing privacy services, and he found that enough of his anonymous customers were problem customers that it was a real pain to support. Similarly, remailer operators often spend a lot of time dealing with spammers and harassers. (An important part of the job is maintaining blocking lists of people who don't want mail.) However, you can keep track of your anonymous customers - have them use pseudonyms, e.g. PGP signatures maintaing a consistent identity even though you don't know the True Name of the customer or whether one customer is using multiple pseudonyms, and if you kill off one customer you can't be sure they won't come back with a new pseudonym. >Like I said, I offer specific services with specific goals for a specific >fee. If the results are not what you wanted, too bad. You want my other >services then you'll have to give up the anonymity because I need a certain >level of security that dealing with anonymous customers simply can't provide. For the most part, that security involves three aspects - making sure you get paid (so make anonymous customers pay in advance) - keeping one customer from cracking into your system and your other customers' (internal firewalls help; may be more work/money than it's worth.) - not having cops raiding you or angry global villagers with flamethrowers showing up. Besides, lots of people deal with anonymous customers every day; they don't call themselves John Doe, they call themselves Foo Corporation and operate from 1234 Main St. Suite 67, which is a mailbox... Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From ravage at ssz.com Fri Oct 3 20:47:31 1997 From: ravage at ssz.com (Jim Choate) Date: Sat, 4 Oct 1997 11:47:31 +0800 Subject: index.html Message-ID: <199710040400.XAA00040@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Main banner Visit Regal at Buick.com rule REPORT: PARENTS SOUGHT TREATMENT FOR TEEN SLAYING SUSPECT The suspect's house October 3, 1997 Web posted at: 4:18 a.m. EDT (0818 GMT) JACKSON TOWNSHIP, New Jersey (AP) -- Three days before 11-year-old Eddie Werner vanished while selling candy door-to-door, the parents of the teen accused of killing him reportedly asked a judge to lock up their son. The parents of the teen asked a Family Court judge on September 24 to place him in a residential psychiatric treatment center in a bid to get his violent behavior under control, The Star-Ledger of Newark reported Friday. Instead, he was allowed to remain at home. Werner Last Saturday, Werner disappeared as he sold candy and wrapping paper for a school fund-raiser. His body was discovered Monday night in a wooded area between the neighborhoods where he and the suspect lived. Authorities have not released the name of the suspect because he is under 18. On Thursday, prosecutors said they believe the suspect was molested by a 43-year-old New York man who met him through an online chat room and arranged trysts. Monmouth County Prosecutor John Kaye said Stephen Simmons, 43, of Holbrook, New York, and the suspect met at New Jersey motels and at Simmons' home for sex several times over the past 13 months. Simmons The boy's parents learned of the meetings and informed police. Simmons, who has been charged with third-degree sodomy and could face other charges, was arrested on September 24 -- the same day the suspect's parents made their request of the judge. "These people had been crying out for help a week before the incident," the suspect's attorney, Michael Critchley, told The Star-Ledger. "Everybody should step back and pause a moment before they put this kid on a pyre and burn him." The teen-age suspect faces murder, aggravated sexual assault and robbery charges. Prosecutors were reviewing whether to have him tried as an adult. memorial Acquaintances described the suspect as a loner and a bully, but others said he was an average teen and a good student with an interest in computers. He built his own Web page, which he filled with biographical tidbits and exhaustive information about his favorite rock band, Smashing Pumpkins. He also explored other regions of the online world. Kaye said information found on a computer drive seized by prosecutors indicated the boy was visiting homosexual chat rooms, where he first met Simmons. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. rule Related stories: * Violent offenses by teens plunged last year - October 2, 1997 * Door-to-door school sales debated after boy's slaying - October 1, 1997 _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Message Boards Sound off on our message boards You said it... [INLINE] Visit Regal at Buick.com rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From stewarts at ix.netcom.com Fri Oct 3 20:47:59 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Sat, 4 Oct 1997 11:47:59 +0800 Subject: Traffic Analysis In-Reply-To: <3.0.3.32.19971002232810.03514efc@rboc.net> Message-ID: <3.0.3.32.19971003111250.0069ee68@popd.ix.netcom.com> At 11:28 PM 10/02/1997 -0400, you wrote: >On the other side, if Cracker were to send out more messages that it takes >in, or just replace these thrown away messages with random noise messages, >perhaps encrypted, would this foil traffic analysis? All those things help, but Eric Hughes and Raph Levien are doing some work that looks like it's possible to do traffic analysis as long as you can tell when messages begin and end. I don't know if their analysis depends on the fact that messages get smaller as they go through the remailer chain, or whether it will also affect Mixmaster-style remailers, which split their messages into constant-sized blocks and mix blocks from different messages. Some things that could be done include having each remailer add random-sized padding and re-encrypting before sending to another remailer, but once you get into that level of work it probably makes sense just to switch to Mixmaster for most uses. Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From stewarts at ix.netcom.com Fri Oct 3 20:50:35 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Sat, 4 Oct 1997 11:50:35 +0800 Subject: Request for illegal electronic surveillance examples and cases In-Reply-To: Message-ID: <3.0.3.32.19971003104332.0069ee68@popd.ix.netcom.com> At 11:33 AM 10/02/1997 -0700, you wrote: >Thanks, all, for the suggestions. Unfortunately my time is limited: my >deadline is tonight. I'm working on a roundup of pre-reported >cases, not reporting out new ones. (at least for this project) > >My best source so far is the 1976 Church Committee documents. Gentry's bio >of J. Edgar Hoover is a good one too. Burnham lent me a copy of his "Above >the Law" book about the DoJ which I haven't finished yet. Haven't read >Puzzle Palace in a while, probably don't have time to reread that. Another good book, not that you'll be able to find it by last night, is "L.A. Secret Police", which was an expose' of the Darryl Gates LAPD's shadier activities. It's a bit sensationalist, but adds some local-police balance to the usual Federal cases. Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From nobody at REPLAY.COM Fri Oct 3 21:58:20 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sat, 4 Oct 1997 12:58:20 +0800 Subject: Stanglehold / Re: Stronghold Message-ID: <199710040437.GAA21179@basement.replay.com> Alan wrote: > C2Net should have demanded proof instead of getting defensive. That > worries me, not because of "hidden backdoors", but because it shows lack of > confidence in their own products. But lack of confidence has nothing to do > with actual strength of the product. Let's think about this for a moment. RSA is so confident in their product that they openly challenge people to prove its strength or weakness, even offering them money out of their own pocket if they cn do so. C2Net, at the merest whisper by the least credible of persons, launches into action an army of litigators to threaten said individual with dire consequences if they fail to duck and cover, not to mention 'shut the fuck up.' Hhhmmmm...... > If you do have evidence and refuse to post it, then you are just helping > C2Net. If I had evidence of a backdoor in C2Net's Stronghold software, and I met with so little support when attacked by them, I would refuse to post it. Why? To let all of C2Net's staunch defenders feel all the more confident in placing their big, hairy balls in the StrangleHold of C2Net's software. Of course, if I were C2Net and I *did* have a backdoor built into my software, I would probably try to link any criticism of my product with the rantings of mentally unstable paranoics. Which begs the question, is Dimitri the 'foil' of C2Net, or a 'creation' of C2Net? TruthMonger "Creator of the 2-way mirror." From dlv at bwalk.dm.com Fri Oct 3 22:34:56 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Sat, 4 Oct 1997 13:34:56 +0800 Subject: commercial remailers and anonymous customers In-Reply-To: <3.0.3.32.19971003103708.0069ee68@popd.ix.netcom.com> Message-ID: <0X91De7w165w@bwalk.dm.com> Bill Stewart writes: > > >> When all your customers are anonymous, you don't get to be very choosy. > > Sameer's C2.Net used to be an ISP business, providing privacy services, > and he found that enough of his anonymous customers were problem customers > that it was a real pain to support. Last October, Sammer was being sued for copyright infringement and he claimed in court papers that he doesn't censor content on C2's ISP. Literally at the same time he pulled the plug on a C2 account for publishing a Web page critical of one of Sameer's associates. Here's Sameer's e-mail to that account: ]From sameer Thu Oct 24 10: 34:59 1996 ]Received: (from sameer at localhost) by blacklodge.c2.net (8.7.6/8.7.3) id ]KAA05716; Thu, 24 Oct 1996 10:34:58 -0700 (PDT) ]From: sameer ]Message-Id: <199610241734.KAA05716 at blacklodge.c2.net> ]Subject: Re: www.c2.net/~netscum/mayt0.html ]To: netscum at c2.net ]Date: Thu, 24 Oct 1996 10:34:58 -0700 (PDT) ]Cc: sameer at c2.net ]In-Reply-To: <3279b6dd.124287235 at mail.c2.net> from "netscum at c2.net" at "Oct ] 24, 96 00:26:22 am" ]X-Mailer: ELM [version 2.4ME+ PL22 (25)] ]MIME-Version: 1.0 ]Content-Type: text/plain; charset=3DUS-ASCII ]Content-Transfer-Encoding: 7bit ] ] I'm sorry. If you don't remove the illegal web pages we're ]going to be forced to shut off your account. ] ]> Dear Sameer, ]> ]> What was reported to you was mistaken. The referenced page contains no ]> libel, and all the claims therein are factually correct and can be proved ]> easily by browing public documents in DejaNews and AltaVista. ]> ]> Good luck in your SPA lawsuit!! ]> ]> ]> On Wed, 23 Oct 1996 12:41:53 -0700 (PDT), sameer posted: ]> ]> > The URL in the subject (http://www.c2.net/~netscum/mayt0.html) ]> > was reported to us as illegal libel. Please note that our policies ]> > forbid any illegal activity on the site. Please remove this page as ]> > soon as possible. Thank you. ]> > ]> > -- ]> > Sameer Parekh Voice: ]> 510-986-8770 ]> > C2Net FAX: ]> 510-986-8777 ]> > The Internet Privacy Provider ]> > http://www.c2.net/ sameer at c2.net ]> > ]> ] ] ]-- ]Sameer Parekh Voice: 510-986-8770 ]C2Net FAX: 510-986-8777 ]The Internet Privacy Provider ]http://www.c2.net/ sameer at c2.net You'd think that a pathologically litigious liar would know better than to use terms like "illegal libel"... Soon after this incident Parekh settled the copyright infringement suit, pulled the plug on C2net's ISP business, and switched to peddling (questionable) software. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From nobody at REPLAY.COM Fri Oct 3 22:37:35 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sat, 4 Oct 1997 13:37:35 +0800 Subject: FBI trainees good, nab innocent teen-agers Message-ID: <199710040532.HAA26609@basement.replay.com> CNN logo [ISMAP]-Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Main banner AST. Working For Your Business. rule FBI trainees goof, nab innocent teen-agers October 3, 1997 Web posted at: 9:35 p.m. EDT (0135 GMT) ELIZABETHTOWN, Pennsylvania (AP) -- Armed FBI trainees in bulletproof vests and camouflage surrounded a group of teen-agers, handcuffed them and forced them to the ground before realizing they had the wrong people. The trainees were taking part in a training exercise at a town square Wednesday night in which they were apparently supposed to nab others taking part in the drill. Instead, up to 30 FBI trainees jumped out of a caravan of vehicles and descended on the innocent teen-agers, bound their wrists with plastic ties and ordered them to lie face-down on the sidewalk. After about 30 minutes, the agents set the teens free. The FBI would not comment on the specifics of the drill, but an FBI official apologized Friday and two agents visited the home of one of the youths Thursday night to express their regrets. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. From alexlh at xs4all.nl Fri Oct 3 23:13:11 1997 From: alexlh at xs4all.nl (Alex Le Heux) Date: Sat, 4 Oct 1997 14:13:11 +0800 Subject: New PGP "Everything the FBI ever dreamed of" Message-ID: <3.0.3.32.19971004062137.007cce40@mail.xs4all.nl> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 3 Oct 1997 17:27:29 +0200, in list.cypherpunks you wrote: >An article in today's (Fri, Oct 3) New York Times (CyberTimes) > >describes the new release of "PGP for Business Security 5.5," which >contains mechanisms that incorporate key recovery mechanism that can either >be volontary or be enforced by using PGP's software for controlling a >company's SMTP server -- the server can verify that all encrypted messages >include the corporate public key (or conform to other corporate policies): [snip] Keep in mind that this is the 'PGP for Business'. Companies often operate on the principle that email that's sent and received from their machines is the company's, not the employee's. This is actually reasonable business practice. Specially when encryption enters the picture. The employee could walk under a bus, and leave some vital but encrypted emails in his mailbox. This could be a real problem for corporations. Individuals should of course stay as far away from something like this as possible. Alex -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDXEUduYAh4dUSo/EQKERQCg6v6i8v+hvh4/zFDXGEt2e0eyl0kAn2An 2tlYh85ewSbxsCmD8L9H1OI/ =i0zt -----END PGP SIGNATURE----- --- Violence is the last resort of those who have lost all control over a situation. From amp at pobox.com Fri Oct 3 23:19:26 1997 From: amp at pobox.com (amp at pobox.com) Date: Sat, 4 Oct 1997 14:19:26 +0800 Subject: New PGP "Everything the FBI ever dreamed of" In-Reply-To: Message-ID: Though I hate the conmcept of key escrow, it actually makes sense for corporations to be able to have access to internal documents. Why they think having key escrow in place will stop people from being able to use other encryption as well is beyond me. I guess it's the same (stupid) mentality of the feds. They don't think anyone would be smart enough to use the escrowed encryption a a wrapper for the non-escrowed encryption. amp ------------------------ From: Martin Minow Subject: New PGP "Everything the FBI ever dreamed of" Date: Fri, 03 Oct 1997 07:30:33 -0700 To: risks at csl.sri.com Cc: cypherpunks at cyberpass.net An article in today's (Fri, Oct 3) New York Times (CyberTimes) describes the new release of "PGP for Business Security 5.5," which contains mechanisms that incorporate key recovery mechanism that can either be volontary or be enforced by using PGP's software for controlling a company's SMTP server -- the server can verify that all encrypted messages include the corporate public key (or conform to other corporate policies): =snip= ---------------End of Original Message----------------- ------------------------ Name: amp E-mail: amp at pobox.com Date: 10/04/97 Time: 00:52:55 Visit me at http://www.pobox.com/~amp == -export-a-crypto-system-sig -RSA-3-lines-PERL #!/bin/perl -sp0777i A non-text attachment was scrubbed... Name: not available Type: text/html Size: 15689 bytes Desc: not available URL: From attila at hun.org Sat Oct 4 00:58:16 1997 From: attila at hun.org (Attila T. Hun) Date: Sat, 4 Oct 1997 15:58:16 +0800 Subject: FBI trainees good, nab innocent teen-agers In-Reply-To: <199710040532.HAA26609@basement.replay.com> Message-ID: <971004.074923@hun.org> -----BEGIN PGP SIGNED MESSAGE----- on or about 971004:0732 nobody at replay.com (Anonymous) purported to expostulate: + + ELIZABETHTOWN, Pennsylvania (AP) -- Armed FBI trainees in + bulletproof vests and camouflage surrounded a group of teen-agers, + handcuffed them and forced them to the ground before realizing + they had the wrong people. + look at this way: the teenagers have seen first blood; they may be better prepared for when it is for real -- "Experience keeps a dear school, but fools will learn in no other." --Benjamin Franklin ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDX2Br04kQrCC2kFAQHMiAP+LueUSQWt333mmVl/e/MtlCQ65fKQ5UoE RlBd88VoIaTFkdE0lkn/lTYGZg0vbI3k3sUC7tPQ4xdWJMP+oNqLhTlc5BNzrGlU 5tb2d079W97HKlUrGqne01z4lQSc0eIR0wggyIDIBoUo8igvIdjGyXBN1d+dXHvd XZbmKDOb+GE= =Ln/r -----END PGP SIGNATURE----- From ccf at dev.null Sat Oct 4 01:04:48 1997 From: ccf at dev.null (C. Crockett Flintstone) Date: Sat, 4 Oct 1997 16:04:48 +0800 Subject: InfoWar 29 / The GeigerText Edition Message-ID: <3435E835.675F@dev.null> ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * Death & Texas * 2000 ---------------------------------------------------------------------------- Death & Texas ---------------------------------------------------------------------------- "I see that our link to the past�" Jonathan paused to remember what the hell the man was calling himself, lately, "�The Same Guy, that's it�" What had he been about to say? Jonathan shook his head to clear away the fog that invariably resulted from use of the Trei Transponder to make contact with�The Same Guy. "He fucked up the 'Death and Taxes' chapter title." Alexis helped Jonathan regain his train of thought. "Oh, yes, thank you." Jonathan sighed, and continued. "Well, if he fails to pick up the reminder from the LMBoyd sampler, then there's no telling what the next chapter will be about, since he'll be away from the 'Home' for the weekend." Priscilla added, "Perhaps we would have been better off to let him usurp the TruthMonger multi-user personality, since he seems to have become a one-man multi-user personality, all on his own." Bubba Rom Dos laughed, and reminded the others of one of his self-coined 'old-sayings': "When you talk to yourself, that's normal. When you answer yourself, that's a little weird, but nothing to seriously worry about. However, when you say, 'Huh?'�you're in big, big trouble." ---------------------------------------------------------------------------- Subject: Sampler: October 3 Date: Fri, 3 Oct 1997 00:15:01 -0700 From: sampler-request at lmboyd.com ====================================================== Clients write: "What I think of when somebody says 'death and taxes' is death only collects once."... "What gets me is this is supposed to be National Apathy Week, and nobody cares."... "What I can't figure out is how hailstones were described before golf balls were invented." ============================================== LMBoyd Web Site / U. S. Newspapers / Start Email / Stop Email http://www.LMBoyd.com/postscript.htm ---------------------------------------------------------------------------- "Taxes!" The Same Guy exclaimed. "Damn! Taxes�" The Same Guy looked at the chapter of 'InfoWar' that he had been working on for the last week. Now it made sense why he couldn't quite get it all to quite come together. Still, 'Death and Texas' had been a pretty good guess, since it did tie in with some of the main players in the worldwide conspiracy destined to come to fruition at the turn of the millennium. Someone had gotten to Paula Jones' attorneys and forced them to bow out of her sexual harassment suit against President Clinton, so that the Puppet Masters behind the scenes could bring in a heavy-hitter from Texas, and fund the attack on the President through the spook-connected Rutherford Institute in Charlottesville, Va. "Donavan Campbell!" The Same Guy slapped his forehead. Now the obviously 'wrong' reference in chapter 26, "Everything You Know Is Wrong," made sense. "One of the reasons the Author attributed to his becoming a computer guru in an amazingly short period of time, was his entry into the computer arena as the apprentice of Bill Campbell, one of the designers of the Adam motherboards, and the Authors work with retarded children early in life." The man referred to in this passage was the owner of CCPPR Computers, Inc., in Tucson, Arizona. But his name was Bill Williams, not Campbell. The Same Guy had known that whoever had changed the name in the manuscript while it was in route to the CypherPunks mailing list was sending a message to someone that everything they knew about something was wrong, and that it involved someone named Campbell, from Texas, where the Author had worked with a number of retarded children. The references to the Feminazis was another reference to the use of Paula Jones for the attack on the Presidency, but what about the reference to George Carlin? The Same Guy had done a quick Web search for Paula Jones and George Carlin using fuzzy pattern-matching, and came up with the email from CNN's 'Carin' Dessauer announcing Paula Jones' switch of attorneys. "Yes, the one-two punch!" The Same Guy had leapt from his chair and given himself a high-five, causing Baby to look up at him as if she was glad she was a dog, and therefore in no way related to these crazy humans. Suddenly, everything was coming full circle�"Full Magic Circle!" The Same Guy joked to himself, laughing uproariously, and causing Baby to get up and go into the next room to lay down, lest someone come along and think that she was associated with this lunatic. Men� "Sure, pretend you don't know me!" The Same Guy hollered after Baby, knowing what she was doing. "Just wait until people around the world are applauding my genius and giving me the 'Key to the City' for my prophetic foresight. Then you'll be sorry you're not there to accept the 'Doggie Bone to the City' for standing by my side, as my faithful companion." Baby just looked at him from her new spot on the Lazy Boy in the front room, and put her head down to sleep, not seeming particularly impressed. "Awe-Stun Taxes." That's what the T-shirts said. The name of the man who engaged the Author to promote the T-shirts for him was C. Crockett Flintstone. Crockett was not only person responsible for introducing the Author to Sam Houston Johnson, and politics, Texas style, but he was also the reason for the Author's fortuitous encounter with gomez at basisinc, and his subsequent journey into the bowels of the UNIX operating system. And, of course, there was the ugly scene at Don Politico's bar in Austin, when the Author had introduced the prototype of a bumper-sticker he had come up with, to sell in Dallas. It said, "Honk if you killed Kennedy." That was a long, long time ago, but the tangled, twisted trail which had led The Same Guy to this point in time still revolved around Death and Taxes, Death in Texas, and now�the Death of Taxes. But The Same Guy didn't want to write about Death, Taxes, Texas, or any of that depressing stuff. He was tired of dealing with the Dark Side of the conspiracy. He wanted to think about the positive things that could be done to counter the Dark Terror that was about to descend upon the world, once again. Stuff like nuking DC. Well, OK, maybe that was a bad example. ---------------------------------------------------------------------------- 2000 ---------------------------------------------------------------------------- "Looks like he's done fucking up the chapter." Alexis smiled at Jonathan, as she put her arms around him and gave him a peck on the cheek. "Now it's your turn." "Bubba! Cowboy! Grab the liquor and get your asses out here, we've got work to do." Jonathan shouted to the two men who were laying in their cots, trying to recover from the exceedingly long hours they had put in the day and night before. "The year 2000." Bubba shouted to Jonathan, dragging himself out of bed. The Cowboy was rising equally slowly, beside him. "Already got it." Jonathan pointed to the chapter title that lay waiting for a reason to exist. He took the bottle from Bubba's hand as the old coot eased himself into a chair, and poured three shots of bourbon while they waited for the Cowboy to join them. Jonathan glanced at Alexis, holding a fourth shotglass in his hand. "No, I have other things to do, unless you need a woman's presence so that you guys can keep it in your pants long enough to complete the chapter without jumping up and down and screaming, 'Nuke DC! Kill! Kill! Kill! Nuke DC!'." The Cowboy gave Alexis a peck on the cheek as he passed by, assuring her, "Run along dear, we have everything under control. As a matter of fact, we think that after we finish prophesying the past�our past-the CypherPunks' future�then we will leave it up to the kindlier, gentler CypherPunks, such as Attila T. Hun, to help light the way for the CypherPunks and the Circle of Eunuchs to forge a new distant past for ourselves, and a new future for themselves." The Cowboy paused, to think about what he had just said, and added, "It's hard to believe I haven't even had my morning 'hair of the dog' and I'm already on a roll." Alexis shook her head and said, "Count me out. Just add a disclaimer at the end of the chapter which involves the womenfolk from any responsibility for stirring up the likes of Attila T. Hun and Conan the Destroyer, or whoever you plan to incite to join in your madness." "Actually, I think that it is we who are joining in theirs." Bubba said, sorting through some recent posts to the CypherPunks list. He turned to Jonathan and the Cowboy, as Alexis joined Priscilla in making some adjustments to the Trei Transponder. "Shall we sugar-coat it, or tell it like it is?" Bubba asked his companions. "The less time we take in the telling, the more time we have for drinking." the Cowboy turned to Jonathan for his opinion. "I defer to the wisdom of my elders." Jonathan smiled, pushing his shotglass forward for a refill. "OK!" Bubba exclaimed. "Quick and dirty." "2000. The end." "Uuhhh, Bubba�" the Cowboy said, "�you wouldn't mind terribly, would you, if I filled in a few details before we close out the chapter and open another bottle?" Bubba waved for the Cowboy to proceed, pouring himself another shot. The Cowboy decided to lay out the basics and let those actually living in the era confirm the details of the flow of InformEnergy that lay in their future if they failed to take steps to counterbalance the attempts of the Dark Allies to force the past, present and future into a narrow mold corresponding to the desires of the Evil One. Now playing at a Whitehouse near you-the one, two punch. Clinton and Gore are destined to be run out of town on a train, similar to the Nixon and Agnew railroading. The players behind the scenes laid the groundwork for setting them up like bowling pins, only to be knocked down once they had served the purpose of smiling benignly as the shakers and movers drove the final nail in the coffin of democracy by getting the line-item veto passed. Once this was done, most of the substructure was then in place for bringing in the new millennium with a New World Order, compliments of Josef Goebbels, George Bush, and a Dictator To Be Named Later (Monty Cantsin?). There were already non-elected Committees and Commissions in place that had the power to arbitrarily enact the draconian measures that had been pre-approved in order to deal with the National Security Emergencies that were already on the drawing boards, waiting only for all of the pieces to fall in place. The last decade of the millennium was mostly used for fine-tuning all of the parts of the maleficent machines that had been created and developed for the purpose of providing the physical tools necessary for instituting a worldwide dictatorship of the Evil One across the face of the earth. The mass media had been co-opted and brought under control, now being basically a press-release arm of the government and corporations, through the influence of powerful figures who pulled their strings from the shadows above them. Once the control of the media had been confirmed during Desert Storm, the process of consolidating that control proceeded rapidly. The government had given those on the growing InterNet a fairly free rein, in order to let them remain a large enough threat to the established, mainstream media, that the government could seal their lips and their loyalty with a fifty billion dollar digital bandwidth giveaway that would ensure their financial stability and dominance in the technology of the future. Little did even the press, let alone the public, know that the import of the digital bandwidth placed in the hands of the established media was much greater than it appeared on the surface. The government already had the technology in place to turn the digital airwaves into the InterNet technology of the future. By the time that the new technologies developed in the government's underground laboratories around the world were revealed to the public as 'new' breakthroughs, they had invariably already been in use for years by the secret government's agents. (Like the radar that can see through walls, being 'announced' as a new technology developed at Lawrence Livermore Labs. CypherPunk Kent Crispin had known about its existence for years, having used it extensively himself-not that he didn't trust his wife...) The World Wide Web was completely under control of the military, having been carefully woven under the watchful eyes of DARPA, who preferred to centralize development of the WWW under CERN, in Europe, in order to get around sticky US laws regarding privacy and freedom. They could move pawns, shills and agents, such as Tim Berners-Lee, Ben Segal, and Phillip Hallam-Baker back and forth between CERN, MIT, and other openly clandestine institutions which served to host the distributed network of quasi-military secret agents supporting the grand designs of Gomez and the Dark Allies. The world at large would little notice that the development of the technology behind the Digital Revolution lie in the same hands as the development of the atomic bomb and nuclear energy. The military, high-security scientists, secret committees and clandestine intelligence organizations-with a background of spooks, spies, and assorted secret societies and their agents, all having their strings pulled by Puppet Masters who remained unknown behind the scenes that were being played out on the stage of everyday reality. Those who cheered the 'failure' of the Clipper Chip, the 'victory' of the Bernstein ruling, or the 'defeat' of the CDA, little realized that these were merely diversionary maneuvers for the real battles which were taking place in the background, between those who were participating in an underground war which was for 'all the marbles.' Like the battles over the intricate details of what types of 'legal' wiretapping would or would not be 'allowed' by the laws of society, the openly fought battles over freedom and privacy were being waged only for the purposes of defining the virtual reality of a world view which was actually based on an underlying 'operating system' which was hidden from the view of the 'average user.' While anti-trust battles were openly being waged with the likes of Microsoft and Intel, the real deals were being cut in the secret meetings between the movers and shakers who could say, "Let there be back doors:" and there would be back doors. While Jane and Joe Normal were playing with their Graphical User Interfaces, the operating system of the underlying reality was being defined, manipulated and controlled by those in the subterranean layers of their Digital Society-by those with access to the 'Command Line.' The 'Above-Ground Players' were working a virtual theater in which the battles they were fighting on the public stage had already been won by the Authors of the scripts, who remained in the background, already knowing how the Grand Play would come to an end, in its final scene. Except for the 'Baker Street Irregulars'� The CypherPunks had recognized the final challenge being thrown down by those playing on the outer stage of reality. "The Feds have shown their hand: they want a ban on domestic cryptography" Tim C. May's weather-vane signature line pointed out that a new game was afoot. What even most of the CypherPunks failed to realize, however, was the timing of the announced intention to begin enforcement of the draconian measures being proposed by Lying Fuck Louis Freeh ('eLFeLF' to his friends.) 1999� Why 1999? Can you say "Taxes."? Sure you can. ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ---------------------------------------------------------------------------- From root at DosLinux Sat Oct 4 01:50:36 1997 From: root at DosLinux (Harka) Date: Sat, 4 Oct 1997 16:50:36 +0800 Subject: russia_1.html Message-ID: <199710040438.EAA00226@DosLinux> Reuters New Media Beatrice shows you the best sites for... Beatrice's Web Guide [Relationships.....] Show me! [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Previous Story: U.S. Sees Hope for War Criminals' Surrender Next Story: U.S. Searches for Its Oldest Worker _________________________________________________________________ Friday October 3 7:09 PM EDT US Sees No KGB Role in Russia's Nuclear Arms WASHINGTON (Reuter) - The United States Friday rejected the claim of a Russian scientist that Moscow had secretly developed nuclear "suitcase bombs" under KGB orders in the 1970s specifically for terrorist purposes. "We have no information or evidence suggesting that nuclear weapons were ever developed for or put under the control of the KGB, which is part of the story here," State Department spokesman James Rubin said. Rubin, reflecting previous U.S. statements, did not deny so-called "suitcase bombs" may be part of Russia's arsenal. "We cannot comment...about the precise specifications or dimensions of any nuclear weapons," he told reporters. But he repeated the U.S. view that "there is no evidence other than hearsay to support such claims" that portable Russian nuclear weapons may have gone missing. "There's probably no issue where you have the combined resources of the U.S. government working as well together and with such determination as the issue of security of nuclear weapons, and we work on it every day, hundreds if not thousands of people in the government," he said. "And if they say that we have no information on this and they say that these accounts are hearsay, that's pretty compelling," Rubin added. Testifying before Congress Thursday, Alexei Yablokov, a respected scientist who served on the Russian National Security Council, contradicted statements by Russian officials denying the existence of the weapons and buttressed claims that many of them have gone missing. "I am absolutely sure that they have been made," he told the House Military Research and Development subcommittee. The issue arose when former Russian National Security Adviser Alexandr Lebed alleged that up to 100 portable suitcase-sized bombs were unaccounted for since the 1991 breakup of the Soviet Union. According to Lebed, who has agreed to testify before the House committee later this month, the devices have an explosive capacity of one kiloton -- the equivalent of 1,000 tons of TNT -- can be activated by a single person and could kill as many as 100,000 people. Yablokov said he had spoken to the scientists who worked on the weapons and so was certain of their existence. But he said the former Soviet Defense Ministry might never have known about the so-called "atomic demolition munitions" because they were developed for the KGB spy service under a secret program. On the issue of possible missing nuclear weapons, Rubin said Moscow "continues to assure us that it retains adequate command and control and that appropriate physical security arrangements exist for these weapons and facilities." "We have no reason or evidence to doubt these assurances," he said. _________________________________________________________________ ________________________ Search News Help _________________________________________________________________ Previous Story: U.S. Sees Hope for War Criminals' Surrender Next Story: U.S. Searches for Its Oldest Worker Beatrice shows you the best sites for... Beatrice's Web Guide [Relationships.....] Show me! _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments From declan at well.com Sat Oct 4 08:09:08 1997 From: declan at well.com (Declan McCullagh) Date: Sat, 4 Oct 1997 23:09:08 +0800 Subject: Data Protection in the United States: A Rising Tide? Message-ID: [From RRE --Declan] >Date: Fri, 3 Oct 1997 14:18:57 -0400 >From: Marc Rotenberg >Subject: EPIC Speech in Brussels > >[...] > >------- > >"Data Protection in the United States: A Rising Tide?" > >Marc Rotenberg >Electronic Privacy Information Center >Washington, DC > >17 September 1997 >19th Intentional Conference on Data Protection >Brussels, Belgium > > Thank you, Mr. Chairman, ladies and gentlemen. I am >grateful for the opportunity to be with you this morning. > > I will speak today on behalf of consumers and users of >the Internet in the United States. There are few issues of >greater concern to us than the protection of privacy. You can >read about this in our newspapers and our magazines. Privacy >stories routinely appear on the front pages of national >magazines and in the daily newspapers. In just the past few >weeks stories about privacy have appeared in Time Magazine, >the Washington Post and USA Today. So extensive is our >discussion of privacy concerns that we even export the news >of our problems. I found a story from the New York Times >about the use of the Internet to collect detailed personal >information on the front page of the International Herald >Tribune that I purchased yesterday morning here in Brussels. > > We believe that strong measures must be taken to >protect personal privacy. You can see this in our responses >to public polls. We have consistently expressed concern about >the loss of privacy, and we have consistently shown support >for new legislation to protect privacy. > > We know that law is often an imperfect solution, but we >are also firm believers in the rule of law. You will >recognize this if you trace the development of privacy law in >the United States over the twentieth century. You can see >this if you understand that our country has always shown >great regard for the right of privacy and expressed >widespread concern when privacy was at risk. > > So, when I say to you today that privacy is a great >concern in the United States and that we need to do much more >to protect it, I do so with the newspaper stories piled high, >the polling numbers unambiguous, and with a respect for >history that makes clear that few rights in American life are >more greatly valued than the right to protect private life. > > I will speak now to the three central issues that need >to be addressed to build a bridge between the United States >and Europe so that we can enter the information society >together with mutual standards that protect the privacy >rights of our citizens . The first issue concerns current >attitudes of consumers in the United States and the current >policies of government. The second concerns the short-comings >of self- regulation. My final point is two recommendations >for how we should proceed. > > First, it is clear the consumers and users of the >Internet favor the passage of law to protect personal >privacy. Professor Westin found this year that 58% of the >American public want government o pass law to protect privacy >now. And 24% said that government should formally recommend >privacy standards. Only 15% favored letting groups develop >voluntary privacy standards and government taking action only >if real problems arise. > > Professor Westin's results are consistent with other >surveys of attitudes toward privacy in the United States. A >1991 poll conducted by Time Magazine found that 93% of the >U.S . public felt that companies that sell personal >information to others should be required to obtain explicit >permission. And the most comprehensive poll of Internet users >ever undertaken found that users of the Internet in the >United States, on a 1 to 5 scale, said that the Internet >needs new laws to protect privacy at a level of 3.8. > > Public support for privacy legislation is clear. > > Second, it is also clear that some political leaders >favor the adoption of privacy law. While it is true that the >White House has expressed the opinion that privacy >legislation is unnecessary at this time, members of Congress >are of a different opinion. Bills have been introduced in the >House and the Senate that address a wide range of privacy >issues. One bill would limit the disclosure of Social >Security Numbers. Another bill would prohibit Internet >Service Providers from disclosing customer information >without consent. A third bill restricts the ability of direct >marketers to sell information about young children. Several >bills have been introduced to address public concern about >unsolicited commercial email. Many other bills are also under >consideration. > > It is also clear that the United States is fully >capable of enacting privacy laws to address public concern, >particularly when new technologies threaten personal >freedoms. In fact, we have passed several laws in a little >over a decade that specifically target new technologies. >Privacy protections for cable subscriber records were enacted >in 1984. Electronic mail was covered in 1986. Video rental >records gained protection in 1988. Even junk faxes and auto- >dialers became subject to privacy legislation in 1991. > > So, we must observe at this point, that the view of >some that the United States does not support passage of >privacy legislation is not supported by the majority of >people of the United States, many of our elected officials, >or our recent history. > > Much has been said in the last few months in support of >self-regulation. Self- regulation has been offered as a >privacy solution, a way to steer a course between government >control and free market chaos. It is critical to look closely >at the case for self-regulation. > > First, it should be said that the current argument for >self-regulation is based on a preference and not a principle. >While much has been said about the "common philosophy" of the >Administration's policy toward the Internet, it is quite >clear, some would say painfully clear, that the >Administration is prepared to regulate if the interest at >stake is copyright or cryptography./1/ > > Second, self-regulation as an argument against privacy >protection is hardly new in the United States. The direct >marketing industry has argued for more than twenty years that >it did not need privacy regulation. The result is that today >Americans receive a flood of junkmail, more junkmail per >capita than any other country in the world. Millions of >Americans sign up for the Mail Preference Service to escape >this onslaught, but there is no assurance that the privacy of >these people will be protected. Professor Reidenberg and >Professor Schwartz have shown in their study of data >protection in the United States that the Mail Preference >Service is ignored by about half the members of the Direct >Marketing Association./2/ > > Self-regulation has also failed repeatedly in the last >few years as trade groups and individual companies have been >unwilling to uphold their own principles and their own >contractual agreements. In 1991 the Direct Marketing >Association failed to take action against the Lotus >Marketplace product even though it plainly violated the >industry's own guideline on the need to offer an effective >opt-out. Similarly, the DMA failed to take any action against >Metromail after the company turned a mailing list into a >look-up service in violation of another DMA edict. Companies >also appear unable to police themselves. America Online >entered into a deal with a telemarketing firm even after it >assured customers in its service agreement that it would not >disclose telephone numbers to others. There are many other >similar cases. > > Consumer groups challenged these practices, and >eventually changes were made. But this is hardly proof, as >some proponents have claimed, that the self- regulatory >approach is working. > > The advocates for self-regulation have also redefined >privacy in a way that is ultimately harmful to the interests >of consumers. Instead of focusing on the obligations of the >organizations that collect personal information to safeguard >the information and use it only for appropriate purposes, the >self-regulatory environment has produced numerous proposals >that all share the common goal of extracting as much >information from the individual as the individual can be >coerced to give up by means of contract. A typical >negotiation in an environment produced by P3 or OPS requires >consumers to satisfy the information disclosure requirements >of the business as a condition of gaining access to services. > > As my colleague Professor Agre has observed, these >relationship easily become asymmetric with the organization >having the greater power to control what information about >itself is released while simultaneously obscuring the nature >and scope of the information it has obtained about >individuals. > > Of course, one remains "free" to withhold consent and >to therefore be denied admission to a web site, service from >a web-based company, and many other opportunities in the >Information Society regardless of whether a fair >justification for the data collection is provided. > > Simply stated, self-regulation elevates the principles >of notice and consent to stratospheric heights and ignores >virtually all other principles of privacy and data >protection. It is, to borrow from the British philosopher >Jeremy Bentham, "contracts on stilts." > > This has been made clear by virtually all of the >proposals in the United States that focus on obtaining >consent. The most ironic of these was one recommendation >earnestly made by a government official on this issue of >children's privacy who proposed in place of legislative >safeguards the use of biometric identifiers to ensure that a >parent's consent to make use of a child's data for marketing >purposes had in fact been obtained. > > Self-regulation has also given rise to the emphasis on >a multiplicity of privacy preferences. But whether >individuals actually have such diverse privacy preferences, >particularly in routine commercial transactions or in data >gathering activity remains to be seen. As Professor Agre >notes, "particular importance should be paid to uniformity of >protocols across different industries and applications, so >that consumers are not overwhelmed by a pointless diversity >of interfaces and contracts." /3/ > > He suggests that it will be particularly important to >look at a broad range of criteria, "including ease of >understanding, adequacy of notification, compliance with >standards, contractual fairness and enforceability, >appropriate choice of defaults, efficiency relative to the >potential benefits, and integration with other means of >privacy protection." > > Self-regulation has a further problem: it provides a >very limited view of the problems surrounding privacy >protection. It focuses on the microeconomic relationship >between buyer and seller and ignores the larger social >questions of architecture and design. Should highway systems >be designed with anonymous toll payment ? Which technologies >could facilitate commerce and protect privacy ? What stand >should governments take on the use of cryptography ? Self- >regulation provides no answers to these questions, it >provides no mechanisms to find solutions. > > Self-regulation have failed to work even in areas where >public and industry support is overwhelming. The Center for >Media Education found that more than a year after the release >of a widely publicized report on children's privacy that >companies were continuing to collect personally identifiable >information from children at their web sites without >disclosing how the information will be used, who will have >access to it, and without obtaining parental consent. As the >CME concluded, "it is clear that industry self-regulation >does not provide adequate protection for children's privacy." > > It has been proposed that the Federal Trade Commission >could enforce a self- regulatory privacy regime by >prosecuting deceptive trade practices. But the FTC's ability >to actually enforce privacy protection in this manner is >highly suspect. First, the legal authority of the FTC under >section 5 of the Federal Trade Commission Act typically >requires a showing of <<<< actual harm ~ to consumers. As those >who have studied privacy law in the United States know, this >will be a difficult test to satisfy. But even if this problem >is overcome, one could well ask why the FTC, if it had such >legal authority, pursued only one privacy case after two >years of intense privacy investigation. And in the single >case that the FTC investigated, the Commission issued an >opinion only after the company had discontinued the >challenged practice. There was no actual judgment against the >firm or any sanction imposed. Finally, what expectation can >there be that the FTC will pursue any privacy actions in the >near future when the Commissioner responsible for privacy >matters has now left the Commission ? One can look to the >Federal Trade Commission for the enforcement of privacy >safeguards on the Internet, but you will see only an empty >chair. > > Finally, there is a significant legal objection to >self-regulation as a means to protect consumer privacy in the >United States: such an arrangement could be impermissible >under anti-trust law. It is, as one commentator has noted, a >violation of competition law for businesses in the same >market to combine to set the terms of competition and then to >enforce those terms on their competitors. Establishing >industry-wide privacy standards could have exactly this >consequence. Some commentators have suggested that it may be >possible for such agreements to survive anti-trust scrutiny >if the codes are sensibly designed and do not discourage >competition. But drafting such a policy may not be so simple. > > What happens, for example, if industry adopts a code >based on an opt-out procedure and an innovative company, >recognizing the need for a higher privacy standard, prefers >to offer an opt-in procedure instead? If the industry >association discourages the company from offering the higher >standard, consumers would be harmed and an anti-trust action >could result. Indeed, there is already anecdotal evidence >that the marketing industry has engaged in just such >practices. (Note that in this example a regulatory framework >that established opt-out in law could still permit the >innovative company to offer the opt-in procedure.) > > What we realize now is that self-regulation provides >neither the assurance of a legal right nor the innovation and >competitive benefit of the marketplace. It is simply an >answer to the question: how do we regulate without the >government ? This is not a path to privacy protection, it is >not even privacy policy. > >THE FUTURE > > It seems to me surprising that we are unable today to >resolve the privacy differences between Europe and the United >States particularly as they concern the Internet. Both >regions share a high regard for privacy and a long privacy >tradition. Both regions seem eager for greater privacy >safeguards. We know also that there is a convergence in the >development of privacy standards around the globe./4/ > > But even more obviously, the Internet offers the ideal >environment to establish uniform standards to protect >personal privacy. This is clear to anyone who recognizes that >the platform is consistent around the globe, that the >protocols are consistent, and the customs surrounding >commercial transactions off-line are surprisingly consistent: >money buys products and services, the disclosure of one's >address is necessary to receive delivery of goods, and the >release of personal financial information may be necessary >when credit is sought. > > For the vast majority of transactions on the Internet, >simple, predictable, uniform rules offer enormous benefits to >consumers and businesses. It is clear what the goal is. > > We must find a way forward. The Commission would have >ample justification at this point if it decided to restrict >certain data flows to the United States because of the >absence of appropriate privacy safeguards. How can this point >be disputed? Consumers in the United States know that we lack >adequate privacy protection. > > I think it is time to end what Colin Bennett has >called "American Exceptionalism.~ There is little support in >our public attitudes, law, or history for this stance. The >United States should move quickly to establish a privacy >agency, and then proceed to explore the application of the >OECD Privacy Guidelines to the private sector. This useful >framework provides a strong foundation for the development of >technical means to protect privacy and the development of new >privacy standards and legal safeguards. It is already found >today in several US privacy laws and in the practices of many >US companies. > > I also propose today that the United States, Europe, >and Asia join together to develop an intentional convention >on privacy protection based on the OECD Guidelines. A simple >framework of general goals combined with a consultative >process that brings together a wide array of countries could >help ensure that privacy standards are extended to all comers >of the globe > > Only when we have established privacy standards and >guidelines as strong as security standards and guidelines >will users of advanced networked services have the trust and >confidence to participate fully in the Information Society. > > It is also my hope that in the process of working >together toward a common goal that some of the current >differences between the United States and Europe will >diminish. There is too much at stake for consumers, and >citizens, and users of the Internet to risk a clash of >privacy rules. > > We share a common interest in the protection of >privacy. Let us go forward together and establish the >policies that will launch the information economies of the >next era while preserving the personal freedoms we cherish >today. > > I thank you for your attention. > >NOTES > >/1/ Framework for Electronic Commerce (1997) > >/2/ Paul M. Schwartz and Joel R. Reidenberg, Data Privacy Law >(New York: Michie, 1996). > >/3/ Philip E. Agre and Marc Rotenberg, eds., Technology and >Privacy: The New >Landscape (Cambridge and London: MIT Press, 1997) > >/4/ Colin J. Bennett, Regulating Privacy (Ithaca: Cornell >Press, 1992) > From dlv at bwalk.dm.com Sat Oct 4 08:27:41 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Sat, 4 Oct 1997 23:27:41 +0800 Subject: Stronghold 1/2 In-Reply-To: Message-ID: <6e32De9w165w@bwalk.dm.com> I sent this large article out a while back, and apparently it never showed up on the mailing list. Perhaps it was too large I'll re-send it again in two smaller chunks. This article includes several long quotes. I urge anyone still interested in the C2Net/StrongHold thread to read the whole thing. I don't expect to need to contribute to this thread again. The "anonymous" C2Net shill (easily recognizable) wrote: >C2Net was wrong to censor the cypherpunks list in the guise of moderation. >It was wrong to send threatening letters to people who claimed its >products were weak. "Moderation" is a misnomer. C2Net engaged in outright fraud by providing a list which C2Net claimed would contain the articles rejected by the C2Net moderator, then censoring articles from both the censored and the uncensored lists. At least one of my articles (not the one about Stronghold; the one quoting the threatening letter from C2net's lawyers) didn't make it even to the "unedited" list. I immediately recognized the "anonymous" shill's hysterical posting style (repeatedly calling me a "liar" and a closet homosexual, making numerous references to my ethnicity and visa status (incorrectly)). Do you happen to remember C2Net's "marketing director" who tried to create the nym "Locutus" via the remailers, and blew his cover because he couldn't change his style? >The burden of proof in claiming that there is a weakness in someone's >security product is on those making the claim. Nope. The burden of proof is on the vendor selling the product. In this case, the vendor is unwilling or unable to present any evidence of the product's security, so it threatens the security experts who question the product. >If anyone really does believe that C2Net's products have backdoors or >weaknesses, why don't they present them? Because C2net's lawyers have been harrassing those who did - plenty of their threats are quoted below. Somebody wrote, and I suspect that it wasn't cc'd to the list, so I'll skip the name: >Are you able to tell some one privately what's wrong with it ?? I'm very sorry, but I'd rather not... Somebody else wrote (my headers are a mess; I apologize profusely if I'm quoting private e-mail to the list. which I suspect I'm doing) >I'm pretty curious, because threatening individuals with lawsuits >for questioning the quality of a product seems like an act of >desperation. It also seems like it wouldn't hold up in court >for a minute. I agree that this is the behavior one would expect from a vendor that has any confidence at all in its product or in its ability to answer questions about its product in an uncensored discussion. >Imagine if McDonalds tried to sue someone that said big macs suck. > >The judge would throw out the case after a good belly laugh. As a matter of fact, McDonald's did sue some folks in the U.K. (where libel laws are even weirder than in the U.S.) who were basically saying that hamburgers aren't healthy. The defendants won just recently. One of the problems with the U.S. legal system that you can be on the defending end of a totally meritless suit, and still not recover your legal fees when the suit is laughed out of court. C2Net's harrassment included calling my home and threatening my mother-in-law; threatening to seize all my computers as part of the "discovery process"; etc (check out some of their threats below). Since I have nothing to gain by publicizing the truth about them, I'd rather not deal with these creeps. Jeff Barber wrote: >> Lucky is lying: the censored articles were also filtered from the list which >> was billed as being unfiltered. > >This is revisionist history. I can't recall any intimation at the >time that any messages were filtered from the unfiltered list. If you can't recall, I'm quoting a bunch of stuff below. At least one of my articles, the one quoting the threatening letter from C2net's lawyers, didn't make it even to the "unedited" list. The "anonymous" C2net shill further wrote: >While it is true that Dmitri is a proven liar in the grand tradtion >of the Soviet Union (shout a lie long enough and loud enough and >eventually some people will start to believe it), and a pathological >homophobic bigot (who secretly enjoys sucking cock but wears womens >clothing to disguise himself), C2Net's shill called me a liar about a dozen times, yet hasn't presented any evidence of me ever lying. On the other hand, C2net's claim that I'm a closet homosexual is an outright lie, typical of Sameer Parekh and his employees. >Of course, by that time Dmitri had so little reputation capital that >Gilmore patched Majordomo so it wouldn't even respect a subscription >request for him. This is correct: John Gilmore tried to censor me from this mailing list. As the result, I'm still here, John Gilmore no longer runs this list, and John Gilmore's "reputation capital" is extremely negative. C2net's shill seems to approve of Gilmore's actions, demonstrating once again that he he is employed by a dishonest and dishonorable organization. >Ultimately, Dmitri's allegations of weaknesses in Stronghold, true or >not, are totally irrelevant. Without mathematical proof of a weakness, >he simply cannot be believed to ever be telling the truth. So, if >C2 said to him in private e-mail, "if you call Sameer a cocksucker one >more time, we'll slap a libel suit across your emigrant ass, take back >your green card, deport you and tell Russia that you called Yeltsin a >cocksucker," well, I can understand why he shut up. Hmm, I turned in my green card about 12 years ago, when I got naturalized... For what it's worth, Sameer is an Arab, and we all know the old Arab proverb: "Women for sons, boys for pleasure, but goats for sheer extasy." However C2net's barratrous threats were not transmitted by e-mail and had nothing to do with Sameer's alleged sexual preferences. Rather, I received 5 or 6 threatening phone calls at home from Janet M. Craycroft. Also the following threatening letter was served on me (on a weekend!) ]Gray Cary Ware ] Frieidenrich ]A professional corporation ] ]Attorneys at Law Janet M. Craycroft ]400 Hamilton Avenue Direct Dial: (415) 833-2297 ]Palo Alto, CA 94301-1826 Internet: JCRAYCROFT at GCWF.COM ]Tel (415) 328-6561 ]Fax (415) 327-3699 Our File No. ] 9999999 ] ] January 21, 1997 ] ] ]VIA OVERNIGHT COURIER ]--------------------- ] ] ]Mr. Dimitri Vulis ]6767 Burns Street, #4K ]Forest Hills, New York 11375-3555 ] ] Re: Internet Postings on Cypherpunks at toad.com ] ]Dear Mr. Vulis: ] ] This firm represents C2Net, a California Corporation. It has come to our attention ]that you are publishing false, defamatory statements about C2Net and its products. ]Specifically, we direct your attention to your January 30, 1997 Internet posting to the ]Cypherpunks at toad.com mailing list which you entitled "Security alert!!!" (A copy of this e- ]mail is enclosed.) ... ] As you are undoubtedly already aware, Stronghold is a web server that protects ]Internet traffic encryption. Stronghold is not a "backdoor" to steal credit card numbers. The ]statements contained in your e-mail directly cast aspersions upon C2Net's product and ]business which will not be tolerated. Dr. Vulis, at a minimum, your e-mail exposes you to ]civil liability for defamation, tortious interference with business relations, interntional ]interference with contractual relations and permits C2Net to seek compensatory damages as ]well as punitive damages against you personally. ] ] C2Net has authorized this firm to take all action necessary to put an immediate stop to ]your actions and conduct as described above, as well as any other conduct or actions ]undertaken by you which might prove to be harmful to C2Net. Such authorization includes ]the filing of a lawsuit against you to obtain injunctive relief as well as compensatory and ]punitive damages. ] ] Given the seriousness of this matter, we insist that you stop disseminating the January ]30 e-mail or any version of such e-mail. If you continue to publish defamatory statements ]about C2Net and its products, we will pursue all remedies against you. So that there is no ]misunderstanding, please confirm in writing by february 4, 1997, that you will agree not to ]further disseminate the January 30 e-mail or versions of such e-mail. ] ] Should you have any questions, please contact me or have your attorney contact me. ] ] Very truly yours, ] ] GRAY CARY WARE & FREIDENRICH ] A Professional Corporation ] ] [Signature] ] Janet M. Craycroft ] ]Enclosure ][deleted] The letter pretty much speaks for itself. Let me just point out that 1) I never claimed that "Stronghold is a backdoor", which makes no sense, 2) Sameer Parekh inists on addressing me as "Mr." because he's a college dropout extremely envious of anyone educated better than him. >So, don't hold your breath waiting for a repost of previous lies >from our dear Kook of the Fucking Century. Yep - since there have been no "previous lies", a repost is impossible. But here are a few list articles from the time of the "C2Net moderation experiment". For those who aren't award, Sandy Sandfart is the marketing guy at C2Net who was trying to "moderate" this mailing list. Sandy Sandfart posted the following lie (note the date): ]Date: Fri, 7 Feb 1997 11:26:27 -0800 (PST) ]From: Sandy Sandfort ]To: Mike Duvos ]Cc: cypherpunks at toad.com ]Subject: Re: My messages not appearing on either of the lists? ]In-Reply-To: <199702071636.IAA26298 at netcom19.netcom.com> ]Message-Id: ]Sender: owner-cypherpunks at toad.com ] ]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ] SANDY SANDFORT ] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ] ]C'punks, ] ]On Fri, 7 Feb 1997, Mike Duvos wrote: ] ]> ...Messages apparently do not get moderated in the order in ]> which they are received... ] ]All messages are filtered and posted in the order in which I ]receive them. ] ] ] S a n d y To which Tim May wrote (and Sandy spiked this article, and many others): ]Message-Id: ]In-Reply-To: ]References: ]Date: Fri, 7 Feb 1997 13:59:23 -0800 ]To: cypherpunks at toad.com ]From: "Timothy C. May" ]Subject: More on the Stronghold Charge ]Cc: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) ] ]Vulis has sent me private mail, which I won't quote here because of the ]usual netiquette standards that private mail not be quoted (though it's ]legal to do so). He asserts that a few weeks ago he sent criticisms of ]Stronghold out to the Cypherpunks list, and the criticisms did not appear ]on any of the distributed lists. ] ]He claims he then received communications from C2Net of a legal nature, ]threatening him with legal action. I'll let Vulis elaborate if he wishes, ]as I don't know the situation. And I encourage him to do so, for more than ]one reason. ] ]As I just replied to "Against Moderation" on, I would like to see these ]articles which were suppressed. Please repost them to the list, and copy me ]to ensure that I get them. ] ]If this claim is true, that Sandy blocked criticism of Stronghold from ]reaching either the Main list (bad enough), or from even going out at all ]on the Flames list (reprehensible), then this is an extremely serious ]charge. ] ]If the claim is true that Sandy used articles sent to the Cypherpunks list, ]but never distributed to the list, as the basis by the company which ]employs him of legal threats of any kind, then this is even more than just ]"extremely serious." ] ]I would like to hear more from Vulis, and copies of any such articles, and ]of course would like to hear Sandy's version of things. ] ]This is too serious a charge not to resolve. ] ]--Tim May ] ]Just say "No" to "Big Brother Inside" ]We got computers, we're tapping phone lines, I know that that ain't allowed. ]---------:---------:---------:---------:---------:---------:---------:---- ]Timothy C. May | Crypto Anarchy: encryption, digital money, ]tcmay at got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero ]W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, ]Higher Power: 2^1398269 | black markets, collapse of governments. ]"National borders aren't even speed bumps on the information superhighway." ]Date: 8 Feb 1997 04:31:15 -0000 ]Message-Id: <19970208043115.2364.qmail at anon.lcs.mit.edu> ]From: Against Moderation ]Subject: The Frightening Dangers of Moderation ]To: cypherpunks at toad.com ]Cc: tcmay at got.net ]Precedence: bulk ] ]-----BEGIN PGP SIGNED MESSAGE----- ] ]Well, folks, tonight I have witnessed the frightening dangers of ]moderation and censorship first-hand, and would like to tell you what ]has happened. I think there is an important lesson to be learned from ]these incidents. ] ]Before I explain what has happened, I want to make one thing ]absolutely clear. Though I've thought the moderation of cypherpunks ]was a terrible idea from the start and am even more convinced of it ]now, I don't assign any blame to Sandy. I believe he offered to ]moderate the list with the best of intentions, and I sincerely ]appreciate his efforts to try to revive what was once a fantastic ]mailing list, even if in my opinion those efforts have backfired. ] ]Sandy has been a valuable advocate of cypherpunk beliefs and a lively ]contributor to cypherpunks list for a long time. Though the ]moderation experiment has resulted in some terrible consequences, we ]can't blame him for what has happened. If the events I have witnessed ]tonight occured with such a high-standing member of the cypherpunks ]community in charge, the cause of them can only be the very nature of ]moderation and censorship. I don't think any of us could have done ]much better in Sandy's shoes. ] ]Now, what happened tonight? As some of you may recall, a month or so ]ago I vehemently argued against the elimination of the ]cypherpunks-unedited mailingt list. Some people (though no one ]associated with toad.com) were claiming that 3 mailing lists might be ]too much load, and that having cypherpunks and cypherpunks-flames ]would be enough. I argued that not only would the delay of waiting ]for a decision put alternate cypherpunks moderators at a disadvantage, ]it would make it farm more difficult to convince people of the ]moderator's honesty as there would be no guarantee that messages made ]it to either list. Fortunately, cypherpunks-unedited did get created ](it seems no one "in charge" ever intended not to create it). ] ]Well, as it turns out, a number of messages have made it neither to ]cypherpunks nor to cypherpunks-flames. Making matters worse, however, ]not only are certain messages being suppressed from both lists, but ]even messages mentioning that fact get suppressed from both the ]cypherpunks and the cypherpunks-flames lists! ] ]Here's exactly what happened. I was beginning to believe that Dmitri ]Vulis had sent an (admitedly objectionable) message to the cypherpunks ]mailing list, but that the message had gone to neither the cypherpunks ]nor the cypherpunks-flames lists. Since I was under the impression ]that every article was supposed to go to one list or the other, and ]many people probably still believe that, I mentioned this somewhat ]startling fact on the cypherpunks mailing list, I believe in response ]to a post by Tim May on the same subject. ] ]Tim replied (in a message Cc'ed to cypherpunks--though I don't think ]it went anywhere but to -unedited), asking me in the message, "Can you ]send to the list, with a copy to me, the articles CENSOREDCENSOREDCENS ]OREDCENSOREDCENSORE?" I therefore went back through my mail archives ]and found a copy of the message that I believed had gone to neither ]mailing list. I sent it to Tim and to cypherpunks. I prepended a few ]paragraphs in which I asked people to confirm that the message had ]gone to neither mailing list. Among other things in those paragraphs, ]I stated that Vulis's message was "verifiably false". It was clear ]from the context that I was forwarding this message to ask people ]which lists it had gone to, not because I believed the content to be ]correct or even at all convincing or interesting. That message I ]sent, quoting Vulis's, immediately follows this message, after the ]line '========'. ] ]Then, tonight, I received a message from Sandy, which I include below ]a second '========' marker. In that letter, Sandy had explicitly ]aknowledged not only that he had sent Vulis's letter to neither ]mailing list, but that he wouldn't send my letter to either mailing ]list, either! He claimed that he couldn't forward Vulis's message ]because it was libel, and accused me of committing libel simply by ]quoting Vulis's message, even though I explicitly stated that Vulis's ]message was verifiably false. ] ]Well, this travesty must exposed, even if I can't make known all the ]details for fear of libel charges. I am therefore forwarding ]everything I can to the cypherpunks mailing list, for all to see. As ]you can see, Vulis made unfounded and incorrect charges that a ]particular system contained a security hole. Believe me, if I could ]get into the details of the case I could convince you easily that his ]claim is not true. However, since even quoting that claim apparently ]opens me up to charges of libel, I can't give you the details. Thus, ]I have censored (by overriting original text with the letters ]CENSORED) any portion of quoted messages that might give you an ]indication of what system Vulis actually claimed had a security hole. ] ]This censorship should not, however, affect my main point, and the ]lesson that I hope we can all take away from this. When it comes down ]to it, the details of this case do not matter. What does matter is ]that even when the "good guys" attempt benign censorship, it can have ]frighteningly far-reaching effects on people's ability to discuss ]otherwise reasonable topics such as the mechanics of the cypherpunks ]list. I generally dislike censorship and moderation, but the ]consequences of the cypherpunks experiment have gone far beyond ]anything I could have imagined. ] ]In closing, let me reiterate that I don't think most of this is ]Sandy's, John's, or anyone else's fault. Given the knowledge I have ]of this case, I believe Sandy has unwittingly found himself ensnarled ]in a nasty legal situation where, for fear of legal reprisal he must ]block articles that he has a moral obligation to send to ]cypherpunks-flames. I certainly don't envy his position. ] ][To moderator Sandy: I believe we must get the content of this ]message to the main cypherpunks mailing list. I have done everything ]I can to ensure that the message contains no libel. If, for some ]reason, you still can't send it on to the main cypherpunks mailing ]list, can you please tell me specifically which parts cause problems. ]I will the CENSOR them out and try again. This message contains ]important, highly relevant information for the cypherpunks community. ]Please help me do what it takes to get it accepted by the moderation ]process. Thanks.] [snip] ]Date: Fri, 7 Feb 1997 16:45:31 -0800 (PST) ]From: Sandy Sandfort ]To: Against Moderation ]Subject: Re: Is Sandy really censoring criticisms of CENSOREDCENSOREDCENSORE? ]In-Reply-To: <19970207220720.15530.qmail at anon.lcs.mit.edu> ] ]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ] SANDY SANDFORT ] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ] ]Hi, ] ]On 7 Feb 1997, Against Moderation wrote: ] ]> What I object to more strongly and think is wrong is the ]> fact that it went to *neither* list. ] ]Unfortunately, it's not as simple as that. As soon as I can ]arrange it with John, I am going to stop moderating the list. ]In the interim, I *will not* be sending your post onto either ]the Flames or the Moderated lists. This is done for legal ]reason. As it is, you have already published a libel on the ]unedited list by repeating Dimitri's libel. This exposes you to ]legal liability, but as an anonymous poster, you are somewhat ]insulated from the consequences of your act. ] ]If you would like to PRIVATELY discuss this matter with me, I ]would not mind going into more detail with you. Suffice it to ]say, I any re-publication by me of Dimitri's libel would expose ]John and myself to legal liability and could also act to ]insulate Dimitri from liability as a result of CENSOREDCENSOREDCE ]NSOREDCENDOREDCENDOREDC. ] ]Take care, ] ] ] S a n d y [to be continued] --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From dlv at bwalk.dm.com Sat Oct 4 08:29:36 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Sat, 4 Oct 1997 23:29:36 +0800 Subject: Stronghold In-Reply-To: Message-ID: This is the second chunk of the same. Tim May described C2net's legal threats: ]Message-Id: ]In-Reply-To: <19970208043115.2364.qmail at anon.lcs.mit.edu> ]Date: Fri, 7 Feb 1997 21:46:10 -0800 ]To: Against Moderation , cypherpunks at toad.com ]From: "Timothy C. May" ]Subject: Re: The Frightening Dangers of Moderation ]Cc: hugh at toad.com ] ]At 4:31 AM +0000 2/8/97, Against Moderation wrote: ]>-----BEGIN PGP SIGNED MESSAGE----- ]> ]>Well, folks, tonight I have witnessed the frightening dangers of ]>moderation and censorship first-hand, and would like to tell you what ]>has happened. I think there is an important lesson to be learned from ]>these incidents. ] ](long account of getting legal threats for quoting a message about CENSORED ]elided) ] ]This is indeed an important incident. I hope we can discuss it. Many issues ]central to Cypherpunks are involved. To name a few: ] ]* the moderation/censorship issue itself (though we have probably beaten ]this one to death in the last few weeks). ] ]* the "libel" issue, especially as it involves Sandy, his company, and the ]machine the list is hosted from. The introduction of a censor has, as many ]of us predicted, raised serious libel and liability issues. (This is the ]best reason I can think of it to move to an "alt.cypherpunks" system, where ]bypassing of liability, libel, copyright violation, etc., laws is ]naturally handled by the globally decentralized and uncontrolled nature of ]Usenet.) ] ]* conflicts of interest issues. Apparently Sandy feels information ]deleterious to C2Net, having to do with a claimed CENSORED in the software ]product CENSORED, cannot be passed by him to _either_ of the two lists to ]which articles are supposed to be sent. (Sadly, he did not tell us of this ]meta-censorship when it happened. This made what he did deceptive as well ]as wrong.) ] ]* chilling of discussion. As "Against Moderation" notes, merely _quoting_ ]the article of another caused Sandy to not only reject his article, but ]also to contact him and raise the threat of legal action. (This even though ]Against Moderation added all sorts of "obviously false" comments to what ]Vulis had written.) ] ]* even more threats. At the request of CENSORED today, I called CENSORED ]and had a verbal communication with him (a nice guy, by the way) about this ]situation. He averred that "you don't want to be pulled into this," and ]suggested that if I post certain things, even quoting the reports that a ]CENSORED exists in CENSORED, I could well be sued by the lawyers of his ]company! ] ]These are issues which remailers, decentralized servers, anonymity, data ]havens, and other Cypherpunks technologies make important issues for us to ]discuss. ] ] ]When did Cypherpunks start thinking about libel? (Obvious answer: when ]_their_ companies were the targets of criticism, lies, libel, whatever.) ]It's not as if insulting or even "libelous" (I'm not a lawyer) comments ]have not been made routinely on the list. Insulting companies and other ]institutions has been standard Cypherpunks fare since the beginning. ]Mykotronx has been accused of high crimes, RSADSI has been declared to be ]placing backdoors in code, Phil Zimmermann has been declared to be an NSA ]plant ("only trust the versions of PGP before he cut the deal to get his ]freedom"), and so on. Think about it. Just about any company with any ]product related to crypto has at one time or another had their motives ]questioned, their products slammed, etc. ] ]Unfortunately, our Late Censor is an employee of one of the companies so ]slammed, and he has reacted by rejecting one or more of these slams without ]bothering to tell the list that he has to do so. (Were it me, I would have ]"recused" myself from the decision, or at least told the list in general ]terms what was going on, or, more likely, resigned as censor. But then I ]would never have been a list.censor in the first place.) ] ]I understand that Sandy is stepping down as our Moderator. The Censor is ]Dead, Long Live Sandy! I expect to harbor no continuing resentment toward ]Sandy (though I expect things will be strained for a while, as might be ]expected). ] ]The issues raised are ugly ones. Here's what scares me: the "precedent" may ]irretrievably be established that companies offended by words on the list ]will threaten legal action to recover their good name. I can imagine ]Mykotronx or even First Virtual citing the actions of C2Net as a precedent ](a cultural precedent, to the extent there is such a thing) for their own ]legal letters. ] ]As with the terrible precedent set by the "even Cypherpunks had to censor ]themselves" experiment, these companies may be able to say "But even a ]Cypherpunk-oriented company realized that the antidote for damaging speech ]was not rebutting speech. No, these Cypherpunks realized that some ]threatening letters and pulling the plug on the speaker was a better ]approach." ] ]And we won't be able to easily argue that Mykotronx has no right to do this ]while C2Net does. ] ]Sandy, in his message a few hours ago to Against Moderation, even made the ]claim (and Sandy _is_ a lawyer, or at least once was) that John Gilmore ]could be held liable for speech on the Cypherpunks list. (I don't doubt the ]"could," but I hate like hell to see a Cypherpunkish company leading the ]charge.) ] ]Perhaps this is true. But the Censorship experiment, and the resulting ]threats of legal action by C2Net to stop mention of the alleged CENSORED in ]their product CENSORED, fuel the fire. Instead of denigrating such legal ]moves--as I'm sure most Cypherpunks would have done a few years ago if ]RSADSI were to try to sue people for making outrageous claims--we have a ]major company consisting of several leading Cypherpunks making just such ]threats. ] ]I'm not a legal scholar, but is it really the case that merely _alluding_ ]to the allegedly libelous comments of another is itself a libel? Is a ]reporter who writes that "Person X has alleged that Product Y has a Flaw Z" ]thus committing a libel? (I don't think so, as reporters frequently report ]such things. If merely quoting an alleged libel is also libel, then ]presumably a lot of reporters, and even court clerks reporting on cases, ]are libelers.) ] ](ObLisp reference: quoting an expression ought to have a different return ]value than evaluating an expression! That's what quotes are for.) ] ]My comments this past week have not been motivated by animosity toward ]Sandy, and certainly my comments today are not motivated by any animosity ]about C2Net or any of its employees (including CENSORED, whom I spoke with ]today). ] ]My comments started out as being a summary of why I had left Cypherpunks ]when the Great Hijacking was announced. Since last Sunday, when I issued my ]"Moderation" post, I've only responded to messages I was CC:ed on, or to ]messages on the Flames list, which I subscribed to temporarily to better ]see what Sandy was calling flames. The discovery that certain posts were ]not appearing on either the Main list or the Flames list triggered today's ]comments about Sandy and the alleged CENSOREDCENSOREDCENSORED (blah blah ]blah). ] ]I hope we can declare this Censorship experiment a failure and move on. ]However, it is almost certain that as a result of attempts to suppress ]certain views, that the move back to an unfiltered state will mean that ]some will use anonymous remailers and nym servers to post even _more_ ]claims, however outrageous. ] ]This is a predictable effect. Cf. Psychology 101 for an explanation. ]Kicking Vulis off the list predictably produced a flood of Vulis ]workarounds, and a surge in insults via anonymous remailers. Instituting ]censorship of the list triggered a flood of comments critical of the ]experiment, and a predictable "testing" of the censorship limits. And, ]finally, now that C2Net is threatening legal action to stop ]discussion--even in quotes!!--of alleged CENSORED in CENSORED, expect a lot ]of repetition of these claims via remailers. And, I predict, claims about ]CENSORED will even be spread more widely, e.g., on the Usenet. ] ](Sadly, I half expect a letter from some lawyers or lawyer larvae saying I ]am "suborning libel," or somesuch nonsense. As Sandy would say, "piffle." ]Lawyers, take your best shot.) ]Message-Id: ]Date: Sat, 8 Feb 1997 09:22:08 -0800 ]To: cypherpunks at toad.com ]From: "Timothy C. May" ]Subject: META: Censorship is Going Way too Far ] ] ]Fellow Cypherpunks (of the virtual community, even if not part of any ]particular version of the list(s)), ] ] ]I am about to drive over the Santa Cruz mountains for today's physical ]meeting at Stanford, and made my last check of the Singapore archive site ]to see if my last several messages to the CP list have appeared. (The ]Singapore site archives the main list every four hours; the latest update ]is 08:15 PST, local time.) ] ]They have _not_ appeared, on either of the two lists, the main list and ]filtered list. I don't know if they have appeared on the "unfiltered" list, ]as I don't have access to an archive site for that, and don't subscribe to ]it. Some of these articles are now more than 18 hours old. ] ](I scanned the archive site carefully and did not see any of my articles. ]If I somehow missed them (all four?!), I apologize to the Moderator and ]will make an appointment with my eye doctor.) ] ]Further, messages dated _much_ later in time are now on the Singapore site, ]meaning they were "approved." (The latest such message I see is from J. ]Blatz, and is dated 2/8/97, 02:58 a.m., EST, which is fully 10 hours after ]the first of my messages which never appeared on either the main list or ]the flames list.) ] ]My articles are dated: ] ]* 2/7/97, 1:46 p.m. PST ] ]* 2/7/97, 1:59 p.m., PST ] ]* 2/7/97, 3:03 p.m., PST ] ]* 2/7/97, 9:46 p.m., PST ] ]I would normally give the message names here, but I suspect that even ]mention of the message titles would cause _this_ message to be filtered ]into the black hole list. So, by avoiding even mention of the message ]titles, I should be safe. Nothing in this message can be considered flamish ](beyond normal criticism) or libelous. ] ](Many articles with dates later than these have already appeared on the ]main list, and some have already appeared on the Flames list. Why have none ]of my articles gone through as of this morning?) ] ]The subjects of my articles deal with the claims made by "Against ]Moderation" and Vulis that certain articles were filtered from the stream ]of articles without appearing on either the main list or the flames list, ]and with no mention by the Moderator of this significant change to the ]moderation policies. ] ]I surmise that my articles are similarly vanishing into a black hole, ]presumably because I have questioned the policies here. (Possibly my ]articles have been side-tracked for further review, or for review by a ]certain company's legal staff, or whatever. If so, this should be explained ]to the main list. And the implications of this, if it is happening, should ]be discussed on the main list.) ] ]By the way, I will deliberately make no mention of the details of my ]articles, or of those by Against Moderation, as I also surmise that any ]articles dealing with a certain product by a certain company will be ]filtered out completely. ] ](I carefully did not repeat the claims made against one of these products ]in my articles, so there is no way under the sun I can be charged in any ]court with "libel.") ] ]To paraphrase the Detweiler of a couple of years ago, "I am quite shocked ]by this situation." It is one thing to filter out posts which contain ]infantile, barnyard taunts and insults, it is quite another to filter out ]_content_. ] ]And it is even worse to not pass on these filtered comments to the "flames" ]list, which was putatively set up to contain such comments. Worse still ]that the list as a whole is not being told of this policy, and that posts ]which mention it are not going out. ] ](There has been some discussion of articles not going out, such as in Igor ]Chudov's recent articles, but I surmise from his article that Igor is ]unaware of the filtering I'm talking about here. I am copying Igor on this ]message, to ensure he knows at least part of what is going on here.) ] ]There is no justification in any of the stated moderation goals for ]blocking articles such as mine, or this one. ] ]As my posts yesterday did not contain flames or insults (beyond normal ]minor turns of phrase some might not like, just as _this_ post contains ]mildly flamish comments if one is so inclined to see _any_ criticism as ]flamish), they should have appeared on the main list. They have not, so ]far, even though articles generated many hours later have already appeared ]on the main list. ] ]And, as of minutes ago, they have not appeared on the Flames list, even if ]the Moderator decided they were flamish. (Even if _one_ was, arguably, not ]all of them were.) ] ]So, we are increasingly in a situation where: ] ]a. the moderation policies appear to be changing on a daily basis ] ]b. articles which are not even flamish are being dumped ] ]c. some of these dumped articles are not even appearing on the "Flames" list ] ]d. the appearance of a conflict of interest is increasing ] ]e. discussion is being squelched ] ]I am cc:ing this message to a handful of Cypherpunks to ensure that it gets ]some propagation before today's meeting. ] ]I find it very sad that things have come to this. ] ] ]--Tim May I wrote: ]Subject: Re: META: Censorship is Going Way too Far ]From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) ]Message-Id: <68qT2D82w165w at bwalk.dm.com> ]Date: Sat, 08 Feb 97 15:39:16 EST ]In-Reply-To: <199702081136.LAA26752 at mailhub.amaranth.com> ] ]"William H. Geiger III" writes: ]> ]> In , on 02/08/97 at 11:22 AM, ]> "Timothy C. May" said: ]> ]> >They have _not_ appeared, on either of the two lists, the main list and ]> >filtered list. I don't know if they have appeared on the "unfiltered" list, ]> >I don't have access to an archive site for that, and don't subscribe to it. ]> >Some of these articles are now more than 18 hours old. ]> ]> All 4 of your post made it to the unfiltered list. ]> ]> I don't know what made it to the moderated/flam list as I had switched to the ]> unmoderated list yesterday morning. ] ]I'm monitoring all 3 lists... A whole batch of Tim's posts made it to the ]cypherpunks-unedited list, but to neither filtered list (he listed them in ]another article that appeared so far on the "unedited" list but not on ]either filtered list). ] ]Also a message on the taboo subject from John Young appeared on 'unedited' ]but not on either filtered list. Its headers were: ] ]]Message-Id: <1.5.4.32.19970207222314.006ca6f0 at pop.pipeline.com> ]]Date: Fri, 07 Feb 1997 17:23:14 -0500 ]]To: cypherpunks at toad.com ]]From: John Young ] ](I suppose Sandy can't stop JYA from placing it on his Web site, can he? :-) ] ]A whole lot of my articles over the last week didn't make it to either ]filtered list. This is nothing new... but the following is: ] ]My article, quoting the threatening letter that C2Net's lawyers had sent ]me, has not appeared even on cypherpunks-unedited! Its headers were: ] ]]To: cypherpunks at toad.com ]]Cc: tcmay at got.net,antimod at nym.alias.net ]]From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) ]]Message-ID: ]]Date: Sat, 08 Feb 97 11:14:34 EST ]]In-Reply-To: ](i.e., in reply to Timmy May's article that appeared on the unedited list, ]but not on either filtered list.) ] ]I'd like to know whether the cc: recipients got it. Thanks. ]I'm also bcc'ing this article to a bunch of people, and encourage them ]to quote it to the list. ] ]I assume that suppressing my articles from appearing on the unedited ]list would require cooperation from John Gilmore. [snip] Someone wrote: ]Date: Mon, 10 Feb 1997 06:33:13 -0800 ]From: Cuckoo ]To: cypherpunks at toad.com ]Subject: Re: Who's Censoring Who? ]References: <1.5.4.32.19970209181732.006dba6c at pop.pipeline.com> <32FF2971.6099 at cuckoo.com> ] ]John Young wrote: ] > Sandy's e-mailed several of us who've sent messages about Vulis's ] > ploy to put Sandy in a conflict-of-interest bind ] ] Did Sandy happen to mention how the evil Dr. Vulis managed to ] twist his impressionable young mind so that his only concern about ] libel is centered around his employer? ] ] Did Sandy mention why his employer went nuclear over the mention ] of the 'b-d' word by an individual whom his employees on the list ] regularly label as a troublemaker and a nut case? ] (Methinks they doth protest _too_ much?) ] ] Did Sandy mention that his employer is in the postion of owning ] the cypherpunks.com domain-name and is in a great postion to profit ] by controlling and/or destroying the cypherpunks list? ] Did Sandy mention that when his own takeover of the list (by ] virtue of 'moving' the subscribers into a list filtered by himself) ] faltered, by becoming an open joke, that one of his fellow employees ] called for the "killing" of the list? ] Did Sandy mention that the pecker-tracks of his employers minions ] leave a sordid trail across the whole face of this whole censorship ] farce? ] ] Gee, John, I wish that I had crypto software to sell, and employees ] who were in control of the reputation capital of the cypherpunks list. ] I wish that I had a domain named cypherpunks.com waiting to capitalize ] on the cypherpunks name to sell my crypto software. ] Of course, some asshole somewhere might regard this as a "ploy" ] to profit from creating misfortune for the cypherpunks. They might ] even think that I had a hand in that misfortune. ] ] ] > It's probably worth saving accusations of censorship for the real ]> thing ] What fucking planet have you been living on, shit-for-brains? ] We're not talking about "accusations," here. We're talking about ] posts by average list subscribers who are coming forward and speaking ] out about the facts surrounding the misappropriation of their posts ] in order to further the private interests of Sandy. ] We're talking about the suppression of postings which Question ] Authority. We're talking about shit-canning postings without ] informing the list, because the actions are reprehensible. We're ] talking about censorship which, in the censor's own words, is not ] based on crypto-relevancy, but a changing morass of ill-defined ] 'Sandy rules' (or 'Sandy Rules!', if you prefer). ] We're talking about robotic censorship where those who do not ] bend under the jackboots suppressing free speech on the cypherpunks ] list are auto-botted to cypherpunks-dontsaybadthingsaboutmyemployer. ] ] Your posts are usually fairly intelligent, so I have no idea why ] you are wasting your own reputation capital attempting to defend ] an inept, lame-duck censor who is too cowardly to defend his own ] vile actions. ] Instead, he declares that he has absolutely no interest in ] filtering out the "Make Money Fast" and "Penis-Picture" garbage ] for list members if he can't use his usurped-power to slam the ] jackboots down on any niggling detail that doesn't serve his ] own private interests. ] ] Cuckoo (<-- Dr. Vulis 'made' me use this name.) Gilmore defends C2net's censorship: ]To: cypherpunks at toad.com, gnu at toad.com ]Subject: Moderation experiment almost over; "put up or shut up" ]Date: Tue, 11 Feb 1997 03:54:29 -0800 ]From: John Gilmore ]Sender: owner-cypherpunks at toad.com ] ]Sandy hit a pothole in the moderation experiment when Mr. Nemesis ]submitted a posting containing nothing but libelous statements about ]Sandy's employer. He never anticipated that he wouldn't be able to ]follow his announced "post it to one list or the other" policy because ]to do so would make him legally liable (in his opinion; he's a lawyer, ]I'm not). His gears jammed, and the whole machine came to a halt for ]a few days. [snip] Dr. Adam Back's analysis is pretty accurate: ]Date: Sun, 16 Feb 1997 23:49:09 GMT ]Message-Id: <199702162349.XAA00536 at server.test.net> ]From: Adam Back ]To: cypherpunks at toad.com ]Subject: Moderation experiment and moderator liability ] ] ]There appears to be a bit of a hush up surrounding the circumstances ]of the pause in the moderation experiment and subsequent change of ]moderation policy. ] ]To clear the air, I think it would be kind of nice if the full story ]were told, so I'll gather here a history as I understand it. ]Information from my archives (those I have), and from asking around in ]email. ] ]I realise that some of the actions that I am claiming of participants ]in this sequence of events seem hard to believe given their high ]reputation capital. I was myself initially dubious on the strength of ]the reputation capital of those being critisized. ] ]However the below is the sequence of events as close as I can ]determine. ] ]I welcome being proven wrong on any points. ] ] ]Events: ] ]1. Dimitri Vulis posted a lot of off topic posts over a period of time ] ]2. Dimitri reposted a couple of 50k Serdar Argic revisionist articles ] ]3. Dimitri challenged John Gilmore to shut him up ] ]4. John unsubscribed Dimitri, and modified majordomo at toad.com to ]siltently ignore Dimitri's attempts to resubscribe. Dimitri could ]still post, and presumably read cypherpunks with a different email ]address or via an archive. It was a token unsubscription only. ] ]5. When Dimitri figured out what John had done, he made many posts ]denigrating John as a censor ] ]6. Much discussion ensued critisizing John for blocking Dimitri ] ]7. Over Christmas some joker subscribed cypherpunks at toad.com to a load ]of sports mailing lists, Hugh Daniels and John cleaned up the mess ] ]8. Followed a long thread on hardening lists against spam attacks ] ]9. John made a post to the list announcing that the list would be ]moderated for one month from Jan 11 as an experiment, and included ]Sandy Sandfort's proposed moderatation policy and offer to act as ]moderator. It appeared that the moderation experiment was Sandy's ]suggestion, and that John had agreed to go along with it. ] ]10. Some discussion both pro and con of moderation, and the technical ], free speech, and legal aspects followed ] ]11. Moderation started Jan 19, the main list became the moderated list ] ]12. Lots of people complained about the moderation, some defended it ]Tim May quietly unsubscribed ] ]13. Some people complained about inconsistency in moderation -- some ]articles which went to flames were not flamish, but made by posters ]with low reputation capital, or were following up to posts which were ]flamish. ] ]14. After a while some people commented on Tim's absence, and sent him ]mail asking what happened. Tim posted an article explaining that he ]had left because of the imposed moderation without discussion. ] ]15. John followed up with a post defending the moderation experiment, ]and arguing for it's popularity (he claimed as evidence the number of ]posters who had not taken the trouble to move to the unedited list). ] ]16. Dimitri posted an article where he claimed that there was a ]security flaw in Stronghold. Stronghold is C2Nets commercial version ]of the freeware Apache SSL web server. Sandy is employed by C2Net. ] ]17. Sandy dropped the posting entirely -- it went to neither ]cypherpunks (edited), nor cypherpunks-flames. He considered that ]forwarding the posting would have made him legally liable. Sandy is a ]lawyer by profession. He did not explain this situation on the list. ] ]18. Tim May had by now subscribed to cypherpunks-flames, and posted ]several follow-ups to Dimitri's posting, discussing the issue of ]Dimitri's post being dropped, and stated that Dimitri's posting was ]not flamish, and should not have been dropped in his opinion. Tim's ]postings were also silently dropped, going to neither of cypherpunks ](edited), and cypherpunks-flames. ] ]19. Sandy made an announcement that he was ending his participation in ]the moderation experiment. Still no explanation of why posts were ]dropped, or even admission that they were. ] ]20. The two moderated cypherpunks lists (cypherpunks and ]cypherpunks-flames) went dead for some time. ] ]21. Tim received a warning from C2Net's lawyers that if he did not ]desist from mentioning that Dimitri had posted an article criticising ]a C2Net product that he would be sued! ] ]22. John posted a statement where he explained Sandy's sudden ]announcement of ending his particpation. John explained that Sandy ]had "hit a pothole in the moderation experiment when Mr. Nemesis ]submitted a posting containing nothing but libelous statements about ]Sandy's employer". Sandy did not drop Johns posting even though it ]covered the same topics that had resulted in Tim's posts being ]dropped, and resulted in Tim receiving legal threats from C2Net. In ]the same post John said that he had come to the conclusion that he was ]no longer willing to host the cypherpunks list. In this post John ]announced that Sandy had been persuaded to continue to moderate for ]the remainder of the moderation period, and gave the new policy. The ]changes were that anything other than crypto discussion and discussion ]of forming a new cypherpunks list would go to flames, and anything ]that Sandy thought was libelous would be dropped silently. ] ]23. Sandy posted a statement affirming that he would continue to ]moderate, and that if any cypherpunks wished to discuss his prior ]moderation policy and performance as a moderator that they do it on ]new lists which they create themselves. ] ] ](If Sandy's current moderation criteria mean that he feels obliged to ]forward this post to cypherpunks-flames as off-topic, or even to ]silently drop it from both moderated lists, so be it. I will simply ]repost it later, when the moderation experiment is over on one of the ]new lists. In the event of myself receiving legal threats, I shall ]simply post it via a remailer, or rely on someone else to do so. C2 ]does not appear to be running any remailers at the moment, otherwise I ]would use a remailer hosted at c2.net as the exit node in the remailer ]chain.) ] ] ]The positive outcome of all this has been to make the cypherpunks list ]more resilient to legal attack. The new distributed list seems to be ]progressing well, and will be less liable to attack. Filtering ]services continue, as they should. And alt.cypherpunks has been ]created as a forum ultimately resistant to legal attack. ] ]Also I should say that I would hope that no one holds any long term ]animosity towards any of the players in this episode, many of the ]people have been very prolific in their work to further online privacy ]and freedom, and I hope that we can all put this chapter behind us. [snip] C2Net denied threatening to sue Tim May, so he refuted their lies: ]Message-Id: <199702170412.UAA18115 at toad.com> ]Date: Sun, 16 Feb 1997 19:14:04 -0800 ]From: Tim May ]To: cypherpunks at toad.com ]Newgroups: alt.cypherpunks, alt.privacy, comp.org.eff.talk ]Subject: Threats of Legal Action and C2Net/Stronghold Issue ] ](A copy of this message has also been posted to the following newsgroups: ]alt.cypherpunks, alt.privacy, comp.org.eff.talk) ] ] ]At 6:07 PM -0800 2/16/97, Sandy Sandfort wrote: ] ]>Curiously, in a subsequent telephone conversation, Tim May ]>proposed almost that exact suggestion as an alternative form of ]>moderation that he said would have been acceptable to him. Go ]>figure. ] ]The only phone conversation I had was with Doug Barnes, at the request of ]Doug that I urgently phone either him or Sameer. I called Doug as soon as I ]got the message. (Doug also said he was the only one in the room at the ]time, and that the call was *not* being recorded, so I have to surmise that ]Sandy got his version of things via a recap by Doug.) ] ] ]>> 21. Tim received a warning from C2Net's lawyers that if he did not ]>> desist from mentioning that Dimitri had posted an article criticising ]>> a C2Net product that he would be sued! ]> ]>Absolutely false. ]> ] ]What Doug told me was that Dimitri Vulis had already been served with a ]legal notice about his warnings about a security flaw in Stronghold, and ]that any repetition of Dimitri's claims by me or anyone else would result ]in similar legal action. ] ]Doug said that any repetition of the claims, even as part of a quote, would ]be seen as actionable by C2Net. "We'll vigorously defend our rights." (as ]best I can recall) He said he thought my messages, to the extent they ]merely _alluded_ to the claims were probably OK and that they would ]certainly go through to the list, as Sandy has already resigned from his ]role as moderator. ] ](For the record, these messages DID NOT GO THROUGH, and have not gone ]through as of tonight, 8-9 days later. However, I have forwarded them to ]several people who requested them.) ] ](I also did not have a recorder running, so I can't claim this is a ]verbatim summary of what was said. As to what I said about how the ]moderation thing might have been done differently, Doug and I chatted for a ]while about various alternatives. I raised the point I've made before, that ]having a "members only" policy, with some special provision for some amount ]of remailed messages, would probably best suit the notion of keeping the ]"community" running. What I told Doug was that my main objection was having ]Sandy sit in judgement to essays folks might have spent a long time ]composing, and I cited physical parties, where a host invites those he ]wants in attendance, but does not micromanage or screen conversations being ]held at the party. My sense was that Doug agreed, and agreed that the whole ]thing had been handled in a bad way...but Doug should comment to tell his ]view of things.) ] ]The next day, at the physical Cyperpunks meeting at Stanford, I briefly ]talked to Greg Broiles, working as a legal aide at C2Net. I told Greg he ]could "take his best shot," in terms of filing suit against me about my ]messages, as I'm prepared to fight C2Net in court on this matter, and have ]the financial resources to hire some pretty good lawyers. (I don't recall ]if Greg replied, or what his reply was.) ] ]In a message to Cypherpunks, I outlined my understanding of the Vulis ]report on security flaws in Stronghold, and put the claims in the context ]of messages not appearing on either of the two main lists, but none of my ]messages were sent to either the Main list or the Flames list. ] ](I also had communication with several members of the list, some known to ]me and some only pseudonyms. I have taken the precaution of erasing these ]messages and copying files to the disk on which they resided to head off ]any attempts by C2Net seize my computer and disks as part of some ]"discovery" process.) ] ]I find it unfortunate that C2Net is behaving in such a manner, and their ]actions are generating far more publicity about the claimed security flaws ]in Stronghold than the original Vulis message ever would have generated. ] ]Sunlight is the best disinfectant, as a Supreme Court justice averred. And ]suppression is a breeding ground for all sorts of bacteria, fungi, and ugly ]growth, as a less articulate person said. [snip] In conclusion, I want to thank Dale Thorn, Toto, and all other punks who participated in the good fight against C2net's censorship. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From suck_my_root at DosEquis.cum Sat Oct 4 08:44:47 1997 From: suck_my_root at DosEquis.cum (Harka #23) Date: Sat, 4 Oct 1997 23:44:47 +0800 Subject: russia_1.html In-Reply-To: <199710040438.EAA00226@DosLinux> Message-ID: <34365E76.4662@DosEquis.cum> Routers Old Media Beatrice shows you the best sites for... Beatrice's Web Guide [Flashers.....] Show me! [ Yahoo | Bite Us | Search | Info ] [ Index | Fingers | World | Buzz | Polident | Spurt | Scorewomen | Enter train | Allah Board ] _________________________________________________________________ Previous Story: The one before this story. Next Story: The one after this story. _________________________________________________________________ Friday October 3 7:09 PM EDT US Sees No Bakery Roll in Russia's Nuclear Arms WASHINGTON (Reuter) - The United States Friday rejected the claim of a Russian scientist that Moscow had secretly developed nuclear "suitcase bombs" under KGB orders in the 1970s specifically for terrorist purposes. "It is foolish to believe that a Russian scientist would know more about it than our spies." a spokesman pointed out. "We have no information or evidence suggesting that nuclear weapons were ever developed for or put under the control of the KGB, which is part of the story here," State Department spokesman James Rubin said. "This does not mean," Rubin added, "that we will not tell members of the US Congress the exact opposite, in closed meetings, in order to get them to pass unconstitutional legislation." Rubin, reflecting previous U.S. statements, did not deny so-called "suitcase bombs" may be part of Russia's arsenal. "We want to have our nukes and deny them, too." he said. "We cannot comment...about the precise specifications or dimensions of any nuclear weapons," he told reporters, "because, for all of our posturing, we are pretty fucking clueless." But he repeated the U.S. view that "there is no evidence other than hearsay to support such claims" that portable Russian nuclear weapons may have gone missing. "And since it is our own FUD-generated hearsay," he added, "we ought to know." "There's probably no issue where you have the combined resources of the U.S. government working as well together and with such determination as the issue of security of nuclear weapons, and we work on it every day, hundreds if not thousands of people in the government," he said. "It might be compared to the BATF's efforts to ensure the safety of soft targets, such as the former Murrah...uuhhh. Never mind..." he said. "And if they say that we have no information on this and they say that these accounts are hearsay, that's pretty compelling," Rubin added. "And if we say the exact opposite, tomorrow, then that will also be pretty compelling." Rubin said, with a smirk. Testifying before Congress Thursday, Alexei Yablokov, a respected scientist who served on the Russian National Security Council, contradicted statements by Russian officials denying the existence of the weapons and buttressed claims that many of them have gone missing. But he was a fucking Commie, so what the fuck does he know. "I am absolutely sure that they have been made," he told the House Military Research and Development subcommittee, "but I'm a fucking Commie, so what the fuck do I know." The issue arose when former Russian National Security Adviser Alexandr Lebed alleged that up to 100 portable suitcase-sized bombs were unaccounted for since the 1991 breakup of the Soviet Union. Lebed's allegations have been alternately confirmed and denied by US intelligence sources, depending on who they are trying to bullshit and manipulate at any given point in time. According to Lebed, who has agreed to testify before the House committee later this month, the devices have an explosive capacity of one kiloton -- the equivalent of 1,000 tons of TNT -- can be activated by a single drug dealing, terrorist, encryption-using pedophile and could kill as many as 100,000 non-encryption using people. Yablokov said he had spoken to the scientists who worked on the weapons and so was certain of their existence, as well as the existence of the Cirle of Nuclear Eunuchs in Bienfait, Saskatchewan. But he said the former Soviet Defense Ministry might never have known about the so-called "atomic demolition munitions" because they were developed for the KGB spy service under a secret program. He added that the US Department of Defense was a much better source of information as to what secret programs were and were not in existence in the heart of the Soviet Union. On the issue of possible missing nuclear weapons, Rubin said Moscow "continues to assure us that it retains adequate command and control and that appropriate physical security arrangements exist for these weapons and facilities." Rubin then looked around, seeming confused, and said, "I can't find my shoes. Has anyone seen my shoes?" "We have no reason or evidence to doubt these assurances," he said. _________________________________________________________________ ________________________ Search News Help! Help! Help! _________________________________________________________________ Previous Story: The one before this. Next Story: The one after this. Beatrice shows you the best sites for... Beatrice's Web Guide [Flashers.....] Show me! _________________________________________________________________ [ Index | Fingers | World | Buzz | Polidick | Spurt | Scorewomen | Enter train | Allah Board ] _________________________________________________________________ Routers Limited Questions or Comments or Bad Attitudes From jf_avon at citenet.net Sat Oct 4 09:14:28 1997 From: jf_avon at citenet.net (jf_avon at citenet.net) Date: Sun, 5 Oct 1997 00:14:28 +0800 Subject: (Fwd) [Exerpts of ] Cdn-Firearms Digest V2 #18 Message-ID: <199710041614.MAA22544@cti06.citenet.net> ------- Forwarded Message Follows ------- Date: Fri, 3 Oct 1997 10:15:14 -0600 From: owner-cdn-firearms-digest at sfn.saskatoon.sk.ca (Cdn-Firearms Digest) To: cdn-firearms-digest at broadway.sfn.saskatoon.sk.ca Subject: Cdn-Firearms Digest V2 #18 Reply-to: cdn-firearms-digest at sfn.saskatoon.sk.ca Cdn-Firearms Digest Friday, October 3 1997 Volume 02 : Number 018 [snip] ------------------------------ Date: Tue, 30 Sep 1997 15:26:24 -0600 (CST) From: mtoma Subject: stated goals "Our task of creating a socialist America can only succeed when all those who would resist us have been totally disarmed". Sarah Brady, highly paid, highly motivated figurehead for Handgun Control Inc., to Senator Howard Metzanbaum. National Educator 1994, page 3. Now what was Sharon Carstairs comment about the social(ist) reengineering of Canadian society? Of course you knew that, did you not? ****** Had an email today, from Bob Lickacz. His comment regarding [the book] Unintended [Consequences] ...Wow! what a book. This is very true. no other book have I read gets to the heart of the matter, that is our love of firearms and shooting. At the same time, no other book puts things in such perspective as to how we got here in matters of gun control. Of course it is a history of the process in the USA. The similarities in Canada are frightening. Buy the book, loan it out. Available at Paladin Press, and amazon.com. Cheers, M. Toma ------------------------------ [snip] ------------------------------ Date: Wed, 1 Oct 1997 08:46:01 -0600 (CST) From: "Fred Davis" Subject: RE: Ruby Ridge?? >Would someone please tell me what relevance the posting of the Ruby >Ridge incident has on the Canadian Firearms Digest? > >Thank you > >Bud Melless IMHO it is apparent that police agencies on both sides of the border are pursuing militarist and sometimes violent actions against citizens who are subsequently charged with non-violent "crimes", if anything at all. You can find out the whole story on the Ruby Ridge incident by pointin your favorite browser to: www.ruby-ridge.com Fred ------------------------------ End of Cdn-Firearms Digest V2 #18 ********************************* List Submissions: cdn-firearms-digest at sfn.saskatoon.sk.ca Mailing List Commands: majordomo at sfn.saskatoon.sk.ca http://cdn-firearms.ml.org/cdn-firearms/homepage.html To subscribe, email to majordomo at sfn.saskatoon.sk.ca, no subject, and body: subscribe cdn-firearms-digest subscribe cdn-firearms-alert subscribe cdn-firearms-chat end From randerso at ece.eng.wayne.edu Sat Oct 4 10:01:35 1997 From: randerso at ece.eng.wayne.edu (Ryan Anderson) Date: Sun, 5 Oct 1997 01:01:35 +0800 Subject: New PGP "Everything the FBI ever dreamed of" In-Reply-To: Message-ID: <3.0.2.32.19971004125619.006aec0c@ece.eng.wayne.edu> -----BEGIN PGP SIGNED MESSAGE----- At 12:52 AM 10/4/97 -0500, amp at pobox.com wrote: > >Though I hate the conmcept of key escrow, it actually makes sense for >corporations to be able to have access to internal documents. Why they >think having key escrow in place will stop people from being able to use >other encryption as well is beyond me. I guess it's the same (stupid) >mentality of the feds. They don't think anyone would be smart enough to use >the escrowed encryption a a wrapper for the non-escrowed encryption. The idea behind escrow in a company is to let each employee have their own key (and secret key/pass-phrase) so that they can digitally sign e-mails, and send encrypted e-mail, but with the escrow to let other people access this mail. This is not any more surveilance than already exists in a corporate environment, and I believe it's main purpose is *not* inside the corporation, but for secure communications with people in other companies, typically partners, suppliers, clients, etc. I can't see a problem with it in this situation. Oh, and one of the bills in Congress seemed to prohibit the US Government from using escrow in this way in government agencies. I can't see a justification for this. [Other than normal FOI reasons.] Think military communicating with weapons contractors if you need an excuse for this kind of encryption in the first place. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNDZ1Mjc3ytqHnNyNAQEyZQP/VH/HLUyHkImbrhWmlzeMBx5YScEM6hOa NcgWcFn2GLEG4sUuQW4nv4fUNwB+uPjtPJW06SWk0HttG5U6k+GZNxysKLQE07Qm 8NW/QnyRAgcZCyirt1fKfSCGk44K1GFjal0AeX10AM0x+58tYvCTEHjXUa5Pap/6 +sghxJNM2AQ= =pF3Z -----END PGP SIGNATURE----- ----------------------------------------------------------------------- Ryan Anderson - "Who knows, even the horse might sing" Wayne State University - CULMA "May you live in interesting times.." randerso at ece.eng.wayne.edu PGP Fingerprint - 7E 8E C6 54 96 AC D9 57 E4 F8 AE 9C 10 7E 78 C9 ----------------------------------------------------------------------- From nobody at REPLAY.COM Sat Oct 4 10:03:46 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sun, 5 Oct 1997 01:03:46 +0800 Subject: Regulate them to 'double-death'... Message-ID: <199710041647.SAA29174@basement.replay.com> Cynthia Brown wrote: > Canada may be regulated to death according to most libertarians, but I for > one like it that way. I can walk alone and unarmed at night in Ottawa, > Toronto, etc. without fearing for my life. Can a female resident of > Washington or New York say the same? Our schools do not have metal detectors > at the entrances because they are not needed. No, instead, Canadian students terrorize each other with old-fashioned forms of violence, like at Cole Harbor high school in Newfie'land, where they use baseball bats to keep the niggers in line, and in Montreal, where four teenagers have been driven to suicide in the last few weeks by the 'taxing' they have endured from the youth gangs that roam the subways. Perhaps Canada needs 'more' regulation... CanuckMonger From jya at pipeline.com Sat Oct 4 10:28:50 1997 From: jya at pipeline.com (John Young) Date: Sun, 5 Oct 1997 01:28:50 +0800 Subject: Stronghold Message-ID: <1.5.4.32.19971004170309.006e6f6c@pop.pipeline.com> Dimitri Vulis reposted parts of the Stronghold/censorship drama: Dimitri: This replay continues your artful distortion of the exchanges, presumbly to make your best case, yet it still fails to explain your original beef with Stronghold. Perhaps this is unfair, but it now appears that you are using the disputed censorship issue to cloud your reluctance, or inability, to substantiate a fault in Stronghold. Send me the Stronghold fault, I'll be happy to add it to the other crypto-security stuff that wasn't supposed to be published. This is not meant to defuse the censorship matter, that's still live ammo. From anon at anon.efga.org Sat Oct 4 11:23:11 1997 From: anon at anon.efga.org (Anonymous) Date: Sun, 5 Oct 1997 02:23:11 +0800 Subject: None Message-ID: It is time to spread some new propaganda, especially in America. One of you with some money should get bumper stickers made up. Make them look nice, with a nice clean font and very simple, say dark lettering on a white background, noble looking. Have them say this: I am an anarchist. I do not believe in government. Simple. Gets the point across. From JonWienk at ix.netcom.com Sat Oct 4 12:20:47 1997 From: JonWienk at ix.netcom.com (Jonathan Wienke) Date: Sun, 5 Oct 1997 03:20:47 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: Message-ID: <3.0.3.32.19971004113450.00689718@popd.netcruiser> At 07:16 PM 10/1/97 +0100, Alex Le Heux wrote: >You people just don't get it do you? A gun has one purpose: To kill. Just like >any other tool, a gun, if it is available _will_ be used at some point. > >So making sure there are lots of guns around only serves to make a lot of >people very dead. This is a Bad Thing. > >Gun control laws are not the issue. It's a matter of mentality. In Europe, >where we have rather strict guncontrol laws, and have had them for a long >time a decent human being will not even think of shooting someone else. In the >US, where guns are tradition and part of the American way, many people would >not think twice before shooting someone. The result of this is that the >number of people getting killed by guns is enourmous, be they criminals, >little kids, old grannies, or presidents. You are right to the extent that the US has a more violent culture than the UK and many other European countries, and has a higher murder rate. However, your argument that the presence of guns == corpses is demonstrably false. Private ownership of firearms has a significant deterrent effect on violent crime. This may not be obvious when comparing the US to the UK, but when comparing the statistics for areas within a country, region, or city, it becomes indisputable. Before Kennesaw, Georgia passed its famous (or infamous) ordinance requiring each household in the city to own a gun and allowing concealed carry of firearms, it had an average of 25-27 violent crimes (murder, armed robbery, etc) per year. After the ordinance was passed, there was one violent crime the first year, and three the next. The gun control shills in the press reported this as a tripling in the violent crime rate. Since the state of Florida passed a "shall issue" concealed carry law (if you apply, pay the fee, pass the safety course, and are not a felon or mentally incompetent, the state shall issue you a concealed carry permit) it has experienced significant reductions (10-20%) in the rates of murder, rape, armed robbery, and other violent crimes. Even in England and Scotland, this inverse relationship between private gun ownership and violent crime can be demonstrated, according to Colin Greenwood, retired chief of the West Yorkshire Constabulary and criminology researcher since the sixties. The explanation for this phenomenon is simple. Most people are not mentally unbalanced, or violent criminals, and therefore are capable of safe and responsible gun ownership. I had a gun when my wife told me that she was having an affair with one of her co-workers. By your theory, my wife should be dead. However, she remains in good health, we communicate frequently, and are currently working on a reconciliation. Why? Because I (and most other people) have sufficient moral fortitude to reject the idea of committing murder for foolish reasons. I am not a lunatic, therefore I do not behave like one. When the general population is armed, especially if they are armed during their daily activities, the life of muggers, rapists, and murderers becomes extremely dangerous. People who insist on staying in these professions are quickly removed from the gene pool by natural selection, and the smarter ones gravitate to less dangerous professions, thereby reducing the crime rate in two separate ways. Even if only 10% of the population is carrying, the 1% or less that is still outgunned by a factor of 10 or more, and only fools play those odds. The US has a higher rate of murder by strangulation than does the UK. Would you argue that Americans posess more hands than their British counterparts? At 04:20 PM 10/1/97 -0400, Cynthia Brown wrote: >IMNSHO the best way to fight crime is not with bigger guns than the "bad >guys", but with better social programs such as universal health care, and >improved day care so single parents can show their kids what a productive >lifestyle looks like. This takes longer than blowing the brains out of some >teenager that feels his only path to a better life is through crime, and it >doesn't give the same adrenalin rush. However, it works at the source of >crime, and not the consequences. We already have more social programs than we can afford--they are a large part of the problem. Why would a 19 year old work for minimum wage at an entry-level job when he can get on walfare and get better benefits than he would from the job, and thereby have the time to make $1000 per night selling crack. Jonathan Wienke What part of "the right of the people to keep and bear Arms, shall not be infringed" is too hard to understand? (From 2nd Amendment, U.S. Constitution) PGP 2.6.2 RSA Key Fingerprint: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 DSS/D-H Key Fingerprint: 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC Public keys available at pgpkeys.mit.edu. PGP encrypted e-mail preferred. Get your assault crypto before they ban it! US/Canadian Windows 95/NT or Mac users: Get Eudora Light + PGP 5.0 for free at http://www.eudora.com/eudoralight/ Get PGP 5.0 for free at http://bs.mit.edu:8001/pgp-form.html Non-US PGP 5.0 sources: http://www.ifi.uio.no/pgp/ http://www.heise.de/ct/pgpCA/download.shtml ftp://ftp.pca.dfn.de/pub/pgp/V5.0/ ftp://ftp.fu-berlin.de/pub/pc/win95/pgp ftp://ftp.fu-berlin.de/pub/mac/pgp http://www.shopmiami.com/utopia.hacktic.nl/pub/replay/pub/pgp/pgp50/win/ RSA export-o-matic: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 From ravage at ssz.com Sat Oct 4 12:27:48 1997 From: ravage at ssz.com (Jim Choate) Date: Sun, 5 Oct 1997 03:27:48 +0800 Subject: None (fwd) Message-ID: <199710041943.OAA01527@einstein.ssz.com> Forwarded message: > Date: Sat, 4 Oct 1997 14:14:08 -0400 > From: Anonymous > Subject: None > It is time to spread some new propaganda, > especially in America. > > One of you with some money should get bumper > stickers made up. Make them look nice, with > a nice clean font and very simple, say dark > lettering on a white background, noble looking. > > Have them say this: > > > I am an anarchist. > I do not believe in government. > > > Simple. Gets the point across. The point being, this is a cook. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From dv at dev.null Sat Oct 4 12:49:52 1997 From: dv at dev.null (Deja Vu) Date: Sun, 5 Oct 1997 03:49:52 +0800 Subject: InforWar 31 / (Part III of 'The True Story of the InterNet') Message-ID: <343698AF.679D@dev.null> A non-text attachment was scrubbed... Name: not available Type: text/html Size: 23822 bytes Desc: not available URL: From dv at dev.null Sat Oct 4 12:52:18 1997 From: dv at dev.null (Deja Vu) Date: Sun, 5 Oct 1997 03:52:18 +0800 Subject: InfoWar 31 / TEXT Message-ID: <3436992B.6801@dev.null> ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * Anarchist Post of the Century * Anarchist Post of the Century ---------------------------------------------------------------------------- Anarchist Post of the Century ---------------------------------------------------------------------------- Subject: Freedom of Encryption: Is it SAFE? From: "Michael Pierson" To: cypherpunks at cyberpass.net -----BEGIN PGP SIGNED MESSAGE----- There has been much discussion recently concerning how to fix certain flaws, or block various amendments in encryption legislation being shepherded through Congress. A far more fundamental problem with these legislative efforts from the beginning was that they involved an implicit concession to the idea that a U.S. citizen's freedom to privately exchange information in whatever coding scheme he or she might choose required some kind of government affirmation or ratification as validation. Once one seeks for the government's deigning to "affirm the rights of United States persons to use and sell encryption", it can (and does) then easily proceed to attach conditions and caveats to these "affirmed" rights. In the process the surveillance hawks within the government have managed, with hardly any struggle, to advance the appearance of legitimacy for their claims of authority to regulate this form of expression. Now comes an expectation that the nature of these "affirmed rights" should be tailored to address "the concerns of national security and the federal law enforcement community." This same community has on occasion complained about how their efforts to fight organized crime and terrorism are being thwarted by not having the modern newspeak disguised equivalent of "Writs of Assistance" (and they are arguably making progress toward acquiring just such powers IMO). Very few politicians are willing to commit the heresy of clearly and staunchly asserting that the information coding methods used by citizens are under no obligation to pass any litmus test, or to be subject to any kind of prior approval or restraint determined by criteria of the law enforcement establishment or anyone else. If the Feds lament that this will make their job harder, too bad. In the words of Orson Welles: "Only in a police state is the job of a policeman easy." When these various legislative efforts attempted to reach beyond the issues of export restrictions to address those of domestic use, they became a doubtful and dangerous fix to something that wasn't broke in the first place. If the Government is intent on "abridging the freedom" to use strong encryption domestically, a legislative affirmation of these rights is feeble comfort at best. If I'm seeking to protect my possessions, I don't ask a thief to affirm my property rights. Of course, even the export question is really about the aims of the state's surveillance constituency to obstruct the wide deployment of strong encryption domestically, and its interoperability on the internet as a whole. Challenging the derisible bogosity of the "preventing the Evil Ones from acquiring this technology" rationale that is invoked to justify these restrictions was not something legislation was likely to do with any great vigor. Legislation to "relax" these restrictions involves lending credence to the dubious assumption that these restrictions had any constitutional validity to begin with. Any bill that would have truly provided for the statutory endorsement of the acceptably uncompromised use of strong encryption never really had much more than a snowball's chance in hell of actually being signed into law given the current political balance of power, did it? Far more likely, was that it could be corrupted and hijacked as a vehicle to further the very type of restrictions it was purportedly intended to relieve. A collateral consequence is an increased arrogance and presumption among lawmakers that it is their prerogative to act to define for us citizens, what freedoms for domestic use of encryption we should be permitted. The growing gallery of GAK amendments and competing legislative proposals now emerging appears to support this sad scenario. It's starting to look like the prospects for meaningfully improving the situation with encryption legislation in the current political environment were about as promising as the prospects of a neophyte gambler coming out ahead at a crooked casino. I expect any apparent winnings in the end will come with a catch between the lines in the fine print, if they come at all. In any case, whatever is legislatively affirmed can later be legislatively denied. What a King presumes is his to grant, he usually presumes is his to revoke as well. In the end, what will have really been gained by this legislative venture, and what will have been explicitly or implicitly surrendered? As I see it, at this point the issue isn't about counting wins, it's about cutting losses. Freedom of encryption.... Is it SAFE? I don't think so. -Michael -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: noconv iQCVAwUBNDVks9GJlWF+GPx9AQGctwQAlE+SKB3/rqG7kz3qdcF2I5eBedz3/DDK f5Vg0Zd8PbhowwT9gWAvyt+ysIZCqRJWMu3vPmWP2iN2ZghLaiGRVv8piXhyUQYl rhv/rOz1Yc1raJbU5Wk+9Qr9zxQqxHZiAk1G0Irye4yDfi72ar8ndD5CqUegBnaF QAoyFGtiJZ4= =2zJO -----END PGP SIGNATURE----- ---------------------------------------------------------------------------- Anarchist Post of the Century ---------------------------------------------------------------------------- Subject: DejaVu: Cypherpunks as Philosopher Kings From: "Attila T. Hun" Reply-To: "Attila T. Hun" Organization: home for unpenitent hackers; no crackers! To: "Timothy C. May" , cypherpunks -----BEGIN PGP SIGNED MESSAGE----- ten months ago: on or about 961218:1123 "Timothy C. May" purported to expostulate: +_Direct action_ is what it's all about. Undermining the state through +the spread of espionage networks, through undermining faith in the tax +system, through even more direct applications of the right tools at the +right times. + +When Cypherpunks are called "terrorists," we will have done our jobs. [Tim] said this before Christmas last year as an erudite and lengthy addendum to my lengthy tome: "Cypherpunks as Philosophy Kings" that pretty well summed our generally mutually agreed "philosophy". both were and still are worth reading; anybody who does not have copies, ask. but cypherpunk terrorists are not violent; this is all about making information free and protecting privacy with technology. despite the fact the Commerce Committee effectively killed SAFE (or we think they did until Oxley tries to tack his amendment structure on an appropriations bill in a house-senate conference or "manager's mark" procedure (whatever that is)), we can not drop the due diligence, and the public must be aroused, called to battle. even if there is no action, prepare for the next fire drill. sow the seeds of dissension. seems to me we were sure the CDA was dead --except it slipped in with a manager's mark after the house voted almost unanimously the other way (402-12 or something like that). the capitol hill sleaze took a grand slam NO and reported an even worse yes, making it part of a major bill that absolutely was going to pass --and they have the gall to call that travesty democracy? Teddy Roosevelt: "It is difficult to make our material condition better by the best law, but it is easy enough to ruin it by bad laws." Tim's message for Christmas last was the prophetic call for direct action; legal action; empowerment action: Robert H. Jackson (1892-1954), U.S. Judge: "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." CYPHERPUNKS MUST BE THE JOHNNY APPLESEED OF THE INFORMATION AGE. the sleazeball, who intends to make J Edgar look like a piker at surveillance, has the gleam of unabridged power in his eyes. Louis F[reeh,uck] is charming, even disarming, as he tells a Congressional committee: "We are potentially the most dangerous agency in the country if we are not scrutinized carefully." (Jun '97) meaning the FBI will be the most powerful [feared] federal agency? really? I thought it was already, although the DEA and BATF have worked hard for the title, too. Supreme Justice Louis O. Brandeis said: "The greatest danger to liberty lurks in insidious encroachment by men of zeal, well-meaning but without understanding." and the [London] Electronic Telegraph, on Sunday's front page: Mr. Freeh has won $370 million (�230 million) of funding for 2,000 new posts, boosted the number of active agents to more than 11,000, and expanded open-ended "domestic security operations" from 100 in 1995 to more than 800. Twenty-three new FBI offices are opening abroad. and more: But none of this will contain the director's ambitions or his power. He is now believed to be eyeing two other "secret police" forces - the Drug Enforcement Agency and the Bureau of Alcohol, Tobacco and Firearms - with a long-term view to a takeover. F[reeh,uck] holds the key to the Clinton's' ambitions; the Clintons cite the Roosevelts as their mentors; Hillary even communes with the long dead Eleanor. Bubba's stated goals included extending FDR's "chicken in every pot" --he's just appeasing the crowd now. Leopards do not change their spots, but Bubba has shifted to the right with public opinion; he is just like the leopard: playing with his food until sufficient presidential powers have been accumulated by the default of Congress and the people. But, the INFORMATION REVOLUTION now stands in way of the Clinton plans; the Internet can destroy the media control now exercised by the acquiescence of the five Jewish media barons. In fact, it is destroying their monopoly. THE CONTROL OF INFORMATION IS THE CONTROL OF POWER. Why does F[reeh,uck] hold the key? Because his job is to sell the Congress on strangling the information revolution before it destroys truthless governments F[reeh,uck]'s masters understand and control. Franklin D. Roosevelt was inaugurated on 4 Mar 33 stating: "I am prepared under my constitutional duty to recommend the measures that a stricken nation in the midst of a stricken world may require. These measures, or such other measures as the Congress may build out of its experience and wisdom, I shall seek, within my constitutional authority, to bring to speedy adoption. But in the event that the Congress shall fall to take one of these two courses, and in the event that the national emergency is still critical, I shall not evade the clear course of duty that will then confront me. I shall ask the Congress for the one remaining instrument to meet the crisis broad Executive power to wage a war against the emergency, as great as the power that would be given to me if we were in fact invaded by a foreign foe." and, on 9 Mar 33, 5 days later, FDR extracted from an uniformed and essentially special session of Congress: "Be it enacted by the Senate and the House of Representatives of the United States of America in Congress assembled, That the Congress hereby declares that a serious emergency exists and that it is imperatively necessary speedily to put into effect remedies of uniform national application." which was based on the War Powers Act (trading with the Enemy) of 1917 which was hastily revised to include US Citizens which had been exempted. Next, FDR "franchised" the banks, "licensed" agriculture and so on. But, to render the citizens powerless and to confiscate all assets so the national state was the ultimate owner, and therefore able to pledge the people for credit to the international bankers, the fundamental monetary system changed: "Whenever in the judgment of the Secretary of the Treasury, such action is necessary to protect the currency system of the United States, the Secretary of the Treasury, in his discretion, may require any or all individuals, partnerships, associations and corporations to pay and deliver to the Treasurer of the United States any or all gold coin, gold bullion, and gold certificates owned by such individuals, partnerships, associations and corporations." which closed the loop and made every US citizen chattel as FDR pledged the good faith and credit of the United States to the international bankers --in return, an unbelievable flood of credit was available since the good faith and credit of the United States is "We the People...." but FDR sold us downstream into a debt financed economy from which there is no escape; we are still there, the debt service is destroying any permanent economy AND total collapse under the debt load is bequeathed to our children. Congress repealed FDR's rubber stamp for the "President" in 1973, but the War Powers Act remains, still modified to treat US citizens as the enemy. and the power of the "President" to make those regulations, and the automatic approval are enshrined for current and future Presidents in Title 12 USC 95(b) "The actions, regulations, rules, licenses, orders and proclamations heretofore or hereafter taken, promulgated, made, or issued by the President of the United States or the Secretary of the Treasury since March the 4th, 1933, pursuant to the authority conferred by subdivision (b) of Section 5 of the Act of October 6, 1917, as amended, are hereby approved and confirmed." The real issue is the President and the fat cat power brokers can get away with these shenanigans __as_long_as_the_people_let_them__. We are still under the Rule of Necessity. We are still in a declared state of national emergency, a state of emergency which has existed, uninterrupted, since 1933. FDR's licensing agencies were rather trivial in number; today there are thousands of them, many with their own administrative courts. FDR took away our common law when he bankrupted America, which is a national corporation under the Hague convention (courtesy of Stanton and Seward after the Civil War). Bankruptcy is a contract, and we are the bait, subject to that court, which is in effect an Admiralty court, and we are "licensed" to literally exist by FDR's Social Security Number schema. and every courtroom now flies the fringed Admiralty flag where habeas corpus is a privilege, not a right, if it exists at all. This is the importance of Louis F[reeh,uck]. He, and Janet Reno as the DOJ rubber stamp, are holding the collar for your neck. They are selling it to you little by little, or even all at once. Why Louis F[reeh,uck]? Madison Avenue style with credentials; he can sell the program. F[reeh,uck] is the front man, the schill. Machiavelli, in his "Discourses of Livy," acknowledged that great power may have to be given to the Executive if the State is to survive, but warned of great dangers in doing so. He cautioned: Nor is it sufficient if this power be conferred upon good men; for men are frail, and easily corrupted, and then in a short time, he that is absolute may easily corrupt the people." sleazeball's comments are scarfed by Congress, sleazeball's candor rocks their cradles, sleazeball shows them private morality plays about a populace running wild with crypto-anarchy, running wild to burn out the offices of central power... in other words: DEPRIVE THEM CONGRESSCRITTERS OF THEIR FREE LUNCH AND IMMUNITY. is it not odd that the more the government tries to abridge our free speech rights, the more they want to confiscate our weapons? free speech is a weapon of democracy! privacy is a weapon of democracy! cryptography is a weapon of democracy! We are not fighting with guns and explosives this time, armed insurrection against the power of the Federal government is suicidal --we are fighting for our lives and the right to live our lives with words: the ability to hear those words _before_ government censors and spin doctors render them useless lies. Bubba can not win a war of truth and information; we can/ The Marquis de Sade: Are not laws dangerous which inhibit the passions? Compare the centuries of anarchy with those of the strongest legalism in any country you like and you will see that it is only when the laws are silent that the greatest actions appear. however, anarchy is the key word that ignites even the ACLU against your cause; it even makes bedfellows of Pat Buchanann and the homosexual/priest/congressman from Massachusetts... pure anarchy, by definition, does not work, anyway. forget it. get the concept out of your systems as it inflames everyone and all other reason is lost in the screaming and police batons. Even Teddy Roosevelt called for the complete extermination of anarchists, to be hunted like vermin. give it up; or go to your private island and fly your rattlesnake flag. even Anguilla will not tolerate anarchists. just give us our REAL constitutional rights as Franklin, Madison, Jefferson, Adams, and friends intended; give us constitutionalists on the Supreme Court, not bleeding hearts, statists, and central power freaks. get the Feds out of cradle to grave big government and let the people determine their religion and morality. give us freedom of speech, freedom to bear arms, freedom from unreasonable searches, freedom not to incriminate ourselves, and repeal the 14th Amendment so we can have states' rights again. if our Constitution were permitted to govern as it was intended, and the states obeyed the precepts endowed to not further limit the rights of the people, America would be the home of the free, not big government, not freeloaders and the welfare state; not the leftovers of a once great nation. give us the rights Abraham Lincoln cherished lovingly: "Those who deny freedom to others deserve it not for themselves." let _them_, not me, live the downside. George Washington, in his farewell address, warned: "... change by usurpation; for through this, in one instance, may be the instrument of good, it is the customary weapon by which free governments are destroyed." cypherpunk philosopher kings: pick up your picks and shovels, get your hands dirty, and start digging in; it's going to be a long and difficult campaign and the tactics needed to expose F[reeh,uck]'s true intentions as the schill for the Clintons who are schills for the elitist leading the destruction of American democracy. The Congressional compromise love match season isn't over yet; the schmoozers and lobbyists, like so many furry rats, still wander the dark halls and tunnels looking for the last, late in the season, clandestine and obscene fuck. any whore will do. lobbyists have long reputations for selling out the interests of their paymasters; the lobbyists are so much a part of the Washington culture that they have _no_ morality or moral position --it is all about who they can claim to have influenced --what difference does it make if it is contrary to the client --the art of the deal, protect their own position and find newer, richer clients --whores! logrolling and porkbarrel voting --but never go home without a deal; used car salesmanship: get your man. I can hear the lobbyists whining now as they are called on the carpet: "aw, come on Mac, we got you a compromise from LEA demands..." never realizing that there is such an action as NO bill, they sell out half our rights blocking legislation which would never happen. they claim they got back half. what half? --some unknown half that we _never_ lost! that is why: The 10 Commandments contain 297 words. The Bill of Rights is stated in 463 words. Lincoln's Gettysburg Address contains 266 words; and: A recent federal directive to regulate the price of cabbage contains 26,911 words. (The Atlanta Journal) send the quisling Neville Chamberlains to the gas chambers! the public needs to be educated, not in crypto, but in the horrors of an oligarchy which intends to destroy the fundamental freedoms on which we stand. publish his credit records; publish his medical records --tell his neighbors about his visits from Child Protective Services... then Joe Coach Potato will figure out he needs something AFTER he figures out there are fuckors and fuckees, and he's on the short end of that stick. [pardon my French] then, and only then, will the masses understand privacy --when they have lost it. either we show the people before they lose everything to uncle, or... just dump it on the table to show everyone just how much uncle knows about _you_. Attila's thought for the day: Now, with a black jack mule you wish to harness, you walk up, look him in the eye, and hit him with a 2X4 over the left eye. If he blinks, hit him over the right eye! He'll cooperate. --so will politicians. Louis F]reeh,uck], did you really state this hoping everyone would think you are joking? "We are potentially the most dangerous agency in the country if we are not scrutinized carefully." Louis F[reeh,uck], you obviously know that telling the truth, before the truth is really the truth, disarms your opposition since they can plainly see that it is not true. there is a limit to what you can endure before you must stand to be counted --so I will loudly echo Tim's sentiment: + +When Cypherpunks are called "terrorists," we will have done our jobs. + -- "Experience keeps a dear school, but fools will learn in no other." --Benjamin Franklin ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDHgKr04kQrCC2kFAQHPpAQAj+ukWNVEXT+Zgf920g63wX9EZqT241dj KFqLQ9lBPZLRQydg/PMDcm8T0oI/RneVh51dep5v17IdJcPQT7MN+0CmX91k6e8m 7Wsd+cNVovzDx6dRsC8ghMDB1QBZdBWW9553FzB89RMfilTikCyqmoP6Tub+23/V QywxUxa3slA= =U4tV -----END PGP SIGNATURE----- Copyright "Anonymous TruthMonger " "Do you feel 'Cypher'�Punk? Well�do you?" ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ---------------------------------------------------------------------------- From dv at dev.null Sat Oct 4 14:47:49 1997 From: dv at dev.null (Deja Vu) Date: Sun, 5 Oct 1997 05:47:49 +0800 Subject: InfoWar 33 / The GeigerBurg Text Message-ID: <3436B414.4EBA@dev.null> ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * Anarchist Post of the Century * Anarchist Post of the...(Ouch!) ---------------------------------------------------------------------------- Anarchist Post of the Century ---------------------------------------------------------------------------- Subject: Crypto-continuation in Washington: FBI/DoJ keep up the pressure From: Declan McCullagh To: fight-censorship at vorlon.mit.edu, cypherpunks at toad.com Crypto is hot in Washington. Don't think the battle's over; it's just beginning: * This afternoon when the Senate Intelligence committee met to consider a new CIA deputy director, Sen. Bob Kerrey said "there's a real urgency" to get an encryption bill passed. (Presumably, that would be his bill, the "Key Escrow Infrastructure" McCain-Kerrey/S.909.) Anyone still think that the Senate will do the right thing on crypto? Think again... * * Last week Janet Reno talked at her weekly press conference about balancing law enforcement rights with privacy rights -- through mandatory domestic key escrow. * * Yesterday Louis Freeh spoke at length before the House International Relations committee about the spread of nuclear weapons... and reminded committee members about the problems the FBI has with nonescrowed crypto... * * Sen. Jon "Mandatory Domestic Key Escrow" Kyl said on Sunday that the Clinton administration's export controls on crypto were *not tight enough*... More info: http://cgi.pathfinder.com/netly/opinion/0,1042,1385,00.html http://www.jya.com/declan8.htm -Declan **************** HEARING OF THE SENATE INTELLIGENCE COMMITTEE NOMINATION OF LT.-GEN. JOHN A. GORDON TO BE DEPUTY DIRECTOR OF THE CENTRAL INTELLIGENCE AGENCY CHAIRMAN: SENATOR RICHARD SHELBY (R-AL) 106 DIRKSEN SENATE OFFICE BUILDING WASHINGTON, DC 2:00 P.M. EDT WEDNESDAY, OCTOBER 1, 1997 SEN. KERREY: I hope no doubt that you've heard of and perhaps had the opportunity to read the recommendations made by Senators Helms and Moynihan, but I think they're excellent. It's an excellent examination of, first, the need in some instances to classify, as well as the need to examine that classification system. It's not really a question, General Gordon. I think it's imperative that, on the issue of encryption, that the president exert some authority and try to pull together the congressional leaders and say, "We need a secure public network." There's counter-intelligence concerns. There's national security issues here at stake, obviously, balanced against the concerns for civil liberties and the concern for commercial interests and the need to develop. But there's lots of action up here on the Hill, both in the House and the Senate, in half a dozen committees or eight or nine committees, or Lord knows how many altogether, more than I realized existed. And I think there's a real urgency to get something passed both for the private sector, so they can have some stability, but also on the public-sector side, so we can protect the nation's interests. MR. GORDON: Senator, I have not delved that deeply into the encryption issue. I certainly take your point on this point. But I do know that if the Senate does confirm me that that will be squarely on my plate. **************** ATTORNEY GENERAL JANET RENO'S WEEKLY MEDIA AVAILABILITY U.S. DEPARTMENT OF JUSTICE WASHINGTON, DC THURSDAY, SEPTEMBER 26, 1997 Q No, wait - ATTY GEN. RENO: You've got to be quicker than that. Q (Inaudible) - yes, ma'am. Director Freeh and Director Constantine both have complained that U.S.-made encryption devices are giving the drug cartels an advantage whereby interdiction becomes impaired. Would you favor, as Mr. Freeh does, some kind of giving of the keys to these devices to the FBI and DEA? ATTY GEN. RENO: I don't think that Director Freeh favors giving keys to the FBI and to the DEA. Q No? ATTY GEN. RENO: What Director Freeh has talked about is what we have today - if someone is going to tap a phone, they don't just go in and tap the phone, if they're going to do it legally. What law enforcement does is it develops probable cause to believe that the telephone is being used to commit a crime and that to overhear would provide evidence of a crime. That is submitted to a judge, both in federal court and in many states courts where wiretapping is authorized. The judge reviews the sufficiency of the affidavits in support of the petition and enters an order directing the telephone company to provide that opportunity. What Director Freeh is hoping to achieve is the same thing with respect to encrypted products; so that the court would direct that the key be provided to the telecommunications system, or the other system, in order to decrypt the encoded message. What we're trying - what the administration is trying to do is to recognize that there are two important interests at stake here. One is the law enforcement interest, which is so vital with respect to terrorists, with respect to being able to decrypt the drug dealer's computer when I - I can get a search warrant now and seize his black book and I can read his black book or decipher what he's talking about. But if he can encrypt the information on his computer, that will be a significant obstacle to law enforcement. At the same time, the whole purpose of encryption with modern telecommunication is to provide for the privacy interest, of commercial interest of the average citizen. And so I think it's important that we work together to ensure the law enforcement capacity and ensure that the present capacity to get court-ordered authorities for surveillance are continued and are made real, while at the same time ensuring privacy. Q So you're saying that the phone company would have the responsibility? Do they have the capability of encrypting? ATTY GEN. RENO: The phone company doesn't have it. There would be a system whereby a key would be provided through third parties or otherwise. But this is something that we need to work together on to ensure that law enforcement interests are protected and that privacy interests are protected as well. **************** HEARING OF THE HOUSE INTERNATIONAL RELATIONS COMMITTEE SUBJECT: ORGANIZED CRIME CHAIRED BY: REPRESENTATIVE BEN GILMAN (R-NY) LOUIS FREEH, DIRECTOR, FEDERAL BUREAU OF INVESTIGATION 2172 RAYBURN HOUSE OFFICE BUILDING WEDNESDAY, OCTOBER 1, 1997 10:00 A.M EDT REP. : Following up on what Mr. Hyde said on your need to fight international crime and terrorism, what do you need, as an agency director and for your agency, in terms of specifics to wage a fight that you can win? MR. FREEH: Yes, sir. As I mentioned in my statement, I think we need it on three levels. We need the permanent and minimal FBI presence overseas to develop the kinds of relationships that Dr. de Gennaro and I have had now for 18 years. We have asked for, and the Congress approved last year, in August of 1996, a plan to expand the FBI's Ligat (sp) program from approximately 23 to 43 Ligats. That would call for, by the end of 1999, 146 special agents in 42 different countries with 116 support employees. That's a total of 262 people. As I mentioned, the plan was submitted last year. It wasn't just an FBI plan. It was jointly submitted by the State Department and the attorney general. And we've asked for funding in the 1998 and 1999 budgets to reach that level. We've also asked for a continuation of the training. As I mentioned, we've been able to train thousands of police officers around the world. The benefit of that training is two-fold. First of all, we can give them what they need most of all, which are the basic tools to conduct their own investigations. Just as importantly, we develop through those relationships, as Dr. de Gennaro described it, the cop-to-cop contacts and relationships. So an FBI agent or a DEA agent can pick up the phone and speak to a police commander in Uzbekistan or Kazakhstan, if that's the place where we need to do our work. So the training is a very important part of the whole program. And again, and finally, we need the technological tools to do our work. We have to be able to communicate rapidly and securely. We have to deal with encryption. We have to deal with cyber-crime. And those are all part of a larger technological challenge which we're trying to meet. [...] REP. LINDSEY GRAHAM (R-SC): Thank you, John. Director Freeh, appreciate your testimony. It's been quite riveting, actually. One of the briefing papers we have indicates that the American public, in a recent poll, whatever you want to take polls worth, say that 70 percent of the American people who were surveyed found it likely that the United States could be attacked by terrorist groups within the next decade using smuggled nuclear devices. If you were asked that, what category would you be in? MR. FREEH: I think it's a threat and a possibility that should occupy our highest priority. I think we've seen attacks certainly in Oklahoma, in New York City. We know that many of the state sponsors of terror, including Iran, are rapidly and very aggressively acquiring nuclear technology, both in terms of warheads and launching devices. We know that many of the state sponsors of terrorism, particularly Iran, sponsor and fund and control Hezbollah groups, including groups which have connections and operations in the United States. So the links, although I don't think I've seen them in a documented form, clearly suggest that if a terrorist is willing to use a truck bomb to blow up a building with thousands of people at risk, the accomplishment of the particular objective would not be changed or influenced by the opportunity to use a much more devastating (nuclear?) or biological or chemical agent. So I think we have to take the possibility extremely seriously and we have to take drastic steps to try to prevent and detect that. **************** [This thanks to John Young. --Declan] Remarks by Senator Jon Kyl at the First International Conservative Congress--September 28, 1997 [...] The Clinton Administration pursues a foreign policy without clear goals or the will to act decisively and is squandering the national security means left to it by a dozen years of Republican presidency. It emphasizes hope over reality and reliance on arms control agreements like the Comprehensive Test Ban Treaty (CTBT), the Anti-Ballistic Missile (ABM) Treaty, and the Chemical Weapons Convention (CWC) over a stronger defense. And political benefit over national security, as in its decisions to cave in to the concerns of some in industry in irresponsibly relaxing export controls on key items like encryption technology and supercomputers. **************** ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ ---------------------------------------------------------------------------- Anarchist Post of the�(Ouch!) ---------------------------------------------------------------------------- "Damn it, Baby!" the Tourette Tic grabbed his elbow and rubbed it. Baby had never bitten him that hard before, and it hurt like hell. "OK, I apologize for the sexist joke I emailed to all of those poor, unsuspecting people." The Tourette Tic knew that Baby had bitten him to keep him from using the same chapter title, once again, but he also knew that his sexist joke was what had put her in a bad mood to start with. "And I'll use a different chapter heading for the next chapter, OK?" Baby sat down on the bed, and resumed chewing on the moose bone she had brought home in the middle of the night from some poacher's stash. She had made her point. "People with Tourette Syndrome often get caught up in repetitious cycles of thought and action." the Tourette Tic was speaking to himself, now, since Baby was putting all of her attention of the moose bone, wrestling it into submission as it tried to escape her grasp. "And sometimes we swear, too, you little cunt." Baby put her bone down for a moment gave the Tourette Tic a cold stare, challenging him to continue with this sexist line of thought. "OK, I apologize." the Tourette Tic said, hastily, but couldn't resist adding, "I forgot that you're on the rag�Ouch!" Baby trotted back to her bone and resumed her attack on it, having disciplined her alleged master for giving rein to his sexist leanings. Men� "�" the Tourette Tic muttered, glancing at Baby, nervously. Baby pretended she hadn't heard that last comment, but she secretly smiled as she continued pulling at a piece of sinew on the end of the moose bone. He was lucky he had her around to keep him on his toes, or there was no telling how far he would backslide into the bowels of sexist bachelorhood. ---------------------------------------------------------------------------- "You can hardly blame him, though." Alexis spoke the words that all of the members of the Magic Circle were thinking as they read the last few chapters of 'InfoWar' that had been submitted by the head of the 'Department of Redundancy Department.' "True." the Cowboy agreed. "Ever since Lying Fuck Louis Freeh made the mistake of tipping his hand, the CypherPunks have risen to the challenge by inundating the list with a plethora of perceptive and poignant posts." "Cowboy!" Priscilla said sternly, "Are you making fun of the tendency of people with Tourette Syndrome to get caught up in alliteration, wherein they titillate their tonsils, tending to repeatedly recite repartee redundantly representing repetitive phrases?" "Yeth." the Cowboy admitted, making fun of the lisp that Priscilla had been blessed with as a child, only overcoming the tendency in adulthood. "OK, that does it�" Jonathan spoke up, shaking his head at the inane attitude that the others had been projecting since their last use of the Trei Transponder. "I am going to reveal to the readers of Part III of The True Story of the InterNet, just how depraved you people are, by adding 'The Plot of the Platypus' to this chapter, and letting them know that you all found it hilarious." Bubba Rom Dos stood up, looking offended. "I resent the implication," he said, "that I am so insensitive as to laugh at the physical disabilities of others. I just happened to think of something extremely funny from my past, at the same time that I was reading 'The Plot of the Platypus' missive." "Me, too." Priscilla added, giggling. "I was thinking of the first time that Bubba and I had sex." The whole group roared with laughter. Jonathan took it as a sign from the Tao that he should indeed add the suggested missive to the chapter, in order to ensure that the readers of 'InfoWar' would understand the truth spoken by Winifred G. Barton, founder of the Bartonian Metaphysical Society and the Institute of Applied Metaphysics, when she said, "Always take metaphysics seriously. Never take yourself seriously." "Nuke DC!" Bubba said, and called up the post onto the GraphiScreen, whereupon Jonathan merged it with the message to the sexist by A Dog To Be Named Earlier. ---------------------------------------------------------------------------- Subject: Plot of the Platypus From: nobody at REPLAY.COM (Anonymous) Organization: Replay and Company UnLimited To: cypherpunks at toad.com ********** ~~~~~~~~~~~~~~~~~~~~ ********** WARNING!!! Plot of the Platypus !!!WARNING ********** ~~~~~~~~~~~~~~~~~~~~ ********** Since the death of Dale Thorn, I have lurked silently in the list background while observing the creeping conspiracies continually compromising cypherpunk costs. I mean..."posts." {Damn, now I'm doing it, too.} Doing what, you ask? How did you know what I said? Are you with the MIND POLICE? AM I SURROUNDED??!!!?? {Oh...I see that I put that thought in brackets, where you could read it. Whew! Had me worried for a minute, there.} To continue... Being an anonymous coward who hides behind remailers the few times that I post, I have been somewhat hesitant, nonetheless, to reveal the observations and accompanying thoughts about the direction that the cypherpunks lissed has taken {Damn, that's twice, already. I may be infected, like many of the others} since the end of the Nazi moderation/censorship experiment. While other, more vocal, list members were celebrating the apparent 'victory' over the Johnboot of fascism being lifted from our typing fingers, I had a troubled mind, worrying whether the evil forces were truly vanquished or whether they had merely escaped by way of the anonymous remailers, to the negative pole, where they would bide their time and prepare to strike again. I was counting on the shit-disturbers, chiefly Dale Thorn, to keep a practiced eye out for signs of the evil farces {Was that a typo, a Freudian slip, or another sign of the mind infection that is rapidly spreading on the list?} regrouping to once again try to destroy the cypherpunks list. Suddenly, Dale disappeared--faster than you can say, "Jimmy Hoffa." For a time, Toto attempted to carry on in his stead, but I *knew* Dale Thorn, and Toto is no John F. Kennedy. {Shit! Now I'm beginning to steal and corrupt the words of others. I'm not certain I like the implications of this. The plot may go even deeper than I previously thought...} Where was I...? Oh, yes...the Plot of the Platypus... William H. Geiger III writed: > A prime example is the welfair class in America. *^^* Anonymous rote: > Many in the welfair class have their basic needs met by... *^^* Then, in a startling development, ? the platypus wrote: >(Australia, most of europe ect have higher welfare rates). ... *^^^^^^^* >Please excuse my spelling as I suffer from agraphia see the url in my header. Notice anything a little bit *strange* in the above quotes? Suddenly, "? the Platypus" is the only one of this group that can spell welfair...warfair......welfare. {Damn! What's that clinging to my back?} What is going on here? As the Platypus's spelling gets better, the other list members' spelling gets worse. For example: Ray Arachelian sayhed: > what shal be the punishment? If the one who takes the order... *^* > reposability, then the one giving the order must be doubly... *^^* Tim May wroted: > Agraphia or not, this is one of the lamest posts I've seen in years. > Wealth is to be taken from those who have worked for it or put their > capitcal at risk *^* The CypherPunk Philosophist King, lame-ing while flame-ing? Worse yet, while flame-ing about lame-ing? Lame-ing while flame-ing about lame-ing? Fucking up his spelling while taking a cheap-shot at someone's disability in their ability to 'dis' someone with proper spelling? And then, after his "capitcal" misfire, the object of his scorn returns fire with a correct spelling of "redistribution?" ? the Platypus correctly scripted: > The US has one of the lowest rates of wealth redistribution in the... Am I making too much of this? A few simple typo's, you say? Perhaps an occasional slip of the finger--a momentary lapse of mind and/or memory, leading to a misspelled word? {Or is it 'mispelled'? I don't know, and I'm afraid to look it up. I could use the spell checker, but... No! It's too dangerous.} It's the Plot of the Platypus, I tell you...I AM NOT CRAZY!!!! I did extensive analysis of the list posts in the last few months, and I can state with absolute certainty that for every slight improvement in the quality of the Platypus's spelling, there is a court responding decease in the Kuala-T of many of T ohter libsp mambors spealing. {See? Do you SEE!?!? IT'S EVEN HAPPENING TO *ME* NOW.} That's not all. Just like before, others on the list are acting as the shills for the chief instant gator of this spelling tragivesty. Bill Stewart, a conscienshous speller, said: > [If you're going to rant about government-provided education, > _please_ spell most of your words correctly, or let technology help > you...] See? Do you SEE?!? The subtle slams by the co-conspirators are beginning. It's the next stage... "Having a little trouble with your spelling there, pal? There's no more censorship, so you can say anything you want...as long as you can SPELL it! Haaa...haaaa...haaa." The ebil fartses are once again attempting to split the cybferpukes lissed in2 too kamps--the good spellers and the bag speelers. Think about it. Have you ever heard of "agraphia" before? Ever known anyone that had it? Of course not! It was developed in an underground lavoratory in Area 51 by reptilian Nazis. Well, maybe not "reptilian", but Nazis, just the same. And LOOK! I'm using double-quotes! *Misplaced* double-quotes, nonetheless. THE MARKS OF THE *TOTO*!!! The conspiracy is spreading fast. It's everywhere. Kent Crispin, government schill {Damn! I even spell 'shill' like Toto, now. At least I managed to use single quotes this time, like we did in the old days, before the censorship crisis...which just 'happened' to happen shortly after Toto happeared out of nowhere...} Where was I...? Oh, yes... Crispin, who has long previously been the target of many vicious attacks by both Toto and the Platypus, is now showing signs of the government generated Platyagraphia and the double-quote marks of the Toto. Kent Crispin say-heyed: >will force the "welfair class" to become productive citizens or die. ^ ^^^ ^ Or is Kent Crispin, gubormint chill, marking funds of the wrist of U.S.? Is he laughtering at uds B-hynd R backs? Is he a bubble agent in the Plop of the Paperplutz? Still skeptical? Wait!! There's more!!! {No, not the Ginsu knives, you fools. I'm talking about the Plop of the Pretty Puss.} Think about the following pots, which wah *snot* sent to the list in order to hide the troops from the simplefucks lips dismemberers. Since it was not cent 2 the lips, I had to make it up, and now I'm a forager, like Tutu making those bag fridgeries of ohter cheaples pastes when he abuses their names without having their parsimmons to accuse their name for making his own pissed to the cyberhunks lost. ------- Begin Pretty Good Pretending------- PGP: Bad Spelling Virgin 0.1 To: ciderpundits at tao.dot.commie From: TheBadSpellingForger Subject: Make Con$piracy La$t Date: {I'm typing it *now*, you idiot.} Tired of being a LOSER? Tired of failing in your list takeover bids while others, like the _fuck_you_morons_ spammer, AOL'ers, and blonde bimbos with huge breasts are getting ahead in life? Tired of not getting your secret cypherpunks decoder ring, like the others, because you don't use an "authorized" operating system, and you can't spell "welfare" even though you're on it? Join the SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST today, and turn your life around. {No Bullshit! This conspiracy is so fucking secret that *nobody* knows about it--NOT EVEN ME! I had to make it up! That's how secret it is.} Good gays Finnish lost. Why do they "Finnish lost"? Because they waste their time with correct spelling, proper placement of quotation marks, and trying to develop a consistent list persona when there are already millions of Internet identities out there already, just waiting to be abused. Face it, it's the assholes that usually end up on top, and not just because most people sleep on their stomachs. So why are you WASTING YOUR TIME being a good gay, when the assholes are making the BIG BUCKS by putting naked pictures of big bucks fucking big butts on their "Native American Nude MLM" web site? Tired of being an anarchist? Tired of waiting for Jim Bell to rat you out as being a co-conspirator in his evil plot to overthrow the government? Tired of standing in front of your mirror, trying to practice acting surprised when armed forces from a dozen government agencies kick down your door to announce that someone nuked D.C., and they'd like to "ask you a few questions?" Join the SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST. Do it TODAY, and you will be guaranteed a secret cypherpunks decoder ring when the people who pull our strings pass a law criminalizing them (except for use in meeting the legitimate needs of secret conspirators against the cypherpunks list). Listen to what these Secret Conspirators have to say: Peter Trei: "Hi. I used to be a boring guy. I was so boring that none of the assholes on the list even bothered insulting me, or forging posts in my name. "Then one day, my life suddenly changed. Someone forged a post to the list in my name, and it was exciting. It was like getting robbed at gunpoint. What a rush! "When I woke up the next morning, I couldn't face going back to my normal, moral, ethical, boring life. I sent an anonymous post to the list--as TruthMonger! It felt good, like being elected to a government office by lying to people, but I wanted MORE. I began forging posts to the list using other people's identities. If they complained to the list, then I killed them, and assumed their list identities. It felt like driving INSLAW into bankruptcy, stealing their software, and murdering those who knew too much! "Now I am Peter Trei, boring cryptographer, by day, but I am any exciting, unethical asshole I want to be, at night. "I liked the SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST so much that I *stole* the conspiracy. "? the Platypus" has nothing to do with the Plot of the Platypus, I'm just making fun of his disability, like a real asshole. Toto has nothing to do with it, either. He's such a loser that everyone on the list can spot his forgeries. (Well, they "used to could". But now that I can mimic his style and have hacked his Sympatico account, I can deny all of this from my real list persona tomorrow, and nobody will be the wiser.) "I'm not just a user of the cypherpunks list, I'm an abuser." Kent Crispin: "This isn't Peter's conspiracy, its MINE! I mean, get real, I work in a secret underground lavoratory as a government shill. "Think about it. Who would you expect to conspire against a bunch of anarchists...the government! You all know how much I love the government and authority. I'm Louis Freeh's secret lover. Janet Reno is going to have my baby. "It's me! *I* am the one behind the SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST. I'm a STATIST, for God's sake, why won't you believe me? "Because I'm not one of the elitist 'chosen?' Fuck you." Tim May: "God, I *love* this list." Robert Hettinga: "Hey! If you check the archives, you'll find that I said that in a post, long before anyone else did." TruthMonger: "Now Hettinga is stealing Tim May's lines. What the hell is going on, here? Has *everybody* on this list gone crazy? "*I* am the one who is *really* behind the SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST. Think about it. Everyone knows that I'm a 33rd degree Mason. No...that's Tim May. "Fuck this shit. From now on, I'm posting as Toto." John Perry: "This has gone on long enough. I'm killing this thread. ...I mean..."post." ...I mean... "Shit! I'm not the list moderator, yet. That's *after* we take over the list." "Sorry." ------- End Pretty Good Pretending------- ... ~~~~~~~ Begin Note From Igor ~~~~~~~ Do you all remember the Perl script I was working on for mimicking the posts of other people? Well, this post is the latest product of that script. What do you think? Is it convincing? Did you really believe that it was actually written by one or more of the people mentioned in the post? I think that I finally have the Perl script to the point where I can effectively fool most people about the true source and method of a computer generated post's actual origins. I was thinking about adding a conspiratorial part about myself. I was going to intimate that the fact that I was so active on the list during the censorship crisis, playing the skeptic who was gradually brought around to the truth of Dale Thorn and Toto's claims, then volunteering to host the list and quietly disappearing into the background, might indicate that *I* was really behind the SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST. In the end, I decided against it, because then the readers would be left with the notion that perhaps even this explanatory note from me was bogus, and that there really was an ongoing SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST. ~~~~~~~ End Note From Igor ~~~~~~~ ********** DISCLAIMER ********** THERE IS *NO* SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! There is no conspiracy by a secret government to destroy the Constitution, enslave the people, and rule the world. Individual cypherpunks are not being imprisoned and murdered and replaced with Identity Bots. There is no need to worry. Declan McCullagh can confirm all of this. You can trust him. He is your representative in D.C. He did *not* give secret testimony against Jim Bell in return for a byline in the "Time" magazine cover story. That is just a rumor. Well, not yet, maybe, but it will be, very soon. Remember, this is just a normal mailing list with a few list members who are a little odd. There are no spooks. There is no background intrigue. This whole privacy thing has just been blown a bit out of proportion. It's really not that important. Waco was just a tragic accident. Ruby Ridge was a simple error in judgment by a government agent who really feels bad about following his superiors orders. Heavily armed U.S. Marines are no match for a goat-herding boy with a .22, and it is only by the grace of God that they are alive today. Oswald acted alone. lai;ekrjke ^C THERE IS *NO* SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! There is no conspiracy by a secret government to destroy the Constitution, enslave the people, and rule the world. dakl;jdafkl;jad;jfa ^C ^C Oswald acted alone. Bears are Catholic. The Pope shits in the woods. The government is concerned for your welfair. *^^^* ldfafd;ljfd; ^C^X^C THERE IS *NO* SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! da;lkdf ^C THERE IS *NO* welfair ad;fljadf; *^^^* ad;sljf;afj ^C ^C ^C THERE IS *NO* SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! SECRET CONSPIRACY AGAINST THE CYPHERPUNKS LIST! ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ---------------------------------------------------------------------------- From dv at dev.null Sat Oct 4 14:51:52 1997 From: dv at dev.null (Deja Vu) Date: Sun, 5 Oct 1997 05:51:52 +0800 Subject: InfoWar 33 / (Part III of 'The True Story of the InterNet') Message-ID: <3436B3A5.458B@dev.null> A non-text attachment was scrubbed... Name: not available Type: text/html Size: 32028 bytes Desc: not available URL: From ravage at ssz.com Sat Oct 4 15:28:58 1997 From: ravage at ssz.com (Jim Choate) Date: Sun, 5 Oct 1997 06:28:58 +0800 Subject: pna.show_story?p_art_id=376182&p_section_name=Sci-Tech Message-ID: <199710042245.RAA01808@einstein.ssz.com> CNN Custom News logo [LINK] Home World U.S. Weather Sports Business Sci-Tech Showbiz Lifestyle alt On Target Customize Profile Help Feedback Switch User [ISMAP] InfoSeek [INLINE] October 4, 1997 10:23 pm GMT [INLINE] Sci-Tech Title [INLINE] Ad Space ________________________ ___Word ___Theme ______________ Options [INLINE] The story below was selected from CNN Custom News - a new personalized service that delivers only the news that's important to YOU. Sign up now to receive your personal news stories, weather, sports scores, and stock quotes from over 100 different sources - all for FREE. If you're already a user, please login. Custom News E-STAMP RECEIVES BIG BACKING FOR NET-BASED POSTAGE SALES InfoWorld 04-OCT-97 Buying stamps for use on "snail mail" soon may be possible over the Internet, and one company pioneering the technology to do so has caught the attention of both Microsoft and AT&T. E-Stamp has created a system that will enable users to purchase postage over the Internet and then print viable U.S. Postal Service stamps onto envelopes. Recently, both Microsoft and AT&T Ventures announced that they have taken an equity stake in E-Stamp. Both companies will receive a 10 percent stake in the postage sales system's creator, and both will hold a seat on its board of directors. Financial details of the investment were not disclosed. "One of the things we're trying to do now is build the industry infrastructure by forming strategic partnerships with software, hardware, and Internet companies, and we see our relationship with Microsoft and AT&T as the first step in this process," said Nicole Ward, vice president of marketing for E-Stamp. The potential for both Microsoft and AT&T to incorporate E-Stamp technology into their product lines in the future could be intriguing, according to analysts. "Microsoft could certainly be incorporating the generating technology into Office," according to Vernon Keenan, senior analyst for Zona Research, in Redwood City, Calif. "I could see clicking a button in Word, and when you print out your envelope, you'd get a stamp on it." "It's certainly conceivable; that's not a scenario that we've ignored," said Greg Stanger, director of business development and investments for Microsoft, in Redmond, Wash. "The Office team picking it up and incorporating it into whatever they're doing is not out of the question." E-Stamp is preparing to beta test the system in San Francisco and Washington by the end of the year. Once postage is purchased from the U.S. Postal Service over the Internet, the value of the "stamps" will be held in an "electronic vault" attached to a PC and printer, according to the company. The Postal Service will monitor the amounts as it currently does with postage machines, but Internet postage is a new innovation, according to Roy Gordon, program manager of process and product development for meter technology management for the U.S. Postal Service, based in Washington. "This is the first new form of postage potentially introduced by the postal service in 77 years," Gordon said. E-Stamp estimates that the complete system will cost less than $300 per year. The irony of using the Internet to facilitate the delivery of "snail mail" was not lost on analysts. "It is definitely ironic," said Ray Boggs, director of small-business research for IDC/Link, a market research company in New York. "But what could be more appropriate than leveraging one technology to benefit another?" E-Stamp Corp., in Palo Alto, Calif., can be reached at (650) 843-8000 or http://www.estamp.com. Article Dated 03-OCT-97 COPYRIGHT 1997 InfoWorld Publishing Company Search the net: InfoSeek ___________________ ____ [Help] [INLINE] Ad Space Top Copyright © 1997 Cable News Network, Inc. A Time Warner Company ALL RIGHTS RESERVED. Terms under which this information is provided to you. [INLINE] From nobody at privacynb.ml.org Sat Oct 4 15:37:17 1997 From: nobody at privacynb.ml.org (Anonymous) Date: Sun, 5 Oct 1997 06:37:17 +0800 Subject: Regulate them to 'double-death'... Message-ID: <199710042136.SAA27932@privacynb.ml.org> On Sat, 4 Oct 1997, Anonymous wrote: > Cynthia Brown wrote: > > Canada may be regulated to death according to most libertarians, but I for > > one like it that way. I can walk alone and unarmed at night in Ottawa, > > Toronto, etc. without fearing for my life. Can a female resident of > > Washington or New York say the same? Our schools do not have metal detectors > > at the entrances because they are not needed. > > No, instead, Canadian students terrorize each other with old-fashioned > forms of violence, like at Cole Harbor high school in Newfie'land, where > they use baseball bats to keep the niggers in line, and in Montreal, > where four teenagers have been driven to suicide in the last few weeks > by the 'taxing' they have endured from the youth gangs that roam the > subways. > Perhaps Canada needs 'more' regulation... > > CanuckMonger Correction: Cole Harbor High School is in Nova Scotia. Canada ia not perfect, no country is, but men and women typically feel safe enought to walk the streets alone at night. Racial hatred is not accepted in the communities at large, nor is wife-beating. I never encountered youth gangs on the subways of Montreal this summer. The fact that you list all the newsworthy examples of teen violence speaks volumes onto itself. The typically Canadian gun owner uses it for one of two purposes; the most common usage is 1) sport hunting 2) target shooting - I have used a gun many times, never towards a living being. -Cyphercanuck From nobody at REPLAY.COM Sat Oct 4 15:40:12 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sun, 5 Oct 1997 06:40:12 +0800 Subject: Fucking Deadbeats! Message-ID: <199710042226.AAA08759@basement.replay.com> I saw on the news today that the Canadian Federal Bank (whatever it is called) decided to raise interests rates recently, because they were afraid that the economy was becoming "too robust." Would anyone like to bet that this little tidbit of information is not likely to help those who Unemployment Insurance Commission workers call deadbeats because they can't find a job? TruthMonger From ant at notatla.demon.co.uk Sat Oct 4 16:01:35 1997 From: ant at notatla.demon.co.uk (Antonomasia) Date: Sun, 5 Oct 1997 07:01:35 +0800 Subject: Quor's cipher Message-ID: <199710042151.WAA03454@notatla.demon.co.uk> ghio at temp0126.myriad.ml.org (Matt Ghio) writes: > What about this: > If (a+b)^(a0+b0) == 0, then the plaintext is the same as the ciphertext. > This happens for one out of every 256 bytes. Ordinarilly this isn't a > problem, but if the key is reused, and there is no IV, it can leak a byte > of plaintext. > So it seems that you would need to change the key for each message, or at > least use a random initialization vector. How are you planning to detect which bytes are passed in this way ? Chosen plaintext attacks would do it, and show where (a+b)^(a0+b0) == 0. Looks like you've just doubled our progress. If the key is reused with a different message I don't think there's a weakness. An IV is a good idea, but aren't we _attacking_ this thing ? I've grabbed a few search-engine hits and not read them yet. I'll be looking for clues there. -- ############################################################## # Antonomasia ant at notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # ############################################################## From jburnes at diac.com Sat Oct 4 16:25:53 1997 From: jburnes at diac.com (Jim Burnes) Date: Sun, 5 Oct 1997 07:25:53 +0800 Subject: Nice quote Message-ID: <3436CAFB.547F228E@diac.com> Someone might find this quote useful for a signature... "Anybody thats asking for privacy must be doing something interesting." Stanford AI Lab (SAIL) Hacker, Don Woods From iang at cs.berkeley.edu Sat Oct 4 16:29:29 1997 From: iang at cs.berkeley.edu (Ian Goldberg) Date: Sun, 5 Oct 1997 07:29:29 +0800 Subject: Peter Landrock's CRYPTO 97 rump session In-Reply-To: <199709261614.KAA00562@asylum.cs.colorado.edu> Message-ID: <616iik$rjv$1@abraham.cs.berkeley.edu> In article <199709261614.KAA00562 at asylum.cs.colorado.edu>, Chris Hall wrote: > >I know that many of you attended this years CRYPTO and probably went to the >rump session too. Does anyone remember the details of Peter Landrock's >presentation? If I recall correctly, he presented an amusing talk in which >an attacker tried to blackmail a bank by claiming knowledge of the bank's >RSA private exponent. He did this by revealing successive bytes of the >exponent starting with the most significant. The ransom doubled with each >successive byte revealed (and I believe he got up to 52 in his example). >The catch was that any person can do this for the first X number of bytes >of the exponent *without actually knowing d* (where X varies depending at >least upon n). IIRC, it only worked for e=3. In that case, since gcd(e,(p-1)(q-1)) = 1, we must have that p and q are each 2 mod 3. Then, since (p-1)(q-1) | de-1, we have that e d - r (p-1)(q-1) = 1 for some positive integer r. Taking this mod 3, we see that r is 2 mod 3. But r = (ed-1)/[(p-1)(q-1)] < (3(p-1)(q-1)-1)/[(p-1)(q-1)] < 3, so r=2. Thus d = [2(p-1)(q-1)+1]/3 = 2(n-p-q)/3 + 1. If p and q are each about half the length of n, then d agrees with 2(n-1)/3 for about its first half. - Ian From nobody at REPLAY.COM Sat Oct 4 16:49:18 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sun, 5 Oct 1997 07:49:18 +0800 Subject: Regulate them to 'double-death'... Message-ID: <199710042334.BAA18345@basement.replay.com> Anonymous wrote: > On Sat, 4 Oct 1997, Anonymous wrote: > > No, instead, Canadian students terrorize each other with old-fashioned > > forms of violence, like at Cole Harbor high school in Newfie'land, where > > they use baseball bats to keep the niggers in line, and in Montreal, > > where four teenagers have been driven to suicide in the last few weeks > > by the 'taxing' they have endured from the youth gangs that roam the > > subways. > > Perhaps Canada needs 'more' regulation... > Canada ia not perfect, no country is, but men and women typically feel > safe enough to walk the streets alone at night. The same is true of most places, even the ones known as being dangerous enclaves of the 'bad' people. The fact is, those who live in any given area generally do not feel too threatened when going out and about in 'their' part of town. I spend time in the areas of Regina, Saskatchewan and Oakland, California, that most of the 'regular' folk avoid. I have seen people shot and stabbed in both places, but I feel safe enough to walk those streets alone. I have been robbed a couple times in both areas, and have given up the cash I was holding, even when I was armed much better than those robbing me. I didn't feel like killing them. > Racial hatred is not accepted in the communities at large Kiss my ass. Racial discrimination is not *recognized* in the communities at large. I like to use the word 'nigger' as often as possible in Berkeley, California, (a prison for the politically correct) just because it pisses all of those oh-so-liberal hypocrites who shit their pants when a black person moves into *their* neighborhood. I like to use the word 'wagon-burner' in Regina when dealing with social workers who use the politically correct term, Native Canadian while they discriminate against the 'wagon-burners' in every possible way. > nor is wife-beating. Joke heard in a Canadian Bar at 11:37 pm, Sat. Oct. 3, 1997: Q: "What do you call a woman with two black eyes? A: "Nothing. She's been told *twice* already!" > The fact that you list all the newsworthy examples of teen violence speaks > volumes onto itself. No. The fact that I did not list the 'volumes' of examples of teen violence in Canada is newsworthy. > The typically Canadian gun owner uses it for one of two purposes; the > most common usage is 1) sport hunting 2) target shooting - I have used a > gun many times, never towards a living being. Sounds like the typical *American* gun owner. Canadians whack out fewer people with weapons than Americans, but so do people in prison. Go figure... Canada does not have the magnitude of problems that the US has because there are only about 20 million people in the whole goddamn country, and there are not nearly as many hugely populated cities. As well, Canadians spend a great amount of their time huddled inside their igloos during the year, and are too busy trying to keep warm to spend much time murdering their fellow citizens. Got to run. I'm a cop, and I haven't beaten up my quota of wagon-burners for the day. CanuckMonger From yt at htp.org Sat Oct 4 17:58:17 1997 From: yt at htp.org (yt at htp.org) Date: Sun, 5 Oct 1997 08:58:17 +0800 Subject: cypherpunks-e@htp.org list explodes! Message-ID: <19971005004130.14498.qmail@htp.org> Hey bill... sorry about the mess. We were just trying to set up a local japanese dist of cypherpunks. same content. I've made it one way.... for the local discussion, cypherpunks-j is where it is at, but it in in Japanese. Sorry about the trouble. yt From dlv at bwalk.dm.com Sat Oct 4 19:21:56 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Sun, 5 Oct 1997 10:21:56 +0800 Subject: Stronghold In-Reply-To: <1.5.4.32.19971004170309.006e6f6c@pop.pipeline.com> Message-ID: <4iw3De14w165w@bwalk.dm.com> John Young writes: > Dimitri Vulis reposted parts of the Stronghold/censorship > drama: > > Dimitri: > > This replay continues your artful distortion of the exchanges, > presumbly to make your best case, yet it still fails to explain > your original beef with Stronghold. Correct. I even deleted one paragraph from the C2Net lawyer letter which dealt with the nature of my claims. > Perhaps this is unfair, but it now appears that you are using > the disputed censorship issue to cloud your reluctance, or > inability, to substantiate a fault in Stronghold. > > Send me the Stronghold fault, I'll be happy to add it to the > other crypto-security stuff that wasn't supposed to be published. > > This is not meant to defuse the censorship matter, that's still > live ammo. Sorry, no, as this would likely cause C2Net to sue me, as they've threatened. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From dollar at hol.fr Sat Oct 4 19:31:27 1997 From: dollar at hol.fr (JN) Date: Sun, 5 Oct 1997 10:31:27 +0800 Subject: $$$ You SHOULD read this TWICE $$$ Make Money Message-ID: <18161.235708.17860313 cypherpunks@toad.com> IF YOU ALLREADY HAVE THIS PROGRAM, PLEASE SORRY PRINT THIS PROGRAM Dear friend, The following income opportunity is one you may be interested in taking a look at. It can be started with VERY MINIMAL outlay and the income return is TREMENDOUS! <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> You are about to make at least $50,000 - In less than 90 days Read the enclosed program...THEN READ IT AGAIN!... <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> The enclosed information is something I almost let slip through my fingers. Fortunately, sometime later I re-read everything and gave some thought and study to it. My name is Christopher Erickson. Two years ago, the corporation I worked at for the past twelve years down-sized and my position was eliminated. After unproductive job interviews, I decided to open my own business. Over the past year, I incurred many unforeseen financial problems. I owed my family, friends, and creditors over $35,000. The economy was taking a toll on my business and I just couldn't seem to make ends meet. I had to refinance and borrow against my home to support my family and struggling business. I truly believe it was wrong for me to be in debt like this. AT THAT MOMENT something significant happened in my life and I am writing to share my experience in hopes that this will change your life FOREVER....FINANCIALLY!!! In mid-December, I received this program via email. Six months prior to receiving this program I had been sending away for information on various business opportunities. All of the programs I received, in my opinion, were not cost effective. They were either too difficult for me to comprehend or the initial investment was too much for me to risk to see if they worked or not. One claimed I'd make a million dollars in one year...it didn't tell me I'd have to write a book to make it. But like I was saying, in December of '95 I received this program. I didn't send for it, or ask for it, they just got my name off a mailing list. THANK GOODNESS FOR THAT!!! After reading it several times, to make sure I was reading it correctly, I couldn't believe my eyes. Here was a MONEY-MAKING PHENOMENON. I could invest as much as I wanted to start, without putting me further in debt. After I got a pencil and paper and figured it out, I would at least get my money back. After determining that the program is LEGAL and NOT A CHAIN LETTER, I decided "WHY NOT". Initially I sent out 10,000 emails. It only cost me about $15.00 for my time on-line. The great thing about email is that I didn't need any money for printing to send out the program, only the cost to fulfill my orders. I am telling you like it is, I hope it doesn't turn you off, but I promised myself that I would not "rip-off" anyone, no matter how much money it cost me! A good program to help do this is Ready Aim Fire, an email extracting and mass mail program @ http://microsyssolutions.com/raf/ In less than one week, I was starting to receive orders for REPORT #1. By January 13th, I had received 26 orders for REPORT #1. When you read the GUARANTEE in the program, you will see that "YOU MUST RECEIVE 15 TO 20 ORDERS FOR REPORT #1 WITHIN TWO WEEKS. IF YOU DON'T, SEND OUT MORE PROGRAMS UNTIL YOU DO!" My first step in making $50,000 in 20 to 90 days was done. By January 30th, I had received 196 orders for REPORT #2. If you go back to the GUARANTEE, "YOU MUST RECEIVE 100 OR MORE ORDERS FOR REPORT #2 WITHIN TWO WEEKS. IF NOT, SEND OUT MORE PROGRAMS UNTIL YOU DO. ONCE YOU HAVE 100 ORDERS, THE REST IS EASY, RELAX, YOU WILL MAKE YOUR $50,000 GOAL." Well, I had 196 orders for REPORT #2, 96 more than I needed. So I sat back and relaxed. By March 19th, of my emailing of 10,000, I received $58,000 with more coming in every day. I paid off ALL my debts and bought a much needed new car. Please take time to read the attached program, IT WILL CHANGE YOUR LIFE FOREVER! Remember, it wont work if you don't try it. This program does work, but you must follow it EXACTLY! Especially the rules of not trying to place your name in a different place. It doesn't work, you'll lose out on a lot of money! REPORT #2 explains this. Always follow the guarantee, 15 to 20 orders for REPORT #1, and 100 or more orders for REPORT #2 and you will make $50,000 or more in 20 to 90 days. I AM LIVING PROOF THAT IT WORKS !!! If you choose not to participate in this program, I'm sorry. It really is a great opportunity with little cost or risk to you. If you choose to participate, follow the program and you will be on your way to financial security. If you are a fellow business owner and you are in financial trouble like I was, or you want to start your own business, consider this a sign. I DID! Sincerely, Christopher Erickson PS Do you have any idea what 11,700 $5 bills ($58,000) look like piled up on a kitchen table? IT'S AWESOME! "THREW IT AWAY" "I had received this program before. I threw it away, but later wondered if I shouldn't have given it a try. Of course, I had no idea who to contact to get a copy, so I had to wait until I was emailed another copy of the program. Eleven months passed, then it came. I DIDN'T throw this one away. I made $41,000 on the first try." John Net, Paris, France A PERSONAL NOTE FROM THE ORIGINATOR OF THIS PROGRAM By the time you have read the enclosed information and looked over the enclosed program and reports, you should have concluded that such a program, and one that is legal, could not have been created by an amateur. Let me tell you a little about myself. I had a profitable business for ten years. Then in 1979 my business began falling off. I was doing the same things that were previously successful for me, but it wasn't working. Finally, I figured it out. It wasn't me, it was the economy. Inflation and recession had replaced the stable economy that had been with us since 1945. I don't have to tell you what happened to the unemployment rate...because many of you know from first hand experience. There were more failures and bankruptcies than ever before. The middle class was vanishing. Those who knew what they were doing invested wisely and moved up. Those who did not, including those who never had anything to save or invest, were moving down into the ranks of the poor. As the saying goes, "THE RICH GET RICHER AND THE POOR GET POORER." The traditional methods of making money will never allow you to "move up" or "get rich", inflation will see to that. You have just received information that can give you financial freedom for the rest of your life, with "NO RISK" and "JUST A LITTLE BIT OF EFFORT." You can make more money in the next few months than you have ever imagined. I should also point out that I will not see a penny of your money, nor anyone else who has provided a testimonial for this program. I have already made over FOUR MILLION DOLLARS! I have retired from the program after sending out over 16,000 programs. Now I have several offices which market this and several other programs here in the US and overseas. By the Spring, we wish to market the 'Internet' by a partnership with AMERICA ON LINE. Follow the program EXACTLY AS INSTRUCTED. Do not change it in any way. It works exceedingly well as it is now. Remember to email a copy of this exciting program to everyone that you can think of. One of the people you send this to may send out 50,000...and your name will be on every one of them!. Remember though, the more you send out, the more potential customers you will reach. So my friend, I have given you the ideas, information, materials and opportunity to become financially independent, IT IS UP TO YOU NOW! "THINK ABOUT IT" Before you delete this program from your mailbox, as I almost did, take a little time to read it and REALLY THINK ABOUT IT. Get a pencil and figure out what could happen when YOU participate. Figure out the worst possible response and no matter how you calculate it, you will still make a lot of money! Definitely get back what you invested. Any doubts you have will vanish when your first orders come in. IT WORKS! Paul Johnson, Raleigh, NC HERE'S HOW THIS AMAZING PROGRAM WILL MAKE YOU $$$$$$ Let's say that you decide to start small, just to see how it goes, and we'll assume you and all those involved send out 2,000 programs each. Let's also assume that the mailing receives a .5% response. Using a good list the response could be much better. Also many people will send out hundreds of thousands of programs instead of 2,000. But continuing with this example, you send out only 2,000 programs. With a 5% response, that is only 10 orders for REPORT #1. Those 10 people respond by sending out 2,000 programs each for a total of 20,000. Out of those .5%, 100 people respond and order REPORT #2. Those 100 mail out 2,000 programs each for a total of 200,000. The .5% response to that is 1,000 orders for REPORT #3. Those 1,000 send out 2,000 programs each for a 2,000,000 total. The .5% response to that is 10,000 orders for REPORT #4. That's 10,000 five dollar bills for you. CASH!!!! Your total income in this example is $50 + $500 + $5000 + $50,000 for a total of $55,550!!!! REMEMBER FRIEND, THIS IS ASSUMING 1,990 OUT OF 2,000 PEOPLE YOU MAIL TO WILL DO ABSOLUTELY NOTHING... AND TRASH THIS PROGRAM! DARE TO THINK FOR A MOMENT WHAT WOULD HAPPEN IF EVERYONE OR HALF SENT OUT 100,000 PROGRAMS INSTEAD OF ONLY 2,000. Believe me, many people will do that and more! By the way, your cost to participate in this is practically nothing. You obviously already have an internet connection and email is FREE!!! REPORT#3 will show you the best methods for bulk emailing and purchasing email lists. THIS IS A LEGITIMATE, LEGAL, MONEY MAKING OPPORTUNITY. It does not require you to come in contact with people, do any hard work, and best of all, you never have to leave the house except to get the mail. If you believe that someday you'll get that big break that you've been waiting for, THIS IS IT! Simply follow the instructions, and your dream will come true. This multi-level email order marketing program works perfectly...100% EVERY TIME. Email is the sales tool of the future. Take advantage of this non-commercialized method of advertising NOW!! The longer you wait, the more people will be doing business using email. Get your piece of this action!! MULTI-LEVEL MARKETING (MLM) has finally gained respectability. It is being taught in the Harvard Business School, and both Stanford Research and The Wall Street Journal have stated that between 50% and 65% of all goods and services will be sold throughout Multi-level Methods by the mid to late 1990's. This is a Multi-Billion Dollar industry and of the 500,000 millionaires in the US, 20% (100,000) made their fortune in the last several years in MLM. Moreover, statistics show 45 people become millionaires everyday through Multi-Level Marketing. INSTRUCTIONS We at Erris Mail Order Marketing Business, have a method of raising capital that REALLY WORKS 100% EVERY TIME. I am sure that you could use $50,000 to $125,000 in the next 20 to 90 days. Before you say "Bull", please read the program carefully. This is not a chain letter, but a perfectly legal money making opportunity. Basically, this is what we do: As with all multi-level business, we build our business by recruiting new partners and selling our products. Every state in the USA allows you to recruit new multi- level business partners, and we offer a product for EVERY dollar sent. YOUR ORDERS COME AND ARE FILLED THROUGH THE MAIL, so you are not involved in personal selling. You do it privately in your own home, store or office. This is the GREATEST Multi-level Mail Order Marketing anywhere: Step (1) Order all four 4 REPORTS listed by NAME AND NUMBER. Do this by ordering the REPORT from each of the four 4 names listed on the next page. For each REPORT, send $5 CASH and a SELF-ADDRESSED, STAMPED envelope (BUSINESS SIZE #10) to the person listed for the SPECIFIC REPORT. International orders should also include $1 extra for postage. It is essential that you specify the NAME and NUMBER of the report requested to the person you are ordering from. You will need ALL FOUR 4 REPORTS because you will be REPRINTING and RESELLING them. DO NOT alter the names or sequence other than what the instructions say. IMPORTANT: Always provide same-day service on all orders. Step (2) Replace the name and address under REPORT #1 with yours, moving the one that was there down to REPORT #2. Drop the name and address under REPORT #2 to REPORT #3, moving the one that was there to REPORT #4. The name and address that was under REPORT #4 is dropped from the list and this party is no doubt on the way to the bank. When doing this, make certain you type the names and addresses ACCURATELY! DO NOT MIX UP MOVING PRODUCT/REPORT POSITIONS!!! Step (3) Having made the required changes in the NAME list, save it as a text (.txt) file in it's own directory to be used with whatever email program you like. Again, REPORT #3 will tell you the best methods of bulk emailing and acquiring email lists. Step (4) Email a copy of the entire program (all of this is very important) to everyone whose address you can get your hands on. Start with friends and relatives since you can encourage them to take advantage of this fabulous money-making opportunity. That's what I did. And they love me now, more than ever. Then, email to anyone and everyone! Use your imagination! You can get email addresses from companies on the internet who specialize in email mailing lists. These are very cheap, 100,000 addresses for around $35.00. IMPORTANT: You won't get a good response if you use an old list, so always request a FRESH, NEW list. You will find out where to purchase these lists when you order the four 4 REPORTS. ALWAYS PROVIDE SAME-DAY SERVICE ON ALL ORDERS!!! REQUIRED REPORTS ***Order each REPORT by NUMBER and NAME*** ALWAYS SEND A SELF-ADDRESSED, STAMPED ENVELOPE AND $5 CASH FOR EACH ORDER REQUESTING THE SPECIFIC REPORT BY NAME AND NUMBER ________________________________________________________ REPORT #1 "HOW TO MAKE $250,000 THROUGH MULTI-LEVEL SALES" ORDER REPORT #1 FROM: John Net 130 Bd Massena APPT 3060 75013 Paris FRANCE ________________________________________________________ REPORT #2 "MAJOR CORPORATIONS AND MULTI-LEVEL SALES" ORDER REPORT #2 FROM: Van Marketing Inc. Apartado 799 8500 Portim�o Portugal ________________________________________________________ REPORT#3 "SOURCES FOR THE BEST MAILING LISTS" ORDER REPORT #3 FROM: Cyberhighway Marketing Inc. P.O.Box 24327 Jacksonville, FL 32241-4327 ________________________________________________________ REPORT #4 "EVALUATING MULTI-LEVEL SALES PLANS" ORDER REPORT #4 FROM: After Hours Software 56 Eugene St Tonawanda, NY 14150 ________________________________________________________ CONCLUSION I am enjoying my fortune that I made by sending out this program. You too, will be making money in 20 to 90 days, if you follow the SIMPLE STEPS outlined in this mailing. To be financially independent is to be FREE. Free to make financial decisions as never before. Go into business, get into investments, retire or take a vacation. No longer will a lack of money hold you back. However, very few people reach financial independence, because when opportunity knocks, they choose to ignore it. It is much easier to say "NO" than "YES", and this is the question that you must answer. Will YOU ignore this amazing opportunity or will you take advantage of it? If you do nothing, you have indeed missed something and nothing will change. Please re-read this material, this is a special opportunity. If you have any questions, please feel free to write to the sender of this information. You will get a prompt and informative reply. My method is simple. I sell thousands of people a product for $5 that costs me pennies to produce and email. I should also point out that this program is legal and everyone who participates WILL make money. This is not a chain letter or pyramid scam. At times you have probably received chain letters, asking you to send money, on faith, but getting NOTHING in return, NO product what-so-ever! Not only are chain letters illegal, but the risk of someone breaking the chain makes them quite unattractive. You are offering a legitimate product to your people. After they purchase the product from you, they reproduce more and resell them. It's simple free enterprise. As you learned from the enclosed material, the PRODUCT is a series of four 4 FINANCIAL AND BUSINESS REPORTS. The information contained in these REPORTS will not only help you in making your participation in this program more rewarding, but will be useful to you in any other business decisions you make in the years ahead. You are also buying the rights to reprint all of the REPORTS, which will be ordered from you by those to whom you mail this program. The concise one and two page REPORTS you will be buying can easily be reproduced at a local copy center for a cost off about 3 cents a copy. Best wishes with the program and Good Luck! "IT WAS TRULY AMAZING" "Not being the gambling type, it took me several weeks to make up my mind to participate in this program. But conservative as I am, I decided that the initial investment was so little that there was no way that I could not get enough orders to at least get my money back. BOY, was I ever surprised when I found my medium sized post office box crammed with orders! I will make more money this year than any ten years of my life before." Mary Riceland, Lansing, MI TIPS FOR SUCCESS Send for your four 4 REPORTS immediately so you will have them when the orders start coming in. When you receive a $5 order, you MUST send out the product/service to comply with US Postal and Lottery laws. Title 18 Sections 1302 and 1341 specifically state that: "A PRODUCT OR SERVICE MUST BE EXCHANGED FOR MONEY RECEIVED." WHILE YOU WAIT FOR THE REPORTS TO ARRIVE: 1. Name your new company. You can use your own name if you desire. 2. Get a post office box (preferred). 3. Edit the names and addresses on the program. You must remember, your name and address go next to REPORT #1 and the others all move down one, with the fourth one being bumped OFF the list. 4. Obtain as many email addresses as possible to send until you receive the information on mailing list companies in REPORT #3. 5. Decide on the number of programs you intend to send out. The more you send, and the quicker you send them, the more money you will make. 6. After mailing the programs, get ready to fill the orders. 7. Copy the four 4 REPORTS so you are able to sent them out as soon as you receive an order. IMPORTANT: ALWAYS PROVIDE SAME-DAY SERVICE ON ORDERS YOU RECEIVE! 8. Make certain the letter and reports are neat and legible. YOUR GUARANTEE The check point which GUARANTEES your success is simply this: you must receive 15 to 20 orders for REPORT #1. This is a must!!! If you don't within two weeks, email out more programs until you do. Then a couple of weeks later you should receive at least 100 orders for REPORT #2, if you don't, send out more programs until you do. Once you have received 100 or more orders for REPORT #2, (take a deep breath) you can sit back and relax, because YOU ARE GOING TO MAKE AT LEAST $50,000. Mathematically it is a proven guarantee. Of those who have participated in the program and reached the above GUARANTEES-ALL have reached their $50,000 goal. Also, remember, every time your name is moved down the list you are in front of a different REPORT, so you can keep track of your program by knowing what people are ordering from. From dlv at bwalk.dm.com Sat Oct 4 19:32:20 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Sun, 5 Oct 1997 10:32:20 +0800 Subject: Nice quote In-Reply-To: <3436CAFB.547F228E@diac.com> Message-ID: <0uw3De16w165w@bwalk.dm.com> Jim Burnes writes: > Someone might find this quote useful for a signature... > > "Anybody thats asking for privacy must be doing something > interesting." > Stanford AI Lab (SAIL) Hacker, Don Woods Is that the same Don Woods who wrote the original "Colossal Cave" adventure game? I was studying English by playing it, many years ago. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From anon at anon.efga.org Sun Oct 5 10:49:00 1997 From: anon at anon.efga.org (Anonymous) Date: Sun, 5 Oct 1997 10:49:00 -0700 (PDT) Subject: Jes' Fishin' / Re: Stronghold (fwd) Message-ID: <954f3b10a95df46153eb5f91d4dbeeda@anon.efga.org> Jim Choate wrote: > > Date: Sun, 5 Oct 1997 18:46:14 +0200 (MET DST) > > Subject: Re: Stronghold > > From: nobody at REPLAY.COM (Anonymous) > > > It is becoming increasingly obvious that John Young is the real > > troublemaker here. I wouldn't doubt that it was John who was > > behind the original troubles between Vulis and Sameer. > > I think that John Young should be forcefully unsubscribed from > > the Cypherpunks mailing lists. > > You sir are an unmittigated ass and more than a tad immature and selfish. I was just trolling on a sunny Sunday afternoon, not really caring if I caught anything. However, Jim is too small-minded, so I think I'm going to have to throw him back. Jes' Fishin' From nobody at REPLAY.COM Sat Oct 4 19:49:46 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sun, 5 Oct 1997 10:49:46 +0800 Subject: Stronghold Message-ID: <199710050234.EAA08104@basement.replay.com> John Young wrote: > Dimitri: > Perhaps this is unfair, but it now appears that you are using > the disputed censorship issue to cloud your reluctance, or > inability, to substantiate a fault in Stronghold. Unless C2Net publicly announces that Dimitri is free to post anything he chooses about C2Net and the software they produce, without threat of lawsuit or prosecution, then it is patently unfair to castigate him for failing to share whatever information he may have in regard to their product. Like it or not, C2Net has declared that the integrity of their product is dependent upon men with guns who have the power to take people before the inquisitors, squelching all intimations of weakness or impropriety in the design of their product. If Ray Arachelian sues Dimitri for libel, I will start wondering just how many people he has, indeed, murdered. (Nothing personal, Ray, but are you *sure* that stain on your tie is ketchup?) ToothMonger "Take a byte out of slime." From wendigo at ne-wendigo.jabberwock.org Sat Oct 4 20:15:19 1997 From: wendigo at ne-wendigo.jabberwock.org (Mark Rogaski) Date: Sun, 5 Oct 1997 11:15:19 +0800 Subject: "Show me an example of terrorists using the Internet or cryp In-Reply-To: Message-ID: <199710050311.XAA08628@deathstar.jabberwock.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 An entity claiming to be Cynthia Brown wrote: : Agreed. There are also dedicated, hard-working, community-oriented : policemen out there. (I'm probably going to get flamed for daring to : say that, but tough.) : There are some cops who I have known or had dealings with (even ones who have given me a citation) who I consider very principled and generally good people ... they actually "serve and protect". However, from my experience with cops in general, even the sight of a cruiser knocks the adrenalin into gear. I have seen friends harrassed and even beaten by cops. I don't trust a cop to protect my well being any more than I trust my mechanic to protect my well being. Big difference is, I can choose my mechanic. Doc - -- [] Mark Rogaski "That which does not kill me [] wendigo at pobox.com only makes me stranger." -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDcFVcHFI4kt/DQOEQLWVgCgu+2GywrmIPRD5p/URat77xE8zcMAoKtn jNjs4UG6Et7SrZgMz7YnWgCW =lU3u -----END PGP SIGNATURE----- From jya at pipeline.com Sun Oct 5 11:30:27 1997 From: jya at pipeline.com (John Young) Date: Sun, 5 Oct 1997 11:30:27 -0700 (PDT) Subject: Stronghold Message-ID: <1.5.4.32.19971005182201.00866268@pop.pipeline.com> Dimitri007 wrote: >It is becoming increasingly obvious that John Young is the real >troublemaker here. I wouldn't doubt that it was John who was >behind the original troubles between Vulis and Sameer. >I think that John Young should be forcefully unsubscribed from >the Cypherpunks mailing lists. Heh, do me! Forcefully unsubscribed means *plonk* -- not seen much lately but once frequently wanked here. Troublemaking is the very essence of this cypherjerk joint, no? Does anyone but me remember that the whole Vulis, moderation, censorship, Stronghold shit started with Tim dissing Dimitri by mocking the [spit] locution (or that's when I first paid attention to the thread -- Tim's and Dimitri's rude humor slurs are their best shots). Dimitri then getting pissed at the dis (or faking it), then counter-assaulting Tim with multiple personalities, then both master peronnae-fakers going at each other through clones, acolytes and yes-bossers to capture the other's reputation capital, both operatically yodelling innocence unfairly ravaged, both raging with highest of principles at the accusations of come-fuck-me-darling lowest-level behavior. Anonymic and pseudonymic chaff flooded in and jammed the putative brilliant list signal. Seeing an opening for righteous evangelism, other high-minder fakirs intervened to protect the list's pristine virtue with prophylatic measures, which leaked, were malfitting, or were rejected by all-natural studs and mares lusting for unmediated self-abuse. Whores spitting at whores, male and female and crossovers it was, and is. Recall these periodic pitbull fights instigated with Tim by those foolish to challenge him, those who think there are limits to all-natural sex. Great liars, the Net's multiple personna double-cross-addressers . Whose willing to bet that Tim and Dimitri, their adherents, are not in bed with, may even be the same as, the Totos, the Mongershitters, the who? None of this compares to meisterwerk slurring which heavenly rents this forum. From hallam at ai.mit.edu Sat Oct 4 21:21:29 1997 From: hallam at ai.mit.edu (Phillip Hallam-Baker) Date: Sun, 5 Oct 1997 12:21:29 +0800 Subject: counter-intuitive -- spam is good for you. anonymous assholes are your friend Message-ID: <01BCD123.C0136B90.hallam@ai.mit.edu> On Friday, October 03, 1997 4:02 AM, Attila T. Hun [SMTP:attila at hun.org] wrote: > law enforcement did not deterred the hacks on the state department, > the FBI, and even the CIA. I dont advocate the hacks, but it is > amusing to watch the great watchdogs of security take a hit. Since I have no responsibility for either site I don't much care Actually neither has responsibility as a security watchdog, that is the NSA's job. > with your spoiled brat rantings, you make your site as tempting as > some of the other nose tweakers who need a serious attitude adjustment Actually I think you are the spoiled brat. If you had any real experience of computer security you would know who I am and who I work with. One of the principles of propaganda is reflection - poor propagandists accuse others of their own faults. My guess is that Attila is a sixteen year old schoolkid who thinks that downloading PGP and reading Bruce's book makes him a security expert. The real complacent folk are the ones that put their trust in cargo cult readings of Bill Morris. Phill From phelix at vallnet.com Sat Oct 4 22:25:24 1997 From: phelix at vallnet.com (phelix at vallnet.com) Date: Sun, 5 Oct 1997 13:25:24 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" Message-ID: <3438046a.78476133@128.2.84.191> On 4 Oct 1997 21:48:23 -0500, Jonathan Wienke wrote: >After the ordinance was passed, there was one >violent crime the first year, and three the next. There it is. Absolute Proof!!!! After everybody finally got those dreadful guns, there was a 300% increase in the murder rate. Guns are evil. Ban them now!!! (Just an example of what people do with statistics these days.) -- Phelix ps. Here's the entire paragraph: Before Kennesaw, Georgia passed its famous (or infamous) ordinance requiring each household in the city to own a gun and allowing concealed carry of firearms, it had an average of 25-27 violent crimes (murder, armed robbery, etc) per year. After the ordinance was passed, there was one violent crime the first year, and three the next. The gun control shills in the press reported this as a tripling in the violent crime rate. Since the state of Florida passed a "shall issue" concealed carry law (if you apply, pay the fee, pass the safety course, and are not a felon or mentally incompetent, the state shall issue you a concealed carry permit) it has experienced significant reductions (10-20%) in the rates of murder, rape, armed robbery, and other violent crimes. Even in England and Scotland, this inverse relationship between private gun ownership and violent crime can be demonstrated, according to Colin Greenwood, retired chief of the West Yorkshire Constabulary and criminology researcher since the sixties. From attila at hun.org Sat Oct 4 22:34:56 1997 From: attila at hun.org (Attila T. Hun) Date: Sun, 5 Oct 1997 13:34:56 +0800 Subject: Pompous Phill [was: RE: counter-intuitive -- spam is good for you] In-Reply-To: <01BCD123.C0136B90.hallam@ai.mit.edu> Message-ID: <971005.043016@hun.org> -----BEGIN PGP SIGNED MESSAGE----- on or about 971004:2213 Phillip Hallam-Baker publicly excreted: +On Friday, October 03, 1997 4:02 AM, Attila T. Hun [SMTP:attila at hun.org] +wrote: +> law enforcement did not deter the hacks on the state department, +> the FBI, and even the CIA. I dont advocate the hacks, but it is +> amusing to watch the great watchdogs of security take a hit. + +Since I have no responsibility for either site I don't much care +Actually neither has responsibility as a security watchdog, +that is the NSA's job. + that's mighty white of you, boy. security is everyone's business +> with your spoiled brat rantings, you make your site as tempting as +> some of the other nose tweakers who need a serious attitude +> adjustment + +Actually I think you are the spoiled brat. If you had any real +experience of computer security you would know who I am +and who I work with. + oh, my! a self-righteous, ostentatious, gratuitous, chest thumper. maybe even a national hero! "Pompous in high presumption" (Chaucer) has your press relations officer given your home town newspaper an exclusive broadside to make your mum proud? probably still looking for his horse... +One of the principles of propaganda is reflection - poor +propagandists accuse others of their own faults. My guess +is that Attila is a sixteen year old schoolkid who thinks that +downloading PGP and reading Bruce's book makes him a +security expert. the truth would surprise you. those who know had a need to know; the rest are irrelevant. +The real complacent folk are the ones that put their trust in +cargo cult readings of Bill Morris. one of Sir Winston Churchill's great lines obviously applies: "[Hallam-Baker] has the gift on compressing the largest amount of words into the smallest amount of thoughts." -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDclZL04kQrCC2kFAQHI3wP/fWxVpyPPcsVL8YcfzGxEzjKpyx8hG/cd oeZA0A8Emd0GxqlCC0pBfYjWYTHGR04ZS5Isd8aclzwUbSq/pNEN3s//X19TI99L mkwruv0TdofoNBYbL0w+sJ6mk4vJpU7PHdE9keSjSaGgJJZ+YfASdzUDSpID8OOX w5U+w/aUw8M= =J2Fj -----END PGP SIGNATURE----- From phelix at vallnet.com Sun Oct 5 02:56:47 1997 From: phelix at vallnet.com (phelix at vallnet.com) Date: Sun, 5 Oct 1997 17:56:47 +0800 Subject: Stronghold Message-ID: <343b60e7.102167602@128.2.84.191> On 5 Oct 1997 00:21:33 -0500, nobody at REPLAY.COM (Anonymous) wrote: > >John Young wrote: >> Dimitri: >> Perhaps this is unfair, but it now appears that you are using >> the disputed censorship issue to cloud your reluctance, or >> inability, to substantiate a fault in Stronghold. > >Unless C2Net publicly announces that Dimitri is free to post >anything he chooses about C2Net and the software they produce, >without threat of lawsuit or prosecution, then it is patently >unfair to castigate him for failing to share whatever information >he may have in regard to their product. >Like it or not, C2Net has declared that the integrity of their >product is dependent upon men with guns who have the power to >take people before the inquisitors, squelching all intimations >of weakness or impropriety in the design of their product. > Use the remailers. That's what they're there for. Am I being overly simplistic here? -- Phelix From anon at anon.efga.org Sun Oct 5 04:26:39 1997 From: anon at anon.efga.org (Anonymous) Date: Sun, 5 Oct 1997 19:26:39 +0800 Subject: New PGP "Everything the FBI ever dreamed of" In-Reply-To: Message-ID: <2f7a322aeda39b75b0d2ea5678b33459@anon.efga.org> http://simson.vineyard.net/clips/96.SJMN.PGPBusinessEdition.html [...] PRETTY LOOSE PRIVACY [...] Published: April 2, 1996 BY SIMSON L. GARFINKEL [...] Viacrypt, an Arizona company that sells the popular program Pretty Good Privacy, or PGP, last month announced a new version tailored for businesses. The new program allows companies to ''decrypt'' -- and then read -- information sent to or received by employees without their knowledge or consent. [...] An employee's right to privacy is nebulous at best. The Electronic Communications Privacy Act of 1986 specifically allows companies to monitor the electronic mail of their own employees. That has not stopped Zimmermann from complaining loudly about the PGP name being used in a product that allows someone other than the author or the intended recipient access to information. Viacrypt owns the licensing rights to sell the commercial versions of PGP. ''PGP does not stand for back doors,'' said Zimmermann. ''I don't mind if they sell a program that has a back door in it, but they shouldn't call it PGP.'' [...] ''If your employer can read your mail anytime he wants, without your permission, that goes against the spirit of the PGP trademark,'' said Zimmermann. From nobody at REPLAY.COM Sun Oct 5 05:30:45 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sun, 5 Oct 1997 20:30:45 +0800 Subject: Stronghold Message-ID: <199710051222.OAA00944@basement.replay.com> In <343b60e7.102167602 at 128.2.84.191>, phelix at vallnet.com writes: }On 5 Oct 1997 00:21:33 -0500, nobody at REPLAY.COM (Anonymous) wrote: } }> }>John Young wrote: }>> Dimitri: }>> Perhaps this is unfair, but it now appears that you are using }>> the disputed censorship issue to cloud your reluctance, or }>> inability, to substantiate a fault in Stronghold. }> }>Unless C2Net publicly announces that Dimitri is free to post }>anything he chooses about C2Net and the software they produce, }>without threat of lawsuit or prosecution, then it is patently A "public announcement" by the proven liars at C2 doesn't constitute a release from liability and wouldn't do much, legally, to protect Vulis from harrassment lawsuits. C2 can turn around and sue Vulis anyway. "So, I lied. Again." - Sameer }>unfair to castigate him for failing to share whatever information }>he may have in regard to their product. }>Like it or not, C2Net has declared that the integrity of their }>product is dependent upon men with guns who have the power to }>take people before the inquisitors, squelching all intimations }>of weakness or impropriety in the design of their product. }> } }Use the remailers. That's what they're there for. Am I being overly }simplistic here? If someone other than Vulis (me, for instance) published the Stronghold backdoor (widely known by now) via an anonymous remailer, then Sameer Parekh could still sue Vulis for having discovered it first, or to "make example" of him, and to intidimate other security experts who are aware of Stronghold's many holes. For example, Sandy Sandfort, Parekh's marketing director, wrote to Vulis: } ... we'll slap a libel suit across your emigrant ass, take back }your green card, deport you and tell Russia that you called Yeltsin a }cocksucker ... C2 is obviously deperate to suppress the information that's already known to an increasing number of people in the field. Their threats against Vulis may be one of the reasons why none of the security experts, who confirmed the presense of serious security flaws in Stronghold, are saying much about this. The BackdoorMonger From tcmay at got.net Sun Oct 5 08:22:24 1997 From: tcmay at got.net (Tim May) Date: Sun, 5 Oct 1997 23:22:24 +0800 Subject: New PGP "Everything the FBI ever dreamed of" In-Reply-To: Message-ID: Quote of the Year: ''PGP does not stand for back doors,'' said Zimmermann. ''I don't mind if they sell a program that has a back door in it, but they shouldn't call it PGP. If your employer can read your mail anytime he wants, without your permission, that goes against the spirit of the PGP trademark." At 4:25 AM -0700 10/5/97, Anonymous wrote: >http://simson.vineyard.net/clips/96.SJMN.PGPBusinessEdition.html ... > PRETTY LOOSE PRIVACY >[...] > Published: April 2, 1996 > BY SIMSON L. GARFINKEL ... > That has not stopped Zimmermann from complaining loudly about the PGP > name being used in a product that allows someone other than the author > or the intended recipient access to information. Viacrypt owns the > licensing rights to sell the commercial versions of PGP. > > ''PGP does not stand for back doors,'' said Zimmermann. ''I don't mind > if they sell a program that has a back door in it, but they shouldn't > call it PGP.'' >[...] > ''If your employer can read your mail anytime he wants, without your > permission, that goes against the spirit of the PGP trademark,'' said > Zimmermann. Pretty Good Point, I'd say. And we ought to keep quoting these comments. I agree that an employer has a "right" to read employee mail, sent on company time with company resources. However, a program which facillitates this has no business being called "Pretty Good Privacy." As Phil notes, it goes against the whole spirit of PGP. It's surveillance, pure and simple. Further, while businesses have every right to monitor their workers (Hey, I'm not saying I _like_ this, just that the alternative of banning such monitoring would be abusive to a property owner's rights), we should not be _encouraging_ the spread of such technologies. Especially given the very real risk that wide deployment of "Business PGP" could present. Wide deployment of "Business PGP" would also make eventual GAK much easier to implement. One plausible scenario is that companies would have to make available the escrowed copies of e-mail upon request by law enforcement. (Such records are of course already subject to subpoena, not to mention inspection by various and sundry other government agencies.) A further scenario is that "Business PGP" is _mandated_ within businesses or corporations by the ever-increasing regulatory web imposed by government. The SEC will want to ensure that insider trading is not being discussed, the FTC will want to snoop on possible anti-competitive communications, the DEA will want to investigate use of corporate shipping systems for drug distribution, and, of course, the various intelligence agencies will want access. "Business PGP" will be just another requirement, like certain accounting practices, like OSHA requirements, etc. Random inspections will force compliance, with fines for violations. Under this scenario, the so-called "rights" of individuals will not even arise, as the government rules will affect businesses, which are not held to have rights in the same way individuals are. (I happen to disagree, and think the owners of XYZ Corporation have the same rights to do with their property as J. Random Citizen has, but the courts have ruled otherwise.) The wide adoption of "Business PGP" could also mean short shrift to non-KR versions, including a lag in availability, or even eventual dropping of development efforts. (I'm sure PGP, Inc. will assure us otherwise, but this could still be an eventual development, if, for example, "Business PGP" accounts for 80% of their sales.) I agree with Phil Zimmermann's point: ''PGP does not stand for back doors,'' said Zimmermann. ''I don't mind if they sell a program that has a back door in it, but they shouldn't call it PGP. If your employer can read your mail anytime he wants, without your permission, that goes against the spirit of the PGP trademark." Let's hope PGP, Inc. comes to their senses and stops doing the work of Big Brother. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From nobody at REPLAY.COM Sun Oct 5 08:31:07 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sun, 5 Oct 1997 23:31:07 +0800 Subject: testing 1 2 3 Message-ID: <199710051518.RAA17661@basement.replay.com> bleh From linia32 at earthlink.net Sun Oct 5 23:56:01 1997 From: linia32 at earthlink.net (linia32 at earthlink.net) Date: Sun, 5 Oct 1997 23:56:01 -0700 (PDT) Subject: New Topical Pain Reliever for Arthritis, Burns, etc. Message-ID: <199710053176IAA25684@KDASASDD434___%$%FFSD.tm.net.my> Sorry for the intrusion. You won't get another message like this one. If you're not interested in our offer, we apologize for the inconvenience. ========================================================== L'APRINA IS A LIQUEFIED TOPICAL ASPIRIN. SPRAY IT ON WHERE IT HURTS! IT REALLY WORKS! SUPERIOR PAIN RELIEF IN MINUTES FROM A REVOLUTIONARY TOPICAL PAIN RELIEVER THAT DOES NOT DISTURB THE DIGESTIVE SYSTEM AND HAS NO ADVERSE SIDE EFFECTS A PROVEN ANALGESIC AND ANTI-INFLAMMATORY with Aloe Vera REVOLUTIONARY PAIN RELIEF Do you suffer with aches and pains from headaches, sports injuries, low back discomfort, arthritis, rheumatism, bursitis, or joint pain? These, and many other kinds of pains and discomfort can now safely be treated with a revolutionary, topical pain reliever called L'APRINA. L'APRINA is simply a liquefied, topical aspirin, designed to be applied wherever pain occurs. Many people will say it is not possible to get pain relief from an external product; they say that true pain relievers-analgesics - have to be swallowed to be effective. Up to now, they were right, because all the other external pain relievers on the market did not do much except "disguised the pain" by warming or cooling the area where applied. However, L'APRINA is truly different. It works, and it works fast to relieve all kinds of pain that people normally experience. Best of all since you do not ingest it, L'APRINA has none of the side effects associated with aspirin and other pain relievers that are taken internally. L'Aprina's main active ingredient is acetylsalicylic acid (commonly known as aspirin). It also contains extract from the Aloe Vera plant. Using a special and highly secret formula, L'Aprina effectively combines the analgesic power of aspirin with the humectant properties of Aloe Vera to produce pain killing and anti-inflammatory action superior to any other external product. NO SIDE EFFECTS Everybody knows there are lots of drugs and other products out there that will relieve pain The big problem with all of them is that they have to be taken orally, which means that they have to work through the digestive system and the blood stream, and enter every organ and tissue of the body. For many people, this leads to stomach or intestional distress from internal pain relievers, as well as more serious, long term effects to their health. Before L'APRINA the adverse side effects from internal pain relievers were something you simply had to accept - there was no effective alternative, However, with the arrival of L'APRINA people now have a wonderful alternative to the treatment of pain. L'APRINA is healther and safer because only a minuscule amount enters the blood or organs of the body - and there are no adverse side effects. With L'APRINA if you have an injured foot, arthritis in your arms, or an aching back, you can get quick relief by applying it where it hurts and rubbing it in. No longer do you have to swallow a pain reliever, putting medicine in your stomach, kidneys, heart and liver just to get relief from a headache, or pain in your feet, back, or arm, This revolutionary, but sinple, idea is what L'APRINA is all about. EASY AND FAST RELIEF L'APRINA is easy to apply with either its roll-on, squeeze or spray applicator. We recommend the painful area be doused liberally, then gently massaged until dry. This procedure should be repeated two or three times, depending on how sever the pain is. Do not worry about over use - you can't overdose with L'APRINA. L'APRINA begins to relieve even the worst discomfort in minutes. You should begin to experience almost immediate relief after using L'APRINA and its analgesic action normally last six hours, and often longer. In addition, when used daily, L'APRINA often has a powerful cumulative effect, which allows many people to use less L'APRINA, less often, for continued pain relief. New uses for L'APRINA are being discovered everyday. In addition to the severe pain discomfort from broken bones, shingles, burns, migraine headaches, and the like L'APRINA is great for those discomforts people experience from sunburn, insect bites and strained muscles, just to name a few. Keep a bottle in your office, home and car at all times. The compact roll-on bottle is perfect for purses and briefcases. Be sure to use L'APRINA on your children for those cuts, scrapes and bruises all children seem to get, L'APRINA IS SAFER and HEALTHER than any oral pain medication you can buy. WE ARE ACCEPTING APPLICATIONS FOR DEALERSHIPS. JIMMIE A. MARTIN, ID#353854976 WILL BE PLEASED TO SPONSOR YOU. TO GET AN APPLICATION SEND AN EMAIL TO jimmie at freeyellow.com or Call 1-800-631-9824 and tell them you were referred by Jimmie A. Martin AS AN INDEPENDENT DISTRIBUTOR YOU BUY WHOLESALE AND SELL RETAIL AND YOU CAN ARRANGE FOR AUTOMATIC MONTHLY SHIPMENTS WITHOUT SHIPPING CHARGES. Even if you are not interested in a dealership you may sign up as a preferred customer and purchase L'APRINA at wholesale prices. Again, send an email to jimmie at freeyellow.com for your application. If you prefer to just order L'APRINA by the bottle the the retail prices* are: 1-ounce Squeeze Bottle $5.95 + $1.50 S&H (First Class Mail) 2-ounce Roll-on Bottle $13.95 + $1.96 S&H (First Class Mail) 4-ounce Spray Bottle $19.95 + $3.95 S&H (Priority Mail) * plus sales tax where applicable Send your order vai turtle mail to the address below and make you check payable to Jimmie A. Martin, YES, L'APRINA IS FDA APPROVED. Jimmie A. Martin 8749 SW 115th Street Ocala, FL 34481-5091 From jya at pipeline.com Sun Oct 5 09:31:20 1997 From: jya at pipeline.com (John Young) Date: Mon, 6 Oct 1997 00:31:20 +0800 Subject: Stronghold Message-ID: <1.5.4.32.19971005161138.0075ca00@pop.pipeline.com> Dimitri and Cloned Anonymees continued the rotten-egging of Stronghold faults: If there's a fault in Stronghold, expose it, in detail, for merely proclaiming there is, is sour grapes commercial knocking of a superior product, or worse, evidence of complicity with those dark forces who want to prevent global spread of strong products. Sniff that rhetoric. It's the same old Backdoor gossip, as with PGP (freeware version, not the latest Freehware, which is evil, evil, how could you Phil?). Using the threat of a lawsuit as grounds to prevent disclosure is shrewd way of avoiding having to document an allegation. Dimitri, you're one smart son of a bitch, and my hat off to your genius at the dirty business of defamation, no holds barred. Defaming an eating-your-lunch competitor is fair play, as C2 shows how to call your bluff with a bullshit legal bluff. Anybody with a reliable info on a hidden backdoor in Stronghold or Dimitri or me, as with PGP, should get the evidence out for verification. Otherwise, such ranting is just trash talk of the bluffing game. Dimitri, out with Stronghold's fault, if you've got it. C2, cut the legal bluff, it stinks. The badmouthing by both of you is the same old toxic waste -- and may mean the two of you're are now in cahoots to boost each other's shoddy goods and hide the faults behind a phony dispute, like 50 years of mock competitive Ameri-Russky junk national security communist-capitalist racketeering so beloved by die-hard globalist TLAs of business and government. And I'm eager to rotten-egg it onward. From anon at anon.efga.org Sun Oct 5 09:53:39 1997 From: anon at anon.efga.org (Anonymous) Date: Mon, 6 Oct 1997 00:53:39 +0800 Subject: Stronghold Message-ID: Anonymous wrote: | C2 is obviously deperate to suppress the information that's already known to | an increasing number of people in the field. Their threats against Vulis may | be one of the reasons why none of the security experts, who confirmed the | presense of serious security flaws in Stronghold, are saying much about this. The information regarding the security flaws in Stronghold comes at a pretty dear price currently. With the increasing value of this type of information in the corporate underworld, the bugs and backdoors in security software that are revealed to the world make up only a small portion of those that are known to exist by those who have the funds to purchase them. For every free spirit who publishes a security flaw, there are a dozen enterpreneurs who recognize the value of the information they hold. MoneyMonger From nobody at REPLAY.COM Sun Oct 5 09:59:11 1997 From: nobody at REPLAY.COM (Anonymous) Date: Mon, 6 Oct 1997 00:59:11 +0800 Subject: Stronghold Message-ID: <199710051646.SAA26190@basement.replay.com> John Young wrote: > Dimitri, out with Stronghold's fault, if you've got it. C2, cut the > legal bluff, it stinks. The badmouthing by both of you is the same old > toxic waste -- and may mean the two of you're are now in cahoots > to boost each other's shoddy goods and hide the faults behind a > phony dispute, like 50 years of mock competitive Ameri-Russky > junk national security communist-capitalist racketeering so beloved > by die-hard globalist TLAs of business and government. It is becoming increasingly obvious that John Young is the real troublemaker here. I wouldn't doubt that it was John who was behind the original troubles between Vulis and Sameer. I think that John Young should be forcefully unsubscribed from the Cypherpunks mailing lists. YoungMonger From whgiii at invweb.net Sun Oct 5 09:59:15 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Mon, 6 Oct 1997 00:59:15 +0800 Subject: New PGP "Everything the FBI ever dreamed of" In-Reply-To: Message-ID: <199710051653.MAA10344@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In , on 10/05/97 at 08, Tim May said: >Let's hope PGP, Inc. comes to their senses and stops doing the work of >Big Brother. This is really silly Tim, The ability to encrypt using multiple keys has been a feature of PGP since day one. All the Business Edition is doing is automating the process. Despite the flawed news reports on this matter (who would have guessed) their is nothing covert about it. The user is both informed that this is being done and there is a way for the user to disable it in the client. This has been discussed before on this list and others, and few have disagreed, that a company has a legitimate need to be able to access its encrypted data. If employees want to send love letters or whatnot then they should not be doing it on company time using company resources. If a corporation wishes to establish a company policy that all correspondence be encrypted with the companies master key it is their right to do so and IMNSHO it would be foolhardy for them to do otherwise. Claiming that they are doing the work of Big Brother is a cheap-shot and uncalled for. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNDfHk49Co1n+aLhhAQFnWQQAorD2znejbM7YxYmIIH0gn3D+KyltWbqR KXy3U9n6ObmQRLrXPR+D12WsfkO8wUXCBbXvEkWFTenSIC+ejgRK7hRqdq7lj4oF Fs1AGcHeKVsUL9M06nOhQqlZjHU03WcDWFhrBIJQZL3NVFz0QzzfaS+m9X673vVN 7fKPBQMwZfA= =tBYy -----END PGP SIGNATURE----- From ravage at ssz.com Sun Oct 5 10:02:23 1997 From: ravage at ssz.com (Jim Choate) Date: Mon, 6 Oct 1997 01:02:23 +0800 Subject: Traffic Analysis (fwd) Message-ID: <199710051718.MAA00600@einstein.ssz.com> Forwarded message: > Subject: Re: Traffic Analysis (fwd) > Date: Sun, 5 Oct 97 11:59:53 -0400 > > On 10/3/97 10:49 AM, Jim Choate (ravage at ssz.com) passed this wisdom: > > >If the MTBF for a remailer is n then the MTBF for m remailers is > >n*m. Inother words the remailer chain gets less reliable as it gets > >longer. > > Jim, you want to take a look at that "n*m" again ... it doesn't > wash. means MTBF goes *up* which means *more* reliable. Remember n is a fraction, failures/time_period ... If your MTBF is 1 failure per year for each system and you have 10 systems your MTBF is 10 failures per year. Looks like multiplication to me.... Course you can look at it another way as well. Which would mean you would have 1 failure every 10th of a year. That's division, and also misleading because failures don't care about the time period, they may happen all at once. Depends on how you look at MTBF, I generaly look at it the first way because I can use addition if I'm working on a system that don't have multiplication (eg machine code on a 68HC11) that way I don't have to build some damn floating poing library to do division ... Statistics, damn statistics, and lies. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Sun Oct 5 10:10:58 1997 From: ravage at ssz.com (Jim Choate) Date: Mon, 6 Oct 1997 01:10:58 +0800 Subject: ISDN status - intermittent Message-ID: <199710051724.MAA00742@einstein.ssz.com> Hi, Just a quick head-up.... The ISDN is going up and down today, there are several SWBT trucks in the neighborhood. My suspicion is that they are working on the trunk line throw from the N. Lamar station to the one on Duval behind the church. If this is the problem then it should go stable (or go dead because of another documentation error like last time) sometime this afternoon. Sorry for any inconvenience. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Sun Oct 5 10:20:24 1997 From: ravage at ssz.com (Jim Choate) Date: Mon, 6 Oct 1997 01:20:24 +0800 Subject: Stronghold (fwd) Message-ID: <199710051735.MAA00824@einstein.ssz.com> Forwarded message: > Date: Sun, 5 Oct 1997 18:46:14 +0200 (MET DST) > Subject: Re: Stronghold > From: nobody at REPLAY.COM (Anonymous) > It is becoming increasingly obvious that John Young is the real > troublemaker here. I wouldn't doubt that it was John who was > behind the original troubles between Vulis and Sameer. > I think that John Young should be forcefully unsubscribed from > the Cypherpunks mailing lists. You sir are an unmittigated ass and more than a tad immature and selfish. I will not forcefully unsubscribe anyone from the SSZ node unless cops start showing up at my door giving me shit, in which case the node might go down (hopefully temporarily). I may not like what he did but I'll be damned if I'll go back on my beliefs in free speech just because you or I don't like it. You want freedom, learn to give it even when it hurts. Grow up and learn to deal with it. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From devnull at bureau42.ml.org Sun Oct 5 12:04:26 1997 From: devnull at bureau42.ml.org (Anonymous (via bureau42 remailer)) Date: Mon, 6 Oct 1997 03:04:26 +0800 Subject: Pretty Good Piracy Message-ID: If anyone has a copy of Viacrypt's Pretty Good Prying, it would be nice if they would make it available to those who want to get to work finding out how to best sabotage it. I am not against Viacrypt producing surveillance software for those who want it, but I resent their perversion of a product whose reputation capital is the result of the integrity and effort of a great many people whose interests lie in privacy, not in surruptitious surveillance. I can guarantee that any system I have access to which contains this twisted sister of PGP will have my hand up its dress, playing with its private parts. What is ViaCrypt's marketing plan? "Make sabotaging the security of your system a badge of honour among the elite of the computer security industry. Buy mis-represented PGP." "You need not fear our product having been sabotaged by privacy purists within ViaCrypt, because we fired all the people with integrity." "We stole the reputation, but we wouldn't steal your information." "It's not GAK. I was just clearing my throat." "Tired of the employees banging your wife...?" RottsaRaffsMongel From ghio at temp0130.myriad.ml.org Sun Oct 5 12:07:43 1997 From: ghio at temp0130.myriad.ml.org (Matthew Ghio) Date: Mon, 6 Oct 1997 03:07:43 +0800 Subject: Quor's cipher In-Reply-To: <199710042151.WAA03454@notatla.demon.co.uk> Message-ID: <199710051843.OAA02599@myriad> Antonomasia wrote: > How are you planning to detect which bytes are passed in this way ? > Chosen plaintext attacks would do it, and show where (a+b)^(a0+b0) == 0. > Looks like you've just doubled our progress. It doesn't take chosen plaintext, just known plaintext. > > If the key is reused with a different message I don't think there's a > weakness. An IV is a good idea, but aren't we _attacking_ this thing ? Lack of an IV is a problem with almost any cipher, but it seems especially so here. From tcmay at got.net Sun Oct 5 12:30:38 1997 From: tcmay at got.net (Tim May) Date: Mon, 6 Oct 1997 03:30:38 +0800 Subject: New PGP "Everything the FBI ever dreamed of" In-Reply-To: Message-ID: At 9:46 AM -0700 10/5/97, William H. Geiger III wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >In , on 10/05/97 > at 08, Tim May said: > >>Let's hope PGP, Inc. comes to their senses and stops doing the work of >>Big Brother. > >This is really silly Tim, > >The ability to encrypt using multiple keys has been a feature of PGP since >day one. All the Business Edition is doing is automating the process. >Despite the flawed news reports on this matter (who would have guessed) >their is nothing covert about it. The user is both informed that this is >being done and there is a way for the user to disable it in the client. I never claimed it is "covert." (Nor is "Key Recovery" covert, if the various laws are implemented. Does this make mandatory Key Recovery acceptable?) Nor, so far as I have read, can employees disable the "Policy" features. > >This has been discussed before on this list and others, and few have >disagreed, that a company has a legitimate need to be able to access its >encrypted data. If employees want to send love letters or whatnot then >they should not be doing it on company time using company resources. I repeated this point _twice_. That employers want to read mail is not surprising, or illegal. But PGP loses its claims to protect personal privacy if it builds in these capabilities. This is what Phil said, too. >Claiming that they are doing the work of Big Brother is a cheap-shot and >uncalled for. (Ironic coming from a frequent issuer of cheap shots.) It is the work of Big Brother, as Garfinkel, Zimmermann, and I agree, when it becomes a default that additional recipients are automatically copied on encrypted mail. It may be useful to companies, but it's still dangerous. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From anon at anon.efga.org Sun Oct 5 12:37:39 1997 From: anon at anon.efga.org (Anonymous) Date: Mon, 6 Oct 1997 03:37:39 +0800 Subject: Quor's cipher Message-ID: <66c42f70e423e616b75fbe950615bdc0@anon.efga.org> Antonomasia wrote: > This cypher is constructed differently from RC4 or fish - not as simple as > WAKE but broadly comparable to Sapphire II. I think I'll enlist the help > of a search engine. It's more than likely there other things waiting to > be done to this. It seems to be roughly a cross between a stream cypher and a block cypher. Search engine turned up absolutely nothing on this. > Quor's friend 'nobody' has actually put some crypto on > the list -let's see what we can do with/to it. An actual crypto post on a cryptography list? How unusual.... ;-) From alan at ctrl-alt-del.com Sun Oct 5 13:00:55 1997 From: alan at ctrl-alt-del.com (Alan) Date: Mon, 6 Oct 1997 04:00:55 +0800 Subject: New PGP "Everything the FBI ever dreamed of" In-Reply-To: Message-ID: <3.0.3.32.19971005124929.03dfa15c@ctrl-alt-del.com> At 11:46 AM 10/5/97 -0500, William H. Geiger III wrote: > >-----BEGIN PGP SIGNED MESSAGE----- > >In , on 10/05/97 > at 08, Tim May said: > >>Let's hope PGP, Inc. comes to their senses and stops doing the work of >>Big Brother. > >This is really silly Tim, > >The ability to encrypt using multiple keys has been a feature of PGP since >day one. All the Business Edition is doing is automating the process. >Despite the flawed news reports on this matter (who would have guessed) >their is nothing covert about it. The user is both informed that this is >being done and there is a way for the user to disable it in the client. I guess the real question is whether the messages/files generated just add an extra key or if they leak the key through some harder to identify method. The current version of PGP no longer shows you the list of recipients, so it is more difficult to determine if extra keys are added. Is the method they are using for this new version to "escrow" the keys obvious to the recipient or not? --- | "That'll make it hot for them!" - Guy Grand | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano at teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan at ctrl-alt-del.com| From alan at ctrl-alt-del.com Sun Oct 5 13:07:14 1997 From: alan at ctrl-alt-del.com (Alan) Date: Mon, 6 Oct 1997 04:07:14 +0800 Subject: Stronghold In-Reply-To: <199710051646.SAA26190@basement.replay.com> Message-ID: <3.0.3.32.19971005124514.03d6c91c@ctrl-alt-del.com> At 06:46 PM 10/5/97 +0200, Anonymous wrote: > >John Young wrote: >> Dimitri, out with Stronghold's fault, if you've got it. C2, cut the >> legal bluff, it stinks. The badmouthing by both of you is the same old >> toxic waste -- and may mean the two of you're are now in cahoots >> to boost each other's shoddy goods and hide the faults behind a >> phony dispute, like 50 years of mock competitive Ameri-Russky >> junk national security communist-capitalist racketeering so beloved >> by die-hard globalist TLAs of business and government. > >It is becoming increasingly obvious that John Young is the real >troublemaker here. I wouldn't doubt that it was John who was >behind the original troubles between Vulis and Sameer. >I think that John Young should be forcefully unsubscribed from >the Cypherpunks mailing lists. That is bullshit! So far, there have been claims to a backdoor but no actual proof. Everytime someone asks for said proof, there is a huge amount of handwaving and misdirection as to why any sort of proof cannot be revealed. Each time the excuses get more and more elaborate. "C2Net will sue us." "We can make more money if we keep it secret." "It is already well known." But the excuses get pretty thin after a while without any real proof. Yes, employees of C2Net have acted in a stupid manner. But, in my opinion, you are using that as a smokescreen to avoid having to reveal anything substantial. (Because you do not have anything substantial.) You can point fingers, accuse people of all sorts of things, and make all the wheeping wailing and knashing of teeth you want. It still somes down to the fact that you have shown no hard evidence that such a backdoor exists. Put up or shut up. --- | "That'll make it hot for them!" - Guy Grand | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano at teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan at ctrl-alt-del.com| From vf at dev.null Sun Oct 5 13:10:07 1997 From: vf at dev.null (ViaCrypt FiringBot) Date: Mon, 6 Oct 1997 04:10:07 +0800 Subject: ViaCrypt Fires Tim C. May Message-ID: <3437F185.24C3@dev.null> From: ViaCrypt FiringBot To: Tim C. May Dear Ms. May, We regret to inform you that your employment with ViaCrypt has been terminated, effectively immediately. In accordance with company policy we will outline the reasons for your termination below. 1. Records from your company supplied E-ZPass electronic toll booth pass indicate that you are arriving in the city over an hour before you begin work, leading us to believe that you are engaged in personal activities during this time which take away from the energy you have left to put into your company work. 2. The OnStar satellite-positioning service reports that your company supplied Cadillac was parked at the restaurant where you ate with your company supplied Visa card for an hour and ten minutes. Employees are only allowed one hour for lunch breaks. 3. The Teletrac global-positioning satellite has reported that you exceeded the speed limit twice in one day (32 mph in a 30 mph zone, and 56 mph in a 55 mph zone). 4. The passive tracking microchip on your company supplied ID card was tracked by our remote sensors in six parts of the city which we prefer that our employees not enter. 5. Your company supplied cellular phone was used to call someone not in our business database who used his MasterCard to buy condoms at a local pharmacy during a weekend when his wife used her Visa to take a trip out of town. This reflects badly on the company. 6. The company aerial drone reports that in several passes over your home, the presence of marihuana smoke was detected. 7. Surveillance of your company email indicates that you have been using company resources to include private messages such as "Have a nice day." in business email sent on company time. 8. Reports sent in to the company by the automatic modem software on your company supplied laptop indicate that you have visited websites which are not approved by CyberSitter, such as the City of SEXton community website. 9. Video surveillance of the Men's Restroom indicates that you have been wasting company resources by using more toilet paper than necessary, in relation to the amount of human waste monitored during your visits. Also, you twice failed to put the toilet seat down, as required by our company policy of sexual sensitivity. 10. Our monitoring of your user access to the company computer system shows that you accessed areas of the system which were not found to be in accordance with your security level. Our records indicate that ViaCrypt owes you $15,000,000.00 for your 1 day(s) of employment. This has been deposited in your Bank Account in Antigua, according to your wishes. Sincerely, (as sincere as a machine can be, that is) ViaCrypt FiringBot From dlv at bwalk.dm.com Sun Oct 5 13:33:57 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Mon, 6 Oct 1997 04:33:57 +0800 Subject: Stronghold In-Reply-To: <199710051646.SAA26190@basement.replay.com> Message-ID: <5F44De2w165w@bwalk.dm.com> nobody at REPLAY.COM (Anonymous) writes: > It is becoming increasingly obvious that John Young is the real > troublemaker here. I wouldn't doubt that it was John who was > behind the original troubles between Vulis and Sameer. Is it merely a coincidence that "John Young" and "John Gilmore" share the same first name? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From randerso at ece.eng.wayne.edu Sun Oct 5 13:43:25 1997 From: randerso at ece.eng.wayne.edu (Ryan Anderson) Date: Mon, 6 Oct 1997 04:43:25 +0800 Subject: Pretty Good Piracy In-Reply-To: Message-ID: <3.0.2.32.19971005162843.006d19f4@ece.eng.wayne.edu> -----BEGIN PGP SIGNED MESSAGE----- At 06:05 PM 10/5/97 GMT, via bureau42 remailer wrote: >I can guarantee that any system I have access to which contains this >twisted sister of PGP will have my hand up its dress, playing with its >private parts. Okay - the only difference between this and a normal version of PGP is that it always encrypts to a certain key-id, in addition to all others. That's the only weakness you'll see in it. So stop bitching about a feature that business is going to require before rolling out PGP to the whole enterprise. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNDf4ejc3ytqHnNyNAQFGUwQAlIcR54r60O21kn8W122pK06XxtaXLtyR p/spjqOkEtk5F0Mdl43MYJH/q07tsE5/Ud+SKxQ3CV3A6L8tojZoK53tuFt0BsSK FsJRVXT7yCC11G11BiAHUipMt+qJHDkwGzi32hmvInYtQ8R0Cywo/zmcUfSGMyaT iWfV+6Z1ygc= =cK+x -----END PGP SIGNATURE----- ----------------------------------------------------------------------- Ryan Anderson - "Who knows, even the horse might sing" Wayne State University - CULMA "May you live in interesting times.." randerso at ece.eng.wayne.edu PGP Fingerprint - 7E 8E C6 54 96 AC D9 57 E4 F8 AE 9C 10 7E 78 C9 ----------------------------------------------------------------------- From toto at sk.sympatico.ca Sun Oct 5 13:43:55 1997 From: toto at sk.sympatico.ca (Toto) Date: Mon, 6 Oct 1997 04:43:55 +0800 Subject: Stronghold In-Reply-To: <5F44De2w165w@bwalk.dm.com> Message-ID: <3437F884.414D@sk.sympatico.ca> Dr.Dimitri Vulis KOTM wrote: > > nobody at REPLAY.COM (Anonymous) writes: > > It is becoming increasingly obvious that John Young is the real > > troublemaker here. I wouldn't doubt that it was John who was > > behind the original troubles between Vulis and Sameer. > > Is it merely a coincidence that "John Young" and "John Gilmore" share > the same first name? Dimitri, I laughed till I cried, when I read this. I hope you were trying to be humorous. If not, then seek psychiatric help immediately! (See if you can get us a group discount, because I have come to believe that the 'moderation experiment' was a clever ruse to weed out all of the 'sane' people from the Cypherpunks list.) Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix "WebWorld & the Mythical Circle of Eunuchs" http://bureau42.base.org/public/webworld "InfoWar" http://bureau42.base.org/public/infowar3 "The Final Frontier" http://www3.sk.sympatico.ca/carljohn From randerso at ece.eng.wayne.edu Sun Oct 5 13:49:43 1997 From: randerso at ece.eng.wayne.edu (Ryan Anderson) Date: Mon, 6 Oct 1997 04:49:43 +0800 Subject: New PGP "Everything the FBI ever dreamed of" In-Reply-To: <199710051653.MAA10344@users.invweb.net> Message-ID: <3.0.2.32.19971005163708.006d25e0@ece.eng.wayne.edu> -----BEGIN PGP SIGNED MESSAGE----- At 12:06 PM 10/5/97 -0700, Tim May wrote: >>Claiming that they are doing the work of Big Brother is a cheap-shot and >>uncalled for. > >(Ironic coming from a frequent issuer of cheap shots.) > > >It is the work of Big Brother, as Garfinkel, Zimmermann, and I agree, when >it becomes a default that additional recipients are automatically copied on >encrypted mail. It may be useful to companies, but it's still dangerous. Look a bit closer at the announcments: I believe they said that they would compile a new version for each key that they used. So it's not even likely that this could become a widespread feature. For this to be useful for GAK, you'd have to change all copies in existence to encrypt for this key. (And of course, then you'd have a very simple key- id to search for in the executable and modify, say to encrypt back to yourself, and you'd have circumvented this little problem) If you want PGP to get into widespread use in business, you have to provide features that they will require. Frankly, this is good for encryption, to provide features that business needs. With this, hopefully the business lobby will fall in line with the no-regulation-on-crypto lobby, and get all of us the results we want. Phil is never going to release a copy of PGP that has built-in GAK. We know that. This is MAK (Management Access...) in a secure manner, which is better than the other methods of internal escrow. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNDf6czc3ytqHnNyNAQF80AP/Vm5uO8nLqnDShxu6/o9HArZNgvb8txoR JV3ANvTd7fHjpCMHEzSdUgyEYspX8uRP6D6qR2nAt3KgLwlVpNcLgQO6mUd4E9av naGgt7jHPcJ1tvFu8yr6mUFtXZ7yvROnOpkRXTv7HR4vaPvOS5Z8G60WZXhJRw3S FkFh7ADJiRk= =PafJ -----END PGP SIGNATURE----- ----------------------------------------------------------------------- Ryan Anderson - "Who knows, even the horse might sing" Wayne State University - CULMA "May you live in interesting times.." randerso at ece.eng.wayne.edu PGP Fingerprint - 7E 8E C6 54 96 AC D9 57 E4 F8 AE 9C 10 7E 78 C9 ----------------------------------------------------------------------- From brianbr at together.net Sun Oct 5 14:02:08 1997 From: brianbr at together.net (Brian B. Riley) Date: Mon, 6 Oct 1997 05:02:08 +0800 Subject: Traffic Analysis (fwd) Message-ID: <199710052028.QAA05930@mx02.together.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/5/97 1:18 PM, Jim Choate (ravage at ssz.com) passed this wisdom: >> Subject: Re: Traffic Analysis (fwd) >> Date: Sun, 5 Oct 97 11:59:53 -0400 >> >> On 10/3/97 10:49 AM, Jim Choate (ravage at ssz.com) passed this >> wisdom: >> >>>If the MTBF for a remailer is n then the MTBF for m remailers >>>is n*m. Inother words the remailer chain gets less reliable as >>>it gets longer. >> >> Jim, you want to take a look at that "n*m" again ... it >>doesn't wash. means MTBF goes *up* which means *more* reliable. > >Remember n is a fraction, failures/time_period ... > >If your MTBF is 1 failure per year for each system and you have 10 >systems your MTBF is 10 failures per year. Looks like multiplication >to me.... Maybe I have been away from hardcore engineering for too long, but last time I checked MTBF (Mean Time Between Failures) is measured in time (seconds, minutes, hours etc) not in failures per year that would be called 'failure rate' -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDf4WMdZgC62U/gIEQJy/QCeKTFBl+4yLC4mDnr/32uh8w8rbLsAn086 Y+veBvWn4ULlxuJBT0+Bun4N =7xHN -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys "One of the deep mysteries to me is our logo, the symbol of lust and knowledge, bitten into, all crossed with in the colors of the rainbow in the wrong order. You couldn't dream of a more appropriate logo: lust, knowledge, hope, and anarchy." -- Gassee - Apple Logo From nobody at REPLAY.COM Sun Oct 5 14:08:33 1997 From: nobody at REPLAY.COM (Anonymous) Date: Mon, 6 Oct 1997 05:08:33 +0800 Subject: Quor's cipher In-Reply-To: <199710042151.WAA03454@notatla.demon.co.uk> Message-ID: <199710052058.WAA21077@basement.replay.com> Matthew Ghio wrote: > Antonomasia wrote: > > > How are you planning to detect which bytes are passed in this way ? > > Chosen plaintext attacks would do it, and show where (a+b)^(a0+b0) == 0. > > Looks like you've just doubled our progress. > > It doesn't take chosen plaintext, just known plaintext. Even in the case where this doesn't work, you can simply collect all 128 plaintext/ciphertext pairs for the first byte (if you can get enough known plaintexts) From ravage at ssz.com Sun Oct 5 14:40:36 1997 From: ravage at ssz.com (Jim Choate) Date: Mon, 6 Oct 1997 05:40:36 +0800 Subject: MTBF Message-ID: <199710052152.QAA01702@einstein.ssz.com> Hi, MTBF is usualy given as a single number, number_of_base_time_units from initial turn-on to 1st failure given no power downs or other interruptions. This is effectively of the form number_of_base_time_units/failure. This is clearly equivalent to number_of_failures/base_time_unit for practical use. Especialy considering that in this form you generaly don't ever need to do a division as you do if you use the first form. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From nobody at REPLAY.COM Sun Oct 5 15:55:08 1997 From: nobody at REPLAY.COM (Anonymous) Date: Mon, 6 Oct 1997 06:55:08 +0800 Subject: Pretty Good Piracy Message-ID: <199710052237.AAA03819@basement.replay.com> Ryan Anderson wrote: > Okay - the only difference between this and a normal version of PGP is that > it always encrypts to a certain key-id, in addition to all others. > > That's the only weakness you'll see in it. It's the only weakness that's needed to compromise all the keys. > So stop bitching about a feature that business is going to require before > rolling out PGP to the whole enterprise. I don't have any problem with the feature, only with the use of the PGP reputation capital to directly promote it. If they wanted to call it 'Pretty Corporate Privacy' then the name would reflect its purpose. Security, in regard to privacy, is an all-or-nothing issue. As such, I do not find it acceptable to apply the same standards of promotion and dissemination as with less important types of software. The fact of the matter is, the product has nothing to do with the privacy of the individual using it, only the privacy of the corporation. This is an important distincion which should not be subject to confusion with a product by the same name which is noted for providing a secure level of privacy for the individual. I would wager that promoting a false sense of security, or an incorrect view of the levels of security and trust involved in company software will do more damage than the occassional loss of keys will. Again, the product does not provide 'Pretty Good Privacy,' it does provide 'Pretty Corporate Privacy.' PrivacyMonger From dlv at bwalk.dm.com Sun Oct 5 16:26:07 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Mon, 6 Oct 1997 07:26:07 +0800 Subject: Stronghold In-Reply-To: <3.0.3.32.19971005124514.03d6c91c@ctrl-alt-del.com> Message-ID: Alan writes: > Everytime someone asks for said proof, there is a huge amount of handwaving > and misdirection as to why any sort of proof cannot be revealed. Each time > the excuses get more and more elaborate. "C2Net will sue us." "We can make > more money if we keep it secret." "It is already well known." Alan, are you still doubting that C2Net's lawyers threatened several people on this mailing list and demanded that they not publish the "proof"? They called my home a number of times and served me with some papers. I'm surprised that JYA hasn't placed the C2Net lawyer letter in his archives. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From brianbr at together.net Sun Oct 5 17:03:27 1997 From: brianbr at together.net (Brian B. Riley) Date: Mon, 6 Oct 1997 08:03:27 +0800 Subject: Pretty Good Piracy Message-ID: <199710052351.TAA09777@mx02.together.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/5/97 6:37 PM, Anonymous (nobody at REPLAY.COM) passed this wisdom: >Ryan Anderson wrote: >> Okay - the only difference between this and a normal version of >> PGP is that it always encrypts to a certain key-id, in addition >> to all others. >> >> That's the only weakness you'll see in it. > >It's the only weakness that's needed to compromise all the keys. It seems to me that it should not necessarily compromise all keys, though it does in effect provide for a goodly number of 'known plaintext' objects. Could some of our hardcore crypto experts comment on IDEA's susceptability to known plaintext which then provides 'plaintext' to the DH/DSS or RSA keys and what is their susceptability to 'known plaintext' It occured to me while proofreading the above that in effect a digitally signed cleartext document provides 'known plaintext' every time its used, since the SHA-1/MD-5 can be computed the hash is a 'known plaintext' on the DH/DSS and RSA keys ... is this one of the reasons for the two key types in PGP5 ??? -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDgmJcdZgC62U/gIEQIvgwCg/kybc9ons3ji3cbi9jtSnQ3kptkAn3IC 90pwzjjpt2qqhpjn8VRlrOGR =IIkE -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys "Never ask what sort of computer a guy drives. If he's a Mac user, he'll tell you. If not, why embarrass him?" - Tom Clancy From aldius at mindless.com Sun Oct 5 18:07:17 1997 From: aldius at mindless.com (Aldius) Date: Mon, 6 Oct 1997 09:07:17 +0800 Subject: Pretty Good Piracy In-Reply-To: <199710052351.TAA09777@mx02.together.net> Message-ID: <199710060054.RAA02677@toad.com> On Sun, 5 Oct 97 19:51:06 -0400 "Brian B. Riley" wrote regarding "Re: Pretty Good Piracy": : It occured to me while proofreading the above that in effect a :digitally signed cleartext document provides 'known plaintext' every :time its used, since the SHA-1/MD-5 can be computed the hash is a :'known plaintext' on the DH/DSS and RSA keys ... is this one of the :reasons for the two key types in PGP5 ??? The reason for having two key types for PGP5 is that DH is only capable of key distribution, not signing. and DSS is only capable of signing. Hence, you require one key to sign, and one to distribute the session key. ;____________________________________________________________________ ; ; aldius at mindless.com ;____________________________________________________________________ ; From raph at CS.Berkeley.EDU Sun Oct 5 18:29:49 1997 From: raph at CS.Berkeley.EDU (Raph Levien) Date: Mon, 6 Oct 1997 09:29:49 +0800 Subject: List of reliable remailers Message-ID: <3.0.3.32.19971005180656.006af36c@popd.ix.netcom.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ADVERTISEMENT: Proudly Sponsored by the Electronic Forgery Foundation, http://www.eff.com ADVERTISEMENT: Digicash Software - Download Today! http://www.digicrime.com I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list at kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys at kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list at kiwi.cs.berkeley.edu. $remailer{'cyber'} = ' alpha pgp'; $remailer{"mix"} = " cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = " cpunk mix pgp hash latent cut post ek"; $remailer{"jam"} = " cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = " cpunk pgp pgponly hash cut ksub reord ?"; $remailer{'nym'} = ' newnym pgp'; $remailer{"trustme"} = " cpunk mix pgp pgponly hash crack latent cut ek"; $remailer{"squirrel"} = " cpunk mix pgp pgponly hash latent cut ek"; $remailer{'weasel'} = ' newnym pgp'; $remailer{"reno"} = " cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"cracker"} = " cpunk mix remix pgp hash ksub esub latent cut ek reord post"; $remailer{'redneck'} = ' newnym pgp'; $remailer{"bureau42"} = " cpunk mix pgp ksub hash latent cut ek"; $remailer{"recovery"} = " cpunk mix pgp ksub hash latent mon cut ek"; $remailer{"neva"} = " cpunk pgp pgponly hash cut ksub ?"; $remailer{"payswell"} = " cpunk pgp pgponly launder hash cut mon ksub ?"; $remailer{"lcs"} = " mix"; $remailer{"medusa"} = " mix middle" $remailer{"McCain"} = " mix middle"; $remailer{"valdeez"} = " cpunk pgp pgponly hash ek"; $remailer{"arrid"} = " cpunk pgp pgponly hash ek"; $remailer{"hera"} = " cpunk pgp pgponly hash ek"; $remailer{"mulder"} = " cpunk pgp pgponly hash ek"; $remailer{"scully"} = " cpunk pgp pgponly hash ek"; $remailer{"htuttle"} = " cpunk pgp hash latent cut post ek"; catalyst at netcom.com is _not_ a remailer. lmccarth at ducie.cs.umass.edu is _not_ a remailer. president at whitehouse.gov is _not_ a remailer. usura at replay.com is _not_ a remailer. remailer at crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix reno winsock) (weasel squirrel medusa) (cracker redneck) (nym lcs) (valdeez arrid hera mulder scully) The remailer list here has been out of date for some time, but should be up to date now. I'm still working on updating the web page. Last update: Mon 8 Sep 97 6:48:45 PDT remailer email address history latency uptime - ----------------------------------------------------------------------- recovery remailer at biglouie.fbi.gov ############ 0:01 99.99% payswell remailer at digicrime.com ############ 0:01 99.99% trustme trustme at trustme.nsa.mil ************ 0:59 99.99% mulder mulder at juno.com #*#*##*#*#*# 0:57 99.98% nym config at nym.alias.net ####**+#-## 7:03 99.95% hera goddesshera at juno.com ----_.---.. 14:56:18 99.95% cyber alias at alias.cyberpass.net *+*****++**+ 11:30 99.93% squirrel mix at squirrel.owl.de ----------- 3:17:57 99.83% scully scully at fox.fbi.gov +-+-+-+-+-+- 0:57 101.00% valdeez valdeez at juno.com -__.-*+*-.- 7:50:19 99.81% winsock winsock at rigel.cyberpass.net -----_..---* 10:10:24 99.81% bureau42 remailer at bureau42.ml.org ..--------- 3:33:37 99.31% arrid arrid at juno.com -- -------- 7:27:32 99.15% kgbvax remailer at kgbvax.demos.su . -- .. --- 99:59:59 19.84% neva remailer at neva.org -+*#+*--* # 25:21 98.45% jam remailer at cypherpunks.ca + ++++++ 39:06 97.23% cracker remailer at anon.efga.org + +++ +++ 28:43 97.10% replay remailer at replay.com +**-++ +** 9:49 96.75% redneck config at anon.efga.org -*+* ++# 10:58 96.60% reno middleman at cyberpass.net ++..+ * -- 2:32:31 84.34% mix mixmaster at remail.obscura.com **+*++*+ 1:14:29 58.44% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. launder Supports Matt Blaze's Packet-Laundry: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. escrow Provides message backup services to prevent accidental loss. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDg5r0TMP00JT6s3EQKSngCdF5V1Ecd5ZA3Xa0gYUDHmHaklorAAn2os muMxWPxHj2VmK9uYtACtZhHx =eWmu -----END PGP SIGNATURE----- From aba at dcs.ex.ac.uk Sun Oct 5 18:56:32 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Mon, 6 Oct 1997 09:56:32 +0800 Subject: Stronghold In-Reply-To: Message-ID: <199710060047.BAA02975@server.test.net> Dimitri Vulis writes: > > Where do people get these bizarre ideas? C2 didn't censor the list. A guy > > who happened to work for C2 dropped some messages from one list. The > > messages still went out on the unfiltered list. Had he worked for Mc > > Donald's or the the NYC Sanitiation Department, would you blame them for > > this as well? > > Lucky is lying: the censored articles were also filtered from the > list which was billed as being unfiltered. There were 3 lists: cypherpunks-unedited (everything) cypherpunks (moderated by Sandy) cypherpunks-flames (the stuff Sandy rejected) At the time I was subscribed to cypherpunks and cypherpunks-flames in the belief that this would result in getting everything, and save the bandwidth of subscribing to all 3, but allow me to tell what was rejected. I didn't see the censored post at all. This means at least that Sandy didn't post it to either of cypherpunks or cypherpunks-flames. This is consistent with his later admission that he considered Dimitri's comments on Stronghold security as a conflict of interests for him to post, as he was manually posting to both of those lists. Unfortunately I wasn't on cypherpunks-unedited at the time, but I thought that it was immediate send out from toad.com without going via Sandy. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Sigh. A company called I-Planet is trying to trademark the term "Cypherspace", even though we've been using it for a couple of years in the cypherpunk community. They're doing an IPSEC Virtual Private Network, with friendly HTML administration; http://www.i-planet.com/P2cypherpb.html . Looks like interesting stuff, and I wish them luck except in TMing the name :-) I looked on AltaVista and HotBot, and the earliest reference I found was from a 1994 article by Tim May. I'd be interested in finding any earlier refs. There's also a line of comic books using the name, and a Java Applet from 1996, plus references from I-Planet in late 96 and 97. Anybody know if the term's been used in print in the dead-tree press? http://www-swiss.ai.mit.edu/6095/assorted-short-pieces/may-police-state.txt 05-Oct-94 http://www.pi.net/~mvheezik/cypher.html 20-Dec-96 http://infinity.nus.sg/cypherpunks/dir.archive-96.10.17-96.10.23/subject.html pointing to David Lesher's article Alice in Cypherspace http://www.insitecomp.com/webdev/java/javasites.htm 7-Dec-96 points to "Cypherspace", a Java Application on a machine I don't seem to be able to reach right now. ============================================================= ==== FROM http://www2.netcom.com/netcom/cypher.html and also ==== http://www.i-planet.com/P2cypherpb.html ======== Introducing i-Planet's CypherSpace� As part of the i-Planet Solution� product family, CypherSpace� allows a company to securely link all of its locations together over the Internet by creating a Virtual Private Network (VPN). This represents an enormous cost savings especially for multinational organizations. ============================================================= Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From stewarts at ix.netcom.com Sun Oct 5 19:34:00 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Mon, 6 Oct 1997 10:34:00 +0800 Subject: Risks of using usually-reliable information sources in your programs Message-ID: <3.0.3.32.19971005191732.00688c2c@popd.ix.netcom.com> I've been thinking about building remailers and cover-traffic generators, and there's a need for a convenient up-to-date list of remailers. Raph Levien's remailer pinging service is definitely convenient, and even produces some of its output in perl for use by perl programs. However, it's important to be really careful when depending on information like this, e.g. when building it into programs, because otherwise it's easy to trick them into using bogus data, such as the crudely forged article sent to Cypherpunks earlier today. The natural implementation is to pick the more reliable remailers based on "Raph"'s statistics, so adding records for very reliable bogus remailers is a win. The security would be improved if Raph signed the weekly file, but that also requires people using the file to check it with PGP and not just grep out the relevant lines for their programs' use. >X-Sender: stewarts at popd.ix.netcom.com >X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32) >Date: Sun, 05 Oct 1997 18:06:56 -0700 >To: cypherpunks at toad.com >From: Raph Levien >Subject: List of reliable remailers >Sender: owner-cypherpunks at cyberpass.net >Reply-To: Raph Levien >X-Loop: cypherpunks at cyberpass.net > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >ADVERTISEMENT: Proudly Sponsored by the Electronic Forgery Foundation, >http://www.eff.com >ADVERTISEMENT: Digicash Software - Download Today! http://www.digicrime.com > > I operate a remailer pinging service which collects detailed >information about remailer features and reliability. .... >recovery remailer at biglouie.fbi.gov ############ 0:01 99.99% >payswell remailer at digicrime.com ############ 0:01 99.99% >trustme trustme at trustme.nsa.mil ************ 0:59 99.99% >mulder mulder at juno.com #*#*##*#*#*# 0:57 99.98% Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From jf_avon at citenet.net Sun Oct 5 19:46:44 1997 From: jf_avon at citenet.net (jf_avon at citenet.net) Date: Mon, 6 Oct 1997 10:46:44 +0800 Subject: Unicorn an NSA agent? WAS: New PGP "Everything the FBI ever dre In-Reply-To: Message-ID: <199710060244.WAA16373@cti06.citenet.net> Unicorn wrote: > borderline activity. It's hardly a settled point. That you are so quick > to advocate corporate ownership of potentially private e-mail out of hand > and without argument tells us much about your real position, Mr. > Moscaritolo. Three words: "Expectation of Privacy." Unicorn, In that piece of knowledge smashing, just as you do in most of your posts, you again mixed up things to make sure that everybody end up knowing less than when they started. It is peoples like you that ended up with using Expectation of Privacy out of it's rightfull context. Apart from various rulings of various judges that probably smoked various herbs, can you please tell me how anybody can rightfully expect privacy when everything that permits them to exchange information is *owned* by somebody else and that the use of this equipment is there *only* for the activities of the owner of the equipment? If it weren't of the business, the damn computer wouldn't be there. And beside, the employee is not paid to chat with friends, he's paid to work. If he doesn't want to work, just fine, but not on the company's pay... Somehow, you basic premises always blows my mind. I think that you are a *very* dangerous person. I've been watching you for almost three years over Cypherpunks and e$-etc and other forums. Virtually *all* of your posts have this blow-up-their-basic-premises-and-let-them-with-nothing-but-confusion style. Your style shows intelligence and skill in the way you do it, which rules out idiocy on your part. So, clearly, you have an agenda. I cannot help but having the nagging feeling that you're on some three-letter agency payroll because you have the uncanny habit of disrupting and diverting some important discussion. I always wanted to killfile you but always refrained to do so just to be able to read the last finely crafted basic premises-smashing abomination. So, again, which of the three-letter agency sends you a paycheck? Or are you doing is only for a secret decoration? jfa -- Jean-Francois Avon, Pierrefonds(Montreal) QC Canada DePompadour, Societe d'Importation Ltee Finest of Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing. PGP encryption keys at: http://w3.citenet.net/users/jf_avon http://bs.mit.edu:8001/pks-toplev.html ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C From jim at mentat.com Sun Oct 5 19:51:10 1997 From: jim at mentat.com (Jim Gillogly) Date: Mon, 6 Oct 1997 10:51:10 +0800 Subject: Trademarking CypherSpace??? Message-ID: <9710060243.AA04467@mentat.com> An AltaVista search for "cypherspace" pulls up a Tim May rant on The Coming Police State dated 9 Mar 1994 on the topic, so it's at least 3.5 yrs old. Good historical reading, by the way... dates back to the Clipper era. Don't you hate it when the pessimists are right all the time? Jim Gillogly From whgiii at invweb.net Sun Oct 5 19:57:24 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Mon, 6 Oct 1997 10:57:24 +0800 Subject: New PGP "Everything the FBI ever dreamed of" In-Reply-To: <3.0.3.32.19971005124929.03dfa15c@ctrl-alt-del.com> Message-ID: <199710060249.WAA15953@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <3.0.3.32.19971005124929.03dfa15c at ctrl-alt-del.com>, on 10/05/97 at 12, Alan said: >At 11:46 AM 10/5/97 -0500, William H. Geiger III wrote: >> >>-----BEGIN PGP SIGNED MESSAGE----- >> >>In , on 10/05/97 >> at 08, Tim May said: >> >>>Let's hope PGP, Inc. comes to their senses and stops doing the work of >>>Big Brother. >> >>This is really silly Tim, >> >>The ability to encrypt using multiple keys has been a feature of PGP since >>day one. All the Business Edition is doing is automating the process. >>Despite the flawed news reports on this matter (who would have guessed) >>their is nothing covert about it. The user is both informed that this is >>being done and there is a way for the user to disable it in the client. >I guess the real question is whether the messages/files generated just >add an extra key or if they leak the key through some harder to identify >method. >The current version of PGP no longer shows you the list of recipients, so >it is more difficult to determine if extra keys are added. >Is the method they are using for this new version to "escrow" the keys >obvious to the recipient or not? I *highly* doubt that they are doing anything other than adding an extra recipiant when encrypting. The code for doing so is already there and achives the objectives desired by their customers. Really no reason to do anything else from a programming or business prospective. I have not had a chance to obtain a copy of 5.5 and check it out so I don't know what info is being presented to the user. I don't run Win95/NT or MAC so it is unlikly that I will spend the $$$ for a copy. Perhaps someone running one of these inferior OS's could obtain a copy and investegate this aspect futher. :) Looking at the encrypted messages should revial wether or not extra keys are being added or not. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNDhTPY9Co1n+aLhhAQEI1QP9Fj3g1lC/WMiWxYCOJnyoCgniD+zb2Ksf bBWsMtflzQVSx7usOGProMxKcael8H9fHBxEuOJU+y2jlINDFAgXBCKHrErtlzfR uJ+NWGeR4ctx+qEJps0mlPcNp7cDzfX5A7bAiVnWb1G/n2R0y4+5sn1i1HkAs0sa u/5KZLVgPZg= =64ir -----END PGP SIGNATURE----- From jf_avon at citenet.net Sun Oct 5 20:06:55 1997 From: jf_avon at citenet.net (jf_avon at citenet.net) Date: Mon, 6 Oct 1997 11:06:55 +0800 Subject: New PGP "Everything the FBI ever dreamed of" In-Reply-To: Message-ID: <199710060219.WAA16101@cti06.citenet.net> > Date: Sat, 04 Oct 1997 03:35:12 -0500 > To: "George F. Mayhew" , > Robert Hettinga > From: Black Unicorn > Subject: Re:New PGP "Everything the FBI ever dreamed of" > At 10:58 PM 10/3/97 -0500, George F. Mayhew wrote: > >I think PGP, Inc. has seen the need for corporations to monitor their > >transactions at all levels, and responded with a simple, effective > >method that keeps the core applications from becoming compromised, and > >thus less secure. As a private user, this doesn't bother me in the > >least. > > You know, you're right. Transactions at all levels on corporate property > can put the corporation at risk. As a private user, this doesn't bother me > in the least either. I think a simple effective method to prevent > potential liability might be to put video cameras in the restrooms on > corporate facilities. God knows what silliness goes on in there which > might get the company in trouble. Mandatory drug tests? Absolutely. > Seems to me that this is essential. Can't have recreational drug users > hanging around can me. By the way, alchohol is considered a drug by the > company. We'll be screening for that starting Monday. AIDS carriers? We > need to know. Never know when this might cause the corporation > embarassment, or, god forbid, liability. What if the local CPR expert > didn't know that Bill had the HIV virus and tried to preform CPR? Can you > imagine the potential liability? God, what about something more > communicable like TB? No, can't have that. We need access to all our > employee's medical records. Absolutely. > God you frighten me. Unicorn, as usual, you twist words like nobody but you (and a zillions politicians) can. You forget the fact that the association between a company and an individual is voluntary. As long as all the tests and surveillance done by the company is known by the employee, it can do anything it wants. Only, you are also free to find another employer. And in the old days of paper correspondence, what prevented a company to give five years of a given employee's correspondence to the FBI? As a business owner, I wouldn't put cameras in the bathrooms, but I would certainly *require* that an encrypting software be decypherable by the top management. Encryption is an envelope. Sometimes, it is justified that management open suspicious enveloppes. As long as a behaviour doesn't impair work performance, there is no reason to pick on it. And personnally, I'd maybe keep somebody with impaired work capabilities but negociate a pay reduction instead of firing him/her. He is free to find work somewhere. This is *NOT* coercion. Your thing about the cops having access to info is an entirely different story. If the company doesn't have the balls or the strenght to resist bullish tactics, then, it is their problems. The employee should simply have evaluated earlier if the company would sell him out to the first spook and choose to work for somebody else. What you seemed to imply when you wrote that precisionless paragraph is that, in the end, key escrow by the owners of the company and computer system is dangerous. But to the company, not having the possibility to decrypt the data they *own* and are liable for is even more dangerous. The data generated on company's time and pay is property of the company. There is no coercion. Everybody is free to act, find another employee or keep him, find another job or keep it. Period. Ciao jfa P.S. For which one of three-letter organization do you work Unicorn? -- Jean-Francois Avon, Pierrefonds(Montreal) QC Canada DePompadour, Societe d'Importation Ltee Finest of Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing. PGP encryption keys at: http://w3.citenet.net/users/jf_avon http://bs.mit.edu:8001/pks-toplev.html ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C From attila at hun.org Sun Oct 5 20:11:10 1997 From: attila at hun.org (Attila T. Hun) Date: Mon, 6 Oct 1997 11:11:10 +0800 Subject: FOCUS [was Re: New PGP "Everything the FBI ever dreamed of"] In-Reply-To: Message-ID: <971005.203718@hun.org> -----BEGIN PGP SIGNED MESSAGE----- attila in --with both feet. starting with the premise that a corporation has a fundamental legal right to review all work and communications of any employee, and "acknowledging" that the employer is virtually required to maintain access to documentation to service the regulations of the government, the courts, and the LEAs, the issue is simply HOW? 1. I personally include my own public key in every encrypted message --if I consider the contents important enough to warrant encrypting, not just signing, I consider it important enough not to maintain a plaintext copy. 2. If I consider the contents more than just important -eg: critical, I use one of my unpublished public keys for the file copy. this version, including the encryption software and key library, are kept on a separate ZIP disk from the standard version ZIP disk. as a matter of reference, all temporary space is maintained on the ZIP drive. the major insecurity is the swap space which is maintained on a separate partition which is fully purged at boot time --which is not often enough. I have written secure swappers, or maybe I should say secure except for the transitory time the information may have been swapped out. this can be made further secure by preventing swap for the encryption engine if the system permits it, or even better, use semiconductor memory which leaves no magnetic media residuals to be analyzed 500 levels down by the Feds. From a mechanical standpoint there is no difference when you apply the same methods to the corporate environment. Again, the issue is HOW it is implemented. 1. if a corporate entity uses a single private-public keypair for each and every employee, that is their own stupidity as this is insecure, both internal and external. Too many hands on the private key. 2. ideally, each employee should be given a separate corporate public key. at the very least the key can represent a department or work group. 3. using the scenario in 2, specific projects can use a second corporate key which permits group leader management control. Therefore: Is this GAK? unfortunately, yes. By tolerating the use of unfortunately, yes. corporate GAK are we setting ourselves up to accept personal GAK? why? individuals will be desensitized to defending the absolute importance of maintaining our Constitutional rights, what few the Supreme Court has not yet denigrated. can we avoid this result? YES! GAK for businesses is a slam dunk, eg: if business has it, LEA, etc. can get it. desensitization can be minimized by pressuring professional associations to keep the issue of _personal_ privacy on the hot burner; this is the only issue. our mission must be to keep the fire out front so Americans will not stand for the total loss of privacy, etc. that F[reeh,uck] is hawking to our government; F[reeh,uck] sings the siren song of anti-terrorism, anti-anarchy, and all that good stuff government wants to suppress in violation of the Constitution. if the general public is fully aware of the implication, there is a chance to lead the rabble with the the chant: hell no, we wont dump our crypto! Now that the NYTimes has seen the light and is joining the battle against the forces of encryption denial, the mainstream press may make some effort in the cause, but we must keep the pressure on high. CDT, EPIC, and the rest of them are funded by business, big business, all of whom have a vested interest in selling product. they are the employers of the inside-the-beltway whores ...pardon me: lobbycritters; and they will compromise our individual rights in the corporate interests of the almighty dollar; in fact, corporate managers and beancounters will violate the privacy of their employees faster than the US spooks, both on and off the job --they have little if any concept of personal Constitutional privacy rights corporate officers are clueless on personal privacy. we face a two edged sword. if we encourage the expanded use of encryption in business, it will spread much more readily to the private sector --knowing full well the corporate users will be subjected to GAK. If business units are smart, they will implement the multi-target encryption and fight like hell against what F[reeh,uck] really wants: on-the-fly, real-time trapdoor cleartext --just like clipper. If F[reeh,uck] gets what he wants, why should he ask a court for approval to decrypt when he can already glean the information in the same way POTS taps are real time. if we rant and rave against the multi-public key encryption system, we risk facing the far more Draconian demands of F[reeh,uck]. The multi-public key system has been in use since the first time the ability to use multi-keys for multi-recipients was included. there is nothing we can do in the courts to prevent corporations processing encrypted mail through servers for verification, or even content scanning. business has this right --unfortunately, the government can compel the business to exercise this "right" and therefore government potentially does have real-time access. THE FOCUS: All efforts need to be directed to prevent the inclusion of master keys in hardware and/or software and the mandating of universal usage of the government system. there is little difference in what F[reeh,uck] is proposing and Clipper --and the same arguments can challenge F[reeh,uck] and friends. Let's not waste time hashing and rehashing business practices we have long since been forced to accept; and stay away from politics: FOCUS on our Constitutional rights. death is inevitable --an action we all face; some things are worth dying early defending --my personal privacy rights and the sanctity of my intellectual processes or whatever I wish to cogitate or regurgitate is one of them. For the masses: '54-40 OR FIGHT' or any number of us will die martyrs; STAND UP AND BE COUNTED; dont be government wimps, snitches, and shills like Hallam-Baker. attila on the way out ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDhTsb04kQrCC2kFAQGD0wP+JJ6GvszXDmBJcyTaGy9nbXSQb5y0kKUW NgZZHQDJlsVGdU4zPWl3HX7QClpjCBWEucWHiZa9BlyyMA55ngAYJiLv6+EzGZCi AuFYjJBbHin8krgauM/iy4Pj1aXZcIMorWEUYJsfRoHEWCtwPikrwCNCBqzj/N+6 3CpuA31WeeQ= =Cg9I -----END PGP SIGNATURE----- From shamrock at netcom.com Sun Oct 5 20:11:26 1997 From: shamrock at netcom.com (Lucky Green) Date: Mon, 6 Oct 1997 11:11:26 +0800 Subject: Unicorn an NSA agent? WAS: New PGP "Everything the FBI ever dre In-Reply-To: Message-ID: <3.0.2.32.19971005200455.00715690@netcom10.netcom.com> At 10:41 PM 10/5/97 -0500, jf_avon at citenet.net wrote: >Unicorn wrote: > >> borderline activity. It's hardly a settled point. That you are so quick >> to advocate corporate ownership of potentially private e-mail out of hand >> and without argument tells us much about your real position, Mr. >> Moscaritolo. Three words: "Expectation of Privacy." I missed the original post, but here are my $0.02. I encrypt all outgoing encrypted work email to my own key as well. I would be just as happy to encrypt it to the corporate key. If I was to send some private email from work, something that is not frowned upon at my place of employment, I would simply pre-encrypt it with just the key of the recipient. Meanwhile, I can understand the desire of a company to be able to read old outgoing email even after the employee quit or forgot their passphrase. After all, it might contain valuable information about details surrounding past negotiations with clients. Information that I would not want to be without. And PGP's Policy Enforcer has another side to it: have you ever forgotten to encrypt email that should have been encrypted? I have. With the Policy Enforcer installed, that can't happen. Which may well save big hassles in the future. All IMHO, of course. --Lucky Green PGP encrypted mail preferred. DES is dead! Please join in breaking RC5-56. http://rc5.distributed.net/ From unicorn at schloss.li Sun Oct 5 20:47:29 1997 From: unicorn at schloss.li (Black Unicorn) Date: Mon, 6 Oct 1997 11:47:29 +0800 Subject: Unicorn an NSA agent? WAS: New PGP "Everything the FBI ever dre In-Reply-To: Message-ID: <3.0.3.32.19971005224053.006b9b98@schloss.li> [I'm not on cypherpunks anymore, anyone there who wants to put me through the wringer without having to endure my response might not want to CC: me.] At 10:41 PM 10/5/97 -0500, jf_avon at citenet.net wrote: >Unicorn wrote: > >> borderline activity. It's hardly a settled point. That you are so quick >> to advocate corporate ownership of potentially private e-mail out of hand >> and without argument tells us much about your real position, Mr. >> Moscaritolo. Three words: "Expectation of Privacy." > >Unicorn, > >In that piece of knowledge smashing, just as you do in most >of your posts, you again mixed up things to make sure that everybody >end up knowing less than when they started. > >It is peoples like you that ended up with using Expectation of >Privacy out of it's rightfull context. Apart from various rulings of >various judges that probably smoked various herbs, can you please >tell me how anybody can rightfully expect privacy when everything >that permits them to exchange information is *owned* by somebody else >and that the use of this equipment is there *only* for the activities >of the owner of the equipment? Remember when the phone company used to lease you your phone? Surely that doesn't make the data that goes over the phone their property? If my doctor calls me at work with the results of a critical test, you believe that data is no longer private? I hope not. You think whatever goes on in a rental car I drive is the property of the rental company? That if some company rented the car they are entitled to read whatever papers I have in there? What about a hotel? A leased apartment? A restraunt back room? I challenge the "ownership gives the owner the right to all that occurs or is produced on or in the property" premise because it is just not a valid one, legally or (in my opinion) ethically. >If it weren't of the business, the >damn computer wouldn't be there. I know of many companies, consulting, law firms, accounting firms, in which employees own their own machines, laptops for example, or PDAs. Even where this is not the case, I still resist the premise that ownership of a computer translates to ownership of all the data thereon. I'm sure hackers would love it if they got title to all the data they download. Unfortunately for this position it just doesn't work that way, nor should it. I suppose ISPs could take the position that encrypted data on their systems must also be encrypted with the ISPs root key. Are you telling me you'd not have a problem with that because the ISP owns all the data on its systems? >And beside, the employee is not >paid to chat with friends, he's paid to work. If he doesn't want to >work, just fine, but not on the company's pay... Actually, most large modern firms I'm familiar with approve of and expect some degree of personal business to be transacted in the work place. Some even state this explicitly in their corporate policies and define the level of personal business that is appropriate. Never have I seen one which insists that no personal business of any kind is to be tolerated. I doubt such a firm would have a reasonable retention rate either. >Somehow, you basic premises always blows my mind. I think that you >are a *very* dangerous person. I think I might take that as a compliment coming from someone who advocates the kind of data ownership views that you seem to. I hope to be thought of as dangerous by those kind of entities. >I've been watching you for almost >three years over Cypherpunks and e$-etc and other forums. >Virtually *all* of your posts have this >blow-up-their-basic-premises-and-let-them-with-nothing-but-confusion >style. Blame law school. If my position on this issue makes me some kind of troublemaker, you better point the same finger at Schneier, who (if quoted accurately) shares my view. >Your style shows intelligence and skill in the way you do >it, which rules out idiocy on your part. So, clearly, you have >an agenda I do. Unimparied privacy for individuals in all contexts. Now tell me how PGP5.5 contributes to that cause, particularly in the current political climate. The timing looks extremely suspect to me. Challenging the premise that corporates own the flesh and mind of every employee within the walls of their facilities doesn't really strike me as something pro-estlablishment or bearing the hallmarks of some sinister plot, unless perhaps one is on a law-enforcement or far right corporate-facist spectrum. P2, the italian corporate-facist movement, held similar views after the second world war, so your ideas are not new. My view is, however, that this is the wrong way for the world to progress. If beliving that employees don't sell their souls to large corporations because they accept their paychecks is evil, call me evil. At the same time I beleve that companies don't tell their soul to a given government just because they do business on a given "soil." This strikes me as consistant. Perhaps you will disagree. >I cannot help but having the nagging feeling that you're on some >three-letter agency payroll because you have the uncanny habit of >disrupting and diverting some important discussion. If correcting legal errors, highlighting the flaws in basic premises and pointing out general gaps in logic, which is what I think I've been doing for the many years I've been poking around on c'punks an elsewhere, is disrupting and diverting, perhaps the "important discussions" are on the wrong tact. Glazing over the messy details of any policy, which seems to be what your "disrupting and diverting some important discussion" clause is advocating, is a rather sly tactic really. "If all these privacy extremists would just shut up about the details of our plan, we could get something done without diversion and distraction." Sound familiar? Always look at those calling for silence with suspicion. >I always wanted >to killfile you but always refrained to do so just to be able to read >the last finely crafted basic premises-smashing abomination. Actually, I don't even usually proofread my stuff. I'm pleased it gives you the impression of some fine craftsmanship, or bears the indications of some grand conspiracy, but in reality its off the top of my head. The consistancy you see is probably because I don't waiver in my principles when it comes to privacy. >So, again, which of the three-letter agency sends you a paycheck? Clearly, any answer I deliver to this question only harms me. I've seen this trick before. >Or are you doing is only for a secret decoration? What kind of decoration? Are you offering me one? (Aside from "Snide Asshole Lawyer of the Year" or something I mean). From netpecker at freemanchester.com Sun Oct 5 20:47:41 1997 From: netpecker at freemanchester.com (netpecker at freemanchester.com) Date: Mon, 6 Oct 1997 11:47:41 +0800 Subject: Internet Kiosk New Revenue For ISP Message-ID: <199710031854.OAA03281@eclipse.freemanchester.com> Attention Internet Service Provides. NetPecker Inc. is now making a limited time offering for distributors of following equipment NetPecker VM4100 a free standing Internet terminal / kiosk ideal for shopping malls, hotel lobbies, restaurants, etc. Advertise your Internet service and collect cash at the same time. Cash and informational terminal / kiosk now available. Purchase lease options. Retail starting price $4995.00. Benefits: New revenues, leverage your infrastructure, increased name recognition. For more information visit: http://www.netpecker.com or return e-mail: ispinfo at netpecker.com From dlv at bwalk.dm.com Sun Oct 5 21:31:46 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Mon, 6 Oct 1997 12:31:46 +0800 Subject: Stronghold In-Reply-To: <199710060047.BAA02975@server.test.net> Message-ID: <2mw5De1w165w@bwalk.dm.com> Adam Back writes: > Dimitri Vulis writes: > > > Where do people get these bizarre ideas? C2 didn't censor the list. A guy > > > who happened to work for C2 dropped some messages from one list. The > > > messages still went out on the unfiltered list. Had he worked for Mc > > > Donald's or the the NYC Sanitiation Department, would you blame them for > > > this as well? > > > > Lucky is lying: the censored articles were also filtered from the > > list which was billed as being unfiltered. > > There were 3 lists: > > cypherpunks-unedited (everything) > cypherpunks (moderated by Sandy) > cypherpunks-flames (the stuff Sandy rejected) > > At the time I was subscribed to cypherpunks and cypherpunks-flames in > the belief that this would result in getting everything, and save the > bandwidth of subscribing to all 3, but allow me to tell what was > rejected. > > I didn't see the censored post at all. This means at least that Sandy > didn't post it to either of cypherpunks or cypherpunks-flames. This > is consistent with his later admission that he considered Dimitri's > comments on Stronghold security as a conflict of interests for him to > post, as he was manually posting to both of those lists. > > Unfortunately I wasn't on cypherpunks-unedited at the time, but I > thought that it was immediate send out from toad.com without going via > Sandy. Going over my notes I see that at least one of my submissions - the one quoting the C2Net lawyer letter in its entirety - didn't appear even on cypherpunks-unedited. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From shiatan at workline.com Mon Oct 6 13:08:25 1997 From: shiatan at workline.com (shiatan at workline.com) Date: Mon, 6 Oct 1997 13:08:25 -0700 (PDT) Subject: No Subject Message-ID: <199710062008.NAA08058@toad.com> F R (remote destination) X - Start Received: by soi.hyperchat.com id 017b00 at Mon, 06 Oct 1997 13:59:36 -600 (Mountain Daylight Time) Message-ID: <34394257.1CF8 at workline.com> Date: Mon, 06 Oct 1997 15:56:07 -0400 From: shiatan X-Mailer: Mozilla 3.01 (Win95; I) MIME-Version: 1.0 To: cypherpunks at toad.com Subject: Re: Zip drive security... Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit I was wondering if anyone can comment on what type of encryption is used for the passwords on zip disks..i've been seperated from the literature that came with it, but i seem to remember reading that the actual password info is kept in the hardware? and i was just wondering how secure it was (before you encrypt the information on the disk with your own encryption methods).. thanks.. From snow at smoke.suba.com Sun Oct 5 22:18:47 1997 From: snow at smoke.suba.com (snow) Date: Mon, 6 Oct 1997 13:18:47 +0800 Subject: cyphernomincom In-Reply-To: <199709291520.LAA01295@borg.mindspring.com> Message-ID: <199710060504.AAA00426@smoke.suba.com> > > > Does anyone know where I can download a copy of the cyphernomicon. I > found a web page where I can read it, but I'd prefer one text file Are you truely that clueless? If so, I suggest you do a little reading on the nature of the medium before you delve into the cyphernomicon. If not, sit back and think about your question a minute or two. then if you still don't understand, go to (1). From snow at smoke.suba.com Sun Oct 5 22:31:51 1997 From: snow at smoke.suba.com (snow) Date: Mon, 6 Oct 1997 13:31:51 +0800 Subject: Stronghold In-Reply-To: <3437F884.414D@sk.sympatico.ca> Message-ID: <199710060526.AAA00484@smoke.suba.com> > (See if you can get us a group discount, because I have come to > believe that the 'moderation experiment' was a clever ruse to > weed out all of the 'sane' people from the Cypherpunks list.) > > Toto Didn't work. I'm still here occasionally. From nobody at REPLAY.COM Sun Oct 5 22:35:27 1997 From: nobody at REPLAY.COM (Anonymous) Date: Mon, 6 Oct 1997 13:35:27 +0800 Subject: Sameer Parekh and C2Net offer a $50,000 reward for the killing of Zionist Vulis Message-ID: <199710060508.HAA17524@basement.replay.com> Allah akbar! God is great! Sameer Parekh and C2Net have placed a $50,000 contract on the life of the miserable Zionist Dimitri Vulis residing at: 67-67 Burns St Forest Hills, NY 11375 U.S. of A. Sameer Parekh is the official supplier of cryprographic software to the Palestine Liberation Organization and Hamas. Death to the Zionist aggressors! Death to Vulis! God is great! From frantz at netcom.com Sun Oct 5 22:35:38 1997 From: frantz at netcom.com (Bill Frantz) Date: Mon, 6 Oct 1997 13:35:38 +0800 Subject: New PGP "Everything the FBI ever dreamed of" In-Reply-To: Message-ID: At 9:52 AM -0700 10/3/97, Robert Hettinga wrote: >Comments? > >From: Martin Minow >"The new version also includes some of the most sophisticated techniques >for enforcing this policy through the corporation. The most novel may be a >new version of software controlling a company's SMTP server, the machine >that acts as the central mailroom for a corporation. PGP provides a >software agent that will read all of the mail to make sure that it complies >with the corporate policy. This may include requiring all messages to be >signed with digital signatures or include a backdoor that the management >can use to read the message. If the software agent discovers a message >violates the policy, it can either return it to sender or simply log a copy. I wonder if it can handle the following: (1) Encrypt real message (e.g. use PGP or Entrust). (1a) Strip the headers. (2) UUEncode the message. (3) Encrypt the message with the corporate system including CAK. (4) Send it thru the SMTP server. ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz at netcom.com | nation it is today. | Los Gatos, CA 95032, USA From nobody at REPLAY.COM Sun Oct 5 22:42:04 1997 From: nobody at REPLAY.COM (Anonymous) Date: Mon, 6 Oct 1997 13:42:04 +0800 Subject: Sameer Parekh and C2Net offer a $50,000 reward for the killing of Zionist Vulis Message-ID: <199710060535.HAA19940@basement.replay.com> Anonymous wrote: > Allah akbar! God is great! Sameer Parekh and C2Net have placed a $50,000 > contract on the life of the miserable Zionist Dimitri Vulis residing at: > 67-67 Burns St > Forest Hills, NY 11375 > U.S. of A. > Sameer Parekh is the official supplier of cryprographic software to the > Palestine Liberation Organization and Hamas. This would explain the "Infidel Inside!" sticker on the Stronghold software packaging. > Death to the Zionist aggressors! Death to Vulis! God is great! From frantz at netcom.com Sun Oct 5 23:21:24 1997 From: frantz at netcom.com (Bill Frantz) Date: Mon, 6 Oct 1997 14:21:24 +0800 Subject: Stronghold (fwd) In-Reply-To: <199710051735.MAA00824@einstein.ssz.com> Message-ID: At 10:35 AM -0700 10/5/97, Jim Choate wrote: >Forwarded message: > >> Date: Sun, 5 Oct 1997 18:46:14 +0200 (MET DST) >> Subject: Re: Stronghold >> From: nobody at REPLAY.COM (Anonymous) > >> It is becoming increasingly obvious that John Young is the real >> troublemaker here. I wouldn't doubt that it was John who was >> behind the original troubles between Vulis and Sameer. >> I think that John Young should be forcefully unsubscribed from >> the Cypherpunks mailing lists. > >You sir are an unmittigated ass and more than a tad immature and selfish. > >I will not forcefully unsubscribe anyone from the SSZ node unless cops start >showing up at my door giving me shit, in which case the node might go down >(hopefully temporarily). I may not like what he did but I'll be damned if >I'll go back on my beliefs in free speech just because you or I don't like >it. You want freedom, learn to give it even when it hurts. > >Grow up and learn to deal with it. Relax Jim. It's just evidence that Dimitri has learned to use remailers. ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz at netcom.com | nation it is today. | Los Gatos, CA 95032, USA From vin at shore.net Sun Oct 5 23:22:00 1997 From: vin at shore.net (Vin McLellan) Date: Mon, 6 Oct 1997 14:22:00 +0800 Subject: New PGP "Everything the FBI ever dreamed of" In-Reply-To: Message-ID: >An article in today's (Fri, Oct 3) New York Times (CyberTimes) ... >describes the new release of "PGP for Business Security 5.5," which >contains mechanisms that incorporate key recovery mechanism that can >either be volontary or be enforced by using PGP's software for controlling >a company's SMTP server -- the server can verify that all encrypted >messages include the corporate public key (or conform to other corporate >policies): Alex Le Heux noted: |> Keep in mind that this is the 'PGP for Business'. Companies often |>operate on the principle that email that's sent and received from |>their machines is the company's, not the employee's. This is actually |>reasonable business practice. Specially when encryption enters the |>picture. The employee could walk under a bus, and leave some vital |>but encrypted emails in his mailbox. This could be a real problem for |>corporations. William H. Geiger III brushed aside PGP Inc's critics to complain: >>This has been discussed before on this list and others, and few have >>disagreed, that a company has a legitimate need to be able to access its >>encrypted data. If employees want to send love letters or whatnot then >>they should not be doing it on company time using company resources. >> >>If a corporation wishes to establish a company policy that all >>correspondence be encrypted with the companies master key it is their >>right to do so and IMNSHO it would be foolhardy for them to do otherwise. >> >>Claiming that they are doing the work of Big Brother is a cheap-shot and >>uncalled for. With respect, Gentlemen, I think you are missing the point. There is no corporate demand for a key-recovery mechanism which allows Management immediate real-time access to all encrypted electronic communications. This new PGP facility is analogous to key-escrow or key-recovery for session keys; in essence, it's a backdoor to the session. Here in the US, FBI Director Louis Freeh has been pointed in his comments about the distinction between key-recovery for stored data and key-recovery for transient electronic communications. Key-recovery for encrypted stored data, Freeh noted, serves a sensible and pragmatic business need. Corporations will do it because it's a necessary part of their Disaster Planning. But, as Freeh noted several times in Congressional testimony, there are few if any business requirements for surreptitious, real-time, access to online communications, so businesses (unless forced by legislation, argued Freeh) simply won't do it. It is police agencies, not Management, which seek real-time access to all encrypted e-mail. No one but the Govt wants it. Management, at least in the US, doesn't need this sort of evidentiary data. Management has an employee who can be required to keep a copy of all business e-mail for Management review; or required to cc his or her boss on all e-mail to a customer -- or even forbidden to use e-mail for anything other than business mail cced to the boss. And, of course, the employee can be fired if he/she doesn't comply. But the truth is: Managment doesn't need the aggravation and -- while the standard of managment oversight is more lenient, at least for professional staff -- no company can keep talented employees if it treats them this way. Surreptitious universal access to an employee's encrypted e-mail _is_ like sound and video pickups in the bathrooms. Vastly intrustive; humilating; diminishing. Far more intrustive than is useful or necessary for conventional management needs. It is the work of Big Brother, sadly. GAK-enabled PGP, plain and simple! As Director Freeh noted, it's only LEAs who need and want this. The likely early victims of such a draconian oversight will probably be the long-suffering US government employees. With no evidence to support my supposition, I'll bet the GAKed-crypto strategists are once again offering the federal workforce as the sacrificial lambs, as they did with Fortezza. Trying (again!) to use the bulk federal purchasing power to establish a defacto product standard. Watch over the next six months. I think they used the new -- "post-Fortezza," pre-PKI -- prospect of huge '98-'99 federal purchases of COTS crypto for non-classified DoD and civilian agency e-mail to lure Mr. Zimmerman, major stockholder, into swallowing the words of Feckless Phil, the wild and wooly free-crypto rebel. Anyone wanna wager that this "design option" evolved concurrent with a quiet MOU-structured review of the New Improved PGP by the X Organization at Ft. Meade? Nor, I fear, will this be the last enhanced cryptographic communications app to come out of vendors active in the NSA's new Commercial Liaison initiative. Big federal market. Big lure. Hard not to give the Customer what he wants. Still, it's sad. (I, btw, am moderating a panel on the "Prospects for Government Control of the Internet" at the NSA/NIST-sponsored NISSC in Baltimore this week. Among my panelists are David Herson, the top pro-GAK policy maven for the European Commission; Tom Black of Smith System Engineering, the network specialists commissioned by the European Parlament to figure out how to enforce content regulation; Patricia Edfors, the Chair of the federal PKI Steering Committee and the Security Champion on GITS; Dave Farber of UPenn, the Internet Society, and EFF; and Danny Weitzner of CDT. Powerful and articulate voices from all sides of the Question. Thoughtful and non-obvious suggestions for questions to the Panel would be welcome -- to the List or in private e-mail. TIA.) _Vin Vin McLellan + The Privacy Guild + 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548 -- <@><@> -- From nobody at REPLAY.COM Sun Oct 5 23:23:47 1997 From: nobody at REPLAY.COM (Anonymous) Date: Mon, 6 Oct 1997 14:23:47 +0800 Subject: Transmission Management Message-ID: <199710060618.IAA23949@basement.replay.com> -----BEGIN PGP SIGNED MESSAGE----- Lucky Green wrote: >And PGP's Policy Enforcer has another side to it: have you ever >forgotten to encrypt email that should have been encrypted? I >have. With the Policy Enforcer installed, that can't happen. Which >may well save big hassles in the future. (This feature is independent of the GAK aspects of the product.) It's probably a good idea to set up your mailer so that it discourages transmission of unencrypted mail. This could be as simple as a sequence of questions: "Do you want to do this?", "Do you really want to do this?", and "Are you absolutely one hundred percent sure that it is a good idea to put this message on tape at Fort Meade for eternity?" But, you could make more amusing warnings. For example, the mailer could convert your message into a front page article for the New York Times and show you what it will look like. Agencies which handle encrypted communications typically track every message sent. We should do the same thing. Most people probably do this in an informal way, but really slick tools for doing this would have their uses. This is especially true when managing an identity. Not only would it be nice to track every transmission in a nice easy to assess way, but also track exactly how it was transmitted, the precise time of transmission, and the remailers used to deliver it. This raw information would be neat to have, but it wouldn't get really useful without an analysis tool. For instance, you could see how much your identity depends on the security of certain remailers. If you use one remailer in your chains a lot, you might want to have something which warns you that you are becoming overly dependent on that remailer. Or, you might want to run "what if" scenarios to see if you would be vulnerable if a particular set of remailers were compromised. If the analysis tool were really good, it would hunt for weaknesses based on known remailer attacks. And, naturally, for proper identity management it would be important to keep a running score for the odds that each identity were compromised and by which threats. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDh0V5aWtjSmRH/5AQFyFwf+OhIbig7B/njU1yTlDdIuBHs3jpYyH6Ol /+Cjk9X2MbFkYGec3vm8muf1alGI/8ZH+NV73cXry1rN8FqdIY/eoJX5OoRhTQpa ajQFNnSaufbY2xgx45o7S+jFCFGaasInjsvl7q78iH8JL2seXgG3t7HNsK/SZOqD lZynyUqCaVssiSTkDHiZx72TUPJbhUCOvkoKdiy5evQlN7PPyKNmajB9INbzin7z qKqfyyHyFR+Gu618IojassyZ9wuEzbjMStTRMf8TGOo8yJWaH0+W7KX9JHVF3Zdv EjINSw7EBxMAOk83AY9YP0nuLJnwaEoloKifX6D+MmQ+Jx9Js2ocuA== =HUZ7 -----END PGP SIGNATURE----- From anon at anon.efga.org Sun Oct 5 23:48:07 1997 From: anon at anon.efga.org (Anonymous) Date: Mon, 6 Oct 1997 14:48:07 +0800 Subject: Unicorn an NSA agent? WAS: New PGP "Everything the FBI ever dre Message-ID: <6c75e10930c5232799155573a91e46a5@anon.efga.org> -----BEGIN PGP SIGNED MESSAGE----- Black Unicorn wrote: >Remember when the phone company used to lease you your phone? Surely >that doesn't make the data that goes over the phone their property? >If my doctor calls me at work with the results of a critical test, >you believe that data is no longer private? I hope not. You think >whatever goes on in a rental car I drive is the property of the >rental company? That if some company rented the car they are >entitled to read whatever papers I have in there? What about a >hotel? A leased apartment? A restraunt back room? I challenge the >"ownership gives the owner the right to all that occurs or is >produced on or in the property" premise because it is just not a >valid one, legally or (in my opinion) ethically. Mr. Avon is talking about agreements, I believe, although he is using the private property approach to argue that there is certainly a meeting of the minds between the two parties. It seems reasonable that employees may agree to give up their rights, for example their inalienable right to stay at home and watch TV, in exchange for employment. When the employment agreement is at will, as most are, it seems reasonable that the company may change it whenever it pleases: "If you wish to continue working here, you will have to let the company read your mail." This is complicated by the bizarre legal environment which employers face in the United States. In practice one would have difficulty terminating an employee by changing the "at will" agreement. More generally, it seems a good guess that Mr. Avon would not object to an agreement with a company in which the company was able to continuously monitor the employees communications or activities. (This is why the private property approach can confuse people: this is not the core issue.) >[I'm not on cypherpunks anymore, anyone there who wants to put me >through the wringer without having to endure my response might not >want to CC: me.] Guess you miss out, then. ;-) Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDh325aWtjSmRH/5AQFfWwf/RfjQ38YvvqNAxkcSTWKhFM09fySjgCvG PlSrimP30jC/dWHAH3iZavS5fn8LE+rfHSHBy5UZyE6xyuyAsJHpMYXDjoQ7gMau vKWHCPCKoxNoi/UNFJ6FQXAEy3o+nBp1pRVupOr/gGFaegCd0tglEyzxCEiFguOf utUGX2X7C5wK2Lwhe+lVJqqlvzkwLXt9UKYzanJc8LZmlAjmcmrPySXC+KSnvfve YHGGqD6+jxxqNxqRVpvCpO4JeJ8O+95O3oCxrOKg7b5SwtOo21qnxkBkFNGyuTq9 YGzQJs/0Ha8Gr9Vk+QiT5CjUAdw+N/uahaPkNWjf1f4SztKpz3y0ZA== =FlvU -----END PGP SIGNATURE----- From bd1011 at hotmail.com Sun Oct 5 23:49:01 1997 From: bd1011 at hotmail.com (Nobuki Nakatuji) Date: Mon, 6 Oct 1997 14:49:01 +0800 Subject: MISTY encryption Message-ID: <19971006062932.19153.qmail@hotmail.com> MISTY Misty is a cryptographic algorithm developed by Mitsubishi Electric after they broke DES in 1994.It is designed to withstand linear and differential cryptanalysis, but has not yet been cryptanalysed. As it has not undergoneintensive peer review, the usual caution is recommended. It is being considered for inclusion into the SET 2.0 standard. http://www.mach5.com/crypto/algorithms.html ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com From tm at dev.null Sun Oct 5 23:49:41 1997 From: tm at dev.null (TruthMonger) Date: Mon, 6 Oct 1997 14:49:41 +0800 Subject: Moderation Revisionism (Try to forget!) Message-ID: <3438874B.18F1@dev.null> Those who are so quick to act as apologists for the C2Nut blitzkreig on the anarchistic freedom of the CypherPunks list forget that by the end of the 'moderation experiment,' the mailing list had lost an estimated 6 million Jewish subscribers. It is likely that we would have lost even more, had it not been for the valiant efforts of Dimitri Vulis to warn us about murdering Armenian bastards in our midst. When the Johnboot of Fascism descended on the CypherPunks mailing list, the evil Dr. Sandfort was given free reign to do bizarre experiments with twin mailing lists, severing parts of toad.com's electronic brain into seperate sections, and producing a mutant clone which was passed off as the original entity. Unfortunately, the Electronic DNA of the mutant strain of the list was not stable, and began to disintegrate, resulting in a denigration of the mutant list body to the point where parts of its electronic body began to become corrupted, even falling completely off, at times. After the nuking of toad.com and Nagasaki, the list CypherSpace was divided up among the winners, with the Eastern Block under control of Comrade Chewd-Off, the Western Block was apparently liberated under the flag of InfoNex (although their ties to the C2Nut secret government remain in place), and Texas, as always, remained a seperate CypherPunk nation just south of Intel, with Commander in Chief Choate launching a bandwidth race to keep ahead of the Eastern Block. Currently there are calls for crypto disarmament coming from the peace-loving folks in DC, in the interests of making the world a safer place, but they are meeting resistance from crypto-guerillas who refuse to recognize that the war is over and it is time for us to ask, "Why can't we all just get along (a long toilet plunger and shove it up somebody's ass)." DigiCash remained neutral during the moderation experiment and denies that they are in possession of large sums of eca$h left with them for safekeeping by the missing Jewish members of the mailing list. There have been rumors that many of the leaders of the attack on the CypherPunks list escaped to Anguilla, a small island in the Caribbean, where they plotted an even greater conspiracy to take over all of cryptography by seizing control of the financial cryptography arena, but Herr Hettinga claims that it was simply a meeting of the Bavarian Illuminati. He denies any claim that there were closed meetings in which a secret alliance was formed with the Japanese, but recent activity by Jochi Ito has led many to suspect that this is indeed the case. In my private meetings with the remaining members of the CypherPunks mailing lists, each of them confirmed that they are members of one three-letter organization or another, although most of them continue to deny it in public. Kent Crispin and Phillip Hallam-Baker asked me to please not blow their 'covers,' so I will not comment on them directly. I hope that this clears things up for everybody. Now just try to forget all about it. RevisionMonger From anon at anon.efga.org Mon Oct 6 00:19:57 1997 From: anon at anon.efga.org (Anonymous) Date: Mon, 6 Oct 1997 15:19:57 +0800 Subject: Unicorn an NSA agent? WAS: New PGP "Everything the FBI ever dre Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Lucky Green wrote: >Meanwhile, I can understand the desire of a company to be able to >read old outgoing email even after the employee quit or forgot their >passphrase. After all, it might contain valuable information about >details surrounding past negotiations with clients. Information that >I would not want to be without. I have never seen or even heard of an instance where it was necessary to go through an employee's electronic mail. Has anybody else ever witnessed such a situation? While we can construct hypothetical circumstances, in practice the need for this feature is rare. What, then, are some sources of the (alleged) demand? 1. PGP is preparing to compromise with The Great Satan, and to have a viable company after The Fall. 2. Secure software is becoming perceived as naughty. Given the insecure legal and regulatory environment in which companies operate, a perception as a naughty company can be expensive. 2.1 Drug testing is an example of similar behavior. In practice, few companies implement an effective drug testing program. External image, then, is the likely motivation. 3. Many companies have a corporate culture of dominance over their employees. This is yet another way of expressing their perceived position. (Perceived, that is, by the employees and the employers, but not perhaps by outsiders.) 3.1 Common drug testing techniques have sado-sexual overtones. 4. Companies may not wish to have their right to read employee mail challenged. (Were employees to commonly protect their mail from employers, the common practice could, in time, be transformed into a right, regardless of contractual agreements.) Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDhuUZaWtjSmRH/5AQFflAf5AWr65whT2ZM9yzaHxs5lX9ViocBCqr6A O+1FG/2xPzk+o4hf9zeXMTThyKu+iQ5NgcCWd+ocRRPwIsIB3TJuAmxBJ2tgLISZ dqtgDkEyXmoD4Mq+ALpNy0wcJ0Z/q1LUhZErm6gGOPGhkVeVTn8Gscj+qDHJPu2M ji8/9v8pjYRKe1BsS8ZJlirNwMdC5Use6Ig/Z3uOHmEcnMh+jeZmbAyLcGupNzd9 hjh/q7hThyEIN7v5mJVjg16oXJ0ryN1SkbIvnMimx8b8dYs47z5C5HaUZYX2CZDc XicfmAv5w+Y87dE7HQh9hKmOH36c2Ajfw0hdbQTxWWkFmPys6hDdvQ== =cJtj -----END PGP SIGNATURE----- From Joel at savetrees.com Mon Oct 6 15:42:59 1997 From: Joel at savetrees.com (Joel at savetrees.com) Date: Mon, 6 Oct 1997 15:42:59 -0700 (PDT) Subject: Grand Opening. 30% Off! Message-ID: <> Our research indicates that you may be interested in this information. If this assumption is incorrect, please reply with "REMOVE" in the subject line. You will get no further mailings from us. We apologize for inconveniencing you. **************************************************************************** Announcing the Grand Opening of ========================= HighDesert General Merchandise ========================= We are striving to make this a 1-stop source for gift giving. You'll find gifts and collectibles for every member of the family. Hand Spun Glass, Solid Brass, Jewelry, Wood Carvings, Crystal, Tools, Luggage Christmas collectibles, Doll House Miniatures, Toys and much more! We plan to add over 4000 items soon! All at unbelievable prices. To celebrate our Grand Opening, we've marked down prices by 30% throughout the store! Be sure to also check out our Grand Opening 50% Off Specials! Perfect for Xmas gift giving. Use our Secured Shopping Cart Server to make shopping a point & click breeze. Major credit cards accepted, as well as money orders and checks. Visit us at Weber's Mall: http://webersmall.com/desert.htm We look forward to your visit. From Joel at savetrees.com Mon Oct 6 15:42:59 1997 From: Joel at savetrees.com (Joel at savetrees.com) Date: Mon, 6 Oct 1997 15:42:59 -0700 (PDT) Subject: Grand Opening. 30% Off! Message-ID: <> Our research indicates that you may be interested in this information. If this assumption is incorrect, please reply with "REMOVE" in the subject line. You will get no further mailings from us. We apologize for inconveniencing you. **************************************************************************** Announcing the Grand Opening of ========================= HighDesert General Merchandise ========================= We are striving to make this a 1-stop source for gift giving. You'll find gifts and collectibles for every member of the family. Hand Spun Glass, Solid Brass, Jewelry, Wood Carvings, Crystal, Tools, Luggage Christmas collectibles, Doll House Miniatures, Toys and much more! We plan to add over 4000 items soon! All at unbelievable prices. To celebrate our Grand Opening, we've marked down prices by 30% throughout the store! Be sure to also check out our Grand Opening 50% Off Specials! Perfect for Xmas gift giving. Use our Secured Shopping Cart Server to make shopping a point & click breeze. Major credit cards accepted, as well as money orders and checks. Visit us at Weber's Mall: http://webersmall.com/desert.htm We look forward to your visit. From aba at dcs.ex.ac.uk Mon Oct 6 01:08:02 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Mon, 6 Oct 1997 16:08:02 +0800 Subject: Secure phone In-Reply-To: <199710032326.QAA19691@comsec.com> Message-ID: <199710060125.CAA03034@server.test.net> Eric Blossom writes: > >Each party reads off a series of digits displayed on their screen. Out > >loud. To each other. Over the secure phone. > > > >The MITM attacker can't duplicate the hash on both ends, because a hash of > >the public keys used to make the connection are different between the > >MITM's public key and the real public keys. > > In addition, to keep life even more interesting, prior to exchanging > the public exponentials g^x and g^y, commitments (hashes) to those > values are exchanged... If the commitments don't match the final > values, the protocol terminates. I can't see that this prevents MITM either. Eve, the attacker, just sends commitments to the values she would have sent in performing the MITM were there no commitments. Still falls back to a belief that a well resourced attacker can't splice audio in real time. Say (for example) if someone smuggled me one of your phones, and I called up Tim. The only protection I'd have is recognizing Tim's voice after hearing him speak breifly years ago. (American accents sound similar to me). On the other hand, using persistent key public key crypto, Tim has been signing his posts recently, and I have an ancient public key of his stashed away which his new key is signed with. If we were able to construct a protocol to bolt on top of the reading of hashes, we could have much greater protection against MITM. To answer the other poster who opined that you had no business saying things to people who's voices you don't recognize: nonsense. We're saying things all the time to people who's voices we've _never_ heard with PGP. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710060836.JAA00816@server.test.net> Dimitri Vulis writes: > Adam Back writes: > > Unfortunately I wasn't on cypherpunks-unedited at the time, but I > > thought that it was immediate send out from toad.com without going via > > Sandy. > > Going over my notes I see that at least one of my submissions - the > one quoting the C2Net lawyer letter in its entirety - didn't appear > even on cypherpunks-unedited. I think I saw this claim made before around the time of the "moderation experiment". The only ways I can see that this could have happened are either that: i) John Gilmore started editing cypherpunks-unedited at Sandy/C2net's request ii) cypherpunks-unedited was edited all along by someone (John or Sandy) i) is sort of feasible, perhaps there are others who were on unedited and were counting who could confirm this. Toto I think was. ii) is hard to believe because the fact that something is edited shows -- when the editor is sleeping you get lag. I'm fairly sure I didn't see the C2 legal letter you posted yesterday before. Can anyone else can confirm? Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710060817.JAA00800@server.test.net> Aldius writes: > The reason for having two key types for PGP5 is that DH is only capable > of key distribution, not signing. DH is an interactive key negotiation protocol. El Gamal is the key exchange algorithm used in PGP5. For some reason PGP Inc insists on calling El Gamal "DH". El Gamal is a variant of DH; so it is related. But El Gamal is not DH, and it is bad terminology to call it DH. The only reason I can think that they insist on calling El Gamal "DH" at every opportunity is that they perhaps think that the name DH (Diffie-Hellman) is more widely known, and want to give people warm fuzzies "oh I've heard of that algorithm". > and DSS is only capable of signing. Hence, you require one key to > sign, and one to distribute the session key. right. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Thanks to Adam Back and Ross Anderson the full Zergo Report on encryption use by the NHSnet is online at: http://www.dcs.ex.ac.uk/~aba/ukcrypto/zergo.html (139K) There may be action by HMG to prohibit publication in the UK (and maybe elsewhere) so we've mirrored it at: http://jya.com/zergo-aba.htm Other mirrors encouraged. From nobody at REPLAY.COM Mon Oct 6 05:03:18 1997 From: nobody at REPLAY.COM (Anonymous) Date: Mon, 6 Oct 1997 20:03:18 +0800 Subject: C2Net offers Vulis $100,000 for not talking about Stronghold Message-ID: <199710061154.NAA24615@basement.replay.com> Sameer Parekh called Dmitry Vulis on the phone today and offered him $100,000 if Vulis promises not to publicize the security flows that Vulis has found in Stronghold, C2Net's only remaining product. From andy at CCMSD.chem.uga.edu Mon Oct 6 06:33:51 1997 From: andy at CCMSD.chem.uga.edu (Andy Dustman) Date: Mon, 6 Oct 1997 21:33:51 +0800 Subject: Risks of using usually-reliable information sources in your programs In-Reply-To: <3.0.3.32.19971005191732.00688c2c@popd.ix.netcom.com> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On Sun, 5 Oct 1997, Bill Stewart wrote: > to pick the more reliable remailers based on "Raph"'s statistics, > so adding records for very reliable bogus remailers is a win. Incidentally, I think the patches I have for premail would probably reduce the effects of an attack like this. It adds a reliability-threshold and latency-threshold. Any remailer more reliable than the reliability-threshold (recommended: 99.5%) is treated as if the uptime was 100%. Latencies lower than the latency threshold are treated as zero. On a good day, this means there are several remailers which will score exactly the same before the shuffling factor is added. The four spook remailers listed would all score the same as squirrel and bureau42, which have latencies exceeding 3 hrs: recovery remailer at biglouie.fbi.gov ############ 0:01 99.99% @ payswell remailer at digicrime.com ############ 0:01 99.99% @ trustme trustme at trustme.nsa.mil ************ 0:59 99.99% @ mulder mulder at juno.com #*#*##*#*#*# 0:57 99.98% @ cracker remailer at anon.efga.org +*+*+***++*+ 15:42 99.99% @ nym config at nym.alias.net **#**###**** :39 99.99% jam remailer at cypherpunks.ca +*++*++++++* 22:24 99.98% @ redneck config at anon.efga.org ############ :37 99.98% privacy remailer at privacynb.ml.org #*#***** 1:47 99.98% @ neva remailer at neva.org --+*-+**+**- 1:15:36 99.97% @ mix mixmaster at remail.obscura.com + -********* 40:27 99.83% @ winsock winsock at rigel.cyberpass.net -------..+- 9:45:21 99.79% % squirrel mix at squirrel.owl.de ------+--+- 3:04:59 99.74% @ bureau42 remailer at bureau42.ml.org ----------- 3:09:39 99.53% @ reno middleman at cyberpass.net +* * + +++* 30:42 99.44% # replay remailer at replay.com **** * *** 4:01 99.00% # hera goddesshera at juno.com ---- .------ 5:18:04 97.77% htuttle h_tuttle at juno.com ---- - ----+ 3:02:37 97.49% # arrid arrid at juno.com - - -.-- 9:23:33 81.91% tea tea at notatla.demon.co.uk - 19:27:50 1.92% @ = all score identically (not counting other bonuses from various config flags), 100% uptime, 0 latency % = 100% uptime # = 0 latency See http://anon.efga.org/anon/premail.efga.patch. This is not why I came up with the patch. Originally I came up with the reliability-threshold when I was running as a middleman and wanted to make sure I was picking good remailers. I find that for chaining, chain lengths of 1 and 2 tend to be somewhat slower on average than with standard premail. However, longer chains tend to be significantly faster and even more reliable. Check out http://anon.efga.org/anon/remailer-chains.html and look at the distribution of remailers selected in chains, and compare my random chain stats against Raph's. (I have a couple of remailers he doesn't, AFAIK.) > The security would be improved if Raph signed the weekly file, > but that also requires people using the file to check it with PGP > and not just grep out the relevant lines for their programs' use. Agreed, but the danger from attack like this lies with automatic chaining programs, where the user may not even be aware of what remailers are on the list, or what remailers were chosen. A PGP-signed version would improve things, particular if a special signing key is used, and that key is stored in a separate keyring. This PGP-version may have to be available separately from the regular remailer list to avoid confusing chaining programs. I'll see if I can whip up a PGP-signed version of the EFGA remailer list by the end of the day. Andy Dustman / Computational Center for Molecular Structure and Design / UGA To get my PGP public key, send me mail with subject "send file key". For the ultimate anti-spam procmail recipe, send me mail with subject "spam" "Encryption is too important to leave to the government." -- Bruce Schneier http://www.athens.net/~dustman mailto:andy at CCMSD.chem.uga.edu <}+++< -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQEPAwUBNDjmWxOPBZTHLz8dAQGjaAfPY9KOWVqyi6egyZqAxt+SOCCeWmfWTxvr UUqWdT4NcdwH52jJnlflLsUZr6c2TtgGoYkXrltH+rzhTNWWGfTSuQgyshuNNRfP Lk6W/y8bsaroFrFccME5vq4M+L9izQekosf+e1muu4X9tJKk5ksCS5bfOQaVLQum ueouSvQOc3dmn4J64R5Wih6iMOrsYusqIj30Dz3SZFjOCbNb7VC66WdF/GafHItw RJiRVZnOsT0igtqTe25ywO097fiGhwld4L2rOGjsLUag4vqbjaf+5NCGl3Dshq0C fcmSPfYXGAvk3/ZxjSjQ2VE1OAEPvde4MiQrTj9PdvFflA== =Xz3V -----END PGP SIGNATURE----- From raph at CS.Berkeley.EDU Mon Oct 6 07:01:14 1997 From: raph at CS.Berkeley.EDU (Raph Levien) Date: Mon, 6 Oct 1997 22:01:14 +0800 Subject: List of reliable remailers Message-ID: <199710061350.GAA03910@kiwi.cs.berkeley.edu> I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list at kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys at kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list at kiwi.cs.berkeley.edu. $remailer{'cyber'} = ' alpha pgp'; $remailer{"mix"} = " cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = " cpunk mix pgp hash latent cut post ek"; $remailer{"jam"} = " cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = " cpunk pgp pgponly hash cut ksub reord ?"; $remailer{'nym'} = ' newnym pgp'; $remailer{"squirrel"} = " cpunk mix pgp pgponly hash latent cut ek"; $remailer{'weasel'} = ' newnym pgp'; $remailer{"reno"} = " cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"cracker"} = " cpunk mix remix pgp hash ksub esub latent cut ek reord post"; $remailer{'redneck'} = ' newnym pgp'; $remailer{"bureau42"} = " cpunk mix pgp ksub hash latent cut ek"; $remailer{"neva"} = " cpunk pgp pgponly hash cut ksub ?"; $remailer{"lcs"} = " mix"; $remailer{"medusa"} = " mix middle" $remailer{"McCain"} = " mix middle"; $remailer{"valdeez"} = " cpunk pgp pgponly hash ek"; $remailer{"arrid"} = " cpunk pgp pgponly hash ek"; $remailer{"hera"} = " cpunk pgp pgponly hash ek"; $remailer{"htuttle"} = " cpunk pgp hash latent cut post ek"; catalyst at netcom.com is _not_ a remailer. lmccarth at ducie.cs.umass.edu is _not_ a remailer. usura at replay.com is _not_ a remailer. remailer at crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix reno winsock) (weasel squirrel medusa) (cracker redneck) (nym lcs) (valdeez arrid hera) The remailer list here has been out of date for some time, but should be up to date now. I'm still working on updating the web page. Last update: Mon 6 Oct 97 6:46:39 PDT remailer email address history latency uptime ----------------------------------------------------------------------- nym config at nym.alias.net ##*+#*#**### :42 99.99% redneck config at anon.efga.org *###+***##** 1:33 99.98% cracker remailer at anon.efga.org ++++++**++*+ 17:20 99.97% cyber alias at alias.cyberpass.net ++******+++* 11:30 99.96% jam remailer at cypherpunks.ca ++***++++++* 22:36 99.89% winsock winsock at rigel.cyberpass.net -.-----..-- 9:58:11 99.68% mix mixmaster at remail.obscura.com + -***+++++* 52:53 99.65% replay remailer at replay.com ** * ****** 3:36 99.57% squirrel mix at squirrel.owl.de ----------- 3:06:27 99.44% neva remailer at neva.org --**-***+ + 1:15:50 99.17% reno middleman at cyberpass.net - + ++++ * 36:51 98.65% hera goddesshera at juno.com ---- ------- 4:34:09 97.76% bureau42 remailer at bureau42.ml.org --- ------- 3:15:49 97.49% arrid arrid at juno.com - . ---- 10:06:05 79.88% valdeez valdeez at juno.com 4:58:22 -16.56% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien From trei at process.com Mon Oct 6 07:04:56 1997 From: trei at process.com (Peter Trei) Date: Mon, 6 Oct 1997 22:04:56 +0800 Subject: russia_1.html Message-ID: <199710061350.GAA06107@toad.com> > From: Harka > US Sees No KGB Role in Russia's Nuclear Arms > > WASHINGTON (Reuter) - The United States Friday rejected the claim of a > Russian scientist that Moscow had secretly developed nuclear "suitcase > bombs" under KGB orders in the 1970s specifically for terrorist > purposes. > >[...] > > Testifying before Congress Thursday, Alexei Yablokov, a respected > scientist who served on the Russian National Security Council, > contradicted statements by Russian officials denying the existence of > the weapons and buttressed claims that many of them have gone missing. > > "I am absolutely sure that they have been made," he told the House > Military Research and Development subcommittee. > > The issue arose when former Russian National Security Adviser Alexandr > Lebed alleged that up to 100 portable suitcase-sized bombs were > unaccounted for since the 1991 breakup of the Soviet Union. > > According to Lebed, who has agreed to testify before the House > committee later this month, the devices have an explosive capacity of > one kiloton -- the equivalent of 1,000 tons of TNT -- can be activated > by a single person and could kill as many as 100,000 people. > > Yablokov said he had spoken to the scientists who worked on the > weapons and so was certain of their existence. [...] I saw part of this on CSPAN. Yablokov made one point that I felt was interesting. These devices were made during the Cold War period, and it's extremely unlikely that any could have been made since the Soviet Union fell apart. The plutonium cores of thermonuclear devices have a limited shelf life - he claimed 6 years, which jibes with what I've heard from other open sources. Fission products build up in the cores which can poison a chain reaction. Thus all Pu based devices need to have the cores periodically removed and replaced with new ones, while the old ones have to go through a non-trivial reprocessing stage to remove the fission products. Thus, a nuke left on the shelf eventually turns into a dud. The time since the Soviet Union fell (which is the upper limit of the last time these particular 'suitcases' could plausibly have been repacked) is long enough ago that they are now either duds or becoming unreliable (I don't know if the degredation results in gradually decreasing yield, or if one day they simply don't work). Of course, even contaminated Pu in the hands of a terrorist (or a State) is a disquieting notion. Peter Trei trei at Process.com From aba at dcs.ex.ac.uk Mon Oct 6 07:08:05 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Mon, 6 Oct 1997 22:08:05 +0800 Subject: New PGP "Everything the FBI ever dreamed of" In-Reply-To: Message-ID: <199710061355.OAA01789@server.test.net> Tim May writes: > I agree that an employer has a "right" to read employee mail, sent on > company time with company resources. > > However, a program which facillitates this has no business being called > "Pretty Good Privacy." As Phil notes, it goes against the whole spirit of > PGP. It's surveillance, pure and simple. > > Further, while businesses have every right to monitor their workers (Hey, > I'm not saying I _like_ this, just that the alternative of banning such > monitoring would be abusive to a property owner's rights), we should not be > _encouraging_ the spread of such technologies. Especially given the very > real risk that wide deployment of "Business PGP" could present. I agree with Tim's point that we should not be encouraging businesses to use GAK technologies for Corporate access to keys. Your "choice" not to work for a company which uses software like pgp5.5 is likely to become ever more limited if corporates adopt this type of policy. They will be conditioned to expect this. Governments will of course encourage corporates to use such software. I'd prefer to see an "off-the-record" option: a personal comment option, with non-transferable signatures, and no GAK; this would give the user the option to have the mail as an official company statement, by clicking "official company business" button, and an option for unofficial, or "not an official statement" button, which are more akin to phone conversations which are typically not recorded. Personal comments are in any case probably in the companies interests not to have transferable proof of authorship attached to. Many email comments are sent with a few seconds thought, a sort of too and fro banter between employees, some of whom have business company contacts who are also personal friends, etc. Actually for maximal non-transferability all "not an official statement" email should be sent via mixmaster remailers, otherwise mail logs etc, may give some material which could be used as proof of authorship. This set up seems less troublesome than pgp's offering with pgp5.5. I reckon it's more sensible to archive "official company business" communications in the normal way. Compose the message in a word processor, archive that, or build in an archive mechanism into the MUA/mail encryption system which encrypts to a storage system. Communications encryption keys should be transient, otherwise you are opening your self up to the less often considered form of key escrow: your company or you are presented with a court order for your keys. Or the Feds burgle your offices and install keyboard sniffer. If they're interested in you they will already have hoovered up your past email with cooperation of your leased line providor. I really think people are asking for trouble not using forward secrecy for secured email. The attacker can archive all your encrypted email, and then decrypt at his leisure if he is able to compromise your key at a later date. Also I seem to remember that Tim, or perhaps someone else, reported that PRZ stated at a recent cpunks meeting that he would quit PGP Inc if they went for a GAK option. Well Phill? Getting pretty close ain't it? Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <3438F030.5B94@nutscrape.cum> Anonymous wrote: > Sameer Parekh called Dmitry Vulis on the phone today and offered him > $100,000 if Vulis promises not to publicize the security flows that > Vulis has found in Stronghold, C2Net's only remaining product. I bid $ 125,00.00 for exclusive rights to the information. Not that it is ethical to do so, but this message looks like a forgery, so there is no reason that it should reflect on me, eh? (<--see, like Toto says--check the headers, too.) But if someone *did* think it was from me, then they would know who to contact by private, encrypted email (before Thursday, when I'm going out of town), eh? (<-- see, I told you!) Maybe Tom Weinstein (maybe not) From 99507504 at 32517.com Mon Oct 6 22:25:54 1997 From: 99507504 at 32517.com (99507504 at 32517.com) Date: Mon, 6 Oct 1997 22:25:54 -0700 (PDT) Subject: "Discount Classified Newspaper ADS.....as low as $1 per paper" Message-ID: <199218919914.fbb09046@aol.com>



UTILIZE THIS VALUABLE INFORMATION AND IT WILL PAY FOR ITSELF MANY TIMES OVER!

That tiny little ad can make you wealthy!

Have you ever bought anything from a classified ad?  If you're like most, the 
answer is yes.  

It's a fact of life, that we as a society crave the need for information. The 
tiny little classified ad can effectively and efficiently deliver the 
information to a potential customer base that is mind boggling.  

A simple classified ad can fill your mailbox with orders or make your phone 
ring off the hook with interested prospects.  

Have you ever seen the same ad running over and over again in a paper?  It's 
because it's making money.  In fact the chances are good that it's in a whole 
lot of other papers also. 

Classified ads can and have made many people very wealthy.  How do you think 
all those late night info-mercial millionaires started?


***Nationwide Newspapers V2.0 TM***

Powerful New Reference Software

-  The First of its Kind, Classified Advertising Tool!

-  Electronic Directory of over 3,600 newspapers!

-  Sources for Over 6,000 newspapers!

-  Daily, Weekly, Shoppers, Community Papers and More!

-  Find Hard to Reach People to Respond to Your Offer!

-  Advertise by City, State, Regionally, or Nationwide!

-  Statewide and Network Advertising, Including Pricing!

-  Discount Advertising Less Than $1 Per Paper!

-  Powerful Tool for Building Huge Downlines!

-  Save Time and Money with Network Advertising, 1 Call, 
   1 Payment & you're in 100's of Papers with Millions 
   of Readers, at a Big Discount Over Individual Rates!

SPECIAL FEATURE-  Built in Sort Tool Enables Sorts by State, City, 
Circulation, Phone Number & More!

Proof is in the Results! Here's just a few:

" Thank you for your 3,600+ newspaper directory! We have built a downline of 
1,800 people in 6 months & a check for over $12,000 using this directory to 
advertise! It contains the small town papers as well as the big ones so we can 
target the audience & stretch our advertising dollar. I recommend it for 
anyone in network marketing."    			
						
            	S & J Linden, Sequim, WA

" I just wanted to let you know how much your program has saved me time and 
energy, now I can place ads with ease. I think your program is simply one that 
anyone who has a  business must have, because time is money."
						
      	Andrea Hurst-Harry, Arlington, TX


There is no doubt that this information can and will be a valuable asset 
to your business. It's the perfect product, at the perfect time, at the 
perfect price.  We've seen similar information costing 100's of dollars.  
Companies charge these high fees because they know that people who understand 
the value of the information will easily pay for it. Our products are more 
advanced and we make them affordable. They say that information is power, well 
we look forward to supplying you with all the power you need for years to 
come!


Price: 

Other companies marketing half the information we offer are charging $249

 For a limited time , You pay only $59  plus shipping for this revolutionary new product.   

To Order Send to:

Strawberry Press 732.744.9633
518-7 Old Post Rd Suite 211
Edison, NJ 08817

***Please Add $6 for shipping and handling

	Name:_________________________________________

	Address:______________________________________EMail Address___________________________

	City:_____________________State:____Zip:______

	Payment Method: 
			    __CHECK __MONEY ORDER

	

     

	Total Enclosed: $_79 + 6  =$85 _____________



  









From jeffb at issl.atl.hp.com  Mon Oct  6 07:33:43 1997
From: jeffb at issl.atl.hp.com (Jeff Barber)
Date: Mon, 6 Oct 1997 22:33:43 +0800
Subject: Stronghold 1/2
In-Reply-To: <6e32De9w165w@bwalk.dm.com>
Message-ID: <199710061516.LAA19565@jafar.issl.atl.hp.com>



Dr.Dimitri Vulis KOTM writes:

> "Moderation" is a misnomer. C2Net engaged in outright fraud by providing
> a list which C2Net claimed would contain the articles rejected by the
> C2Net moderator, then censoring articles from both the censored and the
> uncensored lists. At least one of my articles (not the one about Stronghold;
> the one quoting the threatening letter from C2net's lawyers) didn't make
> it even to the "unedited" list.

As has been pointed out before, "C2Net" never "provided a list" (at 
least not one relevant to this discussion).  Since it is clear you are
fully aware of that, this is sufficient to "prove" to most of us the
charge of "liar" against you (ignoring the several hundred other 
examples that might come to mind from the last couple of years).
I don't particularly care about this except that it reinforces why
your credibility is so low here.


> Jeff Barber  wrote:
   [quoting Dimitri:]
> >> Lucky is lying: the censored articles were also filtered from the list which
> >> was billed as being unfiltered.
> >
> >This is revisionist history.  I can't recall any intimation at the
> >time that any messages were filtered from the unfiltered list.
> 
> If you can't recall, I'm quoting a bunch of stuff below. At least one of
> my articles, the one quoting the threatening letter from C2net's lawyers,
> didn't make it even to the "unedited" list.

Since obviously none of us who were on the -unedited list can say for 
sure whether we received everything sent to it, I can't say with 
certainty this never happened.  But....
This is the problem with being known as a liar.  Nobody is inclined to
believe what you say without substantitation.  So I still don't see any
reason to believe that anything was "censored" from the unedited list.


> C2Net's shill called me a liar about a dozen times, yet hasn't presented any
> evidence of me ever lying. On the other hand, C2net's claim that I'm a closet
> homosexual is an outright lie, typical of Sameer Parekh and his employees.

I don't recall ever seeing such a claim from Sameer or anyone else at
C2Net.  Though given your penchant for making such "accusations" 
yourself, one could understand the impulse for making such a claim.

The fact that *you* are constantly accusing people you don't
apparently know of engaging in various sexual acts or holding a certain
sexual orientation is evidence enough that you are unreliable.  It
seems to be your stance that you are free to fabricate anything the
truth of which cannot be utterly *disproven*.  This is consistent with
your allegations against C2Net's product as well as the allegations of 
sexual acts and preferences you habitually make.

Whether you like them or not, this is why libel laws and such exist.
If you accuse someone of having backdoors in their product, but cannot
or will not show any basis for the allegation, it's perfectly
understandable that they might threaten you legally.  And if you're
simply "throwing rocks" at Sameer with no substance behind your
allegations, the rest of us are unlikely to come to your "defense".
Also, here's a little hint (from a non-lawyer): truth is generally a
very good defense to a libel suit.  You may squirm and dance and claim
you don't want to deal with the hassle or expense of a suit, but we
all know precisely what that really means...


-- Jeff






From bob17 at bigfoot.com  Mon Oct  6 07:41:39 1997
From: bob17 at bigfoot.com (bob17 at bigfoot.com)
Date: Mon, 6 Oct 1997 22:41:39 +0800
Subject: The rumors ARE true
Message-ID: <199710060925.e-mail@Sue M.com>




Hi 



If you follow business journals you may have heard about a new  phone 
company that has patent pending technology that will revolutionize   
the the way we communicate.

They are using technology that allows us to use our existing phones 
in a manner similar to the the way we communicate on the internet 
now.  This is causing the long distance rates to tumble to low prices 
that have been unheard of  before this.

What's more this new technology will eventually allow us to offer an 
unlimited usage low flat rate plan as well as being able to have up 
to 8 phones, computers or fax machines all working off of one phone 
line at the same time.  All this without having to purchase any new 
phones or equipment.

This technology is so advanced that the Richard Marriott family of 
Marriot Hotels has invested 74 Million Dollars in the company for 
just a 38% interest in the company. 

If you would like more information on the service or business opportunity
with this new company just send an e-mail to" mailto:bob17 at bigfoot.com" 
with the words"the rumors are true" and I will send you information 
right away.

Sincerely,
Bob

phone    (847) 462-1937
e-mail   mailto:bob17 at bigfoot.com







From tm at dev.null  Mon Oct  6 07:44:53 1997
From: tm at dev.null (TruthMonger)
Date: Mon, 6 Oct 1997 22:44:53 +0800
Subject: The Right to Work for Nobody / Re: New PGP "Everything the FBI ever dreamed of"
In-Reply-To: <199710061355.OAA01789@server.test.net>
Message-ID: <3438F7E2.7BAE@dev.null>



Adam Back wrote:
> Tim May  writes:
> > I agree that an employer has a "right" to read employee mail, sent on
> > company time with company resources.
...
> > Further, while businesses have every right to monitor their workers (Hey,
> > I'm not saying I _like_ this, just that the alternative of banning such
> > monitoring would be abusive to a property owner's rights)...

I hate to inject too strong a note of reality into arguments that I
would like to agree wholeheartedly with, but I believe that there has
been so much thievery of both property and rights (individual and
corporate) that it is extremely difficult to make a strong case for
any pure argument any more.
First, the federal government gives a business confiscated land to
support a failing industry, the state gives them huge tax breaks
to move from elsewhere, the city does the same, while taxing you
even more to support the grand growth schemes that the mayor and
council members are getting rich on, and then the company announces
that you can 'choose' not to work there if you don't like their
rules.

> Your "choice" not to work for a company which uses software like
> pgp5.5 is likely to become ever more limited if corporates adopt this
> type of policy.  They will be conditioned to expect this.  Governments
> will of course encourage corporates to use such software.

In Canada, one could 'choose' not to work for Safeway Stores, but the
chain would come into a community and undersell everyone until the
locals were run out of business, then raise prices dramatically.
In theory, you could choose to *not* work for Safeway, but in reality,
there was no one else left *to* choose to work for in the grocery 
business.

TruthMonger






From nospam-seesignature at ceddec.com  Mon Oct  6 07:53:51 1997
From: nospam-seesignature at ceddec.com (nospam-seesignature at ceddec.com)
Date: Mon, 6 Oct 1997 22:53:51 +0800
Subject: The Child Molester Prevention and Effective Sentencing Act
In-Reply-To: 
Message-ID: <97Oct6.103925edt.32260@brickwall.ceddec.com>



On Fri, 26 Sep 1997, Declan McCullagh wrote:

> 
> The problem with all the current bills like original SAFE and ProCODE is
> that they're too wimpy, abstract, arcane. Who cares about protecting
> business? Nobody, at least not when you'll be dubbed soft on crime. So
> what's the one thing everyone cares about and wants to protect?
> 
> Yes, that's right: CHILDREN!!!! I think someone should introduce a bill
> called "The Child Molester Prevention and Effective Sentencing Act of
> 1997."
> 
> The summary: "To reduce crime, protect our children, and secure our private
> communications from child molesters, pedophiles, and various perverts, this
> bill would spur the development of privacy-enhancing technologies by
> removing all export controls on encryption products."
> 
> Who would ever vote against the CMPA? Who wants to be soft on child
> molesters and random perverts? Not even Louis Freeh could successfully
> oppose this one...
> 
> -Declan
> 
> (Okay, okay. It's a Friday. Time for me to go home...)

I remember one of the NET moderators asked why they should use encryption.

What if you want to send a message to your child saying you will be late
after school.  What is to prevent a pedophile from forging such a message?
And if a pedophile intercepts such a message, couldn't he arrive 5 minutes
early saying that "dad changed his plans again and sent me...".

Now, Rep. Tauzin wants to make it illegal to listen in to any "private" 
radio communication (yes listen, not just repeat), since Gingrich couldn't
have access to encrypted communication and someone listened in on his cell
phone.  One law prevents security from being available, so they think that
a second law will prevent people from listening in.

Repealing a law preventing fences is more effective than adding a
draconian penalty for tresspass. 

--- reply to tzeruch - at - ceddec - dot - com ---






From rah at shipwright.com  Mon Oct  6 08:07:56 1997
From: rah at shipwright.com (Robert Hettinga)
Date: Mon, 6 Oct 1997 23:07:56 +0800
Subject: New Zealand  encryption rolled by Microsoft
Message-ID: 




--- begin forwarded text


From: "Blair Anderson" 
To: "dcsb at ai.mit.edu" 
Date: Mon, 06 Oct 97 10:07:45 +1300
Priority: Normal
MIME-Version: 1.0
Subject: New Zealand  encryption rolled by Microsoft
Sender: bounce-dcsb at ai.mit.edu
Precedence: bulk
Reply-To: "Blair Anderson" 

New Zealand  encryption rolled by Microsoft..

Despite adopting a succesfull crypto protocol ex Switzerland, Microsoft
has been succesful in "converting" the local banks to its "built in"
scheme..

details at..  http://www.aardvark.co.nz/n296.htm

Cheers,



Blair Anderson  (Blair at technologist.com)

International Consultant in Electronic Commerce,
Encryption and Electronic Rights Management

   "Techno Junk and Grey Matter"  (HTTP://WWW.ISDN.NOW.CO.NZ)
   50 Wainoni Road, Christchurch, New Zealand

          phone 64 3 3894065
          fax     64 3 3894065

Member 	Digital Commerce Society of Boston

---------------------------- Caught in the Net for 25 years
----------------------------



For help on using this list (especially unsubscribing), send a message to
"dcsb-request at ai.mit.edu" with one line of text: "help".

--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/
Ask me about FC98 in Anguilla!: 







From rah at shipwright.com  Mon Oct  6 08:14:35 1997
From: rah at shipwright.com (Robert Hettinga)
Date: Mon, 6 Oct 1997 23:14:35 +0800
Subject: Trademarking CypherSpace???
In-Reply-To: <3.0.3.32.19971005185236.00688c68@popd.ix.netcom.com>
Message-ID: 



cypherspace.com has been held by an artist in Santa Fe for a long time...

Cheers,
Bob Hettinga

-----------------
Robert Hettinga (rah at shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/
Ask me about FC98 in Anguilla!: 







From mm at apple.byte  Mon Oct  6 08:15:15 1997
From: mm at apple.byte (Martin Minow)
Date: Mon, 6 Oct 1997 23:15:15 +0800
Subject: $ 150,000 / Re: C2Net offers Vulis $100,000 for not talking about Stronghold
In-Reply-To: <199710061154.NAA24615@basement.replay.com>
Message-ID: <3438FBB7.138C@apple.byte>



Tom Weinstein wrote:
> 
> Anonymous wrote:
> > Sameer Parekh called Dmitry Vulis on the phone today and offered him
> > $100,000 if Vulis promises not to publicize the security flows that
> > Vulis has found in Stronghold, C2Net's only remaining product.
> 
> I bid $ 125,00.00 for exclusive rights to the information.
> 
> Not that it is ethical to do so, but this message looks like a forgery,
> so there is no reason that it should reflect on me, eh? (<--see, like
> Toto says--check the headers, too.)
> But if someone *did* think it was from me, then they would know who
> to contact by private, encrypted email (before Thursday, when I'm
> going out of town), eh? (<-- see, I told you!)
> 
> Maybe Tom Weinstein (maybe not)

This is also an obvious forgery, but if it weren't, then I bet that
I would offer $ 150,000.00 for exclusive rights to the information.

Anyone gullible enough to think this isn't a forgery could contact
me by private, encrypted email at my *real* address, below.

Martin Minow
minow at apple.com






From PLEASE.READ.ME at aol.com  Mon Oct  6 23:47:34 1997
From: PLEASE.READ.ME at aol.com (PLEASE.READ.ME at aol.com)
Date: Mon, 6 Oct 1997 23:47:34 -0700 (PDT)
Subject: LION, TIGERS, COUGARS
Message-ID: <>


                                  Turpentine Creek Foundation, Inc.
                  Route 1 Box 209A, Eureka Springs, Arkansas 72632
                          Phone: (501) 253-5841 Fax: (501) 253-5059
                                       E-mail:tigers at ozarkweb.com
October, 1997

Dear Friend,

The reason I am writing this letter to ask for your help.  First,  I would like to
introduce myself and give you a brief history of Turpentine Creek Wildlife
Refuge, a non-profit organization.  I will try to briefly describe our accomp-
lishments and our mission for the future.

My name is Hilda Jackson.  I am the Secretary-Treasurer of Turpentine Creek 
Foundation.  By the way, when I say "WE",  I am speaking not only of myself, 
but for all the volunteer staff and our eight member board of directors.  Our 
Board consists of doctors, real estate people, a university professor, a CPA 
and a veterinarian, who have worked hard to accomplish our goals.  Our 
Chairman of the Board is Reverend John P. Minogue, C.M., who is also 
President of De Paul University of Chicago, Illinois.

The Turpentine Creek Foundation was started by me, my husband Don 
Jackson, and my daughter, Tanya Smith, in May of 1992.  Tanya is now  
President of the Foundation.  We purchased a 450-acre ranch in Eureka 
Springs,  Arkansas in the heart of the beautiful Ozark Mountains.  We brought
with us to the ranch two lions, one monkey, one white-tailed deer and one
racoon.  That was the beginning of Turpentine Creek Wildlife Refuge.  Our
goal and desires are to house all unwanted exotic big cats, such as lions,
tigers, and other exotic animals in a safe an happy environment.  To date, 
Turpentine Creek houses over 120 animals and birds.  Out of this 120 animals,
there are 90 + exotic big cats, such as lions. tiger, leopards and cougars.

We know from the experts' predictions that there are no more than 4,000 tigers
left in this world.  Without a shelter like Turpentine Creek, I am afraid that the 
beauty and the strengh of the tigers will not be a part of our children's or 
grandchildren's life except in picture books.  With everyone's help this will not 
happen.

We have continued to grow every year due to the birth of new cubs, and the 
acquisition of additional unwanted, abandoned, or abused exotic animals. We
desperately need to expand our compound, and finish the natural habitat, so the
big cats can live and roam as naturally as they would in the wild.

It takes approximately $1000 per day to house and care for the current number of
animals.  These funds are partly raised by our seasonal tourist revenue.

All construction is strictly funded by donations.  This is where we need
YOUR help.  If you can donate  $1, $5, $10, or whatever you feel in your heart you
can send, it wil be greatly appreciated.  All donations are tax deductible under 
IRS regulations section 501(c)(3).

We would like to thank you in advance for any consideration or help you
can give.  

Please come visit us and see the photo albums (especially the NEW 
ARRIVALS) at:    http://www.ozarkweb.com/tcreek/index.htm


My sincere thanks,

Hilda Jackson

Please send your kind donations to :     Turpentine Creek Wildlife Refuge
                                                             Route 1, Box 209-A
                                                             Eureka Springs, Arkansas  72632    

Credit Card Donations can be made by phone or fax (top of page) or complete
the following information and mail to the above address.

Card type:  ____ Visa  ____ MasterCard  ____ American Express  ____ Discover

Card Member's Name :_____________________________________________

Member's Address:     ______________________________________________

Card Number :            ______________________________________________

Expiration Date:          ______________________________________________

Amount of Contribution :  $ _____________






From PLEASE.READ.ME at aol.com  Mon Oct  6 23:47:34 1997
From: PLEASE.READ.ME at aol.com (PLEASE.READ.ME at aol.com)
Date: Mon, 6 Oct 1997 23:47:34 -0700 (PDT)
Subject: LION, TIGERS, COUGARS
Message-ID: <>


                                  Turpentine Creek Foundation, Inc.
                  Route 1 Box 209A, Eureka Springs, Arkansas 72632
                          Phone: (501) 253-5841 Fax: (501) 253-5059
                                       E-mail:tigers at ozarkweb.com
October, 1997

Dear Friend,

The reason I am writing this letter to ask for your help.  First,  I would like to
introduce myself and give you a brief history of Turpentine Creek Wildlife
Refuge, a non-profit organization.  I will try to briefly describe our accomp-
lishments and our mission for the future.

My name is Hilda Jackson.  I am the Secretary-Treasurer of Turpentine Creek 
Foundation.  By the way, when I say "WE",  I am speaking not only of myself, 
but for all the volunteer staff and our eight member board of directors.  Our 
Board consists of doctors, real estate people, a university professor, a CPA 
and a veterinarian, who have worked hard to accomplish our goals.  Our 
Chairman of the Board is Reverend John P. Minogue, C.M., who is also 
President of De Paul University of Chicago, Illinois.

The Turpentine Creek Foundation was started by me, my husband Don 
Jackson, and my daughter, Tanya Smith, in May of 1992.  Tanya is now  
President of the Foundation.  We purchased a 450-acre ranch in Eureka 
Springs,  Arkansas in the heart of the beautiful Ozark Mountains.  We brought
with us to the ranch two lions, one monkey, one white-tailed deer and one
racoon.  That was the beginning of Turpentine Creek Wildlife Refuge.  Our
goal and desires are to house all unwanted exotic big cats, such as lions,
tigers, and other exotic animals in a safe an happy environment.  To date, 
Turpentine Creek houses over 120 animals and birds.  Out of this 120 animals,
there are 90 + exotic big cats, such as lions. tiger, leopards and cougars.

We know from the experts' predictions that there are no more than 4,000 tigers
left in this world.  Without a shelter like Turpentine Creek, I am afraid that the 
beauty and the strengh of the tigers will not be a part of our children's or 
grandchildren's life except in picture books.  With everyone's help this will not 
happen.

We have continued to grow every year due to the birth of new cubs, and the 
acquisition of additional unwanted, abandoned, or abused exotic animals. We
desperately need to expand our compound, and finish the natural habitat, so the
big cats can live and roam as naturally as they would in the wild.

It takes approximately $1000 per day to house and care for the current number of
animals.  These funds are partly raised by our seasonal tourist revenue.

All construction is strictly funded by donations.  This is where we need
YOUR help.  If you can donate  $1, $5, $10, or whatever you feel in your heart you
can send, it wil be greatly appreciated.  All donations are tax deductible under 
IRS regulations section 501(c)(3).

We would like to thank you in advance for any consideration or help you
can give.  

Please come visit us and see the photo albums (especially the NEW 
ARRIVALS) at:    http://www.ozarkweb.com/tcreek/index.htm


My sincere thanks,

Hilda Jackson

Please send your kind donations to :     Turpentine Creek Wildlife Refuge
                                                             Route 1, Box 209-A
                                                             Eureka Springs, Arkansas  72632    

Credit Card Donations can be made by phone or fax (top of page) or complete
the following information and mail to the above address.

Card type:  ____ Visa  ____ MasterCard  ____ American Express  ____ Discover

Card Member's Name :_____________________________________________

Member's Address:     ______________________________________________

Card Number :            ______________________________________________

Expiration Date:          ______________________________________________

Amount of Contribution :  $ _____________






From dlv at bwalk.dm.com  Mon Oct  6 09:03:41 1997
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Tue, 7 Oct 1997 00:03:41 +0800
Subject: Gestapo wants to police the Internet
Message-ID: 



US Calls for Internet Funds Police
By Jane Martinson
Financial Times: Friday, October 3, 1997

A US securities regulator called yesterday for international
co-operation on policing the sale of cross-border mutual funds on the
internet.

Douglas Scheidt, assistant director in the investment management
division at the Securities and Exchange Commission, said: "Securities
regulators around the world should work together to find an approach,
and to find it relatively soon to satisfy the needs of everyone
concerned."

Fund managers, particularly in the US, are increasingly using the
internet to market their products to investors around the world. This
causes policing problems when potential customers in other countries are
not covered by regulatory agreements. Regulations surrounding the
cross-border sale of products are still vague.

Mr Scheidt outlined his preferred approach to the issue at a meeting of
the Federation Europeenne des Fonds et Societes d'Investissement, a body
of leading European fund managers, in London yesterday.

This approach would insist on the fund management group clearly stating
the citizens it is allowed to sell to on its home page. Mr Scheidt
suggested simple wording to the effect that only US investors were able
to purchase US mutual funds, for example.

This "disclaimer" would be combined with a demand on managers to screen
out possible purchases from unauthorised countries.

Mr Scheidt advocated a "flexible approach" which recognised that fund
managers could be misled on the country of potential investors but
insisted on proof that they had done everything possible to cut down on
sales to citizens in unauthorised countries.

A solution could be the use of gateways or passwords making it harder
for potential investors to find information about a mutual fund. Mr
Scheidt said the main drawback was the cost.

He also discounted what he described as the "regulator's dream approach"
of insisting on the "facts and circumstances" of every transaction.

He felt that one of the most important virtues of these approaches was
that they did not require any legal changes to enable the internet to be
used as a marketing tool.

He said his department was also keen to look at how fund managers
marketed their products generally to potential clients on the internet.
Changes to products must be sent separately via e-mail or the post.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps






From cp at dev.null  Mon Oct  6 09:17:23 1997
From: cp at dev.null (CypherPisser)
Date: Tue, 7 Oct 1997 00:17:23 +0800
Subject: 18" (WAS: Re: Stronghold 1/2)
In-Reply-To: <199710061516.LAA19565@jafar.issl.atl.hp.com>
Message-ID: <34390B46.4261@dev.null>



Jeff Barber wrote: 
> Dr.Dimitri Vulis KOTM writes:
> > "Moderation" is a misnomer. C2Net engaged in outright fraud by providing
> > a list which C2Net claimed would contain the articles rejected by the
> > C2Net moderator, then censoring articles from both the censored and the
> > uncensored lists. At least one of my articles (not the one about Stronghold;
> > the one quoting the threatening letter from C2net's lawyers) didn't make
> > it even to the "unedited" list.

> this is sufficient to "prove" to most of us the
> charge of "liar" against you (ignoring the several hundred other
> examples that might come to mind from the last couple of years).

  Lies, like Beauty and Cocksize, are in the aye's of the beholders.

> I don't particularly care about this except that it reinforces why
> your credibility is so low here.
 
  The last bid I saw on the list was $ 150,000.00.

> > Jeff Barber  wrote:
>    [quoting Dimitri:]
> > >> Lucky is lying: the censored articles were also filtered from the list which
> > >> was billed as being unfiltered.
> > >
> > >This is revisionist history.  I can't recall any intimation at the
> > >time that any messages were filtered from the unfiltered list.

  Gee, then you must have been one of the list members who were so busy
pissing on anyone that disagreed with your position that you paid no
attention to things you didn't want to see, and managed to block out
the posts which flatly contradicted what you wanted to believe.

  Me? Well, I just pissed on everyone in sight, and had a jolly good
time doing it, but I also subscribed to all three lists at one point
or another, and I read the message headers of most of the posts to
the list both before, during and after the moderation experiment.
{or censorship attack, depending on the angle you were pissing from}

> > If you can't recall, I'm quoting a bunch of stuff below. At least one of
> > my articles, the one quoting the threatening letter from C2net's lawyers,
> > didn't make it even to the "unedited" list.
> 
> Since obviously none of us who were on the -unedited list can say for
> sure whether we received everything sent to it, I can't say with
> certainty this never happened.  But....

  Yes we can...
  Unless you were on a CypherPunks mailing list in a parallel universe
(not to be discounted, since some very strange things went on during
that period of time), there were more than a few posts between Sandy
and the list/list-members in which he spoke openly about the posts 
which he shitcanned, his (faulty) reasoning behind it, and a variety of
other troubling 'rules and regulations' in which 'flameless' posts which
made reference to 'flaming' posts, even if not quoting the 'offensive'
part (such as 'bad boy!), became 'flames-by-association.'
  In the end, Sandy was drawing more Crayola lines between the list
members than the CypherPunks conspiracy-theory maniacs. {The major
difference being that Sandy was using the 'new' colors, which everyone
knows are part of the worldwide plot by the underground reptilian 
Nazis.}

> The fact that *you* are constantly accusing people you don't
> apparently know of engaging in various sexual acts or holding a certain
> sexual orientation is evidence enough that you are unreliable.  It
> seems to be your stance that you are free to fabricate anything the
> truth of which cannot be utterly *disproven*.

  Been there, done that, stole the T-shirt, and got out of Dodge without
getting killed or caught. (Although there are still rumors of Tim May
"headed North.")
  As they say in Texas (or should), "Even a bad shot is right 50% of the
time--if he uses a shotgun."
  Read the News of the Weird, sometime. It uses only 'real' facts from
the 'respectable' media and they still manage to paint a much more
bizarre picture of reality than even the looniest of CypherPunks.

> And if you're
> simply "throwing rocks" at Sameer with no substance behind your
> allegations, the rest of us are unlikely to come to your "defense".

  Who died and made *you* Chief CypherPunks Spokesperson?
  (Anonymous? TruthMonger? Nobody?)

> Also, here's a little hint (from a non-lawyer): truth is generally a
> very good defense to a libel suit.  You may squirm and dance and claim
> you don't want to deal with the hassle or expense of a suit, but we
> all know precisely what that really means...

  Yes...and we all disagree, nonetheless.
  We are getting away from the important issue in this thread, which is
that CypherPunks are most effective when engaging in pissing contests
and shooting themselves and each other in the foot.
  This makes the AOL'ers too nervous to stick around long, helps us to
work off angry energy which might otherwise cause our hands to shake 
when working on sensitive nuclear devices, and gives people in the
'Home' more constructive and destructive things to do than sitting
around all day cutting out those damned paper dolls. (And boy am I
getting tired of that).

  If you choose to reply to this post, please be polite. I am a very
sensitive person, and easily offended.

CypherPisser






From frantz at netcom.com  Mon Oct  6 09:40:13 1997
From: frantz at netcom.com (Bill Frantz)
Date: Tue, 7 Oct 1997 00:40:13 +0800
Subject: Secure phone
In-Reply-To: <199710032326.QAA19691@comsec.com>
Message-ID: 



At 6:25 PM -0700 10/5/97, Adam Back wrote:
>On the other hand, using persistent key public key crypto, Tim has
>been signing his posts recently, and I have an ancient public key of
>his stashed away which his new key is signed with.  If we were able to
>construct a protocol to bolt on top of the reading of hashes, we could
>have much greater protection against MITM.

Of course if you can use PGP as well as the secure phone, you can use PGP
to exchange a pad of one-time passwords.

>
>To answer the other poster who opined that you had no business saying
>things to people who's voices you don't recognize: nonsense.
>
>We're saying things all the time to people who's voices we've _never_
>heard with PGP.

Are you really willing to discuss with Tim that suitcase you're planning on
bringing to the states.  :-)


-------------------------------------------------------------------------
Bill Frantz       | Internal surveillance      | Periwinkle -- Consulting
(408)356-8506     | helped make the USSR the   | 16345 Englewood Ave.
frantz at netcom.com | nation it is today.        | Los Gatos, CA 95032, USA







From ppomes at Qualcomm.com  Mon Oct  6 09:44:26 1997
From: ppomes at Qualcomm.com (Paul Pomes)
Date: Tue, 7 Oct 1997 00:44:26 +0800
Subject: russia_1.html
In-Reply-To: <199710061350.GAA06107@toad.com>
Message-ID: <27763.876155489@zelkova.qualcomm.com>



Even a fizzle with a yield in the hundreds of tons equivalent is respectable.
Plutonium decay products have a high neutron cross-section and steal the
fast neutrons necessary for the chain reaction to build.  Sufficient amounts
can kill off the last three or more re-doublings which is where most of the
explosive power comes from.  On the other hand finely dispersed Pu and
other fission products plus the irradiated material that becomes radioactive
will make a few square miles dangerous to inhabit for several years.

/pbp







From frantz at netcom.com  Mon Oct  6 09:45:33 1997
From: frantz at netcom.com (Bill Frantz)
Date: Tue, 7 Oct 1997 00:45:33 +0800
Subject: russia_1.html
In-Reply-To: <199710061350.GAA06107@toad.com>
Message-ID: 



At 3:01 AM -0700 10/6/97, Peter Trei wrote:
>The plutonium cores of thermonuclear devices have a limited shelf
>life - he claimed 6 years, which jibes with what I've heard from
>other open sources. Fission products build up in the cores which
>can poison a chain reaction. Thus all Pu based devices need to have
>the cores periodically removed and replaced with new ones, while the
>old ones have to go through a non-trivial reprocessing stage to
>remove the fission products.

I think this comment is in error.  Plutonium has a half life on the order
of 250,000 years, so very little decay products would build up in 6 years.
The tritium used in thermonuclear weapons has a much shorter half life, and
would need to be replaced about that often.


-------------------------------------------------------------------------
Bill Frantz       | Internal surveillance      | Periwinkle -- Consulting
(408)356-8506     | helped make the USSR the   | 16345 Englewood Ave.
frantz at netcom.com | nation it is today.        | Los Gatos, CA 95032, USA







From ffn at omni.net  Tue Oct  7 00:56:45 1997
From: ffn at omni.net (ffn at omni.net)
Date: Tue, 7 Oct 1997 00:56:45 -0700 (PDT)
Subject: We Will Loan You $59,000 And You NEVER Have To Repay Us
Message-ID: <3336528719035@omni.net>




PLEASE EXCUSE THE INTRUSION. BUT, THIS INFORMATION MAY BE OF 
GREAT INTEREST TO YOU...

How would you like to BORROW $59,000 and NEVER have to 
repay the LOAN?

If you answered YES, and who wouldn't, then I would like 
to invite you to join a very SPECIAL group of people.
The FINANCIAL FRIENDS NETWORK.

The FINANCIAL FRIENDS NETWORK is an ever expanding international
group of GENEROUS and CARING people who WILL automatically
receive $59,000 LOANS, that they NEVER have to repay. 
All of our members are hard working, family-oriented people, 
with one common goal that unites us all. We are committed 
to generating income, to provide the neccessities and the 
comforts for ourselves and our families.

Let us show you exactly how our UNIQUE, HONEST and PROFESSIONALLY
MANAGED program, automatically LOANS YOU $59,000.

HERE'S HOW IT WORKS:

Just LOAN 1 existing member $20 (which is your lifetime membership fee)
and THAT'S IT!!!    WE DO EVERTHING ELSE FOR YOU!

ALL YOU HAVE TO DO IS JOIN US TO RECEIVE YOUR $59,000 LOAN!

IT'S REALLY AMAZING HOW EASY THIS IS AND HOW BEAUTIFULLY IT WORKS!

We can assure you that this is a LEGAL and LEGITIMATE offer and
complies with US law, title 18, sections 1302 & 1341. After all,
who hasn't LOANED a FRIEND money before! And, we don't even expect
YOU to repay us.

HERE'S HOW TO JOIN:

1) Fill out the membership application at the bottom of this letter.
2) Send us your application along with $20, your lifetime membership fee.
AND THAT'S IT, WE'LL DO EVERYTHING ELSE FOR YOU!

HOW AND WHEN DO YOU RECEIVE YOUR LOAN:

ONLY the member in the #1 position RECEIVES YOUR LOAN/membership fee.
(SEE MEMBERSHIP APPLICATION) The FINANCIAL FRIENDS NETWORK will 
then remove the name of the person in the #1 position and will then add 
YOUR name and YOUR assigned number to the #5 position. The FINACIAL 
FRIENDS NETWORK will then enroll new members for you, as we are currently 
doing for an existing member, right now. Those collected membership fees 
are then forwarded to YOU, as the member in the #1 position.

THE FINANCIAL FRIENDS NETWORK WILL CONTINUOUSLY AND VIGOROUSLY 
ENROLL NEW MEMBERS UNTIL EACH EXISTING MEMBER HAS "SPONSORED" 
5 NEW MEMBERS. BY DOING THIS, NO MEMBER CAN FAIL!

THIS SERVICE ALONE IS WORTH MUCH, MUCH MORE THAN THE SMALL $20
LIFETIME MEMBERSHIP FEE!

CALCULATION OF LOAN AMOUNT:

Position 5: We enroll 5 new members for YOU -          1 X 5 = 5
Position 4: We enroll 5 new members for them -         5 X 5 = 25
Position 3: We enroll 5 new members for them -        25 X 5 = 125
Position 2: We enroll 5 new members for them -       125 X 5 = 600
Position 1: We enroll 5 new members for them -       600 X 5 = 3000

Those 3000 new members LOAN YOU $20 EACH, for a total of $60,000, 
less a $1000 loan processing fee, retained by FINANCIAL FRIENDS NETWORK.
This is how we make a profit and it enables us to continuously increase 
our membership. THAT'S ALL THERE IS TO IT!

When YOUR name reaches the #1 position, usually in 3-4 months, 
YOU will then start to receive YOUR LOAN. YOUR LOANS will be automatically 
forwarded to you on the 1st and 15th of each month, until YOU receive 
YOUR entire $59,000 LOAN. Any overages will be automatically repositioned 
to the next member on the list.
(We never know exactly how many people will respond to each 
specific mailing)

Almost EVERYBODY JOINS our exclusive network due to it's LOW, LOW 
lifetime membership fee and it's HIGH, HIGH rate of return. 
Thousands of new members are joining monthly.

There are over 150,000 new people getting on the Internet each week. 
This provides us a vast and ever expanding market to tap into.
THAT'S WHY THIS OPPORTUNITY IS SUCH A FANTASTIC SUCCESS!

Nobody could blame you if you are having some reservations about joining 
our exclusive membership offer. But PLEASE, don't let your fears and past 
disappointments keep you from allowing YOURSELF and YOUR FAMILY to 
benefit from this ONCE IN A LIFETIME OPPORTUNITY!

Financial security is the one basic need of all people. Without it, 
it's difficult to survive. IMAGINE WHAT YOU COULD DO WITH A $59,000 LOAN,
THAT YOU NEVER HAVE TO REPAY!

The FINANCIAL FRIENDS NETWORK allows ALL of it's members the opportunity
to become FINANCIALLY SECURE. And, YOUR lifetime membership fee is so 
LOW, there's no strain on YOUR budget!

PLEASE don't confuse the FINANCIAL FRIENDS NETWORK with any other
money programs that are DOOMED from the start. They make no guarantees, 
they want YOU to do ALL the work and they want YOU to absorb ALL the cost.
They'll even tell you that YOUR SUCCESS depends solely on YOU! As a member 
of the FINANCIAL FRIENDS NETWORK, We do ALL the work and WE absorb all 
the cost. YOU just sit back and collect YOUR LOAN.
WHAT COULD BE EASIER?

MONEY BACK GUARANTEE:

If at any time, you would like to cancel your membership, we will refund you 
your full lifetime membership fee, no questions asked.
NOW YOUR MEMBERSHIP IS RISK FREE!

WE'RE SURE YOU'LL HAVE TO AGREE, THAT THIS IS THE MOST POWERFUL 
OPPORTUNITY OF IT'S KIND, WITH ABSOLUTELY NO RISK!

PLEASE DON'T LET THIS OPPORTUNITY PASS YOU BY. IT WILL PROBABLY 
BE THE BEST THING THAT EVER HAPPENS TO YOU AND YOUR FAMILY!

HAVE YOU EVER GAMBLED AWAY MONEY ON LOTTERY TICKETS?

NOW YOU CAN BE A "WINNER" AND RECEIVE YOUR $59,000, BY BECOMING 
A MEMBER OF THE FINANCIAL FRIENDS NETWORK!

JOIN US NOW!


MEMBERSHIP APPLICATION:

YES, I want to receive my $59,000 too!
I understand that I can cancel my membership at any time.
As a FINANCIAL FRIENDS NETWORK member, all loans are interest
free and I never have to repay the loan. All information
about me will be kept strictly confidential.

NAME____________________________________________________

ADDRESS_________________________________________________

CITY________________________STATE_________ZIP___________

PHONE________________________E-MAIL_____________________
           (optional)                        (optional)

MAKE CASHIERS CHECKS PAYABLE TO:________________________

MEMBERS:
Position 1:         J. Jeffers  ID# 67441
Position 2:         C. Danko    ID# 68377
Position 3:         J. Berga    ID# 70029
Position 4:         M. Lentz    ID# 74893
Position 5:         G. Nunoz    ID# 77906

You may also send in your application by puting the above 
information on a seperate sheet of paper. DON'T FORGET TO 
INCLUDE ALL 5 POSITIONS, WITH NAMES AND ID#'s.

SEND YOUR APPLICATION ALONG WITH $20 CASH,
Sorry, but we ask that all payments be made in cash, 
to eliminate ALL tax liabilities. 
All Checks will be returned.

SEND TO:

FFN
1101 E. Tropicana Ave. STE.# 187
Las Vegas, NV 89119

Please make sure cash does not show through envelope.

NOW, JUST SIT BACK AND RELAX, YOUR LOAN WILL BE ARRIVING SOON!

THANK YOU, and WELCOME TO THE FINANCIAL FRIENDS NETWORK.


 






From whgiii at invweb.net  Mon Oct  6 10:37:45 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Tue, 7 Oct 1997 01:37:45 +0800
Subject: The Right to Work for Nobody / Re: New PGP "Everything the FBI ever dreamed of"
In-Reply-To: <3438F7E2.7BAE@dev.null>
Message-ID: <199710061723.NAA24597@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <3438F7E2.7BAE at dev.null>, on 10/06/97 
   at 08, TruthMonger  said:

>In Canada, one could 'choose' not to work for Safeway Stores, but the
>chain would come into a community and undersell everyone until the locals
>were run out of business, then raise prices dramatically. In theory, you
>could choose to *not* work for Safeway, but in reality, there was no one
>else left *to* choose to work for in the grocery  business.

I have these same complaints about WalMart and KMart here in the US. It
should be noted that it is the community that *chooses* to shop at the
discount store rather than at the local shops. If they didn't buy products
from the Safeway or WalMart then you wouldn't have the "problem" above.
Economics 101; the people are voting with their wallets.

This is a prime example of the basis of socialism; envy. The socialist are
envious of the rich as they are a constant reminder of "what could have
been". "If I had only worked a little harder" ... "If I only had spent
more time in school" ... ect. After a period of time this envy turns to
jelousy and rage. "It's not fair" ... "There should be a law" ... ect.

The socialist never thinks of the hard work and personl sacrfise that goes
into creating a "Safeway" or "KMart" or "Walmart". Such companies are not
created by an act of GOD but through hard work and long hours by their
founders. While the socialist is pissing his life away on the road to
medocracy the founders of such companies, and 1000's like them, are
working 80+ hours a week building their company sometimes at the expence
of health, home and family.

After years of hard work, when the founders are finaly able to reap the
fruits of their toil, the socialist will step up and say: "I want what you
have, you can't have that because I don't" even though the socialist has
done nothing to earn it. 

This is the true evil of socialism: "Equiality of Outcome". While the
socialist will make a big show of his desire for "equal opertunity" it is
really "equal outcomes" that he desires. It is like the story of the
grashopper and the ant. Both have the "equal opertunity" durring the
summertime to store up for the winter. The ant choses the path of the
capitalist and works hard all sumer long while the grasshopper choses the
path of the socialist and wastes the days away in play and folly. When
wintertime comes along the ant is well prepaired while the grasshopper is
without. While the capitalist will see the grasshopper getting his just
rewards for his foolhardy behavior the socialist will cry foul, seeing
this as unjust that the ant should have so much and the grasshopper so
little and demaniding that the ant give a portion of his "wealth" (a large
portion no doubt) to the grasshopper thus achiving his desired "equality
of outcome" even the grasshopper has done nothing to deserve such an
outcome.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNDkgOY9Co1n+aLhhAQFmCwQAzll6zhks8izWPkVgCENJ+/CTuMbQqlDA
cFKsMT4gX0OdqPVuFdjewVsLxTGFcKr2nkLxjWmp62ypH6Nn/uL/R3CPJ6Bsmzzc
EVDI0HZOnHUirlOm1c/zz13jGihzLXww1RIcamkixnbWnXH3WPVank1ZQMyBsCab
6k9jTZmbY2w=
=vHjj
-----END PGP SIGNATURE-----






From tcmay at got.net  Mon Oct  6 10:46:06 1997
From: tcmay at got.net (Tim May)
Date: Tue, 7 Oct 1997 01:46:06 +0800
Subject: Trademarking CypherSpace???
In-Reply-To: <3.0.3.32.19971005185236.00688c68@popd.ix.netcom.com>
Message-ID: 



At 6:52 PM -0700 10/5/97, Bill Stewart wrote:
>Sigh.  A company called I-Planet is trying to trademark the term
>"Cypherspace", even though we've been using it for a couple of years
>in the cypherpunk community.  They're doing an IPSEC Virtual Private Network,
>with friendly HTML administration; http://www.i-planet.com/P2cypherpb.html .
>Looks like interesting stuff, and I wish them luck except in TMing the
>name :-)
>
>I looked on AltaVista and HotBot, and the earliest reference I found
>was from a 1994 article by Tim May.  I'd be interested in finding any
>earlier refs.
>There's also a line of comic books using the name, and a Java Applet
>from 1996, plus references from I-Planet in late 96 and 97.
>Anybody know if the term's been used in print in the dead-tree press?
>
>http://www-swiss.ai.mit.edu/6095/assorted-short-pieces/may-police-state.txt 05-
>Oct-94


Seems to me I-Planet can't trademark a word which has been in usage by many
of us for several years. What could they do, demand that we stop using a
word we in all likelihood coined? Remove our old writings from the Web?
(How?)

We were using the term "cypherspace" in '93-94, especially in the physical
meetings in Mountain View. I recall first hearing it from Eric Hughes, who
may have gotten it from Jude Milhon, or elsewhere. The context was of a new
slogan:

"In cypherspace no one can read your screen."

(This being a takeoff on the "Aliens" tag line: "In space no one can hear
you scream.")

This usage was probably around mid-1993. I started using it to describe the
obvious thing, the "space" our messages, list, etc. live in.  There are
references in my Cyphernomicon, published in September '94, but written
over the previous 8 months, to cypherspace, as in the section on "Data
Havens," where I wrote: "One of the powerful uses of strong crypto is the
creation of journals, web sites, mailing lists, etc., that are
"untraceable." These are sometimes called "data havens," though that term,
as used by Bruce Sterling in "Islands in the Net" (1988), tends to suggest
specific places like the Cayman Islands that corporations might use to
store data. I prefer the emphasis on "cypherspace.""

I don't know about trademark law, and about whether "prior use" invalidates
an attempted trademark.  It seems unrealistic for them to lay claim to a
word someone else invented.

Certainly if this company gets a trademark, it'd be interesting to repost
some old posts, or make references to the comic book, Java applet, etc.,
and then see if they demanded that history be expunged.

--TIm May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From aba at dcs.ex.ac.uk  Mon Oct  6 11:23:45 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Tue, 7 Oct 1997 02:23:45 +0800
Subject: Secure phone
In-Reply-To: 
Message-ID: <199710061757.SAA01293@server.test.net>




Bill Frantz  writes:
> At 6:25 PM -0700 10/5/97, Adam Back wrote:
> >On the other hand, using persistent key public key crypto, Tim has
> >been signing his posts recently, and I have an ancient public key of
> >his stashed away which his new key is signed with.  If we were able to
> >construct a protocol to bolt on top of the reading of hashes, we could
> >have much greater protection against MITM.
> 
> Of course if you can use PGP as well as the secure phone, you can use PGP
> to exchange a pad of one-time passwords.

The passwords alone don't do you any good: if you read them out over
the phone, Eve can just repeat them.

You need to combine the password with the part of the D-H parameter
hash displayed on the dinky little secure phone display in such a way
that Eve can't fake it without knowledge of your password.  It would
be nice if you didn't need a computer to perform this operation, but I
guess you could live with needing a computer.  It would also be nice
if the number of digits you had to read was relatively short.

XOR doesn't work, because Eve can undo that; XOR isn't very easy to do
mentally anyway.

Encrypting the display value with a symmetric cipher and a key formed
from the password and reading out a selection of digits from the
ciphertext would do.  But most/all symmetric ciphers worth speaking of
are beyond doing in your head, or with a piece of paper in a
reasonable amount of time.

How many digits are on the display of one of those phones?  It seems
that you should be able to concoct something which is easy to compute,
and offers as much surety as the few digits on the display.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <3.0.3.32.19971006142118.007b3960@mail.qed.net>



>What if you want to send a message to your child saying you will be late
>after school.  What is to prevent a pedophile from forging such a message?
>And if a pedophile intercepts such a message, couldn't he arrive 5 minutes
>early saying that "dad changed his plans again and sent me...".
>
>Now, Rep. Tauzin wants to make it illegal to listen in to any "private" 
>radio communication (yes listen, not just repeat), since Gingrich couldn't
>have access to encrypted communication and someone listened in on his cell
>phone.  One law prevents security from being available, so they think that
>a second law will prevent people from listening in.
>
>Repealing a law preventing fences is more effective than adding a
>draconian penalty for tresspass. 

I try to avoid "me too" posts, but I agree 100% with this. Somehow we have
to convince a bunch of legislators that technological solutions are
superior or legal ones in protecting info-privacy. Perhaps an analogy with
welfare might help (at least with conservative members): access to crypto
vs. laws protecting privacy is like private job creation vs. welfare. Do we
want to live in a state where we are mandated to rely on the government for
privacy (even if we could trust the government)?

Thanks also for the concrete example of how pedophiles could make use of a
parent's lack of encryption/signing.

Paul

Oh freddled gruntbuggly thy micturations are to me
As plurdled gabbleblotchits on a lurgid bee.






From declan at well.com  Mon Oct  6 12:25:15 1997
From: declan at well.com (Declan McCullagh)
Date: Tue, 7 Oct 1997 03:25:15 +0800
Subject: "Fear and loathing of cyberspace not uncommon"
Message-ID: 



[I just got back from Fox News, where I was on with someone from the
Chicago Bar and Donna Rice-Hughes (yes, that Donna Rice). Rice-Hughes, now
an anti-porn activist at Enough is Enough, did her part to promote fear and
loathing of cyberspace. "Chatrooms are a pedophile's playground. Kids are
falling through the cracks." She called for more obscenity prosecutions
online, but told me afterwards she didn't endorse labelling schemes like
RSACi. --Declan]

***************

By DONALD M. ROTHBERG
Associated Press Writer

	WASHINGTON (AP) - The world runs on computers and, in a sense,
computers run the world. But all this technological progress comes at a
price, a new problem psychologists call computer phobia.
	It is everywhere - in private industry, in government and in the
home. For many people computers are wondrous machines offering access to a
vast world of knowledge.
	But to others they are impersonal monsters that react to an errant
key stroke with this brusque message: "You have performed an illegal
operation. This computer will shut down."
	When the car or the dishwasher breaks down, people curse the
machine. Often when the computer malfunctions, the first reaction is, "What
have I done wrong?"
	Nowhere is the problem of computer phobia likely to show up the
most than in the federal government. The government has millions of
computers. Literally.
	Larry Irving, assistant secretary of commerce for communications
and information, said there are people "who resist and people who are
intimidated" by the increasingly technological focus of their jobs.
	"It's a problem, but it's not insurmountable," he said. "You just
have to find a reason for people to get over it."
	Irving cited the man at the top of the government. "My sense is the
president did not spend a lot of time doing personal e-mail until his
daughter went to college," he said.
	"A lot of people are embarrassed about saying they're afraid of
computers," said Carol Goldberg, a clinical psychologist who conducts
workshops to help corporations deal with technological stress.
	Michelle Weil, a clinical psychologist in Orange, Calif., and
co-author of the book, "TechnoStress: Coping with Stress at Work, at Home,
at Play," said about 15 percent of people love technology and up to 25
percent of the rest are what she called "resisters."
	"The resisters will have higher stress, lower productivity, less
efficiency and higher workers comp claims," she said.
	As the biggest user of computers, has the government seen greater
absenteeism as technology grows?
	"I suspect that may be true," said Don Heffernan, assistant chief
information officer at the General Services Administration, the government
property agency.
	A year ago, every GSA employee was given Internet access, Heffernan
said. "Going into that we knew there were going to be people, even people
who used computers a bit, who were going to be intimidated by the
Internet," he said.
	To help employees adjust to the new technology, GSA Administrator
David Barram urged those who were experienced in using the Internet to
"become five-minute tutors" for those intimidated by the technology.
	Weil is less confident than the government officials that getting
over computer phobia is just a matter of incentive.
	"This problem has not gone away," she said. "In fact, it's getting
worse. We wondered that as technology got more commonplace in society
wouldn't people just get used to it.
	"The answer is no. In fact, some of the technology now makes less
sense than the technology did 15 years ago."
	Irving, the Commerce Department official, said the biggest
indication that people are overcoming computer phobia is in one huge
number. "This year 2.7 trillion e-mail are going to be sent around the
world," he said.
	"That means a lot of people have overcome their paranoia and their
phobia."

Donald M. Rothberg has covered the federal government for The Associated
Press in Washington since 1966.


-------------------------
Declan McCullagh
Time Inc.
The Netly News Network
Washington Correspondent
http://netlynews.com/







From tm at dev.null  Mon Oct  6 12:30:51 1997
From: tm at dev.null (TruthMonger)
Date: Tue, 7 Oct 1997 03:30:51 +0800
Subject: The Right to Work for Nobody / Re: New PGP "Everything the FBI ever dreamed of"
In-Reply-To: <199710061723.NAA24597@users.invweb.net>
Message-ID: <34393A0D.7264@dev.null>



William H. Geiger III wrote:
> TruthMonger  said:
> 
> >In Canada, one could 'choose' not to work for Safeway Stores, but the
> >chain would come into a community and undersell everyone until the locals
> >were run out of business, then raise prices dramatically. In theory, you
> >could choose to *not* work for Safeway, but in reality, there was no one
> >else left *to* choose to work for in the grocery  business.
> 
> If they didn't buy products
> from the Safeway or WalMart then you wouldn't have the "problem" above.
> Economics 101; the people are voting with their wallets.
> 
> This is a prime example of the basis of socialism; envy. The socialist are
> envious of the rich as they are a constant reminder of "what could have
> been".
>
> The socialist never thinks of the hard work and personl sacrfise that goes
> into creating a "Safeway" or "KMart" or "Walmart". Such companies are not
> created by an act of GOD but through hard work and long hours by their
> founders.

  Nothing personal, shit-for-brains, but this sounds like the 'standard
speech' you have prepared, waiting only for a 'trigger' before you fire
it off...

  I was making reference to the simple fact that 'Caveat Hemptor' still
rules, but does so with the backing of men who can afford to hire thugs
called policemen to back their action.
  My point is that Safeway has every right to bring their competition
to financial ruin, just as Nestle's has every right to give away their
baby formulae for free in impoverished countries, just long enough for
the mother's milk to dry up, at which time their babies die if they
can't afford to buy Nestle's product.
  I reserve the right, however, to whack their sorry asses out if 
I decide that my world will be a better place without their scheming
for their own profit at the expense of those who believe the fairy
tales they tell while planning to buttfuck the people all along.

  The rest of your post is proof that one should not read Ayn Rand
while high on acid, but I'm glad you could get all of that off your
chest, just the same.

  The point I was making, if you care to respond to it once the buzz
wears off, is that the 'playing field' has been twisted so far out of
askew that it is difficult to make any judgements about capitalism
versus socialism, etc., since the world is standing on its head.
  I sincerely doubt that 'capitalists' getting paid 'not to grow' 
cotton/corn/whatever, are a far cry different from the socialists
getting paid 'not to go to work.'

  There are no longer any capitalists or socialists, there are only
people projecting images with political rhetoric and ten-second
sound-bytes.
  I am beginning to think that the *only* way to level the playing
field is with a nuclear grader. (If only I could figure out where 
this damn yellow wire goes...)

TruthMangler

> After years of hard work, when the founders are finaly able to reap the
> fruits of their toil, the socialist will step up and say: "I want what you
> have, you can't have that because I don't" even though the socialist has
> done nothing to earn it.
> 
> This is the true evil of socialism: "Equiality of Outcome". While the
> socialist will make a big show of his desire for "equal opertunity" it is
> really "equal outcomes" that he desires. It is like the story of the
> grashopper and the ant. Both have the "equal opertunity" durring the
> summertime to store up for the winter. The ant choses the path of the
> capitalist and works hard all sumer long while the grasshopper choses the
> path of the socialist and wastes the days away in play and folly. When
> wintertime comes along the ant is well prepaired while the grasshopper is
> without. While the capitalist will see the grasshopper getting his just
> rewards for his foolhardy behavior the socialist will cry foul, seeing
> this as unjust that the ant should have so much and the grasshopper so
> little and demaniding that the ant give a portion of his "wealth" (a large
> portion no doubt) to the grasshopper thus achiving his desired "equality
> of outcome" even the grasshopper has done nothing to deserve such an
> outcome.
> 
> - --
> - ---------------------------------------------------------------
> William H. Geiger III  http://www.amaranth.com/~whgiii
> Geiger Consulting    Cooking With Warp 4.0
> 
> Author of E-Secure - PGP Front End for MR/2 Ice
> PGP & MR/2 the only way for secure e-mail.
> OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html
> - ---------------------------------------------------------------
> 
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.3a
> Charset: cp850
> Comment: Registered_User_E-Secure_v1.1b1_ES000000
> 
> iQCVAwUBNDkgOY9Co1n+aLhhAQFmCwQAzll6zhks8izWPkVgCENJ+/CTuMbQqlDA
> cFKsMT4gX0OdqPVuFdjewVsLxTGFcKr2nkLxjWmp62ypH6Nn/uL/R3CPJ6Bsmzzc
> EVDI0HZOnHUirlOm1c/zz13jGihzLXww1RIcamkixnbWnXH3WPVank1ZQMyBsCab
> 6k9jTZmbY2w=
> =vHjj
> -----END PGP SIGNATURE-----






From nobody at REPLAY.COM  Mon Oct  6 12:34:03 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Tue, 7 Oct 1997 03:34:03 +0800
Subject: The Important Question / Re: russia_1.html
Message-ID: <199710061921.VAA10516@basement.replay.com>



Paul Pomes wrote:
> 
> Even a fizzle with a yield in the hundreds of tons equivalent is respectable.
> Plutonium decay products have a high neutron cross-section and steal the
> fast neutrons necessary for the chain reaction to build.  Sufficient amounts
> can kill off the last three or more re-doublings which is where most of the
> explosive power comes from.  On the other hand finely dispersed Pu and
> other fission products plus the irradiated material that becomes radioactive
> will make a few square miles dangerous to inhabit for several years.

Bill Frantz wrote:
> Plutonium has a half life on the order
> of 250,000 years, so very little decay products would build up in 6 years.
> The tritium used in thermonuclear weapons has a much shorter half life, and
> would need to be replaced about that often.

But the _important_ question is: "Where do connect the 'yellow' wire?"







From jseiger at democracy.net  Mon Oct  6 12:36:59 1997
From: jseiger at democracy.net (Jonah Seiger)
Date: Tue, 7 Oct 1997 03:36:59 +0800
Subject: EVENT - Join Rep. Dreier LIVE Online Wednesday Sept 8
Message-ID: 



=========================================================================
     _                                                             _
  __| | ___ _ __ ___   ___   ___ _ __ __ _  ___ _   _   _ __   ___| |_
 / _` |/ _ \ '_ ` _ \ / _ \ / __| '__/ _` |/ __| | | | | '_ \ / _ \ __|
| (_| |  __/ | | | | | (_) | (__| | | (_| | (__| |_| |_| | | |  __/ |_
 \__,_|\___|_| |_| |_|\___/ \___|_|  \__,_|\___|\__, (_)_| |_|\___|\__|
                                                |___/
                         Government Without Walls
_________________________________________________________________________
Update No.14              http://www.democracy.net/           Oct 06 1997
_________________________________________________________________________
Table of Contents

 - Virtual Town Hall Meeting with Rep. David Dreier (R-CA) Wed 10/08
 - About democracy.net
_____________________________________________________________________

DEMOCRACY.NET VIRTUAL TOWN HALL MEETING WITH REP. DAVID DREIER (R-CA)

Join Representative David Dreier (R-CA) live at democracy.net for an
interactive discussion of current Internet policy issues, including efforts
to reform US Encryption policy.

Dreier is a name you need to know. As a member of the House Rules
Committee, Representative Dreier will soon be called upon to help reconcile
the various versions of the Security and Freedom Through Encryption Act
(SAFE, HR 695).

Dreier is a sponsor of the original version of SAFE, and supports efforts
to promote privacy and security on the Internet through the widespread
availability of strong encryption.  However, the FBI, and Rules Committee
Chairman Gerald Solomon (R-NY) are pushing for a version of SAFE which
contains sweeping new domestic encryption restrictions.

Representative Dreier is also a leading advocate for the use of the
Internet and other interactive communications technology to make Congress
more open, accountable, and effective, having played a key role in forming
the 21st Century Congress Project. He has sponsored a campaign finance bill
(HR 1780 - http://thomas.loc.gov/cgi-bin/bdquery/z?d105:h.r.1780:) that
would require candidates to file their donations with the Federal Elections
Commission and disclose them rapidly on the Internet, among other issues
the bill tackles.

Dreier is also a member of the Congressional Internet Caucus.

EVENT DETAILS:

 Date:       Wednesday October 8, 1997
 Time:       8:00 pm Eastern (5:00 pm pacific)
 Location:   http://www.democracy.net

HOW THE TOWN HALL MEETING WORKS:

The democracy.net Virtual Town Hall Meeting will include a moderated
discussion between Rep. Dreier and democracy.net moderator Todd Lappin,
cybercast live via RealAudio. Participants can join a simultaneous chat
forum to pose questions for the moderator and discuss the proceedings.
Questions can also be submitted via a form on the democracy.net web site
(http://www.democracy.net/questions/)

WHAT YOU'LL NEED:

You will need a copy of RealAuido and a telnet application to participate.
Both are available free at http://www.democracy.net/

We hope you will join us for an interesting discussion.
_______________________________________________________________________________
REPRESENTATIVE DRIER ON THE SECURITY AND FREEDOM THROUGH ENCRYPTION ACT (SAFE):

  "Export controls on encryption software put U.S. firms at a disadvantage
   against foreign competitors who are permitted to sell more advanced
   software on the international market.  These controls also fail to
   prevent foreign software companies from producing advanced encryption
   software.  I support H.R. 695, the Security and Freedom Through
   Encryption (SAFE) Act, which addresses the concerns of our law
   enforcement and intelligence agencies by permitting the export of
   encryption software which is as advanced as software widely available on
   the international market."

_____________________________________________________________________________
SHORT BIOGRAPHY OF REP. DRIER (from http://www.house.gov/dreier)

Congressman David Dreier (R-CA) is in his ninth term representing the
eastern cities of Los Angeles County.  He serves on the House Rules
Committee and chairs the Subcommittee on Rules and Organization of the
House.  In 1996, the Subcommittee set up the 21st Century Congress
Project to develop and recommend changes in Congress' operations and
legislative procedures that will allow technology to make the
institution more open, accountable and effective.  The subcommittee held
two hearings on the impact of new information technologies on the
legislative process and decision-making.  The first was an interactive
hearing that utilized television, video conference technology, e-mail
and the Internet.  Information about the 21st Century Congress Project
and the testimony and transcripts of the two technology hearings can be
accessed on the Subcommittee Web site at http://www.house.gov/rules_org.

Dreier is a member of the bipartisan, bicameral Congressional Internet
Caucus.  Working with Congressman Rick White, he pushed through the new
House rule requiring committees to put their publications on the
Internet.  Dreier's office Web site is considered one of the most
comprehensive and informative on Capitol Hill.  There, citizens can gain
obtain information on Dreier's legislative priorities, access CRS
reports and other hard-to-find resources on how Congress works, and
communicate directly with the Congressman by Web mail.

Legislatively, Dreier is a cosponsor of the Security and Freedom
Through Encryption (SAFE) Act.  He is also the sponsor of the Voter
Empowerment Act, which reforms the campaign finance by, among other
things, requiring all disclosure information to be made available on the
Internet, and requiring the FEC to publish an expansive Internet site
which would contain a separate page for every Congressional and
Presidential candidate, each PAC, and every national party.

___________________________________________________________________________
ABOUT DEMOCRACY.NET

democracy.net is a joint project of the Center for Democracy and
Technology (CDT) and the Voters Telecommunications Watch (VTW) to explore
ways of enhancing citizen participation in the democratic process via
the Internet.

To this end, democracy.net will host live, interactive cybercasts of
Congressional Hearings and online town hall meetings with key policy makers.

democracy.net is made possible through the generous support of
WebActive, Public Access Networks, theSync, and Democracy Network.
More information about the project and its sponsors can be found at
http://www.democracy.net/about/

To receive democracy.net announcements automatically, please visit our
signup form at http://www.democracy.net/   To stop receiving these
announcements, please send email to majordomo at democracy.net with
"unsubscribe events" in the body of the message.
_________________________________________________________________________
end update no.14                                                 10/06/97
=========================================================================






From eb at comsec.com  Mon Oct  6 12:57:55 1997
From: eb at comsec.com (Eric Blossom)
Date: Tue, 7 Oct 1997 03:57:55 +0800
Subject: Secure phone
In-Reply-To: <199710061757.SAA01293@server.test.net>
Message-ID: <199710061917.MAA22966@comsec.com>



> Bill Frantz  writes:
> > At 6:25 PM -0700 10/5/97, Adam Back wrote:
> > >On the other hand, using persistent key public key crypto, Tim has
> > >been signing his posts recently, and I have an ancient public key of
> > >his stashed away which his new key is signed with.  If we were able to
> > >construct a protocol to bolt on top of the reading of hashes, we could
> > >have much greater protection against MITM.
> > 
> > Of course if you can use PGP as well as the secure phone, you can use PGP
> > to exchange a pad of one-time passwords.
> 
> The passwords alone don't do you any good: if you read them out over
> the phone, Eve can just repeat them.

There's no reason you couldn't use the passwords in a bidirectional
challenge/response scenario.  The units can pass (optionally
encrypted) control messages back and forth while in secure voice mode.

Eric






From eb at comsec.com  Mon Oct  6 13:02:19 1997
From: eb at comsec.com (Eric Blossom)
Date: Tue, 7 Oct 1997 04:02:19 +0800
Subject: Secure phone
In-Reply-To: <199710060125.CAA03034@server.test.net>
Message-ID: <199710061905.MAA22945@comsec.com>



>> In addition, to keep life even more interesting, prior to exchanging
>> the public exponentials g^x and g^y, commitments (hashes) to those
>> values are exchanged...  If the commitments don't match the final
>> values, the protocol terminates.  
>
>I can't see that this prevents MITM either.
>
>Eve, the attacker, just sends commitments to the values she would have
>sent in performing the MITM were there no commitments.

What the commitment prevents is a birthday attack on the verification
code by Mallet.  Mallet has to be able to come up with a g^x' that
when concatenated with g^y and hashed computes the same verification
code as g^x concatenated with g^y and hashed.

Exchanging commitments to g^x and g^y prior to sending g^x and g^y
severely constrain the the degree of freedom that Mallet has to work
with.  (Another option that works the same way is the "interlock"
protocol, where each side sends half the message (g^x or g^y) and
doesn't send the second half until after receipt of the first half
from the other end).

>Say (for example) if someone smuggled me one of your phones, and I
>called up Tim.  The only protection I'd have is recognizing Tim's
>voice after hearing him speak breifly years ago.  (American accents
>sound similar to me).

None of this is designed to provide authentication of the end point.
It is designed to ensure that you've got a private channel to the end
point. 

>On the other hand, using persistent key public key crypto, Tim has
>been signing his posts recently, and I have an ancient public key of
>his stashed away which his new key is signed with.  If we were able to
>construct a protocol to bolt on top of the reading of hashes, we could
>have much greater protection against MITM.

Agreed.  The primary difficulty is getting the public keys into the
unit.  And agreeing on what kind of certificate to use...  
My preference (for patent reasons) would be to use DSA or ElGamal
signatures.

Eric






From eb at comsec.com  Mon Oct  6 13:02:35 1997
From: eb at comsec.com (Eric Blossom)
Date: Tue, 7 Oct 1997 04:02:35 +0800
Subject: Secure phone
In-Reply-To: <199710061757.SAA01293@server.test.net>
Message-ID: <199710061919.MAA22970@comsec.com>



> How many digits are on the display of one of those phones?  It seems
> that you should be able to concoct something which is easy to compute,
> and offers as much surety as the few digits on the display.

You get 6 big characters that you can see from a couple of feet away,
or three lines of 16 characters that you have to squint at ;-)

(It's a 100 x 32 pixel graphic display).

Eric






From rah at shipwright.com  Mon Oct  6 13:30:31 1997
From: rah at shipwright.com (Robert Hettinga)
Date: Tue, 7 Oct 1997 04:30:31 +0800
Subject: One More Donna Rice Ad Hominem (Was Re: "Fear and loathing ofcyberspace not uncommon")
In-Reply-To: 
Message-ID: 



At 3:16 pm -0400 on 10/6/97, Declan McCullagh wrote:

> [I just got back from Fox News, where I was on with someone from the
> Chicago Bar and Donna Rice-Hughes (yes, that Donna Rice).

I just blew Diet Coke out of my nose again, remembering the first thing
which got me thinking about the speed of information propagation across
financial networks ;-).

To wit, a Donna Rice joke related to me by someone who had heard it on the
"hoot-n-holler" line from the trading room in New York the very morning the
'Monkey Business' picture of Ms Rice, sitting on Gary Hart's, um, lap, went
across the news wires.

The joke was:

Q. What did Donna Rice say she was doing when she left Gary Hart's house?
A. She said she was taking a poll. 

Later, I learned that a friend of mine from my college days at Mizzou,
Brian Smith, got the Pulitzer for that Monkey Business picture. Somewhere,
Mr. Pulitzer was smiling, I bet. Just exactly the kind of yellow journalism
Pulitzer made all his money doing...

Mizzou, of course, is the World's First Journalism School, and I went there
in the late 1970's when we all *knew* that Woodward and Bernstein had saved
the country...

Of course, that made all the journo school folks completely insufferable,
but, unfortunately, only in hindsight...

What? Yes, in fact, I *was* a Liberal Until Graduation. How could you tell?

Cheers,
Bob Hettinga




-----------------
Robert Hettinga (rah at shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/
Ask me about FC98 in Anguilla!: 







From eric at sac.net  Mon Oct  6 13:53:57 1997
From: eric at sac.net (Eric Hughes)
Date: Tue, 7 Oct 1997 04:53:57 +0800
Subject: Trademarking CypherSpace???
In-Reply-To: <3.0.3.32.19971005185236.00688c68@popd.ix.netcom.com>
Message-ID: <3.0.3.32.19971006132514.033f9a78@mail.sac.net>



At 06:52 PM 10/5/97 -0700, Bill Stewart wrote:
>Sigh.  A company called I-Planet is trying to trademark the term 
>"Cypherspace", even though we've been using it for a couple of years
>in the cypherpunk community.  

All this fuss is really not such a big deal, as long as the Patent and
Trademark Office  hears about it.  I know nothing
about trademark procedure, but I imagine that a letter (or three) to the
PTO referencing the right application number on it could scotch an
application but quick.  Printing out email and adding a stamp seems almost
sufficient.

Maybe the nice folks at i-planet (I know you're getting this) could just
post their application number and save us the trouble of finding it ourselves?

And I checked:  The fee for a formal _ex parte_ appeal filing is only $100.
 I'm sure the i-planet lawyers will spend far more than that defending one
of those.

Eric






From PLEASE.READ.ME at 05795.com  Tue Oct  7 05:10:23 1997
From: PLEASE.READ.ME at 05795.com (PLEASE.READ.ME at 05795.com)
Date: Tue, 7 Oct 1997 05:10:23 -0700 (PDT)
Subject: LIONS, TIGERS, & BEARS, OH MY!
Message-ID: <>


                                  Turpentine Creek Foundation, Inc.
                  Route 1 Box 209A, Eureka Springs, Arkansas 72632
                          Phone: (501) 253-5841 Fax: (501) 253-5059
                                       E-mail:tigers at ozarkweb.com
October, 1997

Dear Friend,

The reason I am writing this letter to ask for your help.  First,  I would like to
introduce myself and give you a brief history of Turpentine Creek Wildlife
Refuge, a non-profit organization.  I will try to briefly describe our accomp-
lishments and our mission for the future.

My name is Hilda Jackson.  I am the Secretary-Treasurer of Turpentine Creek 
Foundation.  By the way, when I say "WE",  I am speaking not only of myself, 
but for all the volunteer staff and our eight member board of directors.  Our 
Board consists of doctors, real estate people, a university professor, a CPA 
and a veterinarian, who have worked hard to accomplish our goals.  Our 
Chairman of the Board is Reverend John P. Minogue, C.M., who is also 
President of De Paul University of Chicago, Illinois.

The Turpentine Creek Foundation was started by me, my husband Don 
Jackson, and my daughter, Tanya Smith, in May of 1992.  Tanya is now  
President of the Foundation.  We purchased a 450-acre ranch in Eureka 
Springs,  Arkansas in the heart of the beautiful Ozark Mountains.  We brought
with us to the ranch two lions, one monkey, one white-tailed deer and one
racoon.  That was the beginning of Turpentine Creek Wildlife Refuge.  Our
goal and desires are to house all unwanted exotic big cats, such as lions,
tigers, and other exotic animals in a safe an happy environment.  To date, 
Turpentine Creek houses over 120 animals and birds.  Out of this 120 animals,
there are 90 + exotic big cats, such as lions. tiger, leopards and cougars.

We know from the experts' predictions that there are no more than 4,000 tigers
left in this world.  Without a shelter like Turpentine Creek, I am afraid that the 
beauty and the strengh of the tigers will not be a part of our children's or 
grandchildren's life except in picture books.  With everyone's help this will not 
happen.

We have continued to grow every year due to the birth of new cubs, and the 
acquisition of additional unwanted, abandoned, or abused exotic animals. We
desperately need to expand our compound, and finish the natural habitat, so the
big cats can live and roam as naturally as they would in the wild.

It takes approximately $1000 per day to house and care for the current number of
animals.  These funds are partly raised by our seasonal tourist revenue.

All construction is strictly funded by donations.  This is where we need
YOUR help.  If you can donate  $1, $5, $10, or whatever you feel in your heart you
can send, it wil be greatly appreciated.  All donations are tax deductible under 
IRS regulations section 501(c)(3).

We would like to thank you in advance for any consideration or help you
can give.  

Please come visit us and see the photo albums (especially the NEW 
ARRIVALS) at:    http://www.ozarkweb.com/tcreek/index.htm


My sincere thanks,

Hilda Jackson

Please send your kind donations to :     Turpentine Creek Wildlife Refuge
                                                             Route 1, Box 209-A
                                                             Eureka Springs, Arkansas  72632    

Credit Card Donations can be made by phone or fax (top of page) or complete
the following information and mail to the above address.

Card type:  ____ Visa  ____ MasterCard  ____ American Express  ____ Discover

Card Member's Name :_____________________________________________

Member's Address:     ______________________________________________

Card Number :            ______________________________________________

Expiration Date:          ______________________________________________

Amount of Contribution :  $ _____________






From PLEASE.READ.ME at 05795.com  Tue Oct  7 05:10:23 1997
From: PLEASE.READ.ME at 05795.com (PLEASE.READ.ME at 05795.com)
Date: Tue, 7 Oct 1997 05:10:23 -0700 (PDT)
Subject: LIONS, TIGERS, & BEARS, OH MY!
Message-ID: <>


                                  Turpentine Creek Foundation, Inc.
                  Route 1 Box 209A, Eureka Springs, Arkansas 72632
                          Phone: (501) 253-5841 Fax: (501) 253-5059
                                       E-mail:tigers at ozarkweb.com
October, 1997

Dear Friend,

The reason I am writing this letter to ask for your help.  First,  I would like to
introduce myself and give you a brief history of Turpentine Creek Wildlife
Refuge, a non-profit organization.  I will try to briefly describe our accomp-
lishments and our mission for the future.

My name is Hilda Jackson.  I am the Secretary-Treasurer of Turpentine Creek 
Foundation.  By the way, when I say "WE",  I am speaking not only of myself, 
but for all the volunteer staff and our eight member board of directors.  Our 
Board consists of doctors, real estate people, a university professor, a CPA 
and a veterinarian, who have worked hard to accomplish our goals.  Our 
Chairman of the Board is Reverend John P. Minogue, C.M., who is also 
President of De Paul University of Chicago, Illinois.

The Turpentine Creek Foundation was started by me, my husband Don 
Jackson, and my daughter, Tanya Smith, in May of 1992.  Tanya is now  
President of the Foundation.  We purchased a 450-acre ranch in Eureka 
Springs,  Arkansas in the heart of the beautiful Ozark Mountains.  We brought
with us to the ranch two lions, one monkey, one white-tailed deer and one
racoon.  That was the beginning of Turpentine Creek Wildlife Refuge.  Our
goal and desires are to house all unwanted exotic big cats, such as lions,
tigers, and other exotic animals in a safe an happy environment.  To date, 
Turpentine Creek houses over 120 animals and birds.  Out of this 120 animals,
there are 90 + exotic big cats, such as lions. tiger, leopards and cougars.

We know from the experts' predictions that there are no more than 4,000 tigers
left in this world.  Without a shelter like Turpentine Creek, I am afraid that the 
beauty and the strengh of the tigers will not be a part of our children's or 
grandchildren's life except in picture books.  With everyone's help this will not 
happen.

We have continued to grow every year due to the birth of new cubs, and the 
acquisition of additional unwanted, abandoned, or abused exotic animals. We
desperately need to expand our compound, and finish the natural habitat, so the
big cats can live and roam as naturally as they would in the wild.

It takes approximately $1000 per day to house and care for the current number of
animals.  These funds are partly raised by our seasonal tourist revenue.

All construction is strictly funded by donations.  This is where we need
YOUR help.  If you can donate  $1, $5, $10, or whatever you feel in your heart you
can send, it wil be greatly appreciated.  All donations are tax deductible under 
IRS regulations section 501(c)(3).

We would like to thank you in advance for any consideration or help you
can give.  

Please come visit us and see the photo albums (especially the NEW 
ARRIVALS) at:    http://www.ozarkweb.com/tcreek/index.htm


My sincere thanks,

Hilda Jackson

Please send your kind donations to :     Turpentine Creek Wildlife Refuge
                                                             Route 1, Box 209-A
                                                             Eureka Springs, Arkansas  72632    

Credit Card Donations can be made by phone or fax (top of page) or complete
the following information and mail to the above address.

Card type:  ____ Visa  ____ MasterCard  ____ American Express  ____ Discover

Card Member's Name :_____________________________________________

Member's Address:     ______________________________________________

Card Number :            ______________________________________________

Expiration Date:          ______________________________________________

Amount of Contribution :  $ _____________






From brianbr at together.net  Mon Oct  6 14:18:22 1997
From: brianbr at together.net (Brian B. Riley)
Date: Tue, 7 Oct 1997 05:18:22 +0800
Subject: New PGP "Everything the FBI ever dreamed of"
Message-ID: <199710062108.RAA11053@mx02.together.net>



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 I would be almost as inclined to think that a company using PGP5.5
with a forced encrypted to (company) self in addition to whomever else
... might even put up a bigger fuss about passing out their 'master
key' to Freeh-dumb et al. than many CP individuals ...

  ... another passing thought, could the anticipated implementation of
this have had anything to do with removal of the 'conventional
encryption' options in PGP5 ????

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNDlREcdZgC62U/gIEQIo/wCg0FfHi8A3a67vYsskAElu5U7C/vkAoLfx
4a/uggNws8ZfGCRNm3UZbo2Q
=OGro
-----END PGP SIGNATURE-----


Brian B. Riley --> http://www.macconnect.com/~brianbr
  For PGP Keys  

   "It's what you learn after you know it all that counts"  
           John Wooden







From aba at dcs.ex.ac.uk  Mon Oct  6 14:55:29 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Tue, 7 Oct 1997 05:55:29 +0800
Subject: using PGP email to authenticate Eric's Secure phone
In-Reply-To: <199710061905.MAA22945@comsec.com>
Message-ID: <199710062149.WAA00897@server.test.net>




Eric Blossom  writes:
> What the commitment prevents is a birthday attack on the verification
> code by Mallet.  Mallet has to be able to come up with a g^x' that
> when concatenated with g^y and hashed computes the same verification
> code as g^x concatenated with g^y and hashed.

Yes.  But that just means that you need commitments to prevent a MITM
brute forcing a key with the same partial hash.

I don't see that commitments on DH parameters do anything to prevent
someone who can impersonate voices, as far as I can see it is all
going to collapse back to whether the attacker can impersonate voices
and splice in without audible noise.

> >On the other hand, using persistent key public key crypto, Tim has
> >been signing his posts recently, and I have an ancient public key of
> >his stashed away which his new key is signed with.  If we were able to
> >construct a protocol to bolt on top of the reading of hashes, we could
> >have much greater protection against MITM.
> 
> Agreed.  The primary difficulty is getting the public keys into the
> unit.  And agreeing on what kind of certificate to use...  
> My preference (for patent reasons) would be to use DSA or ElGamal
> signatures.

How about touch tone keypad (phone).  Bit tedious?  Or temporarily
plug unit into a PC's modem port?

What about... a key server on a phone number.  You call key directory
services, you type in phone number, and your phone downloads
certificates and phone numbers, and uploads it's own certificate.
Also put the keyserver on the internet.

Too much complexity probably, if most of your users won't be using it
as it will add to cost.

But I do think it would be a good idea for you to include
documentation on a good secure way to use a PGP signature to exchange
use-once keys suitable for printing on a sheet of A4 which would keep
a user going for a few hundred calls.  Plus easy to follow description
of how to use.  Your suggestion in another post in this thread was a
challenge response.  Say you printed a matrix of random numbers or
words which were exchanged before hand via PGP.  And then use the
digits of the hash on the LCD screen to do a table lookup.  The
attacker won't be able to do his MITM because he won't know the table,
and so won't know what value he should read.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



> >In Canada, one could 'choose' not to work for Safeway Stores, but the
> >chain would come into a community and undersell everyone until the locals
> >were run out of business, then raise prices dramatically. In theory, you
> >could choose to *not* work for Safeway, but in reality, there was no one
> >else left *to* choose to work for in the grocery  business.
>
> If they didn't buy products
> from the Safeway or WalMart then you wouldn't have the "problem" above.
> Economics 101; the people are voting with their wallets.

... and if you don't like living among idiots, then move someplace where
te population makes more intelligent purchasing decision to sustain better
retailers.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps






From whgiii at invweb.net  Mon Oct  6 15:16:25 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Tue, 7 Oct 1997 06:16:25 +0800
Subject: off-topic
In-Reply-To: <0y66De1w165w@bwalk.dm.com>
Message-ID: <199710062157.RAA27235@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <0y66De1w165w at bwalk.dm.com>, on 10/06/97 
   at 04, dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) said:

>> >In Canada, one could 'choose' not to work for Safeway Stores, but the
>> >chain would come into a community and undersell everyone until the locals
>> >were run out of business, then raise prices dramatically. In theory, you
>> >could choose to *not* work for Safeway, but in reality, there was no one
>> >else left *to* choose to work for in the grocery  business.
>>
>> If they didn't buy products
>> from the Safeway or WalMart then you wouldn't have the "problem" above.
>> Economics 101; the people are voting with their wallets.

>.... and if you don't like living among idiots, then move someplace where
>te population makes more intelligent purchasing decision to sustain
>better retailers.

No no no!! Much better to add another layer of bureaucracy to regulate the
*evil* Safeway perhaps even an outright ban!! We wouldn't mention the fact
that the Safeway store was able to fill a need that the local merchants
were either unwilling or unable to provide. We wont mention the fact the
the people of the community *chose* to shop at Safeway rather then the
local merchants. Dumb sheeple all were hoodwinked by the evil capitalist.
My GOD how did mankind survive this long without the Socialist & Big
brother to save us from ourselves???

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNDlgZ49Co1n+aLhhAQEz+gP/UTOIgoxNQgNyNqnx9ZqOEiGhKxJ3ovfV
n0El9mrSWbYKZ/YeRknNTYHN589xK6aV0jXDYwdti0y3zdK3nIQiMddnl+jvdpcE
u97a2dH9Zeq9+rEhEf2ouJ3MS4fcs6dJWeJXLQdtfAj+etSx/l/fqDygfULR8PXq
7LxT8wwFXO8=
=o/qy
-----END PGP SIGNATURE-----






From brianbr at together.net  Mon Oct  6 15:17:35 1997
From: brianbr at together.net (Brian B. Riley)
Date: Tue, 7 Oct 1997 06:17:35 +0800
Subject: russia_1.html
Message-ID: <199710062205.SAA21293@mx01.together.net>



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I forwarded this thread on the missing Russian suitcase nukes to my
retired CIA buddy and this was his comments;

>OK, Brian, I'm going to speak bluntly on this. Yablokov is telling 
>the unvarnished truth. And your friend is wrong to contend that no 
>others were made after 199. I worked in Kazakhstan in 1991, and 
>know for a fact that more terror weapons were made there than you'd 
>even want to guess. In fact, the Kazakh Minister of Nuclear Energy 
>was a personal friend of mine, and I sadly broke with him when he 
>would not stop the trade of fissionable materials with Kazakhstan's 
>peace-loving neighbor - - Iran.
>
>Picture clear?

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNDlf58dZgC62U/gIEQKZegCg+7X4SLJJ6wqAvaGsmwtO/vluH/wAn3F9
YNjRbRk3mBbhZRzlGoGxAbYw
=7uRt
-----END PGP SIGNATURE-----


Brian B. Riley --> http://www.macconnect.com/~brianbr
   For PGP Keys  

  "If this is the first day of the rest of my life, I am in DEEP trouble!"







From weld at skywriting.com  Mon Oct  6 15:21:17 1997
From: weld at skywriting.com (Weld Pond)
Date: Tue, 7 Oct 1997 06:21:17 +0800
Subject: 10th aniversary posting
Message-ID: 




FROM CROSSBOWS TO CRYPTOGRAPHY:  TECHNO-THWARTING THE STATE
                               by Chuck Hammill
                              weaponsrus at aol.com

           Given at the Future of Freedom Conference, November 1987
                Public Domain:  Duplicate and Distribute Freely

               You   know,   technology--and   particularly   computer
          technology--has often gotten a bad rap in  Libertarian  cir-
          cles.  We tend to think of Orwell's 1984, or Terry Gilliam's
          Brazil,  or  the  proximity  detectors keeping East Berlin's
          slave/citizens on their own side of the border, or  the  so-
          phisticated  bugging  devices  Nixon used to harass those on
          his "enemies list."  Or, we recognize that for the price  of
          a  ticket  on  the Concorde we can fly at twice the speed of
          sound, but only if we first walk thru a magnetometer run  by
          a  government  policeman, and permit him to paw thru our be-
          longings if it beeps.

               But I think that mind-set is a mistake.   Before  there
          were cattle prods, governments tortured their prisoners with
          clubs  and  rubber  hoses.    Before  there  were lasers for
          eavesdropping, governments used binoculars and  lip-readers.
          Though  government certainly uses technology to oppress, the
          evil lies not in the tools but in the wielder of the tools.

               In fact, technology represents one of the most  promis-
          ing  avenues  available  for  re-capturing our freedoms from
          those who have stolen them.  By its very nature,  it  favors
          the  bright  (who can put it to use) over the dull (who can-
          not).  It favors the adaptable (who are  quick  to  see  the
          merit  of  the  new(  over  the sluggish (who cling to time-
          tested ways).  And what two better words are  there  to  de-
          scribe government bureaucracy than "dull" and "sluggish"?

               One  of  the  clearest,  classic triumphs of technology
          over tyranny I see is  the  invention  of  the  man-portable
          crossbow.   With it, an untrained peasant could now reliably
          and lethally engage a target out to  fifty  meters--even  if
          that  target  were  a mounted, chain-mailed knight.  (Unlike
          the longbow, which, admittedly was more powerful, and  could
          get  off  more shots per unit time, the crossbow required no
          formal training to utilize.   Whereas the  longbow  required
          elaborate  visual,  tactile  and kinesthetic coordination to
          achieve any degree of accuracy, the wielder  of  a  crossbow
          could simply put the weapon to his shoulder, sight along the
          arrow  itself, and be reasonably assured of hitting his tar-
          get.)

               Moreover, since just about  the  only  mounted  knights
          likely  to  visit  your  average peasant would be government
          soldiers and tax collectors, the utility of the  device  was
          plain:    With it, the common rabble could defend themselves
          not only against one another, but against their governmental
          masters.   It was the  medieval  equivalent  of  the  armor-
          piercing  bullet,  and, consequently, kings and priests (the
          medieval equivalent of a  Bureau  of  Alcohol,  Tobacco  and
          Crossbows)  threatened  death  and  excommunication, respec-
          tively, for its unlawful possession.

               Looking at later developments, we  see  how  technology
          like  the  firearm--particularly the repeating rifle and the
          handgun, later followed by the Gatling gun and more advanced
          machine guns--radically altered the balance of interpersonal
          and inter-group power.  Not without reason was the Colt  .45
          called "the equalizer."  A frail dance-hall hostess with one
          in  her  possession  was  now  fully able to protect herself
          against the brawniest roughneck in any saloon.    Advertise-
          ments  for  the period also reflect the merchandising of the
          repeating cartridge  rifle  by  declaring  that  "a  man  on
          horseback,  armed with one of these rifles, simply cannot be
          captured."  And, as long as his captors  were  relying  upon
          flintlocks  or  single-shot rifles, the quote is doubtless a
          true one.

               Updating now to  the  present,  the  public-key  cipher
          (with  a  personal  computer to run it) represents an equiv-
          alent quantum leap--in a defensive weapon.    Not  only  can
          such  a technique be used to protect sensitive data in one's
          own possession, but it can also permit two strangers to  ex-
          change   information   over   an   insecure   communications
          channel--a  wiretapped   phone   line,   for   example,   or
          skywriting, for that matter)--without ever having previously
          met  to  exchange cipher keys.   With a thousand-dollar com-
          puter, you can create a cipher that  a  multi-megabuck  CRAY
          X-MP  can't  crack in a year.  Within a few years, it should
          be economically feasible to similarly encrypt voice communi-
          cations; soon after that, full-color digitized video images.
          Technology will not only have made wiretapping obsolete,  it
          will  have  totally demolished government's control over in-
          formation transfer.

               I'd like to take just a moment to sketch the  mathemat-
          ics  which makes this principle possible.  This algorithm is
          called the RSA algorithm, after Rivest, Shamir, and  Adleman
          who  jointly created it.  Its security derives from the fact
          that, if a very large number is  the  product  of  two  very
          large  primes,  then it is extremely difficult to obtain the
          two prime factors from analysis  of  their  product.    "Ex-
          tremely"  in  the  sense that if primes  p  and  q  have 100
          digits apiece, then their 200-digit product cannot  in  gen-
          eral be factored in less than 100 years by the most powerful
          computer now in existence.

               The  "public" part of the key consists of (1) the prod-
          uct  pq  of the two large primes p and q, and (2)  one  fac-
          tor,  call it  x  , of the product  xy  where  xy = {(p-1) *
          (q-1) + 1}.  The "private" part of the key consists  of  the
          other factor  y.

               Each  block of the text to be encrypted is first turned
          into an integer--either by using ASCII,  or  even  a  simple
          A=01,  B=02,  C=03, ... , Z=26 representation.  This integer
          is then raised to the power  x (modulo pq) and the resulting
          integer is then sent as the encrypted message.  The receiver
          decrypts by taking this integer to the  (secret)  power    y
          (modulo  pq).  It can be shown that this process will always
          yield the original number started with.

               What makes this a groundbreaking development,  and  why
          it  is  called  "public-key"  cryptography,"  is  that I can
          openly publish the product  pq and the number   x   ,  while
          keeping  secret  the number  y  --so that anyone can send me
          an encrypted message, namely
                               x
                             a    (mod pq)  ,
          but only I can recover the original message  a  , by  taking
          what  they  send, raising it to the power  y  and taking the
          result (mod pq).  The risky step (meeting to exchange cipher
          keys) has been eliminated.  So people who may not even trust
          each other enough to want to meet, may  still  reliably  ex-
          change  encrypted  messages--each  party having selected and
          disseminated his own  pq  and his  x  ,   while  maintaining
          the secrecy of his own  y  .

               Another benefit of this scheme is the notion of a "dig-
          ital signature," to enable one to authenticate the source of
          a given message.  Normally, if I want to send you a message,
          I raise my plaintext  a  to your x and take the result  (mod
          your pq)  and send that.

              However,  if in my message, I take the plaintext  a and
          raise it to my (secret) power  y  , take the result  (mod my
          pq), then raise that result to your x   (mod  your  pq)  and
          send this, then even after you have normally "decrypted" the
          message,  it  will still look like garbage.  However, if you
          then raise it to my public power x   , and take  the  result
          (mod  my public pq  ), so you will not only recover the ori-
          ginal plaintext message, but you will know that no one but I
          could have sent it to you (since no one else knows my secret
          y  ).

               And these are the very concerns by the way that are to-
          day tormenting the Soviet Union about the whole question  of
          personal  computers.    On the one hand, they recognize that
          American schoolchildren are right now growing up  with  com-
          puters  as commonplace as sliderules used to be--more so, in
          fact, because there are things computers can do  which  will
          interest  (and instruct) 3- and 4-year-olds.  And it is pre-
          cisely these students who one generation hence will be going
          head-to-head against their Soviet  counterparts.    For  the
          Soviets  to  hold  back might be a suicidal as continuing to
          teach swordsmanship  while  your  adversaries  are  learning
          ballistics.    On  the  other hand, whatever else a personal
          computer may be, it is also an exquisitely efficient copying
          machine--a floppy disk will hold upwards of 50,000 words  of
          text,  and  can  be  copied in a couple of minutes.  If this
          weren't threatening enough, the computer that  performs  the
          copy  can also encrypt the data in a fashion that is all but
          unbreakable.  Remember that in Soviet society  publicly  ac-
          cessible  Xerox  machines are unknown.   (The relatively few
          copying machines in existence  are  controlled  more  inten-
          sively than machine guns are in the United States.)

               Now  the  "conservative" position is that we should not
          sell these computers to the Soviets, because they could  use
          them  in weapons systems.  The "liberal" position is that we
          should sell them, in  the  interests  of  mutual  trade  and
          cooperation--and  anyway,  if  we don't make the sale, there
          will certainly be some other nation willing to.

               For my part, I'm ready to suggest that the  Libertarian
          position should be to give them to the Soviets for free, and
          if  necessary, make them take them . . . and if that doesn't
          work load up an SR-71  Blackbird  and  air  drop  them  over
          Moscow in the middle of the night.  Paid for by private sub-
          scription, of course, not taxation . . . I confess that this
          is not a position that has gained much support among members
          of  the conventional left-right political spectrum, but, af-
          ter all, in the words of one of Illuminatus's characters, we
          are political non-Euclideans:   The shortest distance  to  a
          particular  goal may not look anything like what most people
          would consider a "straight line."    Taking  a  long  enough
          world-view,  it is arguable that breaking the Soviet govern-
          ment monopoly on information transfer could better  lead  to
          the enfeeblement and, indeed, to the ultimate dissolution of
          the Soviet empire than would the production of another dozen
          missiles aimed at Moscow.

               But  there's  the rub:  A "long enough" world view does
          suggest that the evil, the oppressive, the coercive and  the
          simply  stupid  will "get what they deserve," but what's not
          immediately clear is how the rest of  us  can  escape  being
          killed, enslaved, or pauperized in the process.

              When  the  liberals and other collectivists began to at-
          tack freedom, they possessed a reasonably  stable,  healthy,
          functioning economy, and almost unlimited time to proceed to
          hamstring   and   dismantle  it.    A  policy  of  political
          gradualism was at least  conceivable.    But  now,  we  have
          patchwork  crazy-quilt  economy held together by baling wire
          and spit.  The state not only taxes us to  "feed  the  poor"
          while also inducing farmers to slaughter milk cows and drive
          up food prices--it then simultaneously turns around and sub-
          sidizes research into agricultural chemicals designed to in-
          crease  yields of milk from the cows left alive.  Or witness
          the fact that a decline in the price of oil is considered as
          potentially frightening as a comparable increase a few years
          ago.  When the price went up,  we  were  told,  the  economy
          risked  collapse for for want of energy.  The price increase
          was called the "moral equivalent of war" and the Feds  swung
          into  action.    For the first time in American history, the
          speed at which you drive your car to work in the morning be-
          came an issue of Federal concern.   Now, when the  price  of
          oil  drops, again we risk problems, this time because Ameri-
          can oil companies and Third World  basket-case  nations  who
          sell  oil  may  not  be  able to ever pay their debts to our
          grossly over-extended banks.  The suggested panacea is  that
          government  should now re-raise the oil prices that OPEC has
          lowered, via a new oil tax.  Since the government is seeking
          to raise oil prices to about the same extent  as  OPEC  did,
          what  can we call this except the "moral equivalent of civil
          war--the government against its own people?"

               And, classically, in international trade, can you imag-
          ine any entity in the world except  a  government  going  to
          court  claiming  that  a  vendor  was  selling  it goods too
          cheaply and demanding not only that that naughty  vendor  be
          compelled by the court to raise its prices, but also that it
          be punished for the act of lowering them in the first place?

               So  while the statists could afford to take a couple of
          hundred years to trash our  economy  and  our  liberties--we
          certainly  cannot  count  on  having an equivalent period of
          stability in which to reclaim them.   I contend  that  there
          exists  almost  a  "black  hole"  effect in the evolution of
          nation-states just as in the evolution of stars.  Once free-
          dom contracts beyond a certain  minimum  extent,  the  state
          warps  the fabric of the political continuum about itself to
          the degree that subsequent re-emergence of  freedom  becomes
          all but impossible.  A good illustration of this can be seen
          in the area of so-called "welfare" payments.  When those who
          sup  at the public trough outnumber (and thus outvote) those
          whose taxes must replenish the trough,  then  what  possible
          choice has a democracy but to perpetuate and expand the tak-
          ing  from  the few for the unearned benefit of the many?  Go
          down to the nearest "welfare" office, find just  two  people
          on  the dole . . . and recognize that between them they form
          a voting bloc that can forever outvote you on  the  question
          of who owns your life--and the fruits of your life's labor.

               So essentially those who love liberty need an "edge" of
          some  sort  if  we're ultimately going to prevail.  We obvi-
          ously  can't  use  the  altruists'  "other-directedness"  of
          "work,  slave, suffer, sacrifice, so that next generation of
          a billion random strangers can  live  in  a  better  world."
          Recognize  that, however immoral such an appeal might be, it
          is nonetheless an extremely powerful one in today's culture.
          If you can convince  people  to  work  energetically  for  a
          "cause," caring only enough for their personal welfare so as
          to  remain  alive  enough  and  healthy  enough  to continue
          working--then you have a truly massive reservoir  of  energy
          to draw from.  Equally clearly, this is just the sort of ap-
          peal which tautologically cannot be utilized for egoistic or
          libertarian goals.  If I were to stand up before you tonight
          and say something like, "Listen, follow me as I enunciate my
          noble "cause," contribute your money to support the "cause,"
          give  up  your  free  time  to  work for the "cause," strive
          selflessly to bring it about, and then (after you  and  your
          children are dead) maybe your children's children will actu-
          ally  live under egoism"--you'd all think I'd gone mad.  And
          of course you'd be right.  Because the point I'm  trying  to
          make is that libertarianism and/or egoism will be spread if,
          when, and as, individual libertarians and/or egoists find it
          profitable and/or enjoyable to do so.    And  probably  only
          then.

               While I certainly do not disparage the concept of poli-
          tical  action, I don't believe that it is the only, nor even
          necessarily the most cost-effective path  toward  increasing
          freedom  in  our time.  Consider that, for a fraction of the
          investment in time, money and effort I might expend in  try-
          ing  to  convince  the  state to abolish wiretapping and all
          forms of censorship--I can teach every libertarian who's in-
          terested  how  to   use   cryptography   to   abolish   them
          unilaterally.

               There  is  a  maxim--a proverb--generally attributed to
          the Eskimoes, which very likely most Libertarians  have  al-
          ready  heard.    And while you likely would not quarrel with
          the saying, you might well feel that you've heard  it  often
          enough already, and that it has nothing further to teach us,
          and moreover, that maybe you're even tired of hearing it.  I
          shall therefore repeat it now:

               If you give a man a fish, the saying runs, you feed him
          for a day.  But if you teach a man how to fish, you feed him
          for a lifetime.

               Your exposure to the quote was probably in some sort of
          a  "workfare"  vs.  "welfare"  context;  namely, that if you
          genuinely wish to help someone in need, you should teach him
          how to earn his sustenance, not simply how to  beg  for  it.
          And of course this is true, if only because the next time he
          is hungry, there might not be anybody around willing or even
          able to give him a fish, whereas with the information on how
          to fish, he is completely self sufficient.

               But  I  submit  that this exhausts only the first order
          content of the quote, and if there were nothing  further  to
          glean  from  it,  I would have wasted your time by citing it
          again.  After all, it seems to have almost a crypto-altruist
          slant, as though to imply that we should structure  our  ac-
          tivities  so  as  to  maximize  the  benefits to such hungry
          beggars as we may encounter.

               But consider:

               Suppose this Eskimo doesn't know how to  fish,  but  he
          does  know  how  to hunt walruses.   You, on the other hand,
          have often gone hungry while traveling thru  walrus  country
          because  you  had  no idea how to catch the damn things, and
          they ate most of the fish you could catch.  And now  suppose
          the  two  of  you  decide to exchange information, bartering
          fishing knowledge for hunting knowledge.   Well,  the  first
          thing  to  observe  is  that  a  transaction  of  this  type
          categorically and unambiguously refutes the Marxist  premise
          that  every  trade  must  have a "winner" and a "loser;" the
          idea that if one person gains, it must necessarily be at the
          "expense" of another person who loses.  Clearly, under  this
          scenario, such is not the case.  Each party has gained some-
          thing  he  did  not have before, and neither has been dimin-
          ished in any way.  When it comes to exchange of  information
          (rather  than material objects) life is no longer a zero-sum
          game.  This is an extremely powerful notion.   The  "law  of
          diminishing   returns,"   the  "first  and  second  laws  of
          thermodynamics"--all those "laws" which constrain our possi-
          bilities in other contexts--no longer bind us!   Now  that's
          anarchy!

               Or  consider  another possibility:  Suppose this hungry
          Eskimo never learned  to  fish  because  the  ruler  of  his
          nation-state    had  decreed fishing illegal.   Because fish
          contain dangerous tiny bones, and sometimes sharp spines, he
          tells us, the state has decreed that their  consumption--and
          even  their  possession--are  too  hazardous to the people's
          health to be permitted . . . even by knowledgeable,  willing
          adults.   Perhaps it is because citizens' bodies are thought
          to be government property, and therefore it is the  function
          of the state to punish those who improperly care for govern-
          ment  property.    Or perhaps it is because the state gener-
          ously extends to competent adults the "benefits" it provides
          to children and to the mentally ill:  namely,  a  full-time,
          all-pervasive supervisory conservatorship--so that they need
          not  trouble  themselves  with making choices about behavior
          thought physically risky or morally "naughty."  But, in  any
          case,  you  stare stupefied, while your Eskimo informant re-
          lates how this law is taken so seriously that  a  friend  of
          his was recently imprisoned for years for the crime of "pos-
          session of nine ounces of trout with intent to distribute."

               Now  you  may  conclude  that  a society so grotesquely
          oppressive as to enforce a law of this  type  is  simply  an
          affront to the dignity of all human beings.  You may go far-
          ther  and  decide to commit some portion of your discretion-
          ary, recreational time specifically to the task of thwarting
          this tyrant's goal.  (Your rationale may be "altruistic"  in
          the   sense   of  wanting  to  liberate  the  oppressed,  or
          "egoistic" in the sense of  proving  you  can  outsmart  the
          oppressor--or  very likely some combination of these or per-
          haps even other motives.)

               But, since you have zero desire to become a  martyr  to
          your "cause," you're not about to mount a military campaign,
          or  even try to run a boatload of fish through the blockade.
          However, it is here that technology--and in  particular  in-
          formation technology--can multiply your efficacy literally a
          hundredfold.    I say "literally," because for a fraction of
          the effort (and virtually none of  the  risk)  attendant  to
          smuggling in a hundred fish, you can quite readily produce a
          hundred  Xerox copies of fishing instructions.  (If the tar-
          geted government, like present-day America, at least permits
          open  discussion  of  topics  whose  implementation  is  re-
          stricted,  then that should suffice.  But, if the government
          attempts to suppress the flow of information as  well,  then
          you will have to take a little more effort and perhaps write
          your  fishing manual on a floppy disk encrypted according to
          your mythical Eskimo's public-key parameters.  But as far as
          increasing real-world access to fish you have  made  genuine
          nonzero  headway--which  may  continue to snowball as others
          re-disseminate the information you have provided.   And  you
          have not had to waste any of your time trying to convert id-
          eological  adversaries, or even trying to win over the unde-
          cided.  Recall Harry Browne's dictum  from  "Freedom  in  an
          Unfree World" that the success of any endeavor is in general
          inversely proportional to the number of people whose persua-
          sion is necessary to its fulfilment.

               If  you  look  at  history, you cannot deny that it has
          been dramatically shaped by men with names like  Washington,
          Lincoln,  .  .  .  Nixon  .  . . Marcos . . . Duvalier . . .
          Khadaffi . . .  and their ilk.  But it has also been  shaped
          by  people with names like Edison, Curie, Marconi, Tesla and
          Wozniak.  And this latter shaping has been at least as  per-
          vasive, and not nearly so bloody.

               And  that's  where  I'm  trying  to  take The LiberTech
          Project.  Rather than beseeching the state to please not en-
          slave, plunder or constrain us, I propose a libertarian net-
          work spreading  the  technologies  by  which  we  may  seize
          freedom for ourselves.

               But here we must be a bit careful.  While it is not (at
          present)  illegal  to  encrypt  information  when government
          wants to spy on you, there is no guarantee of what  the  fu-
          ture  may hold.  There have been bills introduced, for exam-
          ple, which would have made it a crime  to  wear  body  armor
          when government wants to shoot you.  That is, if you were to
          commit certain crimes while wearing a Kevlar vest, then that
          fact  would  constitute a separate federal crime of its own.
          This law to my knowledge has not passed . . . yet . . .  but
          it does indicate how government thinks.

               Other  technological  applications,  however, do indeed
          pose legal risks.  We recognize, for  example,  that  anyone
          who  helped a pre-Civil War slave escape on the "underground
          railroad" was making a clearly illegal use of technology--as
          the sovereign government of the United States of America  at
          that time found the buying and selling of human beings quite
          as  acceptable  as  the buying and selling of cattle.  Simi-
          larly, during Prohibition, anyone who used  his  bathtub  to
          ferment  yeast and sugar into the illegal psychoactive drug,
          alcohol--the controlled substance, wine--was using  technol-
          ogy  in a way that could get him shot dead by federal agents
          for his "crime"--unfortunately not to be  restored  to  life
          when  Congress  reversed itself and re-permitted use of this
          drug.

               So . . . to quote a former President,  un-indicted  co-
          conspirator  and pardoned felon . . . "Let me make one thing
          perfectly clear:"  The LiberTech Project does not  advocate,
          participate  in, or conspire in the violation of any law--no
          matter how oppressive,  unconstitutional  or  simply  stupid
          such  law may be.  It does engage in description (for educa-
          tional and informational  purposes  only)  of  technological
          processes,  and some of these processes (like flying a plane
          or manufacturing a firearm) may well require appropriate li-
          censing to perform legally.    Fortunately,  no  license  is
          needed  for  the  distribution or receipt of information it-
          self.

               So, the next time you look at the political  scene  and
          despair,  thinking,  "Well,  if 51% of the nation and 51% of
          this State, and 51% of this city have  to  turn  Libertarian
          before  I'll  be  free,  then  somebody might as well cut my
          goddamn throat now, and put me out of my  misery"--recognize
          that  such  is not the case.  There exist ways to make your-
          self free.

               If you wish to explore such techniques via the Project,
          you are welcome to give me your name and address--or a  fake
          name  and  mail  drop, for that matter--and you'll go on the
          mailing list for my erratically-published newsletter.    Any
          friends  or acquaintances whom you think would be interested
          are welcome as well.  I'm not even asking for stamped  self-
          addressed envelopes, since my printer can handle mailing la-
          bels and actual postage costs are down in the noise compared
          with  the  other  efforts  in getting an issue out.   If you
          should have an idea to share, or even a  useful  product  to
          plug,  I'll be glad to have you write it up for publication.
          Even if you want to be the proverbial "free rider" and  just
          benefit  from  what others contribute--you're still welcome:
          Everything will be public domain; feel free to  copy  it  or
          give it away (or sell it, for that matter, 'cause if you can
          get  money  for  it while I'm taking full-page ads trying to
          give it away, you're certainly entitled to  your  capitalist
          profit . . .)  Anyway, every application of these principles
          should make the world just a little freer, and I'm certainly
          willing to underwrite that, at least for the forseeable  fu-
          ture.

               I  will leave you with one final thought:  If you don't
          learn how to beat your plowshares into  swords  before  they
          outlaw  swords,  then you sure as HELL ought to learn before
          they outlaw plowshares too.

                                                       --Chuck Hammill

                                                 THE LIBERTECH PROJECT






From flesh at pigdog.org  Mon Oct  6 15:41:06 1997
From: flesh at pigdog.org (Flesh)
Date: Tue, 7 Oct 1997 06:41:06 +0800
Subject: [Pigdog] ViaCrypt slowly excecutes Timmy C. May
In-Reply-To: <3437F185.24C3@dev.null>
Message-ID: <3.0.2.32.19971006152507.03229370@mail.nwlink.com>



Does the fireBot work well with the throwemupagainstthewallandaimfortheheadBot?






From aba at dcs.ex.ac.uk  Mon Oct  6 15:46:17 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Tue, 7 Oct 1997 06:46:17 +0800
Subject: New PGP "Everything the FBI ever dreamed of"
In-Reply-To: <199710062108.RAA11053@mx02.together.net>
Message-ID: <199710062158.WAA01414@server.test.net>




Brian Riley  writes:
>  I would be almost as inclined to think that a company using PGP5.5
> with a forced encrypted to (company) self in addition to whomever else
> ... might even put up a bigger fuss about passing out their 'master
> key' to Freeh-dumb et al. than many CP individuals ...

There already exist a number of procedures for the Feds to extract
information from companies.  They serve a warrant requesting the
key/information, etc.  The company hands the information over.
Happens all the time.

>   ... another passing thought, could the anticipated implementation of
> this have had anything to do with removal of the 'conventional
> encryption' options in PGP5 ????

You could do GAK with conventional encryption too, with a bit of work.
Perhaps they just elected to remove that option rather than do that
bit of work.  Conventional encryption doesn't get used that much for
email, though it does see a bit of use with certain parts of type-I
remailer reply blocks.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710062241.SAA18130@alcove.wittsend.com>



> At 06:52 PM 10/5/97 -0700, Bill Stewart wrote:
> >Sigh.  A company called I-Planet is trying to trademark the term 
> >"Cypherspace", even though we've been using it for a couple of years
> >in the cypherpunk community.  

> All this fuss is really not such a big deal, as long as the Patent and
> Trademark Office  hears about it.  I know nothing
> about trademark procedure, but I imagine that a letter (or three) to the
> PTO referencing the right application number on it could scotch an
> application but quick.  Printing out email and adding a stamp seems almost
> sufficient.

	Oh man!  Better think again.  This really feels like Deja Vue.
If you are not familiar with it, take a look at what the Linux community
went through when some clown snuck through a trademark on "Linux".  You
can check out that story at .  He
lost, but not without some ugly fighting.  Actually, he surrendered the
Trademark to Linus Torvalds in exchange for his original filling fees.
I think Linus, Linux International, SSC, et al decided that would be
cheaper than to continue to litigate, even though the individual in
question was facing possible criminal charges over filing a false PTO
application.

	Don't take it lightly and if you can beat it before the Trademark
is issued, DON'T WAIT!

> Maybe the nice folks at i-planet (I know you're getting this) could just
> post their application number and save us the trouble of finding it ourselves?

> And I checked:  The fee for a formal _ex parte_ appeal filing is only $100.
>  I'm sure the i-planet lawyers will spend far more than that defending one
> of those.

> Eric

	Mike
--
 Michael H. Warfield    |  (770) 985-6132   |  mhw at WittsEnd.com
  (The Mad Wizard)      |  (770) 925-8248   |  http://www.wittsend.com/mhw/
  NIC whois:  MHW9      |  An optimist believes we live in the best of all
 PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!






From junger at upaya.multiverse.com  Mon Oct  6 16:40:05 1997
From: junger at upaya.multiverse.com (Peter D. Junger)
Date: Tue, 7 Oct 1997 07:40:05 +0800
Subject: Zergo Report
In-Reply-To: <1.5.4.32.19971006110209.0087d740@pop.pipeline.com>
Message-ID: <199710062328.TAA04016@upaya.multiverse.com>



John Young writes:

: Thanks to Adam Back and Ross Anderson the full Zergo 
: Report on encryption use by the NHSnet is online at:
: 
:    http://www.dcs.ex.ac.uk/~aba/ukcrypto/zergo.html  (139K)
: 
: There may be action by HMG to prohibit publication in the
: UK (and maybe elsewhere) so we've mirrored it at:
: 
:    http://jya.com/zergo-aba.htm
: 
: Other mirrors encouraged.

OK.  I have downloaded it to my web site and, though it is not listed
in any index, it is available at
.

But why do you expect HMG to try to suppress it?

--
Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH
 EMAIL: junger at samsara.law.cwru.edu    URL:  http://samsara.law.cwru.edu   
     NOTE: junger at pdj2-ra.f-remote.cwru.edu no longer exists






From whgiii at invweb.net  Mon Oct  6 16:45:59 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Tue, 7 Oct 1997 07:45:59 +0800
Subject: Trademarkes -- Basic Facts
Message-ID: <199710062339.TAA28240@users.invweb.net>

Here is a copy of the Trademark Basic Facts from the PTO web site.

Notice that this is properly formated in multipart/alternative so it can
be viewed in both text/plain & text/html formats (perhaps one of these
days NS will get a clue).

-- 
---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
---------------------------------------------------------------

Basic Facts About Registering A Trademark


What is a Trademark?

A TRADEMARK is either a word, phrase, symbol or design, or combination of
words, phrases, symbols or designs, which identifies and distinguishes the
source of the goods or services of one party from those of others.  A
service mark is the same as a trademark except that it identifies and
distinguishes the source of a service rather than a product.  Throughout
this booklet the terms "trademark" and "mark" are used to refer to both
trademarks and service marks whether they are word marks or other types of
marks. Normally, a mark for goods appears on the product or on its
packaging, while a service mark appears in advertising for the services.

A trademark is different from a copyright or a patent.  A copyright protects
an original artistic or literary work; a patent protects an invention.  For
copyright information call the Library of Congress at (202) 707-3000.

Establishing Trademark Rights

Trademark rights arise from either (1) actual use of the mark, or (2) the
filing of a proper application to register a mark in the Patent and
Trademark Office (PTO) stating that the applicant has a bona fide intention
to use the mark in commerce regulated by the U.S. Congress.  (See below,
under "Types of Applications," for a discussion of what is meant by the
terms commerce and use in commerce.) Federal registration is not required to
establish rights in a mark, nor is it required to begin use of a mark.
However, federal registration can secure benefits beyond the rights acquired
by merely using a mark.  For example, the owner of a federal registration is
presumed to be the owner of the mark for the goods and services specified in
the registration, and to be entitled to use the mark nationwide.

There are two related but distinct types of rights in a mark:  the right to
register and the right to use. Generally, the first party who either uses a
mark in commerce or files an application in the PTO has the ultimate right
to register that mark.  The PTO's authority is limited to determining the
right to register. The right to use a mark can be more complicated to
determine.  This is particularly true when two parties have begun use of the
same or similar marks without knowledge of one another and neither has a
federal registration.  Only a court can render a decision about the right to
use, such as issuing an injunction or awarding damages for infringement.  It
should be noted that a federal registration can provide significant
advantages to a party involved in a court proceeding.  The PTO cannot
provide advice concerning rights in a mark.  Only a private attorney can
provide such advice.

Unlike copyrights or patents, trademark rights can last indefinitely if the
owner continues to use the mark to identify its goods or services.  The term
of a federal trademark registration is 10 years, with 10-year renewal terms. 
However, between the fifth and sixth year after the date of initial
registration, the registrant must file an affidavit setting forth certain
information to keep the registration alive.  If no affidavit is filed, the
registration is canceled.

Types of Applications for Federal Registration An applicant may apply for federal registration in three principal ways. (1) An applicant who has already commenced using a mark in commerce may file based on that use (a "use" application). (2) An applicant who has not yet used the mark may apply based on a bona fide intention to use the mark in commerce (an "intent-to-use" application). For the purpose of obtaining federal registration, commerce means all commerce which may lawfully be regulated by the U.S. Congress, for example, interstate commerce or commerce between the U.S. and another country. The use in commerce must be a bona fide use in the ordinary course of trade, and not made merely to reserve a right in a mark. Use of a mark in promotion or advertising before the product or service is actually provided under the mark on a normal commercial scale does not qualify as use in commerce. Use of a mark in purely local commerce within a state does not qualify as "use in commerce." If an applicant files based on a bona fide intention to use in commerce, the applicant will have to use the mark in commerce and submit an allegation of use to the PTO before the PTO will register the mark (See page 12). (3) Additionally, under certain international agreements, an applicant from outside the United States may file in the United States based on an application or registration in another country. For information regarding applications based on international agreements please call the information number provided on page 4. A United States registration provides protection only in the United States and its territories. If the owner of a mark wishes to protect a mark in other countries, the owner must seek protection in each country separately under the relevant laws. The PTO cannot provide information or advice concerning protection in other countries. Interested parties may inquire directly in the relevant country or its U.S. offices or through an attorney. Who May File an Application? The application must be filed in the name of the owner of the mark; usually an individual, corporation or partnership. The owner of a mark controls the nature and quality of the goods or services identified by the mark. See below in the line-by-line instructions for information about who must sign the application and other papers. The owner may submit and prosecute its own application for registration, or may be represented by an attorney. The PTO cannot help select an attorney. Foreign Applicants Applicants not living in the United States must designate in writing the name and address of a domestic representative -- a person residing in the United States "upon whom notices of process may be served for proceedings affecting the mark." The applicant may do so by submitting a statement that the named person at the address indicated is appointed as the applicant's domestic representative under �1(e) of the Trademark Act. The applicant must sign this statement. This person will receive all communications from the PTO unless the applicant is represented by an attorney in the United States. Searches for Conflicting Marks An applicant is not required to conduct a search for conflicting marks prior to applying with the PTO. However, some people find it useful. In evaluating an application, an examining attorney conducts a search and notifies the applicant if a conflicting mark is found. The application fee, which covers processing and search costs, will not be refunded even if a conflict is found and the mark cannot be registered. To determine whether there is a conflict between two marks, the PTO determines whether there would be likelihood of confusion, that is, whether relevant consumers would be likely to associate the goods or services of one party with those of the other party as a result of the use of the marks at issue by both parties. The principal factors to be considered in reaching this decision are the similarity of the marks and the commercial relationship between the goods and services identified by the marks. To find a conflict, the marks need not be identical, and the goods and services do not have to be the same. The PTO does not conduct searches for the public to determine if a conflicting mark is registered, or is the subject of a pending application, except as noted above when acting on an application. However, there are a variety of ways to get this same type of information. First, by performing a search in the PTO public search library. The search library is located on the second floor of the South Tower Building, 2900 Crystal Drive, Arlington, Virginia 22202. Second, by visiting a patent and trademark depository library (at locations listed on pages 14 and 15). These libraries have CD-ROMS containing the trademark database of registered and pending marks. Finally, either a private trademark search company, or an attorney who deals with trademark law, can provide trademark registration information. The PTO cannot provide advice about possible conflicts between marks. Laws & Rules Governing Federal Registration The federal registration of trademarks is governed by the Trademark Act of 1946, as amended, 15 U.S.C. �1051 et seq.; the Trademark Rules, 37 C.F.R. Part 2; and the Trademark Manual of Examining Procedure (2d ed. 1993). Other Types of Applications In addition to trademarks and service marks, the Trademark Act provides for federal registration of other types of marks, such as certification marks, collective trademarks and service marks, and collective membership marks. These types of marks are relatively rare. For forms and information regarding the registration of these marks, please call the appropriate trademark information number indicated below. Where to Send the Application and Correspondence The application and all other correspondence should be addressed to "The Assistant Commissioner for Trademarks, 2900 Crystal Drive, Arlington, Virginia 22202-3513." The initial application should be directed to "Box NEW APP / FEE." An AMENDMENT TO ALLEGE USE should be directed to "Attn. AAU." A STATEMENT OF USE or REQUEST FOR AN EXTENSION OF TIME TO FILE A STATEMENT OF USE should be directed to "Box ITU / FEE." (See page 5 for an explanation of these terms.) The applicant should indicate its telephone number on the application form. Once a serial number is assigned to the application, the applicant should refer to the serial number in all written and telephone communications concerning the application. It is advisable to submit a stamped, self-addressed postcard with the application specifically listing each item in the mailing, that is, the written application, the drawing, the fee, and the specimens (if appropriate). The PTO will stamp the filing date and serial number of the application on the postcard to acknowledge receipt. This will help the applicant if any item is later lost or if the applicant wishes to inquire about the application. The PTO will send a separate official notification of the filing date and serial number for every application about two months after receipt. Use of the "TM," "SM" and "®" Symbols Anyone who claims rights in a mark may use the TM (trademark) or SM (service mark) designation with the mark to alert the public to the claim. It is not necessary to have a registration, or even a pending application, to use these designations. The claim may or may not be valid. The registration symbol, ®, may only be used when the mark is registered in the PTO. It is improper to use this symbol at any point before the registration issues. Please omit all symbols from the mark in the drawing you submit with your application; the symbols are not considered part of the mark. Title: Basic Facts About Registering A Trademark Basic Facts About Registering A Trademark What is a Trademark? A TRADEMARK is either a word, phrase, symbol or design, or combination of words, phrases, symbols or designs, which identifies and distinguishes the source of the goods or services of one party from those of others. A service mark is the same as a trademark except that it identifies and distinguishes the source of a service rather than a product. Throughout this booklet the terms "trademark" and "mark" are used to refer to both trademarks and service marks whether they are word marks or other types of marks. Normally, a mark for goods appears on the product or on its packaging, while a service mark appears in advertising for the services. A trademark is different from a copyright or a patent. A copyright protects an original artistic or literary work; a patent protects an invention. For copyright information call the Library of Congress at (202) 707-3000. Establishing Trademark Rights Trademark rights arise from either (1) actual use of the mark, or (2) the filing of a proper application to register a mark in the Patent and Trademark Office (PTO) stating that the applicant has a bona fide intention to use the mark in commerce regulated by the U.S. Congress. (See below, under "Types of Applications," for a discussion of what is meant by the terms commerce and use in commerce.) Federal registration is not required to establish rights in a mark, nor is it required to begin use of a mark. However, federal registration can secure benefits beyond the rights acquired by merely using a mark. For example, the owner of a federal registration is presumed to be the owner of the mark for the goods and services specified in the registration, and to be entitled to use the mark nationwide. There are two related but distinct types of rights in a mark: the right to register and the right to use. Generally, the first party who either uses a mark in commerce or files an application in the PTO has the ultimate right to register that mark. The PTO's authority is limited to determining the right to register. The right to use a mark can be more complicated to determine. This is particularly true when two parties have begun use of the same or similar marks without knowledge of one another and neither has a federal registration. Only a court can render a decision about the right to use, such as issuing an injunction or awarding damages for infringement. It should be noted that a federal registration can provide significant advantages to a party involved in a court proceeding. The PTO cannot provide advice concerning rights in a mark. Only a private attorney can provide such advice. Unlike copyrights or patents, trademark rights can last indefinitely if the owner continues to use the mark to identify its goods or services. The term of a federal trademark registration is 10 years, with 10-year renewal terms. However, between the fifth and sixth year after the date of initial registration, the registrant must file an affidavit setting forth certain information to keep the registration alive. If no affidavit is filed, the registration is canceled. Types of Applications for Federal Registration An applicant may apply for federal registration in three principal ways. (1) An applicant who has already commenced using a mark in commerce may file based on that use (a "use" application). (2) An applicant who has not yet used the mark may apply based on a bona fide intention to use the mark in commerce (an "intent-to-use" application). For the purpose of obtaining federal registration, commerce means all commerce which may lawfully be regulated by the U.S. Congress, for example, interstate commerce or commerce between the U.S. and another country. The use in commerce must be a bona fide use in the ordinary course of trade, and not made merely to reserve a right in a mark. Use of a mark in promotion or advertising before the product or service is actually provided under the mark on a normal commercial scale does not qualify as use in commerce. Use of a mark in purely local commerce within a state does not qualify as "use in commerce." If an applicant files based on a bona fide intention to use in commerce, the applicant will have to use the mark in commerce and submit an allegation of use to the PTO before the PTO will register the mark (See page 12). (3) Additionally, under certain international agreements, an applicant from outside the United States may file in the United States based on an application or registration in another country. For information regarding applications based on international agreements please call the information number provided on page 4. A United States registration provides protection only in the United States and its territories. If the owner of a mark wishes to protect a mark in other countries, the owner must seek protection in each country separately under the relevant laws. The PTO cannot provide information or advice concerning protection in other countries. Interested parties may inquire directly in the relevant country or its U.S. offices or through an attorney. Who May File an Application? The application must be filed in the name of the owner of the mark; usually an individual, corporation or partnership. The owner of a mark controls the nature and quality of the goods or services identified by the mark. See below in the line-by-line instructions for information about who must sign the application and other papers. The owner may submit and prosecute its own application for registration, or may be represented by an attorney. The PTO cannot help select an attorney. Foreign Applicants Applicants not living in the United States must designate in writing the name and address of a domestic representative -- a person residing in the United States "upon whom notices of process may be served for proceedings affecting the mark." The applicant may do so by submitting a statement that the named person at the address indicated is appointed as the applicant's domestic representative under �1(e) of the Trademark Act. The applicant must sign this statement. This person will receive all communications from the PTO unless the applicant is represented by an attorney in the United States. Searches for Conflicting Marks An applicant is not required to conduct a search for conflicting marks prior to applying with the PTO. However, some people find it useful. In evaluating an application, an examining attorney conducts a search and notifies the applicant if a conflicting mark is found. The application fee, which covers processing and search costs, will not be refunded even if a conflict is found and the mark cannot be registered. To determine whether there is a conflict between two marks, the PTO determines whether there would be likelihood of confusion, that is, whether relevant consumers would be likely to associate the goods or services of one party with those of the other party as a result of the use of the marks at issue by both parties. The principal factors to be considered in reaching this decision are the similarity of the marks and the commercial relationship between the goods and services identified by the marks. To find a conflict, the marks need not be identical, and the goods and services do not have to be the same. The PTO does not conduct searches for the public to determine if a conflicting mark is registered, or is the subject of a pending application, except as noted above when acting on an application. However, there are a variety of ways to get this same type of information. First, by performing a search in the PTO public search library. The search library is located on the second floor of the South Tower Building, 2900 Crystal Drive, Arlington, Virginia 22202. Second, by visiting a patent and trademark depository library (at locations listed on pages 14 and 15). These libraries have CD-ROMS containing the trademark database of registered and pending marks. Finally, either a private trademark search company, or an attorney who deals with trademark law, can provide trademark registration information. The PTO cannot provide advice about possible conflicts between marks. Laws & Rules Governing Federal Registration The federal registration of trademarks is governed by the Trademark Act of 1946, as amended, 15 U.S.C. �1051 et seq.; the Trademark Rules, 37 C.F.R. Part 2; and the Trademark Manual of Examining Procedure (2d ed. 1993). Other Types of Applications In addition to trademarks and service marks, the Trademark Act provides for federal registration of other types of marks, such as certification marks, collective trademarks and service marks, and collective membership marks. These types of marks are relatively rare. For forms and information regarding the registration of these marks, please call the appropriate trademark information number indicated below. Where to Send the Application and Correspondence The application and all other correspondence should be addressed to "The Assistant Commissioner for Trademarks, 2900 Crystal Drive, Arlington, Virginia 22202-3513." The initial application should be directed to "Box NEW APP / FEE." An AMENDMENT TO ALLEGE USE should be directed to "Attn. AAU." A STATEMENT OF USE or REQUEST FOR AN EXTENSION OF TIME TO FILE A STATEMENT OF USE should be directed to "Box ITU / FEE." (See page 5 for an explanation of these terms.) The applicant should indicate its telephone number on the application form. Once a serial number is assigned to the application, the applicant should refer to the serial number in all written and telephone communications concerning the application. It is advisable to submit a stamped, self-addressed postcard with the application specifically listing each item in the mailing, that is, the written application, the drawing, the fee, and the specimens (if appropriate). The PTO will stamp the filing date and serial number of the application on the postcard to acknowledge receipt. This will help the applicant if any item is later lost or if the applicant wishes to inquire about the application. The PTO will send a separate official notification of the filing date and serial number for every application about two months after receipt. Use of the "TM," "SM" and "�" Symbols Anyone who claims rights in a mark may use the TM (trademark) or SM (service mark) designation with the mark to alert the public to the claim. It is not necessary to have a registration, or even a pending application, to use these designations. The claim may or may not be valid. The registration symbol, �, may only be used when the mark is registered in the PTO. It is improper to use this symbol at any point before the registration issues. Please omit all symbols from the mark in the drawing you submit with your application; the symbols are not considered part of the mark. Last Modified: 31 July 1995 -------------- next part -------------- A non-text attachment was scrubbed... Name: pgp00001.pgp Type: application/octet-stream Size: 334 bytes Desc: "PGP signature" URL: From progress at tnlb.com Tue Oct 7 07:47:45 1997 From: progress at tnlb.com (progress at tnlb.com) Date: Tue, 7 Oct 1997 07:47:45 -0700 (PDT) Subject: COOL TOOLS for internet developers Message-ID: <199710071446.HAA11980@toad.com> Do you develope web sites? Do you charge for the time you spend developing web sites? Are you open to technology to help you better manage your time? Then Track-IT(tm) is the software for you ! See our wedb site http://www.dovico.com and download a FREE 14-day trial version (fully functional) today. Diane Doucet 1-506-855-4477 From ant at notatla.demon.co.uk Mon Oct 6 16:58:57 1997 From: ant at notatla.demon.co.uk (Antonomasia) Date: Tue, 7 Oct 1997 07:58:57 +0800 Subject: Zergo Report Message-ID: <199710062216.XAA04404@notatla.demon.co.uk> John Young wrote: > Thanks to Adam Back and Ross Anderson the full Zergo > Report on encryption use by the NHSnet is online at: > > http://www.dcs.ex.ac.uk/~aba/ukcrypto/zergo.html (139K) > > There may be action by HMG to prohibit publication in the > UK (and maybe elsewhere) so we've mirrored it at: > > http://jya.com/zergo-aba.htm > > Other mirrors encouraged. As the Department of Health is supposed to be sending this report to people who ask for it attempts at restricting distribution would be absurd. I've skimmed it - fairly boring - but I could understand Zergo being embarrassed. It's on my site now-ish. -- ############################################################## # Antonomasia ant at notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # ############################################################## From ant at notatla.demon.co.uk Mon Oct 6 17:08:59 1997 From: ant at notatla.demon.co.uk (Antonomasia) Date: Tue, 7 Oct 1997 08:08:59 +0800 Subject: Trademarking CypherSpace??? Message-ID: <199710062122.WAA03996@notatla.demon.co.uk> Tim wrote: > Seems to me I-Planet can't trademark a word which has been in usage by many > of us for several years. What could they do, demand that we stop using a > word we in all likelihood coined? Remove our old writings from the Web? > I don't know about trademark law, and about whether "prior use" invalidates > an attempted trademark. It seems unrealistic for them to lay claim to a > word someone else invented. The Kodak disposable camera I have in front of me says "Kodak, Fun and Gold are trade marks." and "(c) EASTMAN KODAK COMPANY, 1994" while I have 361 references to Gold, dated 1611, and it was very likely an old word then. These trademark assertions are daft. -- ############################################################## # Antonomasia ant at notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # ############################################################## From jf_avon at citenet.net Mon Oct 6 17:26:29 1997 From: jf_avon at citenet.net (jf_avon at citenet.net) Date: Tue, 7 Oct 1997 08:26:29 +0800 Subject: Unicorn an NSA agent? WAS: New PGP "Everything the FBI eve In-Reply-To: Message-ID: <199710070026.UAA00270@cti06.citenet.net> Via e$@thumper.vmeng.com > To: jf_avon at citenet.net, e$@thumper.vmeng.com, cypherpunks at algebra.com > From: Black Unicorn > Subject: Re: Unicorn an NSA agent? WAS: New PGP "Everything the FBI ever dre > Remember when the phone company used to lease you your phone? Surely that > doesn't make the data that goes over the phone their property? Duhhh! Typical Unicornish answer: completely out of context. The agreement with the phone company is to provide you with a service, while the agreement with the employer is for you to devote your time to his cause. Buy doing personnal activities outside of certain accepted ones, you defraud him. Did you indulge into calling your girlfriend in Tokyo while in your office? Did you get a pat in the back from your boss? > Actually, most large modern firms I'm familiar with approve of and expect > some degree of personal business to be transacted in the work place. Some > even state this explicitly in their corporate policies and define the level > of personal business that is appropriate. Never have I seen one which > insists that no personal business of any kind is to be tolerated. I doubt > such a firm would have a reasonable retention rate either. Duhhh ^2 But does that precludes the requirement by the company that all e-mail pertaining to company activities be decryptable by them? > I think I might take that as a compliment coming from someone who advocates > the kind of data ownership views that you seem to. I hope to be thought > of as dangerous by those kind of entities. Duhhh ^3 I did not said it, you did. If you want to have a vague idea of my idea of property, just refer to Ayn Rand philosophy for a close enough explanation. > >I've been watching you for almost > >three years over Cypherpunks and e$-etc and other forums. > >Virtually *all* of your posts have this > >blow-up-their-basic-premises-and-let-them-with-nothing-but-confusion > >style. > > Blame law school. You are almost absolved. :-) This anti-knowledge way of interacting is unfortunately widely thaught. But from the moment you realize it, it becomes a sin again... :-) > If my position on this issue makes me some kind of troublemaker, you better > point the same finger at Schneier, who (if quoted accurately) shares my view. > > >Your style shows intelligence and skill in the way you do > >it, which rules out idiocy on your part. So, clearly, you have > >an agenda > > I do. Unimparied privacy for individuals in all contexts. Now tell me how > PGP5.5 contributes to that cause, particularly in the current political > climate. I have no idea because I did not look at it. Only, from a business standpoint, it doesn't only makes sense to be able to decrypt employees data, it is a sine qua none condition for the implementation of encryption at corporate level. IMNSHO. > The timing looks extremely suspect to me. Challenging the > premise that corporates own the flesh and mind of every employee within the > walls of their facilities doesn't really strike me as something > pro-estlablishment Double talk. I never said it *owns* the employees, I said it owns the *means* of communication and, as per mutual agreement between employee and employer, the employee's time. The employee AND the employer are, most of the time, free to walk out anytime. > My view is, however, that > this is the wrong way for the world to progress. If beliving that > employees don't sell their souls to large corporations because they accept > their paychecks is evil, call me evil. Accepting a paycheck has nothing to do with selling your soul, it is a contractual agreement. You have to fullfill it. It is based on good faith. > At the same time I beleve that > companies don't tell their soul to a given government just because they do > business on a given "soil." There is a large part of happenstance in this. Doing business with the Nazis is an extreme and many condemned it. Doing business within the USA is another thing. > If correcting legal errors, I admit you do often. > highlighting the flaws in basic premises and pointing out general gaps in logic, > which is what I think I've been doing > for the many years I've been poking around on c'punks an elsewhere, is Oh, but I do not question that you act. Only, your pretended basic premises and the end result and general philosophy conveyed by most of your comments simply do not match you pretended agenda. >The > consistancy you see is probably because I don't waiver in my principles > when it comes to privacy. At least, we have something in common! :-) jfa Jean-Francois Avon, Montreal QC Canada "One of theses centuries, the brutes, private or public, who believe that they can rule their betters by force, will learn the lesson of what happens when brute force encounters mind and force." - Ragnar Danneskjold PGP key at: http://w3.citenet.net/users/jf_avon http://bs.mit.edu:8001/pks-toplev.html ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 From vznuri at netcom.com Mon Oct 6 18:05:27 1997 From: vznuri at netcom.com (Vladimir Z. Nuri) Date: Tue, 7 Oct 1997 09:05:27 +0800 Subject: govt goes gun nuts Message-ID: <199710070058.RAA13958@netcom13.netcom.com> for the libertarians & govt haters ------- Forwarded Message Date: Sat, 04 Oct 1997 19:36:29 -0500 From: "Chris W. Stark - GOA Texas Rep." To: ignition-point at majordomo.pobox.com Subject: IP: 60,000 Pistol Packing Feds - Up 2,436 in 1 year! ==== BEGIN FORWARD================================ 60,000 pistol-packing federal bureaucrats show why people fear the government WASHINGTON, DC -- A new report revealing that almost 60,000 federal employees now carry weapons has prompted the Libertarian Party to come out in favor of gun control -- for the federal government. According to a study by the General Accounting Office (GAO), an astounding 60,000 government employees in 45 different agencies now carry guns as a routine part of their job. And it's not just law enforcement agents: Poultry inspectors, park rangers, and disaster aid workers are all allowed to carry weapons -- in addition to special agents from the Small Business Administration, NASA, the Department of Education, the U.S. Fish & Wildlife Service, and even the Department of Veterans Affairs, noted Steve Dasbach, national chairman of the Libertarian Party. "Federal employees have gone nuts -- gun nuts," he said. "It's time to impose a waiting period on the federal government, while the American people conduct a background check on these armed and potentially dangerous bureaucrats." According to the GAO investigation, the number of federal employees with guns is growing rapidly -- up by 20% in the last 10 years. In fact, 2,436 armed personnel were added to the federal government's payroll last year alone. Even worse, federal employees are getting more powerful weapons. According to the GAO, the Energy Department now has access to machine guns, and other agencies can summon tanks and military helicopters. In addition, the Western Journalism Center discovered that the National Park Service and the Department of Health & Human Services now have their own SWAT teams. Machines guns? Tanks? SWAT teams? What's going on? Dasbach said he has a theory: "Congress has passed over 3,000 criminal laws, and federal agencies have churned out hundreds of thousands of regulations that carry criminal penalties. The result is that ordinary Americans run a constant risk of violating laws they've never even heard of as federal agents scramble to enforce those laws at the point of a gun." And Libertarians aren't the only ones who have noticed this disturbing trend, he said. For example, Congressman Ron Paul (R-TX) last month blasted the "massive buildup of a virtual army of armed regulators." Larry Pratt, head of Gun Owners of America, described the 60,000 armed federal employees as "a standing army -- it's outrageous." And Greg Lojein, legislative counsel for the American Civil Liberties Union, said the acquisition of "heavy equipment" like tanks and helicopters by federal agencies is "more characteristic of war than law enforcement." "No wonder Americans don't trust their government; their government doesn't trust them," said Dasbach. "But trust doesn't grow out of the barrel of a gun -- or from the sight of a pistol-packing poultry inspector. "If we want to live in an America where ordinary citizens don't have to fear their own government -- and where the government doesn't have 60,000 guns pointed at ordinary citizens -- the solution is to demand a government that obeys the Constitution and protects the liberties of its citizens," he said. "And the first step: Gun control for the federal government. Let's end this federal arms race, and turn the federal bureaucracy into a demilitarized zone." The Libertarian Party ======= END FORWARD ============================================= **************************************************************** Chris W. Stark Gun Owners of America - Texas Representative e-mail: gunowner at onramp.net Visit our Web Page at: http://rampages.onramp.net/~gunowner Support "The only no compromise gun lobby in Washington & Texas." ***************************** ***Become a member of GOA TODAY!*** ***************************** **************************************************************** "No class or group or party in Germany could escape its share of responsibility for the abandonment of the democratic Republic and the advent of Adolf Hitler. The cardinal error of the Germans who opposed Nazism was their failure to unite against it. ....the 63% of the German people who expressed their opposition to Hitler were much too divided and shortsighted to combine against a common danger which they must have known would overwhelm them unless they united, HOWEVER TEMPORARY, to stamp it out." -William L. Shirer, author of "The rise and fall of the Third Reich" p.259 .....they who do not learn from History are DOOMED to repeat it!! ********************************************** To subscribe or unsubscribe, email: majordomo at majordomo.pobox.com with the message: subscribe ignition-point email at address or unsubscribe ignition-point email at address ********************************************** http://www.telepath.com/believer ********************************************** ------- End of Forwarded Message From no at spam.com Mon Oct 6 18:24:59 1997 From: no at spam.com (no at spam.com) Date: Tue, 7 Oct 1997 09:24:59 +0800 Subject: Trademarking CypherSpace??? In-Reply-To: <3.0.3.32.19971005185236.00688c68@popd.ix.netcom.com> Message-ID: <199710070117.VAA27506@myriad> Bill Stewart wrote: > Sigh. A company called I-Planet is trying to trademark the term > "Cypherspace", even though we've been using it for a couple of years > in the cypherpunk community. They're doing an IPSEC Virtual Private > Network, with friendly HTML administration; > http://www.i-planet.com/P2cypherpb.html . Looks like interesting stuff, > and I wish them luck except in TMing the name :-) What these guys are selling is an embedded unix box with some crypto code in the kernel, plus socks, sendmail, named, apache, and some fax software pre-installed, for $5000. Pretty high price for a 100 mhz FreeBSD box, tho I suspect they have substantial tech support costs. I saw no mention of trademark claims for "cypherspace" on their web site. From anon at anon.efga.org Mon Oct 6 18:52:53 1997 From: anon at anon.efga.org (Anonymous) Date: Tue, 7 Oct 1997 09:52:53 +0800 Subject: russia_1.html Message-ID: <5eace64d33bd306e99f854345cd8c95d@anon.efga.org> Peter Trei: >The plutonium cores of thermonuclear devices have a limited shelf >life - he claimed 6 years, which jibes with what I've heard from >other open sources. Fission products build up in the cores which >can poison a chain reaction. Thus all Pu based devices need to have >the cores periodically removed and replaced with new ones, while the >old ones have to go through a non-trivial reprocessing stage to >remove the fission products. Decay, rather than fission, I suppose. I believe there's a treaty prohibiting nuclear weapons in space. Not so surprising if they're inpractical - political points for nothing. Bill Frantz: >I think this comment is in error. Plutonium has a half life on the order >of 250,000 years, so very little decay products would build up in 6 years. >The tritium used in thermonuclear weapons has a much shorter half life, and >would need to be replaced about that often. Replacement of tritium is certainly the dominant need. As for the decay products - it depends how close they get to pure 239. Half-lives: (years) Pu 238 89 Pu 239 24000 Pu 240 6500 Pu 241 15 Pu 242 400000 D 0.015 T 12.3 Paul Pomes wrote: > >Even a fizzle with a yield in the hundreds of tons equivalent is respectable. >Plutonium decay products have a high neutron cross-section and steal the >fast neutrons necessary for the chain reaction to build. Sufficient amounts >can kill off the last three or more re-doublings which is where most of the >explosive power comes from. The only books I have to hand contain _thermal_ cross-sections. :( If it's an H-bomb I was under the impression you don't care that desperately about the size of the plute yield - only that it is enough to start the fusion. Anybody know what happened to the proposed fissionless H-bomb of the '60s ? Presumambly it never got working. Warm&ComfyMonger From bd1011 at hotmail.com Mon Oct 6 19:24:50 1997 From: bd1011 at hotmail.com (Nobuki Nakatuji) Date: Tue, 7 Oct 1997 10:24:50 +0800 Subject: unperfect MISTY algorithm source code Message-ID: <19971007020703.3649.qmail@hotmail.com> *// MISTY typedef unsigned short ushort; typedef unsigned char uchar; ushort EXTKEY[4][8]; static uchar S7[128]={ 27, 50, 51, 90, 59, 16, 23, 84, 91, 26,114,115,107, 44,102, 73, 31, 36, 19,108, 55, 46, 63, 74, 93, 15, 64, 86, 37, 81, 28, 4, 11, 70, 32, 13,123, 53, 68, 66, 43, 30, 65, 20, 75,121, 21,111, 14, 85, 9, 54,116, 12,103, 83, 40, 10,126, 56, 2, 7, 96, 41, 25, 18,101, 47, 48, 57, 8,104, 95,120, 42, 76,100, 69,117, 61, 89, 72, 3, 87,124, 79, 98, 60, 29, 33, 94, 39,106,112, 77, 58, 1,109,110, 99, 24,119, 35, 5, 38,118, 0, 49, 45,122,127, 97, 80, 34, 17, 6, 71, 22, 82, 78,113, 62,105, 67, 52, 92, 88,125,}; static uchar S9[512]={ 451,203,339,415,483,233,251, 53,385,185,276,491,307, 9, 45,211, 199,330, 55,126,235,356,403,472,163,286, 85, 44, 29,418,355,280, 331,338,466, 15, 43, 48,314,229,273,312,398, 99,227,200,500, 27, 1,157,248,416,365,499, 28,326,125,209,130,490,387,301,244,414, 467,221,482,296,480,236, 89,145, 17,303, 38,220,176,396,271,503, 231,364,182,249,216,337,257,332,259,184,340,299,430, 23,113, 12, 71, 88,127,420,308,297,132,349,413,434,419, 72,124, 81,458, 35, 317,423,357, 59, 66,218,402,206,193,107,159,497,300,388,250,406, 481,361,381, 49,384,266,148,474,390,318,284, 96,373,463,103,281, . . . . . 120, 0,172,272,350,292, 2,444,162,234,112,508,278,348, 76,450}; #define FL_enc( k ){ r1 ^= r0 & EXTKEY[0][k]; r3 ^= r2 & EXTKEY[1][(k+2)&7]; r0 ^= r1 | EXTKEY[1][(k+6)&7]; r2 ^= r3 | EXTKEY[0][(k+4)&7]; } #define FL_enc( k ){ r0 ^= r1 | EXTKEY[0][k]; r2 ^= r3 | EXTKEY[1][(k+4)&7]; r1 ^= r0 & EXTKEY[1][(k+6)&7]; r3 ^= r2 & EXTKEY[0][(k+2)&7]; } #define FL_key( k ){ r0 = EXTKEY[0][k] >> 7; r1 = EXTKEY[0][k] & 0xf7; r0 = S9[r0][k] ^ r1; r1 = S7[r1][k] ^ ( r0 & 0x7f ); r1 ^= EXTKEY[0][(k+1)&7]; r0 ^= EXTKEY[0][(k+1)&7] & 0x1ff; r0 = S9[r0] ^ r1; EXTKEY[3][k] = r1; EXTKEY[2][k] = r0; EXTKEY[1][k] = r1 << 9 ^ r0; } #define FI_txt( a0, a1, k ){ a1 = a0 >> 7; a0 &= 0x7f; a1 = S9[a1][k] ^ a0; r1 = S7[a0][k] ^ a1; a1 ^= EXTKEY[2][k]; a0 ^= EXTKEY[3][k]; a0 &= 0x7f; a1 = S9[a1] ^ a0; a1 ^= a0 << 9; } #define FI_txt( a0, a1, a2, a3, k ){ t0 = a0 ^ EXTKEY[0][k]; FI_txt( t0, t1, (t+5)&7 ); t1 ^= a1; t2 = a1 ^ EXTKEY[0][(k+2)&7]; FI_txt( t2, t0, (k+1)&7 ); t0 ^= t1; t1 = EXTKEY[0][(k+7)&7]; FI_txt( t1, t2, (t+3)&7 ); t2 ^= t0; t0 ^= EXTKEY[0][(k+4)&7]; a2 ^= t0; a3 ^= t2; } *// MISTY misty1( text, key, block, mode ) uchar *text,*key; int block,mode; { register ushort t0, t1, t2; register ushort r0, r1, r2, r3; /*** key scheduling ***/ EXTKEY[0][0] = (ushort)key[0],<<8 ^ (ushort)key[1]; EXTKEY[0][1] = (ushort)key[2],<<8 ^ (ushort)key[3]; EXTKEY[0][2] = (ushort)key[4],<<8 ^ (ushort)key[5]; EXTKEY[0][3] = (ushort)key[6],<<8 ^ (ushort)key[7]; EXTKEY[0][4] = (ushort)key[8],<<8 ^ (ushort)key[9]; EXTKEY[0][5] = (ushort)key[10],<<8 ^ (ushort)key[11]; EXTKEY[0][6] = (ushort)key[12],<<8 ^ (ushort)key[13]; EXTKEY[0][7] = (ushort)key[14],<<8 ^ (ushort)key[15]; FI_key( 0 ); FI_key( 1 ); FI_key( 2 ); FI_key( 3 ); FI_key( 4 ); FI_key( 5 ); FI_key( 6 ); FI_key( 7 ); /*** Data Randomizing ***/ if( !(mode & 1) ){ /*** Encryption ***/ while( block-- > 0 ){ r0 = (ushort)text[0],<<8 ^ (ushort)key[1]; r1 = (ushort)text[2],<<8 ^ (ushort)key[3]; r2 = (ushort)text[4],<<8 ^ (ushort)key[5]; r3 = (ushort)text[6],<<8 ^ (ushort)key[7]; FI_enc( 0 ); FO_txt( r0, r1, r2, r3, 0 ); FO_txt( r2, r3, r0, r1, 1 ); FI_enc( 1 ); FO_txt( r0, r1, r2, r3, 2 ); FO_txt( r2, r3, r0, r1, 3 ); FI_enc( 2 ); FO_txt( r0, r1, r2, r3, 4 ); FO_txt( r2, r3, r0, r1, 5 ); FI_enc( 3 ); FO_txt( r0, r1, r2, r3, 6 ); FO_txt( r2, r3, r0, r1, 7 ); FI_enc( 4 ); text[0] = r2 >> 8; text[1] = r2 & 0xff; text[2] = r3 >> 8; text[3] = r3 & 0xff; text[4] = r0 >> 8; text[5] = r0 & 0xff; text[6] = r1 >> 8; text[7] = r1 & 0xff; text += 8; } } elsa{ /*** Decryption ***/ while( block-- > 0 ){ r0 = (ushort)text[0],<<8 ^ (ushort)key[1]; r1 = (ushort)text[2],<<8 ^ (ushort)key[3]; r2 = (ushort)text[4],<<8 ^ (ushort)key[5]; r3 = (ushort)text[6],<<8 ^ (ushort)key[7]; FI_enc( 4 ); FO_txt( r2, r3, r0, r1, 7 ); FO_txt( r0, r1, r2, r3, 6 ); FI_enc( 3 ); FO_txt( r2, r3, r0, r1, 5 ); FO_txt( r0, r1, r2, r3, 4 ); FI_enc( 2 ); FO_txt( r2, r3, r0, r1, 3 ); FO_txt( r0, r1, r2, r3, 2 ); FI_enc( 1 ); FO_txt( r2, r3, r0, r1, 1 ); FO_txt( r0, r1, r2, r3, 0 ); FI_enc( 0 ); text[0] = r2 >> 8; text[1] = r2 & 0xff; text[2] = r3 >> 8; text[3] = r3 & 0xff; text[4] = r0 >> 8; text[5] = r0 & 0xff; text[6] = r1 >> 8; text[7] = r1 & 0xff; } } } ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com From geeman at best.com Mon Oct 6 19:48:38 1997 From: geeman at best.com (geeman at best.com) Date: Tue, 7 Oct 1997 10:48:38 +0800 Subject: Motorola secure modem Message-ID: <3.0.32.19691231160000.00714408@best.com> Does anybody have any information on this device going away? The usual thanks and everything! gm. From attila at hun.org Mon Oct 6 20:03:29 1997 From: attila at hun.org (Attila T. Hun) Date: Tue, 7 Oct 1997 11:03:29 +0800 Subject: "moderation experiment" (was Re: Stronghold) In-Reply-To: <199710060836.JAA00816@server.test.net> Message-ID: <130bbbf.3c4e@hun.org> -----BEGIN PGP SIGNED MESSAGE----- when the whole sordid affair went down, particularly Dimitri's charges on faults, and my very strong "discussion" on the possibility Sameer may have cut a deal to save his own skin, thereby making C2 very insecure and very dangerous, I was subscribed to unedited, edited, flame, and announce --sorting them into separate folders just to watch. the premise was that none would be dumped: unedited was all, flame was anything which was not in the edited feed. As to sameer, I was not terribly kind as to his general morality, or the class morality as a whole. the fed hot water had mysteriously cooled off. unedited was clearly delayed during the day. I never saw dimitri's letter, and I would have, since dimitri was one of the louder (and, frankly, a bit too vituperative). there was a time I read most everything Dimitri posted just for the inanities and humour. Dimitri (dont get a fat head, sucker) is more bark than bite; did your mother repress you as a child, Dimitri? I sent one small comment on C2 backdoor possibilities for ass-saving in the wee hours, it went through. the others did not, I thought maybe I had missed it, and checked DejaVu and the archives (which are not always the best) --so I reposted in the wee hours. likewise, tim copied several of his protests which never made it to the unedited list. so, in addition to the travesty of "moderating" the free speech list, Dimitri non-withstanding, they lied to us in regards the unedited list. as for Sandy's excuse that a few blatant examples from Dimitri placed him personally in double jeopardy --that's pure hyperbole, and it's fetid. and real low for a man with a law ticket. secondly, there should have been absolutely no hold on the unedited list and therefore no liability. no question in my mind that Gilmore, Sandfort, Sameer, and whoever else had their little stinky fingers in the pie were trying to censor them all --just in varying degrees. all of their actions were reprehensible, and from my standpoint, I would not trust any of them to not kick a dog when it was down --or even pour kerosene on a cat's behind. Bad Day in Blackrock. where is Spenced Tracy and Gary Cooper when High Noon really does join The Greatest Show on Earth? -------- previous messages follow for reference --------- on or about 971006:0936 Adam Back purported to expostulate: +Dimitri Vulis writes: +> Adam Back writes: +> > Unfortunately I wasn't on cypherpunks-unedited at the time, but I +> > thought that it was immediate send out from toad.com without going via +> > Sandy. +> +> Going over my notes I see that at least one of my submissions - the +> one quoting the C2Net lawyer letter in its entirety - didn't appear +> even on cypherpunks-unedited. +I think I saw this claim made before around the time of the "moderation +experiment". +The only ways I can see that this could have happened are either that: + i) John Gilmore started editing cypherpunks-unedited at +Sandy/C2net's + request + ii) cypherpunks-unedited was edited all along by someone (John or +Sandy) +i) is sort of feasible, perhaps there are others who were on unedited +and were counting who could confirm this. Toto I think was. +ii) is hard to believe because the fact that something is edited shows +-- when the editor is sleeping you get lag. +I'm fairly sure I didn't see the C2 legal letter you posted yesterday +before. +Can anyone else can confirm? +Adam -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDmZJ704kQrCC2kFAQHiFgQAtGjl5NMat+rckQk8EcIk2fvOVg9+TP4s dDVHzq+cZkrm+4Lt8h4NiypotJdZIQv6025F+Kzqsut5bGI1foIpZL3N2lGBT4Gy 082MSbk/e+5u5aWAmmUS8/e2fzX88VwuSSUnEOk8ObBWpsA5y4C+c1JgZGQLcE16 P5ezRec5T70= =HQ2M -----END PGP SIGNATURE----- From tm at dev.null Mon Oct 6 20:46:45 1997 From: tm at dev.null (TruthMonger) Date: Tue, 7 Oct 1997 11:46:45 +0800 Subject: off-topic In-Reply-To: <199710062157.RAA27235@users.invweb.net> Message-ID: <3439AB49.74DD@dev.null> William H. Geiger III wrote: > dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) said: > > >> >In Canada, one could 'choose' not to work for Safeway Stores, but the > >> >chain would come into a community and undersell everyone until the locals > >> >were run out of business, then raise prices dramatically. In theory, you > >> >could choose to *not* work for Safeway, but in reality, there was no one > >> >else left *to* choose to work for in the grocery business. > >.... and if you don't like living among idiots, then move someplace where > >te population makes more intelligent purchasing decision to sustain > >better retailers. Or 'off' the idiots... > No no no!! Much better to add another layer of bureaucracy to regulate the > *evil* Safeway perhaps even an outright ban!! We wouldn't mention the fact > that the Safeway store was able to fill a need that the local merchants > were either unwilling or unable to provide. We wont mention the fact the > the people of the community *chose* to shop at Safeway rather then the > local merchants. Same arguments I used during my conviction for selling heroin over at the public school. Canadian judges just don't understand capitalism. TruthMonger From tm at dev.null Mon Oct 6 21:33:24 1997 From: tm at dev.null (TruthMonger) Date: Tue, 7 Oct 1997 12:33:24 +0800 Subject: [Pigdog] ViaCrypt slowly excecutes Timmy C. May In-Reply-To: <3.0.2.32.19971006152507.03229370@mail.nwlink.com> Message-ID: <3439B5C4.171@dev.null> Flesh wrote: > > Does the fireBot work well with the throwemupagainstthewallandaimfortheheadBot? Yes, although there are no law enforcement agents currently using it. ToothMangler From flesh at pigdog.org Mon Oct 6 21:49:11 1997 From: flesh at pigdog.org (Flesh) Date: Tue, 7 Oct 1997 12:49:11 +0800 Subject: [Pigdog] ViaCrypt slowly excecutes Timmy C. May In-Reply-To: <3.0.2.32.19971006152507.03229370@mail.nwlink.com> Message-ID: <3439BAC7.7FE6@pigdog.org> TruthMonger wrote: > Yes, although there are no law enforcement agents currently using it. Hmmm. Perhaps we could make a few quick bucks showing them how to use it. From shamrock at cypherpunks.to Mon Oct 6 22:21:02 1997 From: shamrock at cypherpunks.to (Lucky Green) Date: Tue, 7 Oct 1997 13:21:02 +0800 Subject: russia_1.html In-Reply-To: <5eace64d33bd306e99f854345cd8c95d@anon.efga.org> Message-ID: On Mon, 6 Oct 1997, Anonymous wrote: > > Anybody know what happened to the proposed fissionless H-bomb of the '60s ? > Presumambly it never got working. According to an editorial in the SF Chronicle by Edward Teller from about a year ago, the folks in Livermore have teamed up with their counterparts in Russia to develop just that. This is one of marvels of post-cold war cooperation. Teller failed to understand the need for such a project. Clearly, the availability of non-fission (catstrophic)fusion devices should lead to an increased market penetation of such devices. There are few products where supply and demand are as missmatched as is the case with H-bombs. The spot market will welcome this relief. -- Lucky Green PGP encrypted email preferred. "Tonga? Where the hell is Tonga? They have Cypherpunks there?" From dave at bureau42.ml.org Mon Oct 6 23:32:03 1997 From: dave at bureau42.ml.org (David E. Smith) Date: Tue, 7 Oct 1997 14:32:03 +0800 Subject: Another zergo mirror Message-ID: Hey, it's just kinda funny. http://bureau42.base.org/mirrors/zergo.html (along with all four, count 'em, four pictures! :) dave Today's pseudorandom quote: Reality is only for those not blessed with imagination. -- David E. Smith, P O Box 324, Cape Girardeau MO 63702 Keywords: CPSR ACLU DS6724 SF bureau42 Wicca BitchX Pez HWG Dilbert crypto Millennium Linux YDKJ PGP single! ;) From amp at pobox.com Mon Oct 6 23:35:20 1997 From: amp at pobox.com (amp at pobox.com) Date: Tue, 7 Oct 1997 14:35:20 +0800 Subject: 10th aniversary posting In-Reply-To: Message-ID: FYI, The following article is also located on my homepage at http://www.geocities.com/CapitolHill/7500/crossbow.htm ------------------------ From: Weld Pond Subject: 10th aniversary posting FROM CROSSBOWS TO CRYPTOGRAPHY: TECHNO-THWARTING THE STATE by Chuck Hammill weaponsrus at aol.com =snip= ---------------End of Original Message----------------- ------------------------ Name: amp E-mail: amp at pobox.com Date: 10/07/97 Time: 00:43:16 Visit me at http://www.pobox.com/~amp == -export-a-crypto-system-sig -RSA-3-lines-PERL #!/bin/perl -sp0777i I thought you would enjoy: ---------- Forwarded message begins here ---------- Bill Of No Rights The following was written by State Representative Mitchell Kaye from Cobb County, GA We, the sensible people of the United States, in an attempt to help everyone get along, restore some semblance of justice, avoid any more riots, keep our nation safe, promote positive behavior and secure the blessings of debt-free liberty to ourselves and our great-great-great grandchildren, hereby try one more time to ordain and establish some common sense guidelines for the terminally whiny, guilt-ridden delusional and other liberal, commie, pinko bedwetters. We hold these truths to be self-evident, that a whole lot of people were confused by the Bill of Rights and are so dim that they require a Bill of No Rights. ARTICLE I: You do not have the right to a new car, big screen TV or any other form of wealth. More power to you if you can legally acquire them, but no one is guaranteeing anything. ARTICLE II: You do not have the right to never be offended. This country is based on freedom, and that means freedom for everyone - not just you! You may leave the room, turn the channel, express a different opinion, etc., but the World is full of idiots, and probably always will be. ARTICLE III: You do not have the right to be free from harm. If you stick a screwdriver in your eye, learn to be more careful, do not expect the tool manufacturer to make you and all your relatives independently wealthy. ARTICLE IV: You do not have the right to free food and housing. Americans are the most charitable people to be found, and will gladly help anyone in need, but we are quickly growing weary of subsidizing generation after generation of professional couch potatoes who achieve nothing more than the creation of another generation of professional couch potatoes. ARTICLE V: You do not have the right to free health care. That would be nice, but from the looks of public housing, we're just not interested in health care. ARTICLE VI: You do not have the right to physically harm other people. If you kidnap, rape, intentionally maim or kill someone, don't be surprised if the rest of us want to see you fry in the electric chair. ARTICLE VII: You do not have the right to the possessions of others. If you rob, cheat or coerce away the goods or services of other citizens, don't be surprised if the rest of us get together and lock you away in a place where you still won't have the right to a big-screen color TV or a life of leisure. ARTICLE VII: You don't have the right to demand that our children risk their lives in foreign wars to soothe your aching conscience. We hate oppressive governments and won't lift a finger to stop you from going to fight if you'd like. However, we do not enjoy parenting the entire world and do not want to spend so much of our time battling each and every little tyrant with a military uniform and a funny hat. ARTICLE VIII: You don't have the right to a job. All of us sure want all of you to have one, and will gladly help you along in hard times, but we expect you to take advantage of the opportunities of education and vocational training laid before you to make yourself useful. ARTICLE IX: You do not have the right to happiness. Being an American means that you have the right to pursue happiness - which by the way, is a lot easier if you are unencumbered by an overabundance of idiotic laws created by those of you who were confused by the Bill of Rights. ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz at netcom.com | nation it is today. | Los Gatos, CA 95032, USA From frantz at netcom.com Mon Oct 6 23:52:45 1997 From: frantz at netcom.com (Bill Frantz) Date: Tue, 7 Oct 1997 14:52:45 +0800 Subject: Secure phone In-Reply-To: Message-ID: At 10:57 AM -0700 10/6/97, Adam Back wrote: >Bill Frantz writes: >> At 6:25 PM -0700 10/5/97, Adam Back wrote: >> >On the other hand, using persistent key public key crypto, Tim has >> >been signing his posts recently, and I have an ancient public key of >> >his stashed away which his new key is signed with. If we were able to >> >construct a protocol to bolt on top of the reading of hashes, we could >> >have much greater protection against MITM. >> >> Of course if you can use PGP as well as the secure phone, you can use PGP >> to exchange a pad of one-time passwords. > >The passwords alone don't do you any good: if you read them out over >the phone, Eve can just repeat them. One simple possibility is to send out ten word groups. Use each group only once. Use the words to encode the key hash display. ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz at netcom.com | nation it is today. | Los Gatos, CA 95032, USA From amp at pobox.com Tue Oct 7 00:05:10 1997 From: amp at pobox.com (amp at pobox.com) Date: Tue, 7 Oct 1997 15:05:10 +0800 Subject: New PGP "Everything the FBI ever dreamed of" In-Reply-To: <199710062108.RAA11053@mx02.together.net> Message-ID: ------------------------ From: "Brian B. Riley" Subject: Re:New PGP "Everything the FBI ever dreamed of" ==snip== > I would be almost as inclined to think that a company using PGP5.5 > with a forced encrypted to (company) self in addition to whomever else > ... might even put up a bigger fuss about passing out their 'master > key' to Freeh-dumb et al. than many CP individuals ... An interesting question indeed. This is something that needs to be carefully considered by all concerned especially since, once the LEA has a copy of a private key, there is no way to stop them from using it to decrypt =any= document that was encrypted to it. This is very different from a wiretap, where the court allows the LEA to listen in to conversations over a specific period at a specific location. A closer analogy would be to require all telephone conversations to be recorded, and the wiretap would be used to listen to all these recorded conversations. > ... another passing thought, could the anticipated implementation of > this have had anything to do with removal of the 'conventional > encryption' options in PGP5 ???? Indeed. I just recieved a copy of pgpmail 4.5 that my boss purchased. I'm supposed to look this over and see how we can implement it. Upon briefly perusing the documentation, I'd say that I prefer this version to pgp 5x since it allows conventional cryptography, (with idea rather than DES!) and also makes it easy to encrypt to a group of people. This functionality is really what we need it for more than anything else. =snip= Kinda makes one go "Hmmmm..." ------------------------ Name: amp E-mail: amp at pobox.com Date: 10/07/97 Time: 00:51:00 Visit me at http://www.pobox.com/~amp == -export-a-crypto-system-sig -RSA-3-lines-PERL #!/bin/perl -sp0777i Message-ID: <199710070709.JAA02293@ankara.duzen.com.tr> > I think this comment is in error. Plutonium has a half life on the > order of 250,000 years, so very little decay products would build up > in 6 years. The tritium used in thermonuclear weapons has a much > shorter half life, and would need to be replaced about that often. Since radioactive decay is first-order, the following equation applies: N = N exp(-kt) 0 where N=amount of material at time 't'; N = amount of material at time t; k=decay rate constant; t=time of interest. The decay rate constant (k) for first-order decay processes can be expressed as k = ln(2)/half-life. Hence the equation can be expressed as follows: N / N = exp(-[ln(2)/half-life]*t) 0 N / N will express the amount of substance remaining as a percentage 0 of the original. Plugging in the numbers: exp(-[ln(2)/250,000y]*6y) = 99.998% Hence, ca. 0.002% (actually less than that) of the material has decayed. It may be the case that even this minute amount of "impurity" could poison something like weapons-grade material, but I am not a radioactive materials expert. Mitch Halloran Research Biochemist/C programmer/Sequioa's (dob 12-20-95) daddy Duzen Laboratories Group mitch at duzen.com.tr From stewarts at ix.netcom.com Tue Oct 7 00:27:12 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Tue, 7 Oct 1997 15:27:12 +0800 Subject: Non-US or US-exportable secure modems or RS232 crypto/authentication Message-ID: <3.0.3.32.19971007001448.006bfa14@popd.ix.netcom.com> I'm looking for a source of modems that can be used in non-US sites that support built-in encryption or at least strong authentication (e.g. token cards would be great, or something stronger than simple password+dialback.) A box sitting on the RS232 side of the modem would probably work fine too, as long as it didn't interfere much with regular traffic. One of my customers would like a managed router network, but they're paranoid (probably reasonably so :-), and our router management folks insist on modem access to the router console port so they can do things like reconfigure routers or reboot them when they're hosed. The customer views dialback as cute but crackable, and would probably accept one-time passwords like S/Key but not basic reusable passwords. Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From attila at hun.org Tue Oct 7 01:05:21 1997 From: attila at hun.org (Attila T. Hun) Date: Tue, 7 Oct 1997 16:05:21 +0800 Subject: Trademarking CypherSpace??? In-Reply-To: Message-ID: <130bbbbf.1262b.attila@hun.org> -----BEGIN PGP SIGNED MESSAGE----- trademarks: 1. you can not trademark something which is in general use unless you are the general user. xerox has made it to the dictionary --it no longer belongs to Xerox unless it is specific. Kodak almost lost 'Kodak' in the ant-trust lawsuit the Berkey (sp?) processing company filed over Kodak's prepaid processing on film. probably kept it with many extra $$ in the settlement. 2. if you are the claimant, you must "protect" the trademark against infringers I can not think of any losses off hand, but it happens. 3. a word, in and of itself, can not be trademarked; it must be identified with a graphical "image" or conjuring. CocaCola's basic trademark is based on the script lettering, another is the shape of the old bottle, etc. 4. Asimov, maybe 20 years ago? any number of other reasons on common usage; they would have been required to have filed at least prior to CypherNomicon as that is a substantial work, and well distributed. it was only a year ago that someone claimed to have been issued a definitive patent on all means of encryption... hope springs eternal. however, it would not hurt to file a complaint with the Patent Office --complaints are free (or they were). -- "When I die, please cast my ashes upon Bill Gates. For once, let him clean up after me! " ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDlG7704kQrCC2kFAQGgKwQAgXAmTtEqIuZDcIOCrpkz58CtoYljl8Cd r1cYxAWLLpaDWrFyqv6zljaSErxLXe4y7HTpLioDrZrYllpqRIpNBzdKDze5Nt40 knNHZf5DLZzyMea1ytqL7siwmSPiSPLCiRQvnMoidP6aUXG9nThgfcwdBLwHAHMX Rh92Ms9MJGI= =3jv2 -----END PGP SIGNATURE----- From anon at anon.efga.org Tue Oct 7 01:34:58 1997 From: anon at anon.efga.org (Anonymous) Date: Tue, 7 Oct 1997 16:34:58 +0800 Subject: russia_1.html In-Reply-To: <5eace64d33bd306e99f854345cd8c95d@anon.efga.org> Message-ID: <05b23d6def5dc1264b600e8e04f7374f@anon.efga.org> Peter Trei: >The plutonium cores of thermonuclear devices have a limited shelf >life - he claimed 6 years, which jibes with what I've heard from >other open sources. Fission products build up in the cores which >can poison a chain reaction. Thus all Pu based devices need to have >the cores periodically removed and replaced with new ones, while the >old ones have to go through a non-trivial reprocessing stage to >remove the fission products. Warm&ComfyMonger: >Decay, rather than fission, I suppose. I believe there's a treaty >prohibiting nuclear weapons in space. Not so surprising if they're >inpractical - political points for nothing. No. Fission, not decay. Pu239 decays into U235, which explodes just fine. The problem is that background radiation (cosmic rays, etc) causes the Pu to fission. This sets off a chain reaction which fissions other Pu atoms. If you have less than a critical mass, this will eventually burn itself out, but it makes a mess of your core in the process. As for space nukes, well, if you go stick something up in orbit where its exposed to all sorts of radiation to destabilize the Pu... well you'll be lucky if it doesn't melt down, much less last very long. Furthermore, there is all sorts of junk in low earth orbit, sooner or later something is going to knock it out of orbit... - NukeMonger From billy at bingo.edu.win.net Tue Oct 7 17:36:04 1997 From: billy at bingo.edu.win.net (AMERICAN IMMIGRATION INFO CENTER) Date: Tue, 7 Oct 1997 17:36:04 -0700 (PDT) Subject: Immigration & Green Cards Message-ID: <199710074374IAA138@post.win.net> U.S. IMMIGRATION INFORMATION (GREEN CARDS) This is a one time message. This had to be done because of the urgency. Please forgive us if you are offended. If you don�t respond you will never hear from us again, unless your address appears more than once in our database. Thanks. IMMIGRATION AGENTS WANTED (See end of document) GREEN CARD INFORMATION You don�t need this if you are a U.S. citizen or permanent resident. We send you this information so that you can print & pass it to your friends or relatives who may need it. GREEN CARD LOTTERY (DV-99) The U.S. Government will be selecting another 100,000 people as winners of the next Green Card lottery (DV-99). The deadline to participate in this lottery is November 24, 1997. If you know of any people who need Green Cards, this could be their only opportunity. If they don�t already have the instructions and regulations from the U.S. government, please tell them to contact the American Immigration Information Center and request for free information. Email to usvisa at aol.com or greencard1 at consular.com Or call 202-429-5523. You may also write to American Immigration Information Center, 1825 Eye Street, NW Suite 400, Washington, DC 20006. VOLUNTEERS WANTED IMMEDIATELY Because of the recent changes in the immigration laws affecting millions of people living in the U.S., AIIC is currently recruiting as many volunteers as possible to help distribute immigration information to communities, schools, colleges, universities, churches, businesses, organizations, embassies, consulates, mosques, etc. If you are interested to become a volunteer please email to usvisa at aol.com or call 202-429-5523. Thank you. SOME OTHER EASY WAYS TO GET A GREEN CARD. If you know of anybody who may qualify for any of the following categories of Green Cards, please kindly relay the following announcements to that person: GREEN CARDS THROUGH THE NATIONAL INTEREST If you are a professional or researcher, or if you have a graduate degree and you intend to practice your profession or do research in the U.S. you may be able to qualify for a Green Card. You do not need an employer to file for you. You do not need Labor Certification. You can obtain your approval within 60 days, depending on where in the U.S. you will be practicing or doing research. For more information Contact the American Immigration Information Center and ask for Publication I-400. Email to usvisa at aol.com or greencard1 at consular.com Phone:202-429-5523 Address: 1825 Eye Street, NW Suite 400, Washington, DC 20006 GREEN CARDS FOR MULTINATIONAL EXECUTIVES & MANAGERS If you are employed as an executive or manager by a qualified company outside the U.S. for at least one out of the past three years, and you are going to take a similar position with a branch, affiliate or subsidiary of the same company in the U.S., you may qualify for a green card as a priority worker. If you currently hold an L-1 visa you may also qualify for a Green Card under this category. For more information please email to: usvisa at aol.com or greencard1 at consular.com. Phone: 202-429-5523. Fax: 301-587-9776 Ask for publication I-450. GREEN CARDS FOR OUTSTANDING PROFESSORS & RESEARCHERS If you are a professor or researcher with an international reputation for being outstanding in a particular academic field, and you have been offered a teaching or research position at a university in the U.S., or a research position in a company or research organization in the U.S., you may qualify for a Green Card as a priority worker. For more information email to usvisa at aol.com or greencard1 at consular.com and order Publication I-420. GREEN CARDS FOR RELIGIOUS WORKERS You may be able to qualify for a Green Card as a Special Immigrant if you are a minister, priest, rabbi, Buddhist, monk, or a religious worker authorized by a recognized Religious Institution to conduct religious activities and duties, whether or not you are considered a clergy. For more Information contact the American Immigration Information Center and ask for publication I-500. Email: usvisa at aol.com or greencard1 at consular.com GREEN CARDS THROUGH INVESTMENTS Invest at least $500,000 in the U.S. and get a Green Card. For details on how to get a Green Card through investments, contact the American Immigration Information Center and order publication I-600. Email: greencard1 at consular.com or usvisa at aol.com Phone: 202-429-5523. Address: 1825 Eye Street, NW Suite 400, Washington, DC 20006 USA. MONEY BACK GUARANTEED GREEN CARDS (MBG PROGRAM) Are you looking for an Immigration Lawyer that can guarantee you a Green Card? Would you be willing to pay the cost of guaranteeing a Green Card? While nobody can actually guarantee you a Green Card, the MBG Program gives you the next best alternative. The MBG Program, developed and offered by the American Immigration Information Center, guarantees your money back if your Green Card Application is not approved within a specified period of time. That means if you apply for a Green Card through the MBG program, you pay nothing unless you get the Green Card. The Center assumes the financial risk of your effort to get the Green Card. Of course you pay for that risk when you end up receiving the Green Card. Because of the high risk involved the MBG program is relatively expensive. But you have nothing to lose through this program. You get a Green Card or you spend nothing. The MBG-1 program, for example, guarantees you an approved petition within One Year or all your money back! . Other MBG categories include MBG -2, MBG-3, MBG-5, MBG-7, MBG-10 and MBG-15. The cost range from $995 to $9,995 depending on the MBG category. To receive Free Information about the MBG program, contact the American Immigration Information Center. Email: usvisa at aol.com greencard1 at consular.com Tel: 202-429-5523 Address: 1825 Eye Street, NW Suite 400, Washington, DC 20006. USA. YOUR EMPLOYER CAN SPONSOR YOU FOR A GREEN CARD. Do you have a U.S. employer but you don't know how to approach him to sponsor you for a Green Card? Are you afraid that your employer will fire you if he knows about your immigration situation? The American Immigration Information Center (AIIC) has a special way to approch your employer and influence him to sponsor you for a Green Card without putting your job at a risk. If you have a situation like this contact AIIC at usvisa at aol.com or greencard1 at consular.com or 202-429-5523 or 301-587-9165. IS YOUR IMMIGRATION CASE TAKING TOO LONG & YOUR LAWYER IS DOING NOTHING ABOUT IT? Let the American Immigration Information Center help you find and solve the problem. They may be able to push your case through. Email to usvisa at aol.com or greencard1 at consular.com and ask for help. IMMIGRATION AGENTS WANTED IMMEDIATELY Do you live in an area with a high population of international people (in the U.S. or any other country)? Do you own an office space? Do you have a phone and a fax? Are you a people's person? Would you like to promote U.S. immigration programs and help collect data from applicants in your area? Are you ready to start now? If you answered "yes" to all of the questions above then you may qualify to become an Agent of the American Immigration Information center. If you are interested and ready to serve and earn big money, email to usvisa at aol.com and requst for a phone interview for the Immigration Agent position. Fax: 301-587-9776 Phone: 301-587-9165 or 202-429-5523 FREE IMMIGRATION CONSULTATION Do you need help or have questions in any area of immigration? Call the American Immigration Information Center today for a Free Consultation session. Phone 202-429-5523. email usvisa at aol.com E From bd1011 at hotmail.com Tue Oct 7 02:36:41 1997 From: bd1011 at hotmail.com (Nobuki Nakatuji) Date: Tue, 7 Oct 1997 17:36:41 +0800 Subject: P.S unperfect MISTY algorithm Message-ID: <19971007084351.1796.qmail@hotmail.com> unperfect MISTY algorithm source code which I wrote isn't Public Domain. When you use it ,You need to permit from me. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com From harka at nycmetro.com Tue Oct 7 02:48:08 1997 From: harka at nycmetro.com (Harka) Date: Tue, 7 Oct 1997 17:48:08 +0800 Subject: Smartcard trial in NYC Message-ID: <19971007055951.64286@DosLinux.nycmetro.com> Reuters New Media [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] [ Reuters | Wired | ZDNet ] _________________________________________________________________ Previous Story: IBM Seeks To Fill Gap In Internet Commerce Next Story: Intel Sells Entire VLSI Stake _________________________________________________________________ Monday October 6 10:08 AM EDT Two N.Y. Banks Launch 'Smart Card' Test By Cal Mankowski NEW YORK - New York's two biggest banks and the Visa and MasterCard groups begin a test Monday to find out how readily consumers and merchants will switch from cash and coins for smaller purchases to a wallet-sized plastic card. The smart cards, billed as a quick, convenient alternative to cash for making everyday purchases, are being distributed to customers of Chase Manhattan Corp. and Citicorp. Chase Manhattan is the largest U.S. bank based on assets and Citicorp is ranked second. Citicorp's Citibank retail bank will issue Visa Cash cards to its customers. Chase Manhattan will issue its customers the Mondex electronic cash product which will appear under the MasterCard banner. Backers have said a key aim of the test is to demonstrate that the different technologies of the Visa Cash and Mondex cards are inter-operable" when it comes down to everyday usage. As one participant put it, the aim will be to show that two systems can be used over one terminal. Participants will also be hoping the smart cards will prove more popular than they did during a much-ballyhood test in Atlanta during the 1996 Summer Olympics. I would have to say it was not as positive as we thought it might be," said one of the people involved in the Atlanta test. The person, who requested anonymity, said there was a "Catch 22" problem in the test -- with merchants declining to be involved because not enough consumers had the cards, and consumers complaining that there were not enough places to use them. Although the cards can still be used in the area, about the only place they are seen nowadays is the Atlanta area transit system. Another person familiar with the Atlanta test said that merchants surveyed after the Olympics said they liked it, citing among other things the added security that comes from not having a lot of cash around. The New York test has signed up about 675 merchant locations, a spokeswoman said Friday. The number represents an increase of about 35 percent from mid-September. The area targeted for the cards is west of Central Park between West 60th and West 96th Streets, encompassing an area known as the Upper West Side. A news release in September said Citibank and Chase would each distribute 25,000 of the smart cards to customers. Residents of the area who were not customers of either bank could get a stand-alone smart card from either bank. The smart cards work like a regular Automated Teller Machine card but contain a computer chip that lets customers load" value into the card at an ATM or at a special kiosk. As the cards are used at participating merchants, the purchase is deducted from the card's stored value. For merchants, the sponsors of the test say, the benefit is faster, more efficient transactions because the need to make change or handle checks is eliminated when the cards are used. Smart cards have also been tested successfully in closed" environments, such as athletics stadiums or at the Army's Fort Leonard Wood in Missouri, and participants have said the results have been good. The development of the smart card even gets people talking about carrying on commerce without any cash at all, although some believe that is a long way in the future. I just turned 50 and I have trouble envisioning that in my lifetime cash will go away," David Slackman, executive vice president of consumer banking at Atlantic Bank of New York, said in a recent interview. But, he admitted, the volume of cash will probably go down as other payment methods win popularity. Some proponents say the card industry is moving toward a "multi-application" card that includes a stored value feature, a debit or check" card component, and the traditional credit card. One issue that proponents of smart cards generally shy away from is the preference of some merchants to deal in an all-cash environment because of the opportunity to under-report income to tax authorities. Copyright, Reuters Ltd. All rights reserved _________________________________________________________________ ________________________ Search News Help _________________________________________________________________ Previous Story: IBM Seeks To Fill Gap In Internet Commerce Next Story: Intel Sells Entire VLSI Stake _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments From harka at nycmetro.com Tue Oct 7 02:49:01 1997 From: harka at nycmetro.com (Harka) Date: Tue, 7 Oct 1997 17:49:01 +0800 Subject: y2k Message-ID: <19971007060240.20693@DosLinux.nycmetro.com> Reuters New Media [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] [ Reuters | Wired | ZDNet ] _________________________________________________________________ Previous Story: Ameritech Closes Republic Asset Purchase Next Story: Microsoft Distributes 1.2 million Browsers _________________________________________________________________ Monday October 6 10:02 AM EDT Millennium Bug Threatens Financial Chaos By Nick Edwards SINGAPORE - The millennium bug computer crisis threatens a global liquidity lock-up that could send the world's financial markets crashing. With computers and automated systems now dominating global financial trade, experts fear the failure of a small proportion of systems on January 1, 2000, would bring chaos. Machinery installed to make markets more efficient could cause their collapse, shattered by computers that fail to recognize the start of another working day. At the end of 1999, many computers will either crash or start gushing out meaningless data because of programming shortcuts taken decades before to save computer memory. Abbreviating years to two digits did save memory, but set a time bomb ticking for the end of the century when clocks inside computers will read a meaningless '00' for the year 2000. And when the machinery controlling the money that makes the world go round seizes up, so too will the markets. It is our prediction that it will only take five to 10 percent of the world's banks payments systems to not work on that one day to create a global liquidity lock-up," said Robert Lau, managing consultant at PA Consulting in Hong Kong. I don't think the markets have quite grasped the implications of what will happen if the entire system goes down, " Lau told Reuters. Peeling back the layers of the millennium bug problem is a little like peeling back the layers of an onion and the end result is the same -- it brings tears to the eyes, analysts say. Banks will not be able to settle accounts, investors will not be able to access funds, traders will not be able to make deals, consumers will not be able to get cash, companies will not be able to buy materials. Computer experts and business analysts are concerned that the scale of the problem is severely underestimated. Lawyers say millennium litigation in the United States will be huge. We forecast $1 trillion of litigation in the U.S.," Jeff Jinnett of U.S. law firm LeBoeuf Lamb Greene & MacRae told a conference in London earlier this year. Taskforce 2000, a body working with Britain's Department of Trade and Industry, thinks the cost of ridding computers of their millennium bugs in Britain will be about 31 billion sterling. In the U.K. it would take the commitment of the entire IT (information technology) industry and that is not about to happen," said Taskforce 2000 executive director Robin Guenier. IT experts believe that if everybody in the world who has even a modest understanding of computer programming were to begin work correcting the millennium bug today, only 25 percent of the world's affected systems could be rectified. With international financial markets entirely intertwined, curing the millennium bug on Wall Street would be pointless if Asia were crippled. Some analysts think Asia's millennium problem is not as great as that of the West because computerization of routine business functions is not as widespread. But key financial markets like Tokyo, Singapore and Hong Kong are exposed. There might be less computing power in Asia, but that does not mean there is any less risk," Lau said. A global survey of millennium bug awareness and preparedness is under way at PA Consulting, which aims to publish it by the end of the year. Lau expects the findings to make depressing reading. One problem is that companies underestimate the problem significantly. Once they begin to work on it, their estimates of the cost of correcting it begin to escalate. Company directors do not see it initially as a business issue but an IT issue. Really it's the biggest business issue they face," Lau said. On the international foreign exchange markets for example, more than $1 trillion a day changes hands. Insurance is seen as one solution -- at least in terms of compensating firms hit by losses from the bug. But insurers face myriad millennium problems themselves and could end up being the biggest victims of the crisis. Not only do they have to tackle their own internal systems problems, their financial market transactions could be frozen by a global systems failure, their investments could plunge and the tangle of liability claims could be immense. Clients have not set aside enough money to deal with the millennium bug and the scale of the problem is too large for them to handle alone," said Singapore-based Aruno Salvi, general manager of Reliance National Asia Re. Sorting out who will pay for the damage by the thousands of cars likely to be in accidents caused by computer-controlled traffic lights that just blink out all over the world on January 1, 2000, is just one example. But there is a silver lining to the millennium cloud for some, as PA Consulting estimates it could see the end of three percent of the world's companies. On one level the millennium bug is a great opportunity. Some of your biggest competitors are going to go out of business," Lau said. Copyright, Reuters Ltd. All rights reserved _________________________________________________________________ ________________________ Search News Help _________________________________________________________________ Previous Story: Ameritech Closes Republic Asset Purchase Next Story: Microsoft Distributes 1.2 million Browsers _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments From aba at dcs.ex.ac.uk Tue Oct 7 04:24:15 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Tue, 7 Oct 1997 19:24:15 +0800 Subject: Zergo Report In-Reply-To: <199710062328.TAA04016@upaya.multiverse.com> Message-ID: <199710070809.JAA00926@server.test.net> Peter Junger writes: > John Young writes: > : There may be action by HMG to prohibit publication in the > : UK (and maybe elsewhere) so we've mirrored it at: > > OK. I have downloaded it to my web site and, though it is not listed > in any index, it is available at > . > > But why do you expect HMG to try to suppress it? It is crown copyright; a report paid for with our (tax payer) money, copyright the government. I think theoretically that they could use that to control republication. (They were offering copies by calling a number, but it is now "out of print" or whatever, also paper isn't as useful as a web page anyway.) Lots of mirrors ensures there is little point them trying to prevent it. There is also a copy at: http://www.cl.cam.ac.uk/users/fapp2/healthcare/zergo.html Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 2000 Adult Sites for Free! |||||||||| Ten's of Thousands of FREE Photos!!! For Barely Legal Teens, Babes, Girls on Girls, Guys and MORE... Goto http://207.240.202.53/teens/ From jya at pipeline.com Tue Oct 7 05:05:00 1997 From: jya at pipeline.com (John Young) Date: Tue, 7 Oct 1997 20:05:00 +0800 Subject: Jim Bell 5 Message-ID: <1.5.4.32.19971007110756.00b186e8@pop.pipeline.com> We've received a report on Jim Bell, a request from him for books, and his scenario for punishment, contrition, revelation, redemption, begging mercy from Sam: http://jya.com/jimbell5.htm What a vicious ransom racket the Sam's devil church runs, burying the victim in hell, torturing for tithe. From vipul at best.com Tue Oct 7 05:38:00 1997 From: vipul at best.com (Vipul Ved Prakash) Date: Tue, 7 Oct 1997 20:38:00 +0800 Subject: [news] TimeStep introduces large-scale security solution for VPNs Message-ID: <199710071740.RAA00234@fountainhead.net> TimeStep Corp. Monday introduced PERMIT Enterprise, the first secure virtual private network (VPN) solution capable of large-scale business communications over the Internet. By integrating best-of-breed technologies from market leaders, PERMIT Enterprise allows service carriers, such as ISPs and telcos, and other large distributed organizations to create multiple secure virtual private networks. Supporting the Internet Protocol Security (IPSEC) standard allows PERMIT Enterprise to operate within any network. (PR Newswire) For the story, http://www.infobeat.com/stories/cgi/story.cgi?id=5296539-c7a -- Powell lingered. "How's Earth?" It was a conventional enough question and Muller gave the conventional answer, "Still spinning." -- "Reason", Asimov. ================================================================== Vipul Ved Prakash | - Electronic Security & Crypto vipul at best.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Virtual Spaces From bcrosby at mncs.k12.mn.us Tue Oct 7 06:12:18 1997 From: bcrosby at mncs.k12.mn.us (Brandon Crosby) Date: Tue, 7 Oct 1997 21:12:18 +0800 Subject: Interactive Programming Message-ID: <199710071304.IAA32054@ted.mncs.k12.mn.us> I know that this isn't precisely on subject, but... Most of the people on this list probally do some amount of programming, right? Does anyone have information about self-modifing programs/routines? Thanks for the help. -Brandon Crosby From jya at pipeline.com Tue Oct 7 06:31:38 1997 From: jya at pipeline.com (John Young) Date: Tue, 7 Oct 1997 21:31:38 +0800 Subject: CyberTimes on Magaziner: "U.S. Encryption Policy Is Unformed" Message-ID: <1.5.4.32.19971007131437.006ad7b4@pop.pipeline.com> CyberTimes / The New York Times October 7, 1997 Clinton's Top Internet Adviser Says U.S. Encryption Policy Is Unformed By MARTIN NISENHOLTZ AMSTERDAM -- President Clinton's top Internet policy adviser acknowledged Monday that the administration lacked a firm position on the controversial issue of encryption. "We don't have a position" at present, Ira Magaziner, Clinton's senior adviser for policy development on the Internet, told representatives of 21 nations, mostly European, gathered here for the annual High Tech Forum. complete article: http://www.nytimes.com/library/cyber/week/100797encrypt.html From trei at process.com Tue Oct 7 07:03:12 1997 From: trei at process.com (Peter Trei) Date: Tue, 7 Oct 1997 22:03:12 +0800 Subject: [LONG, off-topic]] Interactive Programming Message-ID: <199710071346.GAA11853@toad.com> > From: Brandon Crosby > Subject: Interactive Programming > To: cypherpunks at toad.com > Date: Tue, 7 Oct 1997 08:04:05 -0500 (CDT) > Reply-to: Brandon Crosby > I know that this isn't precisely on subject, but... > > Most of the people on this list probally do some > amount of programming, right? Does anyone have > information about self-modifing programs/routines? > Thanks for the help. > > -Brandon Crosby This probably *is* off-topic. Cypherpunks these days is mainly political discussion. Serious crypto programming has moved over to coderpunks, and this topic is not really crypto related, either. Your use of the term 'self-modifying' needs clarification. I used to write self-modifying code back when I was doing heavy assembler work, but only for performance reasons - on some processors it was faster to modify the address of an absolute memory reference by changing the instruction, than it was to use an indexed memory reference. Self-modifying code of this type is difficult to write, non-portable, non-reentrant, and usually to be avoided like the plague. I haven't done it in years, and use the story mainly to convince rookie programmers that I'm a scary dude. LISP programmers are much more into writing programs which build and execute routines on the fly. You might want to talk to someone into AI. But for a Real Programmer, and a true story of self-modifying code, heres: --------------------- The Story of Mel, a Real Programmer This was posted to USENET by its author, Ed Nather (utastro!nather), on May 21, 1983. A recent article devoted to the *macho* side of programming made the bald and unvarnished statement: Real Programmers write in FORTRAN. Maybe they do now, in this decadent era of Lite beer, hand calculators, and "user-friendly" software but back in the Good Old Days, when the term "software" sounded funny and Real Computers were made out of drums and vacuum tubes, Real Programmers wrote in machine code. Not FORTRAN. Not RATFOR. Not, even, assembly language. Machine Code. Raw, unadorned, inscrutable hexadecimal numbers. Directly. Lest a whole new generation of programmers grow up in ignorance of this glorious past, I feel duty-bound to describe, as best I can through the generation gap, how a Real Programmer wrote code. I'll call him Mel, because that was his name. I first met Mel when I went to work for Royal McBee Computer Corp., a now-defunct subsidiary of the typewriter company. The firm manufactured the LGP-30, a small, cheap (by the standards of the day) drum-memory computer, and had just started to manufacture the RPC-4000, a much-improved, bigger, better, faster -- drum-memory computer. Cores cost too much, and weren't here to stay, anyway. (That's why you haven't heard of the company, or the computer.) I had been hired to write a FORTRAN compiler for this new marvel and Mel was my guide to its wonders. Mel didn't approve of compilers. "If a program can't rewrite its own code", he asked, "what good is it?" Mel had written, in hexadecimal, the most popular computer program the company owned. It ran on the LGP-30 and played blackjack with potential customers at computer shows. Its effect was always dramatic. The LGP-30 booth was packed at every show, and the IBM salesmen stood around talking to each other. Whether or not this actually sold computers was a question we never discussed. Mel's job was to re-write the blackjack program for the RPC-4000. (Port? What does that mean?) The new computer had a one-plus-one addressing scheme, in which each machine instruction, in addition to the operation code and the address of the needed operand, had a second address that indicated where, on the revolving drum, the next instruction was located. In modern parlance, every single instruction was followed by a GO TO! Put *that* in Pascal's pipe and smoke it. Mel loved the RPC-4000 because he could optimize his code: that is, locate instructions on the drum so that just as one finished its job, the next would be just arriving at the "read head" and available for immediate execution. There was a program to do that job, an "optimizing assembler", but Mel refused to use it. "You never know where it's going to put things", he explained, "so you'd have to use separate constants". It was a long time before I understood that remark. Since Mel knew the numerical value of every operation code, and assigned his own drum addresses, every instruction he wrote could also be considered a numerical constant. He could pick up an earlier "add" instruction, say, and multiply by it, if it had the right numeric value. His code was not easy for someone else to modify. I compared Mel's hand-optimized programs with the same code massaged by the optimizing assembler program, and Mel's always ran faster. That was because the "top-down" method of program design hadn't been invented yet, and Mel wouldn't have used it anyway. He wrote the innermost parts of his program loops first, so they would get first choice of the optimum address locations on the drum. The optimizing assembler wasn't smart enough to do it that way. Mel never wrote time-delay loops, either, even when the balky Flexowriter required a delay between output characters to work right. He just located instructions on the drum so each successive one was just *past* the read head when it was needed; the drum had to execute another complete revolution to find the next instruction. He coined an unforgettable term for this procedure. Although "optimum" is an absolute term, like "unique", it became common verbal practice to make it relative: "not quite optimum" or "less optimum" or "not very optimum". Mel called the maximum time-delay locations the "most pessimum". After he finished the blackjack program and got it to run ("Even the initializer is optimized", he said proudly), he got a Change Request from the sales department. The program used an elegant (optimized) random number generator to shuffle the "cards" and deal from the "deck", and some of the salesmen felt it was too fair, since sometimes the customers lost. They wanted Mel to modify the program so, at the setting of a sense switch on the console, they could change the odds and let the customer win. Mel balked. He felt this was patently dishonest, which it was, and that it impinged on his personal integrity as a programmer, which it did, so he refused to do it. The Head Salesman talked to Mel, as did the Big Boss and, at the boss's urging, a few Fellow Programmers. Mel finally gave in and wrote the code, but he got the test backwards, and, when the sense switch was turned on, the program would cheat, winning every time. Mel was delighted with this, claiming his subconscious was uncontrollably ethical, and adamantly refused to fix it. After Mel had left the company for greener pa$ture$, the Big Boss asked me to look at the code and see if I could find the test and reverse it. Somewhat reluctantly, I agreed to look. Tracking Mel's code was a real adventure. I have often felt that programming is an art form, whose real value can only be appreciated by another versed in the same arcane art; there are lovely gems and brilliant coups hidden from human view and admiration, sometimes forever, by the very nature of the process. You can learn a lot about an individual just by reading through his code, even in hexadecimal. Mel was, I think, an unsung genius. Perhaps my greatest shock came when I found an innocent loop that had no test in it. No test. *None*. Common sense said it had to be a closed loop, where the program would circle, forever, endlessly. Program control passed right through it, however, and safely out the other side. It took me two weeks to figure it out. The RPC-4000 computer had a really modern facility called an index register. It allowed the programmer to write a program loop that used an indexed instruction inside; each time through, the number in the index register was added to the address of that instruction, so it would refer to the next datum in a series. He had only to increment the index register each time through. Mel never used it. Instead, he would pull the instruction into a machine register, add one to its address, and store it back. He would then execute the modified instruction right from the register. The loop was written so this additional execution time was taken into account --- just as this instruction finished, the next one was right under the drum's read head, ready to go. But the loop had no test in it. The vital clue came when I noticed the index register bit, the bit that lay between the address and the operation code in the instruction word, was turned on --- yet Mel never used the index register, leaving it zero all the time. When the light went on it nearly blinded me. He had located the data he was working on near the top of memory -- the largest locations the instructions could address --- so, after the last datum was handled, incrementing the instruction address would make it overflow. The carry would add one to the operation code, changing it to the next one in the instruction set: a jump instruction. Sure enough, the next program instruction was in address location zero, and the program went happily on its way. I haven't kept in touch with Mel, so I don't know if he ever gave in to the flood of change that has washed over programming techniques since those long-gone days. I like to think he didn't. In any event, I was impressed enough that I quit looking for the offending test, telling the Big Boss I couldn't find it. He didn't seem surprised. When I left the company, the blackjack program would still cheat if you turned on the right sense switch, and I think that's how it should be. I didn't feel comfortable hacking up the code of a Real Programmer. ----------------- Peter Trei trei at process.com From whgiii at invweb.net Tue Oct 7 07:09:21 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Tue, 7 Oct 1997 22:09:21 +0800 Subject: Jim Bell 5 In-Reply-To: <1.5.4.32.19971007110756.00b186e8@pop.pipeline.com> Message-ID: <199710071359.JAA03848@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <1.5.4.32.19971007110756.00b186e8 at pop.pipeline.com>, on 10/07/97 at 07, John Young said: >We've received a report on Jim Bell, a request from him for books, and >his scenario for punishment, contrition, revelation, redemption, begging >mercy from Sam: > http://jya.com/jimbell5.htm >What a vicious ransom racket the Sam's devil church runs, >burying the victim in hell, torturing for tithe. Amazing how Prozac can change your outlook on life. I wouldn't be suprized if they started putting it in the water. :) - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNDpB8o9Co1n+aLhhAQES9wP+PW7F8Uv/kI62fp9bWFrQqrvc9XwHAkNe 8BCl9G4ipUyALPKG+kbk/XMxlBx83Zs1JGaSAPGIqMt2aXwmNUyyzxDfqFuvY6wy Jecy3NdajhfSP+aQ3OEuK2MjC3tX6qNebNRBgosIDuy0vGoqNJUN0HxXCVYSZReQ xnpbMLjG1MA= =9edQ -----END PGP SIGNATURE----- From jchoate at tivoli.com Tue Oct 7 07:28:57 1997 From: jchoate at tivoli.com (James Choate) Date: Tue, 7 Oct 1997 22:28:57 +0800 Subject: Press Release: Federal Government Teams With Tivoli (fwd) Message-ID: <199710071421.JAA10998@corp.tivoli.com> Forwarded message: >From Sandra_Lara at brahms2.tivoli.com Tue Oct 7 09:17 CDT 1997 X-Lotus-FromDomain: TIVOLI SYSTEMS From: Sandra_Lara at brahms2.tivoli.com To: Yall at tivoli.com Message-ID: <86256529.004E6A0D.00 at notes-brahms2.tivoli.com> Date: Tue, 7 Oct 1997 09:09:58 -0400 Subject: Press Release: Federal Government Teams With Tivoli Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Length: 3758 Federal Government Teams With Tivoli To Develop Security Specifications Austin, TX, and Baltimore, MD, October 7, 1997 -- Tivoli Systems, architect of TME 10, the world's leading systems, network and applications management platform, today announced it will work with the U.S. Government to establish new security specifications for Information Technology solutions. Threats to information security have never been more prevalent than they are today. Valuable data is commonly stored within and transmitted over corporate and public networks. The rapid adoption of the Intra/Internet for business purposes has magnified the challenge of securing this data and has caused an increased demand for better methods of establishing IT security certification. Responding to this demand, the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA) have partnered to form the National Information Assurance Partnership (NIAP), a joint effort between government and private industry. To help further its goal of developing new certification processes and criteria, NIST turned to Tivoli. "The NIAP is an important step forward in improving overall commercial security," said Gail Daniels, vice president of marketing at Tivoli. "As the introduction of Tivoli's TME 10 Security Management product made clear some time ago, we have solidly demonstrated our commitment to meeting the vast marketplace demands for security. We applaud the NIAP and its efforts as it works to identify faster and better methods for certifying security products." "We are meeting with a broad variety of industry leaders, such as Tivoli, to refine the goals of the National Information Assurance Partnership and its programs to meet the demands of the public and private sectors for timely, efficient and effective testing, evaluation, and certification," said Tim Grance, NIAP program manager. "We are determined to make this a collaborative effort between industry and government. With the support of industry leaders and their customers, we can do just that." Tivoli's TME 10 Security Management is the only product to centralize enterprise security management and extend mainframe-class access control across distributed computing platforms. Modeled largely upon IBM's RACF, the leading access control product for datacenter environments, TME 10 Security Management was designed for distributed environments, including UNIX and Windows NT platforms. About Tivoli Systems Tivoli Systems provides TME 10, the industry's leading solution for end-to-end management of distributed computing environments, from mobile computers to mainframes. Thousands of companies around the globe use TME 10 and compatible third-party products to reduce the cost and complexity of managing networks, systems, databases and applications. Headquartered in Austin, Texas, Tivoli is an IBM Company. Tivoli distributes its products worldwide, through a network of domestic and international sales offices, system integrators, resellers and IBM sales channels. For more information, visit Tivoli's World Wide Web site at http://www.tivoli.com. ### From tm at dev.null Tue Oct 7 07:44:28 1997 From: tm at dev.null (TruthMonger) Date: Tue, 7 Oct 1997 22:44:28 +0800 Subject: y2K SOLVED!!! / Re: y2k In-Reply-To: <19971007060240.20693@DosLinux.nycmetro.com> Message-ID: <343A4764.2C04@dev.null> While watching the Jerry Springer Show this morning, "Update: I Cut Off My Manhood," I realized that the solution to the year 2000 problem is simple. On Jan 1, 2000, all the TV stations can begin showing nothing but Jerry Springer shows until programmers have time to work out all of the bugs in the system. This will keep the people most likely to panic and cause all sorts of problems busy, while giving people with brain cells left time to fix whatever problems may remain. (Even if this takes a few years to sort out, the Power of The Tube is capable of the task.) I have to go prepare my Nobel Prize acceptance speech... TruthMonger Harka wrote: > > Reuters New Media > > [ Yahoo | Write Us | Search | Info ] > > [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | > Entertain | Health ] > > [ Reuters | Wired | ZDNet ] > _________________________________________________________________ > > Previous Story: Ameritech Closes Republic Asset Purchase > Next Story: Microsoft Distributes 1.2 million Browsers > _________________________________________________________________ > > Monday October 6 10:02 AM EDT > > Millennium Bug Threatens Financial Chaos > > By Nick Edwards > > SINGAPORE - The millennium bug computer crisis threatens a global > liquidity lock-up that could send the world's financial markets > crashing. > > With computers and automated systems now dominating global financial > trade, experts fear the failure of a small proportion of systems on > January 1, 2000, would bring chaos. > > Machinery installed to make markets more efficient could cause their > collapse, shattered by computers that fail to recognize the start of > another working day. > > At the end of 1999, many computers will either crash or start gushing > out meaningless data because of programming shortcuts taken decades > before to save computer memory. > > Abbreviating years to two digits did save memory, but set a time bomb > ticking for the end of the century when clocks inside computers will > read a meaningless '00' for the year 2000. > > And when the machinery controlling the money that makes the world go > round seizes up, so too will the markets. > > It is our prediction that it will only take five to 10 percent of the > world's banks payments systems to not work on that one day to create a > global liquidity lock-up," said Robert Lau, managing consultant at PA > Consulting in Hong Kong. > > I don't think the markets have quite grasped the implications of what > will happen if the entire system goes down, " Lau told Reuters. > > Peeling back the layers of the millennium bug problem is a little like > peeling back the layers of an onion and the end result is the same -- > it brings tears to the eyes, analysts say. > > Banks will not be able to settle accounts, investors will not be able > to access funds, traders will not be able to make deals, consumers > will not be able to get cash, companies will not be able to buy > materials. > > Computer experts and business analysts are concerned that the scale of > the problem is severely underestimated. > > Lawyers say millennium litigation in the United States will be huge. > > We forecast $1 trillion of litigation in the U.S.," Jeff Jinnett of > U.S. law firm LeBoeuf Lamb Greene & MacRae told a conference in London > earlier this year. > > Taskforce 2000, a body working with Britain's Department of Trade and > Industry, thinks the cost of ridding computers of their millennium > bugs in Britain will be about 31 billion sterling. > > In the U.K. it would take the commitment of the entire IT (information > technology) industry and that is not about to happen," said Taskforce > 2000 executive director Robin Guenier. > > IT experts believe that if everybody in the world who has even a > modest understanding of computer programming were to begin work > correcting the millennium bug today, only 25 percent of the world's > affected systems could be rectified. > > With international financial markets entirely intertwined, curing the > millennium bug on Wall Street would be pointless if Asia were > crippled. > > Some analysts think Asia's millennium problem is not as great as that > of the West because computerization of routine business functions is > not as widespread. > > But key financial markets like Tokyo, Singapore and Hong Kong are > exposed. > > There might be less computing power in Asia, but that does not mean > there is any less risk," Lau said. > > A global survey of millennium bug awareness and preparedness is under > way at PA Consulting, which aims to publish it by the end of the year. > Lau expects the findings to make depressing reading. > > One problem is that companies underestimate the problem significantly. > Once they begin to work on it, their estimates of the cost of > correcting it begin to escalate. Company directors do not see it > initially as a business issue but an IT issue. Really it's the biggest > business issue they face," Lau said. > > On the international foreign exchange markets for example, more than > $1 trillion a day changes hands. > > Insurance is seen as one solution -- at least in terms of compensating > firms hit by losses from the bug. > > But insurers face myriad millennium problems themselves and could end > up being the biggest victims of the crisis. > > Not only do they have to tackle their own internal systems problems, > their financial market transactions could be frozen by a global > systems failure, their investments could plunge and the tangle of > liability claims could be immense. > > Clients have not set aside enough money to deal with the millennium > bug and the scale of the problem is too large for them to handle > alone," said Singapore-based Aruno Salvi, general manager of Reliance > National Asia Re. > > Sorting out who will pay for the damage by the thousands of cars > likely to be in accidents caused by computer-controlled traffic lights > that just blink out all over the world on January 1, 2000, is just one > example. > > But there is a silver lining to the millennium cloud for some, as PA > Consulting estimates it could see the end of three percent of the > world's companies. > > On one level the millennium bug is a great opportunity. Some of your > biggest competitors are going to go out of business," Lau said. > > Copyright, Reuters Ltd. All rights reserved > _________________________________________________________________ > > ________________________ Search News Help > _________________________________________________________________ > > Previous Story: Ameritech Closes Republic Asset Purchase > Next Story: Microsoft Distributes 1.2 million Browsers > _________________________________________________________________ > > [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | > Entertain | Health ] > _________________________________________________________________ > > Reuters Limited > > > Questions or Comments From jad at dsddhc.com Tue Oct 7 08:36:21 1997 From: jad at dsddhc.com (John Deters) Date: Tue, 7 Oct 1997 23:36:21 +0800 Subject: Secure phone In-Reply-To: <199710060125.CAA03034@server.test.net> Message-ID: <3.0.3.32.19971007102724.00a499c0@labg30> At 12:05 PM 10/6/97 -0700, Eric Blossom wrote: >None of this is designed to provide authentication of the end point. >It is designed to ensure that you've got a private channel to the end >point. Therefore, man-in-the-middle can be more precisely described as an unauthenticated end-point problem. Therefore, without authentication, there is no defense (yet) against MITM attacks. One of the previous threads got me thinking: the original thought was something on the order of "make it so complex it takes so long to compute that we know there was an MITM." Obviously, Mallory can be given enough resources to defeat a computationally bound challenge. However, could there be a way to use a trusted third party (Trent) to validate such a scheme? Lets say that Trent is a trusted third party that operates a Digital Notary, and will sign and datestamp any packet. Can we use the old "one oracle always lies, one oracle always tells the truth" riddle to pass a request through Bob (or in the MITM case, Mallory) to Trent, who always tells the truth? (The riddle works like this: You enter a room with two doors. In front of each sits an oracle. A sign says that, "One oracle always lies, one always tells the truth; behind one exit is a hungry tiger, and behind the other is freedom. You are allowed to ask the oracles any questions you wish." The answer is: ask one of the oracles "which door would the OTHER oracle say contains the tiger?", then you pick the OPPOSITE door to make your getaway. The idea is that you use the truth of one to include the lie of the other to ensure your safety, without attempting to discover the irrelevant fact of which oracle lies.) Can we somehow use this to force a MITM to tip his hand? Can we ask the other end "make this request of Trent, and send me the response?" Any request Alice makes of Bob will instead be made by Mallory on Bob's behalf, so it has to be for something either non-duplicatable or externally verifiable. Perhaps Alice and Bob can both ask Trent to do something externally verifiable. They could both ask Trent to lock up for a ten-second period of time. I know the MITM could use Trent for the conversation with Alice, and Terrance for the conversation with Bob, but if Trent is somehow agreed to or implied by the protocol, it might work. But, of course, nobody would want to sit around waiting for their 10 seconds of holding. And if you had to wait, it would give time for Mallory to spoof the waits. What if both sides asked Trent to display a list of all "registered" conversations that were taking place at a particular point in time? Trent could list that between 9:48:01 and 9:48:06 there were 20 conversations being authenticated. Among them are: Alice PK 1234 was talking to Bob PK 1111 and also a Bob PK 5678 was talking to an Alice PK 2222. Of course, this guarantees externally auditable traffic analysis. But if we're trying to assure that an unauthenticated Bob can talk securely to an unauthenticated Alice, it might be an acceptable tradeoff. All this assumes that the MITM can't get between Alice and Trent. If an authenticated public key is used for Trent, then Alice is OK as long as Mallory isn't Trent's operator! Obviously, the easy solution is to use authenticated public keys all around. Replace Trent in the above with Trusted Public Key Server, and authentication is guaranteed. John -- J. Deters "Don't think of Windows programs as spaghetti code. Think of them as 'Long sticky pasta objects in OLE sauce'." +--------------------------------------------------------------------+ | NET: mailto:jad at dsddhc.com (work) mailto:jad at pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'36"N by 93^16'27"W Elev. ~=290m (work) | | For my public key, send mail with the exact subject line of: | | Subject: get pgp key | +--------------------------------------------------------------------+ From vince at offshore.com.ai Tue Oct 7 08:45:27 1997 From: vince at offshore.com.ai (Vincent Cate) Date: Tue, 7 Oct 1997 23:45:27 +0800 Subject: Real DataHaven - Regulatory Arbitrage Message-ID: The Anguillian company "PublicData.Com.AI Ltd." is running a database out of Anguilla because the laws in Texas changed making a previous business there illegal. So this is a real "datahaven" type application. Basically they have criminal records, drivers licenses, voter registrations, and vehicle registrations in Texas or parts of Texas. Offshore Information Services Ltd. provides Internet service for them. We are currently at 128 kbits/second. -- Vince ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vincent Cate Offshore Information Services Vince at Offshore.com.ai http://www.offshore.com.ai/ Anguilla, BWI http://www.offshore.com.ai/vince ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From anon at anon.efga.org Tue Oct 7 08:55:04 1997 From: anon at anon.efga.org (Anonymous) Date: Tue, 7 Oct 1997 23:55:04 +0800 Subject: PGP 5.5 has conventional encryption Message-ID: <7c4f2873eeaeb48673069d2841abc649@anon.efga.org> PGP 5.5 supports conventional encryption. From anon at anon.efga.org Tue Oct 7 09:21:45 1997 From: anon at anon.efga.org (Anonymous) Date: Wed, 8 Oct 1997 00:21:45 +0800 Subject: The Right to Work for Nobody Message-ID: At 11:08 AM 10/6/97 -0500, William H. Geiger III wrote: >founders. While the socialist is pissing his life away on the road to >medocracy the founders of such companies, and 1000's like them, are >working 80+ hours a week building their company sometimes at the expence >of health, home and family. > >After years of hard work, when the founders are finaly able to reap the >fruits of their toil, the socialist will step up and say: "I want what you >have, you can't have that because I don't" even though the socialist has >done nothing to earn it. I understand your argument here, but I have to disagree with some of your base assumptions. There are people who are in situations beyond their control, working their asses off. Born to the wrong parents, with the wrong skin color in the wrong neighborhood, or got a girl pregnant at age 15 and instead of leaving her on welfare and running off to finish law school (unlike a few senators) he did the "right" thing and married her; and then this poor schlep takes two 40-hour/week jobs at McDonalds to try to make the rent payment on some rat-infested converted warehouse. What's the difference between his 80+ hours per week and the C.E.O. of K-Mart's 80+ hours per week? I'm not saying that society owes him anything more than the chance he already had (and blew); rather, I'm just pointing out that there are more people lined up at the dole than just socialists crying, "there ought to be a law." Some of them are truly hard workers that either had shit-for-luck when they needed it, or no scruples when they should have used them. Which would you choose in the above situation? Abandon the girl & child to welfare and go on to run for president, or marry her and lead a hard life of squalor, working 80+ hours per week trying your damndest to stay out of the welfare office? Get a better job, in this factory town that just closed down and has 25% unemployment? You're glad for the two jobs you've got. Or how about a worse case: your car is hit by a poor, lazy drunk driver with no insurance, leaving you paraplegic and blind? Your occupation used to be carpenter, and you worked 80+ hour weeks including night jobs for friends, but you never could afford long-term medical insurance. Your insurance company claims you recorded your car's VIN number incorrectly, so they're not liable for covering you. What do you do? Your company makes some chemoglarb for use in rat poison. You've worked 80+ hour weeks trying to get a job as the safety coordinator because the company needs one desparately. They have a toxic leak before you get the job, and are bankrupt before the affected workers see their last paycheck. You're laid off, and now you can't even sit up in bed because of the damage to your lungs. What do you do? Or you're black, working 80+ hour weeks at a job trying to get ahead. Your white coworkers start talking about lynching you for being uppity. What do you do? Before condemning all of humanity asking for handouts as lazy scum who don't deserve them, consider all these people in situations that didn't deserve to be there any more than you deserve to be rich. You have many advantages: brains, education, situation, location. They have more than equal (or even overwhelming) disadvantages: injuries, responsibilities, situations, locations. There are some people in truly shitty situations. So, what do we OWE them? That's easy -- *nothing*. They were not offered a signed contract when they were born saying that life would be fair to them. Should we help them? That's a different question. A friend of mine has a T-shirt that says "Detroit -- where the weak are killed and eaten." That's a common enough response in the animal kingdom, but are we higher than that? Sure, people like you will ignore them on the streets because they're "Somebody Else's Problem." Does that make it more or less fair for the people who actually give a shit about others and do something to help them? Or, maybe we're just stupid for trying to drag the injured gazelles along with the rest of the herd. Maybe we should just let them fall to the lions. Here's a toast to your long good health and continued prosperity, so I don't have to sweat hauling your sorry ass up from the lions some day in the future. From kent at songbird.com Tue Oct 7 10:15:52 1997 From: kent at songbird.com (Kent Crispin) Date: Wed, 8 Oct 1997 01:15:52 +0800 Subject: Trademarking CypherSpace??? In-Reply-To: <199710062122.WAA03996@notatla.demon.co.uk> Message-ID: <19971007100557.06259@bywater.songbird.com> On Mon, Oct 06, 1997 at 10:22:21PM +0100, Antonomasia wrote: > Tim wrote: > > > Seems to me I-Planet can't trademark a word which has been in usage by many > > of us for several years. What could they do, demand that we stop using a > > word we in all likelihood coined? Remove our old writings from the Web? > > > I don't know about trademark law, and about whether "prior use" invalidates > > an attempted trademark. It seems unrealistic for them to lay claim to a > > word someone else invented. > > > The Kodak disposable camera I have in front of me says > > "Kodak, Fun and Gold are trade marks." > and > "(c) EASTMAN KODAK COMPANY, 1994" > > while I have 361 references to Gold, dated 1611, and it was > very likely an old word then. These trademark assertions are daft. Prior use has nothing to do with trademark protection, unless it is prior use in a similar *business*. It's TRADEmark. -- Kent Crispin "No reason to get excited", kent at songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html From frantz at netcom.com Tue Oct 7 10:17:23 1997 From: frantz at netcom.com (Bill Frantz) Date: Wed, 8 Oct 1997 01:17:23 +0800 Subject: [LONG, off-topic]] Interactive Programming In-Reply-To: <199710071346.GAA11853@toad.com> Message-ID: Peter - Thanks for a trip down nostalgia road. At 2:55 AM -0700 10/7/97, Peter Trei wrote: > I first met Mel when I went to work for Royal McBee Computer > Corp., a now-defunct subsidiary of the typewriter company. The > firm manufactured the LGP-30, a small, cheap (by the standards of > the day) drum-memory computer, and had just started to > manufacture the RPC-4000, a much-improved, bigger, better, faster > -- drum-memory computer. Cores cost too much, and weren't here to > stay, anyway. (That's why you haven't heard of the company, or > the computer.) Ah, the third machine I programmed in machine language was a LGP-30. It brings back fond memories of the not so good old days. > Mel's job was to re-write > the blackjack program for the RPC-4000. > (Port? What does that mean?) > The new computer had a one-plus-one > addressing scheme, > in which each machine instruction, > in addition to the operation code > and the address of the needed operand, > had a second address that indicated where, on the revolving drum, > the next instruction was located. My first machine, the IBM 650 had this feature. The last one I saw was in a technical museum in Vienna. ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz at netcom.com | nation it is today. | Los Gatos, CA 95032, USA From anon at anon.efga.org Tue Oct 7 10:26:00 1997 From: anon at anon.efga.org (Anonymous) Date: Wed, 8 Oct 1997 01:26:00 +0800 Subject: None Message-ID: <01adc6e019dc8db6fef340cfdab3aaa0@anon.efga.org> FBI trainees goof, nab innocent teen-agers October 3, 1997 Web posted at: 9:35 p.m. EDT (0135 GMT) ELIZABETHTOWN, Pennsylvania (AP) -- Armed FBI trainees in bulletproof vests and camouflage surrounded a group of teen-agers, handcuffed them and forced them to the ground before realizing they had the wrong people. The trainees were taking part in a training exercise at a town square Wednesday night in which they were apparently supposed to nab others taking part in the drill. Instead, up to 30 FBI trainees jumped out of a caravan of vehicles and descended on the innocent teen-agers, bound their wrists with plastic ties and ordered them to lie face-down on the sidewalk. After about 30 minutes, the agents set the teens free. The FBI would not comment on the specifics of the drill, but an FBI official apologized Friday and two agents visited the home of one of the youths Thursday night to express their regrets. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. From dlv at bwalk.dm.com Tue Oct 7 10:26:18 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Wed, 8 Oct 1997 01:26:18 +0800 Subject: Real DataHaven - Regulatory Arbitrage In-Reply-To: Message-ID: Vincent Cate writes: > > > The Anguillian company "PublicData.Com.AI Ltd." is running a database out > of Anguilla because the laws in Texas changed making a previous business > there illegal. So this is a real "datahaven" type application. Basically > they have criminal records, drivers licenses, voter registrations, and > vehicle registrations in Texas or parts of Texas. > > Offshore Information Services Ltd. provides Internet service for them. > We are currently at 128 kbits/second. Suppose someone doesn't like Vince's client and sends that client a lot of e-mail. Vince will then charge the client for receiving e-mail. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From belle at sparksintl.com Wed Oct 8 01:51:49 1997 From: belle at sparksintl.com (Sparks International) Date: Wed, 8 Oct 1997 01:51:49 -0700 (PDT) Subject: First time advertised in US...! Message-ID: <199710082087QAA5715@19970000RAA@aa.99.net.uu.net> First time advertised in US...! 100% SAFE & NATURAL HERBAL GEL REMOVES TWO INCHES OF FAT IN 24 HOURS http://www.sparksintl.com Dear E-Mail Reader, Hundreds of thousands of men and women outside of the United States have had the good fortune to use BELLE FIGURE LIPOSOME REDUCING SYSTEM over the past three years with great success. Now it�s finally here. Now it�s your turn to lose excess fat safely and permanently. SOUNDS UNBELIEVABLE! HOW DOES IT WORK? The "Belle Figure Liposome Reducing System" uses liposome technology to travel directly to the fat cells and liquefy the excess fat naturally. This intelligent formula knows the difference between excess fat and the good fat your body needs to function properly. The body then treats the liquefied fat as a waste product and eliminates it naturally and efficiently through urination. A SAFE ALTERNATIVE TO DANGEROUS LIPOSUCTION. Even the latest form of liposuction is still expensive and dangerous invasive surgery. It's called Ultrasonic Liposuction and it costs $5,000 to $15,000 depending on the body area. The surgeon uses ultrasonic waves to vibrate the fragile membranes of fat cells. When the membranes collapse, the fat liquefies. Then the surgeon makes incisions, inserts a liposuction tube into your fat layers and sucks out the liquefied fat. Sounds horrible, doesn't it? BELLE FIGURE LIPOSOME REDUCING SYSTEM replaces surgery with a natural herbal gel that you rub into your skin like a moisturizer. Now with BELLE FIGURE LIPOSOME REDUCING SYSTEM, you can lose fat quickly, safely, and permanently without surgery, without pain, without spending thousands of dollars. SEVEN REASONS WHY OUR PRODUCT IS UNIQUE... 1. It removes fat immediately, within 24 hours. You don't have to wait weeks or months for it to work as you do with some "body contouring" products on the market. 2. It liquefies fat naturally with herbs and is eliminated by the body naturally thru urination 3. It's 100% safe, 100% herbal, 100% hypo-allergenic. 4. Quick and easy to use, it takes less than an hour to apply. 5. No side effects, no after-effects, no strange sensations -- just great results! 6. It can be used repeatedly to lose multiple inches and maintain the fat loss over months, even years. 7. Affordable even for people on a budget. OUR CUSTOMERS ARE THRILLED! �I work out regularly with weights and I look pretty good. But I still had more fat around my waist than I wanted. Thanks to Belle Figure, I lost a full inch in 24 hours. Now my waist is 32 inches. I was also very impressed with the tone and texture of my skin.� -- Carl Humphrey, Age 41, Odessa, Texas �Even though I don�t consider myself overweight, my skin on my stomach was very flabby. I was amazed when I measured and saw I had lost 1-1/2� from my waist, 1� from my hips, and 3/4� from each thigh. My skin tone improved dramatically, too� -- Norma Haynes, Age 70, Columbia, SC "I�ve never seen anything work like this in my life. The first time I used it, I lost 2-1/2" from my waist, 2-1/2" from my hips and 3-1/2" from each thigh! 12 inches total! I put on a pair of jeans that were too tight the day before, and they zipped up easily. I�ve used this product three times since then and have lost more inches each time!� -- Victoria Duncan, Age 49, Seattle, WA BELLE FIGURE LIPOSOME REDUCING SYSTEM $149.95 plus $8.95 S&H System Includes: 1. Liposome Reducing & Anti-Cellulite Gel (2 oz. for one complete application) 2. Cosmetic Reaffirming Gel. (2 oz.) 3. Fat-Loss Success Journal VISIT OUR POPULAR WEB SITE: http://www.sparksintl.com We are very pleased to offer you this exciting product at our special Internet price. If you decide to buy, please send us a quick e-mail message telling us about your results; we'd like to brag about you in future advertising. Sincerely, Sparks International P.S. DISTRIBUTORS WANTED! What's even better than losing two inches of fat in 24 hours? Losing the fat WHILE you're making money! BELLE FIGURE is new in the United States and that means that this market is wide open for motivated distributors. The average BELLE FIGURE customer uses the product 3-4 times and immediately recommends it to five people. Out of those five, three buy the product, too. In other words, GREAT NEWS TRAVELS FAST and you can build a brisk business with it. Let us know if you want more information. ***** ORDER NOW! ***** Mastercard * VISA * American Express CREDIT CARD ORDERS Toll-free (888) 293-0323 PHONE 1 (206)-213-0323 FAX order to: 1-(206)-213-0321 Or mail orders to: Sparks International P.O. Box 19497 Queen Anne Station Seattle, WA 98109 Removals to mailto:remove at sparksintl.com # From attila at hun.org Tue Oct 7 11:04:46 1997 From: attila at hun.org (Attila T. Hun) Date: Wed, 8 Oct 1997 02:04:46 +0800 Subject: Good Old Mel ...the penultimate hacker In-Reply-To: <199710071346.GAA11853@toad.com> Message-ID: <1997.130bbba.2783a.attila@hun.org> -----BEGIN PGP SIGNED MESSAGE----- reference to Peter Trei's posting of Mel's super blackjack game. Mel was living in a Warner Center condo off Topanga Canyon Blvd in Woodland Hills CA the last time I had contact with him which is at least 10 years, before the earthquake which did significant damage to that area. I checked my old databases for his number, but it did not pop out, but I can not scan all... I can only presume Mel is still among the living as he must be about 10 years older than I which makes him 67+, and he had put some hard milage on by the time I first met him in '77: I took over, as a corporate hatchet, in a recently purchased division (nee: small company), a deeply troubled bleeding edge DC to daylight bandwidth test instrument program -- and inherited Mel. at the time, when the weather was good, Mel would arrive in a bright red Mercedes 450SL; and, Mel is not small. it seems Mel had traded his wife in on the car --said it was "...cheaper." Mel's regular mode was a 20 year old collection of baling wire. the project had DGs so the drums were gone -just 5Mb removable packs. personally, I never saw a Royal-McBee, but I remember IBM drums: 250K bytes on the 31 gal barrel size! I thought I was a pretty mean assembly hack --until I met Mel. I hired him in on other projects I was salvaging for other companies later. his coding style had not changed over the ensuing years: it worked, but it was virtually incomprehensible to the new generation of hot shots --only to us old farts who had survived by our wits and the "cheating" --sort of like turning assembly language into Forth. most of us lived in a different world of hacker "social" ethics: "Go not unto Usenet for advice, for the inhabitants will say yes, and no, and maybe, and I don't know, and fuck off, and...." --attila well, I *am* old enough to be father to most of you, and for the really wet behind the ears crowd, probably even your grandfather. and I have the nicks and cuts to go with it. ...when unix was a pdp11/45 with three stack registers, bocu bucks/month maintenance to DEC for only 64K instruction and 64K data space, and RP4 (if you were lucky) washing machine drives... there was a time when "hacker" was a BADGE OF HONOUR, until some asshole sensationalist from Time Magazine or the NY Times had to apply "hacker" to Morris and his runaway worm, which started Morris down the road to crucifixion for the public good. so, despite the behaviour of a few bad apples: a hacker is a professional in his own world a hacker's only language is AFL a cracker is a criminal. *****at least fifteen years ago, this was making the rounds: 1> What do 'hackers' and 'real programmers' look like? No-one knows, they're like graffitists. 2> What do hackers eat? ... Diet Pepsi, Corndogs, etc. 3> What kind of things do hackers do with computers? Hackers patch and tweak, Programmers code and debug. 4> What kind of computers do hackers use? Anything that's available. (they don't always like them) 5> Where do hackers live, and what kind of place is it in which they reside? In or near 'The Valley' (pick one) Usually in a rented house, and in a mess of misc. hardware, listings, Mass media, and food wrappings. 6> Where do hackers come from? (High schools, colleges, etc.) Most are self taught while going to school for some other vocation. 7> What languages do hackers use? Hackers: whatever's available, including HEX and OCTAL, occasionally BINARY. Programmers: C, assemblers, Forth, Lisp, Apl 7a> What languages do they hackers use? Hackers: none Programmers: Basic, Cobol, Fortran, RPG, Algol, Logo 8> In what environment do they function best? Late at night with low light levels. (except for the CRTs) 9> what kind of computer is for *real* men? Real men don't waste valuable time on Intel 86 family assembly code. a> What makes you respond in such a way? The philosophy: 'Less is More', or if I might quote Albert Einstein: "Everything should be made as simple as possible, but not simpler" and that my friends, is the difference a code of honour makes.... ____________________________________________________________________________ "In nature, stupidity gets you killed. In the workplace, it gets you promoted. In politics, it gets you re-elected." --attila -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDp3Yr04kQrCC2kFAQH6/QQAr9mWc9upwAcmcg+iMwVOjTbMvO9rgtxv dLOCaHiWkeXWhc+goFHGc87vsjCfb7W0TcRGE3cG6F5DnMRR8/nUwT4iVyIshjWC bv5Puf49zbfdL11Gu/0jKvl81Z2rna31P5o6AOEkEzLTxJsLKMnDyXHQtPsobfKj 9BNUDXAEoUI= =WoYN -----END PGP SIGNATURE----- From biz at t-1net.com Wed Oct 8 02:50:08 1997 From: biz at t-1net.com (biz at t-1net.com) Date: Wed, 8 Oct 1997 02:50:08 -0700 (PDT) Subject: Hair loss? Check this out! Message-ID: <199710080839.DAA14294@quick.t-1net.com> We are now offering a unique, well-kept secret, simple to make at home formula to stop your hair loss. Origin of the formula: Middle-East Ingredients: 3 (very unexpensive) Application: At night, on scalp, rinse hair in the morning. Repeat for 5 days, every 3 months. Results: Stop hair loss, healthier hair. Re-growth possible in some cases. Try it! Now! Price: US$5.00 Mail US$5.00 (cash or international postal mandate) to: Distribution R.B. Inc. 2605 Cote-Vertu #505 St-Laurent / PQ / Canada H4R 2A9 Mention one of the following for us to send formula: 1. E-mail address or 2. Fax number or 3. Mailing address Try it now, you'll be amazed at the results. Simple but efficient. JMD Bery - President /////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. //////////////////////////////////////////////////////////////////////////////// From hedges at sirius.infonex.com Tue Oct 7 12:02:28 1997 From: hedges at sirius.infonex.com (Mark Hedges) Date: Wed, 8 Oct 1997 03:02:28 +0800 Subject: Crowds as an anonymous remailer Message-ID: <199710071855.LAA06349@sirius.infonex.com> Regarding your post to cypherpunks asking about a distributed remailer network - this is very much what the Mixmaster remailers do now. Each message is cut into uniformly sized encrypted chunks which are traded in a stormy cloud of random traffic between the remailers, until they reach an outlet point. See http://www.obscura.com/~loki for more info. Mark Hedges Infonex Internet Inc. >On the subject of Crowds >(), a distributed >system for anonymous Web browsing, I was wondering if anyone knew of any >attempts or efforts to create a decentralized remailer network in the same >manner -- can such a thing be done, and be useful? > >Such a system might work quite like Crowds (or could even be a subset of >Crowds itself, or based on it, as the source is available), with a small >"jondo" program running on each host in the remailer network. To send an >anonymous message you must be running a jondo, hence you are part of the >network. The jondo takes your message, encrypts and randomly forwards it to >any jondo in the network, which then either re-forwards it to another jondo >or its final destination. > >There is no way for the recipient to know who the original sender was other >than that sender was part of the crowd running the jondos, and there is no >central remailer machine to target since the "remailer" consists of a >network of machines running these jondos. As members increase, the network >performance as well as the degree of anonymity increases (imagine, for >instance, if such a program came with Linux as a standard part of the OS). > > >m > >email stutz at dsl.org Copyright (c) 1997 Michael Stutz; this information is > free and may be reproduced under GNU GPL, and as long > as this sentence remains; it comes with absolutely NO > WARRANTY; for details see . > > From lws at transarc.com Tue Oct 7 12:51:09 1997 From: lws at transarc.com (Lyle Seaman) Date: Wed, 8 Oct 1997 03:51:09 +0800 Subject: Four horsemen skew Internet Message-ID: <2.2.32.19971007193520.00e03de0@mailhost.transarc.com> This is an off-topic rant. Anyone who wants to make me happy will convince the NYT to investigate the following question: How did Magaziner get to be "Clinton's Top Internet Adviser"? Last I knew, he was the Clintons' "Top Health Care Adviser". That is, after he was Rick Miller's $1k/hr "Top Wang Labs Turnaround Adviser", 1 year before they declared bankruptcy. For a guy with such a string of successes, he seems to keep popping up someplace new. At 01:33 PM 10/7/97 -0500, jbugden at alis.com wrote: > >Excerpted from the following NY Times article: > >http://www.nytimes.com/library/cyber/week/100797encrypt.html > >Clinton's Top Internet Adviser Says >U.S. Encryption Policy Is Unformed > >Magaziner took The New York Times and The Wall Street Journal to task for what >he characterized as sensationalizing negative aspects of the Internet. An >analysis of the newspapers' front-page coverage of the global computer network >in the last year, he said, revealed that the four most popular words or phrases >in such articles were "drug deal," "stalker," "bomb maker" and "pornography." >Such coverage, he asserted, had led to a popular image of the Internet that was >fundamentally skewed and that made arguing for market-driven solutions >difficult. > > > From eb at comsec.com Tue Oct 7 13:06:54 1997 From: eb at comsec.com (Eric Blossom) Date: Wed, 8 Oct 1997 04:06:54 +0800 Subject: Secure phone In-Reply-To: <3.0.3.32.19971007102724.00a499c0@labg30> Message-ID: <199710071944.MAA24493@comsec.com> > At 12:05 PM 10/6/97 -0700, Eric Blossom wrote: > >None of this is designed to provide authentication of the end point. > >It is designed to ensure that you've got a private channel to the end > >point. > > Therefore, man-in-the-middle can be more precisely described as an > unauthenticated end-point problem. Therefore, without authentication, > there is no defense (yet) against MITM attacks. I concur from the theoretical point of view. In a practical sense I guess it all boils down to what our working definition of authentication is. If I'm using one of my phones and talking to somebody that I know (recognize voice, speech patterns, shared history, ...) and the verification codes check out, I'm highly confident that there is no man-in-the-middle. I'm free to have whatever conversation I like, modulo bugs in the room, laser window bounce listeners, etc. On the "beat the verification codes by spoofing the voice" thread: I don't think that this is a practical threat. You've got the computational challenge (described in the previous posts) and the human part. The complications come from the fact that you've got two live people having a conversation with each other. At least in the conversations I have, we don't read these things back and forth like robots to each other. In secure mode there are 6 hex digits displayed on each unit. On one unit, the first three digits are underlined. On the other unit, the last three digits are underlined. By convention, you say the three that are underlined, and listen for the other three. This seems to work out pretty well in practice. There is generally a "Hi, I'm looking at 1FC", "4D9, good. What's up?" type of interaction. I'm running a "Privacy Extremist" special on the GSP's. $795 for one, or two for $1500. Cash/Check/MO/MC/VISA/AMEX. Add $16 shipping for one, $20 for two. CA residents add sales tax. US and Canada only. 30 day money back. 1 year warranty. Communication Security Corp. 1275 Fourth St., Suite 194 Santa Rosa, CA 95404 v: 707-577-0409 f: 707-577-0413 eb at comsec.com http://www.comsec.com Eric From jbugden at alis.com Tue Oct 7 14:00:02 1997 From: jbugden at alis.com (jbugden at alis.com) Date: Wed, 8 Oct 1997 05:00:02 +0800 Subject: Four horsemen skew Internet Message-ID: <9710078762.AA876257157@alis-1.alis.com> While I'm not too concerned about your present state of happiness, if you read the cited article, you may find that it is less off-topic than you thought. The quote was chosen as a "text-bite" that - while echoing sentiments familiar to many people on this list - is seldom heard from within the US administration. Magaziner's often been good for politically inopportune statements. To quote from an article in a Canadian business newspaper in late July: "Ira Magaziner, Clinton's international emissary on the issue of how governments should respond to the explosive growth of business on the Net, said any attempt to regulate its content would not only be a mistake, it would be futile." Let's wish him success in his current endeavours, ;-) -----Original Message----- From: Lyle Seaman Sent: Tuesday, October 07, 1997 3:35 PM To: James Bugden Cc: cypherpunks at toad.com Subject: Re: Four horsemen skew Internet This is an off-topic rant. Anyone who wants to make me happy will convince the NYT to investigate the following question: How did Magaziner get to be "Clinton's Top Internet Adviser"? Last I knew, he was the Clintons' "Top Health Care Adviser". That is, after he was Rick Miller's $1k/hr "Top Wang Labs Turnaround Adviser", 1 year before they declared bankruptcy. For a guy with such a string of successes, he seems to keep popping up someplace new. At 01:33 PM 10/7/97 -0500, jbugden at alis.com wrote: > >Excerpted from the following NY Times article: > >http://www.nytimes.com/library/cyber/week/100797encrypt.html > >Clinton's Top Internet Adviser Says >U.S. Encryption Policy Is Unformed > >Magaziner took The New York Times and The Wall Street Journal to task for what >he characterized as sensationalizing negative aspects of the Internet. An >analysis of the newspapers' front-page coverage of the global computer network >in the last year, he said, revealed that the four most popular words or phrases >in such articles were "drug deal," "stalker," "bomb maker" and "pornography." >Such coverage, he asserted, had led to a popular image of the Internet that was >fundamentally skewed and that made arguing for market-driven solutions >difficult. > > > From jon at pgp.com Tue Oct 7 14:44:17 1997 From: jon at pgp.com (Jon Callas) Date: Wed, 8 Oct 1997 05:44:17 +0800 Subject: What's really in PGP 5.5? Message-ID: <3.0.3.32.19971007142710.00a22970@mail.pgp.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have a number of comments about the New York Times article on PGP 5.5 for Business of which Martin Minow sent a synopsis. If we had built what they said we had, then we'd deserve of all the derision people have directed at us. But we didn't. The New York Times got it flat wrong. I'll describe what we built, how it works, and its limitations. But first, some background on the problem we're trying to solve in PGP 5.5. A couple of years ago, the government sugarcoated their surveillance plans by switching from "key escrow" to "key recovery," and trying to sell surveillance to people by pointing out some of the downsides of strong cryptography, and selling key recovery as the way around them. One of the downsides of cryptography is that if you lose your passphrase (or token, PIN, smart card, or whatever), you've lost your data. My favorite way of expressing this problem is, "if you lose the keys to your car, then you have to get a new car." This downside is particularly insidious for a number of reasons. First, without fixing that problem, strong cryptography will be in some sort of limbo. You want to use it to protect your valuable information, but you won't want to use it for any information that's *too* valuable, because it's easily lost. Crypto-protected information is fragile, and this fragility could hurt its widespread deployment. Worse, this gives the government a rationale for regulating cryptography. Like it or not, government has a mandate to protect the people from dangerous technologies, be they in foods, drugs, autos, or information technologies. Many people believe that the government uses this mandate as a rationale for acquiring power, many people would prefer that they let us take our chances, but that's not germane to this discussion. It *is* germane to note that when you hear some ham-fisted remark about how surveillance is like air bags, they are saying: they have to protect people from dangerous things, crypto is dangerous, therefore they have to protect people from crypto. When they started mumbling along these lines, the privacy community got their own act together and started describing what we believe to be the real solution. This is called "data recovery." The first time I heard the term, I hated it. I still hate it. The reason I hate it is that it's got the word "recovery" in it, which makes it sound to someone who isn't paying a lot of attention that all recovery systems are basically the same thing. Most of the people in the world don't pay a lot of attention most of the time. When I was at HIP97 this August, I was amused to hear cypherpunks chanting, "Data recovery good, key recovery bad." The sublimely Orwellian tone of this mantra makes me laugh and cringe at the same time. (To explain the reference, in Orwell's "Animal Farm," there's a revolution in the farm and the animals take over, run by the pigs. One of the slogans they have is "four legs good, two legs bad." By the end of the book, the pigs are nigh indistinguishable from the people. But I digress.) The essence of data recovery is that focusing on the keys is a canard. If you've misplaced your data, you want the data back, not the keys. The only people who want your keys are people who want to spy on you. If you've locked yourself out of your car, you want the use of your car, not the just the key. Thus, the solution to encrypted data being fragile is to let people get to the data. Simple, obvious, but subtle, because the key to getting the data is the key. If you don't like data recovery, you aren't going to like what we did in PGP 5.5 -- we built a data recovery system. Some people aren't going to like it, and some of those will think this missive is a load of self-serving twaddle. Myself, it gives me the same mildly uncomfortable feeling that fake rocks for spare keys do, or skeleton keys do, financial audits, or any other similar technology. Uncomfortable feelings aside, if the fragility problem is not solved, then many people who should be using crypto won't, and government will continue to view this problem as a question of public safety, and thus in their mandate to regulate. Data recovery is useful for a number of things. Perhaps you lost your passphrase. Or data might have been encrypted by an employee or co worker who was in an accident. (As an aside, fifteen years ago, the architect of a product I worked on was in a severe car wreck. He was not killed, but suffered brain damage and has never returned to work.) Your spouse might need access to financial records. Everyone, be they an individual, business, or coporation has a right to having their data protected, and protection not only means being able to put it into a safe, but getting it out of that safe later. What makes data recovery different from key recovery? In my opinion, data recovery allows you to get encrypted data without compromising the key of the person who encrypted it. Data is property, and keys are property. An ethically built system allows emergency access to data without destroying the property of the key owner. Ethically built data recovery software has a number of properties: (1) It is surveillance-surly. It should be impossible or unwieldy for an adversary, be they government (yours or foreign), dirtballs (such as crackers), business competitors (who sometimes count as dirtballs), or others to use this against you. The system should also be aware of how passive surveillance (like traffic analysis) interacts with it. (2) It is an "opt-in" system. Users must consent to it, and must take some action to start using it. It should be as easy as possible to stop using the system. The system must also allow someone who does not opt in to use all the system's features. Please note that abuses of consent (for example, an employer who says, "consent or we fire you") are something we can't prevent in any system. (3) It must obey the principle of fair warning. If you send me a message that is subject to data recovery, you should know that before sending the message. This way, if you don't agree with my policy, you can decide not to send me that message. This interacts closely with the opt-in principle above. (4) The data recovery system should be preferable to an escrow system. A number of corporations who use PGP keep copies of their employees' secret keys. This is both odious and dangerous. Escrowed keys are a target for attackers, subpoena-bait, and potentially ruin the value of digital signatures. It's just bad policy. (5) The system has to allow someone under a legal threat to respond effectively to that threat. Legal threats include warrants, subpoenas, and discovery processes. You have to be able to respond to the request for information without losing your keys and thus all of your data. (6) It must also provide a response to those who would regulate crypto in the name of public safety. Fortunately for us, potential regulators have focused on the horsemen of the infocalyse. There are other pseudo-public-welfare threats including the rights of a person to their spouse's records, or the rights of heirs to information property. We, the people who design privacy systems, have to think about what happens when the regulators stop dragging out the pornographers and start dragging out the poor widows and orphans. Note that these requirements are not completely consistent with each other. For example, an opt-in system is riskier than an opt-out system, yet friendlier to one's own privacy. Balancing these requirements is part of the difficulty of good software design. If you have been skimming the above, wondering when I'm going to get around to actually telling you what we did in PGP 5.5, this is it. With PGP 5, there are a number of attributes of your key that are stored in a self-signature. For example, your preferred symmetric algorithms are stored in your self-signature. The data recovery feature -- which we call "Corporate Message Recovery" -- is an attribute in your self-signature that tells anyone who receives your key that you want messages encrypted to you to also be encrypted to that other key. There is also a flag that tells the encryptor, "please" or "I insist." Architecturally, there can even be more than one recovery key. That's it. That's all it is. Well, that's mostly all it is. There are other bits of the system. For example, if I look up Alice's key on a key server and Alice has a recovery key, I get Alice's recovery key, too. If Alice's recovery key is a "please use" key, then I can encrypt to Alice alone. In any case, the PGP software tells me that Alice has a recovery key, so I can decide to use some other mechanism to talk to her. Note that design satisfies the opt-in and fair-warning requirements. Also, since Alice's recovery key is an attribute of her self-signature, she can change it. She can even have a second user name (let's call it Bob), that has no recovery key. Also, we have three encryption products: PGP freeware, PGP for Personal Privacy, and PGP for Business Security. Corporate Message Recovery is included *only* in PGP for Business Security. It is not, and never will be, in either the freeware or the Personal Privacy product. It is an extra cost item that we created for businesses as per their requirements. As I stated above, a number of these businesses keep copies of their employees' secret keys. One of the reasons we created this feature is to satisfy their requirements with some mechanism that is less blunt than key escrow. When a PGP message is formed, there are a number of "packets" that make up the message. The usual construction is that there is a "session key" packet for each public key that the message is to be read by. Following that is the actual message packet, that is encrypted with a symmetric cypher to session key. The session key packets specify the *key*, by its 64-bit key ID. This is an important and subtle point. Let's go back to Alice, a.k.a. Bob. The information that specifies a recovery key is in a self-signature of a user name, but the session key specifies a public key by keyID. It is impossible, solely from looking at a message, to know if it is addressed to Alice or Bob because that information is not stored in the message. A message that does not honor recovery is syntactically correct. I don't know why Bruce Schneier said that this is everything the FBI wants. If it is, then they have changed spots! One of the major ways PGP's system differs from anything else I've seen is that it has no enforcement built into the protocol. This helps make PGP surveillance-surly, with or without Corporate Message Recovery. If this is all the FBI needs, then they've decided the way to get your files is to knock on your door with a warrant, and that's a big, big, big step forward. Getting back to the system, I'm sure you've noticed a gotcha there. If I mail Alice a message that I encrypted to Bob, she can decrypt it, but the recovery key can't. If you've been paying very close attention, you have wondered something akin to, "hmm, if Alice's key accidentally lost its self-signature, there would be no way to encrypt to her recovery key." You're right. If Alice really wants recovery on messages sent to her, then she has to use our SMTP Policy Management Agent. The policy management agent is an SMTP proxy. You can configure it to do a number of things. Most relevant to this discussion is that Alice can use the policy agent to require that her recovery key gets used. However, the policy agent does *not* decrypt the message. One of the very good features of Business PGP is that it does not decrypt the message. It does not prevent or even try to prevent multiple-encryption. It's really, really easy to encrypt a message to Alice alone, and then encrypt that message to both Alice and her recovery key. We're not going to change that. Nor does the policy management agent archive messages, make copies, notify your mother, or any of the other things we've been accused of doing with it. It's simply the gatekeeper that enforces Alice's corporate policy. To sum up, we created the Corporate Mesage Recovery feature to satisfy the requirements of our customers who need emergency access to data. We made careful decisions to make it useful and effective for honest people, while minimizing its potential for abuse. No one has to use it; we do not include it with PGP freeware, nor with PGP for Personal Privacy. We alert all users of all products when they encrypt to someone who has a message recovery key. It is an opt-in system that you can opt out of. It is not a surveillance system. A few weeks ago, we showed it to the FBI and asked their opinion. They told us it doesn't meet any of their needs. - - ------ Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) -----BEGIN PGP SIGNATURE----- Version: PGP for Business Security 5.5 iQA/AwUBNDqoyn35wubxKSepEQJ9FQCfQcaS8aWdXcTZild0nKe5+LatDRsAnA5n GTIb2dYUx4+Uh/Frim2hKFuF =4u2g -----END PGP SIGNATURE----- ----- Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) From rah at shipwright.com Tue Oct 7 15:19:09 1997 From: rah at shipwright.com (Robert Hettinga) Date: Wed, 8 Oct 1997 06:19:09 +0800 Subject: Nader Letter to Bill Gates Message-ID: Yet another spit take arrives in the e-mail. This seems to be another great week for hilarity... Cheers, Bob Hettinga --- begin forwarded text Date: Tue, 7 Oct 1997 13:21:43 -0400 (EDT) Reply-To: love at cptech.org Originator: info-policy-notes at essential.org Sender: info-policy-notes at essential.org Precedence: bulk From: James Love To: Multiple recipients of list Subject: Nader Letter to Bill Gates MIME-Version: 1.0 The following in Ralph Nader's letter to Bill Gates, inviting him to Ralph's November 13, 14 conference on Apprasising Microsoft's Global Stategy. Jamie ----------------------------------------------------------------------- Ralph Nader P.O. Box 19312 Washington, D.C. 20036 October 2, 1997 Mr. William H. Gates Chairman and Chief Executive Officer Microsoft Corporation 1 Microsoft Way Redmond, WA 98052 Dear Mr. Gates: The customary executive mind receiving a letter such as this would be inclined toward prejudgment and denial, instead of anticipation and affirmation. But as a dominant corporate architect and philosopher of the information highway--note your expressed desire in your book, The Road Ahead, to open the dialogue about how society should shape its future in an age of tremendous technological change--you should be willing to include in that dialogue--Appraising Microsoft and Its Global Strategy. That, as it happens, is the title of a conference in Washington, D.C. on November 13 and 14, which Essential Information and I are sponsoring and to which you are invited to make a presentation. Let me describe briefly what has led to this unique event. As you may know, our various groups work in the consumer safety and environmental protection areas with a dual focus on both corporate and government accountability. We also have been pioneers in advancing freedom of information standards in government and widening the access to justice by all citizens. Concentration of economic power, along with its abuses, has long been a concern of ours and we have worked with many people of conscience inside companies, some of whom became effective whistle-blowers. Recently, people in many different kinds of businesses have been expressing fear and criticism about your company's business practices and strategies. At first, we were prone to dismissing such complaints as reflecting envy toward the dominant company. But as the private criticism became more diverse--flowing from downstream commerce well beyond software and hardware companies and from more disinterested scholars, commentators, writers, public officials and customers, it became an incentive toward further public exploration. Even this accumulated criticism did not suffice to warrant a gathering to explicitly explore the many forays and practices of your company's business strategies, which you must agree, have a range of ambitions and ongoing initiatives in more industrial and commercial directions locally to globally than possibly any business entity in modern history. What tipped the scale was the fear of speaking out by thoughtful people in the business world who otherwise have the position, energy and the resources to do so. Self-censorship brought on by the detailed fear of Microsoft retaliation--itself seen as a many pronged cluster--is not healthy in any economy. Especially when this fear is not imagined but rooted in past and current actions which are described and attributed to your company's high velocity momentum. On the other hand, you and your associates are described as so fearful of becoming another Digital Equipment or IBM missing a "big bend in the road", as you put it, that you are moving to position yourself as the "new middleman" on every lane of the information highway possible. To some observers, Microsoft playing the insecure and challenged role, as depicted in an article you may have relished on the cover of Barron's (September 15, 1997), assumes an irony of King Kong proportions. Seasoned executives are quaking before the relentless Microsoft wave in such lines of commerce as banking, real estate, insurance, car dealers, travel services, cable television, newspaper media and entertainment. The June 5, 1997 issue of the Wall Street Journal reported a detailed Microsoft strategy memorandum, deepened by interviews with your executives, that foreshadowed the "first a partner then a competitor" approach. Your critics assert that using a bundling strategy, together with tactical free offerings, made possible by monopolistically garnered profits, and a punitive "stick" response to your challengers makes Microsoft a leading candidate for antitrust action if only the enforcement agencies had the up-to-date knowledge, willpower and resources to apply these necessary laws for a free, fair and competitive economy. The conference participants are among the few who are still willing to speak openly of their concerns, findings and recommendations. Many plead for an open, not closed, architecture, for a digital future that is a patrimony, a commonwealth within which the best and the most consumer-sensitive will have an opportunity to prevail. They seek an information highway that is ungated where they see such a highway increasingly become gated. You, Steve Ballmer and Nathan Myhrvold have what you believe to be formidable responses to these declarations. Responses that are both specific and that rise to the level of national public policy regarding the information infrastructure in the economy. Focusing on the "Big Kid on the Block"--Microsoft--addresses the core concern directly and avoids the nuanced generalities and abstractions that have no operational realities attached to them. The agenda for the conference is being completed and includes the enclosed topics with the speakers who have confirmed their presence. Other presenters will be added in the coming days. In the interest of joining the issues, your presentation should come near the completion of the conference on November 14. We intend to have a serious, coherent and consequential conference that will lead to greater public understanding of the trends and the issues that will affect business and the general public as you wrote about in The Road Ahead. Your industry is thrusting toward increasing arcane language, acronyms and specializations that are narrowing the public or lay audience which, ever enlarging, is critical in making this technology serve the broadest of human interest and well-being. We are inviting Vice President Albert Gore, your friend and information highway colleague, to participate in the conference. Being an open gathering and near his office, his presence would neither entail the cost, time and closed-door nature of his earlier visit to your 100 executives meeting near Seattle. This should increase the likelihood of his acceptance, one might hope. Should you wish to discuss this invitation further, please call me or John Richard of Essential Information at (202)387-8034. Of course, you may wish to have other Microsoft executives attend the conference and they are welcome to come and absorb the many currents of information and activity, both in the formal sessions and in the informal corridor and coffee break discussions that are often so valuable. While there is a conference fee, there is no outside funding or sponsorship to inhibit or compromise the integrity of the proceedings. Sincerely, Ralph Nader Enclosure -------------------------------------------------------------------- This some other documents about the conference are on the Web at: http://www.essential.org/appraising/microsoft/ -- James Love | Center for Study of Responsive Law P.O. Box 19367 | Washington, DC 20036 | http://www.cptech.org voice 202.387.8030 | fax 202.234.5176 | love at cptech.org --- end forwarded text ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: From rah at shipwright.com Tue Oct 7 15:23:23 1997 From: rah at shipwright.com (Robert Hettinga) Date: Wed, 8 Oct 1997 06:23:23 +0800 Subject: Four horsemen skew Internet In-Reply-To: <2.2.32.19971007193520.00e03de0@mailhost.transarc.com> Message-ID: At 3:35 pm -0400 on 10/7/97, Lyle Seaman wrote: > Last I knew, he was the Clintons' "Top Health Care Adviser". > That is, after he was Rick Miller's $1k/hr "Top Wang Labs Turnaround > Adviser", 1 year before they declared bankruptcy. For a guy with such a > string of successes, he seems to keep popping up someplace new. So, what you're telling us is, having Good Ol' Ira in charge of crypto is *good* news... "There's no law like *no* law" and all that... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: From devnull at bureau42.ml.org Tue Oct 7 15:35:49 1997 From: devnull at bureau42.ml.org (Anonymous (via bureau42 remailer)) Date: Wed, 8 Oct 1997 06:35:49 +0800 Subject: No Subject Message-ID: Nobuki Nakatuji say: > unperfect MISTY algorithm source code which I wrote isn't Public Domain. > When you use it ,You need to permit from me. > > > > ______________________________________________________ > Get Your Private, Free Email at http://www.hotmail.com No no, too late. I take MISTY and use in my secret crypto program to come out soon on Foriegn web-site. I take MISTY and make perfect. You go, chop chop. From dlv at bwalk.dm.com Tue Oct 7 16:35:31 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Wed, 8 Oct 1997 07:35:31 +0800 Subject: stored value cards in NYC - Motorola PR fluff. In-Reply-To: Message-ID: John R Levine writes: > > Anybody on the list know more about this project? ("...one of the largest > > and most exciting..." :-) The puff piece has some contact info, but I don' > > expect to get anything useful from them. > > This could be interesting. NYC already has stored value cards called > Metrocards which you can use for subway and bus fares. The MTA has tried > with little success to get newsstands and other vendors of low-price high > volume stuff to take them. Physically they're just thin plastic cards with > the usual magnetic stripe, nothing fancy. They permit variable sized > decrements and are rechargable, so their design must be reasonably > sophisticated. They suck. I'm sticking to tokens. > > I read somewhere in an account of an NYC hackerfest that the Metrocards > have been subjected to intense hacking but they apparently remain secure. They can't be all that secure... Bruce Schneier helped design the crypto. Schneier is to cryptography that Schildt is to C programmin. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From news at sldc.ffg.com Tue Oct 7 17:01:13 1997 From: news at sldc.ffg.com (news at sldc.ffg.com) Date: Wed, 8 Oct 1997 08:01:13 +0800 Subject: News from the Front (October Issue) Message-ID: <199710072344.RAA22350@Mail.ClickBook.COM> An update to our customers and friends on happenings at ----------------------------------------------------------------------- F O R E F R O N T - Taking the Chaos out of the 'Net http://www.ffg.com Newsletter 10/6/97 ----------------------------------------------------------------------- Contents: I. News from the 'Front II. Special Offer III. Hot Tip ----------------------------------------------------------------------- I. News from the 'Front WEBWHACKER 3.2 UPDATE! There is a FREE update available via the Internet for users of WebWhacker 3. To receive your FREE update, follow these steps: 1. Launch WebWhacker 2. Click Help 3. Click Update WebWhacker Software... 4. Follow the on screen prompts To check out the new and exciting features in WebWhacker 3.2, visit: http://webwhacker.ffg.com/whatsnewdir/3/ww2whatsnew.html HP ACQUIRES FOREFRONT'S NEXT-GENERATION INTERNET-PRINTING TECHNOLOGY ForeFront's Internet Technology and Printing Development Team will be able to accelerate Hewlett Packard's solutions for easy, fast and reliable Internet printing. http://www.ffg.com/press/9_97hewlett.html FOREFRONT ACQUIRES COMPUTER BASED TRAINING SOFTWARE DEVELOPER LANTEC ForeFront is moving aggressively to expand its presence in the training and education markets. http://www.ffg.com/press/lantecacq.html ----------------------------------------------------------------------- II. Special Offer Ever receive files you can't read? Want to print their contents in a useful format, such as a booklet or brochure? ForeFront would like to introduce the ultimate utility bundle: Quick View Plus + ClickBook Now you have access to any file format AND you can print the file's content in any format, including booklets, brochures, and more! How much would you expect to pay for this perfect partnership? Would you believe ONLY $69.95! That's a savings of almost $40 off the regular price of $109.90! Follow this link now to take advantage of this limited time offer: http://store.ffg.com/qvp/ ----------------------------------------------------------------------- III. Hot Tip If you have Microsoft Internet Explorer 4 and WebPrinter or ClickBook, you have the ultimate web printing tool! You are capable of printing multiple linked web pages in a book with one click (almost)! Try this: 1. Launch Microsoft Internet Explorer 4 2. Browse to the site you want to print, e.g. http://www.ffg.com/corpinfo/ 2. Click File/Print... 3. Select your ClickBook printer driver from the Name drop down list 4. Check "Print all linked documents" and "Print table of links" 5. Click OK NOTE: make sure WebPrinter/ClickBook is done procesing pages before clicking the Print button. (In this example there should be 11 pages received) This is truly "The best way yet to print the 'Net!" If you don't have WebPrinter yet, then get it! http://www.ffg.com/wp/ For more printing options, try ClickBook! http://www.ffg.com/wp/clickbook.html ----------------------------------------------------------------------- This newsletter is only sent to those who requested the newsletter and those who downloaded, registered, or evaluated our software. If you wish to unsubscribe from the ForeFront newsletter mailing list, please visit http://www.ffg.com/press to Unsubscribe. From hedges at sirius.infonex.com Tue Oct 7 19:08:12 1997 From: hedges at sirius.infonex.com (Mark Hedges) Date: Wed, 8 Oct 1997 10:08:12 +0800 Subject: bad alter.net routes, backbone vulnerability Message-ID: Right now, as reported by PBI NetCenter staff, Alternet has dumped bad routes to all of its peers. AGIS has San Diego and Los Angeles off the air again ... for the third time today ... that's been going on for weeks. I mentioned the WSJ receipt of report from network engineers that the backbones are extremely vulnerable to attack, and said I guess someone's trying to show that crypto's useful for everyone to have, postulating some mythical encryption authentication could protect the routers from attack. He said yup, attack on the backbone network "happens all the time." Mark Hedges Infonex Internet Inc. From schneier at counterpane.com Tue Oct 7 19:20:17 1997 From: schneier at counterpane.com (Bruce Schneier) Date: Wed, 8 Oct 1997 10:20:17 +0800 Subject: What's really in PGP 5.5? Message-ID: Jon Calis wrote: >Also, we have three encryption products: PGP freeware, PGP for Personal >Privacy, and PGP for Business Security. Corporate Message Recovery is >included *only* in PGP for Business Security. It is not, and never will >be, in either the freeware or the Personal Privacy product. If this is true (and I have no reason to believe it isn't), then why is the key escrow code written (although not turned on) in the source code for 5.0 that was posted internationally from PGP? Makes no sense. Bruce >http://simson.vineyard.net/clips/96.SJMN.PGPBusinessEdition.html .... > PRETTY LOOSE PRIVACY >[...] > Published: April 2, 1996 > BY SIMSON L. GARFINKEL .... > That has not stopped Zimmermann from complaining loudly about the PGP > name being used in a product that allows someone other than the author > or the intended recipient access to information. Viacrypt owns the > licensing rights to sell the commercial versions of PGP. > > ''PGP does not stand for back doors,'' said Zimmermann. ''I don't mind > if they sell a program that has a back door in it, but they shouldn't > call it PGP.'' >[...] > ''If your employer can read your mail anytime he wants, without your > permission, that goes against the spirit of the PGP trademark,'' said > Zimmermann. ********************************************************************** Bruce Schneier, President, Counterpane Systems Phone: 612-823-1098 101 E Minnehaha Parkway, Minneapolis,MN 55419 Fax: 612-823-1590 http://www.counterpane.com From bd1011 at hotmail.com Tue Oct 7 20:36:52 1997 From: bd1011 at hotmail.com (Nobuki Nakatuji) Date: Wed, 8 Oct 1997 11:36:52 +0800 Subject: If you want Perfect MISTY algorithm Message-ID: <19971008032108.21717.qmail@hotmail.com> If you want Perfect MISTY algorithm source code, Please send e-mail to me. Thank you very much. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com From cp at panix.com Tue Oct 7 20:42:36 1997 From: cp at panix.com (Charles Platt) Date: Wed, 8 Oct 1997 11:42:36 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <3.0.3.32.19971007142710.00a22970@mail.pgp.com> Message-ID: On Tue, 7 Oct 1997, Jon Callas wrote: > Like it or not, government has a mandate to protect the people from > dangerous technologies, be they in foods, drugs, autos, or information > technologies. Please tell me where it says this in the U.S. Constitution. In particular, please tell me where the FEDERAL government is assigned this power. Thank you. --Charles Platt From frantz at netcom.com Tue Oct 7 22:07:14 1997 From: frantz at netcom.com (Bill Frantz) Date: Wed, 8 Oct 1997 13:07:14 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <3.0.3.32.19971007142710.00a22970@mail.pgp.com> Message-ID: At 2:27 PM -0700 10/7/97, Jon Callas wrote: >One of the downsides of cryptography is that if you lose your passphrase >(or token, PIN, smart card, or whatever), you've lost your data. My >favorite way of expressing this problem is, "if you lose the keys to your >car, then you have to get a new car." Jon clearly states one half of the problem here. The other half is what seems to be below the surface in many of the responses to PGP 5.5. That is, how do I achieve the secure deletion of data? When I make a telephone call, I have an expectation that the only record of the call will be in my memory and the memory of the person at the other end. At one time, people recording telephone conversations were required to include a beep every 15 seconds to notify the participants that this expectation was being violated. (It seems this expectation has always been violated by law enforcement.) Now email is a confounding medium because it is both a transient communication medium and a storage medium. We would like to be able to have protection against losing access to our stored data, at the same time we are sure that those who violate our trust and intercept our communications can not read the data, when it is sent or at any time in the future. PGP 5.5 seems to have a solution to the "lose your data" problem. It does not seem to address the secure deletion problem. In the context of computer system backup, one paper at the last Usenix Security Conference suggested implementing secure deletion by encrypting the data on the backup tape and then destroying the key when you wanted to delete the data. ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz at netcom.com | nation it is today. | Los Gatos, CA 95032, USA From schneier at counterpane.com Tue Oct 7 22:10:35 1997 From: schneier at counterpane.com (Bruce Schneier) Date: Wed, 8 Oct 1997 13:10:35 +0800 Subject: What's really in PGP 5.5? In-Reply-To: Message-ID: In the New York Times Cyber Edition I was quoted as saying that PGP 5.5's key escrow "sounds like everything the FBI ever dreamed of." Of course, that's an overstatement. The FBI certainly has bigger dreams, like making non-escrowed encryption illegal. But PGP's system certainly is key escrow. PGP, Inc. is splitting hairs, claiming that their system isn't key escrow because they don't keep copies of any keys. This may be true, but it's a difference that makes no difference. What the PGP system does is automatically encrypt a copy of the message key in the public key of the organization. This is more like the original Clipper Chip. If you remember, the Clipper Chip included a Law Enforcement Access Field in the ciphertext field; this field included the session key, encrypted in a secret law-enforcement key. PGP 5.5 essentially does this. You can think of the message key, encrypted in the public key of the organization, as the CAF (Corporate Access Field). And just as the Clipper Chip checked the validity of the LEAF before going into decrypt mode at the remote end, there is software at the SMTP server that check the validity of the CAF before allowing the encrypted e-mail to be sent. This isn't just key escrow; it's key escrow done well. Yes, this is only available in the Business Edition and not in the Personal Edition. Yes, the company has to decide to turn it on. Yes, the user is notified that this feature is turned on. But once it is turned on, the user cannot turn it off. This is not manditory key escrow (unless you are an employee of a company that decided it is manditory), but the FBI is not after manditory key escrow right now. They're willing to settle for voluntary. Then, in a few years, making it manditory can be spun as "closing a loophole." I agree with the 1996 Phil Zimmermann: >http://simson.vineyard.net/clips/96.SJMN.PGPBusinessEdition.html >.... > PRETTY LOOSE PRIVACY > [...] > Published: April 2, 1996 > BY SIMSON L. GARFINKEL >.... > That has not stopped Zimmermann from complaining loudly about the PGP > name being used in a product that allows someone other than the author > or the intended recipient access to information. Viacrypt owns the > licensing rights to sell the commercial versions of PGP. > > ''PGP does not stand for back doors,'' said Zimmermann. ''I don't mind > if they sell a program that has a back door in it, but they shouldn't > call it PGP.'' > [...] > ''If your employer can read your mail anytime he wants, without your > permission, that goes against the spirit of the PGP trademark,'' said > Zimmermann. Key escrow = someone other than the author or the intended recipient of the message being able to decrypt it. There are valid reasons for data backup, but they have nothing to do with crypto key recovery. And there are absolutely no business reasons for manditory recovery of communications. We talked about all of this in our report on key recovery (http://www.crypto.com/key_study). Designing a system that is slightly different doesn't negate everything we said. I'm sorry, PGP, if I offended you. But that does not change the facts. Bruce ********************************************************************** Bruce Schneier, President, Counterpane Systems Phone: 612-823-1098 101 E Minnehaha Parkway, Minneapolis,MN 55419 Fax: 612-823-1590 http://www.counterpane.com From ALESSI10084 at mgnet.com Wed Oct 8 13:42:33 1997 From: ALESSI10084 at mgnet.com (ALESSI10084 at mgnet.com) Date: Wed, 8 Oct 1997 13:42:33 -0700 (PDT) Subject: USERS RIPPED OFF BILLIONS Message-ID: <> WARNING: Internet, Fax & Phone Users Ripped Off Billions! 1-888-248-6358 Shocking fee recorded message reveals wide-spread consumer rip-off's and a secret technique on saving and making a fortune in telecommunications. Call toll-free, anytime 24 hours a day 1-888-248-6358 From ALESSI10084 at mgnet.com Wed Oct 8 13:42:33 1997 From: ALESSI10084 at mgnet.com (ALESSI10084 at mgnet.com) Date: Wed, 8 Oct 1997 13:42:33 -0700 (PDT) Subject: USERS RIPPED OFF BILLIONS Message-ID: <> WARNING: Internet, Fax & Phone Users Ripped Off Billions! 1-888-248-6358 Shocking fee recorded message reveals wide-spread consumer rip-off's and a secret technique on saving and making a fortune in telecommunications. Call toll-free, anytime 24 hours a day 1-888-248-6358 From JonWienk at ix.netcom.com Tue Oct 7 22:43:13 1997 From: JonWienk at ix.netcom.com (Jonathan Wienke) Date: Wed, 8 Oct 1997 13:43:13 +0800 Subject: Internet Via Electric Lines? Message-ID: <3.0.3.32.19971007190121.030e8c68@popd.netcruiser> I heard on the ABC hourly news that some genius had figured out a way to use electrical power lines for data transmission, so that the power grid could be integrated into the Internet. Does anyone have any details / pointers? Jonathan Wienke What part of "the right of the people to keep and bear Arms, shall not be infringed" is too hard to understand? (From 2nd Amendment, U.S. Constitution) PGP 2.6.2 RSA Key Fingerprint: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 DSS/D-H Key Fingerprint: 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC Public keys available at pgpkeys.mit.edu. PGP encrypted e-mail preferred. Get your assault crypto before they ban it! US/Canadian Windows 95/NT or Mac users: Get Eudora Light + PGP 5.0 for free at http://www.eudora.com/eudoralight/ Get PGP 5.0 for free at http://bs.mit.edu:8001/pgp-form.html Non-US PGP 5.0 sources: http://www.ifi.uio.no/pgp/ http://www.heise.de/ct/pgpCA/download.shtml ftp://ftp.pca.dfn.de/pub/pgp/V5.0/ ftp://ftp.fu-berlin.de/pub/pc/win95/pgp ftp://ftp.fu-berlin.de/pub/mac/pgp http://www.shopmiami.com/utopia.hacktic.nl/pub/replay/pub/pgp/pgp50/win/ RSA export-o-matic: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 From JonWienk at ix.netcom.com Tue Oct 7 22:47:51 1997 From: JonWienk at ix.netcom.com (Jonathan Wienke) Date: Wed, 8 Oct 1997 13:47:51 +0800 Subject: russia_1.html In-Reply-To: <199710061350.GAA06107@toad.com> Message-ID: <3.0.3.32.19971007191143.00688008@popd.netcruiser> At 09:37 AM 10/6/97 -0700, Bill Frantz wrote: >At 3:01 AM -0700 10/6/97, Peter Trei wrote: >>The plutonium cores of thermonuclear devices have a limited shelf >>life - he claimed 6 years, which jibes with what I've heard from >>other open sources. Fission products build up in the cores which >>can poison a chain reaction. Thus all Pu based devices need to have >>the cores periodically removed and replaced with new ones, while the >>old ones have to go through a non-trivial reprocessing stage to >>remove the fission products. > >I think this comment is in error. Plutonium has a half life on the order >of 250,000 years, so very little decay products would build up in 6 years. >The tritium used in thermonuclear weapons has a much shorter half life, and >would need to be replaced about that often. One of the decay products of tritium (half-life: 12.5 years) is Helium-3, which aggressively absorbs neutrons and poisons the fission reaction of the plutonium. If one has access to more tritium, which is commercially available for about US $50,000 per gram, the existing tritium can be purified and combined with the new tritium to bring the bomb back to full power. If someone has the resources to obtain the bomb in the first place, refreshing the tritium probably wouldn't be a major problem. Jonathan Wienke What part of "the right of the people to keep and bear Arms, shall not be infringed" is too hard to understand? (From 2nd Amendment, U.S. Constitution) PGP 2.6.2 RSA Key Fingerprint: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 DSS/D-H Key Fingerprint: 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC Public keys available at pgpkeys.mit.edu. PGP encrypted e-mail preferred. Get your assault crypto before they ban it! US/Canadian Windows 95/NT or Mac users: Get Eudora Light + PGP 5.0 for free at http://www.eudora.com/eudoralight/ Get PGP 5.0 for free at http://bs.mit.edu:8001/pgp-form.html Non-US PGP 5.0 sources: http://www.ifi.uio.no/pgp/ http://www.heise.de/ct/pgpCA/download.shtml ftp://ftp.pca.dfn.de/pub/pgp/V5.0/ ftp://ftp.fu-berlin.de/pub/pc/win95/pgp ftp://ftp.fu-berlin.de/pub/mac/pgp http://www.shopmiami.com/utopia.hacktic.nl/pub/replay/pub/pgp/pgp50/win/ RSA export-o-matic: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 From stewarts at ix.netcom.com Tue Oct 7 22:53:37 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Wed, 8 Oct 1997 13:53:37 +0800 Subject: Cypherpunks Bay Area Meeting, This Saturday October 11th, 12-5+ Message-ID: <3.0.3.32.19971007221418.006bd63c@popd.ix.netcom.com> What: Cypherpunks October 1997 Bay Area Meeting When: Saturday October 11, 12 noon till 17pm Where: PGP World Headquarters, 2nd floor meeting room Bayview Bank Building, just south of Hwy. 92 2121 S. El Camino Real, San Mateo California http://www.pgp.com/pgpcorp/contactpgp.cgi#head Agenda: 12-1 - Introductions, Work in Progress, Milling About International Law, Electronic Commerce, and Digital Signature, Cem Kaner Virtual Private Networks - Besides FreeSWAN, there's a lot of VPN and other tunneling work in the commercial sector. Besides privacy uses, it makes it easier to handle your Network 10 or Bogus IP Addresses over the Internet. Domain Name Security PGP5.5 - The Product. The politics. Patents - Merkle-Hellman and Hellman-Pohlig expire! Crypto Politics - what is Congress up to this month? Tentative November Agenda and Location: Eric Hughes has arranged with Lawrence Wilkinson, a principal at GBN , to do a one afternoon scenario planning workshop on cryptography. Several other GBN people will also be in attendance. We are planning to hold it at the GBN offices in Emeryville, which can hold about 40 fairly easily. After: Eat dinner somewhere yet to be decided... PGP Building Access: This is an Open Meeting on US Soil and it is free for anyone to attend. There is a minor building security formality due to the facilities being in a bank building: anytime after 12 noon, approach the Bayview Building's Information window (in the plaza, see below for directions), and ask the Guard on Duty to let you up to the 2nd Floor for the Cypherpunks meeting (use the passphrase "cypherpunks release code"). If you have any difficulty (eg. if the guard is on a break), simply call DDT at +1 415 730 3583 he I'll let you in. You can arrive at any time during the scheduled meeting hours, though earlier is better if you want to hear the interesting stuff. Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From whgiii at invweb.net Tue Oct 7 23:36:26 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Wed, 8 Oct 1997 14:36:26 +0800 Subject: Internet Via Electric Lines? In-Reply-To: <3.0.3.32.19971007190121.030e8c68@popd.netcruiser> Message-ID: <199710080627.CAA13391@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <3.0.3.32.19971007190121.030e8c68 at popd.netcruiser>, on 10/07/97 at 07, Jonathan Wienke said: >I heard on the ABC hourly news that some genius had figured out a way to >use electrical power lines for data transmission, so that the power grid >could be integrated into the Internet. Does anyone have any details / >pointers? This is nothing new. I think it was GE that several years ago created phone extensions that you plugged into your power outlets, no need to run wire to put in an extra outlet. I believe that X-10 uses this same principle for computer control of household appliances. Not to mention data leakage through power lines is an issue long reconized by the TEMPEST crowd. The trick here seems to be in routing the data. How do you get data on the power grid routed to the location that you want it to go?? - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNDspgY9Co1n+aLhhAQHHHwP8D37wNFBs+XpF0ojB38/Dv/EUAu9XpDew E5dvXiq0RtYmauGMZgsZtba+84RJxb0oQy6h3UHUeEjEJqLsG8x4ay5foIypjbwv Bd8koxhfTLdfxXKBwATSAlck8kg5hvNWPFpCrfsMCGskC4fQ07OLfxNtaafKEY0t BxLSzM/ntK0= =ugsr -----END PGP SIGNATURE----- From ian.sparkes at t-online.de Wed Oct 8 00:10:58 1997 From: ian.sparkes at t-online.de (Ian Sparkes) Date: Wed, 8 Oct 1997 15:10:58 +0800 Subject: If you want Perfect MISTY algorithm In-Reply-To: <19971008032108.21717.qmail@hotmail.com> Message-ID: <3.0.2.32.19971008085845.006c3c70@q9f47.dmst02.telekom.de> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At 20:21 07.10.97 PDT, Nobuki Nakatuji wrote: >If you want Perfect MISTY algorithm source code, >Please send e-mail to me. I've never seen perfect code before, I'd be interested to see some. >Thank you very much. No, thank you > > > >______________________________________________________ >Get Your Private, Free Email at http://www.hotmail.com > > -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDsvFPzOjjBJiFUeEQLFhQCeNs3t5dM326sgVpPoM5o5eopjyyMAnA0K sRRyOnT2bvwTNQj59wljqDlb =RWCs -----END PGP SIGNATURE----- From anon at anon.efga.org Wed Oct 8 00:29:37 1997 From: anon at anon.efga.org (Anonymous) Date: Wed, 8 Oct 1997 15:29:37 +0800 Subject: What's really in PGP 5.5? Message-ID: <36e200bba528c46e3694521079832b77@anon.efga.org> -----BEGIN PGP SIGNED MESSAGE----- Jon Callas wrote: >I have a number of comments about the New York Times article on PGP >5.5 for Business of which Martin Minow sent a synopsis. >If we had built what they said we had, then we'd deserve of all the >derision people have directed at us. But we didn't. The New York >Times got it flat wrong. In your long message I was unable to locate an area in which the New York Times "got it flat wrong". If anything, your post was more alarming than the newspaper article. >This downside is particularly insidious for a number of >reasons. First, without fixing that problem, strong cryptography will >be in some sort of limbo. You want to use it to protect your valuable >information, but you won't want to use it for any information that's >*too* valuable, because it's easily lost. Crypto-protected >information is fragile, and this fragility could hurt its widespread >deployment. What you call "fragility" is properly called "security". Would you describe 128-bit keys as more "fragile" than 40-bit keys? Why is PGP, Inc. inventing propaganda terms for the authorities? >Data recovery is useful for a number of things. Perhaps you lost your >passphrase. Or data might have been encrypted by an employee or co >worker who was in an accident. (As an aside, fifteen years ago, the >architect of a product I worked on was in a severe car wreck. He was >not killed, but suffered brain damage and has never returned to >work.) Your spouse might need access to financial records. Everyone, >be they an individual, business, or coporation has a right to having >their data protected, and protection not only means being able to put >it into a safe, but getting it out of that safe later. It is fascinating to me that every example you use does not involve decrypting transmitted messages. Yet, that is the feature which is under discussion. The demand for the ability to decrypt encrypted messages in the corporate environment can easily be measured with this test: how many companies have a policy that requires employees to record all outgoing mail? >(6) It must also provide a response to those who would regulate >crypto in the name of public safety. This is a red herring. Nobody has been talking about regulating cryptography as a matter of public safety in a serious way. Why is PGP, Inc. posing non-threats to justify its actions? Probably because its actual, all too obvious, motivations are unpalatable to the cypherpunks and probably to most of its customers and supporters. They are not unpalatable to Big Brother, however. I suggest that in the future we do not meet at the PGP, Inc. headquarters and that we do not treat this company as a trustworthy ally. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDsgSpaWtjSmRH/5AQG/pwf+LBO0ynwGeLLJipuWTIfoE9n7xvBJeXD4 od4Q7NYMZl/UfbudynBHMKGI0/xrhVhC1lmJlXXu+/mbBK2K1H0X9EMILQqpxhM4 RJd5ndR1BI0dpoRZX4+6PRq2mRi3lspvvXp3UkL4bKR8MpCqVJNcpluunMtBgIzh WoxXjw2GzVnbPiWoHhS/TIdQNSvubBCYBsje5rOKc71yQj86ymUzKLovX6O7j/dD eIjlJZTuP+AemEyG6FD5dyXQV7qdcxKwDG9G4ka813NHl88LU0Nc1JcM4aPATgfh 4cZhgppUvZqSGwd0QpxYb/OduE/adCuqmyrubMumc3SqTKRjPdLyBA== =f9J+ -----END PGP SIGNATURE----- From MAILER-DAEMON at wombat.sk.sympatico.ca Wed Oct 8 17:13:29 1997 From: MAILER-DAEMON at wombat.sk.sympatico.ca (Mail Delivery Subsystem) Date: Wed, 8 Oct 1997 17:13:29 -0700 (PDT) Subject: Returned mail: Host unknown (Name server: fatmans.demon.co.uk: no data known) Message-ID: <199710090008.SAA11007@wombat.sk.sympatico.ca> The original message was received at Wed, 8 Oct 1997 18:00:38 -0600 (CST) from orenco23.sk.sympatico.ca [142.165.99.23] ----- The following addresses have delivery notifications ----- (unrecoverable error) ----- Transcript of session follows ----- ... Deferred: Connection timed out during initial connection with mail.got.net. ... Deferred: Connection refused by mh.brainlink.com. 550 ... Host unknown (Name server: fatmans.demon.co.uk: no data known) ... Deferred: Connection refused by orion.sk.sympatico.ca. Reporting-MTA: dns; wombat.sk.sympatico.ca Received-From-MTA: DNS; orenco23.sk.sympatico.ca Arrival-Date: Wed, 8 Oct 1997 18:00:38 -0600 (CST) Final-Recipient: RFC822; paul at fatmans.demon.co.uk Action: failed Status: 5.1.2 Remote-MTA: DNS; fatmans.demon.co.uk Last-Attempt-Date: Wed, 8 Oct 1997 18:07:10 -0600 (CST) To: cypherpunks at toad.com Subject: InfoWar 2000 / AOL Format From: The Last True CypherPunk Date: Wed, 08 Oct 1997 18:04:15 -0600 Organization: "It's a Multi-User Persona whose homepage is a Mirror site." Reply-To: cypherpunks at toad.com Title: The True Story of the Internet Part II The True Story of the InterNet Part III InfoWar 2000 Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger Copyright 1997 Pearl Publishing InfoWar Table of Contents InfoWar 2000 InfoWar 2000 "InfoWar is back!" Jonathan cried out, waking the other members of the Magic Circle instantly. They quickly rose and gathered around the GraphiScreen hovering over the old oak table. Subject: Re: [Pigdog] ViaCrypt slowly executes Timmy C. May From: Flesh To: pigdog-l at arlington.com, cypherpunks at toad.com Does the fireBot work well with the throwemupagainstthewallandaimfortheheadBot? Cowboy recognized the significance immediately. "A thousand Points of Presence." "UUNET�WorldCom?" Alexis asked, surprised. Jonathan nodded, adding, "And they're moving faster and quieter than they did in history as we have known it, up to now." He began reading off the list he had compiled in just a short time, "Fiber, Digital Microwave, Satellite, Undersea Fiber Cable. Financial markets, telecommunications, construction, health care, and politics. "They seem to be putting all of the 'usual suspects' under one flag, around the globe." A Player To Be Named Later scanned the series of posts, for the thousandth time. "It's dejavu, all over again." he said, quoting a Yogi Berra malapropism. The feeling had been growing on him� The feeling that somehow, everything was the same as before�only different. "The Lake of Life has started to turn over. The bottom is rising to the top, the top is descending to the bottom, and everything is becoming the opposite of what it seems to be." A Player To Be Named Later sat quietly, contemplating what it was that had changed, only somehow not changed, since the last time the lake had turned over on the CypherPunks mailing list. He thought about "WebWorld & the Mythical Circle of Eunuchs." He began to see the parallel between the history of the creation of WebWorld and the creation of the CypherPunks distributed list. There was the subterfuge which had preceded both the Channel Revolution which foreshadowed WebWorld and the Censorship Crisis which had presaged the CypherPunks distributed mailing list. There were the climaxes that precipitated the structural changes in both cases, the satellite destruction in the one case, and the loss of toad.com as host to the mailing list in the other case. There were the parallels with outside attacks ceasing on both the CypherPunks distributed mailing lists and the variety of Channels on WebWorld, in an attempt to let the citizens/members bond with their new channels/lists. One parallel-or two, depending on how you looked at it-in particular, which stood out in the mind of A Player To Be Named Later. There were three CypherPunks distributed lists-at algebra.com, ssz.com, and at cyberpass.net. Likewise, there was a reference to the Money Channel Government in WebWorld having three channels under its control. Then, there was the strange, strange saga of three religious channels-the God Channel, the Dualist Channel, and the Trinity Channel-which had somehow merged, yet not merged, creating a problem which had left the 'powers that be' very, very nervous. "What the hell happened to Channel War I?" A Player To Be Named Later, asked himself, suddenly recognizing a glaring disparity between the parallels he was drawing between the history of WebWorld and the history of the CypherPunks list. "And what the hell happened to InfoWar?" he asked, turning to Baby, who stood up and barked her agreement that there was definitely something fishy going on that involved the two shadow wars that had somehow been misplaced in the annals of history-one in the future, and one in the past. In 'WebWorld', both the reference to the three Money Channel Governments and reference to the three spiritual channels which became one, yet didn't, revolved around the close of Channel War I. But there didn't seem to be a parallel to Channel War I in the Time-Line of the CypherPunks list. Likewise, 'WebWorld' began with a reference to an 'InfoWar Scrambler Mechanism' which seemed to indicate that 'InfoWar' would play a major part in the history of 'WebWorld & the Mythical Circle of Eunuchs.' Yet there were only a few later references in Part II of The True Story of the InterNet in regard to "the beginning stages of InfoWar," with no further details. A Player To Be Named Later strained to touch the wispy haze of memory which was rising somewhere in the back of his mind-a memory which whispered "InfoWar" from somewhere deep in the heart of the CypherPunks mailing list censorship crisis. "Toto!" he said, suddenly feeling a ferocious stinging sensation behind his right ear, which resulted in a loss of balance as he fell to the floor, and a loss of consciousness as the blackness closed in around him� The tattered remnants of the Magic Circle of the future sat quietly around the antique oak table, anxious and depressed. "Why is the Trei Transponder receiving interference from Toto's digital implant?" Priscilla asked the group. "All of my monitoring tests show that the last adjustments we made to the Zooko Zamboni were up to Journeyman standards." "Perhaps it is a result of the differences in the winter climates between the Netherlands and Canada." Jonathan said. "It seems to me that the effects of Global Warming were just beginning to have undeniably noticeable effects in that particular epoch." The Cowboy got up and paced a bit, as the others realized he was working up the courage to say what they were all thinking. "Or.." he hesitated, then turned to face the others and continued, "perhaps the rebirth of InfoWar reflects that our efforts toward changing the past have not only been successful, but are now irrevocable." Jonathan pulled up a passage of 'WebWorld' onto the GraphiScreen, contemplating what he had originally perceived as the failure of InfoWar during the hotly contested battle which took place on the CypherPunks list during the censorship crisis. "January 19, 1997. "The beginning date of the 'moderation experiment' on the legendary CypherPunks mailing list. The beginning probe in preparation for the launching of InfoWar-an experiment which had failed miserably and had caused a delay in the plans of the Evil One. A delay caused by the damnable insolence of the terminal misfits among the CypherPunks. An insolence that was rumored to be fueled by the Circle of Eunuchs, fanning the 'flames' of dissent among the CypherPunks, helping them to resist the herding of their list members into the group-mindset desired by the Evil One." The other members of the Circle of Eunuchs sat still in their seats, not wanting to disturb the deep thoughts of Jonathan, who was indeed the Last True CypherPunk, having grown up at their feet, immersed in their logic and their lore, and whose whole life had been ruled by his connection to the infamous anarchists who had been, alternately, both the shining light of freedom and privacy in their era, and the treacherous instigators of Channel War II-the war which had led to the ultimate triumph of the Gomez and the Dark Allies and the conclusive ascent of the Dark Forces in their domination of WebWorld under the dictum of the Evil One. The room was quiet as Jonathan reluctantly pulled up the next passage of 'WebWorld' which had described his feelings when his bereft past had come back to haunt him. "Jonathan sat frozen in his seat, once again, his brain locked from the major dichotomies being produced as a result of his present-in which the CypherPunks were a villainous band of rogues who had instigated the launching of Channel War II-and his past, in which his grandfather had been exposed both as one of the major players in both the launching of Channel War II, and as traitorous scum who had sabotaged the goals of the CypherPunks in that same historical battle. "Jonathan's grandfather wasn't just a CypherPunk. He was the Fool." "We won�" Jonathan's voice trailed off, before he rose from the table and repeated his statement, in anger. "We won, damn it! "I know we won. Grandfather knew we won the censorship battle. Everyone knew that we won the censorship battle. History itself knows that we won�we�" Jonathan stopped short, turning to stare at the others, who were staring back. "Jonathan�" Bubba said softly. "History has changed." "I know that, damn it!" Jonathan resumed his pacing, knowing that he was missing something very, very important, but he couldn't for the life of him think what it might possibly be. The others in the room watched and waited, knowing that it was Jonathan, and Jonathan alone, whose heritage was intricately and irrevocably linked to the era in history which they had, for better or worse, interfered in through their use of the Trei Transponder. "Grandfather was a traitor to the CypherPunks�a traitor to freedom and privacy. He sabotaged everything that the CypherPunks had fought so hard to defend, since the inception of their anarchist, cryptography mailing list. "But the CypherPunks loved us�" Jonathan was lost in memories of a childhood in which he and his family had been forced to remain in constant motion, staying a half-step ahead of the Dark Allies, who had been hunting down the last remaining members of the CypherPunks-with a vengeance. His family had been soundly welcomed by the remaining CypherPunks, in their flight to freedom after his Grandfather's assassination. They had given the family food, clothing, shelter, and warned them when the Dark Allies were closing in, and it was once again time to flee. Duncan Frissell had even� Perhaps they all had� Jonathan sank to the floor, slowly, with Alexis leaping up and catching him softly. Cowboy helped her guide him toward the table and lower him into a chair. Jonathan slowly pulled off his shirt and stared at his tattoo�the Mark of the Toad. "Duncan Frissell arrived at our last safe house, in the middle of the night." Jonathan spoke, finally understanding the real story behind his family's flight into obscurity. "He warned us to flee, but it was too late�the Dark Allies were close at hand." Jonathan's voice was full of amazement as he recounted an event which he had long known, but had never managed to fully understand. "Duncan held the Dark Allies at bay, while we made our escape. I can still hear his screams�" Jonathan shuddered, then began shaking terribly. Alexis closed her arms around him, hugging him lightly. "Your Grandfather knew that the CypherPunks had lost the battle." Bubba picked up the thread. The other members of the Magic Circle looked on, mystified as to this strange turn of events which turned the whole history of the CypherPunks and the Circle of Eunuchs on hits head. "It wasn't a censorship battle." the Cowboy said, amazed as much by what he was saying as those listening to him were. "It was InfoWar!" "That's what happened to InfoWar." Alexis cried out, in disbelief of her own words. "It was over before it had begun." Bubba d'Shauneaux IV rose to his feet, and filled in the details of the battle as could only be done by one who had spent a lifetime of subterfuge playing a role which was the exact opposite of what it had seemed to be from surface appearances. "It was the first battle fought solely within the bounds of Virtual Reality." "It represented the true nadir point in history when the battle between the Forces of Light and the Forces of Darkness moved beyond the physical plane and into the minds of mankind." "InfoWar!" he roared, the word reverberated throughout the room, sending the Trei Transponder into a soft hum which grew louder and louder, with a pitch that went lower and lower until it became subsonic, unheard, but shaking the room�the earth�even WebWorld itself... The Trei Transponder exploded with a mighty boom, shaking the room so violently that the tattered remnants of the Magic Circle were thrown from their chairs, and found themselves rising to see only ruins around them, where their safe house had once been. They immediately realized that they must flee at once, as those investigating the explosion would undoubtedly be the Dark Allies, fully aware that the event had rent WebWorld at the seams. Jonathan paused, weapon in hand, covering the retreat of d'Shauneaux, who had remained behind to remove the last traces of evidence that the Circle of Eunuchs had ever truly been there. As d'Shauneaux joined him, motioning for him to proceed, he took one last look at the shattered remains of the Trei Transponder. All contact with the CypherPunks of the past was now gone, with little hope of it being renewed. Silently, he sent a message to the CypherPunks of his youth-from the bottom of his soul and into the inestimable profundity of the Tao. It was a message that would be understood by those who had been at Woodstock-a physical gathering of a Magic Circle which had come into physical being through a random blessing of Time and Chance. "You're on you own, folks�because we're sure on ours." Those who fail to learn from the future, are doomed to repeat it. "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite From MAILER-DAEMON at voland.freenet.bishkek.su Wed Oct 8 17:14:04 1997 From: MAILER-DAEMON at voland.freenet.bishkek.su (Mail Delivery Subsystem) Date: Wed, 8 Oct 1997 17:14:04 -0700 (PDT) Subject: Returned mail: User unknown Message-ID: <199710090134.GAA05373@voland.freenet.bishkek.su> The original message was received at Thu, 9 Oct 1997 06:34:24 +0500 from mail-relay.EU.net [134.222.91.10] ----- The following addresses had permanent fatal errors ----- ----- Transcript of session follows ----- ... while talking to freenet.bishkek.su.: >>> RCPT To: <<< 550 ... User unknown 550 ... User unknown Reporting-MTA: dns; voland.freenet.bishkek.su Received-From-MTA: dns; mail-relay.EU.net Arrival-Date: Thu, 9 Oct 1997 06:34:24 +0500 Final-Recipient: rfc822; fygrave at freenet.bishkek.su Action: failed Status: 5.1.1 Remote-MTA: dns; freenet.bishkek.su Diagnostic-Code: smtp; 550 ... User unknown Last-Attempt-Date: Thu, 9 Oct 1997 06:34:53 +0500 To: cypherpunks at toad.com Subject: InfoWar 2000 / AOL Format From: The Last True CypherPunk Date: Wed, 08 Oct 1997 18:04:15 -0600 Organization: "It's a Multi-User Persona whose homepage is a Mirror site." Reply-To: cypherpunks at toad.com Title: The True Story of the Internet Part II The True Story of the InterNet Part III InfoWar 2000 Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger Copyright 1997 Pearl Publishing InfoWar Table of Contents InfoWar 2000 InfoWar 2000 "InfoWar is back!" Jonathan cried out, waking the other members of the Magic Circle instantly. They quickly rose and gathered around the GraphiScreen hovering over the old oak table. Subject: Re: [Pigdog] ViaCrypt slowly executes Timmy C. May From: Flesh To: pigdog-l at arlington.com, cypherpunks at toad.com Does the fireBot work well with the throwemupagainstthewallandaimfortheheadBot? Cowboy recognized the significance immediately. "A thousand Points of Presence." "UUNET�WorldCom?" Alexis asked, surprised. Jonathan nodded, adding, "And they're moving faster and quieter than they did in history as we have known it, up to now." He began reading off the list he had compiled in just a short time, "Fiber, Digital Microwave, Satellite, Undersea Fiber Cable. Financial markets, telecommunications, construction, health care, and politics. "They seem to be putting all of the 'usual suspects' under one flag, around the globe." A Player To Be Named Later scanned the series of posts, for the thousandth time. "It's dejavu, all over again." he said, quoting a Yogi Berra malapropism. The feeling had been growing on him� The feeling that somehow, everything was the same as before�only different. "The Lake of Life has started to turn over. The bottom is rising to the top, the top is descending to the bottom, and everything is becoming the opposite of what it seems to be." A Player To Be Named Later sat quietly, contemplating what it was that had changed, only somehow not changed, since the last time the lake had turned over on the CypherPunks mailing list. He thought about "WebWorld & the Mythical Circle of Eunuchs." He began to see the parallel between the history of the creation of WebWorld and the creation of the CypherPunks distributed list. There was the subterfuge which had preceded both the Channel Revolution which foreshadowed WebWorld and the Censorship Crisis which had presaged the CypherPunks distributed mailing list. There were the climaxes that precipitated the structural changes in both cases, the satellite destruction in the one case, and the loss of toad.com as host to the mailing list in the other case. There were the parallels with outside attacks ceasing on both the CypherPunks distributed mailing lists and the variety of Channels on WebWorld, in an attempt to let the citizens/members bond with their new channels/lists. One parallel-or two, depending on how you looked at it-in particular, which stood out in the mind of A Player To Be Named Later. There were three CypherPunks distributed lists-at algebra.com, ssz.com, and at cyberpass.net. Likewise, there was a reference to the Money Channel Government in WebWorld having three channels under its control. Then, there was the strange, strange saga of three religious channels-the God Channel, the Dualist Channel, and the Trinity Channel-which had somehow merged, yet not merged, creating a problem which had left the 'powers that be' very, very nervous. "What the hell happened to Channel War I?" A Player To Be Named Later, asked himself, suddenly recognizing a glaring disparity between the parallels he was drawing between the history of WebWorld and the history of the CypherPunks list. "And what the hell happened to InfoWar?" he asked, turning to Baby, who stood up and barked her agreement that there was definitely something fishy going on that involved the two shadow wars that had somehow been misplaced in the annals of history-one in the future, and one in the past. In 'WebWorld', both the reference to the three Money Channel Governments and reference to the three spiritual channels which became one, yet didn't, revolved around the close of Channel War I. But there didn't seem to be a parallel to Channel War I in the Time-Line of the CypherPunks list. Likewise, 'WebWorld' began with a reference to an 'InfoWar Scrambler Mechanism' which seemed to indicate that 'InfoWar' would play a major part in the history of 'WebWorld & the Mythical Circle of Eunuchs.' Yet there were only a few later references in Part II of The True Story of the InterNet in regard to "the beginning stages of InfoWar," with no further details. A Player To Be Named Later strained to touch the wispy haze of memory which was rising somewhere in the back of his mind-a memory which whispered "InfoWar" from somewhere deep in the heart of the CypherPunks mailing list censorship crisis. "Toto!" he said, suddenly feeling a ferocious stinging sensation behind his right ear, which resulted in a loss of balance as he fell to the floor, and a loss of consciousness as the blackness closed in around him� The tattered remnants of the Magic Circle of the future sat quietly around the antique oak table, anxious and depressed. "Why is the Trei Transponder receiving interference from Toto's digital implant?" Priscilla asked the group. "All of my monitoring tests show that the last adjustments we made to the Zooko Zamboni were up to Journeyman standards." "Perhaps it is a result of the differences in the winter climates between the Netherlands and Canada." Jonathan said. "It seems to me that the effects of Global Warming were just beginning to have undeniably noticeable effects in that particular epoch." The Cowboy got up and paced a bit, as the others realized he was working up the courage to say what they were all thinking. "Or.." he hesitated, then turned to face the others and continued, "perhaps the rebirth of InfoWar reflects that our efforts toward changing the past have not only been successful, but are now irrevocable." Jonathan pulled up a passage of 'WebWorld' onto the GraphiScreen, contemplating what he had originally perceived as the failure of InfoWar during the hotly contested battle which took place on the CypherPunks list during the censorship crisis. "January 19, 1997. "The beginning date of the 'moderation experiment' on the legendary CypherPunks mailing list. The beginning probe in preparation for the launching of InfoWar-an experiment which had failed miserably and had caused a delay in the plans of the Evil One. A delay caused by the damnable insolence of the terminal misfits among the CypherPunks. An insolence that was rumored to be fueled by the Circle of Eunuchs, fanning the 'flames' of dissent among the CypherPunks, helping them to resist the herding of their list members into the group-mindset desired by the Evil One." The other members of the Circle of Eunuchs sat still in their seats, not wanting to disturb the deep thoughts of Jonathan, who was indeed the Last True CypherPunk, having grown up at their feet, immersed in their logic and their lore, and whose whole life had been ruled by his connection to the infamous anarchists who had been, alternately, both the shining light of freedom and privacy in their era, and the treacherous instigators of Channel War II-the war which had led to the ultimate triumph of the Gomez and the Dark Allies and the conclusive ascent of the Dark Forces in their domination of WebWorld under the dictum of the Evil One. The room was quiet as Jonathan reluctantly pulled up the next passage of 'WebWorld' which had described his feelings when his bereft past had come back to haunt him. "Jonathan sat frozen in his seat, once again, his brain locked from the major dichotomies being produced as a result of his present-in which the CypherPunks were a villainous band of rogues who had instigated the launching of Channel War II-and his past, in which his grandfather had been exposed both as one of the major players in both the launching of Channel War II, and as traitorous scum who had sabotaged the goals of the CypherPunks in that same historical battle. "Jonathan's grandfather wasn't just a CypherPunk. He was the Fool." "We won�" Jonathan's voice trailed off, before he rose from the table and repeated his statement, in anger. "We won, damn it! "I know we won. Grandfather knew we won the censorship battle. Everyone knew that we won the censorship battle. History itself knows that we won�we�" Jonathan stopped short, turning to stare at the others, who were staring back. "Jonathan�" Bubba said softly. "History has changed." "I know that, damn it!" Jonathan resumed his pacing, knowing that he was missing something very, very important, but he couldn't for the life of him think what it might possibly be. The others in the room watched and waited, knowing that it was Jonathan, and Jonathan alone, whose heritage was intricately and irrevocably linked to the era in history which they had, for better or worse, interfered in through their use of the Trei Transponder. "Grandfather was a traitor to the CypherPunks�a traitor to freedom and privacy. He sabotaged everything that the CypherPunks had fought so hard to defend, since the inception of their anarchist, cryptography mailing list. "But the CypherPunks loved us�" Jonathan was lost in memories of a childhood in which he and his family had been forced to remain in constant motion, staying a half-step ahead of the Dark Allies, who had been hunting down the last remaining members of the CypherPunks-with a vengeance. His family had been soundly welcomed by the remaining CypherPunks, in their flight to freedom after his Grandfather's assassination. They had given the family food, clothing, shelter, and warned them when the Dark Allies were closing in, and it was once again time to flee. Duncan Frissell had even� Perhaps they all had� Jonathan sank to the floor, slowly, with Alexis leaping up and catching him softly. Cowboy helped her guide him toward the table and lower him into a chair. Jonathan slowly pulled off his shirt and stared at his tattoo�the Mark of the Toad. "Duncan Frissell arrived at our last safe house, in the middle of the night." Jonathan spoke, finally understanding the real story behind his family's flight into obscurity. "He warned us to flee, but it was too late�the Dark Allies were close at hand." Jonathan's voice was full of amazement as he recounted an event which he had long known, but had never managed to fully understand. "Duncan held the Dark Allies at bay, while we made our escape. I can still hear his screams�" Jonathan shuddered, then began shaking terribly. Alexis closed her arms around him, hugging him lightly. "Your Grandfather knew that the CypherPunks had lost the battle." Bubba picked up the thread. The other members of the Magic Circle looked on, mystified as to this strange turn of events which turned the whole history of the CypherPunks and the Circle of Eunuchs on hits head. "It wasn't a censorship battle." the Cowboy said, amazed as much by what he was saying as those listening to him were. "It was InfoWar!" "That's what happened to InfoWar." Alexis cried out, in disbelief of her own words. "It was over before it had begun." Bubba d'Shauneaux IV rose to his feet, and filled in the details of the battle as could only be done by one who had spent a lifetime of subterfuge playing a role which was the exact opposite of what it had seemed to be from surface appearances. "It was the first battle fought solely within the bounds of Virtual Reality." "It represented the true nadir point in history when the battle between the Forces of Light and the Forces of Darkness moved beyond the physical plane and into the minds of mankind." "InfoWar!" he roared, the word reverberated throughout the room, sending the Trei Transponder into a soft hum which grew louder and louder, with a pitch that went lower and lower until it became subsonic, unheard, but shaking the room�the earth�even WebWorld itself... The Trei Transponder exploded with a mighty boom, shaking the room so violently that the tattered remnants of the Magic Circle were thrown from their chairs, and found themselves rising to see only ruins around them, where their safe house had once been. They immediately realized that they must flee at once, as those investigating the explosion would undoubtedly be the Dark Allies, fully aware that the event had rent WebWorld at the seams. Jonathan paused, weapon in hand, covering the retreat of d'Shauneaux, who had remained behind to remove the last traces of evidence that the Circle of Eunuchs had ever truly been there. As d'Shauneaux joined him, motioning for him to proceed, he took one last look at the shattered remains of the Trei Transponder. All contact with the CypherPunks of the past was now gone, with little hope of it being renewed. Silently, he sent a message to the CypherPunks of his youth-from the bottom of his soul and into the inestimable profundity of the Tao. It was a message that would be understood by those who had been at Woodstock-a physical gathering of a Magic Circle which had come into physical being through a random blessing of Time and Chance. "You're on you own, folks�because we're sure on ours." Those who fail to learn from the future, are doomed to repeat it. "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite From dformosa at st.nepean.uws.edu.au Wed Oct 8 02:39:08 1997 From: dformosa at st.nepean.uws.edu.au (? the Platypus {aka David Formosa}) Date: Wed, 8 Oct 1997 17:39:08 +0800 Subject: [LONG, off-topic]] Interactive Programming In-Reply-To: <199710071346.GAA11853@toad.com> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On Tue, 7 Oct 1997, Peter Trei wrote: > > Does anyone have > > information about self-modifing programs/routines? Avoid them like the plage. There a true PIA to do anything with. > LISP programmers are much more into writing programs which > build and execute routines on the fly. As are some perl programmers. As both a perl programmer and a lisp programer I have never had the need to use self modifing code. In fact I would consider haveing to use s-m code as a sine that I have made a mistate in my desinge. - -- Please excuse my spelling as I suffer from agraphia see the url in my header. Never trust a country with more peaple then sheep. ex-net.scum and proud You Say To People "Throw Off Your Chains" And They Make New Chains For Themselves? --Terry Pratchett -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBNDtGo6QK0ynCmdStAQGy+AP/bHIcXSSW5id/DAQm+IhUlaHTrS0wZxds KE0Y8dAkwNCoQ+/N5J8aaT4UWfKnR8HHb/7QOggHVTvjVXVF1Q/gIBfDh3TGrwpO 0VztWIEg9K9SjjJFxFgO3ig0bcwtbqEXuE5P4WVeOJhJgNjgm6UgPg38UuZ+EJZ6 G1k7D/IyeRI= =L5S2 -----END PGP SIGNATURE----- From anon at anon.efga.org Wed Oct 8 03:11:56 1997 From: anon at anon.efga.org (Anonymous) Date: Wed, 8 Oct 1997 18:11:56 +0800 Subject: Abuse of Authority Message-ID: -----BEGIN PGP SIGNED MESSAGE----- These excerpts should be useful to those attempting to understand the FBI motivations regarding domestic control of cryptography. - ------------------------------ "The Secret War Against the Jews" by John Loftus and Mark Aarons Pages 181 to 183. Several history books have recorded that American intelligence agencies have conducted wiretaps against U.S. citizens without warrants, but these allegations have concerned operations aimed mostly at the left, particularly Communists and radical black groups. Our sources say that the history books have missed the most important elements of this story of the violation of democratic rights: the systematic electronic eavesdropping employed against American Jews engaged in legitimate political activities. In this chapter we discuss the following allegations: - During World II the covert British wiretap program in the United States against Nazi sympathizers was extended to surveil American supporters of a Jewish state in Palestine. - After the war this program was continued, and massively expanded, as the British gained the cooperation of FBI director J. Edgar Hoover and Secretary of Defense James Forrestal for the illegal collection of electronic intelligence on Zionist activities in the United States. - The once highly secret Communications Intelligence arrangements between Britain and the United States have been deliberately twisted by the intelligence agencies of both countries to allow illegal British wiretaps of American Jewish citizens using American facilities. A reciprocal arrangement exists in Britain. - The illegal campaign against the Jews reached its height during the Reagan-Bush years in the White House, when even Jewish children in summer camp were monitored for "subversive" activities. - Over the years this illegal arrangement has been extended past Jews, Communists, and black radicals, to reach virtually any citizen, including mainstream political candidates, no matter how harmless their activities may have been. The "old spies" say that electronic surveillance of Jews started in 1944, when American Zionists were first wiretapped on a broad scale. The wiretaps were the product of secret wartime agreements between British and American intelligence calling for long-term cooperation to spy on each other's "subversive" citizens. Since that time the bugging of American and British Jews has never stopped. In fact, the wiretaps have been greatly expanded. Our sources, who include a former special agent of the FBI, a former liaison to the NSA, several former NSA officials and employees, a number of former consultants to both American and British intelligence on communications security, and several former officers of the U.S. Army Security Agency, make one point very clearly: For the last fifty years, virtually every Jewish citizen, organization, and charity in the world has been the victim of electronic surveillance by Great Britain, with the knowing and willing assistance of the intelligence services of the United States. This massive and systematic violation of both American and British law has continued, with only slight interruptions, for nearly half a century. As will be seen later in Chapter 12, dealing with the Liberty incident, electronic espionage has been the most deadly threat to Israel's existence from its very inception. It also has been the most continuous criminal violation of the Fourth Amendment to the U.S. Bill of Rights (sic). Jews are not the only ethnic group to be wiretapped at their homes or jobs, although, as we shall see, they are the most frequent targets. To put it bluntly, no citizen is safe anymore. Privacy is gone, search warrants are meaningless, the protections of the courts and constitutions have been overthrown entirely, without the knowledge or consent of our legislatures, presidents, or prime ministers. This ugly corner of Western history has never been fully explored before. It is, perhaps, the most shocking revelation of this book. Because of the sensitivity of this topic, we deal with it in some detail from the beginning. Our sources' first thesis is simple. It is not American intelligence that mounted an intensive surveillance operation against Ben-Gurion's arms purchases in the United States, and cut off this promising source of weapons and equipment. It was British intelligence that wiretapped American Jewish citizens without warrants and leaked the information to the FBI. The truth is that the British had been eavesdropping on the United States for a very long time.[2] The advent of British "electronic" espionage against American citizens goes back to the end of World War I. The British knew that money and guns sent by Irish-Americans were making the difference in the Republic of Ireland's war for independence against the British Empire. The British government compelled American telegraph companies to hand over all message traffic, in order that it could obtain intelligence on Irish nationalist and international Communist activities and take appropriate countermeasures. As the heads of the Western Union and other telegraph corporations revealed to a shocked Senate in 1920, the British were reading all American telegrams. Apparently, even official U.S. government communications were included among the material handed over.[3] As a result of these revelations, Congress passed a law making it a crime to intercept telegraphic or diplomatic communications. There the matter rested, along with the false legend of Secretary of State Henry Stimson's edict that "gentlemen do not read each other's mail."[4] Rested, that is, until the early years of World War II. As previously discussed, while the United States remained technically neutral, the British secret service obtained Roosevelt's permission for Sir William Stephenson to establish an illegal wiretap unit in New York to spy on Americans who were aiding the Nazis. As discussed in Chapter 3, several of our sources say that Roosevelt also was using the British wiretap team to dig up dirt on his political opponents.[5] Pages 191 to 192: Hoover was one of the biggest customers of wiretap information from its inception. In fact, the FBI made no bones about its right to listen in to domestic conversations without a warrant. It wasn't until a 1975 court case that the FBI was finally told that they had no legal right to wiretap individuals or organizations without a warrant, unless there was a proven "agency relationship" with a foreign power. In fact, until the stricter 1975 standards, the FBI could wiretap or place surveillance on any Jew who gave money to any Jewish organization that supported Israel. Here is an example of the type of innocuous information that was forwarded to the FBI as a result of their obsessive surveillance of American Jews: EMMA LAZARUS FOUNDATION OF JEWISH WOMENS CLUBS AMONG LARGER DONORS CONTRIBUTING $500 DURING A FUND RAISING DINNER HELD BY THE EMERGENCY CIVIL LIBERTIES COMMITTEE . . . [ON] DEC 15 1962 AT THE AMERICANA HOTEL NYC IN CELEBRATION OF THE 171ST ANNIVERSARY OF THE BILL OF RIGHTS[43] Apparently, Jews who celebrated the Bill of Rights were considered potential, if not actual, subversives. That remains FBI policy to this day. The FBI refused to accept the restrictions from an adverse 1975 court ruling and leaked its view to the media in a 1977 memo. The FBI still defended its right to spy on person who "might" be supporters of a foreign power, or even anyone in the country who "might" be influenced by a foreign power.[44] Pages 194 to 195: In 1982, shortly after President Reagan agreed to rescind the Carter-era restrictions on domestic Communications Intelligence operations, the FBI was asked to record all information on "potential" Jewish subversives. As one source wrote, the wiretapping had nothing to do with Pollard: "the arrest of Pollard [in 1985] was used as a pretext to expand a supposedly closed-down illegal covert operation by the FBI called 'SCOPE' whose purpose was to compile lists of Jews in government, research, and institutional leadership, et al. This operation was revealed publicly in 'The Wall Street Journal', January 17, 1992."[54] This source believed that "The Wall Street Journal" article was really an exercise in damage control, an attempt to shift the blame back to James Jesus Angleton and conceal the ongoing wiretapping. While there is some dispute about when and why the bugging resumed, the consensus of our sources is that the modern version of Operation Gold is horrendous. The FBI's collecting has gone beyond the pale of what could be considered legitimate intelligence gathering. In addition to rosters of major contributors to Israeli funds, the Bureau has targeted the innocuous activities of children. "It's just gotten out of hand. . . . I saw FBI records where they collected lists of kids going to Jewish summer camp."[55] Other government officials who reviewed the FBI's "counterterrorist" program against American Jews said that while they did not catch any terrorists, they collected a lot of information on Jewish lobbyists.[56] Another NSA source alleged that the FBI had custody of the Jewish surveillance files because a recent law made the FBI's "counterterrorism" files completely exempt from the Freedom of Information Act, under a special counterintelligence loophole.[57] Under the FBI's broad definition of an espionage suspect, anyone who communicates with a foreign government - for example, who calls a relative in Israel or donates to a charity that sends funds to Israel - - gets swept up in the electronic vacuum cleaner. "Pollard paranoia" swept through the intelligence community, brushing aside the Bill of Rights. Selected footnotes for Chapter 8, "Spying on Zion". [2] Confidential interviews, former officer, the NSA; former special agent, FBI, 1982-1989. [3] "'In July 1919 . . . when British censorship ceased, we were ordered by the British government to turn over to them all messages passing between our own offices, 10 days after they were sent. . . . they wanted these messages only for such supervision as might give them an inkling of pending disorders within Great Britain, I assume having to do with Irish unrest, and also to do with Bolshevik propaganda.' "Asked by Senator Kellogg whether the messages turned over to British intelligence included United States government communications, the cable chief buckled. 'If you don't mind, I would not like to answer that,' he pleaded. 'It puts my company in a very embarrassing position with the British Government.'" James Bamford, "The Puzzle Palace" (New York: Houghton Mifflin, 1982), pp. 329-330. [4] Ibid., p. 40. As one [of] our sources, an expert on NSA history, pointed out, Stimson did not make that remark at the time. It first appeared in a post-World War II biography. [5] Confidential interviews, former NSA officer; former Special Agent, FBI, 1982-1989. [44] Bamford, "The Puzzle Palace", p. 297 [44] "The foreign influence thesis became a courtroom issue in the Spring of 1977 with the Kearney wiretapping and mail interception indictment [charges later dropped] based on FBI efforts to locate and apprehend the Weather Underground fugitives. A 400-page 'top secret' report . . . was prepared by FBI researchers and leaked to the press to establish that no crimes were committed because [of] inherent executive power, unrestrained by legal or constitutional requirements. The taps and mail interceptions, the report argued, were legitimate counter-intelligence practices sanctioned by a reservation in the Keith case, excluding targets with 'significant connections' with a foreign power. . . . In June 1975, the vague language of Keith was sharpened by an appellate court ruling (Zweiborn v. Mitchell) that mere influence or support of a foreign power did not deprive a domestic group of the protection of warrant requirements in the absence of a showing of an actual agency relationship or collaboration." Donner, "The Age of Surveillance", p. 279. [54] Confidential source letter, January 7, 1993, p. 3. [55] Confidential interview, agency withheld to prevent identification. [56] Confidential interviews, current and former officers in several government agencies that liaise with the FBI, including but not limited to Defense, State, and Justice departments. [57] Confidential interview, former official, the NSA, 1990. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDsYG5aWtjSmRH/5AQECdAf/Q8kK7TSOPhko+sPYQ7wM/AirRSnSt8Oo J901w3M/C+8/t0VQG6JDiVWU/lLl2Zc3YuMpHucIylnDHrE4/WmcgiA1wMvv3+/e uPjO1Vf9p631nmA0brnZuKDCN+MtInkeLzE2H6S13DOclZ/X8SrIlA4elllQZEb9 zQRfusjcqmAZyL/VRTTT1kZr8K5v4wNfMNqv7gMfhn8DCR1KhpJM6yWdV8RKcjFV qNiol0e57WQTEkv4oweugwLVvTbeeDIoyzKokkKWNOvXTCl4DlNWiUYZEj9H6CFY jmSiCVpJ7X+BIifPoDSJctGdmmCS+JiMyJv1FZSBgDEDc+H7PcsI1Q== =TLVL -----END PGP SIGNATURE----- From ravage at ssz.com Wed Oct 8 05:18:46 1997 From: ravage at ssz.com (Jim Choate) Date: Wed, 8 Oct 1997 20:18:46 +0800 Subject: Internet Via Electric Lines? (fwd) Message-ID: <199710081234.HAA11747@einstein.ssz.com> Forwarded message: > From: "William H. Geiger III" > Date: Wed, 08 Oct 97 01:28:42 -0500 > Subject: Re: Internet Via Electric Lines? > This is nothing new. At least late 70's. > I think it was GE that several years ago created phone extensions that you > plugged into your power outlets, no need to run wire to put in an extra > outlet. I believe that X-10 uses this same principle for computer control > of household appliances. > > Not to mention data leakage through power lines is an issue long reconized > by the TEMPEST crowd. > > The trick here seems to be in routing the data. How do you get data on the > power grid routed to the location that you want it to go?? The trick with X-10 is to stay away from transformers as the signal won't go through them effectively. This ends any dreams of sending data to your neighbor, the signal won't go through your power meter. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From Michael.Johnson at mejl.com Wed Oct 8 05:56:39 1997 From: Michael.Johnson at mejl.com (Mike) Date: Wed, 8 Oct 1997 20:56:39 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <3.0.3.32.19971007142710.00a22970@mail.pgp.com> Message-ID: <3.0.3.32.19971008144658.00929840@localhost> Jon Callas wrote: >To sum up, we created the Corporate Mesage Recovery feature to satisfy the >requirements of our customers who need emergency access to data. We made >careful decisions to make it useful and effective for honest people, while >minimizing its potential for abuse. No one has to use it; we do not include >it with PGP freeware, nor with PGP for Personal Privacy. What happens when the non corporate versions of PGP encrypts a message to Alice? Will they disregard the recovery key and encrypt to Bob, or simply fail? Mike. From randerso at ece.eng.wayne.edu Wed Oct 8 06:16:25 1997 From: randerso at ece.eng.wayne.edu (Ryan Anderson) Date: Wed, 8 Oct 1997 21:16:25 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <36e200bba528c46e3694521079832b77@anon.efga.org> Message-ID: <3.0.2.32.19971008090442.0070305c@ece.eng.wayne.edu> -----BEGIN PGP SIGNED MESSAGE----- At 03:26 AM 10/8/97 -0400, Anonymous wrote: >>This downside is particularly insidious for a number of >>reasons. First, without fixing that problem, strong cryptography will >>be in some sort of limbo. You want to use it to protect your valuable >>information, but you won't want to use it for any information that's >>*too* valuable, because it's easily lost. Crypto-protected >>information is fragile, and this fragility could hurt its widespread >>deployment. > >What you call "fragility" is properly called "security". Would you >describe 128-bit keys as more "fragile" than 40-bit keys? Why is PGP, >Inc. inventing propaganda terms for the authorities? Okay, call it security but the point is, if you're protecting documents vital to your company using encryption (say the design of a new product) and the person who knows the passphrase dies, you've just lost a great deal of money. PGP for Business Security gives the business a way to have a backup key that can read that person's information. Frankly, it might not be able to read anybody elses, from the description given. This is a feature that any business (that understands encryption) will want. They can easily store the secret keys of the other id someplace secure, and never retrieve them until someone dies. Disavow knowledge of them to government, etc. heck, the keys can even be in the primary person's posession. (Perhaps stored in a safe-deposit box, or without a passphrase, etc.) >>Data recovery is useful for a number of things. Perhaps you lost your >>passphrase. Or data might have been encrypted by an employee or co >>worker who was in an accident. (As an aside, fifteen years ago, the >>architect of a product I worked on was in a severe car wreck. He was >>not killed, but suffered brain damage and has never returned to >>work.) Your spouse might need access to financial records. Everyone, >>be they an individual, business, or coporation has a right to having >>their data protected, and protection not only means being able to put >>it into a safe, but getting it out of that safe later. > >It is fascinating to me that every example you use does not involve >decrypting transmitted messages. Yet, that is the feature which is >under discussion. Amazingly, he gave an example where, had encryption been used, the project would have stopped, and restarted because the person with the keys was incapacitated. Are you just being combative here? >The demand for the ability to decrypt encrypted messages in the >corporate environment can easily be measured with this test: how many >companies have a policy that requires employees to record all outgoing >mail? Well, any company giving stock advice (and governed by SEC rules on stock tips, etc.) is already require to have all outgoing mail approved (e-mail and snail), so does it matter if they record it or not? -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNDuE6Tc3ytqHnNyNAQFzTQP/cLBt7fwDLXHyVecvoB3U1y0aRNXA22IH Eceiuc4itfZjRG4mwokIzrTnhIUeEqF5BommDqDwdXxg/re1JMYETj4v9apD47Lt nIFVc+mNvKVDQOLtp9cETgepm76IqgHUWZgQxKkgTFtANM5IxXn8IkI51ATd2A3E hj4npnS3bYQ= =0Ib2 -----END PGP SIGNATURE----- ----------------------------------------------------------------------- Ryan Anderson - "Who knows, even the horse might sing" Wayne State University - CULMA "May you live in interesting times.." randerso at ece.eng.wayne.edu PGP Fingerprint - 7E 8E C6 54 96 AC D9 57 E4 F8 AE 9C 10 7E 78 C9 ----------------------------------------------------------------------- From hua at chromatic.com Wed Oct 8 06:55:51 1997 From: hua at chromatic.com (Ernest Hua) Date: Wed, 8 Oct 1997 21:55:51 +0800 Subject: Abuse of Authority In-Reply-To: Message-ID: <199710081345.GAA11834@ohio.chromatic.com> > These excerpts should be useful to those attempting to understand the > FBI motivations regarding domestic control of cryptography. > > - ------------------------------ > "The Secret War Against the Jews" by John Loftus and Mark Aarons > Pages 181 to 183. > > Several history books have recorded that American intelligence > agencies have conducted wiretaps against U.S. citizens without Isn't this better sent to Jewish organizations? Sending this sort of stuff here is definitely preaching to the choir. Ern -- Ernest Hua, Software Sanitation Engineer/Chief Cut And Paste Officer Chromatic Research, 615 Tasman Drive, Sunnyvale, CA 94089-1707 Phone: 408 752-9375, Fax: 408 752-9301, E-Mail: hua at chromatic.com -- #!/bin/perl -sp0777i > To: cypherpunks at cyberpass.net > From: Jonathan Wienke > I heard on the ABC hourly news that some genius had figured out a way > to use electrical power lines for data transmission, so that the power > grid could be integrated into the Internet. Does anyone have any > details / pointers? > Jonathan Wienke I've heard of two methods; one is to transmit the data as a high frequency FM signal along the wire. The other is to use power lines which include an optical fibre. Both have problems. The FM signal has difficulty going through transformers (there are lots of transformers, with the final step-down usually occuring at a pole-top near your house). Also, you have to be very careful about isolating the data output from the power line: an error could send 110VAC into your serial board. I haven't heard of this method being used on a wide scale, but it might work as a LAN. The optical method may actually be implemented. Putting a few optical fibers into a power line is cheap, easy, and widely done. The idea was originally that power companies could read your electrical meter remotely, but the bandwidth available is gross overkill. Thus they are also thinking of adding Cable TV, telephony, and data services. There are still problems. You are basically building a data network on top of the power grid, and the topologies don't really match up. Also, employees have to be trained to splice optical fibers and install routing equipment, and millions of miles of power lines and hundreds of millions of junctions need to be replaced or reworked. There was a rosy article about this in Wired a few years ago. I have heard nothing since. Peter Trei trei at process.com From txporter at mindspring.com Wed Oct 8 07:19:43 1997 From: txporter at mindspring.com (Thomas Porter) Date: Wed, 8 Oct 1997 22:19:43 +0800 Subject: Internet Via Electric Lines? In-Reply-To: <199710081234.HAA11747@einstein.ssz.com> Message-ID: <3.0.1.16.19971008100904.56dff586@pop.mindspring.com> At 07:34 AM 10/8/97 -0500, Jim Choate thoughtfully expounded thus: > >The trick with X-10 is to stay away from transformers as the signal won't go >through them effectively. This ends any dreams of sending data to your >neighbor, the signal won't go through your power meter. Ahh, the memories this brings back! I once worked for a large hosiery manufacturing company that markets its products in a little egg-shaped container, which to protect the stupid, shall remain unnamed. Around 1979, they wanted to automate the collection of manufacturing information on the shop floor using terminals available to the slaves (Err, I mean piecework workers), and some bright lad had the idea of impressing the signal on the power supply in the factory. This was OK until they found out that they drew three separate 110 volt runs off of their three-phase main supply, and the signal wouldn't make it from one run to the other, this dividing the system up into three non-communicating separate networks. This was shelved, and the hand-built data collection terminals were reworked to plug into coax instead. Unfortunately they then decided on a ring topology for the network linking all the little hand-built terminals, combined with a sequential polling system that wouldn't skip a terminal if it didn't answer!!! This lead to one of the more interesting periods in my life, spending six months every other week in a Southern textile town baby-sitting little grey boxes. When one quit working, I had to make a tour of the network loop, resetting little gray boxes until the network came back up again. The fact that workers sewing pantyhose build up incredible static electric charges didn't help matters any, and lead to cryptic instructions to the workers to touch the metal terminal stand before entering any information into the system!! One can only imagine the Pavlovian effects this had on worker acceptance of this new, improved data collection system. Ten years ago, the little grey boxes were gathering dust in a storage room. Five years ago, I could not find anyone who recalled working on this project(!) Tom Porter txporter at mindspring.com ------------------------------------------------------------------------ "On two occasions I have been asked [by members of Parliament], 'Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?' I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question." FIGHT U.S. GOVT. CRYPTO-FASCISM, EXPORT A CRYPTO SYSTEM! RSA in PERL: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 > From: Jonathan Wienke > At 09:37 AM 10/6/97 -0700, Bill Frantz wrote: > >At 3:01 AM -0700 10/6/97, Peter Trei wrote: > >>The plutonium cores of thermonuclear devices have a limited shelf > >>life - he claimed 6 years, which jibes with what I've heard from > >>other open sources. Fission products build up in the cores which > >>can poison a chain reaction. Thus all Pu based devices need to have > >>the cores periodically removed and replaced with new ones, while the > >>old ones have to go through a non-trivial reprocessing stage to > >>remove the fission products. > > > >I think this comment is in error. Plutonium has a half life on the order > >of 250,000 years, so very little decay products would build up in 6 years. > >The tritium used in thermonuclear weapons has a much shorter half life, and > >would need to be replaced about that often. > > One of the decay products of tritium (half-life: 12.5 years) is Helium-3, > which aggressively absorbs neutrons and poisons the fission reaction of the > plutonium. If one has access to more tritium, which is commercially > available for about US $50,000 per gram, the existing tritium can be > purified and combined with the new tritium to bring the bomb back to full > power. If someone has the resources to obtain the bomb in the first place, > refreshing the tritium probably wouldn't be a major problem. > > > Jonathan Wienke I conceed that it may not be the Pu decay products that cause the limited shelf life of thermonuclear weapons; I suspect that it may be components of the 'pit', which produces the initial burst of neutrons to kick of the reaction (the pit is effectively a small fission bomb). This 'pit' may contain tritium (pit design is a very well guarded secret, and I've seen very little about it in the open literature). > If someone has the resources to obtain the bomb in the first place, > refreshing the tritium probably wouldn't be a major problem. I disagree. A terrorist could obtain a bomb by being given it, stealing it, or buying it as a turnkey system. However, I suspect that anyone with the facilities to recondition one of these weapons could also build one from scratch. I don't know if it's comforting or worrying knowing that these devices degrade - any in the hands of terrorists have a limited time that they are a threat, but that fact may pressure a terrorist to 'use it or lose it'. Peter Trei From 19417970 at aol.com Wed Oct 8 23:30:11 1997 From: 19417970 at aol.com (19417970 at aol.com) Date: Wed, 8 Oct 1997 23:30:11 -0700 (PDT) Subject: Credit Problems? Get a Second SS#!!!!!!! Message-ID: <199709240243.BAA12837@instaemail2all.net> ************************************************************************************************* This is a one time message, please forgive me if you are offended by receiving this---you will automatically be removed if you do not order. thank you ************************************************************************************************* NEW CREDIT FILE LEGALLY!!!! Bad credit? Judgements? Other problems? THIS IS THE PROGRAM FOR YOU!!!! Learn how to open a second (or more) SEPERATE credit file. This unique and virtually unknown program is 100% legal, and can work every time!!! This is the chance you have been looking for. You no longer have to be embarrassed about your credit problems----THIS IS YOUR CHANCE FOR A NEW START!!!!----remember that it does not matter what your credit past is. You will now be able to get: ***CREDIT CARDS ***CAR LOANS ***BANK LOANS ***MORTGAGE LOANS ***RENT AN APARTMENT This program will even show you how to REPAIR your old credit file, WHILE you enjoy your AAA credit, in as little as 30 days. REMEMBER----YOU CAN ONCE AGAIN HAVE GOOD (AAA) CREDIT!!!! This is a first time promotional experiment on the internet. Our program normally sells for $79, but act now to get our limited discount offer!!! ONLY $29 (PLUS $3 FOR S&H) ACT NOW!!!!! ONLY A LIMITED NUMBER TO BE SOLD AT THIS PRICE (250) AND ONCE THEY ARE GONE--THAT IS IT!!!!!! SEND $32 ---CHECK, MONEY ORDER, OR CASH TO: D W C P.O. Box 54789 Phoenix, AZ 85078 Be sure to include your: NAME_________________________________ ADDRESS_____________________________ E-MAIL ADDRESS_______________________ PHONE NUBER_________________________ If you would like to learn how to make extra income write "I WANT TO EARN AN EXTRA $50,000 PER YEAR" on your order From canoe at poppy.dyndns.com Wed Oct 8 08:32:52 1997 From: canoe at poppy.dyndns.com (Judith Lewis) Date: Wed, 8 Oct 1997 23:32:52 +0800 Subject: Internet Via Electric Lines? In-Reply-To: <199710081351.GAA15055@toad.com> Message-ID: Tuesday October 7 2:58 PM EDT New Power-line Telephone Technology Set To Hit UK LONDON - Electricity companies may become the latest providers of telephone and Internet services to your home. Forget separate lines from telephone or cable companies: you might talk and send computer data at high speed via existing power cables -- the same lines that supply electricity to your washing machine and fridge. The electricity lines have been able to carry telephone signals and computer data for some time but not in a commercially viable way because they were too slow. Britain's Norweb Communications, part of United Utilities, and Canada's Northern Telecom, however, appear to have developed a new technology to speed things up considerably. "The technology has been successfully tested, is ready for the mass market, has the potential to stimulate major growth in Internet use, and will change the future for electricity utilities," the firms said in a statement. They will announce details at a news conference on Wednesday, but media reports here said the new technology allows computer data to be whizzed around at more than 10 times the speed of current average Internet modems. Copyright, Reuters Ltd. All rights reserved On Wed, 8 Oct 1997, Peter Trei wrote: > > To: cypherpunks at cyberpass.net > > From: Jonathan Wienke > > I heard on the ABC hourly news that some genius had figured out a way > > to use electrical power lines for data transmission, so that the power > > grid could be integrated into the Internet. Does anyone have any > > details / pointers? > > > Jonathan Wienke > > I've heard of two methods; one is to transmit the data as a high > frequency FM signal along the wire. The other is to use power lines > which include an optical fibre. > > Both have problems. > > The FM signal has difficulty going through transformers (there are > lots of transformers, with the final step-down usually occuring at > a pole-top near your house). Also, you have to be very careful about > isolating the data output from the power line: an error could send > 110VAC into your serial board. I haven't heard of this method being > used on a wide scale, but it might work as a LAN. > > The optical method may actually be implemented. Putting a few optical > fibers into a power line is cheap, easy, and widely done. The > idea was originally that power companies could read your electrical meter > remotely, but the bandwidth available is gross overkill. Thus they > are also thinking of adding Cable TV, telephony, and data services. > > There are still problems. You are basically building a data network > on top of the power grid, and the topologies don't really match up. > Also, employees have to be trained to splice optical fibers and > install routing equipment, and millions of miles of power lines and > hundreds of millions of junctions need to be replaced or reworked. > > There was a rosy article about this in Wired a few years ago. I have > heard nothing since. > > Peter Trei > trei at process.com > From whgiii at invweb.net Wed Oct 8 08:44:36 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Wed, 8 Oct 1997 23:44:36 +0800 Subject: Internet Via Electric Lines? (fwd) In-Reply-To: <199710081234.HAA11747@einstein.ssz.com> Message-ID: <199710081521.LAA18348@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <199710081234.HAA11747 at einstein.ssz.com>, on 10/08/97 at 07, Jim Choate said: >Forwarded message: >> From: "William H. Geiger III" >> Date: Wed, 08 Oct 97 01:28:42 -0500 >> Subject: Re: Internet Via Electric Lines? >> This is nothing new. >At least late 70's. >> I think it was GE that several years ago created phone extensions that you >> plugged into your power outlets, no need to run wire to put in an extra >> outlet. I believe that X-10 uses this same principle for computer control >> of household appliances. >> >> Not to mention data leakage through power lines is an issue long reconized >> by the TEMPEST crowd. >> >> The trick here seems to be in routing the data. How do you get data on the >> power grid routed to the location that you want it to go?? >The trick with X-10 is to stay away from transformers as the signal won't >go through them effectively. This ends any dreams of sending data to your >neighbor, the signal won't go through your power meter. This seems to be a Goodthing(TM) for residential X-10 as it would seem to take care of a lot of security issues by effectively isolating each home from others who may be running the same system. Has anyone researched the security issues around X-10? Is the Transformer isolation good enough protection from a dedicated attack (as opposed to accidental signal leakage)? Are their alternative routes for transmitting the FM signal (Airwaves) that the X-10 devices would pick up?? Do any of the current X-10 devices use signal authentication/verification? - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNDumpo9Co1n+aLhhAQGZBAQAo9u4WuKIJ7WfDxaK83X/lwsLpzVDhx+4 lPAlY8ERqBjQwMc8txV+vW9cLl0rHi0Q8YgW+U9vlqlb67re2sjebFqKbQ1c5heZ WMc+nXNeM5MZ65K/dXKPPGl3RhzMw3syBu37s+KD3v6V2C7XJLudH/AnruYBmXF/ ad0+z1S6q9c= =oxPQ -----END PGP SIGNATURE----- From ian.sparkes at t-online.de Wed Oct 8 08:51:39 1997 From: ian.sparkes at t-online.de (Ian Sparkes) Date: Wed, 8 Oct 1997 23:51:39 +0800 Subject: Internet Via Electric Lines? In-Reply-To: <199710081351.GAA15055@toad.com> Message-ID: <3.0.2.32.19971008173309.006c5a34@q9f47.dmst02.telekom.de> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >> I heard on the ABC hourly news that some genius had figured out a way >> to use electrical power lines for data transmission... FM >The FM signal has difficulty going through transformers (there are >lots of transformers, with the final step-down usually occuring at >a pole-top near your house). This has been widely used as a (very) local area network - you can find a number of Hobby-style projects in electronics magazines dating years back. The transformers, which are designed for 50/60Hz, should look like brick walls to any carrier frequency that can cope with a meaningful bandwidth. This probably explains why it is local. Additionally, I have heard that the power companies tend to get uppity about even the local variant - apparently it impacts their supply monitoring. Optical >[...] Putting a few optical >fibers into a power line is cheap, easy, and widely done. But much cheaper and easier is using the signalling gulleys that run along the side of the railways - no High Tension precautions, no scaling pylons. This, incidently is the reason that a number of telecomms consortia (in europe, at least) include a railway element - they provide the long-haul backbone. [...] >Also, employees have to be trained to splice optical fibers and >install routing equipment, and millions of miles of power lines and >hundreds of millions of junctions need to be replaced or reworked. And that's the 'cheap & easy' mentioned above? -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDuntfzOjjBJiFUeEQLX+wCfZu20gO0gc2SahIGPm0+QRKjIDV0AoIhk 81RJqpql8IIKwZXOapVCZthK =8Una -----END PGP SIGNATURE----- From anon at anon.efga.org Wed Oct 8 09:04:07 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 9 Oct 1997 00:04:07 +0800 Subject: None Message-ID: For what its worth; Australian Financial Review 8-10-97 http://www.afr.com.au/content/971008/inform/inform5.html ********************************** Power play to plug in the Internet In what could usher in a new era of competition between telephone companies and electric utilities, engineers have developed a breakthrough technology that lets homeowners make phone calls and access the Internet at high speeds via the electric outlets in their walls. If the technology from United Utilities plc and Northern Telecom Ltd proves commercially viable, it could transform power lines around the world into high-speed conduits on the information superhighway. Because electric utilities are wired into virtually every home and business, the new technology could provide easy entry into the phone and Internet access businesses, thus posing a serious threat to current providers of those services. United Utilities, a power company, and Northern Telecom, a Canadian maker of telecommunications gear, confirmed that their system was "ready for mass market", but declined to reveal details. The two companies have tested phone service over power lines in about a dozen UK households over the past 12 months -- with positive results, according to Alistair Henderson, chief of technology at Energis plc, the telecommunications unit of National Grid Group plc. AP-Dow Jones =A9 This material is subject to copyright and any unauthorised use, copying or mirroring is prohibited. ********************************** Ooops i didnt know my mailer was loaded orifacer From tcmay at got.net Wed Oct 8 09:13:02 1997 From: tcmay at got.net (Tim May) Date: Thu, 9 Oct 1997 00:13:02 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <36e200bba528c46e3694521079832b77@anon.efga.org> Message-ID: At 6:04 AM -0700 10/8/97, Ryan Anderson wrote: >Well, any company giving stock advice (and governed by SEC rules on stock >tips, etc.) is already require to have all outgoing mail approved (e-mail and >snail), so does it matter if they record it or not? > Could you give me some cites for this rule? My own stock broker seems to be sending me stuff on the spur of the moment, so unless he has a government agent sitting in his office approving these notes he sends me, there is no "outgoing mail approved (e-mail and snail)" situation. Further, I dispense stock advice on occasion, and can, like all persons, be charged with insider trading, violations of SEC rules, etc., under the right circumstances. And yet my mail, e-mail or USPS, is _not_ subject to "approval." Being subject to SEC rules does not mean prior approval, or cc:ing of mail to the SEC, etc. (They can try to get a warrant if they think I've violated the insider trading or other securities laws. But no "approval" is needed, nor of course is any escrow of keys required.) I won't comment on the very long post Jon Callas so thoughtfully prepared for us....it's too long for casual comment. My initial glance at it suggests that it addresses problems most businesses don't perceive to have. (When I was Intel, we didn't have crypto. But if we did, the real concern would be encryption of lab notebooks, documents on disk, etc., not my communications with outsiders. These are the files which would vanish were I to be hit by a truck. As we have discussed many times, how does escrowing the _channel_ key (Alice sending to Bob) solve the "hit by a truck" problem?) --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From trei at process.com Wed Oct 8 09:13:19 1997 From: trei at process.com (Peter Trei) Date: Thu, 9 Oct 1997 00:13:19 +0800 Subject: Internet Via Electric Lines? Message-ID: <199710081601.JAA15326@toad.com> > Ian Sparkes > Peter wrote: > >[...] Putting a few optical > >fibers into a power line is cheap, easy, and widely done. > > But much cheaper and easier is using the signalling gulleys that run > along the side of the railways - no High Tension precautions, no > scaling pylons. This, incidently is the reason that a number of > telecomms consortia (in europe, at least) include a railway element - > they provide the long-haul backbone. It looks like we're seeing different parts of the problem. You're worried about the long-haul backbone. I'm trying to see ways to get a 10Gbps fibre into my living room. The backbone cost is a tiny fraction of the cost of getting fiber into every house in the country. > [...] > >Also, employees have to be trained to splice optical fibers and > >install routing equipment, and millions of miles of power lines and > >hundreds of millions of junctions need to be replaced or reworked. > > And that's the 'cheap & easy' mentioned above? Building a few optical fibers into a cable as it is being manufactured is cheap and easy, as is using fiber-equipped cable if you are installing new lines, or replacing old ones for other reasons (installation costs are usually far higher than the cost of the line itself). It's hooking up all the fibers into a meaningful network that gets expensive, which was my point. Peter Trei From attila at hun.org Wed Oct 8 09:16:16 1997 From: attila at hun.org (Attila T. Hun) Date: Thu, 9 Oct 1997 00:16:16 +0800 Subject: privacy rights: giving away the store Message-ID: <19971008.143034.attila@hun.org> -----BEGIN PGP SIGNED MESSAGE----- do you believe this? so what happened to our privacy? the man screams about privacy and encryption one minute, then: > What if I told you there's one easy thing you can do to make > your 1998 Internet experiences simpler and safer? Get a > digital ID. Jesse Berst, ZDNet AnchorDesk, full story at http://www.zdnet.com/anchordesk/story/story_1324.html really? > Also called digital certificates, digital IDs (DIDs) are > like electronic passports -- universal ID cards that prove > your identity to anyone who needs to know. You get a DID > from an independent certificate authority such as VeriSign, > which performs a background check first. just what I wanted, a fucking background check. nice schill, Jesse. OK, I'll call my broker and buy Verisign stock. they're going to be worth bocu bucks taking over the fascists' National ID project. > ...Most Web servers have it already. Most email programs > will have it by the end of the year. And both major > browsers... gee, that's clever. but The NYTimes, The Times [London], the Telegraph, and so on, already log me in immediately with a cookie I authorized. why do I need certified identity? even Wired mag knows me as Attila T. Hun. interNIC knows me as Attila T. Hun, I even get mail to my drop box as Attila T. Hun.... My check writer can even print checks as Attila T. Hun (the bank does not care what the name on the check is --just the MICR numbers). > ...Your bank knows for sure that it's really you... sure, after I enter my password... so what's the big deal? that's all I do now. automated, too. > Simpler Surfing. Sick of separate names and passwords > for each site? A single DID will authenticate you for > any site that supports the technology -- about 20,000 at > last count, including Netscape Netcenter, Internet > Shopping Network, K-Mart, Cellular One and many others. OK, but I still must ID my system with my National-ID card available from the cookie wash. I dont see any place to turn it off! bastards! --they've implanted it under my skin. why? so big government or big business can really catalogue my political views by the stories I read? maybe it's my anti-authoritarian, psychotic behaviour and rants against fascist oligarchies, or, maybe because I post to Cypherpunks? > ...you'll help the Internet make an important transition > --from a fun place to surf to a safe place to do business. aah haa! I knew there was a reason for all this hoopla! What's good for Bill Gate$ is good for the country. ...uuh, sorry Mr. AL (GM) $loan; I meant to quote you correctly: "What's good for General Motors is good for the country." > A safer Internet is at hand. All you have to do is seize it. no, jesse, you got that one wrong --the coy fascist dog F[reeh,uck] just seized you --and the rest of the suckers that fall for Verisign's National-ID. attila still going out... -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDuu5704kQrCC2kFAQFXxgQAo/THjROjaWOCEdsFD0K9Yy1SXu6G2I3Z W7GDfTEv4bwalBUSwzHQJjPNcfrYnRoNpxkWm+kHiqolvoJP2XKtk89tnTumwyvK EfBLPbxRz0lfsXmxy5iNJXWEyJ1Tb3mYbu5CQuAhkWpFhP4xVaRsVSDzCzkmtnBs 7YRH8+KSwoI= =piYW -----END PGP SIGNATURE----- From emc at wire.insync.net Wed Oct 8 09:35:17 1997 From: emc at wire.insync.net (Eric Cordian) Date: Thu, 9 Oct 1997 00:35:17 +0800 Subject: Jackbooted Posturing in Panama Message-ID: <199710081625.LAA15575@wire.insync.net> Five years after the US military murdered thousands of Panamanian civilians, and bulldozed their bodies into mass graves prior to the arrival of the press, the US is again demonstrating its unmitigated arrogance on the world scene by staging a show trial of a Panamanian citizen accused of killing a US soldier. Jury selection began Tuesday in the trial of Pedro Miguel Gonzalez, the son of a prominent Panamanian politician. Gonzalez, who was at a demonstration protesting Bush's impending visit, denies any connection to the incident in which a US vehicle was sprayed with gunfire. He has been in hiding since the 1992 incident, fearing he could not get a fair trial from the US-installed Panamanian government. At the time, the US government promptly termed the killing of the US soldier a "terrorist act", and offered a $100,000 reward for the identity of the perpetrators. The pretense for the US invasion, and subsequent massacre, as announced on television by President Bush, was that Panamanian soldiers had kicked a US soldier who had run a roadblock. The hidden agenda was retaining US control over the Panama canal after it appeared relations between the US and Panama might turn sour. In addition to killing thousands of civilians, the US also kidnapped Panama's President, Manual Noreiga, and convicted him in the United States of various vague drug-related charges, after installing a regieme sympathetic to the United States. Gonzalez faces 20 years in prison if convicted. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law" From frantz at netcom.com Wed Oct 8 09:50:39 1997 From: frantz at netcom.com (Bill Frantz) Date: Thu, 9 Oct 1997 00:50:39 +0800 Subject: russia_1.html In-Reply-To: <199710081352.GAA17135@mail6.netcom.com> Message-ID: At 3:01 AM -0700 10/8/97, Peter Trei wrote: >I don't know if it's comforting or worrying knowing that these >devices degrade - any in the hands of terrorists have a limited >time that they are a threat, but that fact may pressure a terrorist >to 'use it or lose it'. What I have heard about these suitcase nukes is that they yield about 1-2 kilotons. I know of no technical reason for them to be thermonuclear devices. As such, the decay of tritium would not seem to affect them. (They will still need a source of neutrons, which might go bad faster than the plutonium/U235.) I feel very little comfort. ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz at netcom.com | nation it is today. | Los Gatos, CA 95032, USA From jrussell at syncrypt.com Wed Oct 8 09:54:31 1997 From: jrussell at syncrypt.com (Jim Russell) Date: Thu, 9 Oct 1997 00:54:31 +0800 Subject: What's really in PGP 5.5? Message-ID: <01bcd407$02595600$2901320a@Polaris.domain> The swirl of controversy that has arisen since the 2 Oct announcement of the PGP Business Security Suite has been quite amazing. Yet, all of the focus has been on what's been *added* to PGP v5.5. Jon Callas said it explicitly: >>Corporate Message Recovery is included *only* in PGP for Business Security. What sense, then, can I make of the following? I have been examining the published source code for PGP v5.0 for Personal Privacy (note that this is *not* a corporate version), and have discovered that this recovery scheme already appears to be in place, in some form at least, in that version. The following code appears in the published pgp.c, lines 518-537: /* * This is our version of "Commercial Key Escrow". * * A company can set the CompanyKey in the site-wide * configuration file and it will be added to the * recipient list for all encrypted messages. Then * again, the user can override the setting in their * own pgp.cfg or on the command line. */ companyKey = pgpenvGetString (env, PGPENV_COMPANYKEY, NULL, NULL); if (companyKey && *companyKey) { /* Add the company key to the recipient list */ e = ringSetFilterSpec (ui_arg->arg.ringset, ringset, companyKey, PGP_PKUSE_ENCRYPT); if (e <= 0) exitUsage(e); } This certainly *looks* like the implementation that is being discussed in the press release, although I did not find it mentioned in any documentation for PGP for Personal Privacy v5.0. The questions this code brings to my mind are: 1. Does this mean that even the Personal Privacy versions of PGP have a message recovery scheme available? The 2 Oct press release from PGP states that the corporate message recovery "transparently integrates with *any* version of PGP client software". (Emphasis mine). 2. If this is implemented via a configuration setting, does it provide an opportunity for an attacker to reset the "CompanyKey" to their own key? In the Windows environment, it appears that PGP uses the System Registry to hold configuration settings. Is it possible for me to trick someone into running a .REG script that will set the CompanyKey to a key to which I hold the private component? 3. This appears to me to be quite contradictory to the descriptions posted by Jon Callas on 7 Oct. The procedure that Jon describes, using an attribute in the self-signature, would tell an encryptor external to The Corporation to use the "skeleton key" on INCOMING mail. The 5.0 code seems to imply an automatic extra recipient on OUTGOING mail, and this impression is reinforced by the description of the SMTP server policy enforcement in the 2 Oct product description on PGP's web site. (Let's not forget that SMTP is a protocol for OUTGOING mail.) Which is it, or is it actually both? Now, I realize that the long-time PGP users, the computer experts who can take the source code and recompile the application, could simply remove any sections they don't like, or go into the configuration settings and change everything to their liking. However, isn't encryption supposed to be moving to a new target audience, the people who use a computer as a tool, and don't necessarily know the internals? These are the people who need to feel secure using encryption, and magic, invisible encryption to a third-party is probably not going to give them warm fuzzy feelings. Jim Russell Senior Engineer SynData Technologies, Inc. http://www.syndata.com From rah at shipwright.com Wed Oct 8 09:54:37 1997 From: rah at shipwright.com (Robert Hettinga) Date: Thu, 9 Oct 1997 00:54:37 +0800 Subject: Question Message-ID: --- begin forwarded text Date: Wed, 8 Oct 1997 11:24:51 -0400 From: alain at research.bell-labs.com (Alain Mayer) To: rah at shipwright.com Subject: Question Hi Bob, stypid question: how to I post a message to the Cypherpunks. I have an announcement on a new method to fight junk e-mail, which has been integrated in LPWA (nee Janus). See below Best, -- Alain Hi, we are Bell Labs researchers announcing a method to help you combat junk e-mail (spam) via a new kind of e-mail address, termed a target-revokable e-mail address. Every time you give out your e-mail address, e.g., when you register at a Web-site or post to a Usenet newsgroup, there is a risk that your address will end up in the hands of an e-mail a marketeer or spammer. Until now, you had no way to undo giving out your e-mail address. Target-revokable e-mail addresses effectively let you do that. Currently, most e-mail users typically have a very small number of e-mail addresses. For example, one at the office and one for private use with an ISP at home. In contrast, the principle behind target-revokable e-mail addresses is that each user has many e-mail addresses. In fact, users can have a different e-mail address for each group or entity with whom they interact. Furthermore, target revokable e-mail addresses are defined such that a recipient of such an address cannot guess other target-revokable addresses belonging to the same sender and destined for different groups. Target-revokable e-mail addresses have been integrated with LPWA for easy use with Web sites and Usenet newsgroups (more application to follow at a later date). The Lucent Personalized Web Assistant (LPWA, formerly known as Janus) is a new tool that provides you with privacy, convenience and security when browsing the Web. LPWA is having a highly successful test run, having won PC Magazine "Developer's site of the Week Award". For more info and instructions on how to use target-revokable e-mail: http://lpwa.com:8000 ==================== --- end forwarded text ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: From nobody at REPLAY.COM Wed Oct 8 10:09:08 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 9 Oct 1997 01:09:08 +0800 Subject: Thanks Peter! / Re: russia_1.html Message-ID: <199710081656.SAA25279@basement.replay.com> Peter Trei wrote: > I conceed that it may not be the Pu decay products that cause the > limited shelf life of thermonuclear weapons; I suspect that it may > be components of the 'pit', which produces the initial burst of > neutrons to kick of the reaction (the pit is effectively a small > fission bomb). This 'pit' may contain tritium (pit design is a very > well guarded secret, and I've seen very little about it in the open > literature). Peter, I lost your email address when I spilled Scotch on my computer and lost all my data, so I thought I'd send this to the CypherPunks list. Thanks for explaining to me how to decide where the 'yellow' wire goes. My 'you know what' ought to work now (but I'm not going to try it at home, kids...heh...heh). I'm going to go to Washington as soon as I get my cast off. I left in on an extra week since I make more money spare-changing since I got it, and now I have enough to take a bus to 'you know where,' DC. Tell Declan that he should probably go visit his mom, or something, like next Friday, until at least Monday (because that's when my mom leaves Washington, 'you know where.'--{boy, is *she* going to be sorry she grounded me on my uncle's weekend away from the 'Home'.}) My uncle's going to be mad when he finds out I took his suitcase, but he couldn't even get his Heathkit radio to work, and I *almost* did. Besides, you should never trust anyone over fifteen, eh? (And these things are dangerous in the wrong hands, eh?) Human Gus-Peter p.s. - Cynthia still hasn't answered me as whether or not she is wearing any panties. Is she stuck-up, or something? p.p.s. - I wonder if Dimitri thinks its suspicious that your first name is the same as my last one. Of course, if he thought we were doing what John-John do, then ? the Playpus would call you a pedal-file, eh? (Unless you were doing it to a girl my age, and then he would call you a 'petal-file.') {<-- that's a sexist joke} From anon at anon.efga.org Wed Oct 8 10:13:20 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 9 Oct 1997 01:13:20 +0800 Subject: your mail Message-ID: >>> >>>Here is a cool test!! Just write everything down and find out >>everything you >>>need to know about yourself. My answers were GREAT (and some true) >see >>how >>>yours turn out! :-) Don't strain yourlsef thinking though! >>> >>> >>>Chapter I >>> >>>Arrange the following 5 animals according to your preference: >>> >>>Cow >>> >>>Tiger >>> >>>Sheep >>> >>>Horse >>> >>>Monkey >>> >>> >>>Chapter II >>> >>>Describe the following : >>> >>>Dog >>> >>>Cat >>> >>>Rat >>> >>>Coffee >>> >>>Ocean >>> >>> >>>Chapter III >>> >>>Think of somebody (who also knows you) that you can relate to the >>following >>>colors : >>>( Pls. don't repeat your answer twice only one person for each color) >>> >>>Yellow >>> >>>Orange >>> >>>Red >>> >>>White >>> >>>Green >>> >>>And finally indicate your favorite number and favorite day >>> >>> >>>-----------------------------------------------------(See >>interpretations >>>below) : >>> >>>But before going on, just make one wish.......=) >>> >>> >>> >>>Chapter I >>> >>>(This will define your priorities in life) >>> >>>Cow means career >>> >>>Tiger means pride >>> >>>Sheep means love >>> >>>Horse means family >>> >>>Monkey means money >>> >>> >>>Chapter II >>> >>>Your description of Dog implies your own personality >>> >>>Your description of Cat implies your partner's personality >>> >>>Your description of Rat implies your enemy's personality >>> >>>Your description of Coffee is how you interpret sex >>> >>>Your description of Ocean implies your own life >>> >>> >>>Chapter III >>> >>>Yellow - somebody who will never forget you >>> >>>Orange - someone whom you can consider as your real friend >>> >>>Red - someone you really love >>> >>>White - your soulmate >>> >>>Green - a person who will you always remember for the rest of your >>life >>> >>>Your favorite number will be the number of persons you will be sending >>this >>>test to and the favorite day will be the day that your dream will >come >>true! >>> >>>Hope you had fun! > > > >______________________________________________________ >Get Your Private, Free Email at http://www.hotmail.com > > <---- End Forwarded Message ----> From aba at dcs.ex.ac.uk Wed Oct 8 10:22:09 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Thu, 9 Oct 1997 01:22:09 +0800 Subject: What's really in PGP 5.5? In-Reply-To: Message-ID: <199710081011.LAA00865@server.test.net> Bill Frantz writes: > At 2:27 PM -0700 10/7/97, Jon Callas wrote: > >favorite way of expressing this problem is, "if you lose the keys to your > >car, then you have to get a new car." > > Now email is a confounding medium because it is both a transient > communication medium and a storage medium. We would like to be able to > have protection against losing access to our stored data, at the same time > we are sure that those who violate our trust and intercept our > communications can not read the data, when it is sent or at any time in the > future. > > PGP 5.5 seems to have a solution to the "lose your data" problem. It does > not seem to address the secure deletion problem. If PGP wants to archive data sent or received, well they can do so, but sending encrypted communications over open networks encrypted to _two_ long term public keys is bad security practice. There are two reasons which are given as to why someone might want to have GAK installed for company use. 1. to allow access to important material lost in the mail system in the event that an employee is hit by a bus 2. to allow management to spot check the emails being sent and received Argument 1 seems pretty flimsy to me. I reiterate my comment in an earlier post: who in their right mind keeps their _only_ copy of ultra valuable company information bouncing around in the email system? Did those arguing for this position not notice that sometimes email gets lost in transit? Regardless, if PGP claims to be catering to those who use this argument, and to not want to try that hard to make it impossible to by-pass, the more secure, and less GAK friendly way to do it is to have the mail client software archive the email sent and received. Argument 2 I find somewhat distasteful, but seems to me to be logically what PGP's implementation is catering for. A less GAK friendly way to implement it, and a more secure (communications secure, not saying anything about GAK being easier or harder to by-pass) way would be to archive for a while the session keys. The security advantage being that the email doesn't go out with the session key encrypted to 2 long term public key encryption keys. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710081706.SAA00194@server.test.net> Jon Callas defends: > One of the downsides of cryptography is that if you lose your passphrase > (or token, PIN, smart card, or whatever), you've lost your data. My > favorite way of expressing this problem is, "if you lose the keys to your > car, then you have to get a new car." This is true but mainly I think for _storage_ keys. PGP is being discussed as an email communications system. It's probably just as likely that your email will disappear down a black hole as that you forget your keys. Your analogy doesn't fit. All you're encrypting is something sent over a fairly unreliable communications link. If you lose the key, well heck you just get the sender to resend it. Happens every day with or without crypto. (So you generate a new key, and get it certified, and publish your revocation cert., if you have one). This is the same mistake that Freeh and company make in arguing for GAK. It's a flawed argument. > This downside is particularly insidious for a number of reasons. First, > without fixing that problem, strong cryptography will be in some sort of > limbo. You want to use it to protect your valuable information, but you > won't want to use it for any information that's *too* valuable, because > it's easily lost. Crypto-protected information is fragile, and this > fragility could hurt its widespread deployment. Email itself is pretty fragile, and email is not commonly used for long term storage. (What are PGP are thinking? "gee, how best can we best archive our master source tree ... I know we'll email it to our colleague over here and delete it before I get confirmation it arrived"?). > When they started mumbling along these lines, the privacy community got > their own act together and started describing what we believe to be the > real solution. This is called "data recovery." Way I understand "data recovery" is that you have a recovery mechanism for stored data. Like you have backups of the keys for your hard disk driver level encryption program, or encrypted back up program. You either have misunderstood the data recovery argument, or are attempting to rejig it to fit your argument. > When I was at HIP97 this August, I was amused to hear cypherpunks > chanting, "Data recovery good, key recovery bad." I'm pretty sure said cypherpunks were chanting about storage keys: keys for data stored on your disk, as opposed to the GAKkers wanting access to your communications keys. > The essence of data recovery is that focusing on the keys is a > canard. If you've misplaced your data, you want the data back, not > the keys. Bingo. And your data is where? On your disk. Not in limbo being passed around the flaky sendmail/mailserver hodge-podge that is Internet mail. > If you've locked yourself out of your car, you want the use of > your car, not the just the key. Thus, the solution to encrypted data > being fragile is to let people get to the data. No, no! The simple solution to fragile encryption on fragile communications data is to keep a copy of the email you sent! Encrypt and backup the keys for that all you want, and you won't get any GAK complaints. > If you don't like data recovery, you aren't going to like what we > did in PGP 5.5 -- we built a data recovery system. No you didn't, you built a GAK system. > Data recovery is useful for a number of things. Perhaps you lost > your passphrase. Or data might have been encrypted by an employee or > co worker who was in an accident. Yes, and your archives are going to be where? On backup tapes, on an encrypted partition on his hard disk... not in the email system. > (As an aside, fifteen years ago, the architect of a product I worked > on was in a severe car wreck. He was not killed, but suffered brain > damage and has never returned to work.) Sad story. I venture to suggest, however, that the product source code was not stored solely in your email box, nor I expect did the last copy of your source tree happen to be en-route in encrypted email which only he had the key for. > Your spouse might need access to financial records. She might. In which case you might secret split the key to your encrypted partition, your lawyer and her, or whatever. > What makes data recovery different from key recovery? In my opinion, > data recovery allows you to get encrypted data without compromising > the key of the person who encrypted it. Nope, that's not it. Data recovery is being able to recover stored data. "Key escrow" and "key recovery" are newspeak terms defined by the GAKkers which mean that they want access to your communications keys. Your response should be to widely field systems using forward secrecy, not to go along and implement GAK for them. [description of PGP GAKware elided] If any PGP employees want a job working for a company which doesn't do GAK, contact me off list, encrypted mail preferred. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 * In April, Premier Lien Chan of Taiwan ordered a crackdown on the national craze of public betel-nut chewing, which he said was responsible for mouth cancer, slimy sidewalks when they are spit out, and immorality, in that they are mostly sold by young, underdressed women at sidewalk stands. The betel nut is reportedly a mild stimulant and is slightly more expensive than a cigarette. * The Washington Post reported in May that some tribes in Yemen routinely kidnap tourists and hold them for days, though treating them well, regaling them with propaganda, and ultimately offering them to the government in exchange for political concessions, such as new road construction. Said the speaker of the Yemen parliament, "Kidnapping is part of tourism. [The] tourist will end up learning about the customs of the tribes, as well as their good hospitality." ------ To read these News of the Weird newspaper columns from the past six months, go to http://www.nine.org/notw/notw.html (That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it.) From ian.sparkes at t-online.de Wed Oct 8 10:31:26 1997 From: ian.sparkes at t-online.de (Ian Sparkes) Date: Thu, 9 Oct 1997 01:31:26 +0800 Subject: Internet Via Electric Lines Message-ID: <3.0.2.32.19971008185347.006ca108@q9f47.dmst02.telekom.de> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At 12:06 08.10.97 -6, Peter Trei wrote: >> Ian Sparkes > >> Peter wrote: >> >[...] Putting a few optical >> >fibers into a power line is cheap, easy, and widely done. >> >> But much cheaper and easier is using the signalling gulleys that run >> along the side of the railways - no High Tension precautions, no >> scaling pylons. This, incidently is the reason that a number of >> telecomms consortia (in europe, at least) include a railway element - >> they provide the long-haul backbone. > >It looks like we're seeing different parts of the problem. You're >worried about the long-haul backbone. I'm trying to see ways to >get a 10Gbps fibre into my living room. > >The backbone cost is a tiny fraction of the cost of getting fiber >into every house in the country. > Maybe in retrospect I was just tugging your leash a bit, for which I apologise. I agree, in principle there are few entities which are more aptly placed than the power utilities to provide a roots to leaves high- capacity network into your home. Telephone companies could do it, although the very final stage in the link (twisted copper) is a capacitive load, and therefore not very well suited to high frequencies. Power wires, on the other hand, would exhibit better properties and are universally installed. The solution, however, must be a fibre/copper hybrid. The trick will be getting the bridges between fibre/copper and copper/copper (across the step-downs) cheap and reliable enough. This is probably the breakthrough. The post from Judith Lewis seems to hint at about 0.5MB/s. Good enough for your average Joe. Sorry for the obtuseness of my reply. Ian -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDu6gvzOjjBJiFUeEQIewACdGPe87UKBq7aGRkFew/02fHNBwh0AnAqN eidJ2PV2IVO05Gg+ZSXD9NRI =RxdS -----END PGP SIGNATURE----- From whgiii at invweb.net Wed Oct 8 10:35:18 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 9 Oct 1997 01:35:18 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <01bcd407$02595600$2901320a@Polaris.domain> Message-ID: <199710081728.NAA19596@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <01bcd407$02595600$2901320a at Polaris.domain>, on 10/08/97 at 12, "Jim Russell" said: >The swirl of controversy that has arisen since the 2 Oct announcement of >the PGP Business Security Suite has been quite amazing. Yet, all of the >focus has been on what's been *added* to PGP v5.5. Jon Callas said it >explicitly: >>>Corporate Message Recovery is included *only* in PGP for Business >Security. >What sense, then, can I make of the following? >I have been examining the published source code for PGP v5.0 for Personal >Privacy (note that this is *not* a corporate version), and have >discovered that this recovery scheme already appears to be in place, in >some form at least, in that version. >The following code appears in the published pgp.c, lines 518-537: > /* > * This is our version of "Commercial Key Escrow". > * > * A company can set the CompanyKey in the site-wide > * configuration file and it will be added to the > * recipient list for all encrypted messages. Then > * again, the user can override the setting in their > * own pgp.cfg or on the command line. > */ > companyKey = pgpenvGetString (env, PGPENV_COMPANYKEY, > NULL, NULL); > if (companyKey && *companyKey) { > /* Add the company key to the recipient list */ > e = ringSetFilterSpec (ui_arg->arg.ringset, > ringset, > companyKey, > PGP_PKUSE_ENCRYPT); > if (e <= 0) > exitUsage(e); > } >This certainly *looks* like the implementation that is being discussed in >the press release, although I did not find it mentioned in any >documentation for PGP for Personal Privacy v5.0. The questions this code >brings to my mind are: >1. Does this mean that even the Personal Privacy versions of PGP have a >message recovery scheme available? The 2 Oct press release from PGP >states that the corporate message recovery "transparently integrates with >*any* version of PGP client software". (Emphasis mine). I beleive that this statement refers to the policy enforcement at the SMTP server. For such a system to work it would have to bounce a message (according to the policy settings) that was not encrypted with the corporate key regardless of which version of PGP was used to encrypt the message. >2. If this is implemented via a configuration setting, does it provide >an opportunity for an attacker to reset the "CompanyKey" to their own >key? In the Windows environment, it appears that PGP uses the System >Registry to hold configuration settings. Is it possible for me to trick >someone into running a .REG script that will set the CompanyKey to a key >to which I hold the private component? That would seem possiable but you would also have to override the policy enforcement at the SMTP server. Without examining the product I can't comment on what mechinism they have in place. >3. This appears to me to be quite contradictory to the descriptions >posted by Jon Callas on 7 Oct. The procedure that Jon describes, using >an attribute in the self-signature, would tell an encryptor external to >The Corporation to use the "skeleton key" on INCOMING mail. The 5.0 code >seems to imply an automatic extra recipient on OUTGOING mail, and this >impression is reinforced by the description of the SMTP server policy >enforcement in the 2 Oct product description on PGP's web site. (Let's >not forget that SMTP is a protocol for OUTGOING mail.) Which is it, or is >it actually both? I think that you have a mix of two things here: 1. Encryption of OUTGOING mail using both the Corporate Key and the Recipiant Key which can be enforced by SMTP policy agent. 2. A preferance flag in the Public Key to inform the user of a public key to also use the corporate public key when encrypting. There was disscussion of making use of preferance flags on the Open PGP list for things like prefered HASH & Key Use. >Now, I realize that the long-time PGP users, the computer experts who can >take the source code and recompile the application, could simply remove >any sections they don't like, or go into the configuration settings and >change everything to their liking. However, isn't encryption supposed to >be moving to a new target audience, the people who use a computer as a >tool, and don't necessarily know the internals? These are the people who >need to feel secure using encryption, and magic, invisible encryption to >a third-party is probably not going to give them warm fuzzy feelings. I would imagine that they are working from a common code base for all 3 products (shareware, commercial, and business) and merly disable/enable the various options at compile time. I personally don't mind the code being there as it lets me see what they are doing in the various versions (remember Viacrypt never released their source code). I really don't see this as a problem as it would be quite obvious if the shareware or commercial version of PGP were adding extra recipiants to an encrypted message (current PGP format makes this rather hard to hide). Their seems to be alot of speculation of what PGP 5.5 does or does not do without anyone actually examining a copy of the program and finding out. Perhaps a few of us could obtain copys of the program and investegate it properly. I am willing to boot into NT (shudder) to take a look. Just as a side note there doesn't seem to be anything PGP 5.5 is doing that I couldn't get 2.6.x to do with a weekend of codeing. The hard part, being able to encrypt to multiple recipiants, has been in PGP since day one. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNDvEaY9Co1n+aLhhAQFMyAP/T7o9Orl5hjkOLp4+zK/nrH4JucyXRtSs TkW0JqD+GY9sKoNmsiEtWA7LlZmz94pnAzishy68emzPKx/19UGaKr+uV1MkNg0M jDF2biHPn89MbPYTw/IhXMZ/khlgf1m5P7p0Y8ts64pvEBwUvySiNnEpwyopNVR8 9ux6FnJaiGQ= =U3xd -----END PGP SIGNATURE----- From anon at anon.efga.org Wed Oct 8 10:42:47 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 9 Oct 1997 01:42:47 +0800 Subject: Need Info Message-ID: <7137c80bbd61cc66c3de2fde5b826adc@anon.efga.org> sampler-request at lmboyd.com wrote: > ====================================================== > Q. Can you confirm the claim that a ferocious bull won't > attack a naked human being? > A. Hard to find an authority on this. Those who know > won't explain the circumtances wherein they found out. > Such has been reported, though. snow? Zooko? Anyone...? > LMBoyd Web Site / U. S. Newspapers / Start Email / Stop Email > http://www.LMBoyd.com/postscript.htm From Newfile at man.net Thu Oct 9 01:53:05 1997 From: Newfile at man.net (Newfile at man.net) Date: Thu, 9 Oct 1997 01:53:05 -0700 (PDT) Subject: Secret Information Message-ID: <199710090800.DAA11172@ns1.man.net> To be removed from future mailings, please e-mail us at: alphadat at gosnet.com with REMOVE typed in the subject header. *><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><* Secret Information Hello Do you like secret information? If you do, then look at this ** http://www.infoacess.com/users/alphadata ** You will find valuable information regarding your legal right to brand new credit. Think about it...would you like to have brand new credit? Visit our website and find out how you can! Our program is fast, effective, easy and it's also a very well kept secret. Thank You From jad at dsddhc.com Wed Oct 8 11:34:10 1997 From: jad at dsddhc.com (John Deters) Date: Thu, 9 Oct 1997 02:34:10 +0800 Subject: Secure phone In-Reply-To: <3.0.3.32.19971007102724.00a499c0@labg30> Message-ID: <3.0.3.32.19971008132417.00b0c6d0@labg30> At 12:44 PM 10/7/97 -0700, Eric Blossom you wrote: >I wrote: >> Therefore, man-in-the-middle can be more precisely described as an >> unauthenticated end-point problem. Therefore, without authentication, >> there is no defense (yet) against MITM attacks. > >I concur from the theoretical point of view. Really, that's the only point I was attacking. I agree that from a practical standpoint that you probably would be able to detect a fake voice today. However, a weakness is a weakness, and from a practical standpoint, digital audio technology is not getting worse as time goes on. The phone phreaker world has a blue box (available on the net and called bluebox, I think) that uses the sound card to generate tones to fool phone systems into giving them free long distance. It also will use a recorded human voice to "read" credit card numbers and phone numbers to a telephone operator. While it's not perfect, it does manage to get inflection and tone properly across. The imperfections are ostensibly covered up by the omnipresent telephone network noise (from which your box does not suffer.) It would not take an enormous amount of recorded conversation to have enough samples to extract the complete set of hex digits from any given speaker. But, it would take an enormous amount of chutzpah for a MITM to try it. It would be easy enough to "trick" the MITM into exposing their existance anyway, just by using digits that come up in conversation. Humans would be able to come up with unique situations that the MITM would find all but impossible to predict. "Hey, Eric, I noticed that the third digit of your IP address' second octet is the same as the second digit of our exchange. How's by you?" A sudden dropout of sound (or "accidental" loss of connection) while the MITM recognizes the trap and tries to backpedal will be instantly noticed. Human protocols are resilient, whereas mathematical protocols are precise. Having a working theory behind securing the exchange (whether or not you implement it) makes for a nice mind exercise, anyway. Your working boxes are a far cry above any theory we discuss here. If I had one of your nifty boxes, I'm sure I wouldn't lose sleep over the theoretical holes. John -- J. Deters "Don't think of Windows programs as spaghetti code. Think of them as 'Long sticky pasta objects in OLE sauce'." +--------------------------------------------------------------------+ | NET: mailto:jad at dsddhc.com (work) mailto:jad at pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'36"N by 93^16'27"W Elev. ~=290m (work) | | For my public key, send mail with the exact subject line of: | | Subject: get pgp key | +--------------------------------------------------------------------+ From trei at process.com Wed Oct 8 11:39:58 1997 From: trei at process.com (Peter Trei) Date: Thu, 9 Oct 1997 02:39:58 +0800 Subject: The 5th Horseman: Cryptoanarchist doctors. Message-ID: <199710081812.LAA16051@toad.com> I don't often get Forbes, but the Oct 6 issue caught my eye. Leafing through it, I found something fun in the letters column. It's in response to a 'fact & comment' column in the Sept 22 issue, the core of which is: ---------------- Here's how this basic attack on our personal freedom will work: A doctor who provides medical services to a Medicare-eligible patient without billing Medicare must sign an affidavit to the Secretary of Health and Human Services that he or she will not treat a single Medicare patient for the next two years. Any doctor found treating both Medicare patients and Medicare-eligible private patients will be subject to fines and perhaps prison. As Moffit points out, Section 4507 is "deliberately designed to make private contracting and medicine all but impossible except for physicians who reside in very wealthy communities." Senator Jon Kyl (R-Ariz.) correctly observes that this prohibition is the equivalent of Social Security's barring retirees from dealing with stockbrokers: "Surely, a law that made it illegal to supplement with private funds the amount received from Social Security would be met with disbelief and derision." Yet that is the equivalent of what this Medicare regulation does. ------------------ The letter reads: SIR: I have been treating Medicare patients for cash without filing Medicare claims for years. I do not intend to stop. If the government receives no forms, how will it know that a beneficiary received care from me? And the feds can't seize my records. They are all computerized and encrypted. Anthony A. Cassens, M.D Los Angeles, Calif. --------------------- Peter Trei trei at process.com From whgiii at invweb.net Wed Oct 8 11:40:01 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 9 Oct 1997 02:40:01 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <199710081011.LAA00865@server.test.net> Message-ID: <199710081815.OAA20071@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <199710081011.LAA00865 at server.test.net>, on 10/08/97 at 11, Adam Back said: >Bill Frantz writes: >> At 2:27 PM -0700 10/7/97, Jon Callas wrote: >> >favorite way of expressing this problem is, "if you lose the keys to your >> >car, then you have to get a new car." >> >> Now email is a confounding medium because it is both a transient >> communication medium and a storage medium. We would like to be able to >> have protection against losing access to our stored data, at the same time >> we are sure that those who violate our trust and intercept our >> communications can not read the data, when it is sent or at any time in the >> future. >> >> PGP 5.5 seems to have a solution to the "lose your data" problem. It does >> not seem to address the secure deletion problem. >If PGP wants to archive data sent or received, well they can do so, but >sending encrypted communications over open networks encrypted to _two_ >long term public keys is bad security practice. >There are two reasons which are given as to why someone might want to >have GAK installed for company use. >1. to allow access to important material lost in the mail system in the >event that an employee is hit by a bus >2. to allow management to spot check the emails being sent and received >Argument 1 seems pretty flimsy to me. I reiterate my comment in an >earlier post: who in their right mind keeps their _only_ copy of ultra >valuable company information bouncing around in the email system? Did >those arguing for this position not notice that sometimes email gets lost >in transit? Well lets take the flip side of this: Who in their right mind encrypts ultra valuable company information and then leaves the plain text on their computer?? I have an outbox full of encrypted messages that are encrypted to both the recipient and to my key (Encrypt-To-Self Option). If you are going through the trouble of encryption why would you want to leave plain text lying around??? One needs to remember that e-mail is not just communication but communication *and* storage. >Regardless, if PGP claims to be catering to those who use this argument, >and to not want to try that hard to make it impossible to by-pass, the >more secure, and less GAK friendly way to do it is to have the mail >client software archive the email sent and received. I have to disagree, see above. >Argument 2 I find somewhat distasteful, but seems to me to be logically >what PGP's implementation is catering for. A less GAK friendly way to >implement it, and a more secure (communications secure, not saying >anything about GAK being easier or harder to by-pass) way would be to >archive for a while the session keys. The security advantage being that >the email doesn't go out with the session key encrypted to 2 long term >public key encryption keys. I have seen no evidence that encrypting to multiple recipients is any less secure than encrypting to one. If there are serious security implications in doing so then it affects *all* versions of PGP and not just 5.5. I find it odd that this issue is only now being brought up with 5.5 and never mentioned with previous versions. One thing I would like to see added to this set-up is secret sharing of the corporate private key. That way one person could not unilaterally access the data but would require the agreement of several people (say 3 of 5 department heads). I think this would provide enhanced physical security of the key and personal privacy (Joe in IMS can't snoop the mail just because he is board). I have made some mention of this in the past to PGP but don't know what if any work has been done in this area. I have been working on a small utility that would let a user do this with his own private key. Perhaps if I ever get some free time I can finish it up. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNDvPdY9Co1n+aLhhAQHjQgP/UK4Ep2TsA9c5kSdvjS0iy2iaSvFVbML6 w4SIiQtTRgrSX5gQuPN5Xny1KZNH9xgwbSrQUFYOpS4l63eanvTMYdTFDAEt4IyA AzdtZzJjgUqUzy0a8W6nljgQ8AVekJMjBX0N4ew1kVw1ZtWsAMBTxlXCchbzS+zH 9RL4/dHenG4= =iWRY -----END PGP SIGNATURE----- From attila at hun.org Wed Oct 8 11:49:24 1997 From: attila at hun.org (Attila T. Hun) Date: Thu, 9 Oct 1997 02:49:24 +0800 Subject: Fund-Raisers Allege long term DNC Wrongdoing Message-ID: <19971008.180342.attila@hun.org> -----BEGIN PGP SIGNED MESSAGE----- Two Democratic fund-raisers have agreed to testify in exchange for immunity that Bill Clinton's presidential campaign in 1992 and the Democratic Party engaged in an array of questionable activities, a House committee disclosed today. see: http://www.nytimes.com/aponline/w/AP-House-Fund-Raising.html the allegations will cover incidents from 1991 to the present including Indonesian, Chinese, and other foreign interests; details on Peter Trei; influence peddling; a letter with Clinton's name on it for a now SE Asia head of state, etc. Big Macs as legal tender. bacon extra. these folks are ready to do some serious singing! the proposed revelators were convicted and sentenced on one of the charges and are apparently willing to sing to avoid prosecution on the rest. if they had enough evidence to put them in jail for the tip of the iceberg... so, when the fat lady sings, and Valhalla incinerates, do you think the market will have a confidence crisis? too bad stock certificates are electronic; they could bring on the dancing girls and have a tickertape parade with the output of the shredders as the fraudsters run for cover. Wall Street is going to look like Pol Pot came to visit, left a few calling cards, too. since clinton has been busy tossing Gore to the sharks, maybe we will have the Grinch as President --he's next in line. at least the Grinch will look better in a Santa suit! he may be just in time. that might be enough to have the whole infrastructure collapse; it might be time to close the bankruptcy proceedings initiated by Mr. "chicken in every pot" himself on 09 Mar 1933. ironic that his ad her intellectual baggage is being cared for by the current occupants of 1600 Pennsylvania --full circle! as debtors are absolved when bankruptcy is satisfied or liquitdated, do you suppose we can get rid of that stupid fringed [admirality] flag and the contract courts? maybe even have common law and habeus corpus restored? of course, we must remember to hire the Merchant of Venice's lawyer to save us each a pound of flesh. dang, I had old William's plot phone number here somewhere. naw, that's too much to ask for; the four horsemen just came over the horizon... -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDvTOb04kQrCC2kFAQHm+gP/YEG9GK7jLSy7nJ4p/jQ+C967M4+tPwEs nBkQZ5qwCYm2M3U2D0UQ/hE3Pcphrfcc8xzCNstIjtM5bS4ZW7zGqQJG8PwZzRc6 QkSaEOigL4USpj208juDTQB4dxg57EGjQTLCLFma3J481zEVWUXcJPsXs9ee2WYR HC6se+auV1M= =eCld -----END PGP SIGNATURE----- From vipul at best.com Wed Oct 8 12:38:13 1997 From: vipul at best.com (Vipul Ved Prakash) Date: Thu, 9 Oct 1997 03:38:13 +0800 Subject: [news] Azalea releases encryption software Message-ID: <199710082339.XAA01190@fountainhead.net> *** Azalea releases encryption software Azalea Software has just released three new encryption and security products: DESTools v1.5, BlowfishTools v1.5 and SHATools v1.0. All three packages are SDK's (software developers kits) targeting Windows developers who need to add encryption and security features to the applications they write. DESTools and BlowfishTools provide encryption and decryption based on the DES (Data Encryption Standard) and Blowfish algorithms respectively. DES provides 56-bit keys and is used extensively in banking and finance. (PR Newswire) For the full text story, http://www.infobeat.com/stories/cgi/story.cgi?id=5315843-c31 -- Powell lingered. "How's Earth?" It was a conventional enough question and Muller gave the conventional answer, "Still spinning." -- "Reason", Asimov. ================================================================== Vipul Ved Prakash | - Electronic Security & Crypto vipul at best.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Virtual Spaces From cg at evrl.xs4all.nl Wed Oct 8 13:23:41 1997 From: cg at evrl.xs4all.nl (Cees de Groot) Date: Thu, 9 Oct 1997 04:23:41 +0800 Subject: Internet Via Electric Lines? In-Reply-To: <199710081601.JAA15326@toad.com> Message-ID: <199710081929.VAA19175@evrl.xs4all.nl> In <199710081601.JAA15326 at toad.com> Peter Trei wrote: > >It looks like we're seeing different parts of the problem. You're >worried about the long-haul backbone. I'm trying to see ways to >get a 10Gbps fibre into my living room. > In the Netherlands, every house is hooked to the natural gas network. I've heard rumours about them guys testing literally blowing fiber into your house through the gas pipes (hook fiber to a shuttle, let it loose - gas pressure does the rest). Never heard how they're gonna do the steering on junctions, though... Welcome to the brave new world - I envision utility companies literally running down your front door for the privilege of being allowed to hook your house to their 10Gbps network :-) -- Cees de Groot http://pobox.com/~cg Photo pages: http://pobox.com/~cg/photo Yashica SLR List: http://pobox.com/~cg/photo/yashica From tcmay at got.net Wed Oct 8 13:36:14 1997 From: tcmay at got.net (Tim May) Date: Thu, 9 Oct 1997 04:36:14 +0800 Subject: Anthrax Bombs In-Reply-To: <199710081352.GAA17135@mail6.netcom.com> Message-ID: At 8:37 AM -0700 10/8/97, Bill Frantz wrote: >At 3:01 AM -0700 10/8/97, Peter Trei wrote: >>I don't know if it's comforting or worrying knowing that these >>devices degrade - any in the hands of terrorists have a limited >>time that they are a threat, but that fact may pressure a terrorist >>to 'use it or lose it'. > >What I have heard about these suitcase nukes is that they yield about 1-2 >kilotons. I know of no technical reason for them to be thermonuclear >devices. As such, the decay of tritium would not seem to affect them. >(They will still need a source of neutrons, which might go bad faster than >the plutonium/U235.) > >I feel very little comfort. I'd fear an "anthrax bomb" a lot more than a 2 KT suitcase nuke. (If I lived in a crowded target zone, aka a soft target, which I don't.) (As is well-known, or should be, folks survived Hiroshima and Nagasaki as close as 400 meters from ground zero. And they were both roughly 20 KT nukes. Inasmuch as the blast effects scale as the cube root of megatonnage, a 2 KT blast might be expected to be survivable as close as a few hundred meters or even less. Of course, some will die even out at a 1000 meters, but not many.) By comparison, anthrax bacillus is relatively easy to manufacture, and aerosol dispersion could kill hundreds of thousands or more before even being detected. Aerosolized dispersion in Washington or Manhattan could be a far worse human and infrastructure disaster than a suitcase nuke. I expect this sort of attack to occur fairly soon. (The Aum Shinretsu cult in Japan was working with such things, including Sarin, a nerve toxin. Some of the sites knocked out in Iraq were CBW sites.) P.S. I used to work a lot with radioisotopes. Pu-239 has a long half-life, as noted here by others, and is not going to decay significantly in human times. But poising and neutron-stealing can render nukes duds in just a few years. However, battlefield nukes are typically made with some design choices which minimize the routine maintenance/refurbishing which the main MIRV nukes need. My understanding is that most of the NDT (nuclear demolition) devices have a shelf-life of up to a decade or so. Anthrax is a whole lot cheaper. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From nobody at bureau42.ml.org Wed Oct 8 14:53:05 1997 From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer) Date: Thu, 9 Oct 1997 05:53:05 +0800 Subject: Secure phone Message-ID: John Deters wrote: > At 12:44 PM 10/7/97 -0700, Eric Blossom you wrote: > >I wrote: > >> Therefore, man-in-the-middle can be more precisely described as an > >> unauthenticated end-point problem. Therefore, without authentication, > >> there is no defense (yet) against MITM attacks. > >I concur from the theoretical point of view. > It would be easy enough to "trick" the MITM into exposing their existance > anyway, just by using digits that come up in conversation. > A sudden dropout of sound (or "accidental" loss of > connection) while the MITM recognizes the trap and tries to backpedal will > be instantly noticed. Human protocols are resilient, whereas mathematical > protocols are precise. Speaking from a practical standpoint, since I have been the target of a variety of electronic surveillance for over a quarter of a century, the Man-in-the-Middle rarely operates so well that there are not a number of small anomalies that one cannot spot in the quality and/or flow of the service they are receiving. On the other hand, they rarely screw up so badly as to make it glaringly obvious what they are doing. The main thing, when one has reason to believe that quality or technical problems may be the result of MITM, is to take subtle actions such as the one suggested above, in order to force the MITM to adjust on-the-fly to situations that you create in order to monitor the monitor. e.g. - "Call me in 5 minutes at 555-PAY-PHONE for the secret code." If you already have a shill using that pay phone to monitor sudden anomalies in the function, fine, but it is ususally sufficient to take a call at the phone in five minutes, and the results of a quick patch will be noticeable. - "Do you have a radio playing, or something?" Hi-tech MITMs use a white-noise system designed to provide a cover for noise from their equipment, and a statement such as the above will invariably cause them to adjust it, usually resulting in a greater clarity or greater fuzziness on the line. Similar analysis of one's email, particularly if you have several recipients who can send you full feedback on timing/routing, etc., can reveal consistent differences between letters to your mom, and your death threats against the King (as well as letter to your mom which contain death threats against the King). Bottom line: If you are sending something worthy of being monitored, then your actions and methodologies should reflect the belief that you *are* being monitored. Please destroy your hard drive after reading this post. TruthMonger From jon at pgp.com Wed Oct 8 14:54:21 1997 From: jon at pgp.com (Jon Callas) Date: Thu, 9 Oct 1997 05:54:21 +0800 Subject: What's really in PGP 5.5? In-Reply-To: Message-ID: <3.0.3.32.19971008143320.00a9be80@mail.pgp.com> At 08:48 PM 10/7/97 -0500, Bruce Schneier wrote: Jon Calis wrote: >Also, we have three encryption products: PGP freeware, PGP for Personal >Privacy, and PGP for Business Security. Corporate Message Recovery is >included *only* in PGP for Business Security. It is not, and never will >be, in either the freeware or the Personal Privacy product. If this is true (and I have no reason to believe it isn't), then why is the key escrow code written (although not turned on) in the source code for 5.0 that was posted internationally from PGP? Bruce, I understand that you don't like any form of data recovery, but there is no key escrow in PGP. Perhaps we should talk about this on the phone. Makes no sense. Bruce ----- Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) From cynthb at sonetis.com Wed Oct 8 15:05:29 1997 From: cynthb at sonetis.com (Cynthia Brown) Date: Thu, 9 Oct 1997 06:05:29 +0800 Subject: Internet Via Electric Lines? In-Reply-To: <199710081601.JAA15326@toad.com> Message-ID: On Wed, 8 Oct 1997, Peter Trei wrote: > It looks like we're seeing different parts of the problem. You're > worried about the long-haul backbone. I'm trying to see ways to > get a 10Gbps fibre into my living room. > > The backbone cost is a tiny fraction of the cost of getting fiber > into every house in the country. > > Building a few optical fibers into a cable as it is being > manufactured is cheap and easy, as is using fiber-equipped > cable if you are installing new lines, or replacing old ones > for other reasons (installation costs are usually far higher > than the cost of the line itself). It's hooking up all the > fibers into a meaningful network that gets expensive, > which was my point. Practically speaking, using the cable TV infrastructure looks much more promising than the power grid. Pros: - already available in many major urban centres = less retrofit - theoretical 30Mbps transmission rate (not fibre, but still pretty good) Cons: - lack of standardisation / compatibility for the modems themselves (bleeding edge technology, surprise surprise) - little choice for your ISP - you may have to buy cable service along with the Internet connectivity Cynthia =============================================================== Cynthia H. Brown, P.Eng. E-mail: cynthb at iosphere.net | PGP Key: See Home Page Home Page: http://www.iosphere.net/~cynthb/ Junk mail will be ignored in the order in which it is received. Klein bottle for rent; enquire within. From anon at anon.efga.org Wed Oct 8 15:06:58 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 9 Oct 1997 06:06:58 +0800 Subject: What's really in PGP 5.5? Message-ID: > There are two reasons which are given as to why someone might want to > have GAK installed for company use. > > 1. to allow access to important material lost in the mail system in the > event that an employee is hit by a bus > > 2. to allow management to spot check the emails being sent and received > > > Argument 1 seems pretty flimsy to me. I reiterate my comment in an earlier > post: who in their right mind keeps their _only_ copy of ultra valuable > company information bouncing around in the email system? Did those arguing > for this position not notice that sometimes email gets lost in transit? > > Regardless, if PGP claims to be catering to those who use this argument, and > to not want to try that hard to make it impossible to by-pass, the more > secure, and less GAK friendly way to do it is to have the mail client > software archive the email sent and received. Two problems. First, not all mail clients let you archive the mail in a different form than how it arrived. Netscape 3 worked like this, maybe 4 too. If the mail comes in encrypted just to an employee key, that is how it will be stored, and no business access is possible. Second, what if an employee doesn't come back from vacation? You've got messages sitting in his inbox which go back three weeks. All encrypted to his personal key, which is gone. It's been long enough that the senders may not have backups any more. It's all lost, and at best the company is going to put its partners and customers to a great deal of inconvenience by making them re-send everything they've sent in the last three weeks, not to mention making the company look incompetent. From aba at dcs.ex.ac.uk Wed Oct 8 15:07:01 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Thu, 9 Oct 1997 06:07:01 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <3.0.2.32.19971008090442.0070305c@ece.eng.wayne.edu> Message-ID: <199710082004.VAA00169@server.test.net> Ryan Anderson writes: > > > >What you call "fragility" is properly called "security". Would you > >describe 128-bit keys as more "fragile" than 40-bit keys? Why is PGP, > >Inc. inventing propaganda terms for the authorities? > > Okay, call it security but the point is, if you're protecting > documents vital to your company using encryption (say the design of > a new product) and the person who knows the passphrase dies, you've > just lost a great deal of money. Not at all. People seem to be forgetting that we're talking about email security here. Email isn't that reliable. Email goes missing now and then. Your DNS is out, the receivers mail hub has a glitch and swallows it, whatever. Are you really claiming that you will have email in transit which is so valuable that your whole company will be in jeopardy if the intended recipient dies unexpectedly? More likely: you get the sender to resend it. Don't confuse the issues surrounding need for backup of storage keys with communications keys. There is a definate need to take care to have backups of keys used to encrypt backups and disks. Not so for communications keys. I gave some alternative GAK unfriendly ways of archiving email in my longer reply to PGP's Jon Callas defensive article on the NYT article. > Well, any company giving stock advice (and governed by SEC rules on > stock tips, etc.) is already require to have all outgoing mail > approved (e-mail and snail), so does it matter if they record it or > not? If a company has a policy of approving outgoing email, I'd argue for a two tiered system. One for "official statements" which is approved, archived, signed with a transferable non-repudiable signature. And one for unofficial communications, signed with a non-transferable signature, and perhaps delivered via mixmaster. The way to archive your outgoing email is not to have the email in transit encrypted to an extra recipient. The way to do it is to archive sent mail in the senders MUA or at least internal to the senders offices. You will notice that this then involves storage keys, which the GAKkers aren't interested in. Why aren't they interested in access to storage keys? Because they would have to issue a supeona and take the disks away before they would have any use for them. At that stage they'd just as well list the keys to decrypt anything which is encrypted on the disks they seize. The reason the GAKkers want access to communications keys is so that they can read your email without you knowing. So they can go on fishing expeditions and use the evidence by saying that "an unanmed source" tipped them off, etc. By implementing GAK for corporates in such a GAK friendly way, PGP Inc has helped the GAKkers. I would be interested to persuade them to change their architecture for archiving sent and received email. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Forwarded message: >From physnews at aip.org Wed Oct 8 14:08:52 1997 Date: Wed, 8 Oct 97 09:47:35 EDT From: physnews at aip.org (AIP listserver) Message-Id: <9710081347.AA08262 at aip.org> To: physnews-mailing at aip.org Subject: update.340 PHYSICS NEWS UPDATE The American Institute of Physics Bulletin of Physics News Number 340 October 8, 1997 by Phillip F. Schewe and Ben Stein TURNING ONIONS INTO DIAMONDS. Nano-diamonds can be created without high pressure by squeezing carbon "onions" (nested buckyball-like structures) with ion beams. Graphite material can be made into diamond the hard way, with the use of high pressure (above 10^6 atmospheres), high temperature, and the use of catalysts. But recently scientists have been able to bombard carbon onions with electron beams and now ion beams as well, and have been able to convert the onions almost completely into diamonds, up to 100 nm in size. Researchers at the Max Planck Institute in Stuttgart (Florian Banhart, banhart at wselix.mpi-stuttgart.mpg.de) use a beam of neon ions to pelt the onions, which act like miniature pressure cells. With larger ion accelerators, one should be able to make macroscopic amounts of irradiation-induced diamond. (Experimental work: Wesolowski et al., Applied Physics Letters, 6 Oct. 1997; theory paper (Zaiser and Banhart) upcoming in Physical Review Letters; figure at www.aip.org/physnews/graphics.) MOLECULAR HYDROGEN SHOULD BECOME SUPERFLUID if placed on the right surface, say physicists at the University of Illinois (David Ceperley, ceperley at ncsa.uiuc.edu). Superfluids, substances that flow without friction, are few in number: liquid helium-4, special gases of rubidium and sodium atoms (in the form of Bose-Einstein condensates), pairs of helium-3 atoms, and pairs of electrons (which flow through superconductors). The trouble with getting hydrogen molecules (H2) to become superfluid is that they are all too ready to combine with each other into H2 solids. By laying them on a silver substrate and by salting them with a pinch of alkali metal atoms, the H2's should be able to resist the tendency to solidify all the way down to zero temperature. At 1.2 K they would become a superfluid, the Illinois theorists predict. They believe this can be carried out over the next year, after which experimentalists could explore unique hybrid superfluids, such as H2/He-4 mixtures. (M.C. Gordillo and D.M. Ceperley, Physical Review Letters, 13 Oct; see figure at www.aip.org/physnews/graphics) A POLYMER THAT CAN TRANSFER ENERGY BETWEEN DIFFERENT LIGHT BEAMS has been demonstrated by researchers at UC-San Diego (W.E. Moerner, 619-822-0453), opening possibilities for inexpensive and easily manufacturable "optical transistors" that can amplify or attenuate a light beam. The San Diego polymer is an example of a "photorefractive" material, a material that adjusts its structure and electronic properties when two or more light beams combine on it to form an interference pattern. On these materials, light from one beam can bend in such a way as to bounce back in the direction of a second beam, adding energy to it. Inorganic versions of these materials exist, but they are difficult to make and can cost thousands of dollars for a tiny cube. Moerner constructed a polymer whose three main components carried out essential tasks: buckyballs offer electrons, poly (n-vinyl carbazole) (PVK) molecules carry these electrons along their backbone, and PDCST molecules stretch or contract, changing the way light bends in these regions. The researchers demonstrated a "net gain" of about 5, in which one of the laser beams shining on the material gained energy. These materials have numerous possible applications, including correcting distorted images. (Science, 25 July.) From nospam-seesignature at ceddec.com Wed Oct 8 15:52:32 1997 From: nospam-seesignature at ceddec.com (nospam-seesignature at ceddec.com) Date: Thu, 9 Oct 1997 06:52:32 +0800 Subject: copyright & privacy (was Re: "Matchcode" technology sparks privacy flames.....) In-Reply-To: <199709241736.SAA04219@server.test.net> Message-ID: <97Oct8.183617edt.32261@brickwall.ceddec.com> Sorry for the delay, but I have been working massive overtime. On Wed, 24 Sep 1997, Adam Back wrote: > Tom Zerucha writes: > > On Tue, 23 Sep 1997, Declan McCullagh wrote: > > > > Technically, I am arguing for property rights in reputation. Patent > > and copyright are already recognized property rights in information. > > And this is a good thing? Possibly, possibly not. Declan was arguing that information cannot be protected. I was simply pointing out that some is. > > How about personal information such as credit card or social security > > numbers or even tax records - you are saying if I can get them, I should > > be able to publish them. > > Bingo! What you don't want published don't publish. > > Don't like it? Don't reveal information you don't want published. > Argue for chaumian credentials. I don't think our tax authority will accept them. I am compelled to publish all kinds of information about myself (unless I had a few million dollars to go to court on each individual issue, e.g. here it is illegal to drive without insurance, but insurers will not underwrite you unless you give them lots of information). I can argue for chaumian credentials all I want, but I will be thrown in jail because people with guns don't accept them. If you really believe this, you can engage in your own acts of civil disobedience in your country and see if they will accept your argument. > btw. your "you are saying if I can get them, I should be able to > publish them." is almost a tautology -- clearly if you get information > you _can_ publish it anonymously. Therefore anything that is > obtainable is not private. This is like saying that if you keep one million pounds sterling in a locked safe in your house on your property, and I can break in and get it, that it is not stealing - anything not nailed down is unclaimed property? I am entitled to the contents of your wallet if I can get it? But extend that now if there was a law banning safes (the authorities don't like them), and that your assets could not be hidden, so should be kept someplace visible from the outside, and not otherwise protected. Under this condition should laws against theft be enforced? > Laws claiming to regulate what you can _know_ (data protection laws) > are dumber yet, as it is legislating that you must forget something. > And it is unenforceable -- who knows what you have on your database. True, but laws can force you to pay damages. A law attempting to force restitution for vandalism is equally impossible (you can destroy something you cannot recreate), but that does not mean vandalism is not a crime, nor should it be discouraged or go unpunished. > Copyright doesn't prevent squat. It just sets up a procedure for your > local force monopoly to harass you if you don't follow the procedure. > > > (if I remember right the Berne convention says something is still > > protected even if no formal steps have been taken). > > More laws against gravity. Laws against theft, rape, robbery and murder do not prevent said acts, but only tend to discourage them. > > If you are arguing that there should be no legal protection for > > information of any sort (including patent or copyright) I think you have a > > point. We then would have an equal opportunity for information piracy. > > Scrap patents and copyright. Disband WIPO police. Agreed, but after my state scraps its demand for insurance and information before I can legally drive, and when the federal government stops demanding to see all my personal data (now including medical records). Also, things might simply go to copy-protection using strong digital signatures and licensing terms making you responsible for any piracy of your copy (I know, scrap contract law, common law, etc. and then the license will simply state that we will send thugs to kill you - since there is no government - if we see this anywhere it isn't in our opinion supposed to be - replace government force monopoly with private enforcers sort of like Chicago in the 1920's). It is not that things like copyright and patent won't be enforced, but it might be in a more chaotic and not necessarily better matter than what the government does. Or work technologically restricting the information to an even greater degree (a DVD will only play to a TV if it sees a anti-piracy DS cert). My argument is while government can compel me to publish information I do not want to (i.e. violates my rights), it should simultaneously compel third parties not to forward such information (limiting the potential damage from that violation). Scrap both or neither. Only arguing for repeal of laws that constrain tyrants as much as citizens is not arguing for liberty. In the context of a libertarian society, or even an anarchical society your arguments make a great deal of sense. In the current semi-socialism/faschism prevalent now, the effect is to only penalize me for any attempt to protect myself. From aba at dcs.ex.ac.uk Wed Oct 8 15:55:21 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Thu, 9 Oct 1997 06:55:21 +0800 Subject: computationally infeasible jobs for MITMs (Re: Secure phone) In-Reply-To: <3.0.3.32.19971008132417.00b0c6d0@labg30> Message-ID: <199710082248.XAA01618@server.test.net> John Deters writes: > It would be easy enough to "trick" the MITM into exposing their > existance anyway, just by using digits that come up in conversation. > Humans would be able to come up with unique situations that the MITM > would find all but impossible to predict. "Hey, Eric, I noticed > that the third digit of your IP address' second octet is the same as > the second digit of our exchange. How's by you?" A sudden dropout > of sound (or "accidental" loss of connection) while the MITM > recognizes the trap and tries to backpedal will be instantly > noticed. Human protocols are resilient, whereas mathematical > protocols are precise. I wonder if we can come up with a way to formalise this technique and automate it. I think it was James voiced something similar earlier in the thread. Using your example, the MITM faces a couple of problems: he has to think on his toes, and think real fast. Perhaps he can't think fast enough. Second problem, perhaps if he doesn't speak soon enough, he will have blown it, because you are speaking continuously, and the second part of the sentence constructs a problem from information already stated. The first time the information is stated, the MITM doesn't have enough information to change it. Say he changed it to: "Hey eric I noticed the second digit..." (second instead of third), just in case this would help him. Well he doesn't know what the challenge will be so he may just have created an impossible to spoof problem for himself. (The second digit probably won't meet the challenge in the second part of the sentence). So this would force the MITM to construct a replacement challenge which does match. Given the short notice, and already decided first part, he may have difficulty constructing a plausible sounding challenge which meets his criteria. "Is the ummm... square of your first digit". How about this for a computerised method to do something similar. Aim of the game: to make the MITMs job computationally infeasible. Say that we leave some noise in the speech channel. Some of it isn't really noise but encrypted data. Say perhaps first stegoed packet is: E(k1, nonce) = packet1 and second stegoed packet is: E(k2, nonce) = packet2 and finally there is a mask which controls which bits of the noise are actually encrypted data, and which are parts of the actual message. Send this last: E(k3, mask) Then send the three keys k1, k2, k3. Then check that the packets1 and 2 reconsituted according to the mask both decrypt to the same nonce. The idea is that because of the mask, the MITM doesn't know which bits to replace. So he tries to construct his own challenge meeting that protocol. Fair enough he can do this. But he will degrade the voice quality because he will replace some more signal with noise. Can we tune this protocol so that the recipient can detect the extra noise? Well, ok, if the recipient can detect the noise, surely the MITM can too? Yes but, choosing different bits to reduce the noise isn't free, and the hope is that you can construct a system with an expensive noise estimation function which is agreed to as part of the protocol. So you find out 10 seconds into the conversation that there is a MITM. The MITM has to compute this noise function in real time, to avoid introducing lag. It's not very good, but I'm sending it along anway, so that perhaps y'all can improve on it, Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710082122.WAA01574@server.test.net> [made a few snips to the CC line, still Cc of cypherpunks] William Geiger writes: > at 11, Adam Back said: > >1. to allow access to important material lost in the mail system in the > >event that an employee is hit by a bus > > >Argument 1 seems pretty flimsy to me. I reiterate my comment in an > >earlier post: who in their right mind keeps their _only_ copy of ultra > >valuable company information bouncing around in the email system? Did > >those arguing for this position not notice that sometimes email gets lost > >in transit? > > Well lets take the flip side of this: Who in their right mind encrypts > ultra valuable company information and then leaves the plain text on their > computer?? Lots of people. See, what goes over a public network in the clear is much more vulnerable than what sits on your disk. I encrypt communicated copies of things which aren't encrypted on the disk myself. I suspect you do too. But, more to the point, my argument was that keys should have segregated uses. One key for storage, another for receiving encrypted emails. I wasn't saying that you wouldn't encrypt your archived sent & received email. I _was_ arguing that a better way to archive email securely is to encrypt it with a separate storage key. > I have an outbox full of encrypted messages that are encrypted > to both the recipient and to my key (Encrypt-To-Self Option). Bad move dude. See you might have a 100 bit entropy passphrase, but the recipient might have a password of "fred". You've conveniently archived all your email, and you've left it decryptable by a hodge podge of other people with unknown level of care about your level security. Say perhaps fred deleted the email after reading, even though he has a poor passphrase. You have just screwed your own security. Similar problem if it is you that has a passphrase of "william". I won't thank you when the feds decrypt your email to me, thanks to a you having a poor passphrase. (Not that I'm suggesting you do). If your email archives are encrypted with storage keys, you avoid all these problems, and avoid GAK arguments at the same time. > If you are going through the trouble of encryption why would you > want to leave plain text lying around??? One needs to remember that > e-mail is not just communication but communication *and* storage. Nope. Email is communication. Archived email is storage. Use communication keys for communicated email, and storage keys for encrypting archived email. This is a very important point, and I can't fathom why so many people who are otherwise on the ball are not getting it. If you don't escrow any communication keys, but do escrow storage keys, the GAKkers don't get what they want, and you get all the functionality you need. They actually have to break into premises, and take disks, and supoena keys. Right? Simple enough isn't it? > >2. to allow management to spot check the emails being sent and received > > > >A less GAK friendly way to implement it, and a more secure way would > >be to archive for a while the session keys. The security advantage > >being that the email doesn't go out with the session key encrypted > >to 2 long term public key encryption keys. > > I have seen no evidence that encrypting to multiple recipients is any less > secure than encrypting to one. Of course it's less secure. It's less secure almost by definition. Lets say you have your communications encrypted with only your key, and there is a small probability call it p1 that your key is compromised (key board sniffer virus, hidden video cam, typing passphrase whilst on phone (yes?), whatever). Well if you encrypt to another key, say a corporate escrow key, there is an additional chance, call it probability p2, that your security can be blown by the corporate key being compromised. So long as the p2 is greater than 0, which I'm sure you'll agree it is, however small, then you have less security by using multiple encryption. > If there are serious security implications in doing so then it > affects *all* versions of PGP and not just 5.5. I find it odd that > this issue is only now being brought up with 5.5 and never mentioned > with previous versions. I've been arguing against using encrypt-to-self for ages. It simply makes me cringe when people send me email which is encrypt to self. > One thing I would like to see added to this set-up is secret sharing of > the corporate private key. [details elided] Sounds like a good idea. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710082223.XAA01603@server.test.net> [I've moved this thread to cypherpunks, it was on cryptography, and Perry (cryptography moderator) just killed the thread. Some of the participants may not be on cpunks, so keep them on the cc if you want them to see your replies] Marc Horowitz writes: > >> > What makes you think that all critical email is on disk in the clear? > >> > >> Nothing: it could be on disk encrypted. eg. Encrypted files encrypted > >> with storage keys, or encrypted partition encrypted with storage key, > >> or encrypted sent or received email encrypted with storage key. > > Well, if it's encrypted on disk, then "you read the disk" doesn't get > you very far. You need to be able to decrypt the information on the disk. Of course you do. Lets say you are using Peter Gutmanns encrypted filesystem setup. So, if you figure the info on the disk is important, you give a copy of the key to the company lawyer, put it in the fire proof safe, secret split it, whatever tickles your fancy. The advantage of this is that the email software it is no use to the GAKkers, because it doesn't have mildly enforced extra crypto recipients, and it doesn't get the business community used to the idea of shipping email around with extra doors into it. PGP Inc's pgp5.5 could be used by the government to weedle their way into mandatory key escrow. Say that they start requiring companies to use this software, then when lots of companies start using it, they start asking companies for a copy of the company master key. Bingo key escrow, courtesy of PGP Inc. Next they "encourage" ISPs to use it also. > >> The way to do it is as described above. Archive the email, encrypt it > >> to a starage key. Build that functionality into the MUA if you fancy. > >> But _don't_ give extra access to keys used for communications only. > > There is no extra access to communication keys. There is so! His mail said that there was a policy flag in the public key, and an additional public key for the corporate back door. That policy flag effectively said this key has attached to it a request that you encrypt to this extra crypto recipient. In some cases an additional flag will be set which says "if you do not comply with the request to encrypt to the extra crypto recipient, the recipient will not see the mail". PGP Inc's method of enforcing this is an SMTP policy enforcer which bounces mail without the extra crypto recipient. There, that is an extra access to the communication (via an extra route to accessing the session key). Uhhh, I think I just realised why we are talking at cross purposes... you meant extra access to the recipients private key. I consider this an artificial straw man, erected by Jon. Sure it's an independently dumb idea to have lots of people sharing private keys. But the system is still GAK friendly. And it does allow extra parties access to the message. The worry is that government becomes that second party. Do you really care about the details of mandatory GAK, when and if it comes in. Do you care whether the government has a copy of your private encryption key, or whether the system is setup with un-bypassable second crypto recipient of the USG/NSA etc. Can't see that it makes much difference at that point. Both methods can be bypassed theoretically anyway, by super encrypting or any other subliminal channels kicking around in the protocols. So I can't see that arguments about how easy they are to bypass hold much water. Frisbeeing a disk out the window is far easier a way to bypass anyway. Or just blabbing. > >> Hint: you will note that Freeh and friends aren't interested in > >> storage keys. You can see why the above systems is less GAK friendly > >> right? > > Freeh wants storage keys, too. He wants *all* the keys. Yeah he probably does. But he wants your communications keys a lot more. You know why that is? Because he has your communications because you're broadcasting them across the Internet. He'd like to read them. However he doesn't have your disk, and he'd have to break into your offices to get it, or issue you with a supeona or whatever. I'm sure he'd love to read your disk too, but your disk isn't sitting on an NFS mount over the internet. (Is it!?) Fortunately, the internet couldn't handle the strain, otherwise you might see calls for you to rent your disk space of government disk farms, and the government would then be very interested in demanding a copy of your storage keys. So, if even if we use corporate key backup for storage keys, this is still more along the lines of the status quo. They want your documents, they've gotta come and get them. What we'all are getting worked up about here is that Freeh and friends want to be able to key word search our damn communications on fishing expeditions. > Email is a funny thing. It's sort of storage, and sort of > communications. I can understand wanting to recover it from a > communications aspect. They don't call SMTP "store-and-forward" for > nothing. There is no information in the body of the message which is required for it to get to it's destination. All you need is the SMTP headers. You clearly can't end-to-end encrypt the communications routing information. (You could layer it though, like perhaps remailers, with each hop only knowing what it needs to know to do it's job; however at that point you can run into problems: you can't bounce back a delivery failure part way along the route.) > You'll notice that if I delete the messages after receiving it, it > can't be recovered. If I don't, it can. Sound like storage to me. So? The point is that you shouldn't be mixing key purposes. Communications private keys should be used to protect communication and shouldn't be given to anyone else, even your company. Storage keys might be sensible things to backup within the company in case of accidental death. Actually I disagree with what you said: you said "if I delete the message after receiving it, it can't be recovered", it might easily be recovered in lots of ways: 1. feds have tap on your line, feds rubber hose your long term private key out of you 2. your sender has kept a copy in the clear 3. your sender has kept a copy encrypted with a poor passphrase which the feds guess/or rubber hose from him 4. your sender used encrypt-to-self, and has poor passphrase/is passphrase rubber hosed 5. your sender kept a copy which still had you as a crypto recipient (as well as himself with encrypt-to-self), and the feds arrive at your door anyway. Point is, as long as you've got the private keys, it is potentially stored, courtesy of your favourite TLA. This is why you should use forward secrecy, or at least mimic it, by having a long term signature key, and generating a new public key for encryption every week/month, and revoking and destroying the old one. > >> I figure it's not that major a deal. But for those that want it, the > >> most secure, simultaneously least GAK friendly way to do it is to > >> archive and encrypt with separate storage keys. > > This is *exactly* what PGP does: it encrypts with the recipient key, > and the recovery key. Yes, it does, and that is GAK friendly. But that is not what I described above. The difference between what I describe above (quoted a few lines up), and what PGP is doing is that PGP's messages are sent across the internet encrypted to the "recovery key". This is GAK friendly because it is easy to implement GAK with it, you just make that "recovery key" the NSA's "recovery key" (or to avoid newspeak terms perhaps that should be government backdoor master key). Then they coerce ISPs and corporates to include a PGP SMTP policy enforcer which insists on all email having a second crypto recipient of the NSA's backdoor master key. The system is a beautiful GAK system, everything you need for a fully working GAK system is right there on sale by PGP Inc. With what I described, GAK is not possible. What I described is: the MUA archives sent email, and archives received email (after decryption) with none of this process leaking outside the corporate lan (that is it may involve communication inside the LAN). The archives can be encrypted, and you can have a corporate master key with access to these archives. But none of this goes over the Internet. > At this point, I'm not sure if we disagree or not. I'm not sure either, please let me know if I've explained myself this time! I'm worried that the hard time I'm having getting people to grok that escrowing comms keys is a bad idea if you're opposed to mandatory GAK is indicative of the success of the memes being spread by Freeh's crowd. PGP Inc are especially worrying, as they are in a position to influence the balance of whether we get GAK or not, and they appear to be helping GAK out somewhat. Whether this is complicit or whether they don't see that the fact they've implemented a fairly feasible GAK system as that significant in the argument, I'm not sure. However, I think the argument it is relatively straight-forward: companies care about backup of their data. They don't care about backup of their communications. So why backup communications keys? And why include the backup packet in the communication itself? For those companies who have been persuaded that they ought to read email received and email sent, you can implement this without weakening comms security as PGP have done with pgp5.5 for business which is to have a second crypto recipient for backup/backdoor being sent with the message over the internet. All you do for backup or company backdoor is to build in whatever storage, and encrypted archiving functions you wish into the MUA, or internal mail system. That is GAK unfriendly. If PGP Inc is still GAK unfriendly, and hasn't sold out to government, it should be doing something with similar properties to those I described above: not having backdoor second recipient access to traffic. What they have done is implemented a fully functional GAK system. (I get the feeling that sooner or later we're going to get a PRZ penned company position statement. I hope they get it right. I encourage them to re-think.) Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 -----BEGIN PGP SIGNED MESSAGE----- Ryan Anderson wrote: >>What you call "fragility" is properly called "security". Would you >>describe 128-bit keys as more "fragile" than 40-bit keys? Why is PGP, >>Inc. inventing propaganda terms for the authorities? > >Okay, call it security but the point is, if you're protecting documents vital >to your company using encryption (say the design of a new product) and the >person who knows the passphrase dies, you've just lost a great deal of money. > >PGP for Business Security gives the business a way to have a backup key that >can read that person's information. Frankly, it might not be able to read >anybody elses, from the description given. > >This is a feature that any business (that understands encryption) will want. > >They can easily store the secret keys of the other id someplace secure, and >never retrieve them until someone dies. Disavow knowledge of them to >government, etc. heck, the keys can even be in the primary person's >posession. (Perhaps stored in a safe-deposit box, or without a passphrase, >etc.) Decrypting files and decrypting messages are not the same problem. The PGP product has SMTP support - it is explicitly designed to weaken transmitted messages. Just like Clipper. [Jon Callas wrote:] >>It is fascinating to me that every example you use does not involve >>decrypting transmitted messages. Yet, that is the feature which is >>under discussion. > >Amazingly, he gave an example where, had encryption been used, the >project would have stopped, and restarted because the person with the >keys was incapacitated. Are you just being combative here? No. I am making the distinction between files and messages. It is quite easy to use a key for encrypting files which is different from encrypting your messages. The key for encrypting files can then given to the appropriate company officer. It has been possible to use PGP in this mode forever. What is new is the feature set which will make it very easy to impose GAK on the customers of PGP. According to Mr. Schneier, the code is just sitting there in all their products waiting to be compiled in. >>The demand for the ability to decrypt encrypted messages in the >>corporate environment can easily be measured with this test: how >>many companies have a policy that requires employees to record all >>outgoing mail? > >Well, any company giving stock advice (and governed by SEC rules on >stock tips, etc.) is already require to have all outgoing mail >approved (e-mail and snail), so does it matter if they record it or >not? The answer to the question I posed is "No". The example you cite requires the company to review message before transmission, not afterward. After transmission, the recipient of the message can submit it as evidence to the SEC should there be an impropriety. This is no different from the way it works now. There is probably a context issue here. It sounds like you do not share the context within which many people on this list are operating. The Big Problem for PGP, Inc. right now is that in 18 months or so their products may be illegal to use within the United States. While many of the rank and file in the company may be willing to accept corporate dissolution under those circumstances, the board, the investors, and the senior management are unlikely to welcome that option. So, they are preparing for that situation. They are releasing products with GAK support right now. By the time it becomes mandated by law, it will be easy to compile the well tested features into all of the products, or just discontinue their line of privacy products and sell only their Big Brother Inside products. The corporate key becomes the government key with the stroke of a pen. PGP, Inc. is betting that they'll win either way. If GAK goes down in flames again, they can still trade on their reputation for being The Good Guys. If GAK becomes mandated by law: "We didn't want to do it, but we had no choice." Some of us may be in the habit of thinking of PGP, Inc. as the hero. However, the problem with organizations is that they are easily corrupted. Does this mean everybody in the organization is now working for the government? No, it does not. Most likely there are many PGP, Inc. employees who are feeling uncomfortable with this new development but they are being given the same lines we are getting. Many of these people are probably getting an additional "inside scoop" from their leaders that explains the "real" strategy. Hopefully, the rank and file at PGP knows that people you like and see in the hallways every day will still lie to you if they think their career depends on it. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDuw65aWtjSmRH/5AQGwLgf7BBYy2HO30eDXO2YLqkgtuOxAcnQU19AO DOKIa3jwU723ICgWD00dPW1GegKL5LaRfp3a+Xtd+qjHaFs0IlXr4kJGv1wiCJhu sRKxmSi3g1aGIfiF48uMef5bbzPL27b3u78rJds+E44LP9zEnieBcACBp+3977W0 0N0k7ADY6ME+zmc4f5D5aLdJa8gprOCPj1nF6esspkMuDDu5iH/YY/GT6VprRCub NojEXPS/uB6tgTS4vDfenL8UWUUqjXQof8MrRoMAG6dsjvNEyU5WlhbnDgyh9nF5 DbuP9+oA8DHYSmEGzTxD4oG7mGwb+NMMuYOyg3xC1H8ou2Ajv0kfOg== =UtlQ -----END PGP SIGNATURE----- From jon at pgp.com Wed Oct 8 16:27:31 1997 From: jon at pgp.com (Jon Callas) Date: Thu, 9 Oct 1997 07:27:31 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <3.0.3.32.19971007142710.00a22970@mail.pgp.com> Message-ID: <3.0.3.32.19971008161146.009e38c0@mail.pgp.com> At 11:35 PM 10/7/97 -0400, Charles Platt wrote: On Tue, 7 Oct 1997, Jon Callas wrote: > Like it or not, government has a mandate to protect the people from > dangerous technologies, be they in foods, drugs, autos, or information > technologies. Please tell me where it says this in the U.S. Constitution. In particular, please tell me where the FEDERAL government is assigned this power. Thank you. There are a number of places. The usual one they abuse is what's called the "commerce clause" which lets them regulate interstate commerce. They also drag in "providing for domestic tranquility" or anything else that looks good. If you'll look again at my next sentence, I said, "Many people believe that the government uses this mandate as a rationale for acquiring power, many people would prefer that they let us take our chances...." I'm one of those many people. One of the very sad things in our history is that limitations on Federal power became hostage of the race issue a century ago. "States Rights" is a real issue because the Constitution places severe limits on what the federal government is supposed to do. Unfortunately, that term is nigh a synonym for justification of slavery, racial segregation, and other odious things. Limits on the federal government are a casualty of the War Between the States. Recently, the courts have been reversing this trend, tossing out some laws that are justified by the commerce clause. A number of scholars predict this will increase. We can only hope. Jon ----- Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) From dlv at bwalk.dm.com Wed Oct 8 16:36:31 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Thu, 9 Oct 1997 07:36:31 +0800 Subject: Thanks Peter! / Re: russia_1.html In-Reply-To: <199710081656.SAA25279@basement.replay.com> Message-ID: <62u0De1w165w@bwalk.dm.com> nobody at REPLAY.COM (Anonymous) writes: > p.p.s. - I wonder if Dimitri thinks its suspicious that your first > name is the same as my last one. Of course, if he thought we were > doing what John-John do, then ? the Playpus would call you a > pedal-file, eh? (Unless you were doing it to a girl my age, and > then he would call you a 'petal-file.') {<-- that's a sexist joke} Very. Are you indeed a pedophile? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From rah at shipwright.com Wed Oct 8 16:36:58 1997 From: rah at shipwright.com (Robert Hettinga) Date: Thu, 9 Oct 1997 07:36:58 +0800 Subject: Internet Via Electric Lines? In-Reply-To: <199710081601.JAA15326@toad.com> Message-ID: At 3:29 pm -0400 on 10/8/97, Cees de Groot wrote: > Never heard how they're gonna do the steering on > junctions, though... Easy. Just look down the fiber and steer it. :-). To pun something from the pipline biz, pigs *can* fly... Cheers, Bob ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: From dlv at bwalk.dm.com Wed Oct 8 16:37:11 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Thu, 9 Oct 1997 07:37:11 +0800 Subject: Anthrax Bombs In-Reply-To: Message-ID: Tim May writes: > (The Aum Shinretsu cult in Japan was working with such things, including > Sarin, a nerve toxin. Some of the sites knocked out in Iraq were CBW sites.) A few years ago I did several projects together with a guy who actually did a lot of work for AUM/Russia. I never worked with them myself, through. P.S. One of those projects was for Baha'i. They're quite a bunch. "Baha'i shumnoyu tolpoyu Tolkali zhopoj parovoz..." --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From jamesd at echeque.com Wed Oct 8 16:42:43 1997 From: jamesd at echeque.com (James A. Donald) Date: Thu, 9 Oct 1997 07:42:43 +0800 Subject: FCPUNX:CDT complains to my editors after post to cypherpunks Message-ID: <199710082323.QAA10538@proxy3.ba.best.com> At 09:34 AM 9/26/97 -0700, Tim May wrote: > The larger issue is that the CDT/VTW "players" are showing their > willingness to trade away the civil liberties of us all for a few minor > tidbits thrown (they think) to corporate sponsors. CDT may not necessarily be pursuing the interests of its corporate sponsors. Legislation in congress, any legislation, the worse the better, will promote corporate donations to CDT. This does not meen that the corps want legislation. Indeed, this is a chronic problem with such mundane non civil liberties lobbies as the milk lobby. Big business sends their lobbyists to Washington, where they are corrupted by contact with politicians. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd at echeque.com From aba at dcs.ex.ac.uk Wed Oct 8 17:14:39 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Thu, 9 Oct 1997 08:14:39 +0800 Subject: What's really in PGP 5.5? In-Reply-To: Message-ID: <199710090009.BAA02288@server.test.net> Anonymous writes: > Adam Back writes: > > 1. to allow access to important material lost in the mail system in the > > event that an employee is hit by a bus > > > > Argument 1 seems pretty flimsy to me. I reiterate my comment in an > > earlier post: who in their right mind keeps their _only_ copy of > > ultra valuable company information bouncing around in the email > > system? > > > > Regardless, if PGP claims to be catering to those who use this > > argument, and to not want to try that hard to make it impossible to > > by-pass, the more secure, and less GAK friendly way to do it is to > > have the mail client software archive the email sent and received. Thank you anonymous for some good feed back. > Two problems. First, not all mail clients let you archive the mail > in a different form than how it arrived. I was thinking more of a second archive for company use. You can leave the normal MUA archive alone if you have to. The company archive need not be on your machine; could, probably would, be another machine inside the corporate LAN. I do see advantages in using a different archive key for your own archive if you can, but I don't think anybody much is doing this at the moment anyway. > Netscape 3 worked like this, maybe 4 too. 3 has an integrated archive of sent and received email. IMAP mailboxes are interesting in this context. (Mail stays in the remote mail box -- you can't modify it, you've either got to delete it, or leave it -- if it's encrypted you're stuck with that (other than re-encrypting it and mailing it yourself). IMAP is nice for people who are mobile -- use different workstations/laptops each day. But still, it doesn't present a problem. You just archive it once you've decrypted it. Similar to your problem where you can't modify the built-in archive method in the MUA. Problem #2: what if you're outside the LAN? You get inside the LAN with a VPN / ipsec setup, whatever, and do as normal. You'll have to if your mail box is in there. > If the mail comes in encrypted just to an employee key, that is how > it will be stored, and no business access is possible. True. So? Those calling for GAK for company use argue: 1. we've been brainwashed by the GAKkers that it's mission critical to be able to recover email in transit 2. we want to snoop on what our employees are sending. This one: 3. snoop on what our employees are receiving isn't often mentioned. Item 1, recovering email in transit is bogus. Recovering email after receipt, is over-rated in my opinion. Item 2, snooping on sent mail is an independent problem, not involving the GAK argument. (Just send via your mail approver, you sign, he encrypts and sends on if he approves). My suggestion does cater for item 3 because the MUA arranges for the decrypted text to be archived after the employee has decrypted it. To by pass this, the employee has to either: i) modify the software to disable the archiving, or ii) not decrypt it at all. Possibility i) doesn't seem like a major threat, there are ways to hack around all of these escrow mechanisms. PGP Inc are highlighting the purposefully puny nature of their enforcement with the suggestion that this makes it less GAK friendly. Possibility ii) doesn't seem like that big a problem. I presume this is going to come about if the company has read a few emails, and from the context of the other mails this one looks like the biggy, where he is conspiring to do something against the companies interests. Or perhaps they are tipped off. Anyway, my suggested solution would be to ask the employee to decrypt it, and if he refuses, fire him. Any problems? (If he's forgotten his key, get the sender to resend). > Second, what if an employee doesn't come back from vacation? You've > got messages sitting in his inbox which go back three weeks. All > encrypted to his personal key, which is gone. It's been long enough > that the senders may not have backups any more. It's all lost, and > at best the company is going to put its partners and customers to a > great deal of inconvenience by making them re-send everything > they've sent in the last three weeks, not to mention making the > company look incompetent. True. They're going to look a bit incompetent anyway, if this guy was working on a project where he was the main player. They'll have to reorganise anyway. Not really your corporate nightmare situation I don't think. All it requires is a bit if finessing on the part of members of the departees team. If he's an interchangeable employee (one of 20 sales people all doing the same job), you won't be using this method anyway .. you don't want to loose sales when your sales people go on holiday, there will be a sales at megacorp.com which is encrypted to a company key. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 In just a few minutes, we'll be starting the online town hall meeting with Rep. David Dreier (R-CA). Dreier is a key member of Congress for the net community: he's on the Rules committee, which has the fate of SAFE in its hands. He's also been a leader in integrating Congressional committees and the net. Check it out http://www.democracy.net/ -Shabbir From aba at dcs.ex.ac.uk Wed Oct 8 17:15:26 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Thu, 9 Oct 1997 08:15:26 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <3.0.3.32.19971008143320.00a9be80@mail.pgp.com> Message-ID: <199710082309.AAA02193@server.test.net> [cryptography snipped, Perry's killed the thread] Jon Callas writes: > At 08:48 PM 10/7/97 -0500, Bruce Schneier wrote: > Jon Calis wrote: > If this is true (and I have no reason to believe it isn't), then > why is the key escrow code written (although not turned on) in > the source code for 5.0 that was posted internationally from PGP? > > Bruce, I understand that you don't like any form of data recovery, > but there is no key escrow in PGP. Perhaps we should talk about this > on the phone. Oooh. PGP Inc damage control mode on ! We all would like to hear the reason too, Jon :-) > Makes no sense. Here are a couple of reasonably plausible ones: - common source tree with #ifdefs for different products - some functionality required even in non business version to inform user about policy flag meanings btw I didn't read the source code quoted so that second attempt at a plausible reason might be a dud. btw2: it isn't just Bruce that doesn't like key escrow. btw3: your definition of "data recovery" is wrong. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: >I'd fear an "anthrax bomb" a lot more than a 2 KT suitcase nuke. (If I >lived in a crowded target zone, aka a soft target, which I don't.) [snip] Amen. >By comparison, anthrax bacillus is relatively easy to manufacture, and >aerosol dispersion could kill hundreds of thousands or more before even >being detected. Aerosolized dispersion in Washington or Manhattan could be >a far worse human and infrastructure disaster than a suitcase nuke. > >I expect this sort of attack to occur fairly soon. > I'm pretty surprised that someone has posted practical steps for obtaining, culturing. preparation and manufacture of inexpensive aerosol generators. --Steve From cypherpunks at toad.com Wed Oct 8 17:34:02 1997 From: cypherpunks at toad.com (The Last True CypherPunk) Date: Thu, 9 Oct 1997 08:34:02 +0800 Subject: InfoWar 2000 (Part III of 'The True Story of the InterNet) Message-ID: <343C1E01.2825@toad.com> ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar 2000 Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * InfoWar 2000 ---------------------------------------------------------------------------- InfoWar 2000 ---------------------------------------------------------------------------- "InfoWar is back!" Jonathan cried out, waking the other members of the Magic Circle instantly. They quickly rose and gathered around the GraphiScreen hovering over the old oak table. Subject: Re: [Pigdog] ViaCrypt slowly executes Timmy C. May From: Flesh To: pigdog-l at arlington.com, cypherpunks at toad.com Does the fireBot work well with the throwemupagainstthewallandaimfortheheadBot? Cowboy recognized the significance immediately. "A thousand Points of Presence." "UUNET�WorldCom?" Alexis asked, surprised. Jonathan nodded, adding, "And they're moving faster and quieter than they did in history as we have known it, up to now." He began reading off the list he had compiled in just a short time, "Fiber, Digital Microwave, Satellite, Undersea Fiber Cable. Financial markets, telecommunications, construction, health care, and politics. "They seem to be putting all of the 'usual suspects' under one flag, around the globe." ---------------------------------------------------------------------------- A Player To Be Named Later scanned the series of posts, for the thousandth time. "It's dejavu, all over again." he said, quoting a Yogi Berra malapropism. The feeling had been growing on him� The feeling that somehow, everything was the same as before�only different. "The Lake of Life has started to turn over. The bottom is rising to the top, the top is descending to the bottom, and everything is becoming the opposite of what it seems to be." A Player To Be Named Later sat quietly, contemplating what it was that had changed, only somehow not changed, since the last time the lake had turned over on the CypherPunks mailing list. He thought about "WebWorld & the Mythical Circle of Eunuchs." He began to see the parallel between the history of the creation of WebWorld and the creation of the CypherPunks distributed list. There was the subterfuge which had preceded both the Channel Revolution which foreshadowed WebWorld and the Censorship Crisis which had presaged the CypherPunks distributed mailing list. There were the climaxes that precipitated the structural changes in both cases, the satellite destruction in the one case, and the loss of toad.com as host to the mailing list in the other case. There were the parallels with outside attacks ceasing on both the CypherPunks distributed mailing lists and the variety of Channels on WebWorld, in an attempt to let the citizens/members bond with their new channels/lists. One parallel-or two, depending on how you looked at it-in particular, which stood out in the mind of A Player To Be Named Later. There were three CypherPunks distributed lists-at algebra.com, ssz.com, and at cyberpass.net. Likewise, there was a reference to the Money Channel Government in WebWorld having three channels under its control. Then, there was the strange, strange saga of three religious channels-the God Channel, the Dualist Channel, and the Trinity Channel-which had somehow merged, yet not merged, creating a problem which had left the 'powers that be' very, very nervous. "What the hell happened to Channel War I?" A Player To Be Named Later, asked himself, suddenly recognizing a glaring disparity between the parallels he was drawing between the history of WebWorld and the history of the CypherPunks list. "And what the hell happened to InfoWar?" he asked, turning to Baby, who stood up and barked her agreement that there was definitely something fishy going on that involved the two shadow wars that had somehow been misplaced in the annals of history-one in the future, and one in the past. In 'WebWorld', both the reference to the three Money Channel Governments and reference to the three spiritual channels which became one, yet didn't, revolved around the close of Channel War I. But there didn't seem to be a parallel to Channel War I in the Time-Line of the CypherPunks list. Likewise, 'WebWorld' began with a reference to an 'InfoWar Scrambler Mechanism' which seemed to indicate that 'InfoWar' would play a major part in the history of 'WebWorld & the Mythical Circle of Eunuchs.' Yet there were only a few later references in Part II of The True Story of the InterNet in regard to "the beginning stages of InfoWar," with no further details. A Player To Be Named Later strained to touch the wispy haze of memory which was rising somewhere in the back of his mind-a memory which whispered "InfoWar" from somewhere deep in the heart of the CypherPunks mailing list censorship crisis. "Toto!" he said, suddenly feeling a ferocious stinging sensation behind his right ear, which resulted in a loss of balance as he fell to the floor, and a loss of consciousness as the blackness closed in around him� ---------------------------------------------------------------------------- The tattered remnants of the Magic Circle of the future sat quietly around the antique oak table, anxious and depressed. "Why is the Trei Transponder receiving interference from Toto's digital implant?" Priscilla asked the group. "All of my monitoring tests show that the last adjustments we made to the Zooko Zamboni were up to Journeyman standards." "Perhaps it is a result of the differences in the winter climates between the Netherlands and Canada." Jonathan said. "It seems to me that the effects of Global Warming were just beginning to have undeniably noticeable effects in that particular epoch." The Cowboy got up and paced a bit, as the others realized he was working up the courage to say what they were all thinking. "Or.." he hesitated, then turned to face the others and continued, "perhaps the rebirth of InfoWar reflects that our efforts toward changing the past have not only been successful, but are now irrevocable." Jonathan pulled up a passage of 'WebWorld' onto the GraphiScreen, contemplating what he had originally perceived as the failure of InfoWar during the hotly contested battle which took place on the CypherPunks list during the censorship crisis. "January 19, 1997. "The beginning date of the 'moderation experiment' on the legendary CypherPunks mailing list. The beginning probe in preparation for the launching of InfoWar-an experiment which had failed miserably and had caused a delay in the plans of the Evil One. A delay caused by the damnable insolence of the terminal misfits among the CypherPunks. An insolence that was rumored to be fueled by the Circle of Eunuchs, fanning the 'flames' of dissent among the CypherPunks, helping them to resist the herding of their list members into the group-mindset desired by the Evil One." The other members of the Circle of Eunuchs sat still in their seats, not wanting to disturb the deep thoughts of Jonathan, who was indeed the Last True CypherPunk, having grown up at their feet, immersed in their logic and their lore, and whose whole life had been ruled by his connection to the infamous anarchists who had been, alternately, both the shining light of freedom and privacy in their era, and the treacherous instigators of Channel War II-the war which had led to the ultimate triumph of the Gomez and the Dark Allies and the conclusive ascent of the Dark Forces in their domination of WebWorld under the dictum of the Evil One. The room was quiet as Jonathan reluctantly pulled up the next passage of 'WebWorld' which had described his feelings when his bereft past had come back to haunt him. "Jonathan sat frozen in his seat, once again, his brain locked from the major dichotomies being produced as a result of his present-in which the CypherPunks were a villainous band of rogues who had instigated the launching of Channel War II-and his past, in which his grandfather had been exposed both as one of the major players in both the launching of Channel War II, and as traitorous scum who had sabotaged the goals of the CypherPunks in that same historical battle. "Jonathan's grandfather wasn't just a CypherPunk. He was the Fool." "We won�" Jonathan's voice trailed off, before he rose from the table and repeated his statement, in anger. "We won, damn it! "I know we won. Grandfather knew we won the censorship battle. Everyone knew that we won the censorship battle. History itself knows that we won�we�" Jonathan stopped short, turning to stare at the others, who were staring back. "Jonathan�" Bubba said softly. "History has changed." "I know that, damn it!" Jonathan resumed his pacing, knowing that he was missing something very, very important, but he couldn't for the life of him think what it might possibly be. The others in the room watched and waited, knowing that it was Jonathan, and Jonathan alone, whose heritage was intricately and irrevocably linked to the era in history which they had, for better or worse, interfered in through their use of the Trei Transponder. "Grandfather was a traitor to the CypherPunks�a traitor to freedom and privacy. He sabotaged everything that the CypherPunks had fought so hard to defend, since the inception of their anarchist, cryptography mailing list. "But the CypherPunks loved us�" Jonathan was lost in memories of a childhood in which he and his family had been forced to remain in constant motion, staying a half-step ahead of the Dark Allies, who had been hunting down the last remaining members of the CypherPunks-with a vengeance. His family had been soundly welcomed by the remaining CypherPunks, in their flight to freedom after his Grandfather's assassination. They had given the family food, clothing, shelter, and warned them when the Dark Allies were closing in, and it was once again time to flee. Duncan Frissell had even� Perhaps they all had� Jonathan sank to the floor, slowly, with Alexis leaping up and catching him softly. Cowboy helped her guide him toward the table and lower him into a chair. Jonathan slowly pulled off his shirt and stared at his tattoo�the Mark of the Toad. "Duncan Frissell arrived at our last safe house, in the middle of the night." Jonathan spoke, finally understanding the real story behind his family's flight into obscurity. "He warned us to flee, but it was too late�the Dark Allies were close at hand." Jonathan's voice was full of amazement as he recounted an event which he had long known, but had never managed to fully understand. "Duncan held the Dark Allies at bay, while we made our escape. I can still hear his screams�" Jonathan shuddered, then began shaking terribly. Alexis closed her arms around him, hugging him lightly. "Your Grandfather knew that the CypherPunks had lost the battle." Bubba picked up the thread. The other members of the Magic Circle looked on, mystified as to this strange turn of events which turned the whole history of the CypherPunks and the Circle of Eunuchs on hits head. "It wasn't a censorship battle." the Cowboy said, amazed as much by what he was saying as those listening to him were. "It was InfoWar!" "That's what happened to InfoWar." Alexis cried out, in disbelief of her own words. "It was over before it had begun." Bubba d'Shauneaux IV rose to his feet, and filled in the details of the battle as could only be done by one who had spent a lifetime of subterfuge playing a role which was the exact opposite of what it had seemed to be from surface appearances. "It was the first battle fought solely within the bounds of Virtual Reality." "It represented the true nadir point in history when the battle between the Forces of Light and the Forces of Darkness moved beyond the physical plane and into the minds of mankind." "InfoWar!" he roared, the word reverberated throughout the room, sending the Trei Transponder into a soft hum which grew louder and louder, with a pitch that went lower and lower until it became subsonic, unheard, but shaking the room�the earth�even WebWorld itself... The Trei Transponder exploded with a mighty boom, shaking the room so violently that the tattered remnants of the Magic Circle were thrown from their chairs, and found themselves rising to see only ruins around them, where their safe house had once been. They immediately realized that they must flee at once, as those investigating the explosion would undoubtedly be the Dark Allies, fully aware that the event had rent WebWorld at the seams. Jonathan paused, weapon in hand, covering the retreat of d'Shauneaux, who had remained behind to remove the last traces of evidence that the Circle of Eunuchs had ever truly been there. As d'Shauneaux joined him, motioning for him to proceed, he took one last look at the shattered remains of the Trei Transponder. All contact with the CypherPunks of the past was now gone, with little hope of it being renewed. Silently, he sent a message to the CypherPunks of his youth-from the bottom of his soul and into the inestimable profundity of the Tao. It was a message that would be understood by those who had been at Woodstock-a physical gathering of a Magic Circle which had come into physical being through a random blessing of Time and Chance. "You're on you own, folks�because we're sure on ours." ---------------------------------------------------------------------------- Those who fail to learn from the future, are doomed to repeat it. ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ---------------------------------------------------------------------------- From cypherpunks at toad.com Wed Oct 8 17:41:39 1997 From: cypherpunks at toad.com (The Last True CypherPunk) Date: Thu, 9 Oct 1997 08:41:39 +0800 Subject: InfoWar 2000 / AOL Format Message-ID: <343C1F7F.6F0E@toad.com> A non-text attachment was scrubbed... Name: not available Type: text/html Size: 13425 bytes Desc: not available URL: From jon at pgp.com Wed Oct 8 17:53:12 1997 From: jon at pgp.com (Jon Callas) Date: Thu, 9 Oct 1997 08:53:12 +0800 Subject: What's really in PGP 5.5? In-Reply-To: Message-ID: <3.0.3.32.19971008172422.00a4c100@mail.pgp.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At 08:48 PM 10/7/97 -0500, Bruce Schneier wrote: If this is true (and I have no reason to believe it isn't), then why is the key escrow code written (although not turned on) in the source code for 5.0 that was posted internationally from PGP? I just got through talking to one of the developers, and think I found what you're talking about, Bruce. In "pgp.c" of the Unix 5.0 published edition, there's some old Viacrypt code with a comment that says, 'This is our version of "Commercial Key Escrow"' but in fact just adds an additional recipient to the encryption list. It is not in any shipping PGP product. If there's anything to laugh about in all this, if you try to use the feature in the Unix freeware, it core-dumps. It doesn't appear at all in the Mac and Windows code. It's completely gone as of now. Jon -----BEGIN PGP SIGNATURE----- Version: PGP for Business Security 5.5 iQA/AwUBNDwkNn35wubxKSepEQJMvACfWZHVKkYswR9xLibuY8496a4GcaAAoNSB Yda/tOiQA1vLGocTL0N6XVj1 =LNYn -----END PGP SIGNATURE----- ----- Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) From wendigo at ne-wendigo.jabberwock.org Wed Oct 8 19:05:48 1997 From: wendigo at ne-wendigo.jabberwock.org (Mark Rogaski) Date: Thu, 9 Oct 1997 10:05:48 +0800 Subject: Internet Via Electric Lines? In-Reply-To: <199710081929.VAA19175@evrl.xs4all.nl> Message-ID: <199710090117.VAA10713@deathstar.jabberwock.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 An entity claiming to be Cees de Groot wrote: : In the Netherlands, every house is hooked to the natural gas network. I've : heard rumours about them guys testing literally blowing fiber into your : house through the gas pipes (hook fiber to a shuttle, let it loose - gas : pressure does the rest). Never heard how they're gonna do the steering on : junctions, though... Or how they plan on doing it without filling up the target domicile with lots of stinky gas. Doc - -- [] Mark Rogaski "That which does not kill me [] wendigo at pobox.com only makes me stranger." -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDwwp8HFI4kt/DQOEQJ+jACgtbYvxRakM0Wagm3hUmC0WFVpaV4AnA7m 9ZrhoWionhcj07t4OM9qRSxE =nYyZ -----END PGP SIGNATURE----- From bd1011 at hotmail.com Wed Oct 8 19:08:01 1997 From: bd1011 at hotmail.com (Nobuki Nakatuji) Date: Thu, 9 Oct 1997 10:08:01 +0800 Subject: MISTY algorithm source code Message-ID: <19971009011655.26059.qmail@hotmail.com> Attachments files is MISTY algorithm source code. Thank you very much. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com MISTY.zip -------------- next part -------------- A non-text attachment was scrubbed... Name: zip00000.zip Type: application/octet-stream Size: 1336 bytes Desc: "" URL: From nobody at REPLAY.COM Wed Oct 8 19:27:28 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 9 Oct 1997 10:27:28 +0800 Subject: access to storage keys, NOT comms keys! Message-ID: <199710090215.EAA02470@basement.replay.com> Here is what leading cryptographers say about email key recovery, from http://www.crypto.com/key_study/report.shtml. This includes respected figures like Bruce Schneier, Matt Blaze, Ron Rivest, Ross Anderson, Whit Diffie, and more. 2.1 Communication Traffic vs. Stored Data While key ``recoverability'' is a potentially important added-value feature in certain stored data systems, in other applications of cryptography there is little or no user demand for this feature. In particular, there is hardly ever a reason for an encryption user to want to recover the key used to protect a communication session such as a telephone call, FAX transmission, or Internet link. If such a key is lost, corrupted, or otherwise becomes unavailable, the problem can be detected immediately and a new key negotiated. There is also no reason to trust another party with such a key. Key recoverability, to the extent it has a private-sector application at all, is useful only for the keys used to protect irreproducible stored data. There is basically no business model for other uses, as discussed below. In stored data applications, key recovery is only one of a number of options for assuring the continued availability of business-critical information. These options include sharing the knowledge of keys among several individuals (possibly using secret-sharing techniques), obtaining keys from a local key registry that maintains backup copies, careful backup management of the plaintext of stored encrypted data, or, of course, some kind of key recovery mechanism. The best option among these choices depends on the particular application and user. Encrypted electronic mail is an interesting special case, in that it has the characteristics of both communication and storage. Whether key recovery is useful to the user of a secure E-mail system depends on design of the particular system. The government, on the other hand, proposes a key recovery infrastructure that applies to virtually all cryptographic keys, including (especially) those used to protect communications sessions. They say that key recovery is not appropriate for transient keys used during a communication session. However, email is a special case, having characteristics of both communication and storage. In some systems, email may be archived for long periods of time in the same format that it was received. For such systems there is a business case for key recovery in email. From nobody at REPLAY.COM Wed Oct 8 19:31:37 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 9 Oct 1997 10:31:37 +0800 Subject: NoneRe: russia_1.html In-Reply-To: <199710081351.GAA15050@toad.com> Message-ID: <199710090225.EAA03343@basement.replay.com> Peter Trei wrote: > I conceed that it may not be the Pu decay products that cause the > limited shelf life of thermonuclear weapons; I suspect that it may > be components of the 'pit', which produces the initial burst of > neutrons to kick of the reaction (the pit is effectively a small > fission bomb). This 'pit' may contain tritium (pit design is a very > well guarded secret, and I've seen very little about it in the open > literature). The pit usually contains beryllium-9 and an alpha source. When beryllium-9 is struck by an alpha particle it will eject a neutron. Tritium is rather useless for this purpose as it is a beta emitter and betas do not have enough energy to eject neutrons from anything. The reason the pit goes bad is because you need to be able to produce a large number of neutrons in a short period of time, so you need a very strong alpha emitter (stronger than the Pu239) which means it will decay more rapidly. Furthermore, those neutrons are going to find their way into various nuclei and transmutate them into things you don't want. The reason the pit is necessary is that Pu is too fast - the critical mass will blow itself apart just as the reaction is getting underway. To avoid this "fizzle", an implosion bomb is used which squeezes the Pu core and holds it there long enough for it to react. Once the critical mass is assembled you want to make sure it actually blows. If there aren't any free neutrons during that split-second then it won't explode. So that's what the 'pit' is for. From jya at pipeline.com Wed Oct 8 19:44:04 1997 From: jya at pipeline.com (John Young) Date: Thu, 9 Oct 1997 10:44:04 +0800 Subject: US Terrorist Targets Message-ID: <1.5.4.32.19971009020928.00b8ef6c@pop.pipeline.com> US State Department today published the latest list of terrorist organizations (and multiple aliases) which are now targets of sanctions: http://jya.com/dos100897.txt And related foreign assets control announcement: http://jya.com/fac100897.txt ---------- List summary: Abu Nidal Organization Abu Sayyaf Group Armed Islamic Group Aum Shinrikyo Democratic Front for the Liberation of Palestine-Hawatmeh Faction Euzkadi Ta Askatasuna Gama'a al-Islamiyya HAMAS Harakat ul-Ansar Hizballah Japanese Red Army al-Jihad Kach Kahane Chai Khmer Rouge Kurdistan Workers' Party Liberation Tigers of Tamil Eelam Manuel Rodriguez Patriotic Front Dissidents Mujahedin-e Khalq Organization National Liberation Army Palestine Islamic Jihad-Shaqaqi Faction Palestine Liberation Front--Abu Abbas Faction Popular Front for the Liberation of Palestine Popular Front for the Liberation of Palestine--General Command Revolutionary Armed Forces of Colombia Revolutionary Organization 17 November Revolutionary People's Liberation Party/Front Revolutionary People's Struggle Shining Path Tupac Amaru Revolutionary Movement From pleontks at hotmail.com Wed Oct 8 19:44:49 1997 From: pleontks at hotmail.com (THE DUKE) Date: Thu, 9 Oct 1997 10:44:49 +0800 Subject: No Subject Message-ID: <19971009023118.27488.qmail@hotmail.com> Have you ever realized that this list is for straight-up (used loosely) losers? The government is not planning to murder everyone. The Government is not keeping aliens in the 'basement'. The X-Files are not real. The government is not murdering public figures, and setting-up pore, civilian saps to take the fall. The only thing that the Government is doing is running our country the best it can. All you are doing for the Government, is finding fault and conspiracy in every action. You are destroying the Government, and are thereby destroying America. By even being a part of this list, you are confirming to the mindlessness that you so hard are trying not to do. None of you have my pity. I spit upon you all. THE.DUKE pleontks at hotmail.com http://www.angelfire.com/az/69frank69 ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com From nobody at REPLAY.COM Wed Oct 8 20:01:40 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 9 Oct 1997 11:01:40 +0800 Subject: MISTY algorithm source code Message-ID: <199710090247.EAA05594@basement.replay.com> "Nobuki Nakatuji" writes: >Attachments files is MISTY algorithm source code. Interesting. The "Crow" algorithm seems to do nothing but return "BITE ME!" for any plaintext, the "Tom Servo" algorithm converts ciphertext into hip neologisms, and the "Gypsy" algorithm turns unintelligible plaintext into unintelligible ciphertext and vice versa. Memo to self: Fire Chief Programmer Mike Nelson. From ravage at ssz.com Wed Oct 8 20:06:43 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 9 Oct 1997 11:06:43 +0800 Subject: http:--allpolitics.com-1997-10-08-email-clinton.irs- Message-ID: <199710090154.UAA15480@einstein.ssz.com> AllPolitics Bulletin Board Join a thread, start a thread -- it's your chance to sound off! Infoseek search __________ ______ Help Navigation E-mail From Washington From: John King/CNN White House correspondent In: Philadelphia, Pa. Posted 10-8-97 Subject: Clinton to propose IRS citizens panel on Friday After weeks of Republican criticism that he was defending the Internal Revenue Service, sources tell CNN that President Bill Clinton on Friday will propose creating national and regional citizens boards to handle taxpayer complaints against the agency. Clinton's citizens panels would not have as much authority over the IRS as most Republicans prefer. But the White House believes the proposal will give the president cover. Under the Clinton plan, a national citizens panel would be created to serve as a forum for oversight and to handle taxpayer complaints. Similar panels would be created to serve as complaint clearinghouses for each of the IRS' three dozen regional offices. An administration official tells CNN that Clinton will also commit to internal IRS reforms designed to make the agency more efficient. The administration move comes after sharp complaints from congressional Democrats and White House political advisers who worried that the administration appeared to be defending the agency during Republican-called hearings that highlighted taxpayer complaints. _________________________________________________________________ In Other News: Wednesday Oct. 8, 1997 �/BIG> Senators Grill Ickes On Democratic Fund-Raising �/BIG> Democratic Fund-Raisers Will Testify If Immunized �/BIG> Bennett: No 'Distinguishing Characteristics' �/BIG> Clinton Replies To Thompson �/BIG> Jackson Named U.S. Envoy To Africa �/BIG> House Approves Abortion Ban Bill �/BIG> Maine Gov. To Run For Second Term �/BIG> Foley Approved As Envoy To Japan �/BIG> Congress May OK New Dollar Coin �/BIG> Lott: Campaign Finance Bill Dead �/BIG> Analysis: Selling Access Is Political Secret �/BIG> Republicans Ride Anti-IRS Sentiment �/BIG> Babbitt Casino Comments Mulled �/BIG> GOP Seizes On Education Vouchers E-Mail From Washington: �/BIG> Clinton To Propose IRS Citizens' Panel On Friday �/BIG> White House Works To Shore Up Democratic Fast Track Support �/BIG> Lott: Fund-Raising Investigation May Be Extended News Briefs: �/BIG> Clinton Touts 'Unprecedented' Welfare-Roll Decline ... Special Online Companion: �/BIG> The Money Trail: Democracy For Sale Advertise on AllPolitics. Click here for info. Congressional Quarterly Come see the cures of tomorrow Search the Web with InfoSeek _________________________________________________________________ home | news | in-depth | analysis | what's new | bulletin boards | contents | search _________________________________________________________________ Click here for technical help or to send us feedback. Copyright � 1997 AllPolitics All Rights Reserved. Terms under which this information is provided to you. From ravage at ssz.com Wed Oct 8 20:07:27 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 9 Oct 1997 11:07:27 +0800 Subject: http:--cnnfn.com-digitaljam-wires-9710-08-encrypt_wg- Message-ID: <199710090154.UAA15503@einstein.ssz.com> Nortel Power Networks. Click Here. [INLINE] Digital Jam graphic EU stumps for encryption Commission urges U.S. to take 'hands off' approach on regulations October 8, 1997: 3:17 p.m. ET [LINK] [INLINE] Encryption fight rolls on - Sept. 15, 1997 Infoseek search __________ ____ ____ BRUSSELS (Reuter) - European officials urged governments, including the United States, on Wednesday to take a "hands off" approach to regulating the technology needed to ensure that Internet transactions are confidential. [INLINE] "If regulation at all is needed, it should be very light," a top telecommunications commission official said, presenting a report on how the European Union should promote security on the Internet. [INLINE] EU Telecommunications Commissioner Martin Bangemann told reporters that strict controls would end up penalizing law-abiding users rather than the criminals they targeted. [INLINE] He added that the United States, which restricts exports of certain strong encryption products, was becoming isolated on the issue. "We must engage in a debate with the Americans at an international level," he told a news conference. [INLINE] The commission's report addressed the use of encryption and "digital signatures" -- electronic seals that are attached to transmissions to allow recipients to verify their origin and ensure that they have not been tampered with. [INLINE] It urged the EU to take a common approach to the questions, saying otherwise cross-border Internet trade could be hampered. It said it would propose legislation on "digital signatures" in the first half of 1998. [INLINE] Encryption has become a contentious issue because some governments and law enforcement authorities want to regulate it as a way to keep it out of the hands of terrorists and other criminals. France has virtually outlawed use of encryption software. [INLINE] But the commission said controls could impede the growth of a technology that is essential to promoting business over the Internet and would likely not work anyway. [INLINE] "It's not possible to prevent criminals from using modern technologies in order to protect themselves and their messages from the police," Bangemann said. "There's not much point in preventing legal users from having access to this." [INLINE] In addition to its export controls, the United States is discussing legislation that would restrict encryption technology domestically, for example by requiring systems that would allow law enforcement authorities to tap into electronic transmissions. [INLINE] Bangemann renewed his push for a global charter on the Internet that would address questions such as encryption, noting that the United States had already expressed interest in the idea. [INLINE] The Commission said EU legislation on digital signatures would address questions such as legal recognition of signatures, liability, technical requirements and certification authorities (CAs). [INLINE] CAs hold information that allow recipients to confirm the identity of the person that has sent a transmission. [INLINE] It said it would look askance at national restrictions on encryption, however. "Instead of introducing or maintaining rather inefficient but cumbersome restrictions, the Commission invites member states to enhance cooperation of police forces on a European and international level," it said. Link to top home | digitaljam | contents | search | stock quotes | help Copyright 1997 Reuters. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. Copyright © 1997 Cable News Network, Inc. ALL RIGHTS RESERVED. From jad at dsddhc.com Wed Oct 8 20:08:36 1997 From: jad at dsddhc.com (John Deters) Date: Thu, 9 Oct 1997 11:08:36 +0800 Subject: computationally infeasible jobs for MITMs (Re: Secure phone) In-Reply-To: <3.0.3.32.19971008132417.00b0c6d0@labg30> Message-ID: <3.0.3.32.19971008202940.0099f800@labg30> At 11:48 PM 10/8/97 +0100, Adam Back wrote: >I wonder if we can come up with a way to formalise this technique and >automate it. I think it was James voiced something similar earlier in >the thread. I think that's the problem: once it's formalized and automated, it's spoofable by a MITM. The informal, "Hi Adam, my first digit's the third digit of your phone number today, how's your end?" type of query, perhaps made before or after the entire "I've got 78F, what's yours?" sequence, is going to remain secure. If we assume the MITM can spoof your digits, he can also spoof a whole query without weird digit splicing in the middle. It's like the cartoon cat looking the cartoon dog image in the mirror, waving and trying to trick the image. You can attempt to outmaneuver a MITM with trick questions which will almost certainly expose him, but if the stakes are high enough...where there's a will, there was a dead body. Without some external reference, be it the knowledge of the public key of the other participant, or using a trusted arbitrator, keyserver or whatever, I don't think you *can* mathematically authenticate the other end. The MITM with full knowledge will always be able to reconstruct the proper replies. Your best defenses will be: 1) External (out-of-band) authentication, as in a PGP key signing party, or even just having Bob's key fingerprint from a piece of e-mail posted to cypherpunks a year ago. 2) Wetware outclevering the MITM. Re: your noise introduction protocol. Cute idea, but what if Mallory simply audio-couples his two phones together along with a noise compander circuit a la Dolby? That kind of noise is precisely what the simple electronic filters can remove, and the digital portion is passed via the coupling computer system (the one that spoofs the voices.) "Hey, Bob, I think we've got a MITM! This connection is too clear!" :-) I think the hardest to defeat will be the case where Mallory hires Alicia and Bobby to impersonate Alice and Bob to each other. Alice <---------------------------> Bob (what they think is happening) Alice <---> Bobby______Alicia <---> Bob (what actually is happening) / \ under Mallory's control where Bobby and Alicia have the translator's gift of speaking while listening. They could fill in the cracks with idle chatter, have their own personalities, and basically run both shows. They could even run offline from each other, being intelligent humans. As long as Alice and Bob only communicate through Mallory's intermediaries (i.e. never meet in real life, out-of-band), Mallory owns the show. (Tell me you've never seen something like that on a rerun of _Mission_Impossible_! :-) Would you know if you were talking to the REAL John Deters? All I could assume about you is that if my phone rang and a voice claimed to be Adam Back, I'd expect to hear it in a British accent, and with just a bit of time delay so I'd know it was coming across the Atlantic. About 50 million people could pass themselves off as you today, and I'd never know the difference. I can't even tell a Liverpool accent from a London accent! And if I had a voice recognition system, well, then I'd hope if I was taking a voice sample from you that I'd be smart enough to exchange public keys so we could do our authentication the right way. Again, my position is: o internal authentication is *not* information-theoretically possible; o out-of-band authentication *can be* theoretically secure; o MITM attacks are *almost* infeasible, and *always* expensive; and o if you still suspect a MITM after trying to outwit one, you're just being paranoid. Stop it. John P.S. Even if I exchanged PGP keys with you face-to-face, compared picture ID's, checked your fingerprints, read a signed letter from your Mom (moms don't lie,) and *knowing* that you are indeed Adam Back, I still won't know if you work for MI-5 or not! Nothing's perfect, so lets take what we can get. -- J. Deters "Don't think of Windows programs as spaghetti code. Think of them as 'Long sticky pasta objects in OLE sauce'." +--------------------------------------------------------------------+ | NET: mailto:jad at dsddhc.com (work) mailto:jad at pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'36"N by 93^16'27"W Elev. ~=290m (work) | | For my public key, send mail with the exact subject line of: | | Subject: get pgp key | +--------------------------------------------------------------------+ From ravage at ssz.com Wed Oct 8 20:11:07 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 9 Oct 1997 11:11:07 +0800 Subject: index.html Message-ID: <199710090156.UAA15535@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Tech banner IBM AS/400 rule U.S. SEEN AS OPEN TO CYBER ATTACK Cyber Warfare graphic October 8, 1997 Web posted at: 3:46 p.m. EDT (1946 GMT) BALTIMORE (AP) -- Suddenly, electric power goes off. Or telephones go dead. There's chaos in the electronic banking system. Are the incidents electronic accidents, or deliberate attacks? Computer security experts from government and private industry voiced agreement Tuesday that as the most technologically advanced society in the world, the United States is uniquely vulnerable to electronic attack. How soon the threat would be real and what could be done to block it were principal topics of discussion on the opening day of the National Information Systems Security Conference. "Our profound vulnerability is growing on a daily basis," said Charles Abzug of the Institute for Computer and Information Sciences. "Since our society is the most technologically advanced in the world, we are more vulnerable than anyone else." Robert Marsh, a retired Air Force general who is chairman of the President's Commission on Critical Infrastructure Protection, told the conference that "while a catastrophic cyber attack has not occurred, we have enough isolated incidents to know that the potential for disaster is real and the time to act is now." The commission is expected to send its report to the White House next week. Marsh said the panel would recommend far greater cooperation and sharing of information between government and private industry, accelerated research and a nationwide program to educate people on the scope of the problem. But questions were quickly raised as to how much information the government could share from a report that is classified. "We have to solve this dilemma because if we don't, we have no sharing of information," said Thomas J. Falvey, a commission member who is a security expert at the Transportation Department. Marsh conceded in an interview that there will be a need to break down reluctance within industry and government to share sensitive information. He said there is a need to "devise the means by which the private sector can in fact be willing to share its information and not fear that it will leak." At the same time, the government "is going to have to recognize that in this new era, it's the private sector that needs some of this threat information and this warning information." As examples of cyber attacks already experienced, Marsh cited incidents at Langley Air Force Base in Virginia and Griffis Air Force Base in Rome, New York. "A flood of e-mail messages originating in Australia and Estonia, and routed through the White House computer system, virtually shut down Langley air base's e-mail for hours," he said. Someone in England routing messages through Latvia, Colombia and Chile and commercial Internet service providers gained access to computers at Rome Laboratory at Griffis and "launched attacks against a wide array of defense and government computer systems," Marsh said. One of the difficulties in such cases is determining whether it is the work of a mischievous hacker or an attack by a hostile government. "If Iran attacked AT&T, how does AT&T know that's an act of war rather than some kid fooling around?" asked John Pescatore, a senior consultant at Trusted Information Systems, a developer of computer security software. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. rule Related sites: Note: Pages will open in a new browser window * Air Force Information Warfare Center World-Wide Web - develops, maintains and deploys Information Warfare/Command and Control Warfare (IW/C2W) capabilities in support of operations, campaign planning, acquisition and testing * Air Force Computer Emergency Response Team - the single point of contact in the Air Force for reporting and handling computer security incidents and vulnerabilities External sites are not endorsed by CNN Interactive. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Watch these shows on CNN for more sci-tech stories: CNN Computer Connection | Future Watch | Science & Technology Week rule Message Boards Sound off on our message boards You said it... [INLINE] IBM AS/400 rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From ravage at ssz.com Wed Oct 8 20:11:38 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 9 Oct 1997 11:11:38 +0800 Subject: alt_index.html Message-ID: <199710090152.UAA15435@einstein.ssz.com> October 8, 1997 -- Updated 9:03 p.m. EDT (0103 GMT) TEXT - ONLY VERSION MORE NEWS Fund-raising flap Campaign finance is getting a thorough airing on Capitol Hill. While the Senate's hearing into President Clinton's 1996 campaign funding continued Wednesday with a feisty appearance by Harold Ickes, the House kicked off its own probe. And the president defended his staff as he headed off for a day of fund-raising. * Senators grill Ickes * Fund-raisers may testify in House hearing * Clinton replies to Thompson Pathfinder data shows Mars may have crust, core _________________________________________________________________ House approves late-term abortion ban bill _________________________________________________________________ Army to court-martial Sergeant-Major McKinney _________________________________________________________________ What's on CNN Crossfire Impact _________________________________________________________________ T O P S T O R I E S _________________________________________________________________ U. S. * U.S. designates 30 groups as terrorist * Police: Teen hid newborn at home for 2 1/2 weeks * Poll: Most believe Clinton practiced illegal or unethical fund-raising * Georgian diplomat admits guilt in teen's traffic death * In other news... A L L P O L I T I C S * Jackson named U.S. envoy to Africa * Clinton to propose IRS citizens' panel * Lawyer dismisses Jones' claim that Clinton has 'distinguishing characteristics' C N N f n * Family of boy ejected from Chrysler minivan awarded $260 million * Greenspan sacks market * Pow! Marvel-Chase deal falls through * EU stumps for encryption H E A L T H * Meat industry wants irradiation, not tougher penalties T H E T E R R Y N I C H O L S T R I A L * Nichols' case may be toughest yet for defense attorney * Lawyer changes mind to lead Nichols' prosecution * No nonsense Matsch returns to preside over second trial V I E W S * Bill Mitchell's cartoon: President fitted for hearing aid * AllPolitics: Pundits and Prose W E A T H E R * Tropical air bathes the East * Tropical Storm Fabian forms in Atlantic C U S T O M N E W S * Live to be 100 - Better Homes and Gardens * Company run by moms suggests tricks to make Halloween a healthy treat * Cole's Cooking A to Z: Recipe for ladyfingers * Create your own personal edition of CNN - FOR FREE! E A R T H * Forests shrinking at alarming rate Q U I C K N E W S * Get daily updates via e-mail C O M M U N I T Y * Is peace a possibility in the Middle East? * Join our daily NewsChat M-F! W O R L D * U.N. imposes sanctions on Sierra Leone * Arafat, Netanyahu agree to meet regularly, envoy says * Accused Nazi collaborator faces accusers in French trial * Croat war crime suspects plead not guilty C N N / S I * Glavine great as Braves even series with 7-1 win * Dolphins pick up Miami grad Perriman * Carolina QB Collins airs frustrations * Report: Edmonton Oilers to Houston? S C I - T E C H * Supply ship successfully docks with Mir * U.S. seen as open to cyber attack S P E C I A L S * U.S. Supreme Court 1997-1998 session * Princess Diana: A nation mourns * Repairing Mir * Destination Mars: Pictures and panoramas W H E E L S * Auto Hall of Fame comes home to Michigan S H O W B I Z * NBC, CBS and ABC missing something in common: viewers * Review: 'A Thousand Acres' the harvest of a lousy script * Arthur Tracy, famed radio 'Street Singer,' dies at 98 * National Endowment for Arts head leaving post T R A V E L * Just stop a minute and take a look at fall * See our Rocky Mountain Fall slideshow! * Wyland's whale murals come to Chicago * Destinations: A drive on the wild side of Washington V I D E O V A U L T * EU ban on animal parts upsetting Greek appetites F R I N G E * City streets stay steamed S T Y L E * Milan, fashion world await Versace show * Sonya Rykiel: Sexy androgyny _________________________________________________________________ _________________________________________________________________ F E E D B A C K * Email us your comments * What you said! P A G E R * Get automatic updates J O B S * CNN/SI Producer * CNN/SI Copy editor * CNN/SI Multimedia designer * CNN/SI ENG/SNG Engineer * CNN/SI Software Developers C U S T O M N E W S * Register for your personal news A I R M E D I A * Download a free demo P O I N T C A S T * Download it free! _________________________________________________________________ Back to the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From ghio at temp0132.myriad.ml.org Wed Oct 8 20:17:09 1997 From: ghio at temp0132.myriad.ml.org (Matthew Ghio) Date: Thu, 9 Oct 1997 11:17:09 +0800 Subject: [LONG, off-topic]] Interactive Programming In-Reply-To: <199710071346.GAA11853@toad.com> Message-ID: <199710090310.XAA29039@myriad> > In any event, > I was impressed enough that I quit looking for the > offending test, > telling the Big Boss I couldn't find it. > He didn't seem surprised. Reminds me of a time, years ago, where I was trying to modify a program written in 6502 assembler. In addition to pervasive self-modifing code, another extremely popular practice of the era was inlined function-call parameters. Unlike the C approach, which most of you are probably familiar with, where parameters are pushed onto the stack, then a subroutine is called which pops them, instead the subroutine would pop the return address, and use it as a pointer to the function parameters. At the end of the function, the return address pointer would be incremented and jumped to. You're probably thinking, this is nuts. Why would anyone do this? Consider the following line of C code: result = function(x,y,z); One could write this in 6502 assembler as: JSR function DATA x DATA y DATA z STA result where x,y,z,result are pointers to storage locations. This made coding in assembler just as easy as coding in C, and it took less memory because you didn't need all those push/pop instructions. Doing this on a modern processor would probably wreck havok on the decode pipeline. Apple's ProDOS used this type of calling sequence, and most disassemblers dealt with this special case by correctly identifying the parameters as such. But one of the worst I ran into was this: JSR printf ASC "Hello, world!",0 ... You can imagine what the disassembler did with that. Spit out all sorts of garbage as it tried to interpret the ASCII string "Hello, world!" as machine instructions. I encountered this in some BBS software, and had a real difficult time reading it. Finally I got the idea of taking the partially disassembled code, identifying all the branch target addresses, then redisassembling starting at those addresses. It worked. After a few iterations of this I had all the entry points, and everything that didn't disassemble cleanly was outputted as hex data. For fun, run objdump on a cleanly compiled unix binary... It makes it all look so easy... :) From cme at acm.org Wed Oct 8 20:45:49 1997 From: cme at acm.org (Carl M. Ellison) Date: Thu, 9 Oct 1997 11:45:49 +0800 Subject: What's really in PGP 5.5? In-Reply-To: Message-ID: I thought when Phil showed me the corporate access option that the user had the ability to remove that crypto-recipient by double clicking on it in the window which pops up listing all crypto-recipients. I may have been wrong. I agree with you that the danger is in allowing the gov't to claim that industry accepts GAK. If this product were released with a sticker on every copy to the effect that we citizens have always had a right to attempt to keep a secret from gov't via crypto, then I'd feel better. Meanwhile, aren't we overlooking the real issue here: that there are apparently companies obnoxious enough to tell you you are not allowed to send mail they can't read? Little Brother may be as bad as Big Brother. - Carl +------------------------------------------------------------------------+ |Carl M. Ellison cme at acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2| | "Officer, officer, arrest that man! He's whistling a dirty song." | +-------------------------------------------- Jean Ellison (aka Mother) -+ From wendigo at ne-wendigo.jabberwock.org Wed Oct 8 20:55:41 1997 From: wendigo at ne-wendigo.jabberwock.org (Mark Rogaski) Date: Thu, 9 Oct 1997 11:55:41 +0800 Subject: your mail In-Reply-To: <19971009023118.27488.qmail@hotmail.com> Message-ID: <199710090351.XAA11295@deathstar.jabberwock.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 An entity claiming to be THE DUKE wrote: : : Have you ever realized that this list is for straight-up (used loosely) : losers? Didn't you receive the welcome message that specifically said "If you are not a loser, unsubscribe NOW!"? This apparent error will be sent to Customer Service right away. : : The government is not planning to murder everyone. The Government is : not keeping aliens in the 'basement'. The X-Files are not real. The : government is not murdering public figures, and setting-up pore, : civilian saps to take the fall. The only thing that the Government is : doing is running our country the best it can. 1) Killing everyone, aside from being a public relations hassle, would reduce tax revenues. Just not feasible. 2) I'm pretty sure Gillian Anderson and David Duchovny get a paycheck from some entity, so the X-Files (a TV show) does indeed exist. 3) The government is NOT murdering public figures and setting up porous saps to take the fall (spongiforms take comfort in this fact!). The government IS murdering public figures and building widespread support for their actions via manipulation of the media. Hey, we're #1! 4) Unfortunately, the gov't IS running this country the best it can. That's what scares us silly. : : All you are doing for the Government, is finding fault and conspiracy in : every action. You are destroying the Government, and are thereby : destroying America. Even assuming that the nature of an entire nation is defined by the government that holds power, I fail to see how criticism is interpreted as being destructive against a government based upon the association of open criticism and discussion with the proper functioning of government. : : By even being a part of this list, you are confirming to the : mindlessness that you so hard are trying not to do. Ahhhh, throwing me off balance through the use of an alien syntax. Your Jedi tricks will not work on me! : None of you have my pity. I spit upon you all. : Thanks for the warm fuzzies. Doc - -- [] Mark Rogaski "That which does not kill me [] wendigo at pobox.com only makes me stranger." -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDxUocHFI4kt/DQOEQJ1YACgtSiCeQT150hVyBTKeBe6FsSOpsUAoODa qrc2NZZR/MXTQ/N9BpemMp8f =kjhz -----END PGP SIGNATURE----- From cme at acm.org Wed Oct 8 21:10:47 1997 From: cme at acm.org (Carl M. Ellison) Date: Thu, 9 Oct 1997 12:10:47 +0800 Subject: Secure phone In-Reply-To: <3.0.3.32.19971007102724.00a499c0@labg30> Message-ID: Eric, I think you can make a stronger statement. With your phone, once you exchange the hash you have good assurance that you have a private conversation with the person whose voice you hear. How you determine that that is the person you think it is/should be is a different problem. As for proving lack of an eavesdropper, you would also need to establish that the person's earpiece wasn't bugged, the person didn't record the conversation to hand to someone else, .... For my purposes, the authentication is secure enough that I'm very pleased. The voice quality is good enough that I can recognize friends -- and if I'm calling a stranger, then the MITM is a moot point. That is, if I'm calling a stranger named Bob, there is no way for me to tell the difference between: Carl -- Eve -- Bob and Carl -- Bob -- Eve since both Bob and Eve are strangers to me and I don't know Bob well enough to rule out case 2. - Carl +------------------------------------------------------------------------+ |Carl M. Ellison cme at acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2| | "Officer, officer, arrest that man! He's whistling a dirty song." | +-------------------------------------------- Jean Ellison (aka Mother) -+ From ravage at ssz.com Wed Oct 8 21:20:40 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 9 Oct 1997 12:20:40 +0800 Subject: 6502 ML programming Message-ID: <199710090439.XAA16340@einstein.ssz.com> Forwarded message: > Date: Wed, 8 Oct 1997 23:10:26 -0400 > From: ghio at temp0132.myriad.ml.org (Matthew Ghio) > Subject: Re: [LONG, off-topic]] Interactive Programming > Reminds me of a time, years ago, where I was trying to modify a program > written in 6502 assembler. > Consider the following line of C code: > > result = function(x,y,z); > > One could write this in 6502 assembler as: > > JSR function > DATA x > DATA y > DATA z > STA result > > where x,y,z,result are pointers to storage locations. There in no 'DATA' construct in 6502 assembly. This is some sort of macro that either the assembler or programmer defined. All official Rockwell/Commodore [1] 6502 assembly mnemonics are three letter. There are NO official macro's from MOS Technologies under either Rockwell or Commodore other than the ORG. ORG simply defined the starting address for the target code. The most efficient way to store data in 6502 is to put it in the first 256 bytes of ram, then it could be called in no more than 2 clock cycles. Also, in 6502 good programmers use the branch instructions (BCC, BCS, BEO, BMI, BNE, BPL, BVC, BVS) because the JSR required three bytes versus 2 bytes for a Bxx. The only constraint was that the branch target must reside in the same 256 byte page as the branch itself. The biggest boo-boo committed here was not realizing that branch offsets that took you across the upper page boundary would leave you at the lower page boundary plus some remaining offset. Idealy a jump table was created that had the various target addresses for your routines. Then a Bxx followed by a indirect mode JMP (NOT a JSR). If that table was in the first 256 bytes it was possible to save a whole clock cycle AND a byte in the process. At 64k and 1Mhz clock these sorts of short-cuts were significant. Because of the architecture of the 6502 the 0 page of RAM was a very busy place indeed because any operation there automaticaly saved a byte and a clock cycle. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| [1] Rockwell designed and sold the chip for several years and then in the late 70's Commodore bought MOS Technologies. From ravage at ssz.com Wed Oct 8 21:25:32 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 9 Oct 1997 12:25:32 +0800 Subject: index.html Message-ID: <199710090444.XAA16394@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Main banner Charles Schwab Rated #1 by Smart Money rule BROTHER'S BOOK: ATF BLEW UP MURRAH BUILDING James Nichols Jury selection continues in Denver courtroom October 8, 1997 Web posted at: 10:21 p.m. EDT (0221 GMT) DECKER, Michigan (CNN) -- As jury selection continues in the trial of accused Oklahoma bombing conspirator Terry Nichols, his brother has published a book meant to plant the seeds of doubt about whether Nichols was involved in the worst terrorist attack ever on U.S. soil. The 415-page book, co-written with Bob Papovich, is called "Freedom's End: Conspiracy in Oklahoma." In it, James Nichols contends that his brother had nothing to do with the 1995 bombing, that a law enforcement agency actually blew up the building, and that the FBI has not investigated the case sufficiently. _______________________________________________________________ "They have failed to prove anything. They have investigated people, but not the bombing, because all they want to do is prosecute people, not find out the truth." � James Nichols _______________________________________________________________ Specifically, James Nichols contends that the plastic barrels found at his brother's Kansas home did not match those found in the rubble of the Alfred P. Murrah Federal Building in Oklahoma City. He also contends that the bomb did not contain ammonium nitrate, as prosecutors contend. vxtreme CNN's Ed Garsten reports. James Nichols does admit that Timothy McVeigh, already convicted and sentenced to death in the attack that killed 168 people, was upset about a 1993 raid by Bureau of Alcohol, Tobacco and Firearms agents at the Branch Davidian compound in Waco, Texas. But he scoffs at the idea that was the motive for the Oklahoma bombing, as prosecutors say. "Getting back at the (ATF) is a really stupid argument. There were few (ATF) agents stationed at the Murrah building," he writes. Freedom's End Instead, James Nichols maintains that the ATF itself blew up the Murrah building as part of a cover up of what happened at Waco. He wrote, "Who benefits by destroying records that would prove that the (ATF) was lying about the alleged drug laboratory, illegal weapons and child abuse at (the Davidian compound)?" Contacted for a response, an ATF spokesman told CNN that the agency could not comment because of the ongoing trial of Terry Nichols in Denver. James Nichols is scheduled to testify in his brother's defense. For James Nichols, writing the book may have been easier than getting it published. He says mainstream publishers would not print it, so he and Papovich published it themselves and took out loans to pay for it. Nichols also says many books stores are refusing to carry it because of its controversial subject matter. Jury selection continues in Denver In Denver meanwhile, a second week of jury selection began in Nichols' trial in U.S. District Court. Terry Nichols A grandmother who said it would be a mortal sin for her to impose the death penalty, and who pleaded that she needed to be with a sick daughter, was dismissed Wednesday on grounds of hardship. "I could never think of putting a person to death, because how can you put a person to death when it won't bring the people back?" she asked. "It would be on a person's conscience." The woman is Catholic and Judge Richard Matsch asked if she considered it a mortal sin to sentence someone to death. "Yes," said the woman, "a mortal sin." She was followed by a man who designs packaging for the medical industry. He said the death penalty would be appropriate in "a crime where someone shows no remorse. It might be a very violent crime." Another prospective juror interviewed Wednesday morning was a man who at first said the death penalty should be automatic for anyone convicted of premeditated murder. Later, under questioning by U.S. District Court Judge Richard Matsch, the man conceded that he could consider the character and background of the defendant before imposing a death sentence. The court is attempting to find a pool of 64 "death penalty-qualified" jurors from which a final panel of 12 jurors and six alternatives will be chosen. Under federal law, jurors must agree that they can impose the death penalty but will also consider other sentences if mitigating circumstances warrant. Nichols, 42, could receive the death penalty if he is convicted of the murder and conspiracy charges he faces. Detroit Bureau Chief Ed Garsten contributed to this report. rule Trial nav grfk T H E N I C H O L S T R I A L / T H E M c V E I G H T R I A L T H E B O M B I N G / C N N S T O R I E S / L I N K S CNN Community * Message board - OKC trials: Nichols and McVeigh Related feature * Time Magazine: 'What Nichols revealed' _______________________________________________________________ Infoseek search ____________________ ____ ____ _______________________________________________________________ rule Message Boards Sound off on our message boards You said it... [INLINE] Charles Schwab Rated #1 by Smart Money rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From ravage at ssz.com Wed Oct 8 21:25:54 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 9 Oct 1997 12:25:54 +0800 Subject: index.html Message-ID: <199710090445.XAA16427@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Main banner SAMSUNG Meet the Challenge rule WOMAN ADMITS SLAPPING ADOPTED CHILD ON FLIGHT FROM RUSSIA October 8, 1997 Web posted at: 10:30 p.m. EDT (0230 GMT) NEW YORK (AP) -- A Phoenix woman testified Wednesday that on a 12-hour flight from Moscow she may have slapped one of the two Russian girls she and her husband adopted. Karen Thorne said she was "very frustrated" in her attempts to calm the young girl on the crowded jet. She said difficulties began when she and her husband, Richard, met the 4-year-olds at an orphanage in Voronezh, about 12 hours north of Moscow by train. She said one child cried frequently and the other was initially warm, but then became aggressive and hard to manage. She said the children were difficult to control on a shopping trip in Moscow and while waiting to board the plane to New York. Three Texas men who were on the flight with their own newly adopted children said they saw the Thornes hit the girls. The Thornes were arrested upon landing and the girls were placed in foster homes, first in New York and now in Arizona, where the Thornes are permitted supervised visits. The Thornes have been charged with assault, harassment and endangering the welfare of the children. The Thornes speak only English; the children only Russian. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Message Boards Sound off on our message boards You said it... [INLINE] SAMSUNG Meet the Challenge rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From stewarts at ix.netcom.com Wed Oct 8 21:45:06 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Thu, 9 Oct 1997 12:45:06 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <3.0.3.32.19971007142710.00a22970@mail.pgp.com> Message-ID: <3.0.3.32.19971008213456.006ae340@popd.ix.netcom.com> At 02:27 PM 10/07/1997 -0700, Jon Callas wrote: >When I was at HIP97 this August, I was amused to hear cypherpunks >chanting, "Data recovery good, key recovery bad." ... >The essence of data recovery is that focusing on the keys is a canard. >If you've misplaced your data, you want the data back, not the keys. >The only people who want your keys are people who want to spy on you. Eric Hughes brought up this at a cypherpunks meeting earlier this year. It doesn't mean that businesses often _need_ data recovery, and there are serious and complex concerns about "what data do we keep? what data do we discard?" that companies, their legal staffs often deal with. In particular, the Intellectual Property Bureaucrats tend to get very concerned if you either do or don't have a large collection of data in one place, as lawsuit targets, conflict of interest between departments, and "simultaneous employment" opportunities for clerks and computer-janitors. But it's clearly the case that they don't need keys, only maybe data. I haven't yet seen a technical description of PGP5.5, but it sounds like it's implementing copying data to some corporate data-escrow key. Note that, while it is a lawsuit/subpoena/warrant target, that's typically not something that happens without company knowledge, unlike Louis Freeh's dream of no-knock backdoors for your data. So who gets the data? How do you tell what kinds go to whom? Any corporate feature for implementing this needs to provide some mechanism and interface for supporting multiple alternative recipients - if you need message escrow, you may need the 90-day-Work-In-Progress escrow, or the Long-Term-Projects escrow, or the Company-X-Relationship escrow, or the Accounting-Department Escrow, or the Retain-for-Legal-Department escrow - note that these are different functions from just copying those recipients, because an escrow feature is supposed to be semi-automatic and not for automatic and convenient access. Doing the job right really means you need to be able to send mail to recipients who get only a secret-shared slice of the session key, not the whole thing - not only for corporate data escrow, but also for mail you've addressed yourself that goes to your lawyers, or the managers of your trust, or the three trustees of your corporation. >One of the downsides of cryptography is that if you lose your passphrase >(or token, PIN, smart card, or whatever), you've lost your data. One way to help this problem is to support secret-sharing for user key backup, as well as the ability to make copies of keys with different passphrases (e.g. the floppy in the offsite-storage with the passphrase on the yellow-sticky doesn't use the same passphrase as the same key on your desk machine.) >(5) The system has to allow someone under a legal threat to respond >effectively to that threat. Legal threats include warrants, subpoenas, and >discovery processes. You have to be able to respond to the request for >information without losing your keys and thus all of your data. This is an important point - if you've got [data + session key] escrow, you've got a reasonable court case that says the court doesn't need your master keys, just the keys for the specific messages. Of course, they _can_ ask to see _all_ the messages by the targeted senders, just as they can ask to see all the paper in your file cabinets, but you at least have some ability to fight it. >(6) It must also provide a response to those who would regulate crypto in >the name of public safety. Fortunately for us, potential regulators have >focused on the horsemen of the infocalyse. The issue of whether this is in fact needed or if it's giving in to the Great Satan is of course the critical one.... > A few weeks ago, we showed it to the FBI and asked their opinion. > They told us it doesn't meet any of their needs. No, No, Br'er Zimmermann, Don't throw me in that there briar patch! Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From MAILER-DAEMON at wombat.sk.sympatico.ca Wed Oct 8 22:17:10 1997 From: MAILER-DAEMON at wombat.sk.sympatico.ca (Mail Delivery Subsystem) Date: Thu, 9 Oct 1997 13:17:10 +0800 Subject: Warning: could not send message for past 4 hours Message-ID: <199710090428.WBY07338@wombat.sk.sympatico.ca> ********************************************** ** THIS IS A WARNING MESSAGE ONLY ** ** YOU DO NOT NEED TO RESEND YOUR MESSAGE ** ********************************************** The original message was received at Wed, 8 Oct 1997 18:00:38 -0600 (CST) from orenco23.sk.sympatico.ca [142.165.99.23] ----- The following addresses have delivery notifications ----- (transient failure) ----- Transcript of session follows ----- ... Deferred: Connection refused by orion.sk.sympatico.ca. Warning: message still undelivered after 4 hours Will keep trying until message is 1 day old Reporting-MTA: dns; wombat.sk.sympatico.ca Arrival-Date: Wed, 8 Oct 1997 18:00:38 -0600 (CST) Final-Recipient: RFC822; toto at sk.sympatico.ca Action: delayed Status: 4.2.0 Remote-MTA: DNS; orion.sk.sympatico.ca Last-Attempt-Date: Wed, 8 Oct 1997 22:28:07 -0600 (CST) Will-Retry-Until: Thu, 9 Oct 1997 18:00:38 -0600 (CST) To: cypherpunks at toad.com Subject: InfoWar 2000 / AOL Format From: The Last True CypherPunk Date: Wed, 08 Oct 1997 18:04:15 -0600 Organization: "It's a Multi-User Persona whose homepage is a Mirror site." Reply-To: cypherpunks at toad.com Title: The True Story of the Internet Part II The True Story of the InterNet Part III InfoWar 2000 Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger Copyright 1997 Pearl Publishing InfoWar Table of Contents InfoWar 2000 InfoWar 2000 "InfoWar is back!" Jonathan cried out, waking the other members of the Magic Circle instantly. They quickly rose and gathered around the GraphiScreen hovering over the old oak table. Subject: Re: [Pigdog] ViaCrypt slowly executes Timmy C. May From: Flesh To: pigdog-l at arlington.com, cypherpunks at toad.com Does the fireBot work well with the throwemupagainstthewallandaimfortheheadBot? Cowboy recognized the significance immediately. "A thousand Points of Presence." "UUNET�WorldCom?" Alexis asked, surprised. Jonathan nodded, adding, "And they're moving faster and quieter than they did in history as we have known it, up to now." He began reading off the list he had compiled in just a short time, "Fiber, Digital Microwave, Satellite, Undersea Fiber Cable. Financial markets, telecommunications, construction, health care, and politics. "They seem to be putting all of the 'usual suspects' under one flag, around the globe." A Player To Be Named Later scanned the series of posts, for the thousandth time. "It's dejavu, all over again." he said, quoting a Yogi Berra malapropism. The feeling had been growing on him� The feeling that somehow, everything was the same as before�only different. "The Lake of Life has started to turn over. The bottom is rising to the top, the top is descending to the bottom, and everything is becoming the opposite of what it seems to be." A Player To Be Named Later sat quietly, contemplating what it was that had changed, only somehow not changed, since the last time the lake had turned over on the CypherPunks mailing list. He thought about "WebWorld & the Mythical Circle of Eunuchs." He began to see the parallel between the history of the creation of WebWorld and the creation of the CypherPunks distributed list. There was the subterfuge which had preceded both the Channel Revolution which foreshadowed WebWorld and the Censorship Crisis which had presaged the CypherPunks distributed mailing list. There were the climaxes that precipitated the structural changes in both cases, the satellite destruction in the one case, and the loss of toad.com as host to the mailing list in the other case. There were the parallels with outside attacks ceasing on both the CypherPunks distributed mailing lists and the variety of Channels on WebWorld, in an attempt to let the citizens/members bond with their new channels/lists. One parallel-or two, depending on how you looked at it-in particular, which stood out in the mind of A Player To Be Named Later. There were three CypherPunks distributed lists-at algebra.com, ssz.com, and at cyberpass.net. Likewise, there was a reference to the Money Channel Government in WebWorld having three channels under its control. Then, there was the strange, strange saga of three religious channels-the God Channel, the Dualist Channel, and the Trinity Channel-which had somehow merged, yet not merged, creating a problem which had left the 'powers that be' very, very nervous. "What the hell happened to Channel War I?" A Player To Be Named Later, asked himself, suddenly recognizing a glaring disparity between the parallels he was drawing between the history of WebWorld and the history of the CypherPunks list. "And what the hell happened to InfoWar?" he asked, turning to Baby, who stood up and barked her agreement that there was definitely something fishy going on that involved the two shadow wars that had somehow been misplaced in the annals of history-one in the future, and one in the past. In 'WebWorld', both the reference to the three Money Channel Governments and reference to the three spiritual channels which became one, yet didn't, revolved around the close of Channel War I. But there didn't seem to be a parallel to Channel War I in the Time-Line of the CypherPunks list. Likewise, 'WebWorld' began with a reference to an 'InfoWar Scrambler Mechanism' which seemed to indicate that 'InfoWar' would play a major part in the history of 'WebWorld & the Mythical Circle of Eunuchs.' Yet there were only a few later references in Part II of The True Story of the InterNet in regard to "the beginning stages of InfoWar," with no further details. A Player To Be Named Later strained to touch the wispy haze of memory which was rising somewhere in the back of his mind-a memory which whispered "InfoWar" from somewhere deep in the heart of the CypherPunks mailing list censorship crisis. "Toto!" he said, suddenly feeling a ferocious stinging sensation behind his right ear, which resulted in a loss of balance as he fell to the floor, and a loss of consciousness as the blackness closed in around him� The tattered remnants of the Magic Circle of the future sat quietly around the antique oak table, anxious and depressed. "Why is the Trei Transponder receiving interference from Toto's digital implant?" Priscilla asked the group. "All of my monitoring tests show that the last adjustments we made to the Zooko Zamboni were up to Journeyman standards." "Perhaps it is a result of the differences in the winter climates between the Netherlands and Canada." Jonathan said. "It seems to me that the effects of Global Warming were just beginning to have undeniably noticeable effects in that particular epoch." The Cowboy got up and paced a bit, as the others realized he was working up the courage to say what they were all thinking. "Or.." he hesitated, then turned to face the others and continued, "perhaps the rebirth of InfoWar reflects that our efforts toward changing the past have not only been successful, but are now irrevocable." Jonathan pulled up a passage of 'WebWorld' onto the GraphiScreen, contemplating what he had originally perceived as the failure of InfoWar during the hotly contested battle which took place on the CypherPunks list during the censorship crisis. "January 19, 1997. "The beginning date of the 'moderation experiment' on the legendary CypherPunks mailing list. The beginning probe in preparation for the launching of InfoWar-an experiment which had failed miserably and had caused a delay in the plans of the Evil One. A delay caused by the damnable insolence of the terminal misfits among the CypherPunks. An insolence that was rumored to be fueled by the Circle of Eunuchs, fanning the 'flames' of dissent among the CypherPunks, helping them to resist the herding of their list members into the group-mindset desired by the Evil One." The other members of the Circle of Eunuchs sat still in their seats, not wanting to disturb the deep thoughts of Jonathan, who was indeed the Last True CypherPunk, having grown up at their feet, immersed in their logic and their lore, and whose whole life had been ruled by his connection to the infamous anarchists who had been, alternately, both the shining light of freedom and privacy in their era, and the treacherous instigators of Channel War II-the war which had led to the ultimate triumph of the Gomez and the Dark Allies and the conclusive ascent of the Dark Forces in their domination of WebWorld under the dictum of the Evil One. The room was quiet as Jonathan reluctantly pulled up the next passage of 'WebWorld' which had described his feelings when his bereft past had come back to haunt him. "Jonathan sat frozen in his seat, once again, his brain locked from the major dichotomies being produced as a result of his present-in which the CypherPunks were a villainous band of rogues who had instigated the launching of Channel War II-and his past, in which his grandfather had been exposed both as one of the major players in both the launching of Channel War II, and as traitorous scum who had sabotaged the goals of the CypherPunks in that same historical battle. "Jonathan's grandfather wasn't just a CypherPunk. He was the Fool." "We won�" Jonathan's voice trailed off, before he rose from the table and repeated his statement, in anger. "We won, damn it! "I know we won. Grandfather knew we won the censorship battle. Everyone knew that we won the censorship battle. History itself knows that we won�we�" Jonathan stopped short, turning to stare at the others, who were staring back. "Jonathan�" Bubba said softly. "History has changed." "I know that, damn it!" Jonathan resumed his pacing, knowing that he was missing something very, very important, but he couldn't for the life of him think what it might possibly be. The others in the room watched and waited, knowing that it was Jonathan, and Jonathan alone, whose heritage was intricately and irrevocably linked to the era in history which they had, for better or worse, interfered in through their use of the Trei Transponder. "Grandfather was a traitor to the CypherPunks�a traitor to freedom and privacy. He sabotaged everything that the CypherPunks had fought so hard to defend, since the inception of their anarchist, cryptography mailing list. "But the CypherPunks loved us�" Jonathan was lost in memories of a childhood in which he and his family had been forced to remain in constant motion, staying a half-step ahead of the Dark Allies, who had been hunting down the last remaining members of the CypherPunks-with a vengeance. His family had been soundly welcomed by the remaining CypherPunks, in their flight to freedom after his Grandfather's assassination. They had given the family food, clothing, shelter, and warned them when the Dark Allies were closing in, and it was once again time to flee. Duncan Frissell had even� Perhaps they all had� Jonathan sank to the floor, slowly, with Alexis leaping up and catching him softly. Cowboy helped her guide him toward the table and lower him into a chair. Jonathan slowly pulled off his shirt and stared at his tattoo�the Mark of the Toad. "Duncan Frissell arrived at our last safe house, in the middle of the night." Jonathan spoke, finally understanding the real story behind his family's flight into obscurity. "He warned us to flee, but it was too late�the Dark Allies were close at hand." Jonathan's voice was full of amazement as he recounted an event which he had long known, but had never managed to fully understand. "Duncan held the Dark Allies at bay, while we made our escape. I can still hear his screams�" Jonathan shuddered, then began shaking terribly. Alexis closed her arms around him, hugging him lightly. "Your Grandfather knew that the CypherPunks had lost the battle." Bubba picked up the thread. The other members of the Magic Circle looked on, mystified as to this strange turn of events which turned the whole history of the CypherPunks and the Circle of Eunuchs on hits head. "It wasn't a censorship battle." the Cowboy said, amazed as much by what he was saying as those listening to him were. "It was InfoWar!" "That's what happened to InfoWar." Alexis cried out, in disbelief of her own words. "It was over before it had begun." Bubba d'Shauneaux IV rose to his feet, and filled in the details of the battle as could only be done by one who had spent a lifetime of subterfuge playing a role which was the exact opposite of what it had seemed to be from surface appearances. "It was the first battle fought solely within the bounds of Virtual Reality." "It represented the true nadir point in history when the battle between the Forces of Light and the Forces of Darkness moved beyond the physical plane and into the minds of mankind." "InfoWar!" he roared, the word reverberated throughout the room, sending the Trei Transponder into a soft hum which grew louder and louder, with a pitch that went lower and lower until it became subsonic, unheard, but shaking the room�the earth�even WebWorld itself... The Trei Transponder exploded with a mighty boom, shaking the room so violently that the tattered remnants of the Magic Circle were thrown from their chairs, and found themselves rising to see only ruins around them, where their safe house had once been. They immediately realized that they must flee at once, as those investigating the explosion would undoubtedly be the Dark Allies, fully aware that the event had rent WebWorld at the seams. Jonathan paused, weapon in hand, covering the retreat of d'Shauneaux, who had remained behind to remove the last traces of evidence that the Circle of Eunuchs had ever truly been there. As d'Shauneaux joined him, motioning for him to proceed, he took one last look at the shattered remains of the Trei Transponder. All contact with the CypherPunks of the past was now gone, with little hope of it being renewed. Silently, he sent a message to the CypherPunks of his youth-from the bottom of his soul and into the inestimable profundity of the Tao. It was a message that would be understood by those who had been at Woodstock-a physical gathering of a Magic Circle which had come into physical being through a random blessing of Time and Chance. "You're on you own, folks�because we're sure on ours." Those who fail to learn from the future, are doomed to repeat it. "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite From ghio at temp0133.myriad.ml.org Wed Oct 8 23:56:33 1997 From: ghio at temp0133.myriad.ml.org (Matthew Ghio) Date: Thu, 9 Oct 1997 14:56:33 +0800 Subject: 6502 ML programming In-Reply-To: <199710090439.XAA16340@einstein.ssz.com> Message-ID: <199710090632.CAA06768@myriad> Jim Choate wrote: > > There in no 'DATA' construct in 6502 assembly. > > This is some sort of macro that either the assembler or programmer > defined. All official Rockwell/Commodore [1] 6502 assembly mnemonics are > three letter. True, but most assemblers would let you insert static data into the object file using various pseudo-ops like that. > Idealy a jump table was created that had the various target addresses for > your routines. Oh, those were fun to debug too... > The most efficient way to store data in 6502 is to put it in the first 256 > bytes of ram, then it could be called in no more than 2 clock cycles. Actually that took three cycles. One to fetch the opcode, one to fetch the target address, and one to fetch the data byte. If you wanted to do it in two cycles, you had to write the data into the operand of the instruction that loaded it (self-modifying code). From info at epic.org Thu Oct 9 15:30:45 1997 From: info at epic.org (Electronic Privacy Info Center) Date: Thu, 9 Oct 1997 15:30:45 -0700 (PDT) Subject: Privacy Forum - Oct 20 - Washington DC Message-ID: - Open to the public - PRIVACY SYMPOSIUM Georgetown University Law Center Washington, DC October 20, 1997 A public symposium entitled "Privacy at the Crossroads: Law, Technology, and Public Policy", will be held on October 20, 1997, at Georgetown University Law Center in Washington, DC. This symposium will look at emerging privacy issues in the legal and technological world, with a particular focus on the European Union Data Directive, privacy enhancing technologies, and the shape of privacy protection in the next century. These issues are rapidly coming to the fore with the adoption of the European Union Directive and the increasing interest in techniques to promote privacy protection, especially with the rapid flow and exchange of information that is possible with electronic data. Privacy has recently been the subject of hearings before the Federal Trade Commission and it is a central component of the new White House policy on Electronic Commerce. The symposium will take place on Monday, October 20, 1997, at the Gerwirz Center of the Georgetown University Law Center, 600 New Jersey Avenue, NW, Washington, DC. The program will begin at 9 a.m. and conclude at 4 p.m. Speakers will include many North American experts on privacy and technology issues, including law professors, technologists, and commentators. The symposium is sponsored by the Georgetown University Law Center, the John F. Connelly Program in Business Ethics, Georgetown University School of Business, the Communication, Culture, and Technology Program of Georgetown University, and the Electronic Privacy Information Center. This is a free event open to the public. No registration is required. If you have any further questions, please contact Shauna Van Dongen at . Program "PRIVACY AT THE CROSSROADS: LAW, TECHNOLOGY AND PUBLIC POLICY" Georgetown University Law Center Gewirz Student Center, 12th Floor 600 New Jersey Avenue, NW Washington, DC Monday, October 20, 9 a.m. - 4 p.m. 9:00 Welcome - Dean Allen, Prof. Levy, Prof. Drake, Prof. Rotenberg 9:15 The European Union Data Directive Moderator: Deborah Hurley, Kennedy School of Government Prof. David Flaherty, British Columbia Information and Privacy Commissioner Robert Gellman, Information and Privacy Consultant Prof. Priscilla Regan, George Mason University Prof. Paul Schwartz, Brooklyn Law School Prof. Peter Swire, Ohio State University College of Law 10:45 Privacy and Technology Moderator: Prof. Michael Froomkin, Univ. of Miami Law School Dr. Ann Cavoukian, Ontario Information and Privacy Commissioner Prof. Gary Marx, Woodrow Wilson Center Prof. Joel Reidenberg, Fordham Law School Prof. Paul Resnick, University of Michigan Peter Wayner, Cybertimes 12:15 Lunch 1:30 The Future of Privacy Moderator: Dean Anita Allen, Georgetown University Law Center Prof. Phil Agre, Univ. of California at San Diego Prof. Mary Culnan, Georgetown Graduate School of Business Prof. Helen Nissenbaum, Princeton University Prof. Alan Westin, Columbia University 3:00-4:00 Reception Sponsored by - Georgetown University Law Center, John F. Connelly Program in Business Ethics of the Georgetown University School of Business, Georgetown University Communication, Culture, and Technology Program [http://www.georgetown.edu/grad/CCT/], Electronic Privacy Information Center [http://www.epic.org/] From xjlr56xcz at 24540.com Thu Oct 9 16:50:24 1997 From: xjlr56xcz at 24540.com (xjlr56xcz at 24540.com) Date: Thu, 9 Oct 1997 16:50:24 -0700 (PDT) Subject: . Message-ID: <> Turn Your Ideas, Interests or Hobbies into a Lifetime Income, with... ******* THE KITCHEN TABLE MILLIONAIRE ******* Special LIMITED TIME OFFER Includes "PowerSecrets"... FREE! _/_/_/ The Secret of Financial Freedom _/_/_/ Find something you love so much you'd do it for nothing, develop and market it, and the world will shower you with wealth! It starts with "The Four D's..." Dream, Discover, Develop, and Do it!" THE KITCHEN TABLE MILLIONAIRE provides all the tools you need! Home-based business is a $380 billion industry. Ironically, the same technology responsible for massive layoffs and unemployment makes it possible for the average individual to run a prosperous home business out of a spare bedroom, the garage or even, yes, the kitchen table! 60,000 new home businesses are started across America every week. That's one every 11 seconds. Average income is $50,000--twice the national average employee salary. Success rates over a 3-year period are an astounding 85 percent, compared with just 20 percent in the traditional small business sector. An astonishing 90 percent of all home-based businesses succeed in the first year! The key to success is not quick-buck schemes or wild goose chases. You need proven INFORMATION and RESOURCES. The Kitchen Table Millionaire is a revolutionary new book that provides the explosive techniques necessary to develop any idea, then target the widest possible market, and effectively sell to that market. You can get started right away, in just a few hours a day, without interfering with your present job. You don't have to be lucky, well-educated or come from a rich family in order to be successful. A recent survey of successful business owners showed that only 3 percent came from wealthy families. Nearly 50% came from the ranks of the poor or lower middle class. Only 29 percent finished college. Thomas Carlyle said, "The true university of these days is a collection of books." The Kitchen Table Millionaire is the only book you need! _/_/_/ What the Experts Say _/_/_/ "This extraordinary book could change your life! It will open your eyes to opportunities that you cannot now imagine. You should get it, read it, and apply it in your life. You will be astonished!" - Brian Tracy, best-selling author of MAXIMUM ACHIEVEMENT and THE PSYCHOLOGY OF SUCCESS "The Kitchen Table Millionaire provides the nuts, bolts and ideas to help you achieve your dreams of home business success." - Carolyn Tice, Executive Editor, Home Business News; American Home Business Assoc. "This easy to use book goes much deeper than its competition--full of innovative, step-by-step advice about how to get your project off the ground." - Opportunity Magazine "Having spent most of my adult life self-employed, I've been approached with more money making opportunities than I could possibly imagine. Everyone wants to sell me "the book that can change my life forever." I've seen them all. And I've been distinctly unimpressed. But The Kitchen Table Millionaire caught my attention... and kept it. Cochrane's advice is based on tried and true strategies, that, for the most part, the experts have kept secret." - Author Anthony Trupiano, in THE BEST DEALS IN AMERICA TODAY _/_/_/ What Readers Say _/_/_/ "The book is clear, concise, and most of all, it works! After applying the strategies, my consulting business grossed $6,000 in a single month, and continues to flourish, thanks to you!" - F. J. Procopio, California "I just finished your book and thoroughly enjoyed it as well as gained a lot of new ideas and knowledge from your expertise. I have to admit my favorite line in the book is on page 7, "Even if you win the rat race, you're still a rat." - M.D. Foster "I've been suckered by more than a few schemes in my search for reliable home business information. I bought courses by Brad Richdale and Carlton Sheets, and was very disappointed with the information I received. You really do walk the talk." - K.W., Alberta, Canada "It's nice to know there is more out there than just get-rich-quick schemes and real estate hucksters. Thank you so much!" - J. Rapp, California "If you can't make money from reading this book, you can't make money." - A. Jacobellis, Texas _/_/_/ Extraordinary Success Stories of Ordinary People... Like You! _/_/_/ A San Jose, CA woman started a mobile paper shredding business off the back of a truck--and grossed $180,000 in her first year! Anthony Raissen launched BreathAsure on a single radio station--for free--and turned it into a multi-million dollar empire, virtually overnight! An 82-year old man comes up with novelty items like the "Good Egg" Award; a trophy with an egg on top, which he sells to manufacturers--who do all the work, and pay him a 5% royalty per sale! Another California entrepreneur developed a method for pet lovers to document details of their animal's care, feeding, identification and vaccination records, using the identical color and design as real passports. After selling the idea to a large pet store chain, over 40,000 units have been sold nationwide, at $6.00 each! A Utah woman ships packages containing a dozen chocolate chip cookies with a floral stem pushed through the middle. She started the business by advertising on in-flight airline magazines, taking orders by phone and shipping UPS. The result? $40,000 in sales the first year, with projected profits of $80,000 the next! Is There Any Reason Why You Can't Do the Same? The Kitchen Table Millionaire will show you how to use the proven, practical methods of successful entrepreneurs to build your financial independence... safely and inexpensively! The Most Explosive Wealth Building Strategies in Existence: - How to Turn Your Ideas Into Wealth - Setting up and Registering Your Home-Based Business - Invention Marketing... from A to Z - Explosive Dynamarketing Strategies - Financing: Venture Capital and Angels - Mail Order Mastery - Newspaper Classified Advertising - Self-Publishing: How to Write Your Book Using Nothing But Some Loose Leaf Paper and a Tape Recorder! - Cybermarketing on the Internet - Electronic Direct Response: The Future of Marketing - Per-Inquiry Advertising: How to Get Television, Radio and Print Ads with Little or No Cash - Free Publicity in Newspapers, Radio and TV Nationwide - Fairs and Trade Shows - 900 Numbers: More than Just Sleaze and Psychics - Auctions - Paper Power: The Explosive New Real Estate Paradigm - Financial Flourish: Keep Your Banker From Robbing You Blind - Comprehensive Resource Directory - And Much More! Whether you've been searching for the right opportunity, or want to take your existing business into the stratosphere, The Kitchen Table Millionaire gives you the practical, proven techniques that will make success inevitable. But that's not all... Order now during this exclusive offer and you'll also receive, FREE: ===> PowerSecrets! - Save up to 90% on Air Travel - 60% Savings on Five Star Hotel Rooms - How to get Incredible Deals from Price Quote Companies - Painlessly Pay Off a 30-Year Mortgage in Under 16 Years - How to get Swift Results when You've Been Ripped Off - How to Sell Your House Fast - Slash Your Insurance Costs - Lowest-Rate Credit Card Companies - PowerSecrets for Boundless Energy - Super Metabolism-Boosting Foods - Triple Your Odds of Quitting Smoking - Eliminate Hidden Toxins from Your Food - Banish that Flabby Stomach... Permanently - Get Professional Back Pain Relief Over the Telephone - And Much More! _/_/_/ Iron-Clad Guarantee _/_/_/ Your satisfaction with The Kitchen Table Millionaire is unconditionally guaranteed. There's no 30-day, 90-day or even a six month limit. If you're not 100% satisfied, simply return the book for a prompt refund. _/_/_/ About the Author _/_/_/ P.W. Cochrane is an entrepreneur, broadcaster, speaker and home-based business consultant. He has appeared on television, radio and in print throughout North America--showing people how to turn their ideas into reality while avoiding the pitfalls of misinformation and schemes. Patrick resides in La Jolla, California. This is a limited time offer, and may be withdrawn without notice! ORDER NOW! Rush your check or money order for $19.95 U.S. ($16.95 + $3.00 s&h) to: W&S Publishing 8070 La Jolla Shores Drive, Suite 243 La Jolla, CA 92037 =============== Print and Mail Order Form ===================== [ ] Yes! Enclosed is my check or money order for $19.95. Please rush THE KITCHEN TABLE MILLIONAIRE and FREE "PowerSecrets" bonus by Priority mail! I understand if I'm not 100% satisfied I may return the book any time for a full refund--there is no 30, 60 or even 90-day limit. Name ____________________________________________ Address __________________________________________ City ______________________ State ______ Zip _________ *CA residents please add 8.25% sales tax. **All U.S. orders promptly shipped by Priority mail. =========================================================== From xjlr56xcz at 24540.com Thu Oct 9 16:50:24 1997 From: xjlr56xcz at 24540.com (xjlr56xcz at 24540.com) Date: Thu, 9 Oct 1997 16:50:24 -0700 (PDT) Subject: . Message-ID: <> Turn Your Ideas, Interests or Hobbies into a Lifetime Income, with... ******* THE KITCHEN TABLE MILLIONAIRE ******* Special LIMITED TIME OFFER Includes "PowerSecrets"... FREE! _/_/_/ The Secret of Financial Freedom _/_/_/ Find something you love so much you'd do it for nothing, develop and market it, and the world will shower you with wealth! It starts with "The Four D's..." Dream, Discover, Develop, and Do it!" THE KITCHEN TABLE MILLIONAIRE provides all the tools you need! Home-based business is a $380 billion industry. Ironically, the same technology responsible for massive layoffs and unemployment makes it possible for the average individual to run a prosperous home business out of a spare bedroom, the garage or even, yes, the kitchen table! 60,000 new home businesses are started across America every week. That's one every 11 seconds. Average income is $50,000--twice the national average employee salary. Success rates over a 3-year period are an astounding 85 percent, compared with just 20 percent in the traditional small business sector. An astonishing 90 percent of all home-based businesses succeed in the first year! The key to success is not quick-buck schemes or wild goose chases. You need proven INFORMATION and RESOURCES. The Kitchen Table Millionaire is a revolutionary new book that provides the explosive techniques necessary to develop any idea, then target the widest possible market, and effectively sell to that market. You can get started right away, in just a few hours a day, without interfering with your present job. You don't have to be lucky, well-educated or come from a rich family in order to be successful. A recent survey of successful business owners showed that only 3 percent came from wealthy families. Nearly 50% came from the ranks of the poor or lower middle class. Only 29 percent finished college. Thomas Carlyle said, "The true university of these days is a collection of books." The Kitchen Table Millionaire is the only book you need! _/_/_/ What the Experts Say _/_/_/ "This extraordinary book could change your life! It will open your eyes to opportunities that you cannot now imagine. You should get it, read it, and apply it in your life. You will be astonished!" - Brian Tracy, best-selling author of MAXIMUM ACHIEVEMENT and THE PSYCHOLOGY OF SUCCESS "The Kitchen Table Millionaire provides the nuts, bolts and ideas to help you achieve your dreams of home business success." - Carolyn Tice, Executive Editor, Home Business News; American Home Business Assoc. "This easy to use book goes much deeper than its competition--full of innovative, step-by-step advice about how to get your project off the ground." - Opportunity Magazine "Having spent most of my adult life self-employed, I've been approached with more money making opportunities than I could possibly imagine. Everyone wants to sell me "the book that can change my life forever." I've seen them all. And I've been distinctly unimpressed. But The Kitchen Table Millionaire caught my attention... and kept it. Cochrane's advice is based on tried and true strategies, that, for the most part, the experts have kept secret." - Author Anthony Trupiano, in THE BEST DEALS IN AMERICA TODAY _/_/_/ What Readers Say _/_/_/ "The book is clear, concise, and most of all, it works! After applying the strategies, my consulting business grossed $6,000 in a single month, and continues to flourish, thanks to you!" - F. J. Procopio, California "I just finished your book and thoroughly enjoyed it as well as gained a lot of new ideas and knowledge from your expertise. I have to admit my favorite line in the book is on page 7, "Even if you win the rat race, you're still a rat." - M.D. Foster "I've been suckered by more than a few schemes in my search for reliable home business information. I bought courses by Brad Richdale and Carlton Sheets, and was very disappointed with the information I received. You really do walk the talk." - K.W., Alberta, Canada "It's nice to know there is more out there than just get-rich-quick schemes and real estate hucksters. Thank you so much!" - J. Rapp, California "If you can't make money from reading this book, you can't make money." - A. Jacobellis, Texas _/_/_/ Extraordinary Success Stories of Ordinary People... Like You! _/_/_/ A San Jose, CA woman started a mobile paper shredding business off the back of a truck--and grossed $180,000 in her first year! Anthony Raissen launched BreathAsure on a single radio station--for free--and turned it into a multi-million dollar empire, virtually overnight! An 82-year old man comes up with novelty items like the "Good Egg" Award; a trophy with an egg on top, which he sells to manufacturers--who do all the work, and pay him a 5% royalty per sale! Another California entrepreneur developed a method for pet lovers to document details of their animal's care, feeding, identification and vaccination records, using the identical color and design as real passports. After selling the idea to a large pet store chain, over 40,000 units have been sold nationwide, at $6.00 each! A Utah woman ships packages containing a dozen chocolate chip cookies with a floral stem pushed through the middle. She started the business by advertising on in-flight airline magazines, taking orders by phone and shipping UPS. The result? $40,000 in sales the first year, with projected profits of $80,000 the next! Is There Any Reason Why You Can't Do the Same? The Kitchen Table Millionaire will show you how to use the proven, practical methods of successful entrepreneurs to build your financial independence... safely and inexpensively! The Most Explosive Wealth Building Strategies in Existence: - How to Turn Your Ideas Into Wealth - Setting up and Registering Your Home-Based Business - Invention Marketing... from A to Z - Explosive Dynamarketing Strategies - Financing: Venture Capital and Angels - Mail Order Mastery - Newspaper Classified Advertising - Self-Publishing: How to Write Your Book Using Nothing But Some Loose Leaf Paper and a Tape Recorder! - Cybermarketing on the Internet - Electronic Direct Response: The Future of Marketing - Per-Inquiry Advertising: How to Get Television, Radio and Print Ads with Little or No Cash - Free Publicity in Newspapers, Radio and TV Nationwide - Fairs and Trade Shows - 900 Numbers: More than Just Sleaze and Psychics - Auctions - Paper Power: The Explosive New Real Estate Paradigm - Financial Flourish: Keep Your Banker From Robbing You Blind - Comprehensive Resource Directory - And Much More! Whether you've been searching for the right opportunity, or want to take your existing business into the stratosphere, The Kitchen Table Millionaire gives you the practical, proven techniques that will make success inevitable. But that's not all... Order now during this exclusive offer and you'll also receive, FREE: ===> PowerSecrets! - Save up to 90% on Air Travel - 60% Savings on Five Star Hotel Rooms - How to get Incredible Deals from Price Quote Companies - Painlessly Pay Off a 30-Year Mortgage in Under 16 Years - How to get Swift Results when You've Been Ripped Off - How to Sell Your House Fast - Slash Your Insurance Costs - Lowest-Rate Credit Card Companies - PowerSecrets for Boundless Energy - Super Metabolism-Boosting Foods - Triple Your Odds of Quitting Smoking - Eliminate Hidden Toxins from Your Food - Banish that Flabby Stomach... Permanently - Get Professional Back Pain Relief Over the Telephone - And Much More! _/_/_/ Iron-Clad Guarantee _/_/_/ Your satisfaction with The Kitchen Table Millionaire is unconditionally guaranteed. There's no 30-day, 90-day or even a six month limit. If you're not 100% satisfied, simply return the book for a prompt refund. _/_/_/ About the Author _/_/_/ P.W. Cochrane is an entrepreneur, broadcaster, speaker and home-based business consultant. He has appeared on television, radio and in print throughout North America--showing people how to turn their ideas into reality while avoiding the pitfalls of misinformation and schemes. Patrick resides in La Jolla, California. This is a limited time offer, and may be withdrawn without notice! ORDER NOW! Rush your check or money order for $19.95 U.S. ($16.95 + $3.00 s&h) to: W&S Publishing 8070 La Jolla Shores Drive, Suite 243 La Jolla, CA 92037 =============== Print and Mail Order Form ===================== [ ] Yes! Enclosed is my check or money order for $19.95. Please rush THE KITCHEN TABLE MILLIONAIRE and FREE "PowerSecrets" bonus by Priority mail! I understand if I'm not 100% satisfied I may return the book any time for a full refund--there is no 30, 60 or even 90-day limit. Name ____________________________________________ Address __________________________________________ City ______________________ State ______ Zip _________ *CA residents please add 8.25% sales tax. **All U.S. orders promptly shipped by Priority mail. =========================================================== From xjlr56xcz at 00799.com Thu Oct 9 16:58:50 1997 From: xjlr56xcz at 00799.com (xjlr56xcz at 00799.com) Date: Thu, 9 Oct 1997 16:58:50 -0700 (PDT) Subject: . Message-ID: <> Turn Your Ideas, Interests or Hobbies into a Lifetime Income, with... ******* THE KITCHEN TABLE MILLIONAIRE ******* Special LIMITED TIME OFFER Includes "PowerSecrets"... FREE! _/_/_/ The Secret of Financial Freedom _/_/_/ Find something you love so much you'd do it for nothing, develop and market it, and the world will shower you with wealth! It starts with "The Four D's..." Dream, Discover, Develop, and Do it!" THE KITCHEN TABLE MILLIONAIRE provides all the tools you need! Home-based business is a $380 billion industry. Ironically, the same technology responsible for massive layoffs and unemployment makes it possible for the average individual to run a prosperous home business out of a spare bedroom, the garage or even, yes, the kitchen table! 60,000 new home businesses are started across America every week. That's one every 11 seconds. Average income is $50,000--twice the national average employee salary. Success rates over a 3-year period are an astounding 85 percent, compared with just 20 percent in the traditional small business sector. An astonishing 90 percent of all home-based businesses succeed in the first year! The key to success is not quick-buck schemes or wild goose chases. You need proven INFORMATION and RESOURCES. The Kitchen Table Millionaire is a revolutionary new book that provides the explosive techniques necessary to develop any idea, then target the widest possible market, and effectively sell to that market. You can get started right away, in just a few hours a day, without interfering with your present job. You don't have to be lucky, well-educated or come from a rich family in order to be successful. A recent survey of successful business owners showed that only 3 percent came from wealthy families. Nearly 50% came from the ranks of the poor or lower middle class. Only 29 percent finished college. Thomas Carlyle said, "The true university of these days is a collection of books." The Kitchen Table Millionaire is the only book you need! _/_/_/ What the Experts Say _/_/_/ "This extraordinary book could change your life! It will open your eyes to opportunities that you cannot now imagine. You should get it, read it, and apply it in your life. You will be astonished!" - Brian Tracy, best-selling author of MAXIMUM ACHIEVEMENT and THE PSYCHOLOGY OF SUCCESS "The Kitchen Table Millionaire provides the nuts, bolts and ideas to help you achieve your dreams of home business success." - Carolyn Tice, Executive Editor, Home Business News; American Home Business Assoc. "This easy to use book goes much deeper than its competition--full of innovative, step-by-step advice about how to get your project off the ground." - Opportunity Magazine "Having spent most of my adult life self-employed, I've been approached with more money making opportunities than I could possibly imagine. Everyone wants to sell me "the book that can change my life forever." I've seen them all. And I've been distinctly unimpressed. But The Kitchen Table Millionaire caught my attention... and kept it. Cochrane's advice is based on tried and true strategies, that, for the most part, the experts have kept secret." - Author Anthony Trupiano, in THE BEST DEALS IN AMERICA TODAY _/_/_/ What Readers Say _/_/_/ "The book is clear, concise, and most of all, it works! After applying the strategies, my consulting business grossed $6,000 in a single month, and continues to flourish, thanks to you!" - F. J. Procopio, California "I just finished your book and thoroughly enjoyed it as well as gained a lot of new ideas and knowledge from your expertise. I have to admit my favorite line in the book is on page 7, "Even if you win the rat race, you're still a rat." - M.D. Foster "I've been suckered by more than a few schemes in my search for reliable home business information. I bought courses by Brad Richdale and Carlton Sheets, and was very disappointed with the information I received. You really do walk the talk." - K.W., Alberta, Canada "It's nice to know there is more out there than just get-rich-quick schemes and real estate hucksters. Thank you so much!" - J. Rapp, California "If you can't make money from reading this book, you can't make money." - A. Jacobellis, Texas _/_/_/ Extraordinary Success Stories of Ordinary People... Like You! _/_/_/ A San Jose, CA woman started a mobile paper shredding business off the back of a truck--and grossed $180,000 in her first year! Anthony Raissen launched BreathAsure on a single radio station--for free--and turned it into a multi-million dollar empire, virtually overnight! An 82-year old man comes up with novelty items like the "Good Egg" Award; a trophy with an egg on top, which he sells to manufacturers--who do all the work, and pay him a 5% royalty per sale! Another California entrepreneur developed a method for pet lovers to document details of their animal's care, feeding, identification and vaccination records, using the identical color and design as real passports. After selling the idea to a large pet store chain, over 40,000 units have been sold nationwide, at $6.00 each! A Utah woman ships packages containing a dozen chocolate chip cookies with a floral stem pushed through the middle. She started the business by advertising on in-flight airline magazines, taking orders by phone and shipping UPS. The result? $40,000 in sales the first year, with projected profits of $80,000 the next! Is There Any Reason Why You Can't Do the Same? The Kitchen Table Millionaire will show you how to use the proven, practical methods of successful entrepreneurs to build your financial independence... safely and inexpensively! The Most Explosive Wealth Building Strategies in Existence: - How to Turn Your Ideas Into Wealth - Setting up and Registering Your Home-Based Business - Invention Marketing... from A to Z - Explosive Dynamarketing Strategies - Financing: Venture Capital and Angels - Mail Order Mastery - Newspaper Classified Advertising - Self-Publishing: How to Write Your Book Using Nothing But Some Loose Leaf Paper and a Tape Recorder! - Cybermarketing on the Internet - Electronic Direct Response: The Future of Marketing - Per-Inquiry Advertising: How to Get Television, Radio and Print Ads with Little or No Cash - Free Publicity in Newspapers, Radio and TV Nationwide - Fairs and Trade Shows - 900 Numbers: More than Just Sleaze and Psychics - Auctions - Paper Power: The Explosive New Real Estate Paradigm - Financial Flourish: Keep Your Banker From Robbing You Blind - Comprehensive Resource Directory - And Much More! Whether you've been searching for the right opportunity, or want to take your existing business into the stratosphere, The Kitchen Table Millionaire gives you the practical, proven techniques that will make success inevitable. But that's not all... Order now during this exclusive offer and you'll also receive, FREE: ===> PowerSecrets! - Save up to 90% on Air Travel - 60% Savings on Five Star Hotel Rooms - How to get Incredible Deals from Price Quote Companies - Painlessly Pay Off a 30-Year Mortgage in Under 16 Years - How to get Swift Results when You've Been Ripped Off - How to Sell Your House Fast - Slash Your Insurance Costs - Lowest-Rate Credit Card Companies - PowerSecrets for Boundless Energy - Super Metabolism-Boosting Foods - Triple Your Odds of Quitting Smoking - Eliminate Hidden Toxins from Your Food - Banish that Flabby Stomach... Permanently - Get Professional Back Pain Relief Over the Telephone - And Much More! _/_/_/ Iron-Clad Guarantee _/_/_/ Your satisfaction with The Kitchen Table Millionaire is unconditionally guaranteed. There's no 30-day, 90-day or even a six month limit. If you're not 100% satisfied, simply return the book for a prompt refund. _/_/_/ About the Author _/_/_/ P.W. Cochrane is an entrepreneur, broadcaster, speaker and home-based business consultant. He has appeared on television, radio and in print throughout North America--showing people how to turn their ideas into reality while avoiding the pitfalls of misinformation and schemes. Patrick resides in La Jolla, California. This is a limited time offer, and may be withdrawn without notice! ORDER NOW! Rush your check or money order for $19.95 U.S. ($16.95 + $3.00 s&h) to: W&S Publishing 8070 La Jolla Shores Drive, Suite 243 La Jolla, CA 92037 =============== Print and Mail Order Form ===================== [ ] Yes! Enclosed is my check or money order for $19.95. Please rush THE KITCHEN TABLE MILLIONAIRE and FREE "PowerSecrets" bonus by Priority mail! I understand if I'm not 100% satisfied I may return the book any time for a full refund--there is no 30, 60 or even 90-day limit. Name ____________________________________________ Address __________________________________________ City ______________________ State ______ Zip _________ *CA residents please add 8.25% sales tax. **All U.S. orders promptly shipped by Priority mail. =========================================================== From xjlr56xcz at 00799.com Thu Oct 9 16:58:50 1997 From: xjlr56xcz at 00799.com (xjlr56xcz at 00799.com) Date: Thu, 9 Oct 1997 16:58:50 -0700 (PDT) Subject: . Message-ID: <> Turn Your Ideas, Interests or Hobbies into a Lifetime Income, with... ******* THE KITCHEN TABLE MILLIONAIRE ******* Special LIMITED TIME OFFER Includes "PowerSecrets"... FREE! _/_/_/ The Secret of Financial Freedom _/_/_/ Find something you love so much you'd do it for nothing, develop and market it, and the world will shower you with wealth! It starts with "The Four D's..." Dream, Discover, Develop, and Do it!" THE KITCHEN TABLE MILLIONAIRE provides all the tools you need! Home-based business is a $380 billion industry. Ironically, the same technology responsible for massive layoffs and unemployment makes it possible for the average individual to run a prosperous home business out of a spare bedroom, the garage or even, yes, the kitchen table! 60,000 new home businesses are started across America every week. That's one every 11 seconds. Average income is $50,000--twice the national average employee salary. Success rates over a 3-year period are an astounding 85 percent, compared with just 20 percent in the traditional small business sector. An astonishing 90 percent of all home-based businesses succeed in the first year! The key to success is not quick-buck schemes or wild goose chases. You need proven INFORMATION and RESOURCES. The Kitchen Table Millionaire is a revolutionary new book that provides the explosive techniques necessary to develop any idea, then target the widest possible market, and effectively sell to that market. You can get started right away, in just a few hours a day, without interfering with your present job. You don't have to be lucky, well-educated or come from a rich family in order to be successful. A recent survey of successful business owners showed that only 3 percent came from wealthy families. Nearly 50% came from the ranks of the poor or lower middle class. Only 29 percent finished college. Thomas Carlyle said, "The true university of these days is a collection of books." The Kitchen Table Millionaire is the only book you need! _/_/_/ What the Experts Say _/_/_/ "This extraordinary book could change your life! It will open your eyes to opportunities that you cannot now imagine. You should get it, read it, and apply it in your life. You will be astonished!" - Brian Tracy, best-selling author of MAXIMUM ACHIEVEMENT and THE PSYCHOLOGY OF SUCCESS "The Kitchen Table Millionaire provides the nuts, bolts and ideas to help you achieve your dreams of home business success." - Carolyn Tice, Executive Editor, Home Business News; American Home Business Assoc. "This easy to use book goes much deeper than its competition--full of innovative, step-by-step advice about how to get your project off the ground." - Opportunity Magazine "Having spent most of my adult life self-employed, I've been approached with more money making opportunities than I could possibly imagine. Everyone wants to sell me "the book that can change my life forever." I've seen them all. And I've been distinctly unimpressed. But The Kitchen Table Millionaire caught my attention... and kept it. Cochrane's advice is based on tried and true strategies, that, for the most part, the experts have kept secret." - Author Anthony Trupiano, in THE BEST DEALS IN AMERICA TODAY _/_/_/ What Readers Say _/_/_/ "The book is clear, concise, and most of all, it works! After applying the strategies, my consulting business grossed $6,000 in a single month, and continues to flourish, thanks to you!" - F. J. Procopio, California "I just finished your book and thoroughly enjoyed it as well as gained a lot of new ideas and knowledge from your expertise. I have to admit my favorite line in the book is on page 7, "Even if you win the rat race, you're still a rat." - M.D. Foster "I've been suckered by more than a few schemes in my search for reliable home business information. I bought courses by Brad Richdale and Carlton Sheets, and was very disappointed with the information I received. You really do walk the talk." - K.W., Alberta, Canada "It's nice to know there is more out there than just get-rich-quick schemes and real estate hucksters. Thank you so much!" - J. Rapp, California "If you can't make money from reading this book, you can't make money." - A. Jacobellis, Texas _/_/_/ Extraordinary Success Stories of Ordinary People... Like You! _/_/_/ A San Jose, CA woman started a mobile paper shredding business off the back of a truck--and grossed $180,000 in her first year! Anthony Raissen launched BreathAsure on a single radio station--for free--and turned it into a multi-million dollar empire, virtually overnight! An 82-year old man comes up with novelty items like the "Good Egg" Award; a trophy with an egg on top, which he sells to manufacturers--who do all the work, and pay him a 5% royalty per sale! Another California entrepreneur developed a method for pet lovers to document details of their animal's care, feeding, identification and vaccination records, using the identical color and design as real passports. After selling the idea to a large pet store chain, over 40,000 units have been sold nationwide, at $6.00 each! A Utah woman ships packages containing a dozen chocolate chip cookies with a floral stem pushed through the middle. She started the business by advertising on in-flight airline magazines, taking orders by phone and shipping UPS. The result? $40,000 in sales the first year, with projected profits of $80,000 the next! Is There Any Reason Why You Can't Do the Same? The Kitchen Table Millionaire will show you how to use the proven, practical methods of successful entrepreneurs to build your financial independence... safely and inexpensively! The Most Explosive Wealth Building Strategies in Existence: - How to Turn Your Ideas Into Wealth - Setting up and Registering Your Home-Based Business - Invention Marketing... from A to Z - Explosive Dynamarketing Strategies - Financing: Venture Capital and Angels - Mail Order Mastery - Newspaper Classified Advertising - Self-Publishing: How to Write Your Book Using Nothing But Some Loose Leaf Paper and a Tape Recorder! - Cybermarketing on the Internet - Electronic Direct Response: The Future of Marketing - Per-Inquiry Advertising: How to Get Television, Radio and Print Ads with Little or No Cash - Free Publicity in Newspapers, Radio and TV Nationwide - Fairs and Trade Shows - 900 Numbers: More than Just Sleaze and Psychics - Auctions - Paper Power: The Explosive New Real Estate Paradigm - Financial Flourish: Keep Your Banker From Robbing You Blind - Comprehensive Resource Directory - And Much More! Whether you've been searching for the right opportunity, or want to take your existing business into the stratosphere, The Kitchen Table Millionaire gives you the practical, proven techniques that will make success inevitable. But that's not all... Order now during this exclusive offer and you'll also receive, FREE: ===> PowerSecrets! - Save up to 90% on Air Travel - 60% Savings on Five Star Hotel Rooms - How to get Incredible Deals from Price Quote Companies - Painlessly Pay Off a 30-Year Mortgage in Under 16 Years - How to get Swift Results when You've Been Ripped Off - How to Sell Your House Fast - Slash Your Insurance Costs - Lowest-Rate Credit Card Companies - PowerSecrets for Boundless Energy - Super Metabolism-Boosting Foods - Triple Your Odds of Quitting Smoking - Eliminate Hidden Toxins from Your Food - Banish that Flabby Stomach... Permanently - Get Professional Back Pain Relief Over the Telephone - And Much More! _/_/_/ Iron-Clad Guarantee _/_/_/ Your satisfaction with The Kitchen Table Millionaire is unconditionally guaranteed. There's no 30-day, 90-day or even a six month limit. If you're not 100% satisfied, simply return the book for a prompt refund. _/_/_/ About the Author _/_/_/ P.W. Cochrane is an entrepreneur, broadcaster, speaker and home-based business consultant. He has appeared on television, radio and in print throughout North America--showing people how to turn their ideas into reality while avoiding the pitfalls of misinformation and schemes. Patrick resides in La Jolla, California. This is a limited time offer, and may be withdrawn without notice! ORDER NOW! Rush your check or money order for $19.95 U.S. ($16.95 + $3.00 s&h) to: W&S Publishing 8070 La Jolla Shores Drive, Suite 243 La Jolla, CA 92037 =============== Print and Mail Order Form ===================== [ ] Yes! Enclosed is my check or money order for $19.95. Please rush THE KITCHEN TABLE MILLIONAIRE and FREE "PowerSecrets" bonus by Priority mail! I understand if I'm not 100% satisfied I may return the book any time for a full refund--there is no 30, 60 or even 90-day limit. Name ____________________________________________ Address __________________________________________ City ______________________ State ______ Zip _________ *CA residents please add 8.25% sales tax. **All U.S. orders promptly shipped by Priority mail. =========================================================== From aba at dcs.ex.ac.uk Thu Oct 9 02:07:07 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Thu, 9 Oct 1997 17:07:07 +0800 Subject: anonymous poster quality up Message-ID: <199710090852.JAA00726@server.test.net> I notice that the quality of anonymous submissions to the discussion here on cypherpunks has increased markedly lately. I can see a couple of reasons why this might be: Monty Cantsin seems to write consistently good stuff, Tim May announced he may be using some nyms, and we have this big argument with PGP Inc where their employees may feel pressure not to speak out of line. One suspects that some of the anonymous contributors exploring the issues are actually PGP employees:-) Regardless of who the new anonymous contributors are, it's nice to see quality anonymous posts, keep it up! Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710090848.JAA00719@server.test.net> Anonymous writes: > [7 cryptographers report says] > > Key recoverability, to the extent it has a private-sector > application at all, is useful only for the keys used to protect > irreproducible stored data. There is basically no business model > for other uses, as discussed below. Right. > Encrypted electronic mail is an interesting special case, in that it > has the characteristics of both communication and storage. Whether key > recovery is useful to the user of a secure E-mail system depends on > design of the particular system. I was arguing for designing the system so that as much of the storage functionality as possible is accomplished with separate storage keys. > They say that key recovery is not appropriate for transient keys > used during a communication session. However, email is a special > case, having characteristics of both communication and storage. In > some systems, email may be archived for long periods of time in the > same format that it was received. For such systems there is a > business case for key recovery in email. So the solution is to engineer your email system to re-encrypt email to a storage key before archiving. You lose a couple of functionalities over a true key escrow system, which a previous anonymous (don't know if you're the same anonymous) identified well: - if someone leaves / dies unexpectedly you can't decrypt email in their mail box. - if the employee who is the crypto recipient refuses to decrypt the company won't be able to decrypt either. However there are a couple of reasons why this isn't such a big deal, and why people ought to get used to it. i) How often do people die unexpectedly -- if this does happen the company faces other similar problems, perhaps said employee had a few things on a `to do' list stored in only in his head. Perhaps he has contacts the company doesn't have recorded. The company will have to do some extra work reorganising anyway. ii) You can't avoid above problems if you're using forward secrecy; you should be using forward secrecy for security reasons, so you'd better get used ot the side-effects. iii) You can minimise the negative effects if you ensure that the people sending you email also have a matching system which ensures that `official' sent email is all backed but up encrypted with a storage key. Then they _will_ have the email to resend. This seems likely in any event, if the importance of the email exchanges is so important that the company wants to archive it, the sending company is likely to also. If the email gets lost in transit you'll need a copy to resend already. iv) It's worth the minor extra inconvenience because you can then plug in forward secrecy, and you thereby have a double stance against GAK: no key escrow, and no long term private encryption keys as fat targets. As a plus it's a security improvement also. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 WE WILL GIVE YOU A 900# FREE!! The average income for a 900# manager is $17,500. per month. A 900# broker can earn thousands per week! First months potential earnings $10,000 and more! This is a legitimate offer with guaranteed results. Business is booming and we would like very much to help you get your share of this fantastic opportunity. We also provide bulk friendly web hosting at a price you won't believe, a free webpage, plus to much to mention here. Don't wait. Get your 900 number while they're still free. Check out the website now! Http://www.mallmaster.com/merchant/900/index.html click here to visit now I am sorry if you did not wish to receive this info. Sorry for the intrusion. This will be the only msg. you will receive. Thank You. From tm at dev.null Thu Oct 9 03:05:07 1997 From: tm at dev.null (TruthMonger) Date: Thu, 9 Oct 1997 18:05:07 +0800 Subject: Where is _my_ blowjob? Message-ID: <343C739A.72AA@dev.null> Visited the CNN website earlier. I wasn't at all surprised to see the factual errors and pandering to government spoon feeders for the main sources of many CNN stories. After all, when Captial Hill'$ bottom feeders give away fify billion dollars worth of valuable digital airwave bandwidth, I expect them to ask for a few extras thrown in with the usual bribes and blow-jobs. So it was no great surprise to find CNN still reporting the LIE that the child-rapist/murderer in New Jersey had been a victim of a sexual predator he had met on the InterNet, despite the fact that the news services who *aren't* part of the fifty billion dollar giveaway of taxpayer-citizen's public resources have been reporting the FACTS for quite some time now. Seems the guy bopping the murderer met him on a 1-900 line. Should I hold my breath waiting for the loud calls by reporters and legislators for strict new laws taking away citizens' rights to free speech on the phone systems of America, or would that be dangerous to my health? I know that CNN also has to fill in a few spaces between government spoon-fed mind-control propaganda being fed to the citizens by the recipients of the public largess, so that CNN is forced to throw in a few quickie references to some other websites and information other than that which comes directly out of the assholes of Lying Fuck Freeh and Nazi Cunt Reno, such as: Crime on the Superhighway http://www.geocities.com/CapitolHill/6647/ Investigator Lynn Zwicke However, did somebody on the staff get a blow-job in return for putting a supposed NEWS pointer to this schmuck's ADVERTISEMENT for his or her PI business? I certainly hope that this is the case, since someone should have gotten *something* for opening CNN up to a lawsuit for providing a pointer to an incompetent schmuck who is spreading extremely bad FUD (fear, uncertainty, disinformation) in regard to child abuse and abusers, in order to turn a quick buck. I imagine that CNN has some fine-print disclaimer somewhere, explaining that they are not responsible for the victims of incompetent and perhaps unlicensed schmucks that CNN blesses with their own reputation capital when directing people to supposed news/information sites, but I doubt that the parent of an abused child or a falsely accused child abuse victim is going to be to impressed, nonetheless, with CNN's lack of integrity in not spending the time, effort and expense needed to make certain that they are not throwing their trusting readers into the mouths of waiting hyenas. I'm still waiting for the CNN story which replies to the DoJ and FBI *HANDOUTS* detailing their list of 4,000 suspected pedophiles, with a question as to whether some of the 800 LEA's present at the murder of the religious group in Waco perhaps didn't have some extra time on their hands that might have been better spent investigating all of these alleged pedophiles, rather than pushing and shoving each other to get pictures of burning children. OK, I'm holding my breath, starting........NOW! TruthMonger From whgiii at invweb.net Thu Oct 9 03:39:28 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 9 Oct 1997 18:39:28 +0800 Subject: In-Reply-To: <19971009023118.27488.qmail@hotmail.com> Message-ID: <199710091026.GAA29658@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <19971009023118.27488.qmail at hotmail.com>, on 10/08/97 at 07, "THE DUKE" said: >None of you have my pity. None of want or need it. >I spit upon you all children. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNDyy1I9Co1n+aLhhAQFUFQQAmCQkhOPmzCnbuER0sHJIRFGWFoCW/BSD M4+o9l3PxHkUu1dTpLbQ/781f+KwcwxHG53lmUQ+JSTluraB2FUk13XnPpN0l3Kv Uo8C40izI+ZjOAaEKuEvTuf061m4gff/5ftuxHwGszfzRjNJa5VQZRnwREdoQ2l0 9cL3mnJbQSM= =WmjX -----END PGP SIGNATURE----- From nobody at REPLAY.COM Thu Oct 9 04:20:31 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 9 Oct 1997 19:20:31 +0800 Subject: No Subject Message-ID: <199710091106.NAA23241@basement.replay.com> "THE DUKE" writes: >The government is not planning to murder everyone. The Government is >not keeping aliens in the 'basement'. The X-Files are not real. The >government is not murdering public figures, and setting-up pore, >civilian saps to take the fall. The only thing that the Government is >doing is running our country the best it can. The Government routinely lies to the citizens it allegedly represents. It infringes on the rights guaranteed those citizens by the Constitution. The FCC can't allocate radio bandwidth efficiently, byt they seem to have no problem telling Howard Stern not to say "vagina" on the radio. I could go on and on, ad nauseam, but you get the idea. If this is their best effort, they should be horsewhipped, tarred, feathered, and run out of town on a rail. Unfortunately, the brain-dead populace continues to get hypnotized by their Pied-Piper tales and makes the biennial Bataan death march to the polls (nice double entendre there, n'est-ce pas?) to choose between Picto Bold and Picto Light, the two candidates in their district who have a single common goal: to get elected to an office where they can get a firm lip clamp on the teat of the American taxpayer, and skim off the lobbyists in their spare time. Neither one really gives a flying fuck about the people they represent; it's the power they want. >All you are doing for the Government, is finding fault and conspiracy in >every action. You are destroying the Government, and are thereby >destroying America. Why would I want to do anything for the Government? I already pay them a tithe (oh, sure, you can call it "income tax") to stay the fuck away from me, by and large. As soon as someone shows up at my door and says "Hi, I'm here from the Government to help you," I'm running for my life. That kind of "help" usually results in gunfire, or dependence on further Government subidies, or having mopey Government types hang around to explain to me that I should use water-based varnish so I don't wreck the ozone layer. >None of you have my pity. I spit upon you all. None of us need your pity. And wipe your chin when you're done. And say "hi" to Mr. Freeh next time you see him. Of course, it won't be his face that'll be at eye level. . . AngerMonger From reiter at research.att.com Thu Oct 9 04:21:13 1997 From: reiter at research.att.com (Mike Reiter) Date: Thu, 9 Oct 1997 19:21:13 +0800 Subject: 1998 IEEE Symposium on Security and Privacy Message-ID: <199710091102.HAA06297@arran.research.att.com> The call-for-papers for the 1998 IEEE Symposium on Security and Privacy can be found at http://www.research.att.com/~reiter/oakland98.html - Mike From phelix at vallnet.com Thu Oct 9 04:45:35 1997 From: phelix at vallnet.com (phelix at vallnet.com) Date: Thu, 9 Oct 1997 19:45:35 +0800 Subject: Internet Via Electric Lines? (fwd) Message-ID: <34458bd4.96061987@128.2.84.191> On 9 Oct 1997 02:25:13 -0500, "William H. Geiger III" wrote: > >-----BEGIN PGP SIGNED MESSAGE----- > >In <199710081234.HAA11747 at einstein.ssz.com>, on 10/08/97 > at 07, Jim Choate said: > >>Forwarded message: > >>> From: "William H. Geiger III" >>> Date: Wed, 08 Oct 97 01:28:42 -0500 >>> Subject: Re: Internet Via Electric Lines? > >>> This is nothing new. > >>At least late 70's. > >>> I think it was GE that several years ago created phone extensions that you >>> plugged into your power outlets, no need to run wire to put in an extra >>> outlet. I believe that X-10 uses this same principle for computer control >>> of household appliances. >>> >>> Not to mention data leakage through power lines is an issue long reconized >>> by the TEMPEST crowd. >>> >>> The trick here seems to be in routing the data. How do you get data on the >>> power grid routed to the location that you want it to go?? > >>The trick with X-10 is to stay away from transformers as the signal won't >>go through them effectively. This ends any dreams of sending data to your >>neighbor, the signal won't go through your power meter. > >This seems to be a Goodthing(TM) for residential X-10 as it would seem to >take care of a lot of security issues by effectively isolating each home >from others who may be running the same system. > >Has anyone researched the security issues around X-10? Is the Transformer >isolation good enough protection from a dedicated attack (as opposed to >accidental signal leakage)? Are their alternative routes for transmitting >the FM signal (Airwaves) that the X-10 devices would pick up?? Do any of >the current X-10 devices use signal authentication/verification? > X-10? security? hehehe... that's good for a laugh. There is no security whatsover in X-10. If your neighbor knows the addresses of your X-10 units and his power comes off the same transformer as yours, he can easily turn your lights on and off. The only thing protecting you (besides obscurity) is the transformer that isolates your power line from others. X-10 doesn't use any type of FM signal. It simply transmits bits in the zeros of the ac power 'signal'. It only get 120bps and most signals are repeated 3 times (even with that, the signal sometimes gets lost in the line noise), so really you only get 40bps. A command consists simply of [address],[command]. The address is 8 bits long, I dont' remember how long the command is. In X-10 speak, and address is [A-P] [1-16]. The commands are on,off,bright,dim,all-lights-on, and a few others. There's no security, no encryption, not even collision detection when using more than one transmitter. Now, there a new system called cebus, but it's over 10X more expensive. I don't know too much about it. -- Phelix From mixmaster at remail.obscura.com Thu Oct 9 04:50:56 1997 From: mixmaster at remail.obscura.com (Mix) Date: Thu, 9 Oct 1997 19:50:56 +0800 Subject: No Subject Message-ID: <199710091130.EAA09395@sirius.infonex.com> The main difference between Timothy May and shit is that shit smells better. \o _o o o \o |o |o >> /\/ o__ _o o/ Timothy May | | /| |\ | / /|/ \|o o\ | \ \ | | | << << << | << < \ From 15159495 at 21579.com.net.pk Thu Oct 9 20:00:17 1997 From: 15159495 at 21579.com.net.pk (15159495 at 21579.com.net.pk) Date: Thu, 9 Oct 1997 20:00:17 -0700 (PDT) Subject: Hi from the Girls Message-ID: <6730057729034.43309@fish.net> Notice: This is an adult site. Access is limited to persons over 18. If you are offended by things of a sexual nature DO NOT ENTER!!! But if you want to>>> Find the youngest, hottest girls on the net!!! Click on the highlighted text: http://youngnlusty.com From jya at pipeline.com Thu Oct 9 05:13:32 1997 From: jya at pipeline.com (John Young) Date: Thu, 9 Oct 1997 20:13:32 +0800 Subject: EU Rejects GAK Message-ID: <1.5.4.32.19971009115219.006ac38c@pop.pipeline.com> 9 October 1997 Source: The New York Times, October 9, 1997, p. D4 Europeans Reject U.S. Plan On Electronic Cryptography Threats to Privacy and Commerce Are Cited By Edmund L. Andrews Frankfurt, Oct. 8 -- The European Commission has rejected proposals by the United States aimed at insuring that police agencies can crack coded messages over telephone and computer networks. In a lengthy report released today, the European Commission said the American approach could threaten privacy and stifle the growth of electronic commerce and that it might simply be ineffective. The report appears to all but doom efforts by the Clinton Administration and the Federal Bureau of Investigation to establish a global system in which people who use cryptography would have to deposit a "key" for unlocking their codes with an independent outside organization. As envisioned, the police or intelligence agents would be able to use this key once they got court approval to carry out a wiretap. The plan has been vigorously opposed by the computer industry, which fears that it would jeopardize sales to foreign customers. Because of the Internet's borderless nature, American officials have long acknowledged that their plan is workable only if most other countries adopt similar systems. If not, people could simply route their communications through countries with no restrictions. The White House had already run into heavy opposition from civil rights groups, the computer industry and Congressional Republicans. And earlier this year, the United States failed to muster any support for its plan from the Organization for Economic Cooperation and Development, a consortium backed by more than 40 countries. But the European Commission's blunt opposition, reported today in The Wall Street Journal, went considerably further, raising a slew of objections to "key recovery" and "key escrow," systems. Among them were these: + Hackers could find new ways to breach security." Inevitably, any key access scheme introduces additional ways to break into a cryptographic system," the report said. + The systems could weaken European data-privacy laws. "Any regulation hindering the use of encryption products," the report said, "hinders the secure and free flow of personal information." + Even with a "key escrow" or "key recovery" system, criminals cannot be entirely prevented from using strong encryption. More broadly, the European Commission said, any kind of key-based system could jeopardize the rise of electronic commerce. "If citizens and companies have to fear that their communication and transactions are monitored with the help of key access or similar schemes," the report said, "they may prefer remaining in the anonymous off-line world." American officials did not disguise their disappointment, and challenged the Europeans to come up with better alternatives. "I am a little surprised," said William Reinsch, Deputy Secretary of Commerce in charge of export administration. "My question to the European Commission is, where do they think the market is going? Our sense is that corporations engaged in electronic commerce want key recovery in some form, because they want to recover their own records and to monitor their own employees." Beyond high-minded policy issues, European officials quietly acknowledge that they have political and economic concerns. For one thing, several countries do not like the idea of deferring to an American system that might allow American companies to dominate the next generation of security products. The German Government, meanwhile, is worried that American authorities might have improper access to data on German users -- possibly violating Germany's tough new laws on data protection. But the European Union is far from united. Britain has generally sided with the United States in supporting an international system for regulating data encryption. Indeed, the European Commission remained vague about what alternatives to the American system it might actually favor, nor does the report attempt to block member countries from setting up key-based systems if they want to. American computer and software companies greeted the European policy declaration as a victory. "Even the hard-line Governments, the U.S. and the United Kingdom, have said that any cryptography restrictions have to be internationally coordinated because otherwise you can just download material from another country," said Chris Kuner, a lawyer in Frankfurt who represents Netscape Communications and other networking companies in Europe. "This shows that Europe does not agree with the idea of mandatory key recovery. This idea that is the only possible regulatory framework for the world has been clearly rejected." [End] From ravage at ssz.com Thu Oct 9 05:46:47 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 9 Oct 1997 20:46:47 +0800 Subject: 6502 ML programming (fwd) Message-ID: <199710091302.IAA17486@einstein.ssz.com> Forwarded message: > Date: Thu, 9 Oct 1997 02:32:27 -0400 > From: ghio at temp0133.myriad.ml.org (Matthew Ghio) > Subject: Re: 6502 ML programming > Jim Choate wrote: > > > > There in no 'DATA' construct in 6502 assembly. > > > > This is some sort of macro that either the assembler or programmer > > defined. All official Rockwell/Commodore [1] 6502 assembly mnemonics are > > three letter. > > True, but most assemblers would let you insert static data into the object > file using various pseudo-ops like that. > > > > Idealy a jump table was created that had the various target addresses for > > your routines. > > Oh, those were fun to debug too... > > > > The most efficient way to store data in 6502 is to put it in the first 256 > > bytes of ram, then it could be called in no more than 2 clock cycles. > > Actually that took three cycles. One to fetch the opcode, one to fetch the > target address, and one to fetch the data byte. If you wanted to do it in > two cycles, you had to write the data into the operand of the instruction > that loaded it (self-modifying code). Wow, we actualy agree on all points...that has to be a first. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From rah at shipwright.com Thu Oct 9 07:10:48 1997 From: rah at shipwright.com (Robert Hettinga) Date: Thu, 9 Oct 1997 22:10:48 +0800 Subject: Component-based Commerce: CCS Lunch Talk Friday, October 17 Message-ID: --- begin forwarded text Date: Thu, 9 Oct 1997 08:22:11 -0400 (EDT) From: Chris Wysopal To: dcsb at ai.mit.edu Subject: Component-based Commerce: CCS Lunch Talk Friday, October 17 MIME-Version: 1.0 Sender: bounce-dcsb at ai.mit.edu Precedence: bulk Reply-To: Chris Wysopal From: Roanne Neuwirth [SMTP:roanne at MIT.EDU] Sent: Wednesday, October 08, 1997 10:27 AM To: ccs-lunch at MIT.EDU Subject: Component-based Commerce: CCS Lunch Talk Friday, October 17 Greetings! This is to announce a CCS Lunch Talk, Friday, October 17, from 12-1:30 pm in E40-170. Bring your lunch and join us for an interesting session. We are pleased to welcome Jay M. Tenenbaum, Chairman of CommerceNet to CCS. He will speak on component-based commerce and an exciting new project. See you there!! Component-based Commerce Jay M. Tenenbaum Chairman, CommerceNet Digital anarchy is threatening the explosive growth of Internet commerce. Proprietary applications and platforms cannot communicate above the level of browsers. Websites are difficult to locate and incomprehensible to software agents. Such limitations prevent online businesses from leveraging each other's services, resulting in closed markets and trading communities. In response, CommerceNet has launched an ambitious object-oriented interoperability framework initiative called eCo System. eCo treats all commerce services on the Web as business objects. It provides the infrastructure (a Common Business Language, standardized metadata and middleware) for combining them in novel ways to build virtual companies, markets, and trading communities. eCo complements commercial ecommerce platforms, enabling them to communicate with one another, thus expanding the market for all. eCo System promises to transform the Internet into a massive economy of online services, all linked through a common framework. Companies will be able to encapsulate their services (e.g., shipping, banking) as eCo objects, that customers can seemlessly integrate into their own business processes. Entrepreneurs will be able to create innovative value-added services that compare, aggregate, integrate, and translate data across companies -- finding the best price or the closest supplier for example. This potential for instant partnering and for rapidly experimenting with new business concepts could spark an explosion of entrepreneurial activity rivaling that of the web itself. Based on market analyses by Forrester and IDC, CommerceNet projects a $1 Billion market for eCo-enabled Internet commerce building blocks and tools by the year 2000. The Internet commerce transactions enabled by these components could exceed $100 Billion. The talk will cover eCo System from both a technology and business perspective. Dr. Jay M. Tenenbaum (BS MIT '64; Ph.D. Stanford '71) is widely acknowledged as a founder of Internet commerce and its leading visionary. In 1990 he started EIT, the company that pioneered the enabling security and payment infrastructure. In 1994 he formed CommerceNet, the leading industry association for Internet commerce with nearly 600 corporate members worldwide. Dr. Tenenbaum has been a consulting Professor of Computer Science at Stanford University and currently serves on the boards of six Internet start ups. For help on using this list (especially unsubscribing), send a message to "dcsb-request at ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: From schneier at counterpane.com Thu Oct 9 07:26:34 1997 From: schneier at counterpane.com (Bruce Schneier) Date: Thu, 9 Oct 1997 22:26:34 +0800 Subject: What's really in PGP 5.5? In-Reply-To: Message-ID: At 4:33 PM -0500 10/8/97, Jon Callas wrote: >At 08:48 PM 10/7/97 -0500, Bruce Schneier wrote: > Jon Calis wrote: > >Also, we have three encryption products: PGP freeware, PGP for Personal > >Privacy, and PGP for Business Security. Corporate Message Recovery is > >included *only* in PGP for Business Security. It is not, and never will > >be, in either the freeware or the Personal Privacy product. > > If this is true (and I have no reason to believe it isn't), then why is the > key escrow code written (although not turned on) in the source code for 5.0 > that was posted internationally from PGP? > >Bruce, I understand that you don't like any form of data recovery, but >there is no key escrow in PGP. Perhaps we should talk about this on the phone. Sure. Please call. Your CEO called me on Monday, and he tried to tell me that it wasn't key escrow because you weren't saving copies of any keys. If you're just going to call to split those sorts of hairs, don't bother. I'm interested in hearing how your key escrow system works; I've already been told why you put it in. Bruce ********************************************************************** Bruce Schneier, President, Counterpane Systems Phone: 612-823-1098 101 E Minnehaha Parkway, Minneapolis,MN 55419 Fax: 612-823-1590 http://www.counterpane.com From randerso at ece.eng.wayne.edu Thu Oct 9 07:32:14 1997 From: randerso at ece.eng.wayne.edu (Ryan Anderson) Date: Thu, 9 Oct 1997 22:32:14 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <3.0.2.32.19971008090442.0070305c@ece.eng.wayne.edu> Message-ID: <3.0.2.32.19971009102535.006b5a50@ece.eng.wayne.edu> At 08:55 AM 10/8/97 -0700, Tim May wrote: >>Well, any company giving stock advice (and governed by SEC rules on stock >>tips, etc.) is already require to have all outgoing mail approved (e-mail and >>snail), so does it matter if they record it or not? >> > >Could you give me some cites for this rule? > >My own stock broker seems to be sending me stuff on the spur of the moment, >so unless he has a government agent sitting in his office approving these >notes he sends me, there is no "outgoing mail approved (e-mail and snail)" >situation. I believe I read that in Infoworld or ComputerWorld (within the last month, maybe 2) The rules that the SEC had for snail mail (for brokers/traders I believe), in that all mail had to be approved by someone in the company now apply to e-mail. I don't save my copies of Infoworld or Computeworld anymore (too much paper) so I can't look it up easily for you. >(They can try to get a warrant if they think I've violated the insider >trading or other securities laws. But no "approval" is needed, nor of >course is any escrow of keys required.) Oh, I see where I was a bit unclear in my original statement. This rule only applies to the brokerage firms (I think I've got the right terms there, if not, the general idea should be clear) >(When I was Intel, we didn't have crypto. But if we did, the real concern >would be encryption of lab notebooks, documents on disk, etc., not my >communications with outsiders. These are the files which would vanish were >I to be hit by a truck. As we have discussed many times, how does >escrowing the _channel_ key (Alice sending to Bob) solve the "hit by a >truck" problem?) What, you don't encrypt your lab book to yourself (and sign it) with your public key? Easier than remembering another symmetric key, and allows you to keep a the recovery key in use. ----------------------------------------------------------------------- Ryan Anderson - "Who knows, even the horse might sing" Wayne State University - CULMA "May you live in interesting times.." randerso at ece.eng.wayne.edu PGP Fingerprint - 7E 8E C6 54 96 AC D9 57 E4 F8 AE 9C 10 7E 78 C9 ----------------------------------------------------------------------- From endeavor at bizmax.com Thu Oct 9 22:44:50 1997 From: endeavor at bizmax.com (endeavor at bizmax.com) Date: Thu, 9 Oct 1997 22:44:50 -0700 (PDT) Subject: ANY OF YOUR ANSWERS YES? Message-ID: <199710100543.WAA21509@mailgate32> Hello, I read your profile and thought that the following would be of interest to you. You are not on a mailing list so if this does not interest you there is no need to reply. Any of Your Answers Yes? Want to: >Legally slash your business/personal taxes drastically? >Protect any & all assets from any form of judgement? >Learn how to preserve your personal privacy? >Create a 6 figure income in the next 4-6 months? Any of Your Answers No? >Do you know how to make your "nest egg" work 3-5 times harder for you? >Do you know how to set up off shore trusts and protect your owned property from liens & levies? >Can you legally shelter all assets from all Taxes? Find out more and learn how to accomplish all of these by calling: 1-800-497-1799 (24 hr. recorded message) From tcmay at got.net Thu Oct 9 08:54:54 1997 From: tcmay at got.net (Tim May) Date: Thu, 9 Oct 1997 23:54:54 +0800 Subject: anonymous poster quality up In-Reply-To: <199710090852.JAA00726@server.test.net> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At 1:52 AM -0700 10/9/97, Adam Back wrote: >I notice that the quality of anonymous submissions to the discussion >here on cypherpunks has increased markedly lately. > >I can see a couple of reasons why this might be: Monty Cantsin seems >to write consistently good stuff, Tim May announced he may be using >some nyms, and we have this big argument with PGP Inc where their Thanks for the sort-of compliment, but I haven't been using anonymous remailers much at all the last couple of years. Someone wrote to me saying he suspected I was "Monty Cantsin." Nope. I know denials like this mean nothing to some of you--they certainly meant nothing to Detweiler several years ago. But, for the record, virtually every comment I have made on this list in the last couple of years has been under my own name. I agree that some good comments have come from anonymous posters. - --Tim May (I'll sign this with my new PGP 5.0 key, which has also been signed with my 1992 PGP 2.0 key) The Feds have shown their hand: they want a ban on domestic cryptography - ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDz7rVK3AvrfAt9qEQKzBgCglwLRdegEL/ubNrGydVfktiDY9vEAoNPI cUMblxJZFITqeliKe36RgkKB =6oOe -----END PGP SIGNATURE----- From ulf at fitug.de Thu Oct 9 09:08:47 1997 From: ulf at fitug.de (Ulf =?iso-8859-1?Q?M=F6ller?=) Date: Fri, 10 Oct 1997 00:08:47 +0800 Subject: EU Rejects GAK In-Reply-To: <1.5.4.32.19971009115219.006ac38c@pop.pipeline.com> Message-ID: <9710091554.AA41750@public.uni-hamburg.de> > In a lengthy report released today, the European Commission said the > American approach could threaten privacy and stifle the growth of > electronic commerce and that it might simply be ineffective. Theodor Schlickmann of the Commission's DG13 posted the URL: http://www.ispo.cec.be/eif/policy/970503toc.html Executive summary from http://www.ispo.cec.be/eif/policy/970503exec.html follows: ENSURING SECURITY AND TRUST IN ELECTRONIC COMMUNICATION Towards A European Framework for Digital Signatures And Encryption EXECUTIVE SUMMARY Introduction Open electronic networks such as the Internet are increasingly being used as a platform for communication in our society. They have the capacity to create new businesses, new channels of distribution and new methods of reaching the customer. They also open up opportunities to re-engineer business conduct itself. It is now largely expected that electronic commerce will be one of the key drivers for the development of the global information society. Electronic Commerce presents the European Union with an excellent opportunity to advance its economic integration by means of a "virtual" economic area. However, the realisation of such developments are hampered by the noticed insecurities typical to open networks: messages can be intercepted and manipulated, the validity of documents can be denied, personal data can be illicitly collected. As a result, the attractiveness and advantage of electronic commerce and communication cannot be fully exploited. In order to make good use of the commercial opportunities offered by electronic communication via open networks, a more secure environment needs to be established. Cryptographic technologies are widely recognised as essential tools for security and trust on open networks. Two important applications of cryptography are digital signatures and encryption. Several Member States announced their intentions to introduce specific regulation on cryptography and some already have done so. For instance, Germany and Italy already moved ahead with digital signature laws. In other Member States internal discussions are taking place, and some tend to refrain, at least for the moment, from any specific regulation at all. Divergent and restrictive practices with regard to cryptography can be detrimental to the free circulation of goods and services within the Internal Market and hinder the development of electronic commerce. The European Union simply cannot afford a divided regulatory landscape in a field so vital for the economy and society. The main objectives of this Communication are to develop a European policy in particular with a view to establishing a common framework for digital signatures, ensuring the functioning of the Internal Market for cryptographic services and products, stimulating a European industry for cryptographic services and products and stimulating and enabling users in all economical sectors to benefit from the opportunities of the global information society. As far as timing is concerned, the Commission considers that appropriate measures ought to be in place throughout the Union by the year 2000 at the latest. As a consequence, the Commission intends to come forward with detailed proposals in 1998 after the assessment of comments on this Communication. This is in line with the April 1997 adopted Communication on Electronic Commerce, where the Commission announced the intention to prepare a policy aiming at guaranteeing the free movement of encryption technologies and products, as well as to propose a specific initiative on digital signatures From emc at wire.insync.net Thu Oct 9 09:30:53 1997 From: emc at wire.insync.net (Eric Cordian) Date: Fri, 10 Oct 1997 00:30:53 +0800 Subject: Where is _my_ blowjob? In-Reply-To: <343C739A.72AA@dev.null> Message-ID: <199710091622.LAA17373@wire.insync.net> Some sort of Monger wrote: > So it was no great surprise to find CNN still reporting the LIE that > the child-rapist/murderer in New Jersey had been a victim of a sexual > predator he had met on the InterNet, despite the fact that the news > services who *aren't* part of the fifty billion dollar giveaway of > taxpayer-citizen's public resources have been reporting the FACTS for > quite some time now. The facts are that a 15 year old exploring his gay sexuality entered into a long term relationships with an older guy he met on a chat line. Cops entrapped the younger one in a child porn sting, seized his hard drive, bugged his phone, and tried to force him to incriminate his friend. He finally got pissed, smashed the recording machine, told his friend what was going on, and suggested the cops fuck themselves. His parents and the cops then tried to have him declared insane and institutionalized, which didn't work. They also immediately arrested his friend. The cops working on his case then phoned the team investigating the murder of the younger boy, and gave his name to them as a suspect. He was then arrested and jailed for that murder, although no direct evidence linking him to the murder has been released. The boy's parents have now embarked upon a nationwide crusade claiming that their "rights" were violated because laws do not allow the parents of a minor to institutionalize him at will. They have signed a legal waver of their child's right to privacy in order to facilitate this crusade, in spite of the fact that he will likely be tried as an adult and this will undoubtedly prejudice his trial. Meanwhile, the parents have not let these minor tribulations mess up the their heavy schedule of lavish vacations and casino gambling. The press continues to harp on the "murder suspect was abused" and "parents rights foiled by the system" aspects of the case, to the exclusion of the possibility that he is only in jail because the police wanted to screw him, or that the murder was committed in a blind fit of rage as a result of his manipulation at the hands of various authority figures. Somewhere in all of this is the truth, which will no doubt unfold as all these scenarios play themselves out. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law" From jimg at mentat.com Thu Oct 9 09:33:21 1997 From: jimg at mentat.com (Jim Gillogly) Date: Fri, 10 Oct 1997 00:33:21 +0800 Subject: anonymous poster quality up Message-ID: <199710091628.JAA01939@feller.mentat.com> Tim May wrote: > - --Tim May (I'll sign this with my new PGP 5.0 key, which has also been > signed with my 1992 PGP 2.0 key) So what your new PGP 5.0 public key? I checked for the key ID 0xDF02DF6A on the key server at www.pgp.com and didn't see it. I believe your claim that it's a 5.0 key, though, since it ends in the even nibble 'A', and all RSA key IDs are odd. :) Jim Gillogly jim at acm.org From nobody at REPLAY.COM Thu Oct 9 09:35:59 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 10 Oct 1997 00:35:59 +0800 Subject: Object code disassembly (was Re: [LONG, off-topic]] Interactive Programming) Message-ID: <199710091614.SAA25567@basement.replay.com> > It worked. After a few iterations of this I had all the entry points, and > everything that didn't disassemble cleanly was outputted as hex data. > > For fun, run objdump on a cleanly compiled unix binary... It makes it all > look so easy... :) Not quite that easy. Awhile back I disassembled RealAudio because I was curious how their codec worked. Turns out it was not all that interesting and the codecs in nautilus and speak freely are probably better. But anyway.... Running objdump on the binary spit out ~800000 lines of code. They statically linked the whole thing, motif, c library, and all. I'm not sure what they compiled it with, the c-library they had in there didn't look like any of the standard ones. It disassembled fine, but 800k lines of assembler dump is not really all that readable. So I ended up doing it interactively, setting breakpoints on the I/O operations and backtracing to find the coder. The user interface code tended to get in the way a lot. The 1kb/s coder is very basic. No predictor/corrector, and no redundancy (eg lempel-ziv, rle) compression at all. It's just a frequency/band coder at 10 frames per second. I guess thats so it can handle dropped frames. No checksums at all. The "28.8" codec is more sophisticated. It appears to be a LPC and compresses data into much larger blocks/packets. I didn't look into it too deeply because there are lots of other lpc coders available. Shortly after this, they put out a new version 3.0, with yet another codec, which I never looked at. This was quite awhile ago, and all this is from memory. So the codec was rather uninteresting, but there were a number of other "features" which got my attention. I looked at the network protocol. Its pretty simple. The client connects to the server and requests the file it wants. It also sends a whole bunch of other info, like host operating system, version number, etc. ("for statistical purposes, right? uh huh..." are you guys over there at anonymizer.com reading this? hint, hint.) Then it does something truly bizarre. The client and server exchange 32-digit hex numbers. The client calls gettimeofday() and gethostname() and uses this as a random seed. Then it sends a 128-bit random number, encoded as 32 ascii hex digits. The server does the same. I haven't a clue what this is for. Considering that the other data structures are all binary, sending this as ascii is really dumb. It looks as though its part of some third-party library. I thought maybe it was some variant of netscape cookies but it doesn't save anything to disk. It's just wierd. I tried stepping through this section of code a few times, but doing so usually caused the server to time-out. Then the server starts sending the audio file as one big stream of packets - same format as the files it saves to disk, just broken up into packets, each preceeded by a length byte. In udp mode the client sends acks every second or so. In tcp mode there are no in-band acks at all, it relies solely on the tcp protocol driver. No checksums on anything, and it uses predictable port numbers. You can probably spoof it real easy. That might make for an interesting prank. From anon at anon.efga.org Thu Oct 9 09:45:28 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 10 Oct 1997 00:45:28 +0800 Subject: What's really in PGP 5.5? Message-ID: <8dd53fe6b49e0a4b1b529cf8e6c6f7f7@anon.efga.org> The danger with the PGP system is that it could be easily perverted into a British style trusted-third-party system for GAK. The government would set up a key management infrastructure to provide an official repository and CA to register keys. It could even be "voluntary" if only government-approved CAs had liability protection which private CAs didn't have, making it hard for the privates to compete. However the price to use the government registry is that each key has to use the PGP features to specify a TTP as an additional recipient. Every message encrypted to that key should also be encrypted to the TTP key. Only government-approved TTPs may be used, and although there are many to choose from, all have to provide easy and secret GAK. The PGP 5 software will then automatically encrypt to the TTP key. Yes, this can be defeated using superencryption or faking the additional-recipient block in the message. But we know any scheme can be defeated. It still satisfies the government's requirement to get routine access to most email communications, and to allow criminals who use standard email packages to be watched. From kelsey at plnet.net Thu Oct 9 10:14:17 1997 From: kelsey at plnet.net (John Kelsey) Date: Fri, 10 Oct 1997 01:14:17 +0800 Subject: Defeating MITM with Eric's Secure Phone Message-ID: <199710091653.LAA14615@email.plnet.net> -----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks, coderpunks, Perry's Crypto List ## Date: 09-Oct-97 ## Subject: Defeating MITM with Eric's Secure Phone ] >Date: Wed, 8 Oct 1997 23:48:33 +0100 >From: Adam Back >Subject: computationally infeasible jobs for MITMs (Re: Secure phone) >How about this for a computerised method to do something similar. Aim >of the game: to make the MITMs job computationally infeasible. [Method using stegoed audio noise deleted.] I prefer to work on the more immediately useful problem: How can I secure my use of the (very nicely done) Comsec secure phones using existing infrastructure? I am concerned with the MITM voice impersonation attack, since that's the easiest attack on the system. (Actually, it's probably easier to physically tap my office, but I can't fix that right now.) The simple MITM defenses (like restating your checksum spontaneously in the middle of the conversation) take care of lots of this. Here's another way that may make some sense, though it's a little hard to use: 1. Exchange PGP-encrypted e-mail establishing a set of sixteen different words, labeled for 0..f in each direction. Thus: 0. Dilbert 1. Alpha 2. Cable 3. Swordsman ... f. Marxist Now, the checksum reading is very hard to spoof. Suppose I get 0x33f. I say ``My checksum is Swordsman Swordsman Marxist, or 33f.'' An attacker with digits besides 3 and f in his checksum simply doesn't know how to impersonate me to the other party. He lacks the secret information we've shared. Now, the problem with this is that it's too cumbersome. I would like the shared secret information to be usable with less effort. If we just want to detect the MITM eventually, then I can send the other participant a PGP-signed e-mail, in which I include the whole 6-digit checksum. That won't prevent the MITM attack from working once, but it will let us know after-the-fact if our conversation was exposed. If we find evidence that our conversation was intercepted, then we can start using my one-time word lists, or some other more paranoid mechanism. Still another approach, which may be applicable for some people, is to write a simple calculator-type application that uses a shared-secret to compute a checksum on the checksum. Thus, when I call Alice, I do the following: 1. Type the shared secret between Alice and me into the calculator app. 2. Make the call to Alice and push the ``secure'' button. 3. Type the six-digit checksum into the calculator app. 4. Read the calculator's first three checksum digits. 5. Listen to her next three digits. The simplest way to do this seems to be to just exchange a six-digit hex value as a one-time password for a given secure phone call. This is done using PGP or some other mail encryption package, and can legitimately be used to exchange a long list of one-time passwords at once. Then, use Windows' calculator application (with View set to Scientific, and Mode set to Hex) to add your one-time password to the checksum. Thus: 1. I pull up Alice's latest encrypted e-mail, and get today's phone password. 2. I open the Windows calculator, set it to View/Scientific and hex mode, and type in the password (a six-digit hex number) and ``+.'' 3. I call Alice, say hello, and push the ``SECURE'' button. 4. I type the six digit hex checksum into my calculator. 5. I read the first three digits of the result to her. She reads the next three to me. All of this (except for maybe re-reading the checksum in the middle of the conversation) is probably overkill. Still, it may be worth something to someone. Is there a clean way to have the secure phone box take input from the dialpad on the phone, without sending it out on the phone line? If so, then maybe some later version could include a PIN-secured mode, using EKE or SPEKE or something similar. (For a supported mode, the checksum wouldn't need to be read over the phone anymore. We would need to protect the shared PIN from brute-force attack, however.) >Adam --John Kelsey, jmkelsey at plnet.net / kelsey at counterpane.com - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAi5JqlEAAAEEAPCEHMBdDCAJ83/ibNM7ngCaaibv7YkTxcpKPjTO+WcjswFV SEzMeTqW4MX2wSKdfcMq1HembbgfYs7v2UCnUFkLPZF19s3yUSISGcS7JxlBc3q1 7uj8W5XfBoGpgCYQqYFL2+AB/+3tLu7lU5iiEYCnevY5GQkq0kHx57Ag8goBAAUR tCdKb2huIE0uIEtlbHNleSBKciA8am1rZWxzZXlAZGVscGhpLmNvbT6JAJUDBRAv 5uh7QfHnsCDyCgEBAQZ2A/9/OMeWK4YC+PnEzBTmgpF4WAOsVXfzRD3zAbzfNWY9 MEGo4gRF8Mr1lPHdK+0JOHp327mj9ZvYqQb1bV5fwc5dJa8/Z34VLPYlVg2rV7vJ Hd0YnrgkoaIerbRmtP8dmZGeygeFtrk8aDCdcnMm27+tTJACl5hv2yjFO9rxBq+R MLQpRXhwaXJlcyBmb3IgbmV3IHNpZ3MvbXNncyBvbiBEZWMgMzEsIDE5OTc= =pOyw - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNDy68UHx57Ag8goBAQGP1QP9H6Z9Infv1z1swBzpEsvn+VZyweMj20to EQNRFcfLvNFu140kWokWfgIcSXh1CBrsz93/CMoZgIb8l1cpGIU51kFgz/DTXGvj 5XQCFcUzBRAEraxeF7xFnEH+Ss35lcCvzAXaWaVLB6apBvXP5ZkZtFr/vUYLhrtF Y34E8AAXFrg= =AlX3 -----END PGP SIGNATURE----- --John Kelsey, Counterpane Systems, kelsey at counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 From kelsey at plnet.net Thu Oct 9 10:14:59 1997 From: kelsey at plnet.net (John Kelsey) Date: Fri, 10 Oct 1997 01:14:59 +0800 Subject: Applying ``Crowds'' idea to anonymous e-cash. Message-ID: <199710091652.LAA14607@email.plnet.net> -----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks, coderpunks, Perry's Crypto List ## Date: 10/09/97 ## Subject: Applying ``Crowds'' idea to anonymous e-cash. ] I was thinking about applying the ``Crowds'' idea to anonymous e-cash, and came up with what I think is a pretty good idea. I am interested in seeing if anyone sees either holes in it, or ways to improve it. I am also interested in hearing about whether or not it has been invented before. Crowds, for those who haven't seen it, is a way of giving web users partial anonymity by making it impossible to determine which member of some ``crowd'' of users did some action (such as requesting a document). (This is a very rough summary--read the paper for the real analysis.) I can see a way to do something very similar with withdrawing electronic coins. (This works best with online-cleared coins), without any blinding being used. I think this gets around the Chaum patents. I also think it can probably be implemented more-or-less on top of the web-anonymizing Crowds stuff, though I may be wrong. Here's the basic idea: 1. A Crowd of users forms up, each wanting to withdraw some reasonably large amount of money, such as $100, in $1 e-coins. 2. Each user provides a public key and pays some money (perhaps $101) into the bank. The bank registers each public key as belonging to a member of the crowd. 3. Each member of the crowd is given all other members' public keys. 4. Each member prepares 100 one-use symmetric encryption keys, each with a 64-bit key ID. 5. The members organize themselves into a sort of one-time anonymous routing network, using those public keys. Each message to be sent is encrypted in layers (a la onion routing), so that each member appears at least once in the message's path. Each message ends up at the bank, eventually. I'll talk about likely network architectures later, if anyone's interested. 6. The bank publishes something noting that it has received N*100 keys, where N = the number of members in the crowd. It also publishes the hashes of all N*100 symmetric keys. 7. Each member digitally signs something saying that he agrees with the keys published, he hasn't been railroaded, etc. Nothing proceeds until this has been published from each member. 8. The bank encrypts one $1 online-cleared e-coin under each symmetric key. It publishes a list of (key ID, encrypted coin) pairs for all the members to receive. 9. Each member walks away with $100 in $1 e-coins. Nobody can prove which member got which coin. No linking of coins is possible. Now, the protocol isn't all *that* important here, but the idea is: We interface with the traceable money world, but grant a sort of weak anonymity for all users in the crowd. Because the coins are online-cleared, they must be deposited immediately. To protect recipient-confidentiality, these can be deposited under a pseudonym account--basically just a one-use public key. The recipient accumulates a bunch of credit under that public key, and then goes through the withdrawal procedure again to get new, weakly anonymous coins, which he can openly deposit without direct traceability. (That is, the bank can still learn that certain coins were spent at the same place, but can't identify the final recipient of the money. I can think of ways to adapt this idea to unlinkability, though they involve some implementation hassles.) Note that multiple iterations of the withdrawal protocol make things much stronger. That is, there is no reason why the participants in the withdrawal protocol have to spend their e-coins directly--they can also use them, along with a one-use public key, to go back into the withdrawal protocol again. An attacker who manages to link a given coin to a given crowd (possible only with the help of the bank) with some anonymous participants (who paid in with coins from this scheme) must face the possibility that this coin could have come from the anonymous participants--which can then be traced to another pool, with other anonymous participants, etc. The attacker can't even make statistical statements in many cases, since, if I were doing something really hot, I'd want to go through the withdrawal process lots of times. The bank can tell only what crowd your coins came from, not how many times you have swapped your coins out. If you're willing to pay the transaction costs and time, you can withdraw and deposit as many times as you like. Comments? Is this idea practical at all? Has someone else already done it? --John Kelsey, jmkelsey at plnet.net / kelsey at counterpane.com - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAi5JqlEAAAEEAPCEHMBdDCAJ83/ibNM7ngCaaibv7YkTxcpKPjTO+WcjswFV SEzMeTqW4MX2wSKdfcMq1HembbgfYs7v2UCnUFkLPZF19s3yUSISGcS7JxlBc3q1 7uj8W5XfBoGpgCYQqYFL2+AB/+3tLu7lU5iiEYCnevY5GQkq0kHx57Ag8goBAAUR tCdKb2huIE0uIEtlbHNleSBKciA8am1rZWxzZXlAZGVscGhpLmNvbT6JAJUDBRAv 5uh7QfHnsCDyCgEBAQZ2A/9/OMeWK4YC+PnEzBTmgpF4WAOsVXfzRD3zAbzfNWY9 MEGo4gRF8Mr1lPHdK+0JOHp327mj9ZvYqQb1bV5fwc5dJa8/Z34VLPYlVg2rV7vJ Hd0YnrgkoaIerbRmtP8dmZGeygeFtrk8aDCdcnMm27+tTJACl5hv2yjFO9rxBq+R MLQpRXhwaXJlcyBmb3IgbmV3IHNpZ3MvbXNncyBvbiBEZWMgMzEsIDE5OTc= =pOyw - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNDzFQkHx57Ag8goBAQHYkQQA0Oud9OvEX7qJdxJgGyirqzrAN4jI005p aOVl9UnSf4XGEPj1DFMONW61HaLoh46tEDmnfMrXjI706IfwNF3HfY14FIrGe5Nb U386CP5iztc6rpS6YsiX+prN9Q9RIXzari9uSHrmYSlGAcqa571vy7kkn7uejGBC jv+0hnYNE1M= =aHpr -----END PGP SIGNATURE----- --John Kelsey, Counterpane Systems, kelsey at counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 From minow at apple.com Thu Oct 9 10:43:57 1997 From: minow at apple.com (Martin Minow) Date: Fri, 10 Oct 1997 01:43:57 +0800 Subject: What's really in PGP 5.5? In-Reply-To: Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Anonymous, claiming to be Monty Cantsin, writes about PGP 5.5: > >Decrypting files and decrypting messages are not the same problem. >The PGP product has SMTP support - it is explicitly designed to weaken >transmitted messages. Just like Clipper. > No, it isn't "just like Clipper." Messages encrypted with PGP 5.5 can be decrypted or verified by PGP 5.0 or other implementations that can decode the PGP message and encryption format. Also, PGP 5.0 or other complient implementations can send encrypted and signed messages to PGP 5.5 users. The transmitted message is as "weak" as the quality of the encryption, the number of people who have access to the secret key, and the quality of their passwords. It is also as "weak" as the physical security that prevents passwords from leaking (i.e., by Tempest or black bag wiretaps inside the secure user's workstation). Given all of the other risks, encrypting to a corporate private key doesn't seem to me to significantly increase the risk. The real risk, to my view, is that some future implementation will require the secondary key, and will require that that secondary key be stored in a "government accessable" database. This, however, seems a bit remote and, given that PGP publishes their source code, reasonably easy to detect. Martin Minow minow at apple.com -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBND0KUG23+ciinrc5AQGvMgP9HKE4s/3FbjfFpvfC230wvHkjDd2HWyC1 lhVa/i9ayO8pZC/k+V06pGTZLcZ89a4X2r3fQGjj0QNghuotkV9xVVD9AzLTLX88 YPp2DQWDCjkWq4PzBB8IR6c+rH6AbuqtDAhfas/Rto/9DI7EJWqi3dZbi7tFm7jj g2nTAFk9VVo= =DkbK -----END PGP SIGNATURE----- From rah at shipwright.com Thu Oct 9 10:51:18 1997 From: rah at shipwright.com (Robert Hettinga) Date: Fri, 10 Oct 1997 01:51:18 +0800 Subject: Improper biometric controls... Message-ID: --- begin forwarded text Resent-Date: Thu, 9 Oct 1997 11:55:35 -0400 X-Authentication-Warning: qnx.com: localhost [127.0.0.1] didn't use HELO protocol To: 0xdeadbeef at substance.abuse.blackdown.org Cc: bostic at bsdi.com Subject: Exam tip o' the day Date: Thu, 09 Oct 1997 11:50:58 -0400 From: glen mccready Resent-From: 0xdeadbeef at substance.abuse.blackdown.org X-Mailing-List: <0xdeadbeef at substance.abuse.blackdown.org> archive/latest/2317 X-Loop: 0xdeadbeef at substance.abuse.blackdown.org Precedence: list Resent-Sender: 0xdeadbeef-request at substance.abuse.blackdown.org Forwarded-by: Rob Windsor Forwarded-by: Kirk A Schneider It was the week of finals, and obviously, everyone was stressing. This happened in a big (+300) lecture class, it was some hard science course with one of those real pain-in-the ass professors. Everyone taking this course had been dreading this final from the start. They all knew they had no hope. There was one student in the class who felt confident in the area if he could just take his time and work his way through each problem. So, on the day of the final, he decided he would just take his time on the test. The exam began, and he slowly paced himself, carefully working out each problem. This was diffficult because the professor was one of those guys who would obnoxiously yell to the class how much time they had left every three minutes. He was just one of those guys who needed a smack in the face. Finally, time was up, and the teacher told the class to stop, and to bring their test papers down to his desk. With over three-hundred people, this procedure took quite a while. That one student just continued working on his test. Eventually, ten extra minutes turned into twenty, until the student was there for almost an hour after the exam had ended. He looked at his paper, and decided he had completed the test to his satisfaction, and he could now hand it in. He gathered his things and walked down to the teachers desk. The professor was sitting at the desk, the tests were still sitting on the desk in a neatly stacked pile, and it was clear he had just been waiting for this student to finish so that he could tell him that he had failed. The student reached his professors desk with a big smile on his face. The professor said to him, "This test was due an hour ago. By handing it in now it is considered late, and consequently, you fail." The student looked right at the professor and said to him "Do you know who I am?" The professor clearly upset by his student's response said "What are you talking about?" Again the student said, "Do you know who I am?" The professor responded by saying no, of course not... Just as he said this, the student lifted up half of the test papers still sitting on the teachers desk. He casually slipped his test on the pile, and let the rest of the tests fall naturally back onto the stack. He looked at his professor and said "I didn't think so." --- end forwarded text ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: From jon at pgp.com Thu Oct 9 11:39:33 1997 From: jon at pgp.com (Jon Callas) Date: Fri, 10 Oct 1997 02:39:33 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <3.0.3.32.19971007142710.00a22970@mail.pgp.com> Message-ID: <3.0.3.32.19971009112539.00aea800@mail.pgp.com> At 02:46 PM 10/8/97 +0200, Mike wrote: >What happens when the non corporate versions of PGP encrypts a message to >Alice? Will they disregard the recovery key and encrypt to Bob, or simply >fail? Here is what happens if you are using freeware/personal privacy: It brings up a dialog box and gives you the option of encrypting to Alice alone or Alice plus her corporate recovery key. If the "strict" flag is set on Alice's CMRK and you remove it, we display a dialog box that wags a finger at you and tells you you're being naughty, but that's it. If you remove Alice's CMRK from your key ring, it just sends to Alice alone and doesn't bother you at all. If this isn't what happens, it's a bug. Tell us, we'll fix it. Jon ----- Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) From jamesd at echeque.com Thu Oct 9 11:43:18 1997 From: jamesd at echeque.com (James A. Donald) Date: Fri, 10 Oct 1997 02:43:18 +0800 Subject: Secure Phone: Making man in the middle audible. Message-ID: <199710091831.LAA06017@proxy3.ba.best.com> Here is a method to render Man in the Middle audible on a telephone connection. Before speech can be encrypted, it is digitized and compressed. It is turned into digital packets. There is some choice in the size and other properties of the digital packets. Suppose that Bob's computer from time to time formulates a plan to do groups of a particular size and form, and sends Ann's computer a hash of that plan and the DH negotiated shared secret. Malloc (the man in the middle) cannot send this hash to Ann's computer for Ann would discover the shared secret she is using is not the same as the shared Bob is using. So his computer must formulate its own plan, and send its own hash, which will not agree with Bob's plan, because Bob's computer does not reveal the plan except by actually sending the packets. So malloc must decompress Bob's speech packets, repacketize them, and recompress them, Often he will not be able to send off a packet, until he has received two of Bob's packets. So this triples the delay, and increases the speech degradation. This should quite noticeable, noticeable enough to provoke Bob and Ann into verifying their connection by reading the hash digits of their shared secret. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd at echeque.com From hallam at ai.mit.edu Thu Oct 9 11:56:56 1997 From: hallam at ai.mit.edu (Phillip Hallam-Baker) Date: Fri, 10 Oct 1997 02:56:56 +0800 Subject: EU Rejects GAK Message-ID: <01BCD4C0.6DD164E0.hallam@ai.mit.edu> Before people get carried away it is important to realise that the EU institutions do not map onto US ones. The EU Commission does not have an analogue in the US system. It is an unelected group of beureacrats whose purpose is (roughly speaking) to harmonize EU law. It does not have legislative powers in its own right, nor does it necessarily have much influence. The EU lawmaking process is essentially that the Commision drafts some suggestions and passes them onto the council of ministers which accepts, rejects or ammends them. If there is unanimous agreement in the concil of ministers (majority vote on a restricted number of issues) then a directive is issued which the national parliaments must then enact into law. The limited scope of EU laws is critical, the EU is much like the US prior to the civil war, the member states are sovereign. Thus there is nothing the EU Commission can do to prevent member states outlawing crypto, nor for that matter can they force them to allow it. They can assist in forming EU wide regulations either way however. The real importance of the EU report is probably that it denies the statements made by the Freeh et. al. claiming that US alies in Europe are in favour of GAK. Despite the fact that there has never been any public demonstration of a commitment the administration has disingenuously claimed that it has the support of and indeed is being pressured to take its stance on export controls by other countries. Needless to say it is unconvincing to be told 'trust me' by someone who is clearly peddling a lie. Few people can prove it is a lie because few people can claim to have the personal access to European politicians the administration can. I know UK politics well enough to know that the current parliament is not going to back any increase of powers for a security service that many members of the government was used politically by the Conservatives. It would be like the nation of Islam calling for arbitrary arrest powers for the police. Phill From shamrock at netcom.com Thu Oct 9 12:08:51 1997 From: shamrock at netcom.com (Lucky Green) Date: Fri, 10 Oct 1997 03:08:51 +0800 Subject: Applying ``Crowds'' idea to anonymous e-cash. In-Reply-To: <199710091652.LAA14607@email.plnet.net> Message-ID: On Thu, 9 Oct 1997, John Kelsey wrote: > > Crowds, for those who haven't seen it, is a way of > giving web users partial anonymity by making it impossible > to determine which member of some ``crowd'' of users did > some action (such as requesting a document). (This is a > very rough summary--read the paper for the real analysis.) Some people from MSFT proposed a similar concept at FC'97. As for its real life value, the legal term for such a system is "conspiracy". -- Lucky Green PGP encrypted mail preferred From nobody at REPLAY.COM Thu Oct 9 12:45:23 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 10 Oct 1997 03:45:23 +0800 Subject: 6502 ML programming Message-ID: <199710091925.VAA17154@basement.replay.com> If you guys are still doing 6502 work, maybe you can make use of this. -- * RSA Data Security, Inc. MD5 Message-Digest Algorithm * * *********************************************************************** * ** Message-digest routines: ** * ** To form the message digest for a message M ** * ** (1) Initialize a context buffer mdContext using MD5Init ** * ** (2) Call MD5Update on mdContext and M ** * ** (3) Call MD5Final on mdContext ** * ** The message digest is now in the bugffer passed to MD5Final ** * *********************************************************************** * ORG $2000 * Jump Table JMP MD5INIT JMP MD5UPD JMP MD5FINAL DIGEST HEX 00000000 ;Message digest ends up here. HEX 00000000 HEX 00000000 HEX 00000000 MD5INITV HEX 01234567 ;MD5 initialization values HEX 89ABCDEF HEX FEDCBA98 HEX 76543210 MD5BYTES DS 8 ;Counts bytes in message digest so far MD5BUFRP HEX 00 ;Pointer to current byte in partially full buffer MD5BUFR DS 64 ;64-byte buffer for current MD5 block * Initialize MD5 - start new message digest MD5INIT LDX #15 ;Load initialization constants ]LOOP LDA MD5INITV,X STA DIGEST,X DEX BPL ]LOOP LDA #0 ;Reset byte count to zero LDX #7 ]LOOP STA MD5BYTES,X DEX BPL ]LOOP STA MD5BUFRP ;Reset buffer to empty ]RTS RTS * MD5UPD - add a byte to the message digest MD5UPD LDX MD5BUFRP STA MD5BUFR,X INX STX MD5BUFRP JSR INCBYTES CPX #64 BCC ]RTS LDX #0 STX MD5BUFRP JSR MD5DOBLK RTS INCBYTES INC MD5BYTES BNE ]RTS INC MD5BYTES+1 BNE ]RTS INC MD5BYTES+2 BNE ]RTS HEX 0000 * MD5FINAL - do last block and compute final digest MD5FINAL LDA #$80 LDX MD5BUFRP STA MD5BUFR,X INX STX MD5BUFRP ]LOOP CPX #64 BCC MD5FA LDX #0 STX MD5BUFRP JSR MD5DOBLK MD5FA LDX MD5BUFRP LDA #0 STA MD5BUFR,X INX STX MD5BUFRP CPX #56 BNE ]LOOP LDA MD5BYTES STA MD5BUFR+56 LDA MD5BYTES+1 STA MD5BUFR+57 LDA MD5BYTES+2 STA MD5BUFR+58 LDA MD5BYTES+3 STA MD5BUFR+59 LDA MD5BYTES+4 STA MD5BUFR+60 LDA MD5BYTES+5 STA MD5BUFR+61 LDA MD5BYTES+6 STA MD5BUFR+62 LDA MD5BYTES+7 STA MD5BUFR+63 LUP 3 ;Multiply times 8 LDA MD5BUFR+56 ; to convert number of bytes to number of bits ASL STA MD5BUFR+56 LDA MD5BUFR+57 ROL STA MD5BUFR+57 LDA MD5BUFR+58 ROL STA MD5BUFR+58 LDA MD5BUFR+59 ROL ;Unlikely the message would be over 500 MB STA MD5BUFR+59 ;so we can stop here... --^ JSR MD5DOBLK RTS MD5TEMPB DS 16 ;Temporary buffer for a,b,c,d MD5TEMPV DS 4 ;Temporary 32-bit word storage (used by MD5DOBLK) MD5TEMP2 DS 4 ;Temporary 32-bit variable #2 (used by F,G,H,I fcns) * Block transformation MD5DOBLK LDX #15 ;Copy values into temp buffer ]LOOP LDA DIGEST,X STA MD5TEMPB,X DEX BPL ]LOOP LDA #0 STA MD5TP * Round 1 : F-functions * a = b + ((a + F(b,c,d) + X[k] + T[i]) <<< s). */ JSR MD5LOADA ;1 (a,b,c,d) JSR F_BCD JSR NEXT_T ;(D76AA478) LDA #0 JSR MD5ADDX JSR MD5RL7 ;Rotate Left 7 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;2 (d,a,b,c) JSR F_ABC JSR NEXT_T ;(E8C7B756) LDA #1 JSR MD5ADDX JSR MD5RL12 ;Rotate Left 12 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;3 (c,d,a,b) JSR F_DAB JSR NEXT_T LDA #2 JSR MD5ADDX JSR MD5RL17 ;Rotate left 17 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;4 (b,c,d,a) JSR F_CDA JSR NEXT_T LDA #3 JSR MD5ADDX JSR MD5RL22 ;Rotate left 22 JSR MD5ADDC JSR MD5STORB JSR MD5LOADA ;5 (a,b,c,d) JSR F_BCD JSR NEXT_T LDA #4 JSR MD5ADDX JSR MD5RL7 ;<<7 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;6 (d,a,b,c) JSR F_ABC JSR NEXT_T LDA #5 JSR MD5ADDX JSR MD5RL12 ;<<12 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;7 (c,d,a,b) JSR F_DAB JSR NEXT_T LDA #6 JSR MD5ADDX JSR MD5RL17 ;<<17 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;8 (b,c,d,a) JSR F_CDA JSR NEXT_T LDA #7 JSR MD5ADDX JSR MD5RL22 ;<<22 JSR MD5ADDC JSR MD5STORB JSR MD5LOADA ;9 (a,b,c,d) JSR F_BCD JSR NEXT_T LDA #8 JSR MD5ADDX JSR MD5RL7 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;10 (d,a,b,c) JSR F_ABC JSR NEXT_T LDA #9 JSR MD5ADDX JSR MD5RL12 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;11 (c,d,a,b) JSR F_DAB JSR NEXT_T LDA #10 JSR MD5ADDX JSR MD5RL17 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;12 (b,c,d,a) JSR F_CDA JSR NEXT_T LDA #11 JSR MD5ADDX JSR MD5RL22 JSR MD5ADDC JSR MD5STORB JSR MD5LOADA ;13 (a,b,c,d) JSR F_BCD JSR NEXT_T LDA #12 JSR MD5ADDX JSR MD5RL7 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;14 (d,a,b,c) JSR F_ABC JSR NEXT_T LDA #13 JSR MD5ADDX JSR MD5RL12 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;15 (c,d,a,b) JSR F_DAB JSR NEXT_T LDA #14 JSR MD5ADDX JSR MD5RL17 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;16 (b,c,d,a) JSR F_CDA JSR NEXT_T LDA #15 JSR MD5ADDX JSR MD5RL22 JSR MD5ADDC JSR MD5STORB * Round 2 : G-functions * a = b + ((a + G(b,c,d) + X[k] + T[i]) <<< s). */ JSR MD5LOADA ;17 (a,b,c,d) JSR G_BCD JSR NEXT_T LDA #1 JSR MD5ADDX JSR MD5RL5 ;Rotate Left 5 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;18 (d,a,b,c) JSR G_ABC JSR NEXT_T LDA #6 JSR MD5ADDX JSR MD5RL9 ;Rotate Left 9 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;19 (c,d,a,b) JSR G_DAB JSR NEXT_T LDA #11 JSR MD5ADDX JSR MD5RL14 ;Rotate left 14 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;20 (b,c,d,a) JSR G_CDA JSR NEXT_T LDA #0 JSR MD5ADDX JSR MD5RL20 ;Rotate left 20 JSR MD5ADDC JSR MD5STORB JSR MD5LOADA ;21 (a,b,c,d) JSR G_BCD JSR NEXT_T LDA #5 JSR MD5ADDX JSR MD5RL5 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;22 (d,a,b,c) JSR G_ABC JSR NEXT_T LDA #10 JSR MD5ADDX JSR MD5RL9 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;23 (c,d,a,b) JSR G_DAB JSR NEXT_T LDA #15 JSR MD5ADDX JSR MD5RL14 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;24 (b,c,d,a) JSR G_CDA JSR NEXT_T LDA #4 JSR MD5ADDX JSR MD5RL20 JSR MD5ADDC JSR MD5STORB JSR MD5LOADA ;25 (a,b,c,d) JSR G_BCD JSR NEXT_T LDA #9 JSR MD5ADDX JSR MD5RL5 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;26 (d,a,b,c) JSR G_ABC JSR NEXT_T LDA #14 JSR MD5ADDX JSR MD5RL9 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;27 (c,d,a,b) JSR G_DAB JSR NEXT_T LDA #3 JSR MD5ADDX JSR MD5RL14 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;28 (b,c,d,a) JSR G_CDA JSR NEXT_T LDA #8 JSR MD5ADDX JSR MD5RL20 JSR MD5ADDC JSR MD5STORB JSR MD5LOADA ;29 (a,b,c,d) JSR G_BCD JSR NEXT_T LDA #13 JSR MD5ADDX JSR MD5RL5 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;30 (d,a,b,c) JSR G_ABC JSR NEXT_T LDA #2 JSR MD5ADDX JSR MD5RL9 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;31 (c,d,a,b) JSR G_DAB JSR NEXT_T LDA #7 JSR MD5ADDX JSR MD5RL14 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;32 (b,c,d,a) JSR G_CDA JSR NEXT_T LDA #12 JSR MD5ADDX JSR MD5RL20 JSR MD5ADDC JSR MD5STORB * Round 3 : H-functions * a = b + ((a + H(b,c,d) + X[k] + T[i]) <<< s). */ JSR MD5LOADA ;33 (a,b,c,d) JSR H_BCD JSR NEXT_T LDA #5 JSR MD5ADDX JSR MD5RL4 ;Rotate Left 4 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;34 (d,a,b,c) JSR H_ABC JSR NEXT_T LDA #8 JSR MD5ADDX JSR MD5RL11 ;Rotate Left 11 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;35 (c,d,a,b) JSR H_DAB JSR NEXT_T LDA #11 JSR MD5ADDX JSR MD5RL16 ;Rotate left 16 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;36 (b,c,d,a) JSR H_CDA JSR NEXT_T LDA #14 JSR MD5ADDX JSR MD5RL23 ;Rotate left 23 JSR MD5ADDC JSR MD5STORB JSR MD5LOADA ;37 (a,b,c,d) JSR H_BCD JSR NEXT_T LDA #1 JSR MD5ADDX JSR MD5RL4 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;38 (d,a,b,c) JSR H_ABC JSR NEXT_T LDA #4 JSR MD5ADDX JSR MD5RL11 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;39 (c,d,a,b) JSR H_DAB JSR NEXT_T LDA #7 JSR MD5ADDX JSR MD5RL16 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;40 (b,c,d,a) JSR H_CDA JSR NEXT_T LDA #10 JSR MD5ADDX JSR MD5RL23 JSR MD5ADDC JSR MD5STORB JSR MD5LOADA ;41 (a,b,c,d) JSR H_BCD JSR NEXT_T LDA #13 JSR MD5ADDX JSR MD5RL4 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;42 (d,a,b,c) JSR H_ABC JSR NEXT_T LDA #0 JSR MD5ADDX JSR MD5RL11 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;43 (c,d,a,b) JSR H_DAB JSR NEXT_T LDA #3 JSR MD5ADDX JSR MD5RL16 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;44 (b,c,d,a) JSR H_CDA JSR NEXT_T LDA #6 JSR MD5ADDX JSR MD5RL23 JSR MD5ADDC JSR MD5STORB JSR MD5LOADA ;45 (a,b,c,d) JSR H_BCD JSR NEXT_T LDA #9 JSR MD5ADDX JSR MD5RL4 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;46 (d,a,b,c) JSR H_ABC JSR NEXT_T LDA #12 JSR MD5ADDX JSR MD5RL11 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;47 (c,d,a,b) JSR H_DAB JSR NEXT_T LDA #15 JSR MD5ADDX JSR MD5RL16 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;48 (b,c,d,a) JSR H_CDA JSR NEXT_T LDA #2 JSR MD5ADDX JSR MD5RL23 JSR MD5ADDC JSR MD5STORB * Round 4 : I-functions * a = b + ((a + I(b,c,d) + X[k] + T[i]) <<< s). */ JSR MD5LOADA ;49 (a,b,c,d) JSR I_BCD JSR NEXT_T LDA #0 JSR MD5ADDX JSR MD5RL6 ;Rotate Left 6 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;50 (d,a,b,c) JSR I_ABC JSR NEXT_T LDA #7 JSR MD5ADDX JSR MD5RL10 ;Rotate Left 10 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;51 (c,d,a,b) JSR I_DAB JSR NEXT_T LDA #14 JSR MD5ADDX JSR MD5RL15 ;Rotate left 15 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;52 (b,c,d,a) JSR I_CDA JSR NEXT_T LDA #5 JSR MD5ADDX JSR MD5RL21 ;Rotate left 21 JSR MD5ADDC JSR MD5STORB JSR MD5LOADA ;53 (a,b,c,d) JSR I_BCD JSR NEXT_T LDA #12 JSR MD5ADDX JSR MD5RL6 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;54 (d,a,b,c) JSR I_ABC JSR NEXT_T LDA #3 JSR MD5ADDX JSR MD5RL10 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;55 (c,d,a,b) JSR I_DAB JSR NEXT_T LDA #10 JSR MD5ADDX JSR MD5RL15 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;56 (b,c,d,a) JSR I_CDA JSR NEXT_T LDA #1 JSR MD5ADDX JSR MD5RL21 JSR MD5ADDC JSR MD5STORB JSR MD5LOADA ;57 (a,b,c,d) JSR I_BCD JSR NEXT_T LDA #8 JSR MD5ADDX JSR MD5RL6 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;58 (d,a,b,c) JSR I_ABC JSR NEXT_T LDA #15 JSR MD5ADDX JSR MD5RL10 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;59 (c,d,a,b) JSR I_DAB JSR NEXT_T LDA #6 JSR MD5ADDX JSR MD5RL15 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;60 (b,c,d,a) JSR I_CDA JSR NEXT_T LDA #13 JSR MD5ADDX JSR MD5RL21 JSR MD5ADDC JSR MD5STORB JSR MD5LOADA ;61 (a,b,c,d) JSR I_BCD JSR NEXT_T LDA #4 JSR MD5ADDX JSR MD5RL6 JSR MD5ADDB JSR MD5STORA JSR MD5LOADD ;62 (d,a,b,c) JSR I_ABC JSR NEXT_T LDA #11 JSR MD5ADDX JSR MD5RL10 JSR MD5ADDA JSR MD5STORD JSR MD5LOADC ;63 (c,d,a,b) JSR I_DAB JSR NEXT_T LDA #2 JSR MD5ADDX JSR MD5RL15 JSR MD5ADDD JSR MD5STORC JSR MD5LOADB ;64 (b,c,d,a) JSR I_CDA JSR NEXT_T LDA #9 JSR MD5ADDX JSR MD5RL21 JSR MD5ADDC JSR MD5STORB * Add value to previous digest. * Note that this is four seperate 32-bit additions CLC LDA MD5TEMPB ADC DIGEST STA DIGEST LDA MD5TEMPB+1 ADC DIGEST+1 STA DIGEST+1 LDA MD5TEMPB+2 ADC DIGEST+2 STA DIGEST+2 LDA MD5TEMPB+3 ADC DIGEST+3 STA DIGEST+3 CLC LDA MD5TEMPB+4 ADC DIGEST+4 STA DIGEST+4 LDA MD5TEMPB+5 ADC DIGEST+5 STA DIGEST+5 LDA MD5TEMPB+6 ADC DIGEST+6 STA DIGEST+6 LDA MD5TEMPB+7 ADC DIGEST+7 STA DIGEST+7 CLC LDA MD5TEMPB+8 ADC DIGEST+8 STA DIGEST+8 LDA MD5TEMPB+9 ADC DIGEST+9 STA DIGEST+9 LDA MD5TEMPB+10 ADC DIGEST+10 STA DIGEST+10 LDA MD5TEMPB+11 ADC DIGEST+11 STA DIGEST+11 CLC LDA MD5TEMPB+12 ADC DIGEST+12 STA DIGEST+12 LDA MD5TEMPB+13 ADC DIGEST+13 STA DIGEST+13 LDA MD5TEMPB+14 ADC DIGEST+14 STA DIGEST+14 LDA MD5TEMPB+15 ADC DIGEST+15 STA DIGEST+15 RTS * Basic MD5 functions MD5LOADA LDA MD5TEMPB ;Put 'A' into temp variable STA MD5TEMPV LDA MD5TEMPB+1 STA MD5TEMPV+1 LDA MD5TEMPB+2 STA MD5TEMPV+2 LDA MD5TEMPB+3 STA MD5TEMPV+3 RTS MD5LOADB LDA MD5TEMPB+4 ;Put 'B' into temp variable STA MD5TEMPV LDA MD5TEMPB+5 STA MD5TEMPV+1 LDA MD5TEMPB+6 STA MD5TEMPV+2 LDA MD5TEMPB+7 STA MD5TEMPV+3 RTS MD5LOADC LDA MD5TEMPB+8 ;Put 'C' into temp variable STA MD5TEMPV LDA MD5TEMPB+9 STA MD5TEMPV+1 LDA MD5TEMPB+10 STA MD5TEMPV+2 LDA MD5TEMPB+11 STA MD5TEMPV+3 RTS MD5LOADD LDA MD5TEMPB+12 ;Put 'D' into temp variable STA MD5TEMPV LDA MD5TEMPB+13 STA MD5TEMPV+1 LDA MD5TEMPB+14 STA MD5TEMPV+2 LDA MD5TEMPB+15 STA MD5TEMPV+3 RTS MD5STORA LDA MD5TEMPV ;Store temp variable into 'A' in temp buffer STA MD5TEMPB LDA MD5TEMPV+1 STA MD5TEMPB+1 LDA MD5TEMPV+2 STA MD5TEMPB+2 LDA MD5TEMPV+3 STA MD5TEMPB+3 RTS MD5STORB LDA MD5TEMPV ;Store temp variable into 'B' STA MD5TEMPB+4 LDA MD5TEMPV+1 STA MD5TEMPB+5 LDA MD5TEMPV+2 STA MD5TEMPB+6 LDA MD5TEMPV+3 STA MD5TEMPB+7 RTS MD5STORC LDA MD5TEMPV ;Store temp variable into 'C' STA MD5TEMPB+8 LDA MD5TEMPV+1 STA MD5TEMPB+9 LDA MD5TEMPV+2 STA MD5TEMPB+10 LDA MD5TEMPV+3 STA MD5TEMPB+11 RTS MD5STORD LDA MD5TEMPV ;Store temp variable into 'D' STA MD5TEMPB+12 LDA MD5TEMPV+1 STA MD5TEMPB+13 LDA MD5TEMPV+2 STA MD5TEMPB+14 LDA MD5TEMPV+3 STA MD5TEMPB+15 RTS MD5ADDA CLC ;Add 'A' to temp variable LDA MD5TEMPB ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+1 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+2 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+3 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS MD5ADDB CLC ;Add 'B' to temp variable LDA MD5TEMPB+4 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+5 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+6 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+7 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS MD5ADDC CLC ;Add 'C' to temp variable LDA MD5TEMPB+8 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+9 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+10 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+11 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS MD5ADDD CLC ;Add 'D' to temp variable LDA MD5TEMPB+12 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+13 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+14 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+15 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS * F function: * F(X,Y,Z) = XY v not(X) Z F_BCD LDA MD5TEMPB+4 ;B&C AND MD5TEMPB+8 STA MD5TEMP2 LDA MD5TEMPB+5 AND MD5TEMPB+9 STA MD5TEMP2+1 LDA MD5TEMPB+6 AND MD5TEMPB+10 STA MD5TEMP2+2 LDA MD5TEMPB+7 AND MD5TEMPB+11 STA MD5TEMP2+3 CLC ;not(B)&D or (previous) -> MD5TEMPV+= LDA MD5TEMPB+4 EOR #$FF AND MD5TEMPB+12 ORA MD5TEMP2 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+5 ; EOR #$FF AND MD5TEMPB+13 ORA MD5TEMP2+1 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+6 ; EOR #$FF AND MD5TEMPB+14 ORA MD5TEMP2+2 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+7 ; EOR #$FF AND MD5TEMPB+15 ORA MD5TEMP2+3 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS F_ABC LDA MD5TEMPB ;A&B AND MD5TEMPB+4 STA MD5TEMP2 LDA MD5TEMPB+1 AND MD5TEMPB+5 STA MD5TEMP2+1 LDA MD5TEMPB+2 AND MD5TEMPB+6 STA MD5TEMP2+2 LDA MD5TEMPB+3 AND MD5TEMPB+7 STA MD5TEMP2+3 CLC ;not(A)&C or (previous) -> MD5TEMPV+= LDA MD5TEMPB EOR #$FF AND MD5TEMPB+8 ORA MD5TEMP2 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+1 ; EOR #$FF AND MD5TEMPB+9 ORA MD5TEMP2+1 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+2 ; EOR #$FF AND MD5TEMPB+10 ORA MD5TEMP2+2 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+3 ; EOR #$FF AND MD5TEMPB+11 ORA MD5TEMP2+3 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS F_DAB LDA MD5TEMPB+12 ;D&A AND MD5TEMPB STA MD5TEMP2 LDA MD5TEMPB+13 AND MD5TEMPB+1 STA MD5TEMP2+1 LDA MD5TEMPB+14 AND MD5TEMPB+2 STA MD5TEMP2+2 LDA MD5TEMPB+15 AND MD5TEMPB+3 STA MD5TEMP2+3 CLC ;not(D)&B or (previous) -> MD5TEMPV+= LDA MD5TEMPB+12 EOR #$FF AND MD5TEMPB+4 ORA MD5TEMP2 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+13 ; EOR #$FF AND MD5TEMPB+5 ORA MD5TEMP2+1 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+14 ; EOR #$FF AND MD5TEMPB+6 ORA MD5TEMP2+2 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+15 ; EOR #$FF AND MD5TEMPB+7 ORA MD5TEMP2+3 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS F_CDA LDA MD5TEMPB+8 ;C&D AND MD5TEMPB+12 STA MD5TEMP2 LDA MD5TEMPB+9 AND MD5TEMPB+13 STA MD5TEMP2+1 LDA MD5TEMPB+10 AND MD5TEMPB+14 STA MD5TEMP2+2 LDA MD5TEMPB+11 AND MD5TEMPB+15 STA MD5TEMP2+3 CLC ;not(C)&A or (previous) -> MD5TEMPV+= LDA MD5TEMPB+8 EOR #$FF AND MD5TEMPB ORA MD5TEMP2 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+9 ; EOR #$FF AND MD5TEMPB+1 ORA MD5TEMP2+1 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+10 ; EOR #$FF AND MD5TEMPB+2 ORA MD5TEMP2+2 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+11 ; EOR #$FF AND MD5TEMPB+3 ORA MD5TEMP2+3 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS * G Function: * G(X,Y,Z) = XZ v Y not(Z) G_BCD LDA MD5TEMPB+4 ;B&D AND MD5TEMPB+12 STA MD5TEMP2 LDA MD5TEMPB+5 AND MD5TEMPB+13 STA MD5TEMP2+1 LDA MD5TEMPB+6 AND MD5TEMPB+14 STA MD5TEMP2+2 LDA MD5TEMPB+7 AND MD5TEMPB+15 STA MD5TEMP2+3 CLC ;not(D)&C or (previous) -> MD5TEMPV+= LDA MD5TEMPB+12 EOR #$FF AND MD5TEMPB+8 ORA MD5TEMP2 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+13 ; EOR #$FF AND MD5TEMPB+9 ORA MD5TEMP2+1 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+14 ; EOR #$FF AND MD5TEMPB+10 ORA MD5TEMP2+2 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+15 ; EOR #$FF AND MD5TEMPB+11 ORA MD5TEMP2+3 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS G_ABC LDA MD5TEMPB ;A&C AND MD5TEMPB+8 STA MD5TEMP2 LDA MD5TEMPB+1 AND MD5TEMPB+9 STA MD5TEMP2+1 LDA MD5TEMPB+2 AND MD5TEMPB+10 STA MD5TEMP2+2 LDA MD5TEMPB+3 AND MD5TEMPB+11 STA MD5TEMP2+3 CLC ;not(C)&B or (previous) -> MD5TEMPV+= LDA MD5TEMPB+8 EOR #$FF AND MD5TEMPB+4 ORA MD5TEMP2 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+9 ; EOR #$FF AND MD5TEMPB+5 ORA MD5TEMP2+1 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+10 ; EOR #$FF AND MD5TEMPB+6 ORA MD5TEMP2+2 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+11 ; EOR #$FF AND MD5TEMPB+7 ORA MD5TEMP2+3 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS G_DAB LDA MD5TEMPB+4 ;B&D AND MD5TEMPB+12 STA MD5TEMP2 LDA MD5TEMPB+5 AND MD5TEMPB+13 STA MD5TEMP2+1 LDA MD5TEMPB+6 AND MD5TEMPB+14 STA MD5TEMP2+2 LDA MD5TEMPB+7 AND MD5TEMPB+15 STA MD5TEMP2+3 CLC ;not(B)&A or (previous) -> MD5TEMPV+= LDA MD5TEMPB+4 EOR #$FF AND MD5TEMPB ORA MD5TEMP2 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+5 ; EOR #$FF AND MD5TEMPB+1 ORA MD5TEMP2+1 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+6 ; EOR #$FF AND MD5TEMPB+2 ORA MD5TEMP2+2 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+7 ; EOR #$FF AND MD5TEMPB+3 ORA MD5TEMP2+3 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS G_CDA LDA MD5TEMPB ;C&A AND MD5TEMPB+8 STA MD5TEMP2 LDA MD5TEMPB+1 AND MD5TEMPB+9 STA MD5TEMP2+1 LDA MD5TEMPB+2 AND MD5TEMPB+10 STA MD5TEMP2+2 LDA MD5TEMPB+3 AND MD5TEMPB+11 STA MD5TEMP2+3 CLC ;not(A)&D or (previous) -> MD5TEMPV+= LDA MD5TEMPB EOR #$FF AND MD5TEMPB+12 ORA MD5TEMP2 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+1 ; EOR #$FF AND MD5TEMPB+13 ORA MD5TEMP2+1 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+2 ; EOR #$FF AND MD5TEMPB+14 ORA MD5TEMP2+2 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+3 ; EOR #$FF AND MD5TEMPB+15 ORA MD5TEMP2+3 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS * H function: * H(X,Y,Z) = X xor Y xor Z H_BCD CLC ;BxCxD LDA MD5TEMPB+4 EOR MD5TEMPB+8 EOR MD5TEMPB+12 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+5 EOR MD5TEMPB+9 EOR MD5TEMPB+13 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+6 EOR MD5TEMPB+10 EOR MD5TEMPB+14 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+7 EOR MD5TEMPB+11 EOR MD5TEMPB+15 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS H_ABC CLC ;AxBxC LDA MD5TEMPB EOR MD5TEMPB+4 EOR MD5TEMPB+8 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+1 EOR MD5TEMPB+5 EOR MD5TEMPB+9 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+2 EOR MD5TEMPB+6 EOR MD5TEMPB+10 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+3 EOR MD5TEMPB+7 EOR MD5TEMPB+11 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS H_DAB CLC ;AxBxD LDA MD5TEMPB EOR MD5TEMPB+4 EOR MD5TEMPB+12 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+1 EOR MD5TEMPB+5 EOR MD5TEMPB+13 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+2 EOR MD5TEMPB+6 EOR MD5TEMPB+14 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+3 EOR MD5TEMPB+7 EOR MD5TEMPB+15 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS H_CDA CLC ;AxCxD LDA MD5TEMPB EOR MD5TEMPB+8 EOR MD5TEMPB+12 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+1 EOR MD5TEMPB+9 EOR MD5TEMPB+13 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+2 EOR MD5TEMPB+10 EOR MD5TEMPB+14 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+3 EOR MD5TEMPB+11 EOR MD5TEMPB+15 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS * I function * I(X,Y,Z) = Y xor (X v not(Z)) I_BCD CLC ~D|B^C LDA MD5TEMPB+12 EOR #$FF ORA MD5TEMPB+4 EOR MD5TEMPB+8 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+13 EOR #$FF ORA MD5TEMPB+5 EOR MD5TEMPB+9 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+14 EOR #$FF ORA MD5TEMPB+6 EOR MD5TEMPB+10 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+15 EOR #$FF ORA MD5TEMPB+7 EOR MD5TEMPB+11 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS I_ABC CLC ~C|A^B LDA MD5TEMPB+8 EOR #$FF ORA MD5TEMPB EOR MD5TEMPB+4 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+9 EOR #$FF ORA MD5TEMPB+1 EOR MD5TEMPB+5 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+10 EOR #$FF ORA MD5TEMPB+2 EOR MD5TEMPB+6 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+11 EOR #$FF ORA MD5TEMPB+3 EOR MD5TEMPB+7 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS I_DAB CLC ~B|D^A LDA MD5TEMPB+4 EOR #$FF ORA MD5TEMPB+12 EOR MD5TEMPB ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+5 EOR #$FF ORA MD5TEMPB+13 EOR MD5TEMPB+1 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+6 EOR #$FF ORA MD5TEMPB+14 EOR MD5TEMPB+2 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+7 EOR #$FF ORA MD5TEMPB+15 EOR MD5TEMPB+3 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS I_CDA CLC ~A|C^D LDA MD5TEMPB EOR #$FF ORA MD5TEMPB+8 EOR MD5TEMPB+12 ADC MD5TEMPV STA MD5TEMPV LDA MD5TEMPB+1 EOR #$FF ORA MD5TEMPB+9 EOR MD5TEMPB+13 ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5TEMPB+2 EOR #$FF ORA MD5TEMPB+10 EOR MD5TEMPB+14 ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5TEMPB+3 EOR #$FF ORA MD5TEMPB+11 EOR MD5TEMPB+15 ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS *Rotate left functions MD5RL LDA MD5TEMPV ;Rotate the 32-bit temp var left by one bit ASL STA MD5TEMPV LDA MD5TEMPV+1 ROL STA MD5TEMPV+1 LDA MD5TEMPV+2 ROL STA MD5TEMPV+2 LDA MD5TEMPV+3 ROL STA MD5TEMPV+3 LDA MD5TEMPV ;Take high bit and wrap around; ADC #0 ; add it to empty position in lowest byte STA MD5TEMPV RTS * This is somewhat sloppy but it works * It should be optimized to use full byte shifts when possible. MD5RL7 LUP 7 JSR MD5RL --^ RTS MD5RL12 LUP 12 JSR MD5RL --^ RTS MD5RL17 LUP 17 JSR MD5RL --^ RTS MD5RL22 LUP 22 JSR MD5RL --^ RTS MD5RL5 LUP 5 JSR MD5RL --^ RTS MD5RL9 LUP 9 JSR MD5RL --^ RTS MD5RL14 LUP 14 JSR MD5RL --^ RTS MD5RL20 LUP 20 JSR MD5RL --^ RTS MD5RL4 LUP 4 JSR MD5RL --^ RTS MD5RL11 LUP 11 JSR MD5RL --^ RTS MD5RL16 LUP 16 JSR MD5RL --^ RTS MD5RL23 LUP 23 JSR MD5RL --^ RTS MD5RL6 LUP 6 JSR MD5RL --^ RTS MD5RL10 LUP 10 JSR MD5RL --^ RTS MD5RL15 LUP 15 JSR MD5RL --^ RTS MD5RL21 LUP 21 JSR MD5RL --^ RTS *Get data from input block and add it to temp variable MD5ADDX ASL ASL CLC ;It better not be greater than 16 anyway! TAX LDA MD5BUFR,X ADC MD5TEMPV STA MD5TEMPV LDA MD5BUFR+1,X ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5BUFR+2,X ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5BUFR+3,X ADC MD5TEMPV+3 STA MD5TEMPV+3 RTS *Get next element from table and add it to temp variable NEXT_T LDX MD5TP CLC LDA MD5T+3,X ;reverse byte order ADC MD5TEMPV STA MD5TEMPV LDA MD5T+2,X ADC MD5TEMPV+1 STA MD5TEMPV+1 LDA MD5T+1,X ADC MD5TEMPV+2 STA MD5TEMPV+2 LDA MD5T,X ADC MD5TEMPV+3 STA MD5TEMPV+3 INX INX INX INX STX MD5TP RTS * MD5 Sine Constants * The following is the 64-element MD5 table T[1 ... 64] constructed from * the sine function. Let T[i] denote the i-th element of the table, which * is equal to the integer part of 2^32, or 4294967296, times abs(sin(i)), * where i is in radians. * * Sorry, Colin, no occult messages here. :) * These need to be re-arranged to LSB-first * (which is done by the NEXT_T subroutine) MD5TP HEX 00 ;Pointer to current element in table below MD5T * /* Round 1 */ HEX D76AA478 ; /* 1 */ HEX E8C7B756 ; /* 2 */ HEX 242070DB ; /* 3 */ HEX C1BDCEEE ; /* 4 */ HEX F57C0FAF ; /* 5 */ HEX 4787C62A ; /* 6 */ HEX A8304613 ; /* 7 */ HEX FD469501 ; /* 8 */ HEX 698098D8 ; /* 9 */ HEX 8B44F7AF ; /* 10 */ HEX FFFF5BB1 ; /* 11 */ HEX 895CD7BE ; /* 12 */ HEX 6B901122 ; /* 13 */ HEX FD987193 ; /* 14 */ HEX A679438E ; /* 15 */ HEX 49B40821 ; /* 16 */ * /* Round 2 */ HEX F61E2562 ; /* 17 */ HEX C040B340 ; /* 18 */ HEX 265E5A51 ; /* 19 */ HEX E9B6C7AA ; /* 20 */ HEX D62F105D ; /* 21 */ HEX 02441453 ; /* 22 */ HEX D8A1E681 ; /* 23 */ HEX E7D3FBC8 ; /* 24 */ HEX 21E1CDE6 ; /* 25 */ HEX C33707D6 ; /* 26 */ HEX F4D50D87 ; /* 27 */ HEX 455A14ED ; /* 28 */ HEX A9E3E905 ; /* 29 */ HEX FCEFA3F8 ; /* 30 */ HEX 676F02D9 ; /* 31 */ HEX 8D2A4C8A ; /* 32 */ * /* Round 3 */ HEX FFFA3942 ; /* 33 */ HEX 8771F681 ; /* 34 */ HEX 6D9D6122 ; /* 35 */ HEX FDE5380C ; /* 36 */ HEX A4BEEA44 ; /* 37 */ HEX 4BDECFA9 ; /* 38 */ HEX F6BB4B60 ; /* 39 */ HEX BEBFBC70 ; /* 40 */ HEX 289B7EC6 ; /* 41 */ HEX EAA127FA ; /* 42 */ HEX D4EF3085 ; /* 43 */ HEX 04881D05 ; /* 44 */ HEX D9D4D039 ; /* 45 */ HEX E6DB99E5 ; /* 46 */ HEX 1FA27CF8 ; /* 47 */ HEX C4AC5665 ; /* 48 */ * /* Round 4 */ HEX F4292244 ; /* 49 */ HEX 432AFF97 ; /* 50 */ HEX AB9423A7 ; /* 51 */ HEX FC93A039 ; /* 52 */ HEX 655B59C3 ; /* 53 */ HEX 8F0CCC92 ; /* 54 */ HEX FFEFF47D ; /* 55 */ HEX 85845DD1 ; /* 56 */ HEX 6FA87E4F ; /* 57 */ HEX FE2CE6E0 ; /* 58 */ HEX A3014314 ; /* 59 */ HEX 4E0811A1 ; /* 60 */ HEX F7537E82 ; /* 61 */ HEX BD3AF235 ; /* 62 */ HEX 2AD7D2BB ; /* 63 */ HEX EB86D391 ; /* 64 */ From t.fenk at ino.de Thu Oct 9 12:48:59 1997 From: t.fenk at ino.de (Thorsten Fenk) Date: Fri, 10 Oct 1997 03:48:59 +0800 Subject: Internet Via Electric Lines? In-Reply-To: <199710081601.JAA15326@toad.com> Message-ID: <19971009210730.57072@nostromo.ino.de> Cees de Groot (cg at evrl.xs4all.nl) wrote : > In the Netherlands, every house is hooked to the natural gas network. I've > heard rumours about them guys testing literally blowing fiber into your > house through the gas pipes (hook fiber to a shuttle, let it loose - gas > pressure does the rest). Never heard how they're gonna do the steering on > junctions, though... That's not too difficult. There have small Robots for i.e. investigating Tubes with a Camera, sealing Leaks,etc. The smallest Tube Diameter they can reach with a Camera is 2,5 inch, given that there are no Curves. regards Thorsten -------------- next part -------------- A non-text attachment was scrubbed... Name: pgp00004.pgp Type: application/octet-stream Size: 464 bytes Desc: "PGP signature" URL: From aba at dcs.ex.ac.uk Thu Oct 9 13:04:30 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Fri, 10 Oct 1997 04:04:30 +0800 Subject: Defeating MITM with Eric's Secure Phone In-Reply-To: <199710091653.LAA14615@email.plnet.net> Message-ID: <199710091908.UAA00790@server.test.net> John Kelsey writes: > Adam Back writes: > [computationally infeasible jobs for MITMs] > I prefer to work on the more immediately useful problem: How can I > secure my use of the (very nicely done) Comsec secure phones using > existing infrastructure? I am concerned with the MITM voice > impersonation attack, since that's the easiest attack on the > system. We were discussing this problem before turning to talking about automated methods. I think Eric Blossom suggested this earlier on: > 1. Exchange PGP-encrypted e-mail establishing a set of > sixteen different words, labeled for 0..f in each direction. > Thus: > > 0. Dilbert 1. Alpha 2. Cable 3. Swordsman ... f. Marxist > > Now, the checksum reading is very hard to spoof. Suppose I > get 0x33f. I say ``My checksum is Swordsman Swordsman > Marxist, or 33f.'' It seems like a good solution. An interesting question might be how many times can you use the same table without starting to leak values. Perhaps it doesn't matter that much because the MITM can't exactly use brute force on the problem otherwise you will know he's there. He has to act non-passively to extract information. (Presuming the protocol exchanges part of the information hashed for the challenge is encrypted with the negotiated key). > Now, the problem with this is that it's too cumbersome. What would be nice would be able to have information on one sheet of paper which you could continue to use for lots of communications, without need for calculator, or computer, or more emailed tables. > The simplest way to do this seems to be to just exchange a > six-digit hex value as a one-time password for a given > secure phone call. This is done using PGP or some other > mail encryption package, and can legitimately be used to > exchange a long list of one-time passwords at once. Then, > use Windows' calculator application to add your one-time > password to the checksum. Thus: > > 1. I pull up Alice's latest encrypted e-mail, and get > today's phone password. > > 2. I open the Windows calculator, set it to View/Scientific > and hex mode, and type in the password (a six-digit hex > number) and ``+.'' > > 3. I call Alice, say hello, and push the ``SECURE'' button. > > 4. I type the six digit hex checksum into my calculator. > > 5. I read the first three digits of the result to her. She > reads the next three to me. I considered this approach (XOR and + function) earlier in this thread. I don't think it works because the functions are commutative. (Unless I'm missing some aspect of the system, perhaps the interlock... it's a while since I've read the protocols.) Here's why I think it doesn't work: We have Alice, Mallet and Bob. Alice & Bob exchange via email password 123456. The displayed digits of the hash of Alice/Mallet's DH parameters are: 222222. The displayed digits of Mallet/Bob's DH parameters are: 333333. Alice computes 123456 + 222222 = 345678; Alice says to Mallet: "345" Bob computes 123546 + 333333 = 456789; Bob says to Mallet: "789" Mallet recovers the first 3 digits of the passphrase from what Alice said: 345 - 222 = 123 Mallet recovers the last 3 digits of the passphrase from what Bob said: 789 - 333 = 456 Mallet has recovered the passphrase and can now spoof Alice to Bob and Bob to Alice, he says: 456+222 = 678 to Alice, and 456+333 = 789 to Bob. Same story with XOR, only it's harder to compute. I think you need an encryption function. It depends on how many times you wanted to re-use the passphrase. The "encryption" function could be very weak for one use. For lots of uses you'd need a real encryption function. Problem is encryption functions aren't typically very easy to perform as mental arithmetic exercises; and non-programmable calculators don't help much. The table solution gets around this problem nicely, because it is a secure way of using a one time password. Possibly a relatively secure way of re-using that password even, if mallet has to become active to obtain information, and gets detected on occasions when he doesn't yet have sufficient information. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: > ENSURING SECURITY AND TRUST IN ELECTRONIC COMMUNICATION Sorry, I got the URLs wrong, and for some reasons the interesting parts of the summary got cut off. http://www.ispo.cec.be/eif/policy/97503exec.html ENSURING SECURITY AND TRUST IN ELECTRONIC COMMUNICATION Towards A European Framework for Digital Signatures And Encryption EXECUTIVE SUMMARY Introduction Open electronic networks such as the Internet are increasingly being used as a platform for communication in our society. They have the capacity to create new businesses, new channels of distribution and new methods of reaching the customer. They also open up opportunities to re-engineer business conduct itself. It is now largely expected that electronic commerce will be one of the key drivers for the development of the global information society. Electronic Commerce presents the European Union with an excellent opportunity to advance its economic integration by means of a "virtual" economic area. However, the realisation of such developments are hampered by the noticed insecurities typical to open networks: messages can be intercepted and manipulated, the validity of documents can be denied, personal data can be illicitly collected. As a result, the attractiveness and advantage of electronic commerce and communication cannot be fully exploited. In order to make good use of the commercial opportunities offered by electronic communication via open networks, a more secure environment needs to be established. Cryptographic technologies are widely recognised as essential tools for security and trust on open networks. Two important applications of cryptography are digital signatures and encryption. Several Member States announced their intentions to introduce specific regulation on cryptography and some already have done so. For instance, Germany and Italy already moved ahead with digital signature laws. In other Member States internal discussions are taking place, and some tend to refrain, at least for the moment, from any specific regulation at all. Divergent and restrictive practices with regard to cryptography can be detrimental to the free circulation of goods and services within the Internal Market and hinder the development of electronic commerce. The European Union simply cannot afford a divided regulatory landscape in a field so vital for the economy and society. The main objectives of this Communication are to develop a European policy in particular with a view to establishing a common framework for digital signatures, ensuring the functioning of the Internal Market for cryptographic services and products, stimulating a European industry for cryptographic services and products and stimulating and enabling users in all economical sectors to benefit from the opportunities of the global information society. As far as timing is concerned, the Commission considers that appropriate measures ought to be in place throughout the Union by the year 2000 at the latest. As a consequence, the Commission intends to come forward with detailed proposals in 1998 after the assessment of comments on this Communication. This is in line with the April 1997 adopted Communication on Electronic Commerce, where the Commission announced the intention to prepare a policy aiming at guaranteeing the free movement of encryption technologies and products, as well as to propose a specific initiative on digital signatures. Digital Signatures Some Member States are in the process of introducing voluntary schemes, others of mandatory licensing schemes to build trust in Certification Authorities (CAs) and to encourage legal recognition of digital signatures. Whilst the development of a clear framework is welcomed, different national regulatory approaches and the lack of mutual recognition of each others regulatory requirements may easily lead, due to the inherent cross-border nature of digital signatures, to a fragmentation of the Internal Market for electronic commerce and on-line services throughout the Union. In order to stimulate electronic commerce and the competitiveness of the European industry as well as to facilitate the use of digital signatures across national borders, a common legal framework at Community level is urgently needed. Any regulation in the field of digital signatures must meet two main requirements: create a clear framework to build trust in digital signatures on one side and be flexible enough to react to new technical developments on the other side. Encryption Stimulated by the rapid expansion of the Internet encryption will become an integral part of personal and business computing. Electronic commerce as well as many other applications of the information society will only receive acceptance and will only unfold their economic and social benefits if confidentiality can be assured in a user-friendly and cost-efficient way. In open networks, encryption of data is very often the only effective and cost-efficient way of protecting confidentiality of data and communications. Law enforcement authorities and national security agencies are concerned that wide-spread use of encrypted communication will diminish their capability to fight against crime or prevent criminal and terrorist activities. For this reason, there are reflections in several Member States to establish regulation on cryptography, in addition to controls on export and intra-Community shipments. This has led to a discussion about the need, technical possibilities, effectiveness, proportionality and privacy implications of such regulations. However, nobody can be effectively prevented from encrypting data (criminals or terrorists also can use encryption for their activities), e.g. by simply downloading strong encryption software from the Internet. As a result restricting the use of encryption could well prevent law-abiding companies and citizens from protecting themselves against criminal attacks. It would not however prevent totally criminals from using these technologies. Proposals for regulation of encryption have generated considerable controversy. Industry expresses major concerns about encryption regulation, including key escrow and key recovery schemes. Although there is a lack of experience, as electronic communication and commerce have just begun to penetrate economy and society, this Communication makes some assessments to build a common European understanding of the subject. Policy actions in the area of digital signatures The at European level urgently needed framework should include common legal requirements for CAs (in particular common requirements for the establishment and operation of CAs) allowing certificates to be recognised in all Member States. In addition, the Commission will monitor the legal developments in Member States introducing new legislation with the aim to respect Internal Market principles and will encourage Member States to rapidly implement appropriate measures to build trust in digital signatures. In order to achieve as wide as possible acceptance of digital signatures Member States should co-ordinate activities to ensure legal recognition of digital signatures at the latest by the year 2000. The Commission will evaluate the necessity to provide for the legal recognition of digital signatures at Community level by harmonising different national regulation (e.g. form requirements, evidence rules). The Community and Member States should take part in or initiate a dialogue with international organisations, such as the OECD, the United Nations and the WTO, notably to establish common technical standards and mutual recognition of regulations. Policy actions in the area of encryption The EC Treaty and the Treaty on the European Union fully respect the competence of Member States with regard to national security and law enforcement. To ensure that the development of electronic commerce in the Internal Market is not hindered and to facilitate the free circulation and use of encryption products and services the Commission calls upon Member States to avoid disproportionate restrictions. Moreover the Commission will examine whether restrictions are totally or partially justified, notably with respect to: * the free circulation provisions of the Treaty, in particular Articles 30, 36, 52, 56 and 59, * the principle of proportionality, * the Council Directive 83/189/EEC of 28.3.1993 laying down a procedure for the provision of information in the field of technical standards and regulations and * the EU Directive 95/46/EC of 24.10.95 on the protection of personal data. The Commission also believes that it will be important for Member States to distinguish "digital signature services" from "encryption services", because different rules and different goals separate these two aspects. Additional measures: * Adapting the Dual Use Regulation (CE) 3381/94 in view of the requirements for the cryptographic products market; * Improving the co-operation of police forces on a European and international level; * Working towards international agreements between the Community and other countries because of the global dimension of electronic communications and commerce. Accompanying measures * Encouraging industry and international standards organisations to develop interoperable technical and infrastructure standards for digital signatures and encryption to ensure secure and trustworthy use of networks. * Proposal of a Council and Parliament Decision for an INFOSEC II programme building on the INFOSEC programme carried out from 1992 until 1994. Such a programme would aim at developing overall strategies for the security of electronic communications, in particular with a view to provide the user with appropriate protection systems. * Continuing of the current projects in the field of digital signatures and encryption within the 4th framework programme for Community activities in the field of research and technological development (1994 - 1998) and launching of new projects within the 5th framework programme (1998 - 2002). * Support of the use of digital signatures and encryption in EU services and government administrations. * Setting up of an European Internet-Forum in 1997 as a means to inform and exchange information on the regulatory and use aspects of digital signatures and encryption. * Organisation of an international hearing on "digital signature and encryption" beginning of 1998. Timeframe 4.Q./1997: European Internet-Forum 4.Q./1997: Commission proposal to amend the Dual-Use Regulation 1.Q./1998: International hearing 1.Q./1998: Assessment of the comments on the Communication, the results of the Internet-Forum and the international hearing 2.Q./1998: Proposal for further action (e.g. Directive on digital signatures) 2.Q./1998: Proposal for an Infosec II programme 1998-2002: Projects within the 5th framework programme by 2000: Common framework on cryptography put in place throughout the Union From dlv at bwalk.dm.com Thu Oct 9 13:26:43 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Fri, 10 Oct 1997 04:26:43 +0800 Subject: Where is _my_ blowjob? In-Reply-To: <199710091622.LAA17373@wire.insync.net> Message-ID: <3iNBee2w165w@bwalk.dm.com> Eric Cordian writes: > The press continues to harp on the "murder suspect was abused" and > "parents rights foiled by the system" aspects of the case, to the > exclusion of the possibility that he is only in jail because the police > wanted to screw him, or that the murder was committed in a blind fit of > rage as a result of his manipulation at the hands of various authority > figures. I think the 15-y-o did not kill the 11-o-y. I think Chris Lewis did it. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From travmail at MICROSOFT.com Thu Oct 9 13:44:56 1997 From: travmail at MICROSOFT.com (Travel Group Email Account) Date: Fri, 10 Oct 1997 04:44:56 +0800 Subject: Identical Password and Member ID Message-ID: <316D29A34DA2CF11862000805F388D4C02784F2D@RED-30-MSG.dns.microsoft.com> Dear Joe, Our records show that your Expedia account contains a member ID and password that are identical. While we understand that this makes it simpler for you to remember them, we are now asking our members to create passwords that do not match their member ID's. We appreciate your assistance in this small change, which increases the security of your account. You can change your password by following these steps: 1. Access your Expedia Member Information http://expedia.msn.com/pub/signup.dll?qscr=uupd 2. Click Continue on the Expedia sign in screen. 3. If prompted, enter current member ID and password, and then click Continue. 4. Click Continue on the secure sign in screen. 5. Follow instructions for section labeled 3 of 6: Password. 6. Click Continue. Thank you for using Expedia. Please feel free to contact us if you have any questions. From BIZ-BEST at profits.com Fri Oct 10 04:58:41 1997 From: BIZ-BEST at profits.com (BIZ-BEST at profits.com) Date: Fri, 10 Oct 1997 04:58:41 -0700 (PDT) Subject: ANY OF YOUR ANSWERS YES? Message-ID: <50992948_56182062> Hello, I read your profile and thought that the following would be of interest to you. You are not on a mailing list so if this does not interest you there is no need to reply. Any of Your Answers Yes? Want to: >Legally slash your business/personal taxes drastically? >Protect any & all assets from any form of judgement? >Learn how to preserve your personal privacy? >Create a 6 figure income in the next 4-6 months? Any of Your Answers No? >Do you know how to make your "nest egg" work 3-5 times harder for you? >Do you know how to set up off shore trusts and protect your owned property from liens & levies? >Can you legally shelter all assets from all Taxes? Find out more and learn how to accomplish all of these by calling: 1-800-497-1799 (24 hr. recorded message) From aba at dcs.ex.ac.uk Thu Oct 9 14:21:45 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Fri, 10 Oct 1997 05:21:45 +0800 Subject: Secure Phone: Making man in the middle audible. In-Reply-To: <199710091831.LAA06017@proxy3.ba.best.com> Message-ID: <199710092112.WAA01188@server.test.net> James Donald writes: > Suppose that Bob's computer from time to time formulates a plan to > do groups of a particular size and form, and sends Ann's computer a > hash of that plan and the DH negotiated shared secret. > > So malloc must decompress Bob's speech packets, repacketize them, > and recompress them, > > Often he will not be able to send off a packet, until he has received > two of Bob's packets. > > So this triples the delay, and increases the speech degradation. Good. Sounds as though this could work. Much better than my stego ramblings. One minor point: if I was Mallet faced with the problem your solution presents the MITM with I would compose a plan which used a whole row of minimum sized packets (or small upward random variations). That would minimise the chance that I would have to wait to compose packets. Clearly you can fix this: you can insist on a certain standard deviation, or whatever as part of the protocol. Another point is that you are making the unstated assumption that you can't stream packets. That is, you are assuming that you must receive the whole packet before you can start to resend decoded and re-encoded. Perhaps this is already the case anyway, I don't know much about audio compression algorithms or codecs. Eric can tell us whether this will already be the case for his algorithm set. If not, I think it should be easy enough to enforce this property (immediate solution which comes to mind: send the bits in a packet backwards!) I'm wondering also whether you couldn't generalise the sort of stretched interlock protocol which is going on here, with in your solution the readers ears telling him something is wrong, to come up with something where the firmware in Eric's fine box could detect and just flip out of secure mode, or flash the leds, or whatever in protest to indicate it had detected a MITM attempt. Perhaps what you have already is enough -- if the inter-packet delay gets longer than whatever you caculate as the highest possible time which could normally happen you flag MITM. If you can ensure that transatlantic delays are lower than the delays MITM will introduce with this protocol, you've got it covered. Being paranoid, I still see a couple of dangers: - if the packets are quite small you may be able to have a neural net setup fill in the gaps when the packets lengths arrive awkwardly for the MITM without it sounding too strange. - there is no guarantee of real-time, you can make something sound like it is coming in real time when it has lag. For example: if you insert some throat clearing, or ponderous "errr". Some peoples speech patterns are that way already. This second one causes me to suggest that you'd be safer to have the box detect the MITM induced lag if you can, rather than rely on human ears. I'm going to think on this some more. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 I know this is probably like preaching to the choir, but I remember Freeh recently saying that there were no significant losses of software exportation to foreign software companies. Well he is obviously ignorant or lying through his teeth. I'm about to recommend a software purchase from a foreign software company that might exceed #300k. Is that on Freeh's radar yet? Mind you, I don't care where people get their software, but if Freeh is trying to calm the America Firsters by saying that crypto imports aren't important I think someone is congress ought to be informed. Declan? You're still out there in the pit of vipers. Why don't you tell them. My congressman doesn't seem to listen to me. "How do you explain school to higher intelligence?" Elliot to his brother in ET From jamesd at echeque.com Thu Oct 9 16:13:15 1997 From: jamesd at echeque.com (James A. Donald) Date: Fri, 10 Oct 1997 07:13:15 +0800 Subject: What's really in PGP 5.5? Message-ID: <199710092259.PAA13153@proxy3.ba.best.com> At 02:27 PM 10/7/97 -0700, Jon Callas wrote: [Explaining PGP's rather alarming "data recovery" features.] > Well, that's mostly all it is. There are other bits of the system. For > example, if I look up Alice's key on a key server and Alice has a recovery > key, I get Alice's recovery key, too. If Alice's recovery key is a "please > use" key, then I can encrypt to Alice alone. In any case, the PGP software > tells me that Alice has a recovery key, so I can decide to use some other > mechanism to talk to her. Sending a copy to the boss of everything Alice sends is OK. If Alice wants to send something her boss should not read, perhaps she should use her private account, rather than a company paid account. Sending a copy of everything Alice receives to the boss or HR is not OK. Alice should get to control it. It would be acceptable for the company system to keep track of what Alice has received, and flag "Alice received something, and has not yet filed the cleartext copy with us" It is not acceptable to just plain snoop on what Alice receives. > Note that design satisfies the opt-in and fair-warning requirements. Also, > since Alice's recovery key is an attribute of her self-signature, she can > change it. She can even have a second user name (let's call it Bob), that > has no recovery key. Alice needs finer granuality of control. The leakage to her boss primarily affects her, rather than the sender. Furthermore any auto-snoop feature sets a very dangerous precedent. It is politically a lot more difficult for the FBI to mandate that they can recover your data, if such a mandate leads to the message flashing up, "now sending a copy to the FBI" every time you decrypt something. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd at echeque.com From tcmay at got.net Thu Oct 9 17:31:06 1997 From: tcmay at got.net (Tim May) Date: Fri, 10 Oct 1997 08:31:06 +0800 Subject: America as a Shake Down Extortion State In-Reply-To: Message-ID: At 3:36 PM -0700 10/9/97, Jim Burnes wrote: >I know this is probably like preaching to the choir, but >I remember Freeh recently saying that there were no >significant losses of software exportation to foreign >software companies. > >Well he is obviously ignorant or lying through his teeth. > >I'm about to recommend a software purchase from a foreign >software company that might exceed #300k. Is that >on Freeh's radar yet? > >Mind you, I don't care where people get their software, but >if Freeh is trying to calm the America Firsters by saying >that crypto imports aren't important I think someone is >congress ought to be informed. > >Declan? You're still out there in the pit of vipers. Why >don't you tell them. My congressman doesn't seem to listen >to me. What Freeh meant is that "no major political campaign contributors" are losing business, at least not yet. What Netscape and Microsoft may be losing, not to mention what smaller companies may be losing, is of little concern to Clinton, Reno, Freeh, etc. Or even to the Republicans. Until Netscape, Microsoft, RSA, PGP, and C2Net become major contributors, or at least start showing proper respect to their Dons, they don't count. The way an extortion state works is like this: pressure is applied to various industries and groups to get them to contribute lobbyist money and campaign contributions to the various sides. (It almost doesn't matter which sides...) In most cases, the more absurd and ridiculous the law is, the more the lobbyists are incentivized to get their funders to kick in more bucks. The debate over crypto almost certainly fits this pattern. If and when a domestic ban on crypto is likely to pass and be signed, companies like RSA and PGP will face extinction. This will then "incentivize" executives of these companies to release funds, in the form of campaign contributions--either directly or through back channels--to the Republican and Democratic parties. Then a "compromise" will be found which lets RSA and PGP, as examples, survive. And they may also be given government business, with suitable GAK features made mandatory. Such has it always been in "democracies" like the Extorted States of America. So, in addition to the 40% of profits the high tech industry pays in taxes to various governments who demand tribute, they are also expected to kick in more bucks in campaign contributions, junkets to vacation spots, and so on. Only then is there any chance that laws will be modified to suit the highest bidder. Face it, Amerika is basically a Mafia shake-down operation, with the power of the State used to shake down protection money. This is why I favor crypto anarchy: by concentrating on ignoring laws and deploying technology, this extortion state system is bypassed. Also, the tax evasion aspects are poetic justice. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From webtech at lostvegas.com Fri Oct 10 09:04:06 1997 From: webtech at lostvegas.com (webtech at lostvegas.com) Date: Fri, 10 Oct 1997 09:04:06 -0700 (PDT) Subject: Free Email Software! Message-ID: <199710101604.MAA01503@trek.alliance.net> ////////////////////////////////////////////////////////////////////////// Advertising Secrets Exposed ! Are you having a difficult time trying to promote your business on the Internet? Have you posted classified ads with little or no response? Well, if you'd like to know something that you could use with your present business to make it Explode! I have the answer to your business growth problems. Free Email Software! Everybody's talking about Email Marketing! A gold mine for those who can take advantage of mass Email Marketing. Just imagine for a minute what this will mean to your business, being able to reach thousands of new propects daily, with no cost to you. We will give you a new software package called Freedom, absolutely Free, to use in your business. Now you will have, a do it yourself method of online advertising, that up till now only the professional Internet Marketer had access to. And have a powerful potential to target millions with simple click of your mouse. And if you need fresh Email addresses, we have them on, 3.5 IBM disk. The best prices on the Internet. 100,000 Addresses Oppty Seekers Only $29.95 Includes shipping and handling. 200,000 Addresses Oppty Seekers Only $39.95 Includes shipping and handling. 400,000 Addresses Oppty Seekers Only $49.95 Includes shipping and handling. And for the serious Internet Marketer, 25 million plus!! Our company has one of the largests databases on the Internet with over 25 million Email Addresses, these are split up in many different categories, and rotated frequently, giving you new addresses to choose from each time. This service allows you to access our database of Email Addresses as much as you want, from our website. All for only $199. No need to ever gather or purchase Email addresses again!! But because of our special internet promotion for the month of August only, you can purchase our E-Mail software program including 25 Million E-Mail addresses, and including full time tech support, telephone number, for only $99. for all orders received before Oct20/97 PRINT AND FILL OUT ORDER FORM BELOW Yes! Please Rush Me Fresh Email Addresses, And My FREE Email Software. Name______________________________________________________ Address____________________________________________________ City_________________________________State__________________ Zip____________________________Email________________________ Types Of Addresses Opportunity Seekers ( ) General ( ) 100,000 Addresses $29.95 Includes shipping&handling and Freedom Software. 200,000 Addresses $39.95 Includes shipping&handling and Freedom Software. 400,000 Addresses $49.95 Includes shipping$handling and Freedom Software. 25Million Addresses$99. From database Includes S&H and Freedom Software. And full time tech support, by telephone, for all orders received by Oct15/97 Freedom Software Only. Send $10. To cover S&H. IBM 3.5 Floppy disk. Bonus: Orders received before, Oct20/97 will receive another Software program Free, called "CHECKER" that allows you to receive checks by Fax, Email, and Phone. Sold over the Internet for $129. Free with your purchase of any or the above products! Never lose another impulse sale again, for lack of, a credit card, or the slowness of US mail. Plus another bonus for MLMERS, not only are we going to give "CHECKER" and FREEDOM to you, we will authorize you to give "FREEDOM and "CHECKER" to your entire Downline, to use " FREE" Just think what this will mean to your business, when you are able to give "FREEDOM" and "CHECKER" to your entire Downline to use, for Free, or use for an incentive for new recruits. Payment: Check ( ) Money Order ( ) Cashier's CK ( ) Other ( ) U.S Funds Send Order Form Along With Payment: To REV TECH MARKETING 2172 Kanoy ave Thomasville N.C 27360-8733 U.S.A. If you'd prefer not to receive any future mailings, just send an empty email to etech at ascella.net with remove me in the subject line. Mail End. From anon at anon.efga.org Thu Oct 9 19:07:10 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 10 Oct 1997 10:07:10 +0800 Subject: What's really in PGP 5.5? Message-ID: <1923cf26ae66f5dc8867599b0d394536@anon.efga.org> -----BEGIN PGP SIGNED MESSAGE----- Martin Minow claiming to be Martin Minow wrote: >Anonymous, claiming to be Monty Cantsin, writes about PGP 5.5: I beg your pardon! >>Decrypting files and decrypting messages are not the same problem. >>The PGP product has SMTP support - it is explicitly designed to >>weaken transmitted messages. Just like Clipper. > >No, it isn't "just like Clipper." Messages encrypted with PGP 5.5 >can be decrypted or verified by PGP 5.0 or other implementations that >can decode the PGP message and encryption format. Also, PGP 5.0 or other >complient implementations can send encrypted and signed messages to >PGP 5.5 users. Next you'll be telling us that PGP doesn't really use Skipjack. ;-) _Of course_ it isn't Clipper. But, it's like Clipper in the most important way: it is surveillance friendly. The use of Clipper was not compelled. We hated it because if it were used to any degree at all, its use would become mandatory. PGP Inc.'s Big Brother line of products play the same role Clipper did, only they are wrapped up in PGP Inc.'s "Good Guy" image. PGP Inc. may succeed where William Clinton and The Spooks failed. Were we to behave consistently, we would treat the company with the same level of trust and respect the present administration receives. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBND1+KpaWtjSmRH/5AQFTTwf7B6QO8I0yqQobsoUlW5AZxxXH4Tya/pwd 3hAZs//Y1gKyVEX6nW9dE3sDVAW8GBK489S4TMWemdbtfgeq7EaiV0D5QcLcAXst Iqz/WIKxpXjJ5+DjPV2CP6v6zd2XGIa7y3G0BKXglLZh5X7EkiRbJ6c8aixgAk6n 2nFKDqyp53mpmqTPm7xQbpYni5CtQ8Ljq/m+m4LP1hN05OYR8ZWJRz7hqrWvU+5A zw0xagCgPOKZZMZNS7sW+xGwVezsLis9KMZvsB1Paq4s8+geNlFr73vDwlM9SROI KxCfJnpr/sLG3x3Mtbv8Y0vhErTsZ2Pu4HnazVdjelh+r6O67v3TQQ== =JUfQ -----END PGP SIGNATURE----- From jya at pipeline.com Thu Oct 9 19:10:42 1997 From: jya at pipeline.com (John Young) Date: Fri, 10 Oct 1997 10:10:42 +0800 Subject: America as a Shake Down Extortion State Message-ID: <1.5.4.32.19971010015455.00b9450c@pop.pipeline.com> Tim May wrote: >The debate over crypto almost certainly fits this pattern. If and when a >domestic ban on crypto is likely to pass and be signed, companies like RSA >and PGP will face extinction. This will then "incentivize" executives of >these companies to release funds, in the form of campaign >contributions--either directly or through back channels--to the Republican >and Democratic parties. Then a "compromise" will be found which lets RSA >and PGP, as examples, survive. And they may also be given government >business, with suitable GAK features made mandatory. Netscape has just been awarded a major contract with the Department of Defense for "secure" browsers, with options for "annual renewals." One of the best ever for NSCP. This is a public deal, as distinguished from the secret others pointed to in mandatory public notices in the Federal Register of meetings closed for national security by the Defense Science Boards, the National Defense Panel, and a welter of mil/gov advisory groups composed of members from industry, education and policy orgs eager to get advance word of market and contribution opportunities. From anon at anon.efga.org Thu Oct 9 19:11:38 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 10 Oct 1997 10:11:38 +0800 Subject: Applying ``Crowds'' idea to anonymous e-cash. Message-ID: <1cce1b1e16a2b155d266ad70e94abd78@anon.efga.org> Lucky Green wrote: >On Thu, 9 Oct 1997, John Kelsey wrote: >> Crowds, for those who haven't seen it, is a way of giving web users >> partial anonymity by making it impossible to determine which member >> of some ``crowd'' of users did some action (such as requesting a >> document). (This is a very rough summary--read the paper for the >> real analysis.) > >Some people from MSFT proposed a similar concept at FC'97. As for its >real life value, the legal term for such a system is "conspiracy". Almost everything we do could be called "conspiracy". John has a good idea here. Let's give it room to grow. From randerso at ece.eng.wayne.edu Thu Oct 9 20:30:14 1997 From: randerso at ece.eng.wayne.edu (Ryan Anderson) Date: Fri, 10 Oct 1997 11:30:14 +0800 Subject: America as a Shake Down Extortion State In-Reply-To: Message-ID: <3.0.2.32.19971009231954.0069d338@ece.eng.wayne.edu> -----BEGIN PGP SIGNED MESSAGE----- >The debate over crypto almost certainly fits this pattern. If and when a >domestic ban on crypto is likely to pass and be signed, companies like RSA >and PGP will face extinction. This will then "incentivize" executives of >these companies to release funds, in the form of campaign Actually, I think it's a little more likely that they'll get disgusted with Congress, and collect some money for the ACLU to use to pay their lawyers in the instant filing of the consitutionality challenge. Seems to be a much more productive way to spend your money (long-term). -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBND2e2Tc3ytqHnNyNAQFo5gP8CuQ0p5GF3nLjQJUrmOf1Z2sjzbjVosI7 RRegk+nKA6EAaUozCJxTVTAfol2WbOiLNAW7UN4fOPKYxt8mjalLAEhKBNYyH+jf vxwmOX6JXHNYqAIz3CZ0ucZYShrwrS+2LvWamwmjaknnP45C+pBSBwm2bA93/0uo 6s8zgIqsLCQ= =D6cb -----END PGP SIGNATURE----- ----------------------------------------------------------------------- Ryan Anderson - "Who knows, even the horse might sing" Wayne State University - CULMA "May you live in interesting times.." randerso at ece.eng.wayne.edu PGP Fingerprint - 7E 8E C6 54 96 AC D9 57 E4 F8 AE 9C 10 7E 78 C9 ----------------------------------------------------------------------- From anon at anon.efga.org Thu Oct 9 20:33:59 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 10 Oct 1997 11:33:59 +0800 Subject: Defeating MITM with Eric's Secure Phone Message-ID: -----BEGIN PGP SIGNED MESSAGE----- My apologies if this has already been discussed, but wouldn't this be a straightforward solution? Alice and Bob use PGP as a secure, identified channel to exchange a random 6 digit hex number. For example, 0xC926D0. When they establish their Comsec connection, they read 0x5F92E4 off their units. Alice takes the digits C, 9, and 2, and adds them mod 16 to 5, F, and 9 to get the digits 1, 8, and B, which she reads to Bob who confirms them. (Adding just the digits instead of larger numbers means that Alice and Bob can do the computation in their heads.) Bob takes the digits 6, D, and 0 and adds them mod 16 to the digits 2, E, and 4 to get 8, B, and 4. Bob reads them to Alice who confirms them. Any flaws? Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBND2EZ5aWtjSmRH/5AQGBnQf/QRMe/66ge+M/zHzzrZ7zc3g9wFKESsjA alzeGfUulzp+18JyUy1RHNOtM+4bXZUaiYAN7FnxKkAkY+IzW5m7nDHMnC18e+bD IZpO626Ze+pumokhXVTYW0JHWF4OfCol4qmYNSTjM+n4RO0DcmecOuQYuwnscJvb 808rsuin09dhY3UV5uyDWrCwuATIRjwSRTewBinuTGZo/QtMurXJlPc45WtF07oC 9Tg3ebnnq0NtbxWmsX7WT/tjFHoniS5sPoBusrlZT+1z+PT0SzqtSR1JmWKGVQQC xubaghabXvNj9nZZPsEGCG4rMbJw8Qtoh9J6I+aQJ0TVK4hHuanJXw== =Ooh/ -----END PGP SIGNATURE----- From ravage at ssz.com Thu Oct 9 20:37:19 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 10 Oct 1997 11:37:19 +0800 Subject: Pipes & inodes ... redux (fwd) Message-ID: <199710100353.WAA20051@einstein.ssz.com> Forwarded message: > From: mhahn at tivoli.com (Mike Hahn) > Subject: Re: Pipes & inodes ... redux > Date: Thu, 9 Oct 1997 21:57:22 -0500 (CDT) > > > > As for as the "getting old" thread of Kenny Z's: > > > > Speaking of Kenny Z, did you know that Kenny G was majority > > stockholder of Starbucks? > > Man, you would think with all that coffee, he could play something better > than the crap he plays...Heck, Miles Davis and Charlie Parker survived on > Folgers for all we know... How about Robert Johnson....Terraplane Blues rules....;) Ravage Black Leather Monster From sunder at brainlink.com Thu Oct 9 20:40:51 1997 From: sunder at brainlink.com (Ray Arachelian) Date: Fri, 10 Oct 1997 11:40:51 +0800 Subject: What's really in PGP 5.5? In-Reply-To: Message-ID: On Wed, 8 Oct 1997, Anonymous wrote: > Second, what if an employee doesn't come back from vacation? You've got > messages sitting in his inbox which go back three weeks. All encrypted > to his personal key, which is gone. Shut up Kent, yes, we know it is you posting this rant. The above fails due to one single little key word "his personal key." If it is his personal key, then the business has no business reading his email. If it indeed is a corporate key you should have said so, and he - the employee could have arranged for his passphrased to be escrowed with the company's principals, if that wasn't done, the company is stupid and doesn't deserve to survive. > It's been long enough that the > senders may not have backups any more. It's all lost, and at best the > company is going to put its partners and customers to a great deal of > inconvenience by making them re-send everything they've sent in the last > three weeks, not to mention making the company look incompetent. Correction: not only will they look incompetent, but in reality this will prove that they are! Single point of failure in any system is something every company should consider. It's the same with filing taxes so the IRS doesn't come down on your head, making backups of your servers incase the hard drive crashes and buying all sorts of insurance. This is a stupid arguement. Go away. =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\. ..\|/..|sunder at sundernet.com|you once again. I thought you were |/\|/\ <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/ ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/. .+.v.+.|God of screwdrivers"|my eye and there we were.... |..... ======================= http://www.sundernet.com ========================== From nobody at REPLAY.COM Thu Oct 9 20:41:49 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 10 Oct 1997 11:41:49 +0800 Subject: Where is _my_ blowjob? Message-ID: <199710100334.FAA11247@basement.replay.com> Eric Cordian wrote: >His parents and the cops then tried to have him declared insane and >institutionalized, which didn't work. They also immediately arrested >his friend. The cops working on his case then phoned the team >investigating the murder of the younger boy, and gave his name to >them as a suspect. He was then arrested and jailed for that murder, >although no direct evidence linking him to the murder has been >released. A little confused here. Let's call the older man "Victor" and his fifteen year old friend "Harold". Neither of them were murdered, right? Let's call the murder victim "Norbert". "Harold" refused to rat out "Victor" and now the police are charging "Harold" with the murder of "Norbert". What is the relationship between "Harold" and "Norbert"? You say there is no direct evidence connecting them. What evidence does connect them? Did they at least know each other? >The press continues to harp on the "murder suspect was abused" and >"parents rights foiled by the system" aspects of the case, to the >exclusion of the possibility that he is only in jail because the >police wanted to screw him, or that the murder was committed in a >blind fit of rage as a result of his manipulation at the hands of >various authority figures. While "Harold" may not be guilty of the murder, if he did kill "Norbert" then he should probably be treated as a murderer. While the police should not harrass gays, such harrassment does not seem to make a good excuse for murdering an unrelated completely innocent third party. JusticeMonger From ravage at ssz.com Thu Oct 9 20:55:10 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 10 Oct 1997 11:55:10 +0800 Subject: The Sovereign Individual - ignorant authors Message-ID: <199710100412.XAA20204@einstein.ssz.com> Hi, Finaly getting back to reading some more of the book [1], Chpt. 9 in particular. This chapter deals with various aspects of social issues (eg rise of national languages) and how they led to the growth of nationalism in general. Toward the end of the chapter (pp. 265 in the hardback) these idiots (don't know a better term) actualy have the audactity to claim that Stephen Jay Gould is a neo-creationist, in short they claim that Gould holds there is a 'higher power' (ie transcendance) directing evolution and the impact of inhereted traits on society. The author of this section has apparently never read a word that Gould has written. Gould is known as a leading supporter of Punctuated Equilibria and its various spawn, and with Ernst Meyr lead the battle against creationist theories and others of that ilk. Gould and Meyr's theories flatly reject transcendance as a force in evolutionary theory. Considering that no supporter of transcendance in evolutionary theory has ever succesfuly weathered a reasoned attack I simply stand in awe of the authors expectation of the readers ignorance. The more I read of this book the less respect I have for either author. I previously recommended this book as an intellectual challenge at least, I retract that recommendation. Don't waste your money on this drivel from a couple of snake oil salesmen who continously contradict themselves and pose flawed theory after flawed theory. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| [1] The Sovereign Individual: How to survive and thrive during the collapse of the welfare state J.D. Davidson, Lord W. Rees-Mogg ISBN 0-684-81007-7 From ravage at ssz.com Thu Oct 9 21:01:32 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 10 Oct 1997 12:01:32 +0800 Subject: Pipes & inodes ... redux (fwd) [oops] Message-ID: <199710100413.XAA20243@einstein.ssz.com> Forwarded message: > From: Jim Choate > Subject: Re: Pipes & inodes ... redux (fwd) > Date: Thu, 9 Oct 1997 22:53:50 -0500 (CDT) Sorry, that was meant for a completely different set of readers. I hit the wrong key. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From wealthy at profit.com Fri Oct 10 12:53:11 1997 From: wealthy at profit.com (wealthy at profit.com) Date: Fri, 10 Oct 1997 12:53:11 -0700 (PDT) Subject: hey! Message-ID: <653439045634ADR46591@com> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 36 Year Old Man Discovers How To . . . . . GET $500 IN YOUR HANDS As Soon As Next Week! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The truth is stranger than fiction..."How I Make $200.00 A Day, Sitting At My Kitchen Table, In My Underwear!" A COMPLETELY DIFFERENT APPROACH TO "NETWORK MARKETING" TOOK ME FROM BROKE TO $200.00 A DAY,WORKING FROM HOME,IN ONLY A FEW MONTHS - AND I'M CONVINCED ANYBODY CAN COPY WHAT I'M DOING! (Why would any sane person reveal this kind of secret, if it was true? Read my message and find out.) I'm 36 years old. My wife and I have 3 boys, all terrors. We live in the suburbs. I'm writing this article, sitting at my kitchen table in my boxer shorts and a T-shirt; I have achieved the "fantasy" of making a ton of money from my own successful home-based business. I know it'll be tough for you to believe that you can do what I'm doing. But I hope you'll give me a chance. I may just be the guy to change your life around in a big, big way. IF YOU HAD TOLD ME A YEAR AGO THAT I'D BE WRITING ANYTHING LIKE THIS, I'D HAVE LAUGHED IN YOUR FACE - BUT HERE I AM. There is nothing more rewarding and fulfilling than owning and operating your own sucessful business. No where else on Earth can you get this kind of independence, security and freedom. Work when you want to work. Earn what you want to earn . . . You Can Have All This and MORE With Oour System - NOW! With this system you are PROTECTED BY A SIMPLE GUARANTEE. And I would be an idiot to risk ruining a $ 20,000-A-MONTH business to steal pocket change from you. Wouldn't that be incredibly stupid? So here's my guarantee to you: If you aren't 100% satisfied after receiving your first check, you can just return your check and your membership package and I will gladly refund your money! I simply will not have an unhappy member! The bottom line is I want you to be as successful as I am. I want you to make moeny. I want you to get handfuls of checks. And I wanna see the look on your banker's face when you shove an envelope full of checks into his face!!! I want to help you overcome all the obstacles. I want to teach you the "jealously guarded" secrets. I want to get YOU started with the network marketing company of the 21st century!!! With this fast-growing company.... * You don't have to recruit friends and family! * You don't have to wonder what to do! They maintain a professional staff of over 50 trained marketing consultants equipped to answer any and all questions and fully explain this wonderful opportunity to your prospect's satisfaction (and your banker's delight!) * You don't have to send out millions of letters! * You don't have to call prospects on the phone! * Your only job is to promote a toll-free 800 number! And if you can do this simple thing, YOU can make YOUR FORTUNE! Forget all the hooplah: the "rich" are not going to bear the burden of all the new taxes needed to cover social security shortfalls,healthcare,etc. - it's the middle class, middle income "wage slave' they have their sights on. YOU are the target. The only real way to fight back is to make so much darned money that what you have AFTER the damage is still fantastic. That's where I am. A whole lot of people join but never do anything about it, and I can't help that. But there ARE people just like you, who join, and then go on to make VERY big incomes. IT'S UP TO YOU. You can sit there and watch helplessly as Washington chews up your take home pay...or you can chase a silly pie-in-the-sky idea get rich quick scheme... or you can let me teach you a proven, truly practical way to jump up to such a HUGE INCOME that you can sit back and laugh at the politicians.Which is it going to be? Take action NOW!!! Make the call, sign up and... WE'LL MAKE A FORTUNE TOGETHER! 1-800-811-2141 (Mon - Sat) give them Code# 26589 After you join they'll send me your code # and contact info. I will send you an EXTENSIVE marketing package that details all the secrets of network marketing! Questions? Call 1-800-811-2141 , give them code #26589 . . They will be happy to answer any questions you may have! After all, we're on the same team! After you get your code number, I'll be contacting you! Not sure if you're gonna call? Well, you can turn your back on me right now and ignore everything I've said - but why? Maybe my system can free you from money worries and day-to-day-drudgery forever. FIND OUT NOW! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1-800-811-2141 (Mon - Sat) give them Code# 26589 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I was given your name as someone likely to be interested in becoming wealthy. If this was an error, please send me an email at: stopmail at answerme.com You will be put on a list of those who do not wish to become financially independant. Thanks again! From frantz at netcom.com Thu Oct 9 21:57:29 1997 From: frantz at netcom.com (Bill Frantz) Date: Fri, 10 Oct 1997 12:57:29 +0800 Subject: Defeating MITM with Eric's Secure Phone In-Reply-To: <199710091653.LAA14615@email.plnet.net> Message-ID: At 12:08 PM -0700 10/9/97, Adam Back wrote: >John Kelsey writes: >> Adam Back writes: >> [computationally infeasible jobs for MITMs] >> I prefer to work on the more immediately useful problem: How can I >> secure my use of the (very nicely done) Comsec secure phones using >> existing infrastructure? I am concerned with the MITM voice >> impersonation attack, since that's the easiest attack on the >> system. > >We were discussing this problem before turning to talking about >automated methods. I think Eric Blossom suggested this earlier on: > >> 1. Exchange PGP-encrypted e-mail establishing a set of >> sixteen different words, labeled for 0..f in each direction. >> Thus: >> >> 0. Dilbert 1. Alpha 2. Cable 3. Swordsman ... f. Marxist >> >> Now, the checksum reading is very hard to spoof. Suppose I >> get 0x33f. I say ``My checksum is Swordsman Swordsman >> Marxist, or 33f.'' > >It seems like a good solution. An interesting question might be how >many times can you use the same table without starting to leak values. >Perhaps it doesn't matter that much because the MITM can't exactly use >brute force on the problem otherwise you will know he's there. He has >to act non-passively to extract information. (Presuming the protocol >exchanges part of the information hashed for the challenge is >encrypted with the negotiated key). > >> Now, the problem with this is that it's too cumbersome. > >What would be nice would be able to have information on one sheet of >paper which you could continue to use for lots of communications, >without need for calculator, or computer, or more emailed tables. When I suggested using code words to exchange the checksum, I thought you would have to use them in one-time-pad mode to be secure. The following argument makes me think you can reuse them several times, changing them at about the same rate as you would change a symmetric crypto key. Assume that the contents of the paper are secret between Alice and Bob. When Alice calls Bob, she reads the word coresponding to the first digit of the checksum. Either Mallory is in the middle or he isn't. If he isn't, no problem. The word list remains secure. If he is in the middle, he has 15 chances in 16 of being caught on the first exchange. He only survives if the first digit of the Alice-Mallory connection is the same as the first digit of the Mallory-Bob connection. He now knows the word for one value and can continue to play 1 out of 16 times. The probability he can survive the next word that Bob reads to Alice is harder to calculate. He can survive if the second digit of the Mallory-Bob connection is the same as the second digit of the Alice-Mallory connection, or the second digit of the Alice-Mallory connection is the same as the first digit on that connection. Without doing the math, Mallory's survival probability becomes very small as the exchange continues. If Alice and Bob catch Mallory, they talk about the weather and exchange a new list by email. If they don't, there is a very high probability that the word list has not been compromised, and they can safely continue to use it for the next call. BTW - I really like John's idea of doing another exchange later in the conversation. Perhaps something like, "You know, I was dancing the Foxtrot with my wife 9 days ago at 5AM." ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz at netcom.com | nation it is today. | Los Gatos, CA 95032, USA From snow at smoke.suba.com Thu Oct 9 23:08:18 1997 From: snow at smoke.suba.com (snow) Date: Fri, 10 Oct 1997 14:08:18 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: Message-ID: <199710100559.AAA00846@smoke.suba.com> > Maybe you haven't noticed, but seen on 2000 year scales, the entire world > is constantly in a state of war. Europe isn't special in that regard. Even > though it doesn't look like there's many countries that are about to take > war to us here, it still might happen. And even if I had my AR15 then, it > wouldn't help me a lot against guided missiles and mortar fire. And anyway, This statement shows you know nothing about warfare execpt what you see on TV. > "to defend yourself in a war" is not one of the usual arguments against gun > control. No, but "To defend yourself against Government Thugs" is. > > You must be getting some good drugs over there to conjure up this fantasy > > land where everyone loves one another and would never think of killing > > someone because it sure as hell doesn't exist in Europe. > Well, we're a lot closer to it over here than you guys are over there. Stalin. Hitler. Bosnia. Yup. Lots closer. From snow at smoke.suba.com Thu Oct 9 23:14:11 1997 From: snow at smoke.suba.com (snow) Date: Fri, 10 Oct 1997 14:14:11 +0800 Subject: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: Message-ID: <199710100607.BAA00869@smoke.suba.com> > On Wed, 1 Oct 1997, Alex Le Heux wrote: >>You people just don't get it do you? A gun has one purpose: To kill. Just like >>any other tool, a gun, if it is available _will_ be used at some point. > >>So making sure there are lots of guns around only serves to make a lot of >>people very dead. This is a Bad Thing. > I agree wholeheartedly. Uncontrolled guns do not solve problems, they > create them. If most households have at least one firearm, it makes it Name one problem that you have with "uncontrolled" guns that you don't with controlled ones. > that much easier for a criminal to obtain one by stealing yours while you > are at work. Not if it is with you. > Canada may be regulated to death according to most libertarians, but I for > one like it that way. I can walk alone and unarmed at night in Ottawa, > Toronto, etc. without fearing for my life. Can a female resident of > Washington or New York say the same? Our schools do not have metal detectors > at the entrances because they are not needed. Toronto has how many people? And the cultural mix is? > IMNSHO the best way to fight crime is not with bigger guns than the "bad > guys", but with better social programs such as universal health care, and > improved day care so single parents can show their kids what a productive Crap. The kind of crime that guns stop isn't the kind solved with "better social conditions". Rape has nothing to do with how much money _either_ person makes. Muder rarely does. If you can't see this, then you have your head firmly up your governments ass. Stop and take a hard look at who kills who with guns and why. > lifestyle looks like. This takes longer than blowing the brains out of some > teenager that feels his only path to a better life is through crime, and it > doesn't give the same adrenalin rush. However, it works at the source of > crime, and not the consequences. You may know a bit about crypto, but you don't know a god damn thing about crime and it's causes. Shoemaker stick to your lasts. From snow at smoke.suba.com Thu Oct 9 23:22:18 1997 From: snow at smoke.suba.com (snow) Date: Fri, 10 Oct 1997 14:22:18 +0800 Subject: Why? (fwd) In-Reply-To: <199710012159.QAA20763@einstein.ssz.com> Message-ID: <199710100615.BAA00927@smoke.suba.com> > Forwarded message: > > Date: Tue, 30 Sep 1997 22:54:15 -0700 > > From: Bill Frantz > > Black Unicorn uses a nym to express opinions he expects his coworkers and > > acquaintances would not like. Anonymous remailers can be used for the same > > purpose. > Ok, I believe that falls under the 'bitching' category. No. When I say "Jane doe is a bitch", I am bitching. When I say "IMO, we need to eliminate the governments ability to track the movement of money thru the system", that is not bitching, that is stating an opnion that might cost one contacts or clients were one in the kind of business where that kind of thing wasn't highly thought of. > > I have heard of people's posts being brought up in employment > > interviews. A rational person might want to express controversial opinions > > anonymously. > And your point is? My personal opinions have nothing to do with my > professional career and yours shouldn't either. I would love to have a Shouldn't != doesn't. > If you want to work for such a company and you know their views and your > views are in conflict then I would say you need a shrink not an anon. > remailer. Or just a job. From emc at wire.insync.net Thu Oct 9 23:36:22 1997 From: emc at wire.insync.net (Eric Cordian) Date: Fri, 10 Oct 1997 14:36:22 +0800 Subject: Where is _my_ blowjob? In-Reply-To: <199710100334.FAA11247@basement.replay.com> Message-ID: <199710100605.BAA18667@wire.insync.net> Anonymous writes: > What is the relationship between "Harold" and "Norbert"? You say > there is no direct evidence connecting them. What evidence does > connect them? Did they at least know each other? No relationship at all, except for the fact that the police "Harold" told to fuck off called the team investigating "Norbert's" death and told them "Harold" would make an excellent patsy, being in an illegal homosexual relationship with an older man and excellent media fodder. > While "Harold" may not be guilty of the murder, if he did kill > "Norbert" then he should probably be treated as a murderer. While the > police should not harrass gays, such harrassment does not seem to make > a good excuse for murdering an unrelated completely innocent third > party. I suppose, but it does seem that the only time young people get adult rights awarded to them is when adults want to punish them for something. Here we have a 15 year old, having a clandestine relationship with an older friend. He lets something slip to a therapist, who immediately declares that the boy has no right to privacy, and communicates his confidential medical files to the local prosecutor. The cops accost him in his home, take his computer hard drive, and install bugging equipment all over the place and demand he participate in an elaborate entrapment scheme, or they will screw him royally. He finaly gets up enough courage to say "NO" to the cops, and his parents then drag him to various places where they try and get various people to sign papers committing him to a mental institution, including a degrading hearing in which a judge makes smug remarks about corporal punishment, declares he is "just a kid" with no rights, and suggests that family problems are a result of kids taking advantage of their parents niceness. Oh - his older friend is also arrested, and charged with every imaginable sex crime, and held without bail. Failing to get him committed, the police then contact the team in charge of the murder investigation of the uninvolved third party, and give them his name as a suspect, whereupon he is promptly arrested and jailed without bail as well. His parents lawyer then signs away all his rights to confidentiality, and his parents start a media campaign about how the "system" let them down, because they couldn't just get him locked up anytime they demanded. Add to the insult the years of taunting he endured in school because he was gay, and it probably isn't beyond the realm of possibility that he caved someones head in with the nearest rock. Of course, it would have been nicer if he had terminated his parents and half a dozen jackbooted thugs with extreme prejudice, but as we know, when someone goes postal, it's sometimes the bystanders who take the bullets. Although he had to right to confidentiality from his therapist, no rights against his parents, no right against the police, no right to keep his parents from giving all his confidential records to the press, and no right to his own legal counsel, he now apparently has the "right" to be tried as an "adult" and take "full adult responsibility" for any crime he may have committed. I'm not suggesting killing anyone is a nice thing to do, but certainly adults with full adult rights and responsibilities have been known to kill far more people over far less crap that this 15 year old put up with. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law" From real at freenet.edmonton.ab.ca Thu Oct 9 23:52:15 1997 From: real at freenet.edmonton.ab.ca (Graham-John Bullers) Date: Fri, 10 Oct 1997 14:52:15 +0800 Subject: your mail In-Reply-To: <199710091130.EAA09395@sirius.infonex.com> Message-ID: On Thu, 9 Oct 1997, Mix wrote: I think Vulis needs each of us to send ten copies of this back to him. > The main difference between Timothy May and shit is that shit smells > better. > > \o _o o o \o |o |o >> /\/ o__ _o o/ Timothy May > | | /| |\ | / /|/ \|o o\ | \ \ | > | | << << << | << < \ > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Graham-John Bullers Moderator of alt.2600.moderated ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ email : : ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.freenet.edmonton.ab.ca/~real/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From jwn2 at qualcomm.com Thu Oct 9 23:57:35 1997 From: jwn2 at qualcomm.com (John W. Noerenberg) Date: Fri, 10 Oct 1997 14:57:35 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <3.0.3.32.19971007142710.00a22970@mail.pgp.com> Message-ID: At 6:06 PM +0100 10/8/97, Adam Back wrote: > >Email itself is pretty fragile, and email is not commonly used for >long term storage. Now this is a pretty bold assertion. One with which I completely disagree. As I peruse my Eudora folder this evening, I can easily pick out messages that date back nearly 6 years. Looking thru IETF working group archives (which are *all* email) it is possible to find messages dating back 10 years and more. Moreover, it is not unheard of during legal discovery for email to be made subject to search (Our lawyers are constantly tut-tuting about all the email that is saved). So to say it is not used for long-term storage is simply incorrect. Since your argument pretty much is based on this claim, Adam, I have a hard time accepting any of it. john w noerenberg, ii jwn2 at qualcomm.com pager: jwn2 at pager.qualcomm.com -------------------------------------------------------------------- "A beautiful idea has a much greater chance of being a correct idea than an ugly one." -- Roger Penrose, "The Emperor's New Mind", 1989 -------------------------------------------------------------------- From stewarts at ix.netcom.com Fri Oct 10 00:14:29 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Fri, 10 Oct 1997 15:14:29 +0800 Subject: computationally infeasible jobs for MITMs (Re: Secure phone) In-Reply-To: <3.0.3.32.19971008132417.00b0c6d0@labg30> Message-ID: <3.0.3.32.19971009111805.006aedf0@popd.ix.netcom.com> >> It would be easy enough to "trick" the MITM into exposing their >> existance anyway, just by using digits that come up in conversation. >> Humans would be able to come up with unique situations that the MITM >> would find all but impossible to predict. "Hey, Eric, I noticed >> that the third digit of your IP address' second octet is the same as >> the second digit of our exchange. How's by you?" A sudden dropout Another game you can play, with the audio, is to have music playing in the background, so Eve not only has to fake Alice's voice, but has to fake Alice reading numbers against a background of an arbitrarily-selected musical piece. Now, the effectiveness of the technique may depend on the musical tastes of the players ("Hey - that's not Toscanini conducting Beethoven's Fifth - that's the Furtwangler version on Deutsche Gramophon!"/ "Oh, was that Elvis? I guess so."/ "We're being MITMed - the Terrapin Station during the numbers was off the album, where Jerry remembered all the words, and now you're playing an audience tape version from Nassau in 89" ) and with some genres of music, it makes it easier to notice if there's a gap. Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From zooko at xs4all.nl Fri Oct 10 15:39:45 1997 From: zooko at xs4all.nl (Zooko Journeyman) Date: Fri, 10 Oct 1997 15:39:45 -0700 (PDT) Subject: No Subject Message-ID: <199710102238.AAA01083@xs2.xs4all.nl> ~h ~h ~h ~h ~v From brianbr at together.net Fri Oct 10 01:39:35 1997 From: brianbr at together.net (Brian B. Riley) Date: Fri, 10 Oct 1997 16:39:35 +0800 Subject: What's really in PGP 5.5? Message-ID: <199710100833.EAA24294@mx02.together.net> On 10/9/97 12:42 PM, Anonymous (anon at anon.efga.org) passed this wisdom: >It still satisfies the government's requirement to get routine >access to most email communications, and to allow criminals who >use standard email packages to be watched. This sums up the stupidity of the whole thing. The *only* thing the government achieves is invasion of honest people's privacy and catching a few stupid crooks who would most likely fuck up anyway and get caught if they are actually stupid enough to think government escrowed encryption is gonna hide their communications. Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys "He's mad that trusts in the tameness of a wolf ... or a whore's oath." -- SHAKESPEARE, "King Lear," III, 6 From tm at dev.null Fri Oct 10 03:00:43 1997 From: tm at dev.null (TruthMangler) Date: Fri, 10 Oct 1997 18:00:43 +0800 Subject: Monty Cantsin Exposed! / Re: What's really in PGP 5.5? In-Reply-To: <1923cf26ae66f5dc8867599b0d394536@anon.efga.org> Message-ID: <343DF499.6E32@dev.null> Anonymous wrote: > Martin Minow claiming to be Martin Minow wrote: > >Anonymous, claiming to be Monty Cantsin, writes about PGP 5.5: > I beg your pardon! Let me give you the *dirt* on Monty Cantsin. Anyone who has visited h/is/er alleged website will realize that I speak the trooth when I say that s/he was kicked out of the Electronic Forgery Foundation when it was discovered that s/he was forging posts in h/is/er own name. The EFF has a policy of disbarrment for those who maintain consisent forged personas. After all, without rules there is chaos...and vice-versa. TruthMangler "Vote Bill Stewart for EFF forger of the year!" From hgp at dev.null Fri Oct 10 03:00:46 1997 From: hgp at dev.null (Human Gus-Peter) Date: Fri, 10 Oct 1997 18:00:46 +0800 Subject: Defeating MITM with Eric's Secure Phone In-Reply-To: <199710091908.UAA00790@server.test.net> Message-ID: <343DE86D.51B9@dev.null> Adam Back wrote: > John Kelsey writes: > > Adam Back writes: > > [computationally infeasible jobs for MITMs] > > I prefer to work on the more immediately useful problem: How can I > > secure my use of the (very nicely done) Comsec secure phones using > > existing infrastructure? I am concerned with the MITM voice > > impersonation attack, since that's the easiest attack on the > > system. > We were discussing this problem before turning to talking about > automated methods. I think Eric Blossom suggested this earlier on: > > > 1. Exchange PGP-encrypted e-mail establishing a set of > > sixteen different words, labeled for 0..f in each direction. > It seems like a good solution. An interesting question might be how > many times can you use the same table without starting to leak values. > Perhaps it doesn't matter that much because the MITM can't exactly use > brute force on the problem otherwise you will know he's there. He has > to act non-passively to extract information. (Presuming the protocol > exchanges part of the information hashed for the challenge is > encrypted with the negotiated key). > I think you need an encryption function. It depends on how many times > you wanted to re-use the passphrase. The "encryption" function could > be very weak for one use. For lots of uses you'd need a real > encryption function. Problem is encryption functions aren't typically > very easy to perform as mental arithmetic exercises; and > non-programmable calculators don't help much. Plus - A table can be based on a previously agreed upon one-time pad, such as the old-school spook classic, first three words, second column, page 3, New York Times. PlusPlus - On the InformEnergy Highway, this method can be further obscured by use of data on an obscure website, text or source, binary or hex, etc. The point being, that one can use complex or obscure methodologies to obtain the one-time pad table of the day, which can be simple enough to calculate on-the-fly in one's head. there Are Some Similar metHOds peopLe can useE which can even be used by children, such as myself. Kill Flags - When WE' RElying on FeatUres of suCh Kinds, Everyone shoulD be using prearranged kill flags to signal danger. Keep in mind that I may just be telling you these things because I am a cop and trying to gain your confidence. OTOH, how many cops have a: Human Gus-Peter From tm at dev.null Fri Oct 10 03:01:15 1997 From: tm at dev.null (TruthMangler) Date: Fri, 10 Oct 1997 18:01:15 +0800 Subject: Where is _my_ blowjob? In-Reply-To: <199710100605.BAA18667@wire.insync.net> Message-ID: <343DF9FE.6E06@dev.null> Eric Cordian wrote: > > Anonymous writes: > > > What is the relationship between "Harold" and "Norbert"? You say > > there is no direct evidence connecting them. What evidence does > > connect them? Did they at least know each other? > > No relationship at all, except for the fact that the police "Harold" told > to fuck off called the team investigating "Norbert's" death and told them > "Harold" would make an excellent patsy, being in an illegal homosexual > relationship with an older man and excellent media fodder. You're an LEA, getting plump feeding off the fat of the land. You are confiscating vehicles, homes, money, businesses, every time you find someone in possession of a joint. The citizens are getting a little edgy about this, when someone murders an 11 year old boy, creating a big stink in the community. The chief suspects are the Ramseys, but the local cops hand you a quick and easy fix, so that you can get back to your more profitable pursuits. What do you do? Not that I'm cynical, but I've seen this shit go down too many times, from the inside, so I don't necessarily suck on every spoon stuck in front of my face by the mainstream media. TruthMangler From tnd at dev.null Fri Oct 10 03:05:23 1997 From: tnd at dev.null (The New Dictator) Date: Fri, 10 Oct 1997 18:05:23 +0800 Subject: New Rule Message-ID: <343DEF99.31B8@dev.null> >From now on, no one can drink coffee out of yellow cups, ok? The reason for this is because there are child molesters. Thank you for your cooperation, or I will kill you. The New Dictator "I have a suitcase, and I'm not afraid to use it." From tm at dev.null Fri Oct 10 03:08:27 1997 From: tm at dev.null (TruthMangler) Date: Fri, 10 Oct 1997 18:08:27 +0800 Subject: The more things change... In-Reply-To: <199710100715.AAA18614@jimmy.djc.com> Message-ID: <343DFB68.2A70@dev.null> sampler-request at lmboyd.com wrote: > ====================================================== > Q. Why do some countries make it a crime to commit > suicide? > A. Maybe so governments legally can confiscate the > property of the deceased. That's how it worked in ancient > Rome. Laws are made of money, it's said. > ============================================== > LMBoyd Web Site / U. S. Newspapers / Start Email / Stop Email > http://www.LMBoyd.com/postscript.htm From aol at aol.com Fri Oct 10 03:19:09 1997 From: aol at aol.com (Anonymous Online Limpdick) Date: Fri, 10 Oct 1997 18:19:09 +0800 Subject: 6502 ML programming In-Reply-To: <199710091925.VAA17154@basement.replay.com> Message-ID: <343DDFE3.1F4F@aol.com> Howcum you guys are talking about computer code and stuff? Are your browsers broken? Can't get QUAKE to boot? Let me know if you need some help. I know how to format my hard drive and reinstall Windows. I'm an expert. AOL'er Anonymous wrote: > If you guys are still doing 6502 work, maybe you can make use of this. > -- > > * RSA Data Security, Inc. MD5 Message-Digest Algorithm > > * > * *********************************************************************** > * ** Message-digest routines: ** > * ** To form the message digest for a message M ** > * ** (1) Initialize a context buffer mdContext using MD5Init ** > * ** (2) Call MD5Update on mdContext and M ** > * ** (3) Call MD5Final on mdContext ** > * ** The message digest is now in the bugffer passed to MD5Final ** > * *********************************************************************** > * > > ORG $2000 > > * Jump Table > JMP MD5INIT > JMP MD5UPD > JMP MD5FINAL > > DIGEST HEX 00000000 ;Message digest ends up here. > HEX 00000000 > HEX 00000000 > HEX 00000000 > > MD5INITV HEX 01234567 ;MD5 initialization values > HEX 89ABCDEF > HEX FEDCBA98 > HEX 76543210 > > MD5BYTES DS 8 ;Counts bytes in message digest so far > > MD5BUFRP HEX 00 ;Pointer to current byte in partially full buffer > > MD5BUFR DS 64 ;64-byte buffer for current MD5 block > > * Initialize MD5 - start new message digest > > MD5INIT LDX #15 ;Load initialization constants > ]LOOP LDA MD5INITV,X > STA DIGEST,X > DEX > BPL ]LOOP > > LDA #0 ;Reset byte count to zero > LDX #7 > ]LOOP STA MD5BYTES,X > DEX > BPL ]LOOP > > STA MD5BUFRP ;Reset buffer to empty > > ]RTS RTS > > * MD5UPD - add a byte to the message digest > > MD5UPD LDX MD5BUFRP > STA MD5BUFR,X > INX > STX MD5BUFRP > JSR INCBYTES > CPX #64 > BCC ]RTS > LDX #0 > STX MD5BUFRP > JSR MD5DOBLK > RTS > > INCBYTES INC MD5BYTES > BNE ]RTS > INC MD5BYTES+1 > BNE ]RTS > INC MD5BYTES+2 > BNE ]RTS > > HEX 0000 > > * MD5FINAL - do last block and compute final digest > > MD5FINAL LDA #$80 > LDX MD5BUFRP > STA MD5BUFR,X > INX > STX MD5BUFRP > ]LOOP CPX #64 > BCC MD5FA > LDX #0 > STX MD5BUFRP > JSR MD5DOBLK > MD5FA LDX MD5BUFRP > LDA #0 > STA MD5BUFR,X > INX > STX MD5BUFRP > CPX #56 > BNE ]LOOP > > LDA MD5BYTES > STA MD5BUFR+56 > LDA MD5BYTES+1 > STA MD5BUFR+57 > LDA MD5BYTES+2 > STA MD5BUFR+58 > LDA MD5BYTES+3 > STA MD5BUFR+59 > LDA MD5BYTES+4 > STA MD5BUFR+60 > LDA MD5BYTES+5 > STA MD5BUFR+61 > LDA MD5BYTES+6 > STA MD5BUFR+62 > LDA MD5BYTES+7 > STA MD5BUFR+63 > > LUP 3 ;Multiply times 8 > LDA MD5BUFR+56 ; to convert number of bytes to number of bits > ASL > STA MD5BUFR+56 > LDA MD5BUFR+57 > ROL > STA MD5BUFR+57 > LDA MD5BUFR+58 > ROL > STA MD5BUFR+58 > LDA MD5BUFR+59 > ROL ;Unlikely the message would be over 500 MB > STA MD5BUFR+59 ;so we can stop here... > --^ > > JSR MD5DOBLK > RTS > > MD5TEMPB DS 16 ;Temporary buffer for a,b,c,d > MD5TEMPV DS 4 ;Temporary 32-bit word storage (used by MD5DOBLK) > MD5TEMP2 DS 4 ;Temporary 32-bit variable #2 (used by F,G,H,I fcns) > > * Block transformation > > MD5DOBLK LDX #15 ;Copy values into temp buffer > ]LOOP LDA DIGEST,X > STA MD5TEMPB,X > DEX > BPL ]LOOP > > LDA #0 > STA MD5TP > > * Round 1 : F-functions > * a = b + ((a + F(b,c,d) + X[k] + T[i]) <<< s). */ > > JSR MD5LOADA ;1 (a,b,c,d) > JSR F_BCD > JSR NEXT_T ;(D76AA478) > LDA #0 > JSR MD5ADDX > JSR MD5RL7 ;Rotate Left 7 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;2 (d,a,b,c) > JSR F_ABC > JSR NEXT_T ;(E8C7B756) > LDA #1 > JSR MD5ADDX > JSR MD5RL12 ;Rotate Left 12 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;3 (c,d,a,b) > JSR F_DAB > JSR NEXT_T > LDA #2 > JSR MD5ADDX > JSR MD5RL17 ;Rotate left 17 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;4 (b,c,d,a) > JSR F_CDA > JSR NEXT_T > LDA #3 > JSR MD5ADDX > JSR MD5RL22 ;Rotate left 22 > JSR MD5ADDC > JSR MD5STORB > > JSR MD5LOADA ;5 (a,b,c,d) > JSR F_BCD > JSR NEXT_T > LDA #4 > JSR MD5ADDX > JSR MD5RL7 ;<<7 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;6 (d,a,b,c) > JSR F_ABC > JSR NEXT_T > LDA #5 > JSR MD5ADDX > JSR MD5RL12 ;<<12 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;7 (c,d,a,b) > JSR F_DAB > JSR NEXT_T > LDA #6 > JSR MD5ADDX > JSR MD5RL17 ;<<17 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;8 (b,c,d,a) > JSR F_CDA > JSR NEXT_T > LDA #7 > JSR MD5ADDX > JSR MD5RL22 ;<<22 > JSR MD5ADDC > JSR MD5STORB > > JSR MD5LOADA ;9 (a,b,c,d) > JSR F_BCD > JSR NEXT_T > LDA #8 > JSR MD5ADDX > JSR MD5RL7 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;10 (d,a,b,c) > JSR F_ABC > JSR NEXT_T > LDA #9 > JSR MD5ADDX > JSR MD5RL12 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;11 (c,d,a,b) > JSR F_DAB > JSR NEXT_T > LDA #10 > JSR MD5ADDX > JSR MD5RL17 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;12 (b,c,d,a) > JSR F_CDA > JSR NEXT_T > LDA #11 > JSR MD5ADDX > JSR MD5RL22 > JSR MD5ADDC > JSR MD5STORB > > JSR MD5LOADA ;13 (a,b,c,d) > JSR F_BCD > JSR NEXT_T > LDA #12 > JSR MD5ADDX > JSR MD5RL7 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;14 (d,a,b,c) > JSR F_ABC > JSR NEXT_T > LDA #13 > JSR MD5ADDX > JSR MD5RL12 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;15 (c,d,a,b) > JSR F_DAB > JSR NEXT_T > LDA #14 > JSR MD5ADDX > JSR MD5RL17 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;16 (b,c,d,a) > JSR F_CDA > JSR NEXT_T > LDA #15 > JSR MD5ADDX > JSR MD5RL22 > JSR MD5ADDC > JSR MD5STORB > > * Round 2 : G-functions > * a = b + ((a + G(b,c,d) + X[k] + T[i]) <<< s). */ > > JSR MD5LOADA ;17 (a,b,c,d) > JSR G_BCD > JSR NEXT_T > LDA #1 > JSR MD5ADDX > JSR MD5RL5 ;Rotate Left 5 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;18 (d,a,b,c) > JSR G_ABC > JSR NEXT_T > LDA #6 > JSR MD5ADDX > JSR MD5RL9 ;Rotate Left 9 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;19 (c,d,a,b) > JSR G_DAB > JSR NEXT_T > LDA #11 > JSR MD5ADDX > JSR MD5RL14 ;Rotate left 14 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;20 (b,c,d,a) > JSR G_CDA > JSR NEXT_T > LDA #0 > JSR MD5ADDX > JSR MD5RL20 ;Rotate left 20 > JSR MD5ADDC > JSR MD5STORB > > JSR MD5LOADA ;21 (a,b,c,d) > JSR G_BCD > JSR NEXT_T > LDA #5 > JSR MD5ADDX > JSR MD5RL5 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;22 (d,a,b,c) > JSR G_ABC > JSR NEXT_T > LDA #10 > JSR MD5ADDX > JSR MD5RL9 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;23 (c,d,a,b) > JSR G_DAB > JSR NEXT_T > LDA #15 > JSR MD5ADDX > JSR MD5RL14 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;24 (b,c,d,a) > JSR G_CDA > JSR NEXT_T > LDA #4 > JSR MD5ADDX > JSR MD5RL20 > JSR MD5ADDC > JSR MD5STORB > > JSR MD5LOADA ;25 (a,b,c,d) > JSR G_BCD > JSR NEXT_T > LDA #9 > JSR MD5ADDX > JSR MD5RL5 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;26 (d,a,b,c) > JSR G_ABC > JSR NEXT_T > LDA #14 > JSR MD5ADDX > JSR MD5RL9 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;27 (c,d,a,b) > JSR G_DAB > JSR NEXT_T > LDA #3 > JSR MD5ADDX > JSR MD5RL14 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;28 (b,c,d,a) > JSR G_CDA > JSR NEXT_T > LDA #8 > JSR MD5ADDX > JSR MD5RL20 > JSR MD5ADDC > JSR MD5STORB > > JSR MD5LOADA ;29 (a,b,c,d) > JSR G_BCD > JSR NEXT_T > LDA #13 > JSR MD5ADDX > JSR MD5RL5 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;30 (d,a,b,c) > JSR G_ABC > JSR NEXT_T > LDA #2 > JSR MD5ADDX > JSR MD5RL9 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;31 (c,d,a,b) > JSR G_DAB > JSR NEXT_T > LDA #7 > JSR MD5ADDX > JSR MD5RL14 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;32 (b,c,d,a) > JSR G_CDA > JSR NEXT_T > LDA #12 > JSR MD5ADDX > JSR MD5RL20 > JSR MD5ADDC > JSR MD5STORB > > * Round 3 : H-functions > * a = b + ((a + H(b,c,d) + X[k] + T[i]) <<< s). */ > > JSR MD5LOADA ;33 (a,b,c,d) > JSR H_BCD > JSR NEXT_T > LDA #5 > JSR MD5ADDX > JSR MD5RL4 ;Rotate Left 4 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;34 (d,a,b,c) > JSR H_ABC > JSR NEXT_T > LDA #8 > JSR MD5ADDX > JSR MD5RL11 ;Rotate Left 11 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;35 (c,d,a,b) > JSR H_DAB > JSR NEXT_T > LDA #11 > JSR MD5ADDX > JSR MD5RL16 ;Rotate left 16 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;36 (b,c,d,a) > JSR H_CDA > JSR NEXT_T > LDA #14 > JSR MD5ADDX > JSR MD5RL23 ;Rotate left 23 > JSR MD5ADDC > JSR MD5STORB > > JSR MD5LOADA ;37 (a,b,c,d) > JSR H_BCD > JSR NEXT_T > LDA #1 > JSR MD5ADDX > JSR MD5RL4 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;38 (d,a,b,c) > JSR H_ABC > JSR NEXT_T > LDA #4 > JSR MD5ADDX > JSR MD5RL11 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;39 (c,d,a,b) > JSR H_DAB > JSR NEXT_T > LDA #7 > JSR MD5ADDX > JSR MD5RL16 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;40 (b,c,d,a) > JSR H_CDA > JSR NEXT_T > LDA #10 > JSR MD5ADDX > JSR MD5RL23 > JSR MD5ADDC > JSR MD5STORB > > JSR MD5LOADA ;41 (a,b,c,d) > JSR H_BCD > JSR NEXT_T > LDA #13 > JSR MD5ADDX > JSR MD5RL4 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;42 (d,a,b,c) > JSR H_ABC > JSR NEXT_T > LDA #0 > JSR MD5ADDX > JSR MD5RL11 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;43 (c,d,a,b) > JSR H_DAB > JSR NEXT_T > LDA #3 > JSR MD5ADDX > JSR MD5RL16 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;44 (b,c,d,a) > JSR H_CDA > JSR NEXT_T > LDA #6 > JSR MD5ADDX > JSR MD5RL23 > JSR MD5ADDC > JSR MD5STORB > > JSR MD5LOADA ;45 (a,b,c,d) > JSR H_BCD > JSR NEXT_T > LDA #9 > JSR MD5ADDX > JSR MD5RL4 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;46 (d,a,b,c) > JSR H_ABC > JSR NEXT_T > LDA #12 > JSR MD5ADDX > JSR MD5RL11 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;47 (c,d,a,b) > JSR H_DAB > JSR NEXT_T > LDA #15 > JSR MD5ADDX > JSR MD5RL16 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;48 (b,c,d,a) > JSR H_CDA > JSR NEXT_T > LDA #2 > JSR MD5ADDX > JSR MD5RL23 > JSR MD5ADDC > JSR MD5STORB > > * Round 4 : I-functions > * a = b + ((a + I(b,c,d) + X[k] + T[i]) <<< s). */ > > JSR MD5LOADA ;49 (a,b,c,d) > JSR I_BCD > JSR NEXT_T > LDA #0 > JSR MD5ADDX > JSR MD5RL6 ;Rotate Left 6 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;50 (d,a,b,c) > JSR I_ABC > JSR NEXT_T > LDA #7 > JSR MD5ADDX > JSR MD5RL10 ;Rotate Left 10 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;51 (c,d,a,b) > JSR I_DAB > JSR NEXT_T > LDA #14 > JSR MD5ADDX > JSR MD5RL15 ;Rotate left 15 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;52 (b,c,d,a) > JSR I_CDA > JSR NEXT_T > LDA #5 > JSR MD5ADDX > JSR MD5RL21 ;Rotate left 21 > JSR MD5ADDC > JSR MD5STORB > > JSR MD5LOADA ;53 (a,b,c,d) > JSR I_BCD > JSR NEXT_T > LDA #12 > JSR MD5ADDX > JSR MD5RL6 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;54 (d,a,b,c) > JSR I_ABC > JSR NEXT_T > LDA #3 > JSR MD5ADDX > JSR MD5RL10 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;55 (c,d,a,b) > JSR I_DAB > JSR NEXT_T > LDA #10 > JSR MD5ADDX > JSR MD5RL15 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;56 (b,c,d,a) > JSR I_CDA > JSR NEXT_T > LDA #1 > JSR MD5ADDX > JSR MD5RL21 > JSR MD5ADDC > JSR MD5STORB > > JSR MD5LOADA ;57 (a,b,c,d) > JSR I_BCD > JSR NEXT_T > LDA #8 > JSR MD5ADDX > JSR MD5RL6 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;58 (d,a,b,c) > JSR I_ABC > JSR NEXT_T > LDA #15 > JSR MD5ADDX > JSR MD5RL10 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;59 (c,d,a,b) > JSR I_DAB > JSR NEXT_T > LDA #6 > JSR MD5ADDX > JSR MD5RL15 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;60 (b,c,d,a) > JSR I_CDA > JSR NEXT_T > LDA #13 > JSR MD5ADDX > JSR MD5RL21 > JSR MD5ADDC > JSR MD5STORB > > JSR MD5LOADA ;61 (a,b,c,d) > JSR I_BCD > JSR NEXT_T > LDA #4 > JSR MD5ADDX > JSR MD5RL6 > JSR MD5ADDB > JSR MD5STORA > > JSR MD5LOADD ;62 (d,a,b,c) > JSR I_ABC > JSR NEXT_T > LDA #11 > JSR MD5ADDX > JSR MD5RL10 > JSR MD5ADDA > JSR MD5STORD > > JSR MD5LOADC ;63 (c,d,a,b) > JSR I_DAB > JSR NEXT_T > LDA #2 > JSR MD5ADDX > JSR MD5RL15 > JSR MD5ADDD > JSR MD5STORC > > JSR MD5LOADB ;64 (b,c,d,a) > JSR I_CDA > JSR NEXT_T > LDA #9 > JSR MD5ADDX > JSR MD5RL21 > JSR MD5ADDC > JSR MD5STORB > > * Add value to previous digest. > * Note that this is four seperate 32-bit additions > > CLC > LDA MD5TEMPB > ADC DIGEST > STA DIGEST > LDA MD5TEMPB+1 > ADC DIGEST+1 > STA DIGEST+1 > LDA MD5TEMPB+2 > ADC DIGEST+2 > STA DIGEST+2 > LDA MD5TEMPB+3 > ADC DIGEST+3 > STA DIGEST+3 > CLC > LDA MD5TEMPB+4 > ADC DIGEST+4 > STA DIGEST+4 > LDA MD5TEMPB+5 > ADC DIGEST+5 > STA DIGEST+5 > LDA MD5TEMPB+6 > ADC DIGEST+6 > STA DIGEST+6 > LDA MD5TEMPB+7 > ADC DIGEST+7 > STA DIGEST+7 > CLC > LDA MD5TEMPB+8 > ADC DIGEST+8 > STA DIGEST+8 > LDA MD5TEMPB+9 > ADC DIGEST+9 > STA DIGEST+9 > LDA MD5TEMPB+10 > ADC DIGEST+10 > STA DIGEST+10 > LDA MD5TEMPB+11 > ADC DIGEST+11 > STA DIGEST+11 > CLC > LDA MD5TEMPB+12 > ADC DIGEST+12 > STA DIGEST+12 > LDA MD5TEMPB+13 > ADC DIGEST+13 > STA DIGEST+13 > LDA MD5TEMPB+14 > ADC DIGEST+14 > STA DIGEST+14 > LDA MD5TEMPB+15 > ADC DIGEST+15 > STA DIGEST+15 > > RTS > > * Basic MD5 functions > > MD5LOADA LDA MD5TEMPB ;Put 'A' into temp variable > STA MD5TEMPV > LDA MD5TEMPB+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+3 > STA MD5TEMPV+3 > RTS > > MD5LOADB LDA MD5TEMPB+4 ;Put 'B' into temp variable > STA MD5TEMPV > LDA MD5TEMPB+5 > STA MD5TEMPV+1 > LDA MD5TEMPB+6 > STA MD5TEMPV+2 > LDA MD5TEMPB+7 > STA MD5TEMPV+3 > RTS > > MD5LOADC LDA MD5TEMPB+8 ;Put 'C' into temp variable > STA MD5TEMPV > LDA MD5TEMPB+9 > STA MD5TEMPV+1 > LDA MD5TEMPB+10 > STA MD5TEMPV+2 > LDA MD5TEMPB+11 > STA MD5TEMPV+3 > RTS > > MD5LOADD LDA MD5TEMPB+12 ;Put 'D' into temp variable > STA MD5TEMPV > LDA MD5TEMPB+13 > STA MD5TEMPV+1 > LDA MD5TEMPB+14 > STA MD5TEMPV+2 > LDA MD5TEMPB+15 > STA MD5TEMPV+3 > RTS > > MD5STORA LDA MD5TEMPV ;Store temp variable into 'A' in temp buffer > STA MD5TEMPB > LDA MD5TEMPV+1 > STA MD5TEMPB+1 > LDA MD5TEMPV+2 > STA MD5TEMPB+2 > LDA MD5TEMPV+3 > STA MD5TEMPB+3 > RTS > > MD5STORB LDA MD5TEMPV ;Store temp variable into 'B' > STA MD5TEMPB+4 > LDA MD5TEMPV+1 > STA MD5TEMPB+5 > LDA MD5TEMPV+2 > STA MD5TEMPB+6 > LDA MD5TEMPV+3 > STA MD5TEMPB+7 > RTS > > MD5STORC LDA MD5TEMPV ;Store temp variable into 'C' > STA MD5TEMPB+8 > LDA MD5TEMPV+1 > STA MD5TEMPB+9 > LDA MD5TEMPV+2 > STA MD5TEMPB+10 > LDA MD5TEMPV+3 > STA MD5TEMPB+11 > RTS > > MD5STORD LDA MD5TEMPV ;Store temp variable into 'D' > STA MD5TEMPB+12 > LDA MD5TEMPV+1 > STA MD5TEMPB+13 > LDA MD5TEMPV+2 > STA MD5TEMPB+14 > LDA MD5TEMPV+3 > STA MD5TEMPB+15 > RTS > > MD5ADDA CLC ;Add 'A' to temp variable > LDA MD5TEMPB > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+1 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+2 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+3 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > MD5ADDB CLC ;Add 'B' to temp variable > LDA MD5TEMPB+4 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+5 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+6 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+7 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > MD5ADDC CLC ;Add 'C' to temp variable > LDA MD5TEMPB+8 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+9 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+10 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+11 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > MD5ADDD CLC ;Add 'D' to temp variable > LDA MD5TEMPB+12 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+13 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+14 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+15 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > * F function: > * F(X,Y,Z) = XY v not(X) Z > > F_BCD LDA MD5TEMPB+4 ;B&C > AND MD5TEMPB+8 > STA MD5TEMP2 > LDA MD5TEMPB+5 > AND MD5TEMPB+9 > STA MD5TEMP2+1 > LDA MD5TEMPB+6 > AND MD5TEMPB+10 > STA MD5TEMP2+2 > LDA MD5TEMPB+7 > AND MD5TEMPB+11 > STA MD5TEMP2+3 > CLC ;not(B)&D or (previous) -> MD5TEMPV+= > LDA MD5TEMPB+4 > EOR #$FF > AND MD5TEMPB+12 > ORA MD5TEMP2 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+5 ; > EOR #$FF > AND MD5TEMPB+13 > ORA MD5TEMP2+1 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+6 ; > EOR #$FF > AND MD5TEMPB+14 > ORA MD5TEMP2+2 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+7 ; > EOR #$FF > AND MD5TEMPB+15 > ORA MD5TEMP2+3 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > F_ABC LDA MD5TEMPB ;A&B > AND MD5TEMPB+4 > STA MD5TEMP2 > LDA MD5TEMPB+1 > AND MD5TEMPB+5 > STA MD5TEMP2+1 > LDA MD5TEMPB+2 > AND MD5TEMPB+6 > STA MD5TEMP2+2 > LDA MD5TEMPB+3 > AND MD5TEMPB+7 > STA MD5TEMP2+3 > CLC ;not(A)&C or (previous) -> MD5TEMPV+= > LDA MD5TEMPB > EOR #$FF > AND MD5TEMPB+8 > ORA MD5TEMP2 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+1 ; > EOR #$FF > AND MD5TEMPB+9 > ORA MD5TEMP2+1 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+2 ; > EOR #$FF > AND MD5TEMPB+10 > ORA MD5TEMP2+2 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+3 ; > EOR #$FF > AND MD5TEMPB+11 > ORA MD5TEMP2+3 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > F_DAB LDA MD5TEMPB+12 ;D&A > AND MD5TEMPB > STA MD5TEMP2 > LDA MD5TEMPB+13 > AND MD5TEMPB+1 > STA MD5TEMP2+1 > LDA MD5TEMPB+14 > AND MD5TEMPB+2 > STA MD5TEMP2+2 > LDA MD5TEMPB+15 > AND MD5TEMPB+3 > STA MD5TEMP2+3 > CLC ;not(D)&B or (previous) -> MD5TEMPV+= > LDA MD5TEMPB+12 > EOR #$FF > AND MD5TEMPB+4 > ORA MD5TEMP2 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+13 ; > EOR #$FF > AND MD5TEMPB+5 > ORA MD5TEMP2+1 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+14 ; > EOR #$FF > AND MD5TEMPB+6 > ORA MD5TEMP2+2 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+15 ; > EOR #$FF > AND MD5TEMPB+7 > ORA MD5TEMP2+3 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > F_CDA LDA MD5TEMPB+8 ;C&D > AND MD5TEMPB+12 > STA MD5TEMP2 > LDA MD5TEMPB+9 > AND MD5TEMPB+13 > STA MD5TEMP2+1 > LDA MD5TEMPB+10 > AND MD5TEMPB+14 > STA MD5TEMP2+2 > LDA MD5TEMPB+11 > AND MD5TEMPB+15 > STA MD5TEMP2+3 > CLC ;not(C)&A or (previous) -> MD5TEMPV+= > LDA MD5TEMPB+8 > EOR #$FF > AND MD5TEMPB > ORA MD5TEMP2 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+9 ; > EOR #$FF > AND MD5TEMPB+1 > ORA MD5TEMP2+1 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+10 ; > EOR #$FF > AND MD5TEMPB+2 > ORA MD5TEMP2+2 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+11 ; > EOR #$FF > AND MD5TEMPB+3 > ORA MD5TEMP2+3 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > * G Function: > * G(X,Y,Z) = XZ v Y not(Z) > > G_BCD LDA MD5TEMPB+4 ;B&D > AND MD5TEMPB+12 > STA MD5TEMP2 > LDA MD5TEMPB+5 > AND MD5TEMPB+13 > STA MD5TEMP2+1 > LDA MD5TEMPB+6 > AND MD5TEMPB+14 > STA MD5TEMP2+2 > LDA MD5TEMPB+7 > AND MD5TEMPB+15 > STA MD5TEMP2+3 > CLC ;not(D)&C or (previous) -> MD5TEMPV+= > LDA MD5TEMPB+12 > EOR #$FF > AND MD5TEMPB+8 > ORA MD5TEMP2 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+13 ; > EOR #$FF > AND MD5TEMPB+9 > ORA MD5TEMP2+1 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+14 ; > EOR #$FF > AND MD5TEMPB+10 > ORA MD5TEMP2+2 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+15 ; > EOR #$FF > AND MD5TEMPB+11 > ORA MD5TEMP2+3 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > G_ABC LDA MD5TEMPB ;A&C > AND MD5TEMPB+8 > STA MD5TEMP2 > LDA MD5TEMPB+1 > AND MD5TEMPB+9 > STA MD5TEMP2+1 > LDA MD5TEMPB+2 > AND MD5TEMPB+10 > STA MD5TEMP2+2 > LDA MD5TEMPB+3 > AND MD5TEMPB+11 > STA MD5TEMP2+3 > CLC ;not(C)&B or (previous) -> MD5TEMPV+= > LDA MD5TEMPB+8 > EOR #$FF > AND MD5TEMPB+4 > ORA MD5TEMP2 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+9 ; > EOR #$FF > AND MD5TEMPB+5 > ORA MD5TEMP2+1 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+10 ; > EOR #$FF > AND MD5TEMPB+6 > ORA MD5TEMP2+2 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+11 ; > EOR #$FF > AND MD5TEMPB+7 > ORA MD5TEMP2+3 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > G_DAB LDA MD5TEMPB+4 ;B&D > AND MD5TEMPB+12 > STA MD5TEMP2 > LDA MD5TEMPB+5 > AND MD5TEMPB+13 > STA MD5TEMP2+1 > LDA MD5TEMPB+6 > AND MD5TEMPB+14 > STA MD5TEMP2+2 > LDA MD5TEMPB+7 > AND MD5TEMPB+15 > STA MD5TEMP2+3 > CLC ;not(B)&A or (previous) -> MD5TEMPV+= > LDA MD5TEMPB+4 > EOR #$FF > AND MD5TEMPB > ORA MD5TEMP2 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+5 ; > EOR #$FF > AND MD5TEMPB+1 > ORA MD5TEMP2+1 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+6 ; > EOR #$FF > AND MD5TEMPB+2 > ORA MD5TEMP2+2 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+7 ; > EOR #$FF > AND MD5TEMPB+3 > ORA MD5TEMP2+3 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > G_CDA LDA MD5TEMPB ;C&A > AND MD5TEMPB+8 > STA MD5TEMP2 > LDA MD5TEMPB+1 > AND MD5TEMPB+9 > STA MD5TEMP2+1 > LDA MD5TEMPB+2 > AND MD5TEMPB+10 > STA MD5TEMP2+2 > LDA MD5TEMPB+3 > AND MD5TEMPB+11 > STA MD5TEMP2+3 > CLC ;not(A)&D or (previous) -> MD5TEMPV+= > LDA MD5TEMPB > EOR #$FF > AND MD5TEMPB+12 > ORA MD5TEMP2 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+1 ; > EOR #$FF > AND MD5TEMPB+13 > ORA MD5TEMP2+1 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+2 ; > EOR #$FF > AND MD5TEMPB+14 > ORA MD5TEMP2+2 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+3 ; > EOR #$FF > AND MD5TEMPB+15 > ORA MD5TEMP2+3 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > * H function: > * H(X,Y,Z) = X xor Y xor Z > > H_BCD CLC ;BxCxD > LDA MD5TEMPB+4 > EOR MD5TEMPB+8 > EOR MD5TEMPB+12 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+5 > EOR MD5TEMPB+9 > EOR MD5TEMPB+13 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+6 > EOR MD5TEMPB+10 > EOR MD5TEMPB+14 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+7 > EOR MD5TEMPB+11 > EOR MD5TEMPB+15 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > H_ABC CLC ;AxBxC > LDA MD5TEMPB > EOR MD5TEMPB+4 > EOR MD5TEMPB+8 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+1 > EOR MD5TEMPB+5 > EOR MD5TEMPB+9 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+2 > EOR MD5TEMPB+6 > EOR MD5TEMPB+10 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+3 > EOR MD5TEMPB+7 > EOR MD5TEMPB+11 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > H_DAB CLC ;AxBxD > LDA MD5TEMPB > EOR MD5TEMPB+4 > EOR MD5TEMPB+12 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+1 > EOR MD5TEMPB+5 > EOR MD5TEMPB+13 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+2 > EOR MD5TEMPB+6 > EOR MD5TEMPB+14 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+3 > EOR MD5TEMPB+7 > EOR MD5TEMPB+15 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > H_CDA CLC ;AxCxD > LDA MD5TEMPB > EOR MD5TEMPB+8 > EOR MD5TEMPB+12 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+1 > EOR MD5TEMPB+9 > EOR MD5TEMPB+13 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+2 > EOR MD5TEMPB+10 > EOR MD5TEMPB+14 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+3 > EOR MD5TEMPB+11 > EOR MD5TEMPB+15 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > * I function > * I(X,Y,Z) = Y xor (X v not(Z)) > > I_BCD CLC ~D|B^C > LDA MD5TEMPB+12 > EOR #$FF > ORA MD5TEMPB+4 > EOR MD5TEMPB+8 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+13 > EOR #$FF > ORA MD5TEMPB+5 > EOR MD5TEMPB+9 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+14 > EOR #$FF > ORA MD5TEMPB+6 > EOR MD5TEMPB+10 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+15 > EOR #$FF > ORA MD5TEMPB+7 > EOR MD5TEMPB+11 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > I_ABC CLC ~C|A^B > LDA MD5TEMPB+8 > EOR #$FF > ORA MD5TEMPB > EOR MD5TEMPB+4 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+9 > EOR #$FF > ORA MD5TEMPB+1 > EOR MD5TEMPB+5 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+10 > EOR #$FF > ORA MD5TEMPB+2 > EOR MD5TEMPB+6 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+11 > EOR #$FF > ORA MD5TEMPB+3 > EOR MD5TEMPB+7 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > I_DAB CLC ~B|D^A > LDA MD5TEMPB+4 > EOR #$FF > ORA MD5TEMPB+12 > EOR MD5TEMPB > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+5 > EOR #$FF > ORA MD5TEMPB+13 > EOR MD5TEMPB+1 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+6 > EOR #$FF > ORA MD5TEMPB+14 > EOR MD5TEMPB+2 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+7 > EOR #$FF > ORA MD5TEMPB+15 > EOR MD5TEMPB+3 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > I_CDA CLC ~A|C^D > LDA MD5TEMPB > EOR #$FF > ORA MD5TEMPB+8 > EOR MD5TEMPB+12 > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5TEMPB+1 > EOR #$FF > ORA MD5TEMPB+9 > EOR MD5TEMPB+13 > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5TEMPB+2 > EOR #$FF > ORA MD5TEMPB+10 > EOR MD5TEMPB+14 > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5TEMPB+3 > EOR #$FF > ORA MD5TEMPB+11 > EOR MD5TEMPB+15 > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > *Rotate left functions > > MD5RL LDA MD5TEMPV ;Rotate the 32-bit temp var left by one bit > ASL > STA MD5TEMPV > LDA MD5TEMPV+1 > ROL > STA MD5TEMPV+1 > LDA MD5TEMPV+2 > ROL > STA MD5TEMPV+2 > LDA MD5TEMPV+3 > ROL > STA MD5TEMPV+3 > LDA MD5TEMPV ;Take high bit and wrap around; > ADC #0 ; add it to empty position in lowest byte > STA MD5TEMPV > RTS > > * This is somewhat sloppy but it works > * It should be optimized to use full byte shifts when possible. > > MD5RL7 LUP 7 > JSR MD5RL > --^ > RTS > > MD5RL12 LUP 12 > JSR MD5RL > --^ > RTS > > MD5RL17 LUP 17 > JSR MD5RL > --^ > RTS > > MD5RL22 LUP 22 > JSR MD5RL > --^ > RTS > > MD5RL5 LUP 5 > JSR MD5RL > --^ > RTS > > MD5RL9 LUP 9 > JSR MD5RL > --^ > RTS > > MD5RL14 LUP 14 > JSR MD5RL > --^ > RTS > > MD5RL20 LUP 20 > JSR MD5RL > --^ > RTS > > MD5RL4 LUP 4 > JSR MD5RL > --^ > RTS > > MD5RL11 LUP 11 > JSR MD5RL > --^ > RTS > > MD5RL16 LUP 16 > JSR MD5RL > --^ > RTS > > MD5RL23 LUP 23 > JSR MD5RL > --^ > RTS > > MD5RL6 LUP 6 > JSR MD5RL > --^ > RTS > > MD5RL10 LUP 10 > JSR MD5RL > --^ > RTS > > MD5RL15 LUP 15 > JSR MD5RL > --^ > RTS > > MD5RL21 LUP 21 > JSR MD5RL > --^ > RTS > > *Get data from input block and add it to temp variable > > MD5ADDX ASL > ASL > CLC ;It better not be greater than 16 anyway! > TAX > LDA MD5BUFR,X > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5BUFR+1,X > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5BUFR+2,X > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5BUFR+3,X > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > RTS > > *Get next element from table and add it to temp variable > > NEXT_T LDX MD5TP > CLC > LDA MD5T+3,X ;reverse byte order > ADC MD5TEMPV > STA MD5TEMPV > LDA MD5T+2,X > ADC MD5TEMPV+1 > STA MD5TEMPV+1 > LDA MD5T+1,X > ADC MD5TEMPV+2 > STA MD5TEMPV+2 > LDA MD5T,X > ADC MD5TEMPV+3 > STA MD5TEMPV+3 > INX > INX > INX > INX > STX MD5TP > RTS > > * MD5 Sine Constants > > * The following is the 64-element MD5 table T[1 ... 64] constructed from > * the sine function. Let T[i] denote the i-th element of the table, which > * is equal to the integer part of 2^32, or 4294967296, times abs(sin(i)), > * where i is in radians. > * > * Sorry, Colin, no occult messages here. :) > > * These need to be re-arranged to LSB-first > * (which is done by the NEXT_T subroutine) > > MD5TP HEX 00 ;Pointer to current element in table below > MD5T > > * /* Round 1 */ > > HEX D76AA478 ; /* 1 */ > HEX E8C7B756 ; /* 2 */ > HEX 242070DB ; /* 3 */ > HEX C1BDCEEE ; /* 4 */ > HEX F57C0FAF ; /* 5 */ > HEX 4787C62A ; /* 6 */ > HEX A8304613 ; /* 7 */ > HEX FD469501 ; /* 8 */ > HEX 698098D8 ; /* 9 */ > HEX 8B44F7AF ; /* 10 */ > HEX FFFF5BB1 ; /* 11 */ > HEX 895CD7BE ; /* 12 */ > HEX 6B901122 ; /* 13 */ > HEX FD987193 ; /* 14 */ > HEX A679438E ; /* 15 */ > HEX 49B40821 ; /* 16 */ > > * /* Round 2 */ > > HEX F61E2562 ; /* 17 */ > HEX C040B340 ; /* 18 */ From aba at dcs.ex.ac.uk Fri Oct 10 03:51:06 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Fri, 10 Oct 1997 18:51:06 +0800 Subject: What's really in PGP 5.5? In-Reply-To: <199710092259.PAA13153@proxy3.ba.best.com> Message-ID: <199710101040.LAA00172@server.test.net> James Donald writes: > At 02:27 PM 10/7/97 -0700, Jon Callas wrote: > [Explaining PGP's rather alarming "data recovery" features.] > > Sending a copy to the boss of everything Alice sends is OK. > > If Alice wants to send something her boss should not read, perhaps she > should use her private account, rather than a company paid account. > > Sending a copy of everything Alice receives to the boss or HR is not OK. > > Alice should get to control it. I'm not sure I see why you draw this distinction. Is it because the person sending may intend the message for Alice only? If so I think Jon said that all current versions of PGP warn the user that their is a company escrow situation when you send to the key (this information being in attributes of the key). Snooping Alice's outgoing traffic, and snooping Alice's incoming traffic are similarly little brotherish in my view. If the company has an approval system for official statements (seems reasonable, if it's a press release, important contractual decision, etc), then Alice can send a copy to the legal beagles for the ok, and they can send it on. > It would be acceptable for the company system to keep track of what > Alice has received, and flag "Alice received something, and has not > yet filed the cleartext copy with us" I figure this is fair game also... clearly they can see the traffic coming into LAN and being delivered to Alice's mailbox. > It is not acceptable to just plain snoop on what Alice receives. I don't like it either. But how is this so different from snooping on what Alice sends. > Furthermore any auto-snoop feature sets a very dangerous precedent. Agree. > It is politically a lot more difficult for the FBI to mandate that they > can recover your data, if such a mandate leads to the message flashing up, > "now sending a copy to the FBI" every time you decrypt something. I was arguing earlier that the way for the company to do archiving of received encrypted email was for archive copy to be taken after the employee has decrypted it. The employee should be made aware that the received email is being archived. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710101045.LAA00179@server.test.net> Monty Cantsin writes: > My apologies if this has already been discussed, but wouldn't this be > a straightforward solution? John Kelsey described the same system. [adding hex passphrase digits exchanged via PGP to display digits] > Any flaws? See my other recent post in this thread... I think it doesn't work because Mallet can recover the passphrase. You must remember that when Mallet is actively doing a MITM attack he knows the digits on the display of each party. With that info he can recover the passphrase by subtracting. Then he can give Alice the correct checksum for the link A<->M and Bob the correct checksum for the link M<->B. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: * Jon Callas wrote: >It brings up a dialog box and gives you the option of encrypting to Alice >alone or Alice plus her corporate recovery key. If the "strict" flag is set >on Alice's CMRK and you remove it, we display a dialog box that wags a >finger at you and tells you you're being naughty, but that's it. If you >remove Alice's CMRK from your key ring, it just sends to Alice alone and >doesn't bother you at all. The CMRK must not be used in eMails. It may be used in storing folders.x If it does work in that way, it's GAK to temprorary communication keys. From jya at pipeline.com Fri Oct 10 04:18:27 1997 From: jya at pipeline.com (John Young) Date: Fri, 10 Oct 1997 19:18:27 +0800 Subject: BXA RFC on Export Controls Message-ID: <1.5.4.32.19971010105649.00b5a36c@pop.pipeline.com> "The Bureau of Export Administration (BXA) is reviewing the foreign policy-based export controls in the Export Administration Regulations to determine whether they should be modified, rescinded or extended. To help make these determinations, BXA is seeking comments on how existing foreign policy-based export controls have affected exporters and the general public." http://jya.com/bxa100897.txt From aba at dcs.ex.ac.uk Fri Oct 10 05:24:06 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Fri, 10 Oct 1997 20:24:06 +0800 Subject: do NOT escrow communications keys (Re: What's really in PGP 5.5?) In-Reply-To: Message-ID: <199710101123.MAA01069@server.test.net> John Noerenberg writes: > > At 6:06 PM +0100 10/8/97, Adam Back wrote: > > > >Email itself is pretty fragile, and email is not commonly used for > >long term storage. > > Now this is a pretty bold assertion. One with which I completely disagree. > As I peruse my Eudora folder this evening, I can easily pick out messages > that date back nearly 6 years. Looking thru IETF working group archives > (which are *all* email) it is possible to find messages dating back 10 > years and more. You're misunderstanding what I'm saying. There was some other context around the above quote. What I'm saying is that you don't use the *email in transit* for storage. You receive the email, then you archive it (store it in your eudora folder), then you consider it storage. Perhaps with your current software you archive the PGP encrypted email. This is a bad security practice. You should have different, storage only keys for encrypted archives. Email in transit isn't that reliable. About the only example of email in transit being considered storage was a USENET article years ago by someone who considered it a kewl hack that he had some games or something else which was in breach of policy in his account and rumor went around that the admin was having a purge. He tarred, gzipped & uuencoded the lot and emailed it to himself down a _long_ ! fowarding path. It came back to him around 3 days later after the purge. That's the kind of thing I mean when I say you don't consider email storage. I'm arguing that you should not backup, or escrow communications keys, and that you should backup storage keys. (Separately I have argued in the past that you should use forward secrecy to ensure that you have no long term private keys which after the fact allow you to decrypt traffic -- if a competitor, or the feds get a copy of this key, your past traffic is vulnerable. Encrypting the session key to two long term keys, never mind one, makes this situation even worse, and also results in a system useable for GAK.) > Moreover, it is not unheard of during legal discovery for email to be made > subject to search (Our lawyers are constantly tut-tuting about all the > email that is saved). So to say it is not used for long-term storage is > simply incorrect. Your lawyers have a good point. I know a few examples where people really wish that email hadn't been kept around, as an email sent with 1 minutes thought has been dug up and used somewhat out of context as the basis of a court case. A pgp signed email is even worse. There you have transferable undeniable signature proving that you wrote the contested email. I'm sure I've said this all before, but hey, maybe PGP has it's ears open this time: You should have two types of email. "Official statement" type email, which you might want to back up, and which you might want proof read and approved by your company legal team, depending on how important it is. Official email you want to sign with a transferable signature (normal pgp signature). Unofficial email, for example to and fro communications between co-developers at different companies, etc. you probably don't want transferable signatures on. (This is the kind of thing lawyers go tut-tut about.) So you use non-transferable signatures. You use forward secrecy, and for the really paranoid deliver it via mixmaster to avoid mail delivery logs. Archive if you wish. It'll then be largely one persons word against the other, as there will be little in the way of proof of authorship. > Since your argument pretty much is based on this claim, Adam, I have > a hard time accepting any of it. It isn't based on the idea that you never want to store email. That's clearly bunk. I've got 54Mb of old email on my disk. What I'm arguing is that if you're going to encrypt your stored email on your disk, that you should encrypt it with a storage key, and NOT a communications key. Communications keys should ideally be transient (via forward secrecy), but failing that you should at least not have multiple recipients to exarcerbate the problem. Am I making sense? I know I'm fighting against the tide .. but I'm confident that what I'm saying is correct. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710101215.NAA01268@server.test.net> Bill Stewart writes: > Another game you can play, with the audio, is to have music playing > in the background, so Eve not only has to fake Alice's voice, but > has to fake Alice reading numbers against a background of an > arbitrarily-selected musical piece. There are two types of MITM attack: i) the eavesdropper lets your voice go through ii) the eavesdropper re-synthesizes your voice, or has two actors one for Bob, one for Alice holding separate conversations Your suggestion of having a CD playing in the back-ground only helps against type i) MITM. James's method of forcing the MITM to commit to delivering packets with sizes which he can't deliver similarly only applies to type i), as does my stego idea. I think we stand a chance against type i). Type ii) seems pretty hard to stop by either manual cleverness (mixing in comments related to the hash digits) or automated methods (such as James's or my earlier stego idea). I mean, heck, the actors could run two completely different conversations, and weave into the conversation earlier topics covered with Alice which they wanted to hear responses to, from Bob, and vice-versa. The MITM could potentially have as long as he wanted to think of something clever to say to sound consistent with a comment made by Alice or Bob relating to their hash digits. Or he could simply choose to omit saying anything related to hash digits. They could play different CDs, or no CDs, or go buy a copy of the CD, or have a nice selection on tap as radio stations do (they seem to be able to play any track with a couple of seconds notice). I think the only real way to stop MITM to a paranoidly high degree of certainty is to use authentication and web of trust. Perhaps you can get a high enough degree of certainty for your application with preventative measures against type i) MITM firm in the belief that type ii) MITM is too difficult, or too expensive to try against you. I'm not sure it's even that expensive or difficult. If I was a drug king pin, or mafia, or military intelligence I wouldn't feel safe with these approaches alone. I'd want separate authentication. Probably another kind of attack would be dangerous too: if the attacker re-routes my phone call or hi-jacks it prior to set up of secure comms. Without authentication I could have a convesation with a spook instead of Bob Gotti and not know it. Alice need never know I called, or may simultaneously, or some time afterwards have a call from another spook with faked ANI. Persistence authentication suggestion: I can see one strong protection feature which isn't currently built in to Eric's phone which could be, should be I think. Shouldn't be that hard to do. You have the situation currently that you call Bob's number to go secure, then have a conversation. Well if you make several calls to Bob with the first call being MITM free, because the MITM hadn't singled you out for investigation yet, no use of this fact is made to reduce the MITM's chance of succeeding next time. (People who know some about SSH protocols may be guessing what's coming next). A way to use the fact that you have had one or more non-MITM'd calls is for the unit to remember the number and exchange a secret with the called unit inside the encryption envelope. The next time you call the same unit (as defined by calling the same phone number), you use the shared secret to authenticate the call. If the other unit can't do this, you get suspicious. You could do better than using the phone number: you could have the units exchange public El Gamal or DSA keys (bearing in mind Eric's understandable avoidance of RSA). When you call up a unit you first send it a nonce to sign with it's EG/DSA key. It signs it and sends you it's public key. If you already have the public key, you check that the signature matches. If you don't have the public key, you save it for next time. You probably want to assign the public key some human meaningful value that can be displayed on the display. If you have no input device, I guess a sequence number would do. (First secured phone you ever call is called user 1, etc). Then the user can write down who he thinks each caller is caller 1. Black Unicorn, 2. Lucky Green. 3. Tim May, etc. You could even slap a sticker on top of the box with a few places to enter this information. In addition this feature means that you can secure one communication with a PGP emailed table of key words to lookup hash digits and speak words. After that secured communication all further communications are also authenticated. If you don't use a PGP secured email, well you still have authenticated that you are at least talking to a persistent MITM. This in itself is useful, because the MITM may make mistakes, or you may arrange to call from different numbers arranged by out of band communications. If you once get a different key, you get suspicious, as the once could be the only time you got through to the real Bob, as opposed to the MITM. Another way to authenticate yourself would be if you met face-to-face with someone you plan to use the phone with in an office with an internal switch board, or with a test rig such as Eric has to demonstrate his phones. (How easy would it be to have the units directly plugable -- plug them together, plug a phone in talk make secured call, remember or write down that user 3 is Tim May. I like this use of persistence authentication. What do you think Eric? Another method, which could be used in addition would be for Eric to install an additional key into the units, and certify that key. If the sale is in person, perhaps you could even personalise them with the users name & dob or something unique (users choice). At least that way Eric gets to profit from the MITM/spooks as they've got to buy a unit to get a certified key :-) Course it makes Eric, or Eric's laptop, a _fat_ target, but would be cheaper than including full web of trust certification capability, and could add some utility. Anyway, I like the persistence authentication idea. And I'd encourage Eric to build it in. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 /////////////////////////////////////////////////////////////////////////////// This Message was Composed using E- Mail Software. If you wish to be removed from future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. Sorry for the intrusion!! //////////////////////////////////////////////////////////////////////////////// Choosing a roofing contractor can be one of the most difficult decisions you will ever make. Bad workmanship, poor business practices, the lack of expertise, and the never ending hassle of unneeded come backs are often the rule. Meanwhile your property is suffering the damage. BUT NO MORE! Prominent roofer and current roofing contractor Jim Daniels shares all his secrets in "My Roofer" a widely read information guide to help you, the property owner, save hundreds or even thousands on your roof repair or new roof project. This easy to follow step by step guide will give you precise information on topics such as, 1- "Repair or new Roof" Know for yourself, Don�t be fooled by the roofer. 2- List of items your roofer should have before you hire him. 3- Materials list and definitions. 4- Average cost list for labor and materials. 5- Tricks for hiding those ugly ceiling stains. 6- Yearly maintenance you can do to prolong the life of your roof. 7- Most common roof problems and how to fix them. (includes the removal of algae stains) 8- Access to our FREE live information line to assist you with your roofing questions. 9- Negotiating the deal. This is but a few of the many money saving ideas that Jim shares with you in this guide. Testimonial " I got two bids on my roof for two leaks we had last winter. I was almost ready to get the roof replaced when I saw the ad for Jim�s guide. I�m so glad I bought it! After about 10 minutes I knew I needed to find another roofer and get a third bid. After following the simple check list I almost found the leak my self and I was able to point out where it was coming from to the new contractor. He replaced two vent boots and my roof has not leaked since. Not only did I save over $2,200.00 by reading this guide but, I also got rid of some stains as well. THANKS JIM!!" Lois Biglane Gretna, LA. We have many stories like this but, we know that you may think that your too smart to get fooled. We hope you are but why risk it. Roofing is our business and we will ensure you that your money and property will be safe. Our guide cost less than a PIZZA FOR DINNER and it WILL save you money. In fact, if you do not save money we will refund you 100% of the purchase price. All that we ask is that you try at least one of our suggestions. It�s up to you!! ORDER TODAY!! Direct Mail Price: $39.95 SPECIAL INTERNET PRICE: $18.99 Save $20.96 PRINT THIS ORDER FORM AND MAIL IT IN TODAY! E-mail me "My Roofer" for only $18.99 (.txt format) Name _________________________________________ Address________________________________________ City___________________________________________ State______________ZIP_________________________ Phone_______________________ E.Mail______________________ ALL ORDERS IN U.S. FUNDS- FOREIGN ORDERS ADD $15_______ TOTAL___________________________________________ I am paying by: Visa___MasterCard___Discovery____ CARD#___________________________________________ EXP DATE_______________ Check or Money order_______ (guide will still be e-mailed to you) Allow 24 hours for e-mail orders and 7-10 days for mail in orders. Order from: JD Enterprises PO Box 38073 Germantown, Tn. 38183 For more information please type "more info" in the subject of your return e-mail then ask any questions you like in the body of the mail. From nobody at bureau42.ml.org Fri Oct 10 08:01:46 1997 From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer) Date: Fri, 10 Oct 1997 23:01:46 +0800 Subject: Freeh Replaced! / Re: New Rule Message-ID: The New Dictator wrote: >From now on, no one can drink coffee out of yellow cups, ok? > > The reason for this is because there are child molesters. > > Thank you for your cooperation, or I will kill you. Must have been embarassing for Freeh to have gotten replaced by a child. Guess it has something to do with the new 'Truth in Tyranny' laws... From jad at dsddhc.com Fri Oct 10 08:01:48 1997 From: jad at dsddhc.com (John Deters) Date: Fri, 10 Oct 1997 23:01:48 +0800 Subject: Defeating MITM with Eric's Secure Phone In-Reply-To: Message-ID: <3.0.3.32.19971010095530.00a32ce0@labg30> At 11:31 PM 10/9/97 -0400, an Anonymous Monty Cantsin wrote: >My apologies if this has already been discussed, but wouldn't this be >a straightforward solution? Yes, your PGP solution will work. Information-theoretically speaking, it's a simple XOR, and is as secure as the random number generator used and the PGP systems used to exchange your secret key. However, so will a thousand other schemes that use PGP, or any other "out-of-band" form of authentication. At this point you realize that you are using PGP for authentication, not the "Secure Phone". Our discussion so far has been ways of authenticating the connection WITHOUT external references. No pre-exchanged public keys, no pre-arranged passwords or secrets or any of that. (They even disallowed me a trip to ask a trusted authorizer!) To restate the problem in its current form: using the secure phone channel, (and only the secure phone channel) can we "prove" that we are connecting only two endpoints, and that there is no man-in-the-middle between the voices that are speaking to each other? Remember that Mallory (the man in the middle) has full knowledge of the protocol and of the public keys belonging to both parties. He can even spoof the voices. The latest candidates for solutions have been "have the users identify this flaw in the audio" which is probably as good as we can hope for on an unauthenticated conversation. As it is, Eric's current solution to have each party simply read their half of the hash. Real-time impersonating the audio to the point where you can fool a careful human is already putting a great deal of exposure risk on Mallory. My bottom line: I would trust Eric's current phone to all but eliminate the MITM, and with external authentication I wouldn't have any problems at all. John -- J. Deters "Don't think of Windows programs as spaghetti code. Think of them as 'Long sticky pasta objects in OLE sauce'." +--------------------------------------------------------------------+ | NET: mailto:jad at dsddhc.com (work) mailto:jad at pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'36"N by 93^16'27"W Elev. ~=290m (work) | | For my public key, send mail with the exact subject line of: | | Subject: get pgp key | +--------------------------------------------------------------------+ From jad at dsddhc.com Fri Oct 10 08:12:56 1997 From: jad at dsddhc.com (John Deters) Date: Fri, 10 Oct 1997 23:12:56 +0800 Subject: authentication suggestion for secure phone (Re: computationally infeasible jobs for MITMs) In-Reply-To: <3.0.3.32.19971009111805.006aedf0@popd.ix.netcom.com> Message-ID: <3.0.3.32.19971010100231.00a56c60@labg30> At 01:15 PM 10/10/97 +0100, Adam Back you wrote: >Persistence authentication suggestion: >A way to use the fact that you have had one or more non-MITM'd calls >is for the unit to remember the number and exchange a secret with the >called unit inside the encryption envelope. The problems with this solution are twofold: 1. Eric may have to redesign the unit to have persistent read-write storage. And maybe a *lot* of storage, if you use it a lot. Maybe a lot of expen$ive $torage at that. His phone is already priced way out of the consumer market, let's not add to that. 2. I had problems with UUCP when my machines got out of sync (way back when.) Just think how bad they'll look if they refuse to light up "secure" because one guy had to change batteries. I agree with you that external authentication is the only way to fly. And if it is simply accepted, lets let Eric's unit survive unmolested and use PGP out-of-band (as per Monty's suggestion) or use PGP to exchange session keys (like in Speak Freely.) I also think the most likely avenue of attack will be a black bag job on the individual user's phone. MITM attacks seem too risky and expensive to pay off. John -- J. Deters "Don't think of Windows programs as spaghetti code. Think of them as 'Long sticky pasta objects in OLE sauce'." +--------------------------------------------------------------------+ | NET: mailto:jad at dsddhc.com (work) mailto:jad at pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'36"N by 93^16'27"W Elev. ~=290m (work) | | For my public key, send mail with the exact subject line of: | | Subject: get pgp key | +--------------------------------------------------------------------+ From cynthb at bone_dis.com Fri Oct 10 08:55:55 1997 From: cynthb at bone_dis.com (Cynthia Brown) Date: Fri, 10 Oct 1997 23:55:55 +0800 Subject: Cole Harbor Students Not Wearing Any Panties! / Re: "Show me an example of terrorists using the Internet or crypto" In-Reply-To: Message-ID: <343E4B61.6FE8@bone_dis.com> Cynthia Brown wrote: > Canada may be regulated to death according to most libertarians, but I for > one like it that way. I can walk alone and unarmed at night in Ottawa, > Toronto, etc. without fearing for my life. Can a female resident of > Washington or New York say the same? > Our schools do not have metal detectors > at the entrances because they are not needed. Boy, do I feel like an idiot. Since I wrote the above, the Province of Nova Scotia shut down Cole Harbor school for a week to install surveillance cameras, and now they have armed policemen patrolling the highways. Although the body-searches have shown that the students are not carrying weapons, it turns out they are also not wearing any panties. {This doesn't come as news to *some* of us. } Cynthia, unredundant bleeding-nose liberal {Please join me in posting at midnight tonight, in the first annual FemniPunk 'Take Back The CypherPunks List' electronic march to Bienfait, Saskatchewan where we will byte Human Gus-Peter.} ====================================================================== Cynthia H. Brown, P.Ing. E-mail: cynthb at iosphere.net | PrettyGoodPenis Key: See Bone Page Home Page: http://www.iosphere.net/~cynthb/ Punk mail will be impaled in the order in which it is repreived. Calvin Klein for rent; enquire within. From ts at dev.null Fri Oct 10 09:02:15 1997 From: ts at dev.null (The Spook) Date: Sat, 11 Oct 1997 00:02:15 +0800 Subject: authentication suggestion for secure phone (Re: computationally infeasible jobs for MITMs) In-Reply-To: <3.0.3.32.19971009111805.006aedf0@popd.ix.netcom.com> Message-ID: <343E4EFC.1783@dev.null> John Deters wrote: > > At 01:15 PM 10/10/97 +0100, Adam Back you wrote: > >Persistence authentication suggestion: > >A way to use the fact that you have had one or more non-MITM'd calls > >is for the unit to remember the number and exchange a secret with the > >called unit inside the encryption envelope. > I agree with you that external authentication is the only way to fly. And > if it is simply accepted, lets let Eric's unit survive unmolested and use > PGP out-of-band (as per Monty's suggestion) or use PGP to exchange session > keys (like in Speak Freely.) > > I also think the most likely avenue of attack will be a black bag job on > the individual user's phone. MITM attacks seem too risky and expensive to > pay off. I'm not a subscriber to the CypherPunks list, but I have been monitoring the emissions from John's computer screen, and I would just like to say that I agree with him, wholeheartedly. I often tell my superiors that there are much better ways to be spending taxpayer money. I am not alone in my agreement with most of what is being said in this thread. The spook supplying heroin to Adam Back's lover agrees with most of this thread, as does the spook peeking through Eric's window (although she disagrees with the suggestion to "let Eric's unit survive unmolested"). The one exception is the grandson of Patton who is doing surveillance on Monty. His method is quite simply to beat Monty to the phone. Spooky (isn't it?) From declan at well.com Fri Oct 10 09:05:39 1997 From: declan at well.com (Declan McCullagh) Date: Sat, 11 Oct 1997 00:05:39 +0800 Subject: The Globalization of Chile, from The Netly News (fwd) Message-ID: ---------- Forwarded message ---------- Date: Fri, 10 Oct 1997 08:51:15 -0700 (PDT) From: Declan McCullagh To: fight-censorship-announce at vorlon.mit.edu Subject: The Globalization of Chile, from The Netly News ************* http://cgi.pathfinder.com/netly/opinion/0,1042,1484,00.html The Netly News Network (http://netlynews.com/) October 10, 1997 The Globalization of Chile By Declan McCullagh (declan at well.com) The wires are clogged again in Chile, a country with no shortage of Net-enthusiasm but little way to express it. Bandwidth is so limited in this remote country, which stretches almost to Antarctica, that local netizens wake up early or stay up late to log in (this report had to be filed via fax). Chile's connections to the outside world total about 9 Mb/sec, the same size pipe that a small U.S. Internet provider uses to connect to the Net. Chileans intend to change this. By next summer, fiber optic cables will gird the country on the east and west, snaking south from Brazil and Peru. The country's connectivity will jump to 200 times its current bandwidth. Even now, though, there's plenty of excitement about the Net in the capital, Santiago. Apple Chile, H.P. and the Cafe Internet Cybercenter line the Avenue Andres Bello. The REUNA Internet World Conference, which ends today, attracted hundreds of local businessmen. Companies such as Business News Americas email (for a fee) daily economic reports from Chile to American investors and analysts. But even if younger Chileans are cyber-savvy, the country remains staunchly conservative. Nearly 90 percent of Chileans are Roman Catholic (it was once the state religion) and Chile remains the only Western country where both divorce and abortion are illegal. Geography, too, has an effect. The South American country is ringed by deserts to the north, the Pacific Ocean to the west and the lofty Andes mountains to the east. [...] From nobody at REPLAY.COM Fri Oct 10 09:52:08 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sat, 11 Oct 1997 00:52:08 +0800 Subject: Thanks Peter! / Re: russia_1.html Message-ID: <199710101639.SAA26517@basement.replay.com> On Wed. Oct 8, Human Gus-Peter wrote: > Tell Declan that he should probably go visit his mom, or something, > like next Friday, until at least Monday (because that's when my mom > leaves Washington, 'you know where.'--{boy, is *she* going to be > sorry she grounded me on my uncle's weekend away from the 'Home'.}) > > My uncle's going to be mad when he finds out I took his suitcase, > but he couldn't even get his Heathkit radio to work, and I *almost* > did. Besides, you should never trust anyone over fifteen, eh? > (And these things are dangerous in the wrong hands, eh?) On Fri, Oct 10, Declan wrote: > The Netly News Network (http://netlynews.com/) > October 10, 1997 > > The Globalization of Chile > By Declan McCullagh (declan at well.com) > > The wires are clogged again in Chile, a country with no shortage > of Net-enthusiasm but little way to express it. Bandwidth is so > limited in this remote country, which stretches almost to Antarctica, > that local netizens wake up early or stay up late to log in (this > report had to be filed via fax). Staying until Monday, Declan? Little Peter From tcmay at got.net Fri Oct 10 09:58:04 1997 From: tcmay at got.net (Tim May) Date: Sat, 11 Oct 1997 00:58:04 +0800 Subject: Corporate Access to Keys (CAK) Considered Harmful In-Reply-To: <199710081706.SAA00194@server.test.net> Message-ID: At 11:48 PM -0700 10/9/97, John W. Noerenberg wrote: >Moreover, it is not unheard of during legal discovery for email to be made >subject to search (Our lawyers are constantly tut-tuting about all the >email that is saved). So to say it is not used for long-term storage is >simply incorrect. Not surprising that your lawyers are worried about extensive mail archives. Imagine the juicy things that must lie in gigabytes of archived e-mail messages! (Or the messages which can be twisted by skilled lawyers into seeming to be anticompetitive, price-fixing, conspiratorial, etc.) I don't think we've yet seen a good example of massive amounts of e-mail being examined in a "discovery" process, yet, but we saw the effects on IBM during its antitrust issues in the 70s. Basically, every scrap of paper, every desk calendar, every internal memo, everything, had to be turned over to opposing counsel. We will almost certainly see some examples of where lawyers demand access to all company e-mail. (When I was at Intel there were periodic purges of old memos, old reports, old scraps of paper. Ostensibly this was to cut clutter, but the real reason was, probably, that Intel feared old memos and reports would be demanded by AMD or whichever competitors were suing Intel, or by a government bent on breaking up the world's most powerful chip monopoly (as the Feds saw it). As a sidenote, I kept nearly all of my old reports and papers, and this came in handy several times...others had purged their corporate memories, but I had the needed information to solve a problem.) I can imagine that companies are getting very worried about the possibly "discovery" of their increasingly computerized communications systems, with lawyers pawing through gigabytes with keyword searches for anything to help their case. (And there are similar examples in the political sphere. E-mail in the President's "PROFS" system during the Iran-Contra controversy was acquired; the Ollie North crowd thought they had deleted the messages implicating them, but the PROFS backups revealed all.) Is there a solution? Well, "key recovery" is probably one of the _worst_ solutions! (This is in my opinion. If I had a company I'd fear a CAK system would be used against my company. Expect CAK keys to be the first things demanded in the discovery process.) Certainly lawyers can subpoena the holders of various keys, and I'm certainly not saying that having X hundred separate, non-CAKked keys means the discovery process hits an insurmountable obstacle. But it is certainly true that having a large repository of all e-mail, conveniently accessible with a small number of easily subpoenaed CAK keys, is an overwhelmingly tempting target. If CAK is implemented, and these corporate discovery trends continue, expect to see less communication through the official corporate channels, and more through personal accounts. (E.g. people will use the Net to access other accounts, even Web mail throwaway accounts, to communicate even with persons in their own company!) It may be that PGP, Inc. and the other companies claiming "communications plaintext recovery" is so important are talking to the wrong groups of lawyers at various companies. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From aba at dcs.ex.ac.uk Fri Oct 10 10:21:13 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sat, 11 Oct 1997 01:21:13 +0800 Subject: secure phone on a PCI card? (Re: authentication suggestion for secure phone) computationally infeasible jobs for MITMs) In-Reply-To: <3.0.3.32.19971010100231.00a56c60@labg30> Message-ID: <199710101622.RAA03364@server.test.net> John Deters writes: > At 01:15 PM 10/10/97 +0100, Adam Back you wrote: > >Persistence authentication suggestion: > > The problems with this solution are twofold: > > 1. Eric may have to redesign the unit to have persistent read-write > storage. And maybe a *lot* of storage, if you use it a lot. Maybe a lot > of expen$ive $torage at that. His phone is already priced way out of the > consumer market, let's not add to that. If it cost a lot extra, that could be a problem, yes. I am unclear on how much extra this would cost. Apart from an EEPROM, it's a protocol and software update right? > 2. I had problems with UUCP when my machines got out of sync (way back > when.) Just think how bad they'll look if they refuse to light up "secure" > because one guy had to change batteries. Use an EEPROM? > I agree with you that external authentication is the only way to > fly. And if it is simply accepted, lets let Eric's unit survive > unmolested and use PGP out-of-band (as per Monty's suggestion) or > use PGP to exchange session keys (like in Speak Freely.) > I also think the most likely avenue of attack will be a black bag > job on the individual user's phone. MITM attacks seem too risky and > expensive to pay off. For individuals perhaps. For military intelligence or mafia boss type uses perhaps not. Or perhaps not for lower security apps too: buy a small landline phone to use as a handset, carry your box with you every where you go, never let it out of your sight, move around a lot, hotel rooms, anywhere else random you can get a phone jack socket. I reckon there would be potential clients who might fit this life-style. On the cost front, I am interested as to thoughts on how easy it would be for Eric to put one of his phones on a PCI card, or PCMCIA card. Presumably you could make some major cost savings in this way, in that you could potentially use the computers modem, memory, processor. PGP Inc's pgpfone I think is sort of compatible with Eric's phone. However pgpfone audio quality _sucks_. (Admittedly one end was using a 14.4k modem when I tried it -- but it was _terrible_, even no encryption was fairly bad). I think Eric's phone uses a 14.4k modem chip (or lower?) so it's not the bit rate as such, but more the lack of higher quality audio compression codecs which are possible in hardware. (Right?) Also the fact that with PGPfone you're using PC speakers, and room microphone probably makes it seem worse than it could be. A socket to plug a phone into to act as a speaker/microphone would be a good start, plus the audio codec part of the Eric's hardware. Now what do you reckon you could get the price of that down to? How would that work out with a PCMCIA card... I'm thinking of laptops using GSM mobile phones data links, what would the audio quality be like over the 9600 bit data rate over a GSM mobile phone? If it could work it would be neat as you'd have a fully mobile secure phone. Better than Jim McCoy's cell phone strapped to his laptop: secure phone PCMCIA card in one PCMCIA slot, PCMCIA modem in the other slot, mobile phone plugged into PCMCIA modem, al-cheapo phone handset plugged into secure phone PCMCIA card. Tangle of wires, but still neat. Pity GSM phones don't have audio in, and mike out jack sockets, which get selected when you plug in the data lead, or you could use the GSM phone handset. Course adding the whole lot to a GSM phone would be even neater, but then that'd get expensive again. Wonder how much functionality could be borrowed from components already present for the normal GSM phone hardware, and how much saving you could get from that. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Adam Back writes: > I'm arguing that you should not backup, or escrow communications keys, > and that you should backup storage keys. Euphemism alert: when we are talking about the kind of data recovery we like, we call it "backup". When we are talking about the kind we don't like, we call it "escrow". Schneier did the same thing: Bruce Schneier: > Key escrow = someone other than the author or the intended recipient of the > message being able to decrypt it. > > There are valid reasons for data backup, but they have nothing to do with > crypto key recovery. You don't actually mean that you should backup storage keys, you mean you should provide a means for someone other than the user to decrypt that stored data. Schneier means the same thing with regard to "data backup". > (forward secrecy) This could be a good idea, particularly in terms of old keys leaking out, but it needs more work. It's not clear that any of the forward secrecy methods will work for email. You can't easily do a DH key exchange via email because of the multiple messages. Maybe you could piggyback on ordinary messages, and after a few have been exchanged, you can get a DH key for the next message, but this is very complicated. Synchronization isn't guaranteed with email, neither is reliable delivery. > (untransferable signatures) This is also a good idea, but it needs more work, too. There is a big education problem here. People barely understand the implications of regular digital signatures. Now you are throwing this new kind in, which guarantee the message came from another person, but aren't binding. What happens when an employee receives a message from a supplier signed with that kind of signature? Can he make a decision on that basis, or not? In paper business correspondence, there is no such distinction. A signed letter is transferable. Go beyond this and business will be scratching its heads. It's a solution looking for a problem. There may be patents on these technologies, too. > (re-encrypting email with an escrowed key for archival) This is going to require special archival software and special actions on the part of users. You won't be able to do it as a transparent plugin. The user can't save his mail the regular way (with some email packages), he has to remember to (also?) save it to the business access archive. If he forgets, the business owner has lost access. There will be extra training costs, and people will have to change their habits. Besides being more complex to design and implement, it will be harder to sell to customers. From tcmay at got.net Fri Oct 10 10:34:58 1997 From: tcmay at got.net (Tim May) Date: Sat, 11 Oct 1997 01:34:58 +0800 Subject: CAK as a really bad form of corporate networking Message-ID: I've been scratching my head, trying to figure out what the market for PGP's new recovery program is for. After all, if employees have local disks and these disks are on a company network or backup plan, then the corporation has access to the plaintext of memos, reports, and plaintext sent and received e-mail. (The purpose of Alice encrypting to Bob being _in-transit_ security, and nothing more.) It seems to me that the CAK (Corporate Access to Keys) approach being talked about, where Alice encrypts to Bob and _also_ encrypts to Eve, is a poor solution to the "archiving" problem. As Adam Back and others have noted, if Alice stores her Eudora or whatever e-mail files on her systems, presumably in plaintext (as the purpose of encrypting with Bob is for _in-transit_ security, not storage security), then the corporation can insist that she make her plaintext files archivable on the company's backup system. One way to look at the market for CAK is that a company is too flaky to have a corporate network or backup strategy and is using CAK as a kind of crude networking scheme. E-mail, with cc:ing of the company crypto czar, is a way to archive or pool company traffic. A rather back-assed approach, it seems to me. Meaning no insult to PGP, Inc. or its fine programmers, it's as if this message was sent out: --begin internal Giant Corporation memorandum-- From: Cakbert, Evil PR and Security Administrator To: All Droids Subject: Mandatory Voluntary CAK System It has come to my attention that our attempts to get a corporate-wide network working have failed, and that we are using a mishmash of intranets, local LANs, and direct dial-out systems. This is thwarting our efforts to read what you people are writing to each other. Henceforth, to solve this network problem we must insist that you adopt a mandatory voluntary system of cc:ing me, Cakbert, on all of your messages. Encrypted messages must be voluntarily encrypted with PPP (Pretty Poor Privacy). Thank you for your attention. --end internal Giant Corporation memorandum-- --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From anon at anon.efga.org Fri Oct 10 10:35:37 1997 From: anon at anon.efga.org (Anonymous) Date: Sat, 11 Oct 1997 01:35:37 +0800 Subject: America as a Shake Down Extortion State Message-ID: <800ba9b5ce70bcdb069766023ed9e797@anon.efga.org> -----BEGIN PGP SIGNED MESSAGE----- Ryan Anderson wrote: >Tim May wrote: >>The debate over crypto almost certainly fits this pattern. If and when a >>domestic ban on crypto is likely to pass and be signed, companies like RSA >>and PGP will face extinction. This will then "incentivize" executives of >>these companies to release funds, in the form of campaign > >Actually, I think it's a little more likely that they'll get disgusted with >Congress, and collect some money for the ACLU to use to pay their lawyers in >the instant filing of the consitutionality challenge. > >Seems to be a much more productive way to spend your money (long-term). Bullshit! Fuck the lawyers! By wasting time and money in the courts bickering about the stupid laws that buffoons in Congress pass in order to justify their existence, we are only ignoring the real issue: you cannot use the system to change the system. What amazes me is the amount of time and energy well-intentioned folks piss away trying to convince legislators to "do the right thing". By paying attention to these idiots, we are in effect legitimatizing their actions. If enough people come to their senses and ignored this bogus legislation, we will all be much better off in much less time. Tim May wrote elsewhere: >Face it, Amerika is basically a Mafia shake-down operation, with the power >of the State used to shake down protection money. > >This is why I favor crypto anarchy: by concentrating on ignoring laws and >deploying technology, this extortion state system is bypassed. Exactly. Spend the money on deploying the technology. Don't waste it lining the pockets of scum legislators and their litigious brethren. The big question is do PGP, RSA, Netscape et al have the balls to stand up for themselves and tell the DC politcos to fuck off? We can only hope... [ Imastun ] - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzQ+SNwAAAEEANhUVaFtM+8ZLhEhur55LhN0m/aUyemwVExEq96RUXkQlvBw H45ZcEMYzml7k2hM84rQiJEd/BPi18dhtXykz0vYqmke6BKDiAsR95ik+Jm3XXMU OQgHo0+asRJ85BOG+jm3424e4vY5/eTFaExNISW5T8XD+qgRgnC/ZQW0eQF1AAUR tBZJbWFzdHVuIDxsaWJlcnR5QHJpc2s+iQCVAwUQND5KIXC/ZQW0eQF1AQESOwP+ MPNlXlv/hzqoAaqXu4RpNR02XcMLOB5DwhG1pLij3Tt6uYfRqZul8eJ9LxvQ0R/R eT7g+j3dNpjcOSdCci4VYAPfdBK78esgDIn61cOiN29fGRwjJOO5rup9RvXBQt+T +Sf7D1gYlr/aDUGKMiBGGZhx2git7zpL7uqnvQn0WY8= =bXK7 - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBND5M5HC/ZQW0eQF1AQE4HwP+JJ1eiIFGVguO5PwRsRl0gAiVxYiSGpHP 6h8le1QAgNJTlCz7C/ObNjVmtHnw6vjcYewLXSsnF59cRPakAD/Y4NLSLP/vPzWk gbx6t9X8hb0vC2LWOA/UcXZQBoqfLEXexm4LehKU0LpDL7ggy6SBw8PDEOr3InSh f15W51XTv/0= =OBNd -----END PGP SIGNATURE----- From 13993666 at juno.com Sat Oct 11 01:56:04 1997 From: 13993666 at juno.com (13993666 at juno.com) Date: Sat, 11 Oct 1997 01:56:04 -0700 (PDT) Subject: FREE HEALING SECRETS FROM THE BIBLE Message-ID: <1882077.776@juno.com> An Amazing Rediscovery! For over 6,000 years we've had FIFTY of the MOST POWERFUL NATURAL HEALING AGENTS on the planet right in front of us and we didn't even know it!! NO, this information is not about herbs, minerals, enzymes, or anything else that you are familiar with. FIND OUT ..What was uncovered in KING TUT'S TOMB. ..What is mentioned in the BIBLE 188 TIMES? ..What deals with over 500 MENTAL AND PHYSICAL PROBLEMS? ..What is the "MISSING LINK" IN NATURAL HEALING? ..What 8-year-old company recently began bringing these healing secrets to the public through networking? ..What was voted "MOST POWERFUL AUDIOTAPE" for 1997? Are you looking for a health and nutrition company that is TRULY COMMITTED to YOU for health in BODY, MIND, AND SPIRIT? IF SO CALL (800) 953-9234 Extension 10. LIVE OPERATORS ARE STANDING BY 24 HOURS A DAY! WE'LL RUSH YOU OUR FREE INFORMATION PACK. Your pack will include the life-changing audiotape "The Missing link" by international health expert, Dr. Gary Young. BUSINESS OPPORTUNITIES are still available, including your own FREE website with autoresponders. CALL TODAY! This very unusual WINDOW OF OPPORTUNITY won't stay open very long. YOU'VE NEVER SEEN ANYTHING LIKE THIS!!! CALL FOR YOUR FREE PACK TODAY! From tp at dev.null Fri Oct 10 10:56:46 1997 From: tp at dev.null (The Prosecutor) Date: Sat, 11 Oct 1997 01:56:46 +0800 Subject: Corporate Access to Keys (CAK) Considered Harmful In-Reply-To: <199710081706.SAA00194@server.test.net> Message-ID: <343E6766.2573@dev.null> Tim May wrote: > At 11:48 PM -0700 10/9/97, John W. Noerenberg wrote: > >Moreover, it is not unheard of during legal discovery for email to be made > >subject to search (Our lawyers are constantly tut-tuting about all the > >email that is saved). So to say it is not used for long-term storage is > >simply incorrect. > > Not surprising that your lawyers are worried about extensive mail archives. > Imagine the juicy things that must lie in gigabytes of archived e-mail > messages! (Or the messages which can be twisted by skilled lawyers into > seeming to be anticompetitive, price-fixing, conspiratorial, etc.) So, Mr. May...I see that you have instructed your "skilled lawyer" to make certain my client's email messages are "twisted" to seem anticompetitive, price-fixing and conspiratorial. Now all I have to do is find a client to sue you... The Prosecutor "Hold that ambulance!" From tcmay at got.net Fri Oct 10 11:36:41 1997 From: tcmay at got.net (Tim May) Date: Sat, 11 Oct 1997 02:36:41 +0800 Subject: CAK as a really bad form of corporate networking In-Reply-To: Message-ID: At 10:28 AM -0700 10/10/97, Tim May wrote: >As Adam Back and others have noted, if Alice stores her Eudora or whatever >e-mail files on her systems, presumably in plaintext (as the purpose of >encrypting with Bob is for _in-transit_ security, not storage security), >then the corporation can insist that she make her plaintext files >archivable on the company's backup system. I should add that Alice may have encrypted files on her local hard disk. Nothing in PGP for Business, as I understand it, stops Alice from storing files without also encrypting to Cakbert's key. That is, Alice can store encrypted files to her heart's content. (If in fact PGP for Business even requires a corporate encryption for stored files, then I missed this in the description. My apologies. Actually, to close this glaring loophole, I would expect PGP for Business to insist on a corporate key being used even for private files. Of course, without communicating those files to the corporate data center, all Alice has to do is corrupt the stored file a little, or delete it, and she's back to encrypting in ways only she can use.) A tree chart is really needed to see where PGP for Business works and where it doesn't work. The charting of the permulations, of who encrypts, who keeps the plaintext versions around, etc. is complicated, but instructive to do. (Does Alice encryp to Bob? Does Alice store the plaintext or leave things encrypted? Does Alice make her local disk archivable by corporate backup systems? Etc.) My conclusion is that PGP for Business does very little for real corporate access in "hit by a truck" situations, as most of these critical files (fill in the blanks, but think of chip design files, source code for programs, lab notebooks, etc.) are simply NOT ever e-mailed. And if they are e-mailed, this is completely a tertiary issue. To put it simply, if Joe the Programmer is hit by a truck, reconstruction of his project files will come almost entirely from what he has on his hard disk, on backups he or the company made, on his papers, etc. Almost none of it will come from the e-mail he sent to others. And, in any case, his recipients presumably have copies of the e-mail he sent them. Maybe they don't, but if this is a function of PGP for Business, then it says that file archiving is really one of the main functions. Which is possible, but there are better ways to archives records! If a company is worried that an employee will forget his passphrases, or be hit by a truck, or leave on bad terms, or whatever, then the obvious solution is to have him carefully make a backup of his passphrases and secret keys and place them in a safe and accessible place, e.g., in the safe of the company attorney. This is what all prudent persons do with their keys, right? Such precautions are standard for crypto work, and have nothing to do with what PGP for Business is apparently doing. Further, I would argue that PGP for Business gives a false sense of security. What real use is access to some bullshit e-mail if the prudent steps outlined above have been ignored? We know that the push for GAK is for access to _communications_ keys. We know that Alice and Bob have no need to GAK their _communications_. The real customer for GAK is an eavesdropper, not Alice or Bob. So who is the real customer for PGP for Business and its form of plaintext recovery? --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From rwright at adnetsol.com Fri Oct 10 11:58:54 1997 From: rwright at adnetsol.com (Ross Wright) Date: Sat, 11 Oct 1997 02:58:54 +0800 Subject: Spammers Plan Backbone Message-ID: <199710101846.LAA25809@adnetsol.adnetsol.com> http://www.zdnet.com/chkpt/adt1010nk/www.anchordesk.com/story/story_1343.html Yippie! Spam wars intensify as bulk emailers plan own Internet backbone. AOL, other ISPs threaten to fight back. Spam is FREE SPEECH!!!! =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: (408) 259-2795 From tcmay at got.net Fri Oct 10 12:14:12 1997 From: tcmay at got.net (Tim May) Date: Sat, 11 Oct 1997 03:14:12 +0800 Subject: DoD Asks Me to Stop Quoting From the Congressional Record In-Reply-To: <61l7cn$rc$1@gail.ripco.com> Message-ID: <199710101947.MAA14304@always.got.net> (A copy of this message has also been posted to the following newsgroups: alt.censorship, alt.privacy,comp.org.eff.talk,misc.legal) In article <61l7cn$rc$1 at gail.ripco.com>, glr at ripco.com (Glen Roberts) wrote: > I received a letter yesterday from the Office of the Secretary of > Defense. It politely asked me to stop quoting from the U.S. > Congressional on my website, and I presume they are also asking me > not to include such quotes on my radio show or print publications. > > Keep your eye out for a copy of their letter and my response... > I'll be anxious to see it. Certainly they have no legal footing, as the Congressional Record is just that, a record of what our elected Congress is doing and saying. The CR is, as we all know, widely available and meant to be quoted. This is why things, including a lot of nonsense (actually, _mostly_ nonsense) is "read into the Record." Or simply submitted to the CR for inclusion. As for any possible military secrets being disclosed, this is what closed hearings are for. Not that I necessarily approve of how many closed hearings there are, but this is what they're meant for. It would be consistent with trends of the past few decades if the Congressional Record becomes subject to secrecy laws. Hell, if were a Congresscritter I know I'd certainly want some of my stupid remarks stricken from the record and discussion of them banned. Let us know what happens. By the way, if the DoD pushes on this issue, you may find using mirrors of the CR, with pointers, another way to go. Don't actually quote the offending secruts, just give pointers to them. But quoting the CR is almost certainly fully legal. --Tim May -- The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From ah at dev.null Fri Oct 10 12:15:56 1997 From: ah at dev.null (A. Hoir) Date: Sat, 11 Oct 1997 03:15:56 +0800 Subject: InfoWar Epilogue 0 (Part III of 'The True Story of the InterNet') Message-ID: <343E7B2F.4E40@dev.null> A non-text attachment was scrubbed... Name: not available Type: text/html Size: 3532 bytes Desc: not available URL: From ah at dev.null Fri Oct 10 12:26:27 1997 From: ah at dev.null (A. Hoir) Date: Sat, 11 Oct 1997 03:26:27 +0800 Subject: InfoWar Epilogue 0 / TEXT Message-ID: <343E7B9A.BC8@dev.null> ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * Epilogue * d'Shauneaux ---------------------------------------------------------------------------- Epilogue ---------------------------------------------------------------------------- Gomez surveyed the wreckage with a discerning eye, before turning toward the mountains in the distance and fixing upon them with a penetrating stare that burned like a laser toward the chief target of his hatred, wherever they might be. "They are finished." he said, with certainty, turning to the Commander of his Dark Forces, and instructing him, "Now finish them!" ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- d'Shauneaux Except that you have spent literally a lifetime involved in a world of shadows, where even those things which are not done with mirrors are resonating indeterminately and obliquely, then you have little hope of ever recognizing the true depth to which the world you live in is ruled by secrecy, subterfuge and intrigue. Unless, of course, you are a follower of an ancient sage named Dilbert, and are steeped in the history and lore of Office Politics, in which case you undoubtedly already have all of the tools you need to understand what I am about to tell you. (And could probably even teach an old dog-foot soldier such as myself a few new tricks.) The lineage of the Author, as well as those of d'Shauneaux and Rom Dos, were each given information on a basis, not of 'need to know,' but more along the lines of 'need to figure out.' (That's 'decrypt' or 'decipher' for you CypherPunks.) The reason for this was that, at the time of the formation of the Circle of Eunuchs, the Evil One not only had his tentacles spread throughout society in general, and the computer industry, in particular, but had also made great progress in 'encrypting' Reality, so to speak. Even the Magic Circle did not fully realize the extent or import of this for quite some time, but they did recognize that they were playing 'catch-up' and needed not only to learn from the past, but also to reach toward the future. The Circle of Eunuchs, not being restrained by the need for absolute control and coordination of their efforts, as the Dark Allies were, made an astounding amount of penetration into the highest levels of the computer industry, in a short period of time. The individuals involved, working on their own or in small guerrilla cells, were able to 'move camp' at an instant's notice, changing the direction and focus of their entire career, if need be, which was of great benefit in such a quickly burgeoning technology. Despite their astounding success in placing their ersatz players in the midst of some of the most sensitive arenas of Gomez's grand technological game, the Circle of Eunuchs knew that they lacked possession of the key that would unlock the doors of deceit and allow them to expose the malfeasance underlying the technology that was increasingly ruling both the bodies and minds of all mankind. Then, something extraordinary happened� A no-name individual who would have had to raise his station in life in order to become known as a bit-player in the computer arena suddenly became the target of a full-scale attack by the Dark Forces over a seemingly insignificant program called Pretty Good Privacy. Phil Zimmerman� ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ---------------------------------------------------------------------------- From aba at dcs.ex.ac.uk Fri Oct 10 12:41:13 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sat, 11 Oct 1997 03:41:13 +0800 Subject: do NOT escrow communications keys In-Reply-To: <199710101715.TAA00367@basement.replay.com> Message-ID: <199710101928.UAA04746@server.test.net> Anonymous writes: > Adam Back writes: > > > I'm arguing that you should not backup, or escrow communications keys, > > and that you should backup storage keys. > > Euphemism alert: when we are talking about the kind of data recovery > we like, we call it "backup". When we are talking about the kind we > don't like, we call it "escrow". > > Schneier did the same thing: > > Bruce Schneier: > > Key escrow = someone other than the author or the intended recipient of the > > message being able to decrypt it. > > > > There are valid reasons for data backup, but they have nothing to do with > > crypto key recovery. It's getting difficult to speak English around here, what with the GAKkers redefining the terms and issuing updates to the NewSpeak dictionary every month or so. "escrow" already meant an object kept safe for one's own benefit. Or it did, until the GAKkers perverted it, and redefined it's meaning to be backdoor for another person or organisations benefit (government/spook benefit in their case). Key recovery sounds like the process of using your backup plan to recover keys. You would think it means a plan to recover your keys in case you have a hard disk crash or whatever. Again for your own benefit. But no, with another new edition of the newspeak dictionary it suddenly means backdoor, master key for government or other organisation to access your communications. (I also might admit to a small amount of hyperbole, "dastardly evil government/spook/TLA master backdoor access" as compared to "backing up your hard disk now and then is a good idea". But hey, that's the way I feel about it.) > You don't actually mean that you should backup storage keys, you > mean you should provide a means for someone other than the user to > decrypt that stored data. Thank you. With the obvious caveat that any given user may not want this, but that if you are holding information for other people, that is the information is other peoples valuable property, and the machine belongs to that other person too, then you might find it useful to give them a copy of the storage encryption key in case of disaster. In fact if they are employing you, and the machine is theirs they might reasonably insist upon it. You clearly have the option not to store your own private information on the machine. In fact your employee may have policies discouraging you from doing so. > Schneier means the same thing with regard to "data backup". The point about using the terms "data backup" and "data recovery", is that it attempts to highlight the falacy of the fundamental misconception buzzing around, as a result of the lastest issue of the newspeak dictionary released from DC, that it is "essential and in companies interests to be able to recover transient messages". This is bogus. What is important is recovering DATA (using your backup tapes to "recover" your data, when you have a disk crash). Jon Callas' attempted invocation of the "key recovery bad" / "data recovery good" mantra, was somewhat amusing in that he _was_ arguing for data recovery, whilst implementing key recovery (or at least transient communication message recovery). > > (untransferable signatures) > > What happens when an employee receives a message from a supplier > signed with that kind of signature? Can he make a decision on that > basis, or not? The legal beagles at your company will decide a policy for you designed to minimise your companies chances of being sued over the contents of your communications, and hence losing it's shareholders money. > In paper business correspondence, there is no such distinction. A > signed letter is transferable. Go beyond this and business will be > scratching its heads. It's a solution looking for a problem. No, it's a solution to a problem. It's a solution to the problem that Tim just explored in more detail, and one that I gave a few short comments upon in one of my posts in this thread. If your company can't be proven to have authored a document, it reduces the value of that the document to an opponent doing attempting to do creative legal work and create a headache for you company when your archives are requested in a discovery process. > There may be patents on these technologies, too. Don't think so. It's simple enough technology. > > (re-encrypting email with an escrowed key for archival) > > This is going to require special archival software and special actions on > the part of users. Yes it'll need special archival software; but you're providing an integrated business solution right. PGP Inc's (are you a PGP employee?), already includes a number of components. Key server, SMTP policy enforcer, PGP for business. I might also point out that the current PGP for CAKware (pgp5.5) solution also has the same problem. Just because the message is encrypted to a second recipient, is no guarantee that the user is archiving it for you. Say the user receives some email which is hot, hot, hot, and immediately purges it from the received folder on eudora, or netscape, or PGP for business. So, now what good is your CAKware going to do for you? You don't have the message. Therefore you have the same problem if you wish to guarantee access to messages. > You won't be able to do it as a transparent plugin. The user can't > save his mail the regular way (with some email packages), he has to > remember to (also?) save it to the business access archive. Look, I'm not in favour of CAK, or GAK, or any other snoopy business, PGP are the ones arguing for that. What I'm proposing is that firstly you don't encourage people to do it. But, if you're convinced that people will shop elsewhere unless you do provide archival facilities readable by the company, and snooping facilities, I'm arguing that you ought to do it in such a way that the resulting system isn't useful for _Government_ access to keys. So given that set of criteria I think it's entirely reasonable to say to clients who demand encrypted user archival: - You'll need new email clients on all your desks And reasonable to tell clients who demand that the archive be central, (to prevent users deleting archived messages that don't suit them) that: - You'll need to buy the LAN archive server module also I also think it's entirely reasonable to tell clients who demand snooping: - you're little brotherish SOBs - the client will send your LAN archiver a copy after the user has decrypted - the client will send you a copy of sent email prior to encryption So, to answer: > If he forgets, the business owner has lost access. He won't forget: it will be integrated into pgp5.6 "for business for people who don't like GAK" PGP mail clients. > There will be extra training costs, and people will have to change > their habits. Well they're going to have to learn how to use pgp5.6, but frankly it's just as easy to use as pgp5.0 for personal security. > Besides being more complex to design and implement, Oh come on, I think PGP Inc will be able to hack it. Most of the design I already worked out for them in the last few posts. > it will be harder to sell to customers. And there's the rub. What comes first: profits, or selling out to the US government. I'm sorry, but I think PGP has sold out on this one. You can justify most of the aspects of the system I outlined in terms of security. It is more secure. Using forward secrecy is more secure again, and imposes the same restrictions anyway. You can therefore use the line: - you want to marginally easier to integrate snooping at the expense of security? - what if your competitors also get to read your communications? Also, might carry some weight: - PGP is the standard solution, it doesn't work that way, for security reasons. If you use competitors products which do work that way, you'll be unable to communicate with the rest of the world Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <11579.876513953@zelkova.qualcomm.com> At 9:50 PDT on Friday, October 10, 1997, Tim May wrote: |I don't think we've yet seen a good example of massive amounts of e-mail |being examined in a "discovery" process, yet, but we saw the effects on IBM |during its antitrust issues in the 70s. Basically, every scrap of paper, |every desk calendar, every internal memo, everything, had to be turned over |to opposing counsel. | |We will almost certainly see some examples of where lawyers demand access |to all company e-mail. Several lawsuits about discriminatory denial of tenure have been won partly based on the contents of email. The University of Illinois periodically reminds all staff that email is considered a public record and that they should conduct their business with that in mind. /pbp From eb at comsec.com Fri Oct 10 14:25:51 1997 From: eb at comsec.com (Eric Blossom) Date: Sat, 11 Oct 1997 05:25:51 +0800 Subject: secure phone on a PCI card? (Re: authentication suggestion for secure phone) computationally infeasible jobs for MITMs) In-Reply-To: <199710101622.RAA03364@server.test.net> Message-ID: <199710102057.NAA02969@comsec.com> Adam Back writes: > John Deters writes: > > At 01:15 PM 10/10/97 +0100, Adam Back you wrote: > > >Persistence authentication suggestion: > > > > The problems with this solution are twofold: > > > > 1. Eric may have to redesign the unit to have persistent read-write > > storage. And maybe a *lot* of storage, if you use it a lot. Maybe a lot > > of expen$ive $torage at that. His phone is already priced way out of the > > consumer market, let's not add to that. Hey, it's only a factor of two too expensive... Moore's law is your friend... > If it cost a lot extra, that could be a problem, yes. I am unclear on > how much extra this would cost. Apart from an EEPROM, it's a protocol > and software update right? The units currently have 2K bytes of EEPROM and 256K bytes of FLASH. A little under half the flash is currently available, though it will probably be taken advantage of during remote upgrades (coming soon to a crypto phone near you...) There's plenty of room for long term storage of a reasonable set of public keys. Private or symmetric keys present a problem, since then you've got a long term secret to store somewhere. To forestall a bunch of questions about remote upgrades: (1) there is a jumper on the write line to the FLASH. If you're totally paranoid, leave it in the "Read Only" position. (2) upgrades will be digitally signed. (3) It'll be a "pull" upgrade. I.e., you have to request the upgrade. They're not just pushed down your throat. > On the cost front, I am interested as to thoughts on how easy it would > be for Eric to put one of his phones on a PCI card, or PCMCIA card. > Presumably you could make some major cost savings in this way, in that > you could potentially use the computers modem, memory, processor. I can pretty much be done all in software on a laptop. I've explained the details several times. Perhaps if folks we're paying me lots of money for the info, they would listen closer ;-) The primary thing you lose is the simple integration with the telephone. A small (cheap) hardware hack can work around this. Yes, I know you'd prefer not to have any non-standard hardware, but on the other hand, if the system is a pain in the ass to use, nobody is going to use it. > I think Eric's phone uses a 14.4k modem chip (or lower?) so it's not > the bit rate as such, but more the lack of higher quality audio > compression codecs which are possible in hardware. (Right?) The unit currently runs at 14.4k. A 4800 b/s fallback mode is currently under development. > Also the fact that with PGPfone you're using PC speakers, and room > microphone probably makes it seem worse than it could be. Fixable with software and MIPS (you've got those). Take a look at those nice USR and Polycom full duplex speaker phones. There's nothing magic in them. Notice the neat little song they play when you power them up. It's a training tone used to compute the impulse response of the room. > Course adding the whole lot to a GSM phone would be even neater, but > then that'd get expensive again. Wonder how much functionality could > be borrowed from components already present for the normal GSM phone > hardware, and how much saving you could get from that. Pretty much everything you need is already there. It's a question of integration. Eric From staff at tnlb.com Sat Oct 11 05:32:48 1997 From: staff at tnlb.com (staff at tnlb.com) Date: Sat, 11 Oct 1997 05:32:48 -0700 (PDT) Subject: Open 4 new mirror locations ? Message-ID: <199710111231.FAA02738@toad.com> Now you can open 4 new locations for your business NEXT WEEK - just in time for the holiday shopping season. This is how one of our Clients DOUBLED Sales in less than four weeks... Is your site really getting enough traffic now? or is your site lost in the crowd.... The solution is simple but powerful. Multiple locations! If a prospective customer is looking for your products or services, who has the best chance of being found - someone with five locations or someone with one...plus you get the added bonus of the "accidental shoppers", people who will find you that didn't know your business existed. International Shopping Complex now averaging over a million hits per month, with shops from 28 different countries, announces mirroring package to business site owners. The first page of your site is copied by our teks and installed in the four mall locations. All links from your first page go back to your site, so you can still update your pages. Businesses (retail, wholesale, mfg, services) can now add their stores to these multiple sites for a special GUARANTEED package rate of $375.00, which includes all set up and a year's rent. Compare that to setting up four stores yourself! Plus, we give you details of a free promotion site which enables you to enter your 4 new URLs and you will automatically get 500 NEW LISTINGS to jump start your new sites. Offer expires October 17th. For Complete details please email: press at 1stworldwidemedia.com And put "send details" in the subject line. Thank you :) www.1stworldwidemedia.com ----------------------------------------------------------------------- This mailing is being sent to qualified business owners only. If it has reached you in error, please accept our apologies. If you do not respond, you will automatically be removed from any further mailing. ----------------------------------------------------------------------- From aba at dcs.ex.ac.uk Fri Oct 10 14:37:54 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sat, 11 Oct 1997 05:37:54 +0800 Subject: PGP CAKware & IETF controlled Open-PGP standard Message-ID: <199710102108.WAA05223@server.test.net> One aspect of PGP's controversial CAK system in pgp5.5 that I have not seen discussed is the standardisation aspects. How does the introduction of corporate access to keys (CAK), and government access to keys (GAK) features fit into the IETF framework? Are PGP Inc's CAK features intended to be part of the now IETF controlled Open-PGP standard? What is the IETF's stance on politics having influence on security? A weakly comparable example might be perhaps the IPSEC standardisation process, and the effect of export regulations on key sizes. Are IPSEC key sizes allowed to be restricted in the standards so that IPSEC products can be exportable? Now some would argue, and with some justification, that emails sent using company equipment are the property of that company. However there are other considerations also. Expectation of privacy is one. The negative aspects of a society in which most companies have become little brother institutions, becoming small versions of what many of us are fighting: mandatory government access to keys, big brother wanting the ability to read all traffic. I would be somewhat concerned if PGP Inc's recently announced the key escrow functionality becomes part of the Open-PGP standard, because it will set a bad precedent, and possibly force others who would otherwise wish to implement to the open-PGP standard to also implement features useful to secret service special interests in enforcing mandatory domestic government access to keys, or implement only partly compatible systems. I need hardly comment that such an eventuality is not in the interests of the internet community. Specific questions relating to the standard are perhaps: - Are the certificate flags informing the recipient that communications to a key is escrowed, and that email which is not encrypted to the escrow key will be bounced expected to be part of the Open PGP standard. - Can a conforming application ignore the key escrow flags? - Or must a conforming application display a suitable warning perhaps such as: WARNING: the person whose key you are using has the misfortune of being forced to use software supplied by a company which has sold out to key escrow, therefore you data may be read by others than your intended recipient. and perhaps a note tacked on to the email for the recipient to read: SAY NO TO KEY ESCROW. Boycot little brother and big brother. Don't buy PGP Inc software. or must conforming applications be more polite. Aside from the snide remarks about key escrow, I am concerned about PGP's actions harming internet privacy, and helping indirectly the introduction of mandatory key escrow which the US administration and UK secret service and department of trade and industry are pushing. A system which implements all the features necessary for mandatory key escrow as a business solution may indirectly help the mandatory key escrow proponents. Plausible events which might happen in such an event might be: - companies encouraged to use (or penalised for not using) open-PGP corporate escrow compatible systems - service providers also encouraged to use such systems - companies legally required to use such systems, and hand copies of corporate master keys to government (corporate escrow then becomes government escrow for business communications) - ISPs and individuals legally required to use such systems, and hand copies of corporate master keys to government (full blown mandatory key escrow) I am concerned about the possibility that the IETF might be steered by PGP Inc into putting features into the Open-PGP standard which are not in the interests of the internet community. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710102020.VAA05198@server.test.net> Tim May writes: > I've been scratching my head, trying to figure out what the market > for PGP's new recovery program is for. After all, if employees have > local disks and these disks are on a company network or backup plan, > then the corporation has access to the plaintext of memos, reports, > and plaintext sent and received e-mail. (The purpose of Alice > encrypting to Bob being _in-transit_ security, and nothing more.) > > It seems to me that the CAK (Corporate Access to Keys) approach > being talked about, where Alice encrypts to Bob and _also_ encrypts > to Eve, is a poor solution to the "archiving" problem. I'm finding this whole thing is surrounded by euphemisms, and newspeak. For example PGP's Jon Callas claiming that the main motivation for the system is to ensure availability of messages. As you point out this is bunk. This leaves as the only excuse for pgp5.5's existance corporate snooping of sent and received emails. PGP Inc is encouraging little brother and doing it in a way that provides tools for big brother, and is thereby paving the way for mandatory GAK. (Also Jon's flimsly claim that it isn't a "key escrow" system, I consider mere word play, whatever PGP Inc cares to call it, it's clearly a CAK system). > As Adam Back and others have noted, if Alice stores her Eudora or > whatever e-mail files on her systems, presumably in plaintext (as > the purpose of encrypting with Bob is for _in-transit_ security, not > storage security), then the corporation can insist that she make her > plaintext files archivable on the company's backup system. Perhaps my arguments of how you can build encrypted corporate snooping email archive systems without being GAK friendly are too complex. Just storing the data in the clear is easier to understand, and is probably what most corporates are doing anyway. I don't think most corporates are using storage encryption widely internal to their networks, and rely on a decent firewall, or an air gap. The obvious objection to the argument that you store your email folders in the clear, as I'm sure one of our anonymous PGP employees will point out again, is that: What if the email is archived encrypted in the eudora folder, or the netscape, or other MUA folder. The corporate snoop won't be able to read it without the employees co-operation. A similar objection applies to IMAP mailboxes, (IMAP being a POP3 like thing, but with the added functionality that the mailbox archive is kept on the server). If you're using PGP mail client software too, it can archive it in plain text, or encrypted with a corporate escrowed storage key as I was describing. Mostly mega-important email is going to be copies of stuff on disk anyway, as Tim points out. (Also I'd like to ask those who use other email clients than I how encrypted email is treated: with emacs mailcrypt, I have the option of archiving the decrypted email, or keeping the encrypted mail as is in the archive, so that you have to go back and decrypt it again to read old encrypted emails. How does the eudora plug in work? How does pgp5.0 work, and how does netscape with pgp plug in work.) To me a corporate snooping policy is not a good thing to encourage. I wonder if PGP Inc claim that corporate snooping is demanded by the industry. Another way to implement corporate message snooping is for the company to retain copies of users private decryption keys. (Plus to have the second crypto recipient on sent mail of the company snoop, but strip it off before it goes outside the LAN in the SMTP policy enforcer.) Still that's more GAKware, as if you remove the policy enforcer it's useful for GAKkers also. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 -----BEGIN PGP SIGNED MESSAGE----- Adam Back wrote: >Monty Cantsin writes: >> My apologies if this has already been discussed, but wouldn't this be >> a straightforward solution? > >John Kelsey described the same system. > >[adding hex passphrase digits exchanged via PGP to display digits] > >> Any flaws? > >See my other recent post in this thread... I think it doesn't work >because Mallet can recover the passphrase. You must remember that >when Mallet is actively doing a MITM attack he knows the digits on >the display of each party. With that info he can recover the >passphrase by subtracting. Then he can give Alice the correct >checksum for the link A<->M and Bob the correct checksum for the link >M<->B. Oh, I get it. Thanks. And now I get why people want to assign passwords to each digit. Mallory has no way of knowing all the mappings, even when one is revealed. Just to get a feel for what this looks like, a table like this one could be exchanged in advance of each telephone call. (Nothing here is my invention, of course.) The columns are used once successively for each digit. 0: Tientsin bedeviling Menominee bonneted coincides quotation 1: handling Bernadine prouder Navaho fittingly Swinburne 2: degrading Puritanizes allophone acquaint jack renditions 3: clientele homo Verderer diskettes overview surmounts 4: delimiting probes sobering modulating situated jelly 5: bewail reflex multistage plastics stigmata scandal 6: Genoa divider synonym bipeds tale denominators 7: aborts carbons welding amalgam chain innovation 8: salvaging Fargo transitional relishes Ozarks meditations 9: overlapping Tehran desperation initiated intimidate beggars A: whereby muffins Soddy miniatures diagnostic proportionment B: flour pistils aback despatched Rydberg tales C: lifespan sallying Arianist kindness side corporal D: wrongs nervousness minting totaller feather copyrightable E: intoxicated Yukon Boyd response ingredients numismatist F: stairway imitation consulted printably anesthetizes interval This has about 85 bits of entropy assuming the words are randomly selected from a pool of 20,000. As Mallory only gets one try, those are very good odds. This is completely practical and secure because the table is easy to generate and exchange. (Not that an in-band method wouldn't be way cool!) Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEUAwUBND56bpaWtjSmRH/5AQGcfQf3Y8tpnovD2tVVqUdJwHBg4ZgKfulxP2EH nuXSuvg7eMJ1veHw3ObmsiA+MzPzoBbrEkYM6u5TN3U+ytZbb5A/ogvD3fZepwhW Sns5l0J6y5gK4nRd9AqvU7MBp21iugJy6VEPwQzKwTIj/lkUydKeODluZSOqatyL NHr9qdZQrvvzsmvRL6EGvf2yEmYTeLg5XscLWPIyyA24jEMJNUXyQ5+W6bTx3Pxc aUBiSbVtoYIJDGKdzNGUu7QtlQP0DSQ+81kW4R86CreFx7H8rwRdr7dpwgTMADgZ ps2Nj0M71x9R8W9Jukg1eBw/xoyihldEo4SGrpDECv+Iawu+HSgZ =CEWV -----END PGP SIGNATURE----- From aba at dcs.ex.ac.uk Fri Oct 10 14:43:28 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sat, 11 Oct 1997 05:43:28 +0800 Subject: anonymous poster quality up In-Reply-To: Message-ID: <199710102120.WAA05251@server.test.net> Tim May writes: > Thanks for the sort-of compliment, but I haven't been using > anonymous remailers much at all the last couple of years. My reason for commenting was that you recently commented that you planned to experiment with Nyms soon, but wouldn't be announcing when. > Someone wrote to me saying he suspected I was "Monty Cantsin." Nope. I must admit that I also had noticed a small similarity in vocabulary used by Cantsin, certain phrases, etc -- perhaps he's trying to simulate your writing style, or perhaps he just naturally has similar writing characteristics. I'll take you word on it, anyway. Not that it matters really -- a good point in an argument is still a good point where ever it comes from. I'm finding that the non-persistent anonymous user(s) are having meaningful discourse on pgp CAKware (I like to think of them as anonymous PGP employees -- and I hope they're finding my comments useful -- of course it is mere speculation or wishful thinking on my part that they are anything to do with PGP Inc -- they could be anyone). Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 -----BEGIN PGP SIGNED MESSAGE----- Anonymous wrote: >> (untransferable signatures) > >This is also a good idea, but it needs more work, too. There is a >big education problem here. People barely understand the >implications of regular digital signatures. Now you are throwing >this new kind in, which guarantee the message came from another >person, but aren't binding. What happens when an employee receives a >message from a supplier signed with that kind of signature? Can he >make a decision on that basis, or not? > >In paper business correspondence, there is no such distinction. A >signed letter is transferable. Go beyond this and business will be >scratching its heads. It's a solution looking for a problem. How about arbitration? Two parties may wish to make an agreement to be judged by an arbitrator of their choosing. In certain cases, the State can be expected to intervene. If only the arbitrator knows the signatures to be valid, the State has no fair basis on which to make an intervention. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBND5vYpaWtjSmRH/5AQGzygf/TdMgevKLw87e6ZtJ6++pyrOKliu/OunT Z4uxcWzDGPEcyNchhOsb6B+NSOehcgvqIhxs4NNTJqMVICiJCBhBTZlsQt7bW6kq Ayz62YWFZZeMcYbsP87FmuGLxsyh/wW2Nh/s80J9obS6vn7HQJBUp/Ox7Ho9RPIp bdijOAw6nxtPt0SWcr38F8XVj/XpqA768nn5uWwdtd2aCAIQf7uLE7poZLVL7+UQ VMiHlgsRIlcHEakNbCExrBTuyCzyoKo5LY+PPzlLCTC93rzXyPIdO8Ain6p49qa5 i/7z+WbT8powUsmwj5BEfPSKOo1CcuHfdAUgeSI4JawfhqYJAnzpRg== =m09K -----END PGP SIGNATURE----- From nobody at REPLAY.COM Fri Oct 10 14:54:04 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sat, 11 Oct 1997 05:54:04 +0800 Subject: do NOT escrow communications keys (Re: What's really in PGP 5.5?) Message-ID: <199710102136.XAA28507@basement.replay.com> -----BEGIN PGP SIGNED MESSAGE----- Adam Back wrote: >About the only example of email in transit being considered storage >was a USENET article years ago by someone who considered it a kewl >hack that he had some games or something else which was in breach of >policy in his account and rumor went around that the admin was having >a purge. He tarred, gzipped & uuencoded the lot and emailed it to >himself down a _long_ ! fowarding path. It came back to him around 3 >days later after the purge. That's the kind of thing I mean when I >say you don't consider email storage. Sometimes you can use this trick to get around storage limitations at your ISP. Often mail in the spool file doesn't get added up for the disk quota. When you hit your limit, just e-mail yourself a bunch of megabyte messages. Sysadmins tend not to like this. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBND5t8JaWtjSmRH/5AQFf9wf/TQMiQH4wJXO3Xx/borwAobWIlKQCGmVQ BnflPYg5pDvHOc+vppprb/f5HLZ78p1WaOY9l7vc+aJ97NC346UQAzS8kGyr6WP7 YmHmWRx576CV8EsLWjMZFYB6fZXvvMQd6VGUPC9IKC9Zum2BV1GCUSxGIHFpwNDp ElfqFFlFdVqfh30XEi2e/XK7UKh6bzYMHgfHTEjv+FqV1grXpGlwDHQfWvPMv4s8 ZEO8XM7Sh6DOXEMnrZkKJ0dl9cW8FjphEeYbkePV9oPVuCqC8HF6gzFfGLtWMK6E nj7iuv1QoQPagk4nwogHRUjhuuFg0aDcHieDR7T1HivFReB5fZIHYQ== =HCXe -----END PGP SIGNATURE----- From jon at pgp.com Fri Oct 10 15:07:04 1997 From: jon at pgp.com (Jon Callas) Date: Sat, 11 Oct 1997 06:07:04 +0800 Subject: Why Corporate Message Recovery isn't Key Escrow Message-ID: <3.0.3.32.19971010145353.00ad9330@mail.pgp.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A number of people have asserted that the Corporate Message Recovery feature is key escrow. From where I sit, the difference is easy to see. My definition of "key escrow" is that another person or organization keeps a copy of the user's secret key. Here's an example, based on actual customers who use key escrow to manage their data: This corporation uses PGP for a number of things. Email, engineering plans, CAD drawings, and so on. They've done so at least since the days when we were Viacrypt, and I believe they even used PGP 2.x. When an employee arrives at this company, they create a key pair for the new employee, hand it to them on a floppy, keeping a duplicate floppy with the keypair on it, which they toss into a safe. Literally. This is key escrow. They do this because they can't afford to lose their files and messages. Their policies require them to keep the secret keys, as if they were the same as keys to offices or file cabinets. I don't know about you, but I'm appalled. Nonetheless, they're our customers. In spite of inheriting them, we have a responsibility as businesspeople to at least listen to their concerns. - From our standpoint, the issue gets even touchier. They don't like what they're doing, and they want us to give them a better way to manage their data. Does anyone really believe that only moral response is to flinch and turn away? I'd like to be in a situation where I didn't have to deal with this. Wanna trade positions? I'll sit over there and cluck my tongue about how adding an extra recipient weakens security while you figure out how to help these folks out of the mess they're in. While you're at it, I'll pen a few lines about how giving clean needles to addicts undermines society, and handing out condoms encourages kids to have sex. Trust me, it's less nerve-wracking than what we have to do to solve this problem, which involves running through hypothetical scenario after hypothetical scenario, balancing the user's privacy against the organizations property rights, the privacy and property rights of one organization against that of another, and so on. Corporate Message Recovery isn't key escrow for a number of reasons. First, it doesn't involve keeping a copy the end-user's secret key. I hope that's obvious now. Second, the system behaves very differently. With a key escrow system, there is a superb McGuffin (which is what Alfred Hitchcock called the crux of a mystery, like the falcon in The Maltese Falcon) - it's the safe. Break into the safe, or lend its contents out, and all Hell breaks loose. Whoever has those keys (which easily fit on a single Zip disk) has the company at its mercy. They can decrypt or sign anything they care to. There is a great thriller to be written here. It isn't so with a CMRK. The worst possible way to use the feature is to have a single, company-wide CMRK. If that gets lost, the thriller you can write isn't nearly as interesting. Yup, you can steal any of the plans, read all the mail, and so on. That's bad. It's deplorable, actually. But it isn't a difference that makes no difference. At least there isn't a gang of keys out there that can sign anything with anyone's ID. This is not the only way to use Corporate Message Recovery, it's just the worst way. Remember, it's just a notation in the self-signature that states, "When you encrypt to me, encrypt to X." That's any X. You can have a different CMRK for every department, every workgroup, or even every user. A sophisticated policy might be that every user sets their supervisor's key to be their CMRK. Another is that everyone in Department X sets their office mate, or lab partner, or other person. You can have anything that suits your group, from Recovery Central, to Recovery Hierarchy, to Recovery Buddy System. The significant improvement that PGP's web of trust has over a traditional hierarchical system is that you can set up a top-down system for validity, but you don't have to (and in our opinion, shouldn't). Analogously, the significant improvement that Corporate Message Recovery has over key escrow is that you can tailor a recovery system to your needs (including and especially deciding it's not for you). Jon -----BEGIN PGP SIGNATURE----- Version: PGP for Business Security 5.5 iQA/AwUBND6j8H35wubxKSepEQI58gCfQuiMZCyfe7cD1F2nNgFtluQqGXMAoJUh yHFMApAlDjzwRTCspBi7p9t3 =a2Zo -----END PGP SIGNATURE----- ----- Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) From jon at pgp.com Fri Oct 10 15:09:07 1997 From: jon at pgp.com (Jon Callas) Date: Sat, 11 Oct 1997 06:09:07 +0800 Subject: PGP CAKware & IETF controlled Open-PGP standard In-Reply-To: <199710102108.WAA05223@server.test.net> Message-ID: <3.0.3.32.19971010145005.00a32360@mail.pgp.com> I am adamantly opposed to any of PGP's business features being MUST features of OpenPGP. If they were, then our freeware and personal privacy products wouldn't be conforming applications, and we have *no* intention of putting them in those products. Wouldn't that be an interesting situation? I am strongly opposed the business features being SHOULD features. If I were the only one arguing against them being SHOULD features, I'd make my opposition clear and then shut up. I am in favor of them being MAY features, along with a big section on polite use. Jon ----- Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) From emailprofits at mail3.c-flash.net Sat Oct 11 06:30:04 1997 From: emailprofits at mail3.c-flash.net (emailprofits at mail3.c-flash.net) Date: Sat, 11 Oct 1997 06:30:04 -0700 (PDT) Subject: 1110: Home-Based Email Processors Required.... Message-ID: <394810482832.PQR2222@mail3.c-flash.net> Earn $14.95 for every email you process for us. GUARANTEED! Dear Sir/Madam, This announcement concerns an online employment opportunity currently available with our company. If the idea of earning an excellent income using your home or office computer appeals to you, then please review this brief article. If you find this article of no benefit to you, we apologize for our intrusion. To be removed, hit reply with 'remove' in the subject. ================================================= Home-Based Email Processors Needed Immediately!! ================================================= Please be assured that this is NOT an invitation to participate in an illegal chain letter scheme. Neither is this an invitation to join a network/multi-level marketing program. We are offering a unique, legitimate home-based employment opportunity. As an Email processor for our company, you'll work out of your home or office using our exclusive FREE, "no-catch" turnkey software package. There's NO personal selling involved. There's NO sending out bulk email. We are in the Software Distribution and Publishing business. Our products have worldwide appeal. In order to expand our business globally in the shortest possible time, we need home-based Email processors all across North America, Europe, Australia and Asia RIGHT NOW!! Our EXCLUSIVE turnkey software package is all you need to do your daily duties. The work can be done full or part time. Your earnings is based on the hours you put in to the work. By devoting few hours a week, you'll be able to add handsomely to your present income. With a full time effort, your income may even exceed your expectations. If you are interested in this position, and would like to find out more about the pay structure, and the duties involved, please link to: http://204.137.223.80/master/email.html OR http://www3.c-flash.net/~emailprofits/email.html If you're having difficulties connecting, you may request a detailed information report and an application form by hitting REPLY with "MORE INFO" in the subject line. Thank you for your attention. Sincerely, Angie Steele Global Marketing Services From jon at pgp.com Fri Oct 10 15:34:06 1997 From: jon at pgp.com (Jon Callas) Date: Sat, 11 Oct 1997 06:34:06 +0800 Subject: Why Corporate Message Recovery isn't GAK Message-ID: <3.0.3.32.19971010151206.00a122b0@mail.pgp.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 There are two things I will discuss in this missive: (1) The assertion that Corporate Message Recovery is "just like Clipper" and why this is not true. (2) The fear a number of people have expressed that Corporate Message Recovery (CMR) could be used by the US government to slide in GAK. I think we're agreed that CMR isn't itself GAK and I'll talk some about why it isn't with (1). CMR isn't like Clipper: * Clipper was a 64-bit key. CMR symmetric keys are full-strength keys (128 bits or more), backed with a full-strength public key. * Clipper's key was set in hardware by the manufacturer, and users were required to use it. A CMR key is a software-enabled key, no user is ever required to use it. There are cases in which a user might "volunteer" to use a CMR because they work for someone who requires it, but that's a problem we'll address with the PGP Secure Resume Server which allows headhunters to securely and anonymously find people who've made bad career decisions. As a corollary of of the previous paragraph, there's no reasonable guarantee with a Clipper device that you haven't been black-bagged with an insecure key. Using a CMR may be unwise, but at least you knowingly did it to yourself. * A CMR key can be revoked, reissued, or changed. You can periodically change it as a matter of policy. You can even stop using it. Clipper's was, again, set in hardware, with no option of not using it. * The Clipper symmetric algorithm was secret; CMR keys use publicly available algorithms. * With Clipper, there was always a concern that an outside agency had the keys. This is true with a number of other systems (the so-called key recovery systems), and is the reason that a number of them are lumped together with the term GAK. Note that the user-organization creates a CMR key, and the end-user enables it. If any government gets access to this key, it is because either (1) they solved the Discrete Logarithm Problem, (2) they broke the public CMR key, (3) they black-bagged your CMR key, or (4) they are using a subpoena, warrant, or discovery to get the key. We're working on a way around (1), we can't do anything about (2) or (3), but these are fine reasons not to use CMR! If you're beset by (4), you need lawyers, not cryptographers. * With Clipper, there was a central repository of all the keys. With CMR, there is not. I discussed that in detail in my message, "Why Corporate Message Recovery isn't Key Escrow." I have noticed that a number of people have the tacit assumption that business people and corporations are in cahoots with the FBI, waiting to hand over everyone's secret key. As in all parts of life, there are many, many businesspeople and corporate execs who are not particularly moral. But I don't think that their immorality takes this form. If we could examine the dark, secret thoughts of a corporate scumwaffle -- the ones that he *really* hopes don't hit the papers -- I sincerely doubt that, "Oh, Louis, I love it when you rummage my drawers" is among them. Now then, the next topic is the fear that CMR will be used in some insidious government plot to slip in GAK everywhere. I worry about this, too. But I don't think it's feasible that CMR can be a stalking horse for GAK. If the government wants to GAK-enable all PGP, they'll have to have a plan similar to this: (1) Buy PGP, Inc. Since our worth is less than the black portion of the Federal Budget, this is not impossible. Would that it were otherwise. Heck, we're probably worth less than the black portion of New Zealand's budget. (2) Fire all the current development staff. This isn't very hard. All the new bosses have to do is round us up in a meeting and announce, "The next version of PGP will have a 40-bit export option." We'll say, "Not while *we're* working for the company!" They'll say, "Fine with us." Keep your eye on the secure resume server for clues of this event. (3) Hire a new staff. This is one of the places that the plan might fall apart. We have such a hard time finding anyone who's qualified to work for us that we have reqs we can't seem to fill. I suppose, though, that they'll be able to find some people willing to relocate from Maryland. (4) Stop the OpenPGP process in the IETF. Some people think that we did this as part of our Evil Plan to Take Over the World by Giving Away Software (hey, it almost worked for Netscape). Other people think it's part of our Evil Plan to Take Over Crypto by Using Unpatented Algorithms. I can neither confirm nor deny these, but I *will* tell you that it's part of our Sniveling Plan To Convince the Feds They Can't Kill PGP by Killing Us, which the source code books also fall into. If OpenPGP succeeds, then anyone can build an interoperable version of PGP, not just us, Highware, Systemics, etc. (5) Wait until bitrot makes all those existing copies of PGP stop working. I could make a few catty remarks about how quickly existing software stops working on new releases of OSes, but you've probably thought of them yourself. There are also a few details left, like shutting down all those international FTP sites, but hey, they're the government, they're omnipotent. Jon - ----- Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) -----BEGIN PGP SIGNATURE----- Version: PGP for Business Security 5.5 iQA/AwUBND6mO335wubxKSepEQKpgQCeNxWHHjIucyzRrQV429PKM0sTykAAnjiz byD3SzToLdfkGq+mIyUHji6M =r8nx -----END PGP SIGNATURE----- ----- Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) From jamesd at echeque.com Fri Oct 10 15:44:03 1997 From: jamesd at echeque.com (James A. Donald) Date: Sat, 11 Oct 1997 06:44:03 +0800 Subject: FCPUNX:The Sovereign Individual - ignorant authors Message-ID: <199710102228.PAA19277@proxy4.ba.best.com> At 11:12 PM 10/9/97 -0500, Jim Choate wrote: > This chapter deals with various aspects of social issues (eg rise of > national languages) and how they led to the growth of nationalism in > general. Toward the end of the chapter (pp. 265 in the hardback) these > idiots (don't know a better term) actualy have the audactity to claim that > Stephen Jay Gould is a neo-creationist, This appears to me to be an accurate depiction of Stephen Jay Gould's views. He claims that humans are fundamentally different from other animals in this regard, and has frequently been ridiculed on this account. I have read some of his writings, for which he was ridiculed, and the ridicule and contempt appears justified to me. > The author of this section has apparently never read a word that Gould has > written. Gould is known as a leading supporter of Punctuated Equilibria and > its various spawn, I have read a fair bit of Gould. His work on the evolution of non humans is perfectly plausible though controversial. His work on humans is shear crap and is not regarded by the relevant experts in the relevant fields as legitimate science. In his field, he is a innovator. Outside his field, he is a crackpot, similar to the flat earthers and the people who claim that Socrates was black, demonstrating that even trained scientists can degenerate into nuttery when they go beyond their area of expertise. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd at echeque.com From bianca at dev.null Fri Oct 10 15:45:18 1997 From: bianca at dev.null (Bianca) Date: Sat, 11 Oct 1997 06:45:18 +0800 Subject: Fuck You! Message-ID: <343EADC9.1317@dev.null> I found your address, despite your subterfuge, and I am going to fuck up both you and your computer system. I don't like fuckwads sending bullshit to my email. Fuck You (& the horse you rode in on) From nobody at REPLAY.COM Fri Oct 10 15:53:50 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sat, 11 Oct 1997 06:53:50 +0800 Subject: CAK as a really bad form of corporate networking Message-ID: <199710102238.AAA07439@basement.replay.com> -----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: >My conclusion is that PGP for Business does very little for real >corporate access in "hit by a truck" situations, as most of these >critical files (fill in the blanks , but thinkof chip design files, >source code for programs , lab notebooks , etc .) are simplyNOT ever >e-mailed. And if they are e -mailed , this is completelya tertiary >issue. One should also ask who is managing the company and why. It is never a good policy to leave important components of the company in the hands of particular people for long periods of time. While people die relatively infrequently, they do often become frustrated or angry and leave the company. For instance, one really has to ask what is going on when a programmer doesn't check in his or her code for six months. And one really has to wonder how useful that code is going to be to anyone. My policy has been to discard half completed work when people leave. It's just cheaper to start anew than to clean up and debug undocumented code which nobody understands. In general, the case where "important documents" have to be retrieved from a departed employee's desk or computer are fairly uncommon. And the case where it is necessary to intercept a departed employee's e-mail is pretty much non-existent. >So who is the real customer for PGP for Business and its form of >plaintext recovery? I am looking forward to hearing the precise mechanisms behind PGP, Inc.'s change in tune. Were some of those investors shills? In terms of governmental expenditures, it would cost nothing to flood PGP with great investment deals. It would probably cost less than Clipper itself. And all of the former troublemakers can be quietly ridden down and finally trained to accept the saddle of good stock deals and contractual obligations. If that was the mechanism, it's pretty slick and to be admired by sportsmen everywhere. It is the sense of Monty Cantsin that a number of readers of the list are downplaying PGP Inc.'s actions because they hold the character of certain people involved with the company in high regard. This is probably an error. Character must be judged by actions. The actions are clear. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBND6DcJaWtjSmRH/5AQEDGwf+Pl0xusD2oBzrqOFkBrV92NHswJJ6VbuQ akNVAaBz+gNnXy2Zt7Pfa09nqibW9qbzd3pbJh8v7djOwtqQSJXN7uZA0JVF2mii oLR5jwh9bpNRSvElaJLRmcGMY3RKighl1rcwfxAjbmJjEI6nSjcaELPNpPCMZEfT cEehlxC5R4f9oikQJc4VNg/MVo89P9ckT9wtbdd4S4ZOFArxHvGlw+bW/hwlpDNE fIZBy8BlJqir+BSZGLkSwOOvuAwozMCQSM/VFj6aDNiNTA3bQ8xHGyaapRci7dVX ZleOrYWsdAt25R9yt79T9Mcu8tKuvbfl245gxHSrOReODG89gOT/vw== =FLvb -----END PGP SIGNATURE----- From zooko at xs4all.nl Fri Oct 10 16:16:23 1997 From: zooko at xs4all.nl (Zooko Journeyman) Date: Sat, 11 Oct 1997 07:16:23 +0800 Subject: GAK, CAP, "escrow", "recovery" -- Minitru has us so confused we fight amongst ourselves Message-ID: <199710102307.BAA02313@xs2.xs4all.nl> The whole goal of the hijacking of the phrase "key escrow" to camoflage GAK was to obscure the difference between voluntary and involuntary participation. Unfortunately, while Clipper and successors have been policy failures, that initial push to conquer important conceptual ground has been a devastating success. Now good guys from both sides of the PGP CAP debate appear to have forgotten this essential distinction. Jon, I started reading your list of ways that PGP CAP differs from USG GAK, and it was about "software versus hardware" or something. Screw that-- is it voluntary or is it not? Of course it is voluntary. PGP, Inc. has no deal with USG or any other agency to the effect that user's secrets will be involuntarily (by threat, force or secrecy) copied. So forget about all those details and make the point-- PGP helps people control their own data, including voluntarily sharing their data with others. This is almost entirely unrelated to GAK. One more time for the slow folks at home (journalists especially, listen up!): Escrow is when you voluntarily choose to share your property with someone else, especially as part of a business contract that you have with that person to the effect that she won't use your property for anything but will merely hold your property in order to give it back to you or to a third party in response to certain events transpiring. The word "escrow", coined sometime in the 16th or early 17th centuries, has held this meaning and only this meaning throughout the intervening centuries. Someone getting access to your secrets against your will, whether by trickery, threat of force, or burglary is not escrow. At least, not until the USG deliberately chose to abuse that word to throw a mask of legitimacy upon its rotten idea of mandatory wiretapping for all digital communication. Damn, but it is frustrating to see such a bare-faced newspeak gambit succeed so brilliantly against otherwise literate people. Everyone should read George Orwell's paper on (ab)use of language in politics. None of the examples he cites are nearly as worthy of Minitru as is this single conceptual hijacking. Regards, Zooko P.S. Of course there are subtleties that I omitted from this rant. It wouldn't be a good rant if I calmly enumerated the various legitimate perspectives now would it? Maybe PGP CAP is a bad idea. Maybe it will lead to GAK. Maybe corporations are a bad idea. Maybe they will lead to governments. But whether or no, use of PGP and PGP features (including escrow features) is voluntary. GAK is not voluntary. GAK is not escrow. Please help me put a stake through the heart of this vile meme. From randerso at ece.eng.wayne.edu Fri Oct 10 16:30:22 1997 From: randerso at ece.eng.wayne.edu (Ryan Anderson) Date: Sat, 11 Oct 1997 07:30:22 +0800 Subject: America as a Shake Down Extortion State In-Reply-To: <800ba9b5ce70bcdb069766023ed9e797@anon.efga.org> Message-ID: <3.0.2.32.19971010192133.006a07c0@ece.eng.wayne.edu> -----BEGIN PGP SIGNED MESSAGE----- At 01:32 PM 10/10/97 -0400, Anonymous wrote: >>Actually, I think it's a little more likely that they'll get disgusted with >>Congress, and collect some money for the ACLU to use to pay their lawyers in >>the instant filing of the consitutionality challenge. >> >>Seems to be a much more productive way to spend your money (long-term). > >Bullshit! Fuck the lawyers! > >By wasting time and money in the courts bickering about the stupid laws that >buffoons in Congress pass in order to justify their existence, we are only >ignoring the real issue: you cannot use the system to change the system. That's the point - you ignore the legislation until it becomes a problem for you. Then you challenge it and get a legal precedent to stop it from happening again. The judicial system is in *much* better shape than the legislative system (even though they are strongly related) This, however, is not to say that the judicial system is in good shape. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBND64fDc3ytqHnNyNAQFdUwP+NxJiiOfCxa8b6ONY0sLxFt8+NZBcf0fr WkYH4xA33a+Q1B81YL0CNQqxRpVue+CWh0Qp1JLKIHZjKrI/hMHmo/znCpJO6uDP 4BRzq8LauWF8OTKT/r7Q2dJbqSs1ISb9FZE3FOYK0lb0By7w+TfiRXzUwTkYCH6E 7vKvV/4PsuU= =5vpe -----END PGP SIGNATURE----- ----------------------------------------------------------------------- Ryan Anderson - "Who knows, even the horse might sing" Wayne State University - CULMA "May you live in interesting times.." randerso at ece.eng.wayne.edu PGP Fingerprint - 7E 8E C6 54 96 AC D9 57 E4 F8 AE 9C 10 7E 78 C9 ----------------------------------------------------------------------- From aba at dcs.ex.ac.uk Fri Oct 10 16:40:56 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sat, 11 Oct 1997 07:40:56 +0800 Subject: secure phone on a PCI card? (Re: authentication suggestion for secure phone) computationally infeasible jobs for MITMs) In-Reply-To: <199710102057.NAA02969@comsec.com> Message-ID: <199710102210.XAA05811@server.test.net> Eric Blossom writes: > > If it cost a lot extra, that could be a problem, yes. I am unclear on > > how much extra this would cost. Apart from an EEPROM, it's a protocol > > and software update right? > > The units currently have 2K bytes of EEPROM and 256K bytes of FLASH. > [...] There's plenty of room for long term storage of a reasonable > set of public keys. Private or symmetric keys present a problem, > since then you've got a long term secret to store somewhere. What's the difference betwen storing public keys and private keys? Are you concerned that someone will tamper with the unit and replace the keys. (Borrow the phone while you're out, reset the EEPROM, and make a series of calls to put in MITM keys.) Could be dangerous. You could use a pin, but then you need an input device. However, you could also argue that if someone can borrow your phone for a while they can give it free "upgrade", and replace the RNG, or whatever anyway, so it doesn't make any difference? I don't think it does. I kind of liked the persistency authentication idea as a candidate for your remote upgrade. You could do it with symmetric keys or with asymmetric keys. It's just a trade off which depends on how many keys you're allowing. If space is short, you could do something more clever, say: - Exchange (and store in a table) a symmetric key with each new phone - Lookup keys by phone number (or unit serial number if you don't have ANI) - Authenticate using nonce and stored key. Overhead: 16 bytes per phone Allow say 50 callers = 800 bytes. Perhaps you want a button to push (hold go secure down for over 5 seconds, say) to store a caller in this table. (Prevents attacker flushing your table by making a load of dud calls). Or perhaps just wrap around and discard least used numbers/serial numbers. > > [phone on PCI/PCMCIA card] > > I can pretty much be done all in software on a laptop. > > The primary thing you lose is the simple integration with the > telephone. A small (cheap) hardware hack can work around this. Yes, > I know you'd prefer not to have any non-standard hardware, but on the > other hand, if the system is a pain in the ass to use, nobody is going > to use it. Fancy organising this cheap hardware hack? I reckon you'd get a few buyers. I'll pledge to buy 3 at a reasonable price. Do you have the software for PCs/MACs? Would this cheap hardware hack work with PGPfone as is? (PGP Inc don't seem to be doing much work on PGPfone right now). btw the hardware hack I presume is impedance matching to allow phone to plug into 3.5mm jack audio and mic socket? Any hardware people care to give soldering instructions? > > I think Eric's phone uses a 14.4k modem chip (or lower?) so it's not > > the bit rate as such, but more the lack of higher quality audio > > compression codecs which are possible in hardware. (Right?) > > The unit currently runs at 14.4k. A 4800 b/s fallback mode is > currently under development. GSM laptop secure phone, here we come :-) > > Also the fact that with PGPfone you're using PC speakers, and room > > microphone probably makes it seem worse than it could be. > > Fixable with software and MIPS (you've got those). Take a look at > those nice USR and Polycom full duplex speaker phones. There's > nothing magic in them. Notice the neat little song they play when you > power them up. It's a training tone used to compute the impulse > response of the room. I'm not sure what PGPfone's problem is, but when I tried it, it sounded like an off tune radio station, but worse. Even turning off encryption entirely (to preserve the precious cycles for the audio codec) didn't help much. Perhaps I should retry it now with 166Mhz K5 pentium in place of 120Mhz AMD 486 at the time. > > [integrating with GSM phone] > > Pretty much everything you need is already there. It's a question of > integration. It's a damn, damn, shame that no-one is doing this. We couldn't bribe you to do it next could we? I was kind of figuring that eventually we'll get there with a bit of software because cellular phones and laptops functionality will merge, and the bandwidth and processing power will be there. Still a laptop with your hardware hack, would be ok for now. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In the course of all the discussion here, I have seen a number of implicit attitudes and assumptions that irritate me. This is a short rant to air my irritation. The first thing that bugs me is what I'm calling Crypto-Correctness. I don't know a single person on cypherpunks who is against privacy, or is against the notion that in the information society, keeping and bearing crypto is an inalienable human right. Politically, I'm a Lockeian, and put privacy up there with Locke's basic trio of life, liberty, and property. As part of this, I fight the stupid notion that because there are bad people out there, rights should be abridged. Crypto is a tool, and nigh any useful tool can be misused. If we let that fact stop us from making tools, we'd be using nerf axes and dressing in bubble wrap. If we let the fact that bad guys are using our stuff bother us too much, we'd be against privacy. Here at PGP, we like to make hay out of the fact Burmese freedom fighters use PGP. A while ago, Tim May sent out something in which he stated that Hamas uses PGP, making the very valid point that one person's freedom fighters are another person's terrorists. He implied that they're not using just to tell each other where the best hummous shops are, and I don't doubt it. I like to say (now that I'm no longer an arms maker) that we are like the Red Cross in that the Red Cross gives medical attention to everyone, regardless of their moral worth; we supply privacy software to everyone, regardless of their moral worth. In the days when crypto was a munition, I used Winchester as a metaphor, complete with Sarah's cute bungalow. In its milder forms, Crypto-Correctness thinks that if a bad guy is using crypto, then it's a mitigating factor on what they're doing. I can see that it might come from not liking tack-on laws like the clause in the present bill that makes using crypto to hide a crime illegal. This is deplorable. But using crypto doesn't make something good. In some of its other forms, it pushes into what I perceive as Crypto-Socialism. We just shrug if suicide bombers or paparazzi are using crypto, but if a property-owner wants to use it, you can just hear the sharp intake of breath. If that property-owner is Big Business, there are howls of indignation. I get the impression that some people think crypto should only be produced by non-profit organizations for the use of non-profit organizations, or those that had the common decency to get their profits illegally. The next thing that bugs me is that the government has us so scared of our shadows that we look askance at anything that might make crypto mass-market. Right now, crypto is rocket science. Many of the people who need it most are only going to understand it after years of acclimatization. The sorts who inhabit the nightmares of tech-support people are going to take at least one more turn of the wheel of Maya to get it. I think a lot of people here think that blade guards on crypto in any form is stark moral evil. You lost your data? Good. Shows you're not worthy. You shouldn't have data anyway. Information is property, and property is theft. In the crypto-anarchist future, after the withering away of the state, you won't need property anyway. I suppose we'll all just eat e-cash. I really believe that this panicked, bunker-mentality fear of anything that might complicate the system with blade guards is doing the cause of freedom a sever disservice. Business people are subjected to a lot of the asinine annoyances and minor evils that government brings, too. If we get them on our side, they will be a powerful ally. I believe that the central thesis of crypto-freedom is that it doesn't matter if a document is on paper or in a text file; it doesn't matter if a conversation is on the phone or in a restaurant. The medium doesn't matter. My papers and effects have the same protection on a disk as on paper itself. We all know that deployment is the key. But real deployment means deploying to people who don't know how their toaster works, too. If we don't solve this problem, we'll get hit with the backlash. Just you wait, once crypto becomes trendy, there will be a Time cover story with some headline like, "How Much Privacy is Enough? Who's Really After You, Anyway?" and in it will be sob stories about how people lost their passphrases, were blackmailed by employees (ask me, I have real-world tales of this), or can't decrypt their backups. Congress will have hearings, and they aren't going to be fun to watch. Is trying to head this eventuality off (yes, I believe it's inevitable) really the work of Satan? The last thing that really, really bugs me is the hostility that's directed towards PGP Inc. because now we're an Inc. The core group of people who are here are the same people they always were, they're just being paid now. I'd love to be independently wealthy and do this for the crypto-anarchist, non-profit joy of it, really I would. But you know, as the great crypto-socialist Balzac said, "behind every great fortune, there is a great crime" so I suppose we must be up to no good. This is a blues riff, so let me tell you how we've paid our dues before I get to the chorus: We published our source code. One of our potential partners said and I quote, "Are you mad?" We stand firm on the issue of No Weak Crypto. A noted GAK proponent asked me at a conference, "Aren't you folks going to do an export version?" I replied, "Sure we are." This person asked, "When?" I said, "The day after the law changes." We put out a freeware product, hoping people will upgrade to the for-pay version. If you're thinking of your own startup, let me give you some investment advice: the crowd who thinks the X-files is a documentary doesn't upgrade to the for-pay version. We started an IETF working group that will take our core technology and put it out for anyone to use. They will own change control. We won't be able to use any patents or intellectual property to enhance our business position. We won't be able upgrade the protocol without a vote. The only thing we offer as a selling point is our superb engineering and our good name. The business version is funding the rest of the ball of wax. Are you afraid we'll make a deal with the devil? I have two comments on that: (1) I work in Silicon Valley. I tell headhunters, "no thank you" every week. I took a pay cut to come here. I can get a 20% raise by going to WebFoo any time I want. My options aren't worth what I would have gotten as a layoff package had I stayed at Apple. If I send out an email message that provides "technical support" to furriners, I could land in jail. I'm here because I care. Ask the people here who left behind Cisco options at 40 if they care. (2) There's one surefire way to make sure we don't make any deals with the devil. Buy the product. Encourage your friends, your mother to buy the product. If you see someone who is using the freeware version, send them a polite message to buy the product. Buy one and send it to your congresscritter. If you don't, what you're saying is, "crypto-freedom is very important to me, as long as I don't have to spend $49 on it." Convince your employer that $119 isn't too much to pay for meta-introducers. Make the crypto market so hot that someone competes with us by being badder than us. Oh, yeah, baby, I got them crypto-startup blues. Jon - ----- Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) -----BEGIN PGP SIGNATURE----- Version: PGP for Business Security 5.5 iQA/AwUBND7PCH35wubxKSepEQKD9QCgwPoRbXSHyueb9U4fLztaQkAKLlQAoNdC kX1gOsFsBZ6YDtC9AX5X/VU9 =IiAC -----END PGP SIGNATURE----- From ravage at ssz.com Fri Oct 10 18:19:13 1997 From: ravage at ssz.com (Jim Choate) Date: Sat, 11 Oct 1997 09:19:13 +0800 Subject: FCPUNX:The Sovereign Individual - ignorant authors (fwd) Message-ID: <199710110137.UAA24206@einstein.ssz.com> Forwarded message: > Date: Fri, 10 Oct 1997 15:28:31 -0700 (PDT) > From: "James A. Donald" > Subject: Re: FCPUNX:The Sovereign Individual - ignorant authors > At 11:12 PM 10/9/97 -0500, Jim Choate wrote: > > This chapter deals with various aspects of social issues (eg rise of > > national languages) and how they led to the growth of nationalism in > > general. Toward the end of the chapter (pp. 265 in the hardback) these > > idiots (don't know a better term) actualy have the audactity to claim that > > Stephen Jay Gould is a neo-creationist, > > This appears to me to be an accurate depiction of Stephen Jay Gould's > views. He claims that humans are fundamentally different from other > animals in this regard, and has frequently been ridiculed on this account. > > I have read some of his writings, for which he was ridiculed, and the > ridicule and contempt appears justified to me. Well apparently you didn't comprehend what he was saying any better than the authors of the book or your experts. However, I have no intention of bringing this discussion onto the list past this responce. If you, or anybody else, would like to see Gould's refutation of this claim in his own words then refer to: Scientist Confront Creationism ed. L.R. Godfrey ISBN 0-393-30154-0 Chpt. 8. Darwin's Untimely Burial - Again! pp. 139 This volume is a collection of articles by 15 of the top evolutionary theorist (not all biologist) in the field. Worth the $7.95 this little book costs. You might also want to read "The Mismeasure of Man" (again). > I have read a fair bit of Gould. His work on the evolution of non humans is > perfectly plausible though controversial. > > His work on humans is shear crap and is not regarded by the relevant experts > in the relevant fields as legitimate science. [rhetorical questions, please don't send responces] So your premise is that the evolutionary processes which form non-humans are not the same forces acting on humans? You seriously mis-understand not only Gould but modern evolutionary theory in toto. Sounds like you and not Gould have embraced neo-creationism. What relevant experts? THE relevent expert in evolutionary biology is Ernst Meyr. Are you claiming that Meyr doesn't know what he is talking about? Gould's premise, supported by Meyr and most other evolutionary biologist, is that the human being is in fact a radicaly different animal than all others. Not because of some magical force of transcendance but rather a easily understand mechanism. The increase of cerebral capacity in concert with exo-cerebral capacity (ie memory outside the brain), abstract thinking, and language provide humans the tools to escape the purely evolutionary process. Gould's claim, and what pisses so many people off, is that man has reached a point where the major force in future development is NOT evolutionary processes. It is quite similar to what happens when you have 10 computers sitting in a room and what happens when those 10 computers are networked and given large hard-drives. You don't get evolution, you get revolution. [that's as close to relevancy to this list as I can manage] ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Fri Oct 10 18:39:28 1997 From: ravage at ssz.com (Jim Choate) Date: Sat, 11 Oct 1997 09:39:28 +0800 Subject: Attitude and Assumptions (fwd) Message-ID: <199710110158.UAA24285@einstein.ssz.com> Forwarded message: > Date: Fri, 10 Oct 1997 18:00:24 -0700 > From: Jon Callas > Subject: Attitude and Assumptions > Crypto is a tool, and nigh any useful tool can be misused. If we let that > fact stop us from making tools, we'd be using nerf axes and dressing in > bubble wrap. If we let the fact that bad guys are using our stuff bother us > too much, we'd be against privacy. Tis better to let 10 guilty men go free than to imprison a single innocent man. > the Red Cross in that the Red Cross gives medical attention to everyone, The Red Cross is a non-profit organization that supplies support and aid to both sides. PGP Inc. does not - you don't make tools that crack crypto. Bad analogy. > The next thing that bugs me is that the government has us so scared of our > shadows that we look askance at anything that might make crypto > mass-market. Can't say that I am motivated by this particular meme. I am ecstatic that the company I work for in my day job (Tivoli Inc.) is coming out with a series of security and crypto related products to be implimented by our customers on a global enterprise level. None of which support GAK or backdoors. Now whether our parent company IBM will have the cajones to carry through on it is another question entirely. Exactly how we are going to sell these products over-seas does concern me, especialy since our product is used by many large corporations for enterprise managment in other countries besides Canada or the US and they regularly use our Courier product to distribute data across national borders (not to mention some pretty big ponds). > The sorts who inhabit the nightmares of tech-support > people are going to take at least one more turn of the wheel of Maya to get > it. There are at least 10-12 people at Tivoli tech-support who 'have got it'. > I think a lot of people here think that blade guards on crypto in any form > is stark moral evil. If those blade guards keep me from getting a close shave then they shouldn't be there. > I believe that the central thesis of crypto-freedom is that it doesn't > matter if a document is on paper or in a text file; it doesn't matter if a > conversation is on the phone or in a restaurant. The medium doesn't matter. > My papers and effects have the same protection on a disk as on paper itself. Exactly, it's the message that is protected NOT the media. > The last thing that really, really bugs me is the hostility that's directed > towards PGP Inc. because now we're an Inc. Congratulations and best wishes on your future. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From aba at dcs.ex.ac.uk Fri Oct 10 19:02:17 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sat, 11 Oct 1997 10:02:17 +0800 Subject: do NOT escrow communications keys (Re: What's really in PGP 5.5?) In-Reply-To: <199710102136.XAA28507@basement.replay.com> Message-ID: <199710110019.BAA06426@server.test.net> Monty wrote: > Adam Back wrote: > >[emailing stuff to yourself] > > Sometimes you can use this trick to get around storage limitations at > your ISP. Often mail in the spool file doesn't get added up for the > disk quota. When you hit your limit, just e-mail yourself a bunch of > megabyte messages. Sysadmins tend not to like this. Yep, I've done both of these. Mail spool didn't count on quota, so I wrote some scripts to store and retrieve messages from /usr/mail/aba. Didn't actually use them, but I enjoyed writing them :-) Also we had a temporary scratch 1 Gig partition on one machine. Your stuff was defined to live for 1 week after last access. So I put find /scratch -name \* -exec touch {} \; & in my .login. So the stuff was always up to date and lived for ever :-) The hack caught on, and soon everyone was doing this, and I got a polite note from admin of the system in question telling me (they determined I was the ring leader somehow) to pass the word around that this was not ok, and reprisals in terms of deletion of touched files would occur to those doing it. Phun stuff. (Oddly that and other experimentation ensured I was not the admins favourite student.) Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710110011.BAA06419@server.test.net> Monty Cantsin writes: > Anonymous wrote: > >[non-transferable signatures] > > > >[these sigs] guarantee the message came from another person, but > >aren't binding. [...] > > > >In paper business correspondence, there is no such distinction. A > >signed letter is transferable. Go beyond this and business will be > >scratching its heads. It's a solution looking for a problem. > > How about arbitration? Two parties may wish to make an agreement to > be judged by an arbitrator of their choosing. In certain cases, the > State can be expected to intervene. If only the arbitrator knows the > signatures to be valid, the State has no fair basis on which to make > an intervention. Wuw. Don't go away will you Monty? That was an excellent point. The application you describe could be catered for very well by a third type of signature called a designated verifier signature. With this type of signature you can designate when you create the signature who can verify it. DV signatures are different than non-transferable signatures in that in addition to being not transferable to non-verifiers, you can't transfer them without revealing your private key. The other difference being that you can construct them for other verifiers (the arbitration service). Non-transferable signatures on the other hand work by being made forgeable by the recipient. That way it is essentially the recipients word against the senders. However there is some transferable proof there: there is proof that _one_ of you wrote it. So DV signatures are probably the best of the two. Merely being able to demonstrate enough proof to cause an argument about which of you wrote the document costs you the compromise of your private key. Also you could clearly cope with the arbitrator situation without resorting to DV signatures; non-transferable signatures would be enough, if you sent a signed message to Alice, and a detached signature to your abitrator. If you want to later use the abitrator, you send the body of the message to the arbitrator. He calculates the hash of the message, and is then able to use the detatched non-transferable signature to verify your claim. But he can't demonstrate this to other people. One disadvantage is that the arbitrator could team up with you and make that two peoples words against one. You might see that as an advantage, but Alice won't. An arbitrator which indulged in this kind of behaviour may lose reputation. Lastly, some comments along the lines of `smart contracts' as discussed by Nick Szabo in the past. It would be nicer if you didn't need the arbitrator. One way to do this for some kinds of situations is for each party to setup a atomic transfer where they give each other the ability to cause a penalty to be extracted from both of them. Say they are engaging in some business worth $100. Alice is performing some programming task for Bob. If Bob is satisfied with the software he gives Alice the $100. If he is not he incurs a $50 loss himself which goes to charity, and Alice does also. In doing this he doesn't get the software. But Alice is penalised, and it is better than losing $100. Problem with that example is that you still need an arbitrator probably. Unless perhaps Bob is able to determine quality without source code, or with part of source code. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710110141.CAA06527@server.test.net> Jon Callas writes: > There are two things I will discuss in this missive: > > (1) The assertion that Corporate Message Recovery is "just like Clipper" > and why this is not true. I won't even bother dealing indivdually with your arguments to this one because you have just demonstrated again your ability to simultaneously focus on hair splitting trivia, and ignore the whole crux of the argument. Suffice to say that it is not the details of the GAK (government access to keys) system that the US government has tried to coerce people to use that makes people not like it. It's what it means: it means that government will have access to keys. We have had what some people term Clipper I through Clipper IV (or is that V)? The details and the names change each time. And were you to be their spokesperson you would be explaining in intricate detail how "key recovery" is not "key escrow" and how therefor it is ok, and we should all accept it. The argument against pgp 5.5 is that it does 3 things wrong: 1. it is GAK compliant; it provides a ready to roll GAK system for the US administration to try to leverage into place and switch on 2. it attempts to provide escrow features for transient communications 3. it doesn't differentiate between storage keys (which should be escrowed to protect encrypted information stored on hard disks and backup tapes) and transient communications keys which should if anything be securely wiped after use > Now then, the next topic is the fear that CMR will be used in some > insidious government plot to slip in GAK everywhere. > > I worry about this, too. I'm glad that you acknowledge the very real problem. > But I don't think it's feasible that CMR can be a stalking horse for > GAK. I notice that none of your reasons are technical. I take this to be a tacit acknowledgment that you have indeed built a GAK compliant system with pgp5.5. Let's have a look at these balances to see how comforting they are given the lack of technical protection (being a cypherpunks I like technical protections, they are so much more useful and concrete than words of assurance): > If the government wants to GAK-enable all PGP, they'll have to have > a plan similar to this: > > (1) Buy PGP, Inc. Since our worth is less than the black portion of the > Federal Budget, this is not impossible. Would that it were otherwise. Heck, > we're probably worth less than the black portion of New Zealand's budget. Why would they have to buy the company? They would just introduce legislation to enforce _use_ of a feature you have already thoughtfully included. (A couple of people speculated that this early GAK compliance may be the result of PGP Inc corporate investor pressure (the share holder is god), or perhaps high level management decision that this allows an easy route for PGP whatever the outcome of the GAK wars: mandatory GAK PGP wins with it's early compliance, if mandatory GAK loses, well PGP continues to cash in PRZ's reputation, and PGP Inc's business client base). My question to you is what is PGP Inc going to do when becomes illegal to sell software which doesn't include mandatory GAK? What're you all going to do? Break the law? It'll be too late by then, unless you have a corporate contingency plan of moving to Switzerland. Do you? > (2) Fire all the current development staff. This isn't very hard. All the > new bosses have to do is round us up in a meeting and announce, "The next > version of PGP will have a 40-bit export option." We'll say, "Not while > *we're* working for the company!" They'll say, "Fine with us." Keep your > eye on the secure resume server for clues of this event. The company would survive with staff replacement. Especially with mandatory GAK as the regime. > (3) Hire a new staff. This is one of the places that the plan might fall > apart. We have such a hard time finding anyone who's qualified to work for > us that we have reqs we can't seem to fill. I suppose, though, that they'll > be able to find some people willing to relocate from Maryland. No problem. They'll just pay higher wages with the huge government sell-out dividend reaped by being a early GAK adopter (via GAK compliance). > (4) Stop the OpenPGP process in the IETF. [...] If OpenPGP succeeds, > then anyone can build an interoperable version of PGP, not just us, > Highware, Systemics, etc. Stopping the OpenPGP process doesn't sound necessary, if I read your other post correctly PGP Inc would like to persuade the IETF to put GAK compliance features in the OpenPGP standard as a MAY right now. If you have your way, it'll be ratified by the time GAK comes. You might like to consider this thought also: Even if you personally believe that PGP Inc will stall at mandatory GAK, and cease trading rather than do it, or even if you personally will resign (I can't see that anyone's resignation helps us after the fact): other OpenPGP implementors may not. TIS or IBM or one of the other bona-fide GAKware government sell out types will take the opportunity to create an interoperable mandatory government access to key system. This is a BAD thing. You could prevent that. But you're not, you're helping it head to fruition. You will have to live with your conscience if GAK happens through this route. > (5) Wait until bitrot makes all those existing copies of PGP stop > working. I could make a few catty remarks about how quickly > existing software stops working on new releases of OSes, but you've > probably thought of them yourself. Mr linux hacker will figure it out. Mr windows user won't. There are more Mr windows users. > There are also a few details left, like shutting down all those > international FTP sites, but hey, they're the government, they're > omnipotent. This game isn't about Mr crypto-anarchist, linux hacker, it's about mass market software, about what individuals and companies are using. The spooks know they can't stop "live free or die" types using steganography even after mandatory GAK. Won't make it any less painful for those who don't have the nerve or technical expertise. I would say that I am not trying to be vindictive, or anything here, but you are _so_ easy to criticize, and I am trying to do what I can to encourage PGP to salvage the situation. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Play Misty for me. From ravage at ssz.com Fri Oct 10 19:38:41 1997 From: ravage at ssz.com (Jim Choate) Date: Sat, 11 Oct 1997 10:38:41 +0800 Subject: SSZ & T1 upgrade Message-ID: <199710110218.VAA24375@einstein.ssz.com> Hi, Just a quick note to update you on the status of the T1 upgrade. It's going to take us a few weeks longer to get resources in place than we expected but there is some good news. It turns out that SWBT can provide us a 2-year contract on a full T1 for <$1500 setup and $350 a month. If we go for 5 years there is no install fee and the fee is $250 a month. We are currently discussing various issues with our current customers, examining our personal finances, and our market share potential in our area for which contract to go for. I currently have a 2-year contract on the present equipment location. The potential for purchasing the property will also be discussed. We can purchase a T1/T3 Linux compliant card that will mimic a NIC for less than $700. So, it looks like we can do a complete upgrade to a T1 for less than $3k. Provided we don't get in some sort of grid lock we hope to have something setup and going within the next few weeks. It is my personal desire to have something in place and fully functioning no later than Thanksgiving. But then again, I would have already signed the contract in order to get it going by Halloween. Alas, I am not the last word anymore - the down side to business partners. Even if both my current business partners decide they want out I can say that I will have resources in place by Christmas to have us to a T1. So, irrespective of what is decided the T1 will happen. We will be keeping the ISDN as a backup and transient dial-in for users. If you have any questions please direct them to 'consulting at ssz.com'. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From aba at dcs.ex.ac.uk Fri Oct 10 19:39:09 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sat, 11 Oct 1997 10:39:09 +0800 Subject: PGP CAKware & IETF controlled Open-PGP standard In-Reply-To: <3.0.3.32.19971010145005.00a32360@mail.pgp.com> Message-ID: <199710110154.CAA06536@server.test.net> Jon Callas writes: > I am adamantly opposed to any of PGP's business features being MUST > features of OpenPGP. If they were, then our freeware and personal > privacy products wouldn't be conforming applications, and we have > *no* intention of putting them in those products. Wouldn't that be > an interesting situation? I may be misunderstanding something here, but could you tell me how PGP freeware and PGP personal privacy can simultaneously not have recognition of GAK compliant keys, and emit messages telling the users that this is a GAK key (on receipt of the flag you described), and emit messages warning the user that the email will not be delivered (on receipt of that other flag you described). If it's defined as being compliant to ignore both of these flags, and the message snooping key then users email will bounce without warning. If it's defined to silently send to second crypto recipient, you have fully interoperable GAK compliance built in to the core of PGP. If PGP Inc will remove the GAK compliance when GAK becomes mandatory, I'm sure there are other companies who won't have a problem selling out to GAK (eg IBM, or TIS). If it's defined to warn but give the option to send to second crypto recipient, well you've still got mandatory GAK compliance, but you've got a pretty little warning that you've got mandatory GAK to rub your nose in the fact for each message you send too. > I am strongly opposed the business features being SHOULD features. If I > were the only one arguing against them being SHOULD features, I'd make my > opposition clear and then shut up. > > I am in favor of them being MAY features, along with a big section on > polite use. I'd be interested to see some discussion of how this will work out, following up to the specific examples I give above. No switching to genaralities this time; please answer: how is it going to work? I fear you can't have your CMR setup in pgp5.5 and not be GAK compliant. If you can think of a way that you can modify it to break this dependency, I'd be interested to hear it. If you can't demonstrate such a change I would argue strongly for it not even being a MAY. I'd argue for GAK compliancy not to go into the IETF OpenPGP standard. I gave lots of examples of other ways to achieve the claimed functionality of recovering stored data. Achieving hard to circumvent corporate email snooping functionality is harder to achieve without CMR. You can do some, but not quite as much. But corporate snooping wasn't on your stated list of user requirements. And it's not very savory anyway. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Main banner Reservation Desk rule FORMER FBI OFFICIAL SENTENCED IN RUBY RIDGE PROBE October 10, 1997 Web posted at: 3:07 p.m. EDT (1907 GMT) Kahoe WASHINGTON (CNN) -- A former FBI official was sentenced Friday to 18 months in prison and fined $4,000 after pleading guilty to the destruction of a report criticizing the FBI's role in the deadly 1992 shootout at Ruby Ridge, Idaho. E. Michael Kahoe, a former head of the FBI's violent crime and major offenders section, told the court he was sorry for his actions. "I must live every day with the realism of what I've done," he said tearfully. "I will always be known as the agent who plead guilty to obstruction of justice in the Ruby Ridge case." Kahoe was sentenced by Judge Ricardo Urbina, who could have given him two years. The judge also ordered him placed on probation for two years after his release from federal prison. Kahoe's lawyers said his 26 years of unblemished law enforcement experience should be taken into account. Federal prosecutors urged the maximum sentence. In 1992, the wife and son of white separatist Randy Weaver were killed during a standoff with the FBI. A deputy U.S. marshal was also killed in the siege. As head of the FBI's major crimes section, Kahoe was responsible for preparing a critique of the FBI's performance at Ruby Ridge. Federal prosecutors said he repeatedly refused to hand over documents and later destroyed the report, which they were able to recreate from computer files. rule Related stories: * Both sides decry new Ruby Ridge charges - August 21, 1997 * FBI senior officials won't be charged in Ruby Ridge siege - August 15, 1997 * Former FBI section chief pleads guilty, admits destroying Ruby Ridge report - October 30, 1996 * FBI official charged with obstruction after concealing Ruby Ridge report - October 22, 1996 Related sites: Note: Pages will open in a new browser window * United States Department of Justice Home Page * Federal Bureau of Investigation External sites are not endorsed by CNN Interactive. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Message Boards Sound off on our message boards You said it... [INLINE] Reservation Desk rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From ravage at ssz.com Fri Oct 10 19:50:39 1997 From: ravage at ssz.com (Jim Choate) Date: Sat, 11 Oct 1997 10:50:39 +0800 Subject: cypherpunks-e list problem - blank subject lines Message-ID: <199710110308.WAA24826@einstein.ssz.com> Hi, The remailer software used for the cypherpunks-j and cypherpunks-e mailing lists does not accept empty subject: lines. Until they can arrange a work-around it would behoove authors to be shure to include something in the subject: line of the header. FYI. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From 12444880 at LC.Enterprises Sat Oct 11 10:51:15 1997 From: 12444880 at LC.Enterprises (12444880 at LC.Enterprises) Date: Sat, 11 Oct 1997 10:51:15 -0700 (PDT) Subject: For Immediate Release Message-ID: <> --------------------------------------------------------------------- We placed an ad in one small area of the Internet. And when the dust started to settle we had over six thousand responses in ten days. (LC Enterprises) ----------------------------------- For Immediate Release: Denver, October 10, 1997 COLORADO MARKETING FIRM SHARES MONEY GENERATING TRADE SECRETS ON THE INTERNET! ----------------------------------- Hello, My Name is Shannon Johnson. I am CEO of LC Enterprises. I have to tell you that I am really angry and upset about what is going on here on the Internet. We at Success Concepts are so angry, in fact, that we decided to do something about it. Read on and you'll see. For three years I have lead my marketing firm in sales campaigns on the Internet and the other large online services which have yielded outstanding results! We are now sharing the information we have gained over the last several years with other people who are desperately trying to figure out how to make a substantial income from their home computers. Do you know what it's like to turn your computer on in the morning to find an email box full of orders for your product.....Where it takes over an hour to sift through just the credit card orders alone? We do! Do you know what it's like to have the postman bring you a bag full of orders for products you have marketed on the Internet, and then hear him complain about all the mail you get? We do! Do you know what it's like to place a simple ad into a newsgoup or classified section on the Internet and have your Order Department's phone ring off the hook with people who want to buy your product. We do! Have you ever placed just one advertisement on the Ineternet and when the dust settled ten days later had over 6,000 responses by phone, fax, mail, and email? Well....we did in January of this year! Have you ever tried to market something simple on the Internet, only to have weeks or months of toil and effort result in only a few sales, if any? Well....that's happened to us too. But not since we learned the secrets!!! You see, we found the "secrets" to marketing just about anything on the Internet. And it is really quite simple, once you know them. Imagine this. You decide to make a second, or even a primary income from the Internet. So, you put up a Web Site, get a mess of email follow-up letters ready, put your Web Site in several hundred search engines (people gotta find your page...right), get in the News-Groups and advertise your site, and drop hundreds of classified ads all over the Net. There ya go.....now you are going to rake in the cash! Two weeks later you have one sale and you are telling your spouse and your friends that "This will take time! " Four months later you've made just enough to pay for your web space and your friends don't listen to you anymore. They consider you an "Internet Marketer Wanna Be". Sound familiar! We are not trying to rub salt in your wounds. What we are trying to do is let you in on the TRUTH about doing business from your home on the Internet. Let's face it. The vast majority of people who are trying to earn a living on the Internet are STARVING!!! That's right! They don't have a clue of what to do first, second, third or fourth! And even if they do have a clue they have been lead down the garden path with dreams and silly techniques which don't work and are breaking the hearts of thousands of people who are just trying to make a living from their home computers. That is what we are so upset about at Success Concepts! But, it doesn't have to be that way! People don't have to really FAIL at making a good income on the Internet. And it really doesn't have to take months or even years to learn how to do it. Not if you have the right guide to show you what to do, and when to do it. THE GUIDE (No More Broken Dreams on The Internet) is the name of our informative guide to generating orders, money, cash, on the Net. It was written with the "average" Netrepreneur in mind, in plain English, with straight to the point "How To" and "Why Do You Do" phraseology. In...... THE GUIDE (No More Broken Dreams on The Internet) we expose all the traps WE fell into in our first year of Internet Marketing, but stay away from now. We expose the lies and half truths which people have fallen for in the past. We expose the SECRETS which most of the successful Internet Marketers really DON'T WANT YOU TO KNOW! Because, when you know the secrets you will be off and running in... that's right......THEIR BACKYARD....the Cyberspace Marketplace! THERE IS ROOM FOR A LOT MORE OF US! There are millions of people on the Internet. And there are millions of more people on the way here. The pie which will be cut up is so huge that several hundred more people who know what they are doing will not even make a dent in our income level. It will just be a drop in the bucket so to speak. THE GUIDE (No More Broken Dreams on The Internet) will expose the Ineternet for what it really is, the marketplace which can provide you with a steady income. It will literally show you what to do first, second, third, fourth, and so on. You are about to discover exactly what makes the difference between the "Internet success stories," and the obscure "Web Marketing Failures." This guide will give you all the details, the tools, the ideas, and the resources to help you make all of your INTERNET DREAMS come true... Finally, the truth is revealed! Find out the secrets that some of the wealthiest Internet marketers are using to propel their sales through the Cyberspace roof. THE GUIDE (No More Broken Dreams on The Internet) Will show you: ** How to use Newsgroups to your advantage. The tricks! Just placing a few ads just won't do it for you! ** How to use a sig file to get more orders. They look simple, but if you write your Sig correctly it can be a GOLD MINE to you. We generate thousands just from our sigs! ** How to place your web page at the top of the search engines. If you don't get close to the top you can forget many hits! ** How to maximize your web sales using a professional looking web page (that you can build all by yourself). ** All about follow-ups and how to do them using email. A very simple technique which can mean rapidly increasing volume to you. This technique is used by some of the top Internet Marketers. ** How to effectively build mailing lists on the internet. Without lists your business will probably perish! ** Special Coding Techniques which can make your Marketing efforts amaze even the most die hard skeptics ** Where and how to place thousands of FREE classified ads. What to say in them, and what to expect when you place them. ** What products you should or shouldn't market for quick results ** How to use Testimonials... ** The importance of tracking your marketing results. ** The importance of a "back-end". ** A step by step guide to get you started IMMEDIATELY! ** And much, much more... Here is what some people who turned their Internet Marketing results from failure to success have to say about "The Guide": I thought all I had to do was place some classified ads on the Net for my flame retarding spray. Every night after work I would place a few ads and answer some questions in email. I never made much money at all. Then I read THE GUIDE and everything turned around! I'm looking at leaving my job now. And their newsletter keeps me up to date with all the new things I need to know to keep on track with my business. Bill J. St. Louis, MO I started Internet Marketing in the Chat Rooms on AOL. What a joke that was! Nobody ever told me it would take so long to make any money that way. Then I read the 'The Guide." The Chat Rooms, Internet Newsgroups, Web Sites, and email all make me money now. And it wasn't all that hard either. I just didn't know the secrets before. But I do now!!! The Internet is huge, and I've just started getting my share! Ann W. Houston, TX THE GUIDE (No More Broken Dreams on The Internet) is usually only offered to our marketing clients. With all the garbage we have seen on the Internet in the past few months we have decided to offer "The Guide" to everyone reading this advertisement. Our clients have paid $99.95 for "The Guide" and have felt that it was a real bargain for that price. "The Guide" has now gone into it SECOND Edition and we feel that we should open it up to just about anyone's financial budget. At least for a limited time. THE GUIDE (No More Broken Dreams on The Internet) is being offered to you, for a limited time, for only $24.95!!! That's correct! That's a full $75 off the regular price. Once 200 more or so orders have been placed at this price we will take "The Guide" off of the sale counter and move the price back to $99.95. But, why offer this for such a deep discount? It's simple. Success Concepts feels that the time is right for this information to become more available on the Net. But we aren't marketing fools either. The Guide holds a Copyright, and will only be offered at this very deeply discounted price for a very limited time. (There is some Joker on the Net who is trying to sell LESS information without our two bonus offers to follow for $395.00. That is ridiculous!!!) FIRST BONUS OFFER: If you order within the next 3 days we will include: ** Bulk Email Secrets...This information could save you hundreds of dollars in mailing costs, and more importantly it could keep you from losing your ISP. You'll get the details on how to: --use bulk email to explode your profits --prevent losing your dialup account --find the right product(s) to market by bulk email. --find the correct software to use. You will also learn: --Where to find reliable bulk email servers. --Where to purchase the very best email software on the market today. --And much, much more. PLUS!!! ** Free access to our private download site. Here you will find hundreds of FREE informative reports to use or sell on the internet. You will find helpful programs that we use to make our marketing efforts more effective. You will also find 25,000 email names, FREE for you to download to help you get started. These are fresh names that you can use to market your business. These names are changed weekly and you can download as often as you like. Once again all of this is yours for only $24.95, plus $3.00 S&H.... so order now! SECOND BONUS OFFER: Not many people want to do this Internet Marketing thing alone. Now you won't have to. Those who order "The Guide" by October 31 will be placed on our very select "The Guide Electronic Newsletter" where you will receive the latest tricks and "HOW TOs" in Internet Marketing. Tricks which the big boys find out about first. Now you will be right in line to find them out quickly, so you can capture the market. ***OUR BETTER THAN RISK-FREE GUARANTEE!!!*** Order the book today and receive the two bonuses absolutely FREE...Read over the book, follow the step by step guide, contact the resources listed, and if for any reason you are not fully satisfied with the book you can return it within 30 days for a full refund, AND you get to keep the bulk email report, and email names from the FREE download site. It's easy to do, so order today and take advantage of this BETTER THAN RISK-FREE OFFER before "The Guide" is moved back to the regular price. For a 3 minute RECORDED audio presentation call: 1-800-935-5171 ext. 1826 SO ORDER NOW... EMAIL: Complete the following form (Credit Card Orders) and email to: ucan2 at premierservices.com Make sure that your Subject heading is "Dreams Order" or POSTAL MAIL: PRINT out the following form and mail to: LC Enterprises Dept. 1232A P.O. Box 10003 Clarksville, TN 37042 ___________________Cut Here___________________ __Yes, I am tired of Broken Dreams...I am ordering "The Guide" well within the allotted time period and would like both the Bulk Email Report and the Private Download Site bonuses. Plus I want to be placed on your very select mailing list for "The Guide Electronic Newsletter".....all for only $24.95 + $3 S&H. __I did not order within 3 days but would still like to take advantage of your THE GUIDE (No More Broken Dreams on The Internet) for only $24.95 + $3 S&H and be placed on your very select mailing list for "The Guide Electronic Newsletter" ----[[[ Do Not Remove This Code -->( BT ) ]]] NAME:___________________________________________________ ADDRESS:________________________________________________ CITY:__________________________________STATE:_____________ COUNTRY:________________ZIP\COUNTRY CODE:______________ PHONE:________________________FAX:_______________________ EMAIL ADDRESS:___________________________________________ Please Circle Mode of Payment. Check Money Order Credit Card If Paying by Credit Card Please Circle Type of Card. Visa M/C AM EX Discover Credit Card #:___________________________exp date:_____/______ Name on card:______________________________________________ Signature:__________________________________________________ TOTAL AMOUNT INCLUDED: $27.95 Add $10 for Internation Orders. Make checks payable to: LC Enterprises. Send to: LC Enterprises Dept. 1232A P.O. Box 10003 Clarksville, TN 37042 Code: BT ________________Cut Here_____________________________ LC Enterprises Trying doesn't always work on the Net. Find out why "The Guide" works. From 12444880 at LC.Enterprises Sat Oct 11 10:51:15 1997 From: 12444880 at LC.Enterprises (12444880 at LC.Enterprises) Date: Sat, 11 Oct 1997 10:51:15 -0700 (PDT) Subject: For Immediate Release Message-ID: <> --------------------------------------------------------------------- We placed an ad in one small area of the Internet. And when the dust started to settle we had over six thousand responses in ten days. (LC Enterprises) ----------------------------------- For Immediate Release: Denver, October 10, 1997 COLORADO MARKETING FIRM SHARES MONEY GENERATING TRADE SECRETS ON THE INTERNET! ----------------------------------- Hello, My Name is Shannon Johnson. I am CEO of LC Enterprises. I have to tell you that I am really angry and upset about what is going on here on the Internet. We at Success Concepts are so angry, in fact, that we decided to do something about it. Read on and you'll see. For three years I have lead my marketing firm in sales campaigns on the Internet and the other large online services which have yielded outstanding results! We are now sharing the information we have gained over the last several years with other people who are desperately trying to figure out how to make a substantial income from their home computers. Do you know what it's like to turn your computer on in the morning to find an email box full of orders for your product.....Where it takes over an hour to sift through just the credit card orders alone? We do! Do you know what it's like to have the postman bring you a bag full of orders for products you have marketed on the Internet, and then hear him complain about all the mail you get? We do! Do you know what it's like to place a simple ad into a newsgoup or classified section on the Internet and have your Order Department's phone ring off the hook with people who want to buy your product. We do! Have you ever placed just one advertisement on the Ineternet and when the dust settled ten days later had over 6,000 responses by phone, fax, mail, and email? Well....we did in January of this year! Have you ever tried to market something simple on the Internet, only to have weeks or months of toil and effort result in only a few sales, if any? Well....that's happened to us too. But not since we learned the secrets!!! You see, we found the "secrets" to marketing just about anything on the Internet. And it is really quite simple, once you know them. Imagine this. You decide to make a second, or even a primary income from the Internet. So, you put up a Web Site, get a mess of email follow-up letters ready, put your Web Site in several hundred search engines (people gotta find your page...right), get in the News-Groups and advertise your site, and drop hundreds of classified ads all over the Net. There ya go.....now you are going to rake in the cash! Two weeks later you have one sale and you are telling your spouse and your friends that "This will take time! " Four months later you've made just enough to pay for your web space and your friends don't listen to you anymore. They consider you an "Internet Marketer Wanna Be". Sound familiar! We are not trying to rub salt in your wounds. What we are trying to do is let you in on the TRUTH about doing business from your home on the Internet. Let's face it. The vast majority of people who are trying to earn a living on the Internet are STARVING!!! That's right! They don't have a clue of what to do first, second, third or fourth! And even if they do have a clue they have been lead down the garden path with dreams and silly techniques which don't work and are breaking the hearts of thousands of people who are just trying to make a living from their home computers. That is what we are so upset about at Success Concepts! But, it doesn't have to be that way! People don't have to really FAIL at making a good income on the Internet. And it really doesn't have to take months or even years to learn how to do it. Not if you have the right guide to show you what to do, and when to do it. THE GUIDE (No More Broken Dreams on The Internet) is the name of our informative guide to generating orders, money, cash, on the Net. It was written with the "average" Netrepreneur in mind, in plain English, with straight to the point "How To" and "Why Do You Do" phraseology. In...... THE GUIDE (No More Broken Dreams on The Internet) we expose all the traps WE fell into in our first year of Internet Marketing, but stay away from now. We expose the lies and half truths which people have fallen for in the past. We expose the SECRETS which most of the successful Internet Marketers really DON'T WANT YOU TO KNOW! Because, when you know the secrets you will be off and running in... that's right......THEIR BACKYARD....the Cyberspace Marketplace! THERE IS ROOM FOR A LOT MORE OF US! There are millions of people on the Internet. And there are millions of more people on the way here. The pie which will be cut up is so huge that several hundred more people who know what they are doing will not even make a dent in our income level. It will just be a drop in the bucket so to speak. THE GUIDE (No More Broken Dreams on The Internet) will expose the Ineternet for what it really is, the marketplace which can provide you with a steady income. It will literally show you what to do first, second, third, fourth, and so on. You are about to discover exactly what makes the difference between the "Internet success stories," and the obscure "Web Marketing Failures." This guide will give you all the details, the tools, the ideas, and the resources to help you make all of your INTERNET DREAMS come true... Finally, the truth is revealed! Find out the secrets that some of the wealthiest Internet marketers are using to propel their sales through the Cyberspace roof. THE GUIDE (No More Broken Dreams on The Internet) Will show you: ** How to use Newsgroups to your advantage. The tricks! Just placing a few ads just won't do it for you! ** How to use a sig file to get more orders. They look simple, but if you write your Sig correctly it can be a GOLD MINE to you. We generate thousands just from our sigs! ** How to place your web page at the top of the search engines. If you don't get close to the top you can forget many hits! ** How to maximize your web sales using a professional looking web page (that you can build all by yourself). ** All about follow-ups and how to do them using email. A very simple technique which can mean rapidly increasing volume to you. This technique is used by some of the top Internet Marketers. ** How to effectively build mailing lists on the internet. Without lists your business will probably perish! ** Special Coding Techniques which can make your Marketing efforts amaze even the most die hard skeptics ** Where and how to place thousands of FREE classified ads. What to say in them, and what to expect when you place them. ** What products you should or shouldn't market for quick results ** How to use Testimonials... ** The importance of tracking your marketing results. ** The importance of a "back-end". ** A step by step guide to get you started IMMEDIATELY! ** And much, much more... Here is what some people who turned their Internet Marketing results from failure to success have to say about "The Guide": I thought all I had to do was place some classified ads on the Net for my flame retarding spray. Every night after work I would place a few ads and answer some questions in email. I never made much money at all. Then I read THE GUIDE and everything turned around! I'm looking at leaving my job now. And their newsletter keeps me up to date with all the new things I need to know to keep on track with my business. Bill J. St. Louis, MO I started Internet Marketing in the Chat Rooms on AOL. What a joke that was! Nobody ever told me it would take so long to make any money that way. Then I read the 'The Guide." The Chat Rooms, Internet Newsgroups, Web Sites, and email all make me money now. And it wasn't all that hard either. I just didn't know the secrets before. But I do now!!! The Internet is huge, and I've just started getting my share! Ann W. Houston, TX THE GUIDE (No More Broken Dreams on The Internet) is usually only offered to our marketing clients. With all the garbage we have seen on the Internet in the past few months we have decided to offer "The Guide" to everyone reading this advertisement. Our clients have paid $99.95 for "The Guide" and have felt that it was a real bargain for that price. "The Guide" has now gone into it SECOND Edition and we feel that we should open it up to just about anyone's financial budget. At least for a limited time. THE GUIDE (No More Broken Dreams on The Internet) is being offered to you, for a limited time, for only $24.95!!! That's correct! That's a full $75 off the regular price. Once 200 more or so orders have been placed at this price we will take "The Guide" off of the sale counter and move the price back to $99.95. But, why offer this for such a deep discount? It's simple. Success Concepts feels that the time is right for this information to become more available on the Net. But we aren't marketing fools either. The Guide holds a Copyright, and will only be offered at this very deeply discounted price for a very limited time. (There is some Joker on the Net who is trying to sell LESS information without our two bonus offers to follow for $395.00. That is ridiculous!!!) FIRST BONUS OFFER: If you order within the next 3 days we will include: ** Bulk Email Secrets...This information could save you hundreds of dollars in mailing costs, and more importantly it could keep you from losing your ISP. You'll get the details on how to: --use bulk email to explode your profits --prevent losing your dialup account --find the right product(s) to market by bulk email. --find the correct software to use. You will also learn: --Where to find reliable bulk email servers. --Where to purchase the very best email software on the market today. --And much, much more. PLUS!!! ** Free access to our private download site. Here you will find hundreds of FREE informative reports to use or sell on the internet. You will find helpful programs that we use to make our marketing efforts more effective. You will also find 25,000 email names, FREE for you to download to help you get started. These are fresh names that you can use to market your business. These names are changed weekly and you can download as often as you like. Once again all of this is yours for only $24.95, plus $3.00 S&H.... so order now! SECOND BONUS OFFER: Not many people want to do this Internet Marketing thing alone. Now you won't have to. Those who order "The Guide" by October 31 will be placed on our very select "The Guide Electronic Newsletter" where you will receive the latest tricks and "HOW TOs" in Internet Marketing. Tricks which the big boys find out about first. Now you will be right in line to find them out quickly, so you can capture the market. ***OUR BETTER THAN RISK-FREE GUARANTEE!!!*** Order the book today and receive the two bonuses absolutely FREE...Read over the book, follow the step by step guide, contact the resources listed, and if for any reason you are not fully satisfied with the book you can return it within 30 days for a full refund, AND you get to keep the bulk email report, and email names from the FREE download site. It's easy to do, so order today and take advantage of this BETTER THAN RISK-FREE OFFER before "The Guide" is moved back to the regular price. For a 3 minute RECORDED audio presentation call: 1-800-935-5171 ext. 1826 SO ORDER NOW... EMAIL: Complete the following form (Credit Card Orders) and email to: ucan2 at premierservices.com Make sure that your Subject heading is "Dreams Order" or POSTAL MAIL: PRINT out the following form and mail to: LC Enterprises Dept. 1232A P.O. Box 10003 Clarksville, TN 37042 ___________________Cut Here___________________ __Yes, I am tired of Broken Dreams...I am ordering "The Guide" well within the allotted time period and would like both the Bulk Email Report and the Private Download Site bonuses. Plus I want to be placed on your very select mailing list for "The Guide Electronic Newsletter".....all for only $24.95 + $3 S&H. __I did not order within 3 days but would still like to take advantage of your THE GUIDE (No More Broken Dreams on The Internet) for only $24.95 + $3 S&H and be placed on your very select mailing list for "The Guide Electronic Newsletter" ----[[[ Do Not Remove This Code -->( BT ) ]]] NAME:___________________________________________________ ADDRESS:________________________________________________ CITY:__________________________________STATE:_____________ COUNTRY:________________ZIP\COUNTRY CODE:______________ PHONE:________________________FAX:_______________________ EMAIL ADDRESS:___________________________________________ Please Circle Mode of Payment. Check Money Order Credit Card If Paying by Credit Card Please Circle Type of Card. Visa M/C AM EX Discover Credit Card #:___________________________exp date:_____/______ Name on card:______________________________________________ Signature:__________________________________________________ TOTAL AMOUNT INCLUDED: $27.95 Add $10 for Internation Orders. Make checks payable to: LC Enterprises. Send to: LC Enterprises Dept. 1232A P.O. Box 10003 Clarksville, TN 37042 Code: BT ________________Cut Here_____________________________ LC Enterprises Trying doesn't always work on the Net. Find out why "The Guide" works. From aba at dcs.ex.ac.uk Fri Oct 10 19:56:57 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sat, 11 Oct 1997 10:56:57 +0800 Subject: Attitude and Assumptions In-Reply-To: <3.0.3.32.19971010180024.00ad8ce0@mail.pgp.com> Message-ID: <199710110252.DAA07516@server.test.net> Jon Callas writes: > In the course of all the discussion here, I have seen a number of > implicit attitudes and assumptions that irritate me. This is a short > rant to air my irritation. [bucko big snip] Well, it was a nice rant, Jon. Most of it was even crypto-correct :-) But the problem is you didn't address the point causing your perceived hostilities. Not once. The point is Jon "GAK compliance meister" Callas, you're building in GAK compliance. Now we know that it is possible for you to have GAK compliance without using it for that purpose, or at least to promise that at this stage, promise sincerely even, it doesn't make any difference. When mandatory GAK is law, all you'll have done is to smooth the way for it. Your promises, and crypto-anarchic 'tudes won't amount to a stack of cards. Your wimpy sounding safegaurds and reasons why PGP Inc would have to be bought out, all staff sacked etc. don't sound very reassuring. Saying "over my dead body", doesn't really help us if we are realistic enough to figure that you'll be dead, and we'll have GAK. Personally I'd sooner we didn't have GAK (and that y'all lived too). Oh yeah, and the reason we're all "picking on you" is nothing, absolutely nothing what-so-ever, to do with the fact that PGP is an "Inc" now. The reason that it appears to you that we're picking on you is that we're trying to ram a few simple points through your skulls which we consider may be significant points in the political wars potentially leading up to mandatory GAK. For example, major point #1: that by attempting to enforce GAK compliance on the IETF OpenPGP standard you will make it easier, much easier, major point this, listening?, much easier to introduce GAK, because they can then do so interoperably with the OpenPGP standard, which you're hoping will be #1 internet email application used by netscape like 80% market dominance figures. PGP Inc has easily within it's powers the ability to remove this easy migration path for manditory GAK. Point #2, is more of a technical point really: you seem to be mixing key functionality to the detriment of security to provide a fully functional corporate email snooping service. Here's a meme to pass around the office: separate storage and encryption keys are just as important as separate encryption keys and signature keys. This is also fairly important, as keys have different recovery requirements, and different life time requirements. Re-using communication encryption keys for storage keys causes all sorts of problems. One of which is getting shouted at for being GAK compliant. Oh yes, and email in your received folder is NOT a communication anymore, it is now _stored_, and should therefore, if it is encrypted be encrypted with said storage key. Now, if y'all over there are such "live free or die" crypto-anarchist martyr's that you've given up your cisco options, and taken a pay cut, and resisted temptation for a 20% pay rise (and you very well may be die hard crypto-anarchists for all I know, I've only met a few of you), surely argument #1 means something to you: "attempting to enforce GAK compliance on the IETF OpenPGP standard you will make it MUCH easier for USG to introduce GAK" So what's your problem, if skipping on a 20% pay rise isn't a problem, why do you have to implement GAK compliance to provide small amounts of additional functionality for corporate snooping, which isn't even on your stated user requirement list. As I demonstrated you could if you figure this is necessary to the future of free crypto (though I can't see that it is), implement most of the snooping functionality without GAK compliance. It's not as if people can't hack around the whole damn caboodle anyway, as was stated as a plus point in earlier PGP person post. So why GAK compliance for that last couple of % of enforceability on snooping. Think of the lower enforceability as a boon, you've got a technical reason to use to explain to little brother why 100% snooping doesn't work that well without 24 hr video cams surveillance and NSA style body cavity searches at the door. I'd suggest you print the above document out and have a discussion of it. Get PRZ there too. Let us all know the decision so we know whether to start investing in stego applications in preparation for fast-track inadvertently (being generous here, since your whinge) PGP Inc assisted GAK. Cheers, And hang-loose, don't get up-tight, just say no to GAK compliance. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 > > There may be patents on these technologies, too. > > Don't think so. It's simple enough technology. Take a look at 5493614 : Private signature and proof systems INVENTORS: Chaum; David, Sherman Oaks, CA 91403 ISSUED: Feb. 20, 1996 FILED: May 3 , 1994 ABSTRACT: Cryptographic methods and apparatus for forming (102) and verifying (103) private signatures and proofs (203,204, 207, and 209) are disclosed. Such a signature convinces the intended recipient that it is a valid undeniable or designated-confirmer signature. And such a proof convinces the intended recipient, just as any cryptographic proof. Even though the signatures and proofs are convincing to the intended recipient, they are not convincing to others who may obtain them. Unlike previously known techniques for convincing without transferring the ability to convince others, those disclosed here do not require interaction--a signature or proof can simply be sent as a single message. Because the intended recipient can forge the signatures and proofs, they are not convincing to others; but since only the intended recipient can forge them, they are convincing to the intended recipient. Exemplary embodiments use a cryptographic challenge value that is said to pivot on a trap-door function, in that the value can be manipulated by those with the corresponding trap-door information, and is believed impractical to manipulate without it. From dlv at bwalk.dm.com Fri Oct 10 20:20:09 1997 From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) Date: Sat, 11 Oct 1997 11:20:09 +0800 Subject: Spammers Plan Backbone In-Reply-To: <199710101846.LAA25809@adnetsol.adnetsol.com> Message-ID: "Ross Wright" writes: > > > http://www.zdnet.com/chkpt/adt1010nk/www.anchordesk.com/story/story_1343.html > > Yippie! Spam wars intensify as bulk emailers plan own Internet > backbone. AOL, other ISPs threaten to fight back. > > Spam is FREE SPEECH!!!! > > > =-=-=-=-=-=- > Ross Wright > King Media: Bulk Sales of Software Media and Duplication Services > http://www.slip.net/~cdr/kingmedia > Voice: (408) 259-2795 > All power to the spammers!!! Note that the corporate whores at EFF are preparing another assault on free speach in the form of an "anti-spam" white paper. Fuck the Gilmore cocksucker! --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps From aba at dcs.ex.ac.uk Fri Oct 10 20:29:14 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sat, 11 Oct 1997 11:29:14 +0800 Subject: Why Jon Callas keeps picking nits (Re: Why Corporate Message Recovery isn't Key Escrow) In-Reply-To: <3.0.3.32.19971010145353.00ad9330@mail.pgp.com> Message-ID: <199710110112.CAA06510@server.test.net> Jon Callas writes: > A number of people have asserted that the Corporate Message Recovery > feature is key escrow. From where I sit, the difference is easy to > see. My definition of "key escrow" is that another person or > organization keeps a copy of the user's secret key. You are adopting a narrow technical meaning of key escrow. Key escrow also has another meaning in common parlance: third party access to communications. Now I know this common parlance isn't technically accurate, but "key escrow" itself is a piece of newspeak, a clever term coined by secret service / government spin doctors. It has entered the language like it or not (I don't like it). This common parlance meaning is probably more widely understood and used than the technical meaning you are using. With that in mind, you may start to see why people, such as Schneier, and others over the last few days have been telling you "you're picking nits". Point is pgp 5.5 allows other people to have access to your communications. Your SMTP policy enforcer even attempts to enforce this. You also described a feature whereby an administrator could remotely configure and restrict functionality in pgp 5.5 mail client (I am unclear as to whether this allows the admin to enforce snoop access or not). Your own term CMR (Corporate Message Recovery) isn't that accurate a description itself, it's a bit of a euphamism at best. What you're recovering is transient communications which don't need recovering anyway. What PGP is really up to is enforcing capability for Corporate Message Snooping. [line breaks were _all over_ the shop, I've reformatted] > Here's an example, based on actual customers who use key escrow to > manage their data: > > This corporation uses PGP for a number of things. Email, engineering > plans, CAD drawings, and so on. They've done so at least since the > days when we were Viacrypt, and I believe they even used PGP 2.x. First point, which I'm getting bored of repeating: keys have different uses. Storage keys, transient communications keys, signature keys. You're using one key for all 2 functions; that is the root of your problems and dilemmas. You're using what should be a storage key to receive transient communications, then you're proceeding to wonder why this causes you to have the undesirable situation of having a GAK compliant system (or more properly trying and failing to argue that you don't have one). > When an employee arrives at this company, they create a key pair for > the new employee, hand it to them on a floppy, keeping a duplicate > floppy with the keypair on it, which they toss into a > safe. Literally. This is key escrow. They do this because they > can't afford to lose their files and messages. Their policies > require them to keep the secret keys, as if they were the same as > keys to offices or file cabinets. You know, what they're doing: it's not so bad for data encrypted on their disks. They can acheive the departmental level escrow to distribute risk just the same with this form of escrow. You don't need to escrow transient communications keys at all anyway. Your pgp 5.5 isn't going to help recover the actual data of value, all those stored CAD files... You know why? Because they're on the disk, not in transit in the email system. So you haven't solved the claimed problem. If you want to do something about the claimed problem work out some secret splitting solutions to better distribute trust for escrowed storage keys. (Now this is a real use for escrow: the company is safe guarding it's own encrypted data on disks and tapes for it's own benefit). > - From our standpoint, the issue gets even touchier. They don't like > what they're doing, and they want us to give them a better way to > manage their data. Does anyone really believe that only moral > response is to flinch and turn away? Nope, your responsibility should be to solve their problems. (Which as I show above you have not done.) Actually your responsibility to live up to the reputation PRZ transfered to PGP Inc dictates that you should also do what you can do not build systems which help GAKkers. Instead your responsibility appears increasingly to produce systems which smooth the way for coming mandatory GAK by implementing systems which are GAK ready. Or if you deny that one, at least you are weakening your communications security for practically no gain. > I'd like to be in a situation where I didn't have to deal with > this. Wanna trade positions? Yeah, OK, you don't seem to be managing very well :-) (Sorry, you asked for it. I don't actually mean to be rude, I would just like to get the points across, and to influence PGP to recover gracefully from this tactical and reputational mistake.) > It isn't so with a CMRK. The worst possible way to use the feature > is to have a single, company-wide CMRK. If that gets lost, the > thriller you can write isn't nearly as interesting. Yup, you can > steal any of the plans, read all the mail, and so on. That's > bad. It's deplorable, actually. But it isn't a difference that makes > no difference. At least there isn't a gang of keys out there that > can sign anything with anyone's ID. This is why I was asking above about separate signing keys. They surely don't need to stick the signature keys in the safe!!! In fact it is counter-productive even for hard-nosed corporate lawyers, and $$$ driven scruple-short company execs: if they can't prove an employee penned something they can't use this to prove a case against him. If they've got a copy of the signature key, they can forge signatures which makes signatures useless in litigation involving company and employee. > This is not the only way to use Corporate Message Recovery, it's > just the worst way. Remember, it's just a notation in the > self-signature that states, "When you encrypt to me, encrypt to X." > That's any X. You can have a different CMRK for every department, > every workgroup, or even every user. It's all screwey because you've got key functionality which belongs in different keys mixed up. You should have 3 types of key: 1. signature keys 2. transient encryption keys 3. storage keys The signature keys you never escrow. You certify. If something goes wrong you re-issue, release revocation cert, and re-certificate. The transient encryption keys are for communications, you delete them immediately after use. Yes I'm talking forward secrecy here. If you don't like forward secrecy, well at least don't escrow the encryption keys. Storage keys you make damn sure you can recover. You escrow these for real. Company safe sounds about right. Secret splitting could be nice also. > The significant improvement that PGP's web of trust has over a > traditional hierarchical system is that you can set up a top-down > system for validity, but you don't have to (and in our opinion, > shouldn't). Analogously, the significant improvement that Corporate > Message Recovery has over key escrow is that you can tailor a > recovery system to your needs (including and especially deciding > it's not for you). There is no advantage; the systems are approximately equivalent in flexibility of architecture. You can acheive the exact same architecture with key escrow; just escrow the keys with your backup czar. You shouldn't be recovering transient messages, you should be recovering stored data. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 I'm getting a bit tired of the rants on this topic to the Open-PGP list. Yes, there are problems, but the whole purpose of IETF review is to find solutions to problems. The PGP staff have some ideas on how business message recovery can be done. It seems there is a business need. It seems that they have thought about it, and made some effort toward implementation. What annoys me is that the PGP formats are now supposed to be "open", yet no proposed formats for this new "feature" have been documented for our review, and other folks' suggestions for a better K-of-N mechanism have been ignored. We don't even have the current formats. When will the PGP 5.0 internet-draft be ready for review? There is already a PGP 5.0 separation between signing and communication keys; why not have separate message storage keys? Why not have a K-of-N system for BMR? Why have a communication enforcement filter, when the only usage is supposed to be for recovering archival storage? Let us decide _what_ the goals are, _how_ to solve the problems, and _then_ decide the protocol details and formats to match the solution. WSimpson at UMich.edu Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32 From tcmay at got.net Fri Oct 10 21:16:07 1997 From: tcmay at got.net (Tim May) Date: Sat, 11 Oct 1997 12:16:07 +0800 Subject: Attitude and Assumptions In-Reply-To: <3.0.3.32.19971010180024.00ad8ce0@mail.pgp.com> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A thoughtful essay by Jon Callas on the trials and tribulations of being a crypto start-up company. Before I get into commenting on parts of Jon's message, let me first make some very general points. First, I don't think PGP, Inc. is being picked on. It announced a new product this month, one with obvious implications and resonances for and with the whole key recovery/key escrow/GAK debate. Second, for us not to pick it apart would be "out of character" (considering past critical remarks directed toward Netscape (ask the Weinstein brothers), toward Microsoft (ask the MS employees who mostly post from non-MS accounts), toward Cybercash, toward First Virtual, toward RSADSI, and on and on. (And the Cypherpunks list was not even in the lead in picking on PGP for Business, as the comments by Bruce Schneier, Simson Garfinkel, etc. show.) Third, several of us have reititerated the basic point that *of course* an employer or corporation owner has every right to insist that his employees use a particular product, submit to searches of their breifcases, have their phone calls monitored, wear funny costumes, and so on. Only a couple of people have even hinted that the issue is some kind of "workers rights" thing. Fourth, though employers may wish to insist on this kind of message recovery, there are obvious dangers. Not the least of which is that the voluntary aspects may cease to be voluntary (in terms of the government mandating archival of all corporation messages, analogous to requirements for audit trails, OSHA compliance, receipts, cash register records, etc.). Fifth, it thus behooves us to think about these issues. That there will be issues to consider, and public debate, is shown by the comments here and the comments from Schneier, Garfinkel, etc. And even Phil Zimmermann, when discussing a very similar product from ViaCrypt, basically said (paraphrasing from memory): "Call it what you like, but it violates the spirit of PGP, so don't call it PGP." Amen to that. (Personally, I'll be real disappointed if Chairman Phil sends us a Zimmermann Telegram (TM) telling us that the ViaCrypt and PGP products are actually not all alike. "Pay no attention to the man behind the curtain.") Sixth, besides all of these issues, there are interesting questions about whether this form of "encrypting to a corporate key" is very useful or addresses the right problem. (I happen to believe that the "what if Joe is hit by a truck?" issue is better solved with other tools, and the "what if Joe is sending corporate secrets outside the company?" issue is not at all addresses with PGP for Business (as Joe will either stego encrypt, or, even better, will just carry out gigabytes in a CD or DAT and use a non-company account). Anyway, I guess I don't need to comment paragraph by paragraph on Jon's points. I'm happy that he's commenting here on the list. - --Tim May The Feds have shown their hand: they want a ban on domestic cryptography - ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBND78j1K3AvrfAt9qEQL4pgCfQqH86oZ8phNCo45ZNFRj2AX8ogYAoLjG 0d/WpUBVhv4NXPsfo/dbsa59 =88Cn -----END PGP SIGNATURE----- From JonWienk at ix.netcom.com Fri Oct 10 21:29:14 1997 From: JonWienk at ix.netcom.com (Jonathan Wienke) Date: Sat, 11 Oct 1997 12:29:14 +0800 Subject: 6502 ML programming In-Reply-To: <199710090439.XAA16340@einstein.ssz.com> Message-ID: <3.0.3.32.19971010211816.02fa1704@popd.netcruiser> At 11:39 PM 10/8/97 -0500, Jim Choate wrote: >Forwarded message: > >> Date: Wed, 8 Oct 1997 23:10:26 -0400 >> From: ghio at temp0132.myriad.ml.org (Matthew Ghio) >> Subject: Re: [LONG, off-topic]] Interactive Programming > >> Reminds me of a time, years ago, where I was trying to modify a program >> written in 6502 assembler. > >> Consider the following line of C code: >> >> result = function(x,y,z); >> >> One could write this in 6502 assembler as: >> >> JSR function >> DATA x >> DATA y >> DATA z >> STA result >> >> where x,y,z,result are pointers to storage locations. > >There in no 'DATA' construct in 6502 assembly. > >This is some sort of macro that either the assembler or programmer >defined. All official Rockwell/Commodore [1] 6502 assembly mnemonics are >three letter. There are NO official macro's from MOS Technologies under >either Rockwell or Commodore other than the ORG. ORG simply defined the >starting address for the target code. I concur. >The most efficient way to store data in 6502 is to put it in the first 256 >bytes of ram, then it could be called in no more than 2 clock cycles. Also, >in 6502 good programmers use the branch instructions (BCC, BCS, BEO, BMI, >BNE, BPL, BVC, BVS) because the JSR required three bytes versus 2 bytes for >a Bxx. The only constraint was that the branch target must reside in the same >256 byte page as the branch itself. The biggest boo-boo committed here was not >realizing that branch offsets that took you across the upper page boundary >would leave you at the lower page boundary plus some remaining offset. This is not quite correct. I can't seem to find my Commodore 128 Programmer's Reference Guide, (of all the things I lost going to the PC, I miss my PRG the most. It contains complete BASIC & assembler language reference guides, lists EVERY memory address used by the OS and what it does, register-level programming info on every chip, and even schematics for my 128! Unfortunately, nobody seems to publish such a book for PC's, but I digress.) The branching instructions used 1 byte for the in struction, followed by 1 data byte which was a signed integer. This allowed one to branch up to 127 bytes ahead, or 128 bytes back from the current instruction address register value. The coolest thing about this was that if you were able write your code to branch and not JMP or JSR, your code could be located anywhere in memory and it would work perfectly, which was very useful when writing interrupt wedges that were supposed to work on the C-64 and the C-128, or that could be loaded in various places in memory. >Idealy a jump table was created that had the various target addresses for your >routines. Then a Bxx followed by a indirect mode JMP (NOT a JSR). If that table >was in the first 256 bytes it was possible to save a whole clock cycle AND a >byte in the process. At 64k and 1Mhz clock these sorts of short-cuts were >significant. This is where self-modifying code came in handy. During initialization, a self-mod routine would increment the addresses in the jump table so they pointed to the proper addresses of the respective routines. >Because of the architecture of the 6502 the 0 page of RAM was a very busy >place indeed because any operation there automaticaly saved a byte and a >clock cycle. If I remember correctly, there were all of 5 or 10 bytes available for "user programs", depending on which OS functions you were willing to break. My first computer was a Commodore VIC-20. 5 points and Geek of the Week to the first email correctly specifying the "Basic Bytes Free" on a vanilla VIC-20. Real Programmers don't use symbolic addresses. Jonathan Wienke What part of "the right of the people to keep and bear Arms, shall not be infringed" is too hard to understand? (From 2nd Amendment, U.S. Constitution) PGP 2.6.2 RSA Key Fingerprint: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 DSS/D-H Key Fingerprint: 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC Public keys available at pgpkeys.mit.edu. PGP encrypted e-mail preferred. Get your assault crypto before they ban it! US/Canadian Windows 95/NT or Mac users: Get Eudora Light + PGP 5.0 for free at http://www.eudora.com/eudoralight/ Get PGP 5.0 for free at http://bs.mit.edu:8001/pgp-form.html Non-US PGP 5.0 sources: http://www.ifi.uio.no/pgp/ http://www.heise.de/ct/pgpCA/download.shtml ftp://ftp.pca.dfn.de/pub/pgp/V5.0/ ftp://ftp.fu-berlin.de/pub/pc/win95/pgp ftp://ftp.fu-berlin.de/pub/mac/pgp http://www.shopmiami.com/utopia.hacktic.nl/pub/replay/pub/pgp/pgp50/win/ RSA export-o-matic: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 From whgiii at invweb.net Fri Oct 10 21:36:00 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Sat, 11 Oct 1997 12:36:00 +0800 Subject: Why Adam Back keeps politicizing technical issues (Re: Why Jon Callas keeps picking nits) In-Reply-To: <199710110112.CAA06510@server.test.net> Message-ID: <199710110431.AAA21720@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <199710110112.CAA06510 at server.test.net>, on 10/10/97 at 08, Adam Back said: Ok Adam here is a challenge for you: - -- Explain why Corporations do not have the right to access *their* documents in whatever form they may be in. - -- Failing that explain how PGP 5.5 furthers the cause of GAK and PGP 2.6.x does not when I can get my network to do the same thing in a weekend and a couple of scripts using PGP 2.6.x. - -- Failing that explain why there were no great outcries that PGP 2.6.x is GAKware??? Now if you agree that Corporations *do* have a right to access their documents but you disagree with the technical aspects of how PGP 5.5 achieves this then drop the fearmongering and spell out how you think this can be better achieved. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBND8CqI9Co1n+aLhhAQGoJwP+P5InFFnaH5svFrdnlREW08lOlYKrLjHH 95/X669e3RK+l9Oaj0svN8DxMV53GnRj+4spb8c7UpYLmUV0ZGvf+mORog6rwYaP 65Gl+wgNTdkJefENxAr6aofTU+zwYUgklUSPfl6+y5Hn8xlwftpuRxNjs4W2muGz VR1RYTQKQIE= =Z81q -----END PGP SIGNATURE----- From biy71 at ix.netcom.com Sat Oct 11 12:36:02 1997 From: biy71 at ix.netcom.com (biy71 at ix.netcom.com) Date: Sat, 11 Oct 1997 12:36:02 -0700 (PDT) Subject: For Adults Only!! Message-ID: <199710111615UAA45220@post.wsu.edu> Preview the 1998 "Online stripshow Of The Year" Voted by the Association of Adult Internet Services as having the best content, best live sex picture quality and the most beautiful models! http://www.livehardcoresex.com AOL Click Here! You must be 21 or older. If you would like to be removed forever e-mail us jackpotx at ix.netcom.com 3ing sender: From ravage at ssz.com Fri Oct 10 21:56:42 1997 From: ravage at ssz.com (Jim Choate) Date: Sat, 11 Oct 1997 12:56:42 +0800 Subject: 6502 ML programming (fwd) Message-ID: <199710110506.AAA25402@einstein.ssz.com> Forwarded message: > Date: Fri, 10 Oct 1997 21:18:16 -0700 > From: Jonathan Wienke > Subject: Re: 6502 ML programming > for my 128! Unfortunately, nobody seems to publish such a book for PC's, > but I digress.) Actualy there are several sources for schematics and such for PC's. As to the basic BIOS functions and such, plenty of PC assembly books go into that to some detail. The one I use and refer to is: IBM PC Assembler Language and Programming Peter Abel ISBN 0-13-448143-7 Some other references you might want to get from IBM (800-426-7282) are: PC Hardware Maintenance Service (PC, XT, AT, PPC) Part No. 6280087 $244.00 PC Hardware Maintenance Reference Part No. 6280088 $187.00 Hardware Interface Technical Reference Part No. 85F1646 $63.00 BIOS Interface Technical Reference Part No. 04G3283 $55.00 Note: contact your BIOS manufacturer and they should be more than willing to sell you the technical manual for their BIOS. They ain't cheap. Also contact: Annabooks 11848 Barnardo Plaza Ct., #102 San Diego, CA 92128-2417 619-673-0870 800-462-1042 619-673-1432 fax IBM Technical Directory PO Box 2009 Racine, WI 53404 414-633-8108 800-426-7282 ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From nobody at REPLAY.COM Fri Oct 10 22:20:08 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sat, 11 Oct 1997 13:20:08 +0800 Subject: non-transferable & designated verifier signatures Message-ID: <199710110505.HAA15711@basement.replay.com> Adam Back: > The application you describe could be catered for very well by a third > type of signature called a designated verifier signature. AKA patent number 5373558 : Desinated-confirmer signature systems INVENTORS: Chaum; David, Sherman Oaks, CA 91403 > Non-transferable signatures on the other hand work by being made > forgeable by the recipient. That way it is essentially the recipients > word against the senders. However there is some transferable proof > there: there is proof that _one_ of you wrote it. Not clear how much privacy this buys you. If one party sues the other, it's some protection. But if both parties are hauled into court and accused of some crime, it's going to be clear enough which party sent the mail. Yes, technically it could have been forged by the other party, but people have been convicted on evidence a lot shakier than this. > Also you could clearly cope with the arbitrator situation without > resorting to DV signatures; non-transferable signatures would be > enough, if you sent a signed message to Alice, and a detached > signature to your abitrator. If you want to later use the abitrator, > you send the body of the message to the arbitrator. He calculates the > hash of the message, and is then able to use the detatched > non-transferable signature to verify your claim. But he can't > demonstrate this to other people. One disadvantage is that the > arbitrator could team up with you and make that two peoples words > against one. You might see that as an advantage, but Alice won't. An > arbitrator which indulged in this kind of behaviour may lose > reputation. Sounds complicated. It will be years before the legal system is able to handle these subtleties. Ordinary digital signatures are challenging enough. > One way to do this for some kinds of situations is for each party to > setup a atomic transfer where they give each other the ability to > cause a penalty to be extracted from both of them. Torn ecash? > Say they are engaging in some business worth $100. Alice is > performing some programming task for Bob. > If Bob is satisfied with the software he gives Alice the $100. If he > is not he incurs a $50 loss himself which goes to charity, and Alice > does also. In doing this he doesn't get the software. But Alice is > penalised, and it is better than losing $100. With torn ecash, Bob withdraws $100 from his account, but in such a way that Alice has some crucial information needed to unblind it. If they can't come to a meeting of the minds, Bob is out the $100 and Alice is out the time she spent on the project. This removes much of the incentive each has to cheat the other, and gives them an incentive to cooperate. From whgiii at invweb.net Fri Oct 10 22:22:26 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Sat, 11 Oct 1997 13:22:26 +0800 Subject: PGP CAKware & IETF controlled Open-PGP standard In-Reply-To: <199710110154.CAA06536@server.test.net> Message-ID: <199710110517.BAA22561@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <199710110154.CAA06536 at server.test.net>, on 10/11/97 at 02, Adam Back said: >Jon Callas writes: >> I am adamantly opposed to any of PGP's business features being MUST >> features of OpenPGP. If they were, then our freeware and personal >> privacy products wouldn't be conforming applications, and we have >> *no* intention of putting them in those products. Wouldn't that be >> an interesting situation? >I may be misunderstanding something here, but could you tell me how PGP >freeware and PGP personal privacy can simultaneously not have recognition >of GAK compliant keys, and emit messages telling the users that this is a >GAK key (on receipt of the flag you described), and emit messages warning >the user that the email will not be delivered (on receipt of that other >flag you described). I didn't see where Jon said that the other versions versions of PGP would not recognize these keys. What Jon did say is that they would not generate these keys nor force compliance with encryption to a second key. I myself would want to know that a message encrypted with key A is also being encrypted with key B though haveing this info in the public key itself is not necessary. >If it's defined as being compliant to ignore both of these flags, and the >message snooping key then users email will bounce without warning. I don't see this as a problem. My Twit/SPAM filter bounces messages without warning. As a matter of fact most bounced messages are done so without warning. :) >If it's defined to silently send to second crypto recipient, you have >fully interoperable GAK compliance built in to the core of PGP. If PGP >Inc will remove the GAK compliance when GAK becomes mandatory, I'm sure >there are other companies who won't have a problem selling out to GAK (eg >IBM, or TIS). This is a stereotypical Strawman. "Even if PGP avoids GAK some other 3rd party can modify it to be Gakware." Every version of PGP had the ability to encrypt to multiple recipients. As I stated in my previous posts I can get PGP 2.6.x to do everything 5.5 does with a couple of scripts. Are you no willing to take the position that ALL versions of PGP are GAK compliant??? >If it's defined to warn but give the option to send to second crypto >recipient, well you've still got mandatory GAK compliance, but you've got >a pretty little warning that you've got mandatory GAK to rub your nose in >the fact for each message you send too. No this is not mandatory GAK compliance. Mandatory GAK compliance would be if every copy of PGP came with a government key and the program *forced* the user to encrypt all his messages with it. This is really turning into a shameless FUD campagne on your part Adam worthy of David "FUD" Sternlight himself. >> I am strongly opposed the business features being SHOULD features. If I >> were the only one arguing against them being SHOULD features, I'd make my >> opposition clear and then shut up. >> >> I am in favor of them being MAY features, along with a big section on >> polite use. >I'd be interested to see some discussion of how this will work out, >following up to the specific examples I give above. >No switching to genaralities this time; please answer: how is it going to >work? I fear you can't have your CMR setup in pgp5.5 and not be GAK >compliant. If you can think of a way that you can modify it to break >this dependency, I'd be interested to hear it. If you can't demonstrate >such a change I would argue strongly for it not even being a MAY. I'd >argue for GAK compliancy not to go into the IETF OpenPGP standard. As far as I am concerned you have not proven your case that PGP 5.5 is GAK compliant. Your general argument that PGP 5.5 has the potential to be GAK can cover *ALL* version of PGP. Any system that allows encrypting to multiple recipients can easily modified into a GAK system. >I gave lots of examples of other ways to achieve the claimed >functionality of recovering stored data. Achieving hard to circumvent >corporate email snooping functionality is harder to achieve without CMR. >You can do some, but not quite as much. But corporate snooping wasn't on >your stated list of user requirements. And it's not very savory anyway. I think this is your real issue here. You don't like the ideal of a company haveing access to their documents. If that's how you feel then make your case so it can be judged on it's merits. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBND8Nko9Co1n+aLhhAQEdsQP+JD99L79r4aGkc4GEj4S0rOzbt5aadkQP GPaERGoRCB3cn9ms0crNRc6JUNmjVEBff/48zMzAH9reeaDhtqZadmW9CrVZIMle VrOa9A+wqZjuNdFiSLE+5ygyeJ+WN0ofqUluCzUa5dgg2eAVHU4MRzWvRuREkjuN nRWB6mhCt0g= =s4jP -----END PGP SIGNATURE----- From whgiii at invweb.net Fri Oct 10 23:07:07 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Sat, 11 Oct 1997 14:07:07 +0800 Subject: PGP CAKware & IETF controlled Open-PGP standard In-Reply-To: <6661.wsimpson@greendragon.com> Message-ID: <199710110557.BAA22975@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <6661.wsimpson at greendragon.com>, on 10/10/97 at 10, "William Allen Simpson" said: >I'm getting a bit tired of the rants on this topic to the Open-PGP list. >Yes, there are problems, but the whole purpose of IETF review is to find >solutions to problems. I agree, I think the political debates can be better handled on the CP list rather than here. In that light I have created a PGP 5.5 digest that covers the various threads on this topic from the CP list, the open PGP list and the PGP Users lists (for the neswgroups you are on your own). I will also provide a daily digest as long as these threads continue (cut-off time 5pm central time zone). Anyone wishing to receive a copy let me know (digest, daily, or both). >The PGP staff have some ideas on how business message recovery can be >done. It seems there is a business need. It seems that they have >thought about it, and made some effort toward implementation. >What annoys me is that the PGP formats are now supposed to be "open", yet >no proposed formats for this new "feature" have been documented for our >review, and other folks' suggestions for a better K-of-N mechanism have >been ignored. >We don't even have the current formats. When will the PGP 5.0 >internet-draft be ready for review? >There is already a PGP 5.0 separation between signing and >communication keys; why not have separate message storage keys? >Why not have a K-of-N system for BMR? >Why have a communication enforcement filter, when the only usage is >supposed to be for recovering archival storage? >Let us decide _what_ the goals are, _how_ to solve the problems, and >_then_ decide the protocol details and formats to match the solution. An excellent suggestion. Perhaps you could detail your ideals on these areas so we can work on them. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBND8W+o9Co1n+aLhhAQEW2wP/Ya18Xh44vRqsy/5uhPLeprw8C9z+MgWE MOdoRrKq8BvkCA9qoCEpm6bmFajR18IcvkEE1rurEV69yehpi0/YfYOQ4adntiEd xTIQ8OLpQ6DMion7FauBb9Y1/XeKef/jOqddlM4qmgUswpkzMA7RMdaHoL7yrLI+ jGjJnD6qmKk= =KxW9 -----END PGP SIGNATURE----- From 07607928 at grandbikes.com Sat Oct 11 14:09:27 1997 From: 07607928 at grandbikes.com (07607928 at grandbikes.com) Date: Sat, 11 Oct 1997 14:09:27 -0700 (PDT) Subject: NEW ! DIGITAL / CELL PHONE ! NEW ! Message-ID: <> DO YOU WANT THE SECURITY OF A DIGITAL / CELLULAR PHONE WITH NO DEPOSIT , NO CREDIT CHECK , NO PREPAY AND NO PENALIZING RATES ? EXAMPLE : .10 AIRTIME / MIN . & .15 LD , 24 HRS. 7 DAYS THIS IS YOUR GROUND FLOOR OPPORTUNITY TO GET THE PHONE AND/OR EARN BIG BUCKS NOW ! AT THE PHONE COMPANY IF YOUR CREDIT IS LESS THAN PERFECT YOU CAN'T GET A CELL PHONE WITHOUT A DEPOSIT OR A PREPAY AND/OR INFLATED RATES , BUT NOT SO WITH US , WE DO NOT DISCRIMINATE .YOU GET THE PHONE , NO QUESTIONS ASKED ,THE SAME RATES AS EVERYONE ELSE AND YOU CAN EASILY EARN THE MONEY TO PAY YOUR PHONE BILL AND MUCH , MUCH MORE ! * WE ARE A LEADER IN THE TELECOMMUNICATIONS INDUSTRY WITH MANY PRODUCTS AND SERVICES. WE ARE TARIFFED /REGISTERED IN EVERY STATE. WE ALSO OFFER 9.9 c + 1 PLUS DIALING . * DUAL COMPENSATION PLAN OFFERS BIG UPFRONT $$$. * WE ARE THE ONLY , THE ONLY COMPANY TO OFFER THIS EXCITING OPPORTUNITY, THAT CAN PRODUCE 100'S OF NEW MILLIONAIRES I * THERE ARE 30/40 MILLION FOLKS WHO CANNOT GET A CREDIT CARD OR A CELLULAR PHONE BECAUSE OF CREDIT , SO YOUR MARKET IS 30/40 MILLION PEOPLE , WE WILL TAKE THEM ALL. NO DEPOSIT, NO CREDIT CHECK, NO PREPAY, NO ROAM CHARGE I FOR MORE DETAILS AND AN APPLICATION PLEASE VISIT OUR WEB SITE AT: HTTP://WWW.DATATAMERS.COM/~DIGIPHONE OR E MAIL US AT : DIGIPHONE at DATATAMERS.COM If you received this notice in error, please delete and we apologize for the intrusion. Sorry :-( If you wish your address to be removed from our list please e mail us at : remove at grandbikes.com From 07607928 at grandbikes.com Sat Oct 11 14:09:27 1997 From: 07607928 at grandbikes.com (07607928 at grandbikes.com) Date: Sat, 11 Oct 1997 14:09:27 -0700 (PDT) Subject: NEW ! DIGITAL / CELL PHONE ! NEW ! Message-ID: <> DO YOU WANT THE SECURITY OF A DIGITAL / CELLULAR PHONE WITH NO DEPOSIT , NO CREDIT CHECK , NO PREPAY AND NO PENALIZING RATES ? EXAMPLE : .10 AIRTIME / MIN . & .15 LD , 24 HRS. 7 DAYS THIS IS YOUR GROUND FLOOR OPPORTUNITY TO GET THE PHONE AND/OR EARN BIG BUCKS NOW ! AT THE PHONE COMPANY IF YOUR CREDIT IS LESS THAN PERFECT YOU CAN'T GET A CELL PHONE WITHOUT A DEPOSIT OR A PREPAY AND/OR INFLATED RATES , BUT NOT SO WITH US , WE DO NOT DISCRIMINATE .YOU GET THE PHONE , NO QUESTIONS ASKED ,THE SAME RATES AS EVERYONE ELSE AND YOU CAN EASILY EARN THE MONEY TO PAY YOUR PHONE BILL AND MUCH , MUCH MORE ! * WE ARE A LEADER IN THE TELECOMMUNICATIONS INDUSTRY WITH MANY PRODUCTS AND SERVICES. WE ARE TARIFFED /REGISTERED IN EVERY STATE. WE ALSO OFFER 9.9 c + 1 PLUS DIALING . * DUAL COMPENSATION PLAN OFFERS BIG UPFRONT $$$. * WE ARE THE ONLY , THE ONLY COMPANY TO OFFER THIS EXCITING OPPORTUNITY, THAT CAN PRODUCE 100'S OF NEW MILLIONAIRES I * THERE ARE 30/40 MILLION FOLKS WHO CANNOT GET A CREDIT CARD OR A CELLULAR PHONE BECAUSE OF CREDIT , SO YOUR MARKET IS 30/40 MILLION PEOPLE , WE WILL TAKE THEM ALL. NO DEPOSIT, NO CREDIT CHECK, NO PREPAY, NO ROAM CHARGE I FOR MORE DETAILS AND AN APPLICATION PLEASE VISIT OUR WEB SITE AT: HTTP://WWW.DATATAMERS.COM/~DIGIPHONE OR E MAIL US AT : DIGIPHONE at DATATAMERS.COM If you received this notice in error, please delete and we apologize for the intrusion. Sorry :-( If you wish your address to be removed from our list please e mail us at : remove at grandbikes.com From sales at consumersgroup.com Sat Oct 11 14:58:03 1997 From: sales at consumersgroup.com (sales at consumersgroup.com) Date: Sat, 11 Oct 1997 14:58:03 -0700 (PDT) Subject: Great Products to Improve Yourself and Your Life Message-ID: <>


	Great products to improve yourself and improve your life.  Visit
Consumers Integrity Groups Web site at www.consumersgroup.com.  We have
many books, guides, and literature on  self help and  financial  improvement.  All
offers are 100% guarenteed.  Here's  our current list of great products;

	- Web Wealth, by Dr. Jeffrey Lant, 248 pages.  How to turn the World Wide Web 
                   into a cash flow machine for you and/or your business.
	- The Insiders Guide to Credit Cards, by Barry Klien, 80 pages.  Best credit
                   card rates of the top 96 credit cards with all addresses and toll free #'s.  Great book.
	- The Action Guide to Government Auctions & Real Estate, 235 pages. 
                   Everything you need to know about government auctions and real estate.
	- Credit Information Guide, by R.D. Kincannon.  How to correct  and remove
                   inaccurate information from your credit report. Also includes federal credit law. Step by
                   step procedures and sample letters. Limited quantity, order today.
	- Money Making 900 Numbers, by Ginsberg and Mastin. 336 pages.  Learn how
                   you too, can make substantial income with this great indsustry.
	- The Magic of Credit, by George Chelekis, 380 pages.  Complete credit guide.

	All offers 100% $ back
                Guarantee!!
Discover many other great products at our Web page.
http://www.consumersgroup.com/booklist.htm    

If you would like to be removed from our list please click here. http://209.30.49.41/remove.htm









From sales at consumersgroup.com  Sat Oct 11 14:58:03 1997
From: sales at consumersgroup.com (sales at consumersgroup.com)
Date: Sat, 11 Oct 1997 14:58:03 -0700 (PDT)
Subject: Great Products to Improve Yourself and Your Life
Message-ID: <>



	Great products to improve yourself and improve your life.  Visit
Consumers Integrity Groups Web site at www.consumersgroup.com.  We have
many books, guides, and literature on  self help and  financial  improvement.  All
offers are 100% guarenteed.  Here's  our current list of great products;

	- Web Wealth, by Dr. Jeffrey Lant, 248 pages.  How to turn the World Wide Web 
                   into a cash flow machine for you and/or your business.
	- The Insiders Guide to Credit Cards, by Barry Klien, 80 pages.  Best credit
                   card rates of the top 96 credit cards with all addresses and toll free #'s.  Great book.
	- The Action Guide to Government Auctions & Real Estate, 235 pages. 
                   Everything you need to know about government auctions and real estate.
	- Credit Information Guide, by R.D. Kincannon.  How to correct  and remove
                   inaccurate information from your credit report. Also includes federal credit law. Step by
                   step procedures and sample letters. Limited quantity, order today.
	- Money Making 900 Numbers, by Ginsberg and Mastin. 336 pages.  Learn how
                   you too, can make substantial income with this great indsustry.
	- The Magic of Credit, by George Chelekis, 380 pages.  Complete credit guide.

	All offers 100% $ back
                Guarantee!!
Discover many other great products at our Web page.
http://www.consumersgroup.com/booklist.htm    

If you would like to be removed from our list please click here. http://209.30.49.41/remove.htm









From kelsey at plnet.net  Sat Oct 11 00:31:26 1997
From: kelsey at plnet.net (John Kelsey)
Date: Sat, 11 Oct 1997 15:31:26 +0800
Subject: Defeating MITM with Eric's Secure Phone
Message-ID: <199710110651.BAA02401@email.plnet.net>



-----BEGIN PGP SIGNED MESSAGE-----

[ To: Cryptography, cypherpunks ## Date: 10/10/97 ##
  Subject: Re: Defeating MITM with Eric's Secure Phone ]

>Date: Thu, 9 Oct 1997 21:02:53 -0700
>From: Bill Frantz 
>Subject: Re: Defeating MITM with Eric's Secure Phone
>Cc: cryptography at c2.net, cypherpunks at Algebra.COM

I wrote (and Bill commented on):
>> 1.	Exchange PGP-encrypted e-mail establishing a set of
>> sixteen different words, labeled for 0..f in each direction.
>> Thus:
>>
>> 0. Dilbert 1. Alpha 2. Cable 3. Swordsman ... f. Marxist
>>
>> Now, the checksum reading is very hard to spoof.  Suppose I
>> get 0x33f. I say ``My checksum is Swordsman Swordsman
>> Marxist, or 33f.''

Bill responded with some nice reasoning:
>Assume that the contents of the paper are secret between
>Alice and Bob. When Alice calls Bob, she reads the word
>coresponding to the first digit of the checksum.  Either
>Mallory is in the middle or he isn't.  If he isn't, no
>problem.  The word list remains secure.

>If he is in the middle, he has 15 chances in 16 of being
>caught on the first exchange.  He only survives if the first
>digit of the Alice-Mallory connection is the same as the
>first digit of the Mallory-Bob connection. He now knows the
>word for one value and can continue to play 1 out of 16
>times.

This is *almost* right.  We need to add one more thing,
though:

1.      Alice calls Mallory, thinking she's calling Bob.
She reads the first three digits to him.  He makes the
connection fall apart.  At the same time, Mallory calls Bob,
pretending to be Alice, and causes the connection to fall
apart at the same time.

2.      Alice calls Bob again, re-establishes their
connection, and talks to him.  Both seem to have had the
same thing happen, so it's believeable that it was just
noise on the line.  (Where I am, this isn't so uncommon that
it would imply an active attack.)

3.      Mallory now knows three of these words in the
dictionary.  He lies low for the next few calls before
trying the same trick again, until he learns most or all the
dictionary entries.

This implies a couple of things:  First, Alice and Bob
ought to be suspiscious of line noise that conveniently
clobbers them during reading of checksums.  Second, Alice
and Bob shouldn't keep the same 16-word dictionary forever.
If they change it once a week, this may be enough to make
the attack I describe above unworkable.

Note that this all works only when the phones/dictionaries
are used only by single users.

I also made a poorly-thought-through comment about using
6-digit hex secrets, and adding or XORing them into the
checksums.  This is vulnerable to a trivial attack, of
course.  The thing is, this doesn't need to be as complex or
cryptographically secure as a hash function or MAC, because
of the way it's used.  We can probably also expect
one-day-only keys for this application.

I can think of dozens of things that *ought* to work here,
and still be strong enough to resist the limited possible
attacks, but I can't seem to convince myself of the security
of any that are simple enough to use with a calculator.  If
I settled on one, it would be

New checksum = (((old checksum * C0) mod P)+ C1) mod 2^{64}.

where P is a random 64-bit prime, C0 is a random 64-bit
number between 0 and P-1 inclusive, and C1 is a random
64-bit number.  If P,C0, and C1 are all unknown, I *think*
that's secure.  An attacker given the high-order half of
this doesn't seem to have the information needed to guess
its low-order half on a different checksum, nor to reliably
learn the value of P.

This is essentially the IBC-Hash message authentication
code, which is provably secure if the key is used once.
I can't see a way that this could be attacked in this
application, given one-time use of the keys.  Can anyone
else?  (I may be missing something obvious again.)

>BTW - I really like John's idea of doing another exchange
>later in the conversation.  Perhaps something like, "You
>know, I was dancing the Foxtrot with my wife 9 days ago at
>5AM."

I wish I could claim this, but it's been around for a while.
Didn't some of the PGPphone people come up with this idea?
(Or was it users of older, government-issued secure phones?)

>Bill Frantz       | Internal surveillance      | Periwinkle --
Consulting
>(408)356-8506     | helped make the USSR the   | 16345 Englewood
Ave.
>frantz at netcom.com | nation it is today.        | Los Gatos, CA
95032, USA

   --John Kelsey, Counterpane Systems, kelsey at counterpane.com
 PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBND8+LUHx57Ag8goBAQHgCAQA1a6JjY0CMymvvXkWC8L8xOkyy2oosmQU
rJAGtN9pYOdv+fyxSwEu4Mh03jjbcmQ1YBKkkD5CVfrhIYN93FGMZq9tVT+hIVCE
04/ki48Os1AitU/vZI94GlJlajhssSPy0R9fcPbFtR96KAw8csuFICtX2quwBK6a
+SkkfLZgaKc=
=vGOh
-----END PGP SIGNATURE-----


   --John Kelsey, Counterpane Systems, kelsey at counterpane.com
 PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36






From stewarts at ix.netcom.com  Sat Oct 11 01:41:17 1997
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sat, 11 Oct 1997 16:41:17 +0800
Subject: Defeating MITM with Eric's Secure Phone
In-Reply-To: <199710091908.UAA00790@server.test.net>
Message-ID: <3.0.3.32.19971010195814.006b4024@popd.ix.netcom.com>



>>> 1.	Exchange PGP-encrypted e-mail establishing a set of
>>> sixteen different words, labeled for 0..f in each direction.....
>>>  ``My checksum is Swordsman Swordsman Marxist, or 33f.''
That really does seem easier than all this checksum business;
if you're exchanging secrets anyway you could also type your
half-keys into some friendly application program, but this is fun.
On the other hand, for Alice's Fax Machine calling Bob's Fax Machine,
it's tougher to automate this stuff.  Does the phone have some way
to output the checksums to a data port for checking later?
(stuffing it into the fax header field would be a nice touch.)

> Either Mallory is in the middle or he isn't.  If he isn't, no problem.
> The word list remains secure.
>
>If he is in the middle, he has 15 chances in 16 of being caught on the
>first exchange.  He only survives if the first digit of the Alice-Mallory
>connection is the same as the first digit of the Mallory-Bob connection.

If there's a failure, you're going to burn this list anyway;
if Alice and Bob each read all their codewords, Mallory can trick them
about 1/16**6 times (1/16Million), which is pretty low -
Mallory learns up to six codewords, but they're only useful if
he doesn't get caught or if Alice and Bob decide to reuse the list
because they don't have a chance to exchange more email.
So if you're not worried about denial of service, catch him.
You do have to make sure Alice and Bob _notice_ they've been hosed;
you can get a bit fancier by using two lists, one for use 
in case of errors or other interruptions
Alice: Swordsman Swordsman Marxist  ->
Mallory: Marxist COUGH COUGH ->
		<- Bob: Dilbert Marxist Aardvark, and repeat please
		<- Mallory: Swordsman Dilbert COUGH, and repeat please
Alice: Swordsman Swordsman Marxist, sounds like you have a cold? ->
Mallory: Marxist Dilbert Aardvark, and I've got a cold too. ->

As opposed to 
		<- Bob: Bogus Suspicious Fnord, and repeat please
Alice: Swordsman Swordsman Marxist, and I've got a bad feeling about this....		

Even just using one list for Alice and one for Bob helps this attack.

>If Alice and Bob catch Mallory, they talk about the weather and exchange a
>new list by email.  If they don't, there is a very high probability that
>the word list has not been compromised, and they can safely continue to use
>it for the next call.

				Thanks!
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From mc at dev.null  Sat Oct 11 01:41:34 1997
From: mc at dev.null (Monty Cantsin)
Date: Sat, 11 Oct 1997 16:41:34 +0800
Subject: InfoWar Epilogue 1 / TEXT
Message-ID: <343F373B.7D6A@dev.null>



----------------------------------------------------------------------------
----------------------------------------------------------------------------

                       The True Story of the InterNet
                                  Part III

                                   InfoWar

                  Final Frontier of the Digital Revolution

                     Behind the ElectroMagnetic Curtain

                        by TruthMonger 

Copyright 1997 Pearl Publishing
----------------------------------------------------------------------------
----------------------------------------------------------------------------

                          InfoWar Table of Contents

   * Epilogue
   * Priscilla

----------------------------------------------------------------------------

                                  Epilogue
----------------------------------------------------------------------------

The sun was rising over the mountain peaks, crimson streaks of light
streaming through the trees, striking the multi-colored falling leaves.
As the tattered remnants of the Magic Circle slept soundly, after days of
flight to the security of their last remaining hideaway, twin rays of light
split the air in the cave above them, with silver leaves twisting lazily
down from the skylight at its peak, turning to a blazing scarlet as they
passed through the lower streak of light, like blood dripping off a chain
saw�

This was a moment stranded in time�not abandoned, but suspended in the
twilight which lay between the future and the past�between the beginning of
time and the end of time�or vice-versa.
A twinkling of time, wherein the sun was neither rising, nor setting�merely
waiting for a whisper from the Tao before deciding which way to proceed in
its journey toward eternity�
----------------------------------------------------------------------------
----------------------------------------------------------------------------

                                  Priscilla

Perhaps I look at life a bit differently from some of the remaining members
of the Magic Circle, because I am a mother.
That is probably why, of all Bubba's many stories of the characters in the
legends surrounding the Magic Circle, I most enjoyed the ones concerning the
Author and Bubba d'Shauneaux swapping stories about the Author's mother.
My favorite remains the one of how she worked at a small newspaper, in a
small town, at a time when it was unheard of for a woman to write a sports
column. She simply took on a masculine nome-de-plume, put some obscure man's
picture next to it on the column header, and proceeded to do exactly what
she wanted to do.

"To him who does what within him lies, God will not deny his grace."
- Saint Augustine

This is something that mothers instinctively understand, and their joy or
heartache, if they have remained on a path with heart, is not from their
children's success or status in the eyes of others, but in their child's own
inner eye.
Likewise in the Magic Circle. It's members recognize one another instantly,
not from their outer appearances, but from an inner quality of being that is
acquired only by being true to one's inherent soul-pattern and making
choices that are in line with their true destiny in life.

Bubba Rom Dos tells a story about the Author and d'Shauneaux I discussing
members of the CypherPunks list.
"Bianca was listening to them discuss whom on the list they would trust to
vote for them. When they discussed Kent Crispin, the Author said, 'If he
tried to cast my vote for me, I would be forced to kill him.'
"d'Shauneaux asked the Author if he would trust Crispin to watch his back
for him in the real world, and the Author replied, 'In a heartbeat.'
"Bianca asked the Author, 'If he was your child, would you be proud of him?'
and he replied, without hesitation, 'Yes�but I'd spank him, too.'"

Cowboy once told me that he thought I had perhaps given one of the most
astute definitions of the CypherPunks he had ever heard, and that it was a
description that only a mother could give.
I had told him that I thought they were "deranged saints with an attitude."
I suspect that he was so grandly impressed with my description because it
fit himself so well. As a child, I mean, of course (nod-nod, wink-wink;)

The CypherPunks were an oddball assortment of scrappers and elitists,
mathematicians, philosophers, physicists, lunatics and poets�ad infinitum�
The CypherPunk mailing list, however, had a spirit of life about it, with
even the most brutal of attacks usually having some basis of logic
underpinning them. Meanness and pettiness were not the rule of the day and
were seldom tolerated for long on the list without any one of a wide number
of list members stepping in to give the originator an 'attitude adjustment.'

Even in the midst of some of the CypherPunks' most ferocious of their
legendary pissing contests, some poor bastard would shoot himself in the
foot that he or she had put in their mouth, at which point the thread would
often pause, like the Civil War hiatus wherein opposing sides would 'do
lunch' and claim their dead, and everyone would join in soundly ridiculing
the offending party before resuming their pissing party (or forgetting about
it and moving on to less meaningful activities).

After Vice-Admiral d'Shauneaux had taken over Pearl Harbor Computers, Inc.,
and had written the Epilogue to 'The Xenix Chainsaw Massacre' someone asked
him what he liked most about the bizarre cryptographers he was following who
had formed the CypherPunks mailing list.
His cryptic reply was, "They're Troopers!"

I asked Bubba once whether the Admiral was referring to the rumors that they
were all double or triple agents of three-letter secret agencies of one sort
or another, or to one of the Author's favorite musical groups, who sang,
"We're here for a good time, not a long time, so have a good time�the sun
doesn't shine every day."
Bubba's answer was, "Both."

If you are reading this, then I presume that the Trei Transponder is no
longer functioning, and has transferred the InformEnergy from the Epilogue
HydroCube which was meant only to be sent in the event that we were forced
to abandon our last remaining safe house and beat feet to our mountain
hideaway.
No matter what your view of what the tattered remnants of a mythical group
from the future have chosen to share with you, I hope and pray that you will
learn as much from your future as we have from our past.

You may not yet fully realize the full import of the story that you and we
have woven together from what could have been, and what may yet be, but it
will not be long before you will.

Remember:
"Patience comes to those who wait�"
----------------------------------------------------------------------------

                        "The Xenix Chainsaw Massacre"

                 "WebWorld & the Mythical Circle of Eunuchs"

           "InfoWar (Part III of 'The True Story of the InterNet')

                Soviet Union Sickle of Eunuchs Secret WebSite
----------------------------------------------------------------------------







From mc at dev.null  Sat Oct 11 01:42:45 1997
From: mc at dev.null (Monty Cantsin)
Date: Sat, 11 Oct 1997 16:42:45 +0800
Subject: InfoWar Epilogue 1 (Part III of 'The True Story of the InterNet')
Message-ID: <343F36F7.470@dev.null>

A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 6115 bytes
Desc: not available
URL: 

From I.Brown at cs.ucl.ac.uk  Sat Oct 11 03:16:02 1997
From: I.Brown at cs.ucl.ac.uk (Ian Brown)
Date: Sat, 11 Oct 1997 18:16:02 +0800
Subject: PGP CAKware & IETF controlled Open-PGP standard
In-Reply-To: <199710110557.BAA22975@users.invweb.net>
Message-ID: <343F4B28.B3E088A1@cs.ucl.ac.uk>



William Geiger wrote:

> This is a stereotypical Strawman. "Even if PGP avoids GAK some other 3rd
> party can modify it to be Gakware." Every version of PGP had the ability
> to encrypt to multiple recipients. As I stated in my previous posts I can
> get PGP 2.6.x to do everything 5.5 does with a couple of scripts.

Yes, but as Adam says, the average Mr. Windows can not. In any case,
this is not a narrow technical argument. Of course any system with
multiple recipients can be turned into GAKware. The point is that we
don't want to make it ANY easier for anyone to do so.

> No this is not mandatory GAK compliance. Mandatory GAK compliance would be
> if every copy of PGP came with a government key and the program *forced*
> the user to encrypt all his messages with it.

Again, as Adam says, how long would it take for a government to
introduce legislation making this mandatory once PGP 5.5-type systems
took off? Or, more insiduously, using its purchasing power - "Federal
agencies will only buy CAK-enabled systems" - to ensure the vast
majority of systems did so.

> Ok Adam here is a challenge for you:
> 
> -- Explain why Corporations do not have the right to access *their*
> documents in whatever form they may be in.

Can I take this one up ;-) The point is, with *communication* keys,
corporations will have full access to the plaintext because it will be
decrypted by the recipient as soon as it arrives. I appreciate your
point about corporations being able to read *their* documents - although
doing so by snooping, without the sender's knowledge, is rather
unethical to say the least - but I don't think they have the right to
snoop on all *incoming* communications, whoever they may be from. This
is the really scary part of PGP 5.5...

> explain why there were no great outcries that PGP 2.6.x is
> GAKware???

...because PGP 2.6.x does not include an SMTP automatic snooping agent.

William Simpson wrote:

> Let us decide _what_ the goals are, _how_ to solve the problems, and
> _then_ decide the protocol details and formats to match the solution.

Absolutely. Can we start with Adam and William's proposal that we should
have three separate types of key: communication, signature, and storage.
This would be very simple to implement; probably the easiest and most
backward-compatible way would be to define a new packet type specifying
a key's usage. 

> Why have a communication enforcement filter, when the only usage is
> supposed to be for recovering archival storage?

Absolutely. I can see the point, and appreciate the difficulties faced
by PGP Inc., in most of the CAK features of PGP 5.5. But I just can
*not* see how the twisted idea of the SMTP snooper ever came about.

Ian.






From aba at dcs.ex.ac.uk  Sat Oct 11 03:34:59 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sat, 11 Oct 1997 18:34:59 +0800
Subject: IETF policy on refusing to allow politics to weaken protocols (Re: Why Adam Back keeps politicizing technical issues)
In-Reply-To: <199710110431.AAA21720@users.invweb.net>
Message-ID: <199710110941.KAA01200@server.test.net>




Williams title being: `Why Adam Back keeps politicizing technical
issues'

I would like to comment that the reason politics are arising in
discussion of communications security issues is a natural consequence
of the fact that it's a damn political topic.  Ignore the politics and
you may implement a mandatory GAK system, or at least a GAK compliant
one.  Actually I also argue that there are technical security reasons
why the CMR approach offers weaker security.  I've gone over these
reasons already in this thread, so I won't repeat them.

IETF I think has a stated policy (at least this is the case for the
IPSEC standardisation discussions I have been intermittently
following) to not allow politics to weaken it's protocols and
algorithm choices.  PGP Inc introducing GAK compliance at the cost of
security is a clear case where this policy should be kicking in.

William Geiger  writes:
> In <199710110112.CAA06510 at server.test.net>, on 10/10/97 
>    at 08, Adam Back  said:
> 
> Ok Adam here is a challenge for you:
> 
> -- Explain why Corporations do not have the right to access *their*
> documents in whatever form they may be in.

You will note that I didn't say this.  In fact I spent half of last
night detailing alternate less GAK friendly ways for PGP Inc to
provide corporate message snooping, the very functionality which is
the motivation for their CMR.  Perhas you were not reading.

What I did say, and it appears to be a meme which didn't stick with
you as I'm sure I raised this in a previous post replying to you is:

Key functionality should be separated: in the same way that you have
separate signature and encryption keys, because of the differences
between appropriate backup policies, security implications, and
life-times, you should have separate email receipt encryption keys and
storage keys.  Transient email receipt keys should not be escrowed,
but for security reasons perhaps should even be securely wiped after
use.

As an additional security bonus: storage keys can be symmetric (where
they are for your own use) which avoids the more less certain and
more quickly sliding target of public key lengths.

I will guess that the reason this meme doesn't suit you is that it's
not the way your OS/2 pgp mail client plugins work, and therefore not
yet part of your mindset.  So perhaps it's not the status quo for your
and some other apps to use separate storage keys for archiving and
receiving encrypted mail; but there are clear security advantages to
doing it this way.

> -- Failing that explain how PGP 5.5 furthers the cause of GAK and
> PGP 2.6.x does not when I can get my network to do the same thing in
> a weekend and a couple of scripts using PGP 2.6.x.

There is are some clear differences: 

1. You can visually see multiple crypto recipients in most PGP enabled
MUAs, as they usually correspond to email CC fields.

2. PGP Inc is attempting to weakly enforce this special purpose
message snooping recipient embedded into the key certificate.

3. PGP Inc even has (less clear on details here) I think from Jon
Callas first post: pgp 5.5 client which enforces inclusion on sent
mail as controlled by a remote company message snooping czar &
enforced inclusion on received mail by the SMTP policy enforcer.

4. There is a difference between what you or I may knock up in
scripts, and what PGP Inc attempts to persuade the IETF include as
conformancy requirements, and what PGP does implement ahead of the
standardisation process.

5. The IETF process should be accepting proposed designs and deciding
on the best ones, which PGP Inc, and the other suppliers would then go
and implement.  As it is now, as William Allen Simpson just pointed
out, PGP Inc is cruising ahead implementing, and deploying things
without bothering with the OpenPGP process.


Your point about using normal multiple recipient to provide snooping
is a good one.  It would be a much less GAK friendly solution for PGP
Inc to encrypt to a second recipient without any message snooping
flags encoded into the PGP standard.  That way email clients won't
reply to this second recipient, and users won't have an automated
snooping feature embeded in their PGP for personal privacy, or
competitor re-write of the same compliant OpenPGP app, for someone
else's benefit (recipient company, or government).

To snoop received email, it provides similar amounts of snooping
enforcement if the recipient's PGP 5.5 for business client when the
user decrypts re-encrypts to a storage key that the company does have
escrowed, or where there is a second crypto recipient in the storage.
(Talking mail folders here.)

> -- Failing that explain why there were no great outcries that PGP
> 2.6.x is GAKware???

See above.  The objectionable new feature in PGP5.5 (and apparently
pgp5.0 too without our realisation to this point) is enforcement in
senders clients to support message snooping, in a form which can
easily be used to interoperate with GAK, and thereby prepares
everyones OpenPGP compliant email client to enforce GAK against them.

At the very most the maximum acknowledgement that it seems reasonable
to me for OpenPGP to have of the GAK compliancy feature is to flag
this key and allow the user to send to this recipient at their option.

In addition I am arguing that PGP Inc are doing the Internet community
a major disservice by choosing to implement message snooping in this
way.  Much better, less controversial, and more secure to do the
snooping in the pgp5.5 client after decryption.  That doesn't need to
involve changes to the message spec.  PGP Inc's SMTP policy enforcer
could then be changed in functionality to stripping off the company
snooping crypto recipient field before it leaves the LAN for security
reasons.

> Now if you agree that Corporations *do* have a right to access their
> documents but you disagree with the technical aspects of how PGP 5.5
> achieves this then drop the fearmongering and spell out how you
> think this can be better achieved.

I already did this half a dozen times.  I'm not fear mongering, I'm
attempting to point out the dangers of including GAK compliancy.  And
to point out the opportunity to make PGP non-GAK compliant, and
thereby frustrate mandatory GAK proponents.  PGP is trying to discard
this opportunity, when there are clear alternate methods which can be
argued are more secure, better meet PGP's Jon Callas's stated user
requirements, don't support GAK, and don't require modifications to
the standard.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710111017.LAA01278@server.test.net>




William Geiger  again:
> In <199710110154.CAA06536 at server.test.net>, on 10/11/97 
>    at 02, Adam Back  said:
> >Jon Callas  writes:
> >> I am adamantly opposed to any of PGP's business features being MUST
> >> features of OpenPGP. If they were, then our freeware and personal
> >> privacy products wouldn't be conforming applications, and we have
> >> *no* intention of putting them in those products. Wouldn't that be
> >> an interesting situation?
> 
> >I may be misunderstanding something here, but could you tell me how PGP
> >freeware and PGP personal privacy can simultaneously not have recognition
> >of GAK compliant keys, and emit messages telling the users that this is a
> >GAK key (on receipt of the flag you described), and emit messages warning
> >the user that the email will not be delivered (on receipt of that other
> >flag you described).
> 
> I didn't see where Jon said that the other versions versions of PGP would
> not recognize these keys. 

Neither did I.  But the question at hand is whether the IETF OpenPGP
should recognize them.

> What Jon did say is that they would not generate these keys nor
> force compliance with encryption to a second key. I myself would
> want to know that a message encrypted with key A is also being
> encrypted with key B though haveing this info in the public key
> itself is not necessary.

I'd argue that it's more than just not necessary, having the
information in the public key is the sole reason I'm arguing that this
is a GAK compliant feature.

> >If it's defined as being compliant to ignore both of these flags, and the
> >message snooping key then users email will bounce without warning.
> 
> I don't see this as a problem. My Twit/SPAM filter bounces messages
> without warning. As a matter of fact most bounced messages are done so
> without warning. :) 

Not very intuitive to the user though is it.  Also not a very strongly
optional feature if 80% of businesses end up bouncing your mail back
at you because you're "choosing" not to be GAK compliant.

> >If it's defined to silently send to second crypto recipient, you have
> >fully interoperable GAK compliance built in to the core of PGP.  If PGP
> >Inc will remove the GAK compliance when GAK becomes mandatory, I'm sure
> >there are other companies who won't have a problem selling out to GAK (eg
> >IBM, or TIS).
> 
> This is a stereotypical Strawman. "Even if PGP avoids GAK some other 3rd
> party can modify it to be Gakware." 

Not so fast there.  That isn't the stated problem.  The problem is
that not only can some 3rd party adopt it (no modifications necessary,
that's why I'm dubing it "GAK compliant"), but that the rest of the
compliant OpenPGP standards would automatically cooperate to some
degree, and we would thereby be streamlining the migration path to
mandatory GAK.  If PGP retract the GAK compliancy feature, by removing
the functionality in the key, we won't be calling it GAK compliant.
They (and any other government or corporate message snooping feature
implementors) can achieve message snooping without adding this
functionality to the OpenPGP standard.

> Every version of PGP had the ability to encrypt to multiple
> recipients. As I stated in my previous posts I can get PGP 2.6.x to
> do everything 5.5 does with a couple of scripts. Are you no willing
> to take the position that ALL versions of PGP are GAK compliant???

No, they are not.  I've argued in reply to your other post why this is
clearly not so.  The difference is that PGP is creating a new animal:
a key which it is defined will be auto-encrypted to two keys by the
_sender_.  Variations being discussed being auto-encrypt with user
query, or auto-encrypt with user override to disable.  Regardless, the
fact that PGP is encouraging the process of enforcing this dubious
security practice via their policy enforcer means that users are
forced to use the GAK compliancy feature to get through to any
corporates who are using PGP's method of implementing corporate
message snooping.

> >If it's defined to warn but give the option to send to second crypto
> >recipient, well you've still got mandatory GAK compliance, but you've got
> >a pretty little warning that you've got mandatory GAK to rub your nose in
> >the fact for each message you send too.
> 
> No this is not mandatory GAK compliance. Mandatory GAK compliance
> would be if every copy of PGP came with a government key and the
> program *forced* the user to encrypt all his messages with it. This
> is really turning into a shameless FUD campagne on your part Adam
> worthy of David "FUD" Sternlight himself.

It's less strongly enforced GAK compliance, but I think it is still
a form of GAK compliance.

To see why this might be, consider the effects of 80% of the business
community using this feature, and you as a pro-privacy cypherpunk type
(you are pro-privacy aren't you?).  Consider also that government has
mandated that companies hand over their message snooping master key to
the Feds.

Now what happens.  In the above, you have the "option" not to use the
GAK compliance feature in that you can still send a message, but the
option won't be worth much in that the recipient will be unable to
read it.  If lots of people are using this system, that will cut you
off.  You will be unable to send email to these people.  It's all very
well to say you have the "choice" not to do business with them, but
your choices may be severely restricted.

I hope that following from this discussion you can see the advantages
of PGP switching to the use of the normal multiple crypto recipient
field to acheive this message snooping functionality.  It doesn't
apply at all to the recipient.  The snooping of received email for
those using PGP 5.6 "message snooping for businesses" is done after
decryption in the PGP5.6 "for message snooping enforcing" client.  The
snooping of sent mail for users of PGP5.6 "for message snooping
enforcement" client is done inside the corporate LAN as the message
snooping packet security leak prevention functionality built in to the
PGP 5.6 "SMTP prevention of security leaks enforcer" strips out the
second message snooping crypto recipient packet.

> As far as I am concerned you have not proven your case that PGP 5.5
> is GAK compliant. Your general argument that PGP 5.5 has the
> potential to be GAK can cover *ALL* version of PGP. Any system that
> allows encrypting to multiple recipients can easily modified into a
> GAK system.

You may have not been convinced of the case, but that is because you
have not considered the long term picture, interoperability issues,
and utility to GAKkers of having GAK compliant features in the IETF
OpenPGP standard.

The argument that pgp5.5 has mandatory GAK compliancy does not in any
way apply to older versions of PGP.

PGP 2.x can support voluntary GAK in that the user can send to a
second key that the NSA generates for thme.

It is the features which move the enforcement of this functionality
into the senders client, and the fact that the "optional" nature
becomes weakly optional (meaninglessly optional) if you consider
scenarios where most businesses are using the pgp5.5 SMTP policy
enforcer to bounce your email unless it complies, and where business
are legally required to use such policy enforcers, and businesses are
legally required to hand over the master corporate snooping key to the
GAKkers to go in the NSA database.

> >I gave lots of examples of other ways to achieve the claimed
> >functionality of recovering stored data.  Achieving hard to circumvent
> >corporate email snooping functionality is harder to achieve without CMR. 
> >You can do some, but not quite as much.  But corporate snooping wasn't on
> >your stated list of user requirements.  And it's not very savory anyway.
> 
> I think this is your real issue here. You don't like the ideal of a
> company haveing access to their documents. If that's how you feel then
> make your case so it can be judged on it's merits.

That's a separate argument entirely.  I believe that I have shown
security advantages in not doing corporate message snooping in the way
that PGP is "proposing" (by steaming ahead and implementing and
deploying it outside of the IETF OpenPGP process).  In addition I made
the point earlier that any form of message snooping is weak... there
are many ways for the determined employee to by pass it.  The only
real protection is surveillance cameras, tamper-resistant key board
logs, and body cavity searches at the door.  So if enforcement is weak
anyway, it seems sensible to trade some small percentage of this
enforceability for enhanced security.

I went to great pains to detail other more secure, and entirely
feasible methods of assuring corporate message snooping functionality
can be built.

I also clearly distinguised between stored documents and documents in
transit in transient communications mediums.

In addition I argued for key escrow of storage keys as good company
backup policy.

You have not been paying attention here, or are playing the function
of the luddite, refusing to accept that better security is obtained by
separating the functionality of encryption keys and storage keys.

A similar example might be if you were to refuse to countenance the
suggestion that having separate signature and encryption keys is
better than not doing using as an argument perhaps the fact that
pgp2.x has been using the same key for both purposes for years.

The point of the IETF OpenPGP standardisation process is to explore
the options and decide on the best technical approach, which is in the
interests of the Internet community.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710111107.MAA02086@server.test.net>




Hal Finney, now working for PGP  writes:
> PGP now offers an extensible signature format.  This allows key
> signatures, both self-signatures by a key on itself, and ordinary key
> signatures by keys on other keys, to do more than before.  The extensions
> are in the form of subpackets within the signature packet.  Various
> subpackets have been defined, and Open-PGP would be an excellent forum
> to propose and design new subpacket types and corresponding data formats.

OK, that means the correct technical term for my discussion is an
argument over the GAK compliancy subpacket type.

> Some of the subpackets are modifiers of ordinary userid-binding signatures.
> These allow signatures to have expiration dates; to be marked as non-
> exportable (so that the signatures are only for your own use on the
> keyring); 

I really like this non-exportable signature option.  It is highly
useful.  I have a couple of keys on my key ring with signatures on
them that I have mentally flagged as non-exportable.  This is because
they are signatures by the True Name of nyms I happen to know the True
Name of and are intended to allow me to transfer the trust to that
Nym, but the Nym is trusting me not to make public this signature.

It would be really kind of neat to extend this functionality so that I
_couldn't_ export the key by making the certifcate a non-transferable
signature, or a designated verifier signature.

> And here there is the new corporate message recovery key (CMRK)
> subpacket.

This is the controversial object.  I have been arguing in a couple of
earlier posts today that this design is a bad idea from a security
perspective, and from the point of view that it is a form of GAK
compliancy when coupled with PGP's SMTP policy enforcer.

The reason I say this is that if we get to the situation where many
businesses are using PGP 5.5 + PGP policy enforcer, the clients
"choice" to not encrypt to the message snooping second crypto
recipient in the CMRK subpacket will have little practical meaning.
The user will be forced to comply or be unable to send messages which
don't bounce.

A better place to do corporate snooping, and to avoid the extra
security risk of sending messages over the internet encrypted to two
rather than one long term encryption keys, is to snoop the plaintext
after it has been decrypted in the PGP 5.5 mail client.

Also, the message snooping functionality is reading between the lines;
Jon's post no where mentioned this as a user requirement.  What he
said was that corporates had a need to recover encrypted email
messages stored in encrypted mail folders.  If this is truly the case,
the functionality is even easier to achieve, just encrypt the mail
folder to a company escrowed storage key after decryption.  Easy to
do, and more secure.  Same flexibility in reflecting the internal
structure of the company's trust and risk management in the storage
key escrow architecture.

> The CMRK subpacket allows a key to request that when a message is
> encrypted to it, the message should also be encrypted to a specified
> additional key.  The subpacket includes a flag byte which is designed to
> allow the key to give information about the circumstances under which this
> should be done. Only two values are presently defined, one specifying
> an optional request, and the other meaning that the message will not be
> read by the recipient if the additional encryption hasn't been done.

If PGP is going to forge ahead and try for this flawed message
snooping architecture anyway, I would urge you personally to at least
press upon them to remove the flag meaning that a message will not be
received without the use of the message snooping key, and to remove
the functionality preventing delivery in the SMTP policy enforcer.

> I won't address the controversy about this feature, as that is being
> thoroughly discussed in other forums.  Let me make two points, though:

OK.  The controversy has technical basis too -- and seems to be
starting to be discussed in this forum also.  There is also a question
of how this design interacts with the IETF policy of not allowing
political issues to weaken protocol designs to discuss.

> We would like to move towards a mechanism to allow more power for keys
> to make assertions.  Matt Blaze's (still vaporware?) PolicyMaker project
> showed how powerful such a general mechanism could be.  SPKI is also
> working along these lines, defining a certificate format which allows
> keys to make very general classes of assertions.

I've read Matt's PolicyMaker paper.  I can see the attraction of
moving towards these generalisedl trust statement syntaxes.

I would be nice to see the topic of the recipient refusing email based
on policies relating to third party access to messages in transit
being addressed in the standard when and if PGP gets to that stage.

There are some nice uses for some types of recipient refusal.  Ecash
payment for message processing, or my less $ oriented hashcash
proposal also.  (The types of problem that can arise with real ecash
payment for receipt, which hashcash avoids is that if applied to
discussion forums, it can bias the forums to allowing through more of
what rich people have to say.  A similar argument perhaps applies to
email following up to comments made in public forums, you can only
reply to someone if you have the money.  Busy people may set very high
payment rates.)

> The CMRK is one such type of assertion: "please cc to key X anything
> encrypted for me".  The key is requesting that the specified other key
> by an additional recipient on encryption.

I can see problems with this type of assertion.  I hope when the time
comes that a way to define a convetion or set of rules which disallows
this as part of the standard.

> If we move to a sufficiently powerful language to allow keys to make
> useful assertions, it seems to me that we will probably inherently
> allow keys to make assertions of a type which some people may regard as
> politically unacceptable, like this one.  But to artificially constrain
> the language so that it can only say things which are politically correct
> will make a an already-difficult design task into an intractable one,
> I'm afraid.

We'll see when we get to it.  In the mean time, PolicyMaker &
look-alikes are vapourware.

> Ultimately, a fully general and flexible system of key assertions will
> allow keys to say stupid things as well as smart ones.  I believe that
> the power gained from having such a language gives advantages which
> outweigh the problems of misuse.  (Note the similarities to the debate
> over the PICS labelling technology, which some people oppose because it
> could be misused.)

It's similar to PICs in that third party rating services are fine (for
example consumer product evaluations in various magazines), but
centrally controlled ones are objectionable to many of us.

> Secondly, with this type of assertion, as with others such as
> the preferred algorithm packet, it is inherently in the sender's
> (encryptor's) power to ignore it if he chooses.  You can request that I
> not use triple-DES, but I could still send you a message encrypted with
> that algorithm.  You would then have the choice to reject it or accept it.
> This is a point which I owe to Phil Zimmermann.

The problem with this point, which you say is PRZ's, is that it falls
down for interoperability reasons when the system is widely deployed.
Exactly how much "choice" do you have when 80% of businesses will
bounce your mail if you don't comply.  How much "choice" do you have a
few years later when 95% of individuals and companies are using the
same system, and the government is holding the master snooping keys.

[1] The long term likely value of this choice is rather low, so the
assertion that it leaves you empowered is a weak assertion.  You would
paradoxically in this case be much more empowered if the recipient did
the escrowing silently after receipt by decrypting and storing his
mail folder with an escrowed storage key.  Of course it would be nice
if this policy was advised in the public key also, to at least warn
you, in case you mistook the persons email address as a private
account.  (Some ISPs have names which look similar to some companies
names,... domain names ending in .com, if you are not familiar with
the company name).

> Likewise in PGP 5.0 the user can override the CMRK request even in
> its strongest form (although not in 5.5, because that is intended
> for business-to-business communications).

I submit for the above reasons that this overriding feature will in
the long term me fairly meaningless.  What is the practical individual
empowerment transferred in being able to override something in the
sure knowledge that it will thereby be bounced and not delivered.

> Therefore, I very much agree with Jon Callas that an implementation which
> (perhaps optionally) allows overriding the requests which a key makes
> in its self-signatures should still be considered compliant.  That is
> consistent with the nature of the sender's power to create the message.

I strongly disagree for reasons stated in paragraph [1] above.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710111135.MAA02104@server.test.net>




Ian Brown  writes:
> William Geiger wrote:
> 
> > This is a stereotypical Strawman. "Even if PGP avoids GAK some other 3rd
> > party can modify it to be Gakware." Every version of PGP had the ability
> > to encrypt to multiple recipients. As I stated in my previous posts I can
> > get PGP 2.6.x to do everything 5.5 does with a couple of scripts.
> 
> Yes, but as Adam says, the average Mr. Windows can not. In any case,
> this is not a narrow technical argument. Of course any system with
> multiple recipients can be turned into GAKware. The point is that we
> don't want to make it ANY easier for anyone to do so.

Agree.  What I am proposing is to make GAK enabled systems
non-interoperable with the OpenPGP standard on the sending end (ie to
define that when you receive a message it won't dictate to you that
you should use GAK compliancy, and to define that if flags indicating
message snooping is ocurring this won't be enforced by your mail being
bounced if you don't, and won't be implemented with encrypting to a
special snooping crypto recipient).  What PGP is proposing with PGP
5.5 is to implement enforcement on end users to send to GAK (or
corporate snooping) enabled keys using the snooping key.

They claim that it's ok, because the user is empowered, as he can
override the sending to the snooping key.  But, if you enable the
sender of a message you receive to state (in syntax defined as part of
the OpenPGP standard, or even if it is not) that if you don't encrypt
to this corporate snooping key (or technically equivalent
functionality: government GAKking key) the message will bounce, how is
this user empowerment, or choice in any meaningful way.  How is this
user empowered to choose when 80% of businesses end up using this
feature?  Or when the government mandates this feature.

> > No this is not mandatory GAK compliance. Mandatory GAK compliance would be
> > if every copy of PGP came with a government key and the program *forced*
> > the user to encrypt all his messages with it.
> 
> Again, as Adam says, how long would it take for a government to
> introduce legislation making this mandatory once PGP 5.5-type systems
> took off? Or, more insiduously, using its purchasing power - "Federal
> agencies will only buy CAK-enabled systems" - to ensure the vast
> majority of systems did so.

Bingo!

> > Ok Adam here is a challenge for you:
> > 
> > -- Explain why Corporations do not have the right to access *their*
> > documents in whatever form they may be in.
> 
> Can I take this one up ;-) 

You beat me to it ... my reply crossed in the mail :-)

> The point is, with *communication* keys, corporations will have full
> access to the plaintext because it will be decrypted by the
> recipient as soon as it arrives. I appreciate your point about
> corporations being able to read *their* documents - although doing
> so by snooping, without the sender's knowledge, is rather unethical
> to say the least - but I don't think they have the right to snoop on
> all *incoming* communications, whoever they may be from. This is the
> really scary part of PGP 5.5...

Even if you do argue that they do have the right to snoop incoming
messages (and there may be a case for this even if some of us find it
a bit little brotherish), this can still be just as easily catered
for, without building GAK compliance into the IETF OpenPGP standard by
having the user's client software decrypt and store their mail folder
in plain text, or encrypted to a company escrowed storage key.

Such a system would not be at all GAK compliant.

> William Simpson wrote:
> 
> > Let us decide _what_ the goals are, _how_ to solve the problems, and
> > _then_ decide the protocol details and formats to match the solution.
> 
> Absolutely. Can we start with Adam and William's proposal that we should
> have three separate types of key: communication, signature, and storage.

(I am glad that you managed to persuade William that this was
necessary, I didn't notice him agree :-) William should however be
credited for the useful contribution that you can just as easily
implement corporate snooping with the existing multiple crypto
recipients functions of pgp2.x.  (Without the GAK compliancy baggage).

> This would be very simple to implement; probably the easiest and most
> backward-compatible way would be to define a new packet type specifying
> a key's usage. 

I'll go for this idea.  X509 v3 certificates have such an extension,
and it seems like a very useful functionality for OpenPGP to include.

Re. the argument about separating key functionality leading to more
consistent and secure designs, if people don't like 3 keys, you should
see some of the Norwegian standards stuff which was relayed to me at a
eurpean medical messaging standarisation meeting... they reportedly
have 5 key usages defined:

  1. storage
  2. signatures
  3. encryption
  4. certificates
  5. authentication

> > Why have a communication enforcement filter, when the only usage is
> > supposed to be for recovering archival storage?
> 
> Absolutely. I can see the point, and appreciate the difficulties faced
> by PGP Inc., in most of the CAK features of PGP 5.5. But I just can
> *not* see how the twisted idea of the SMTP snooper ever came about.

It came about I suspect because the real unstated feature they are
trying to implement is message snooping, and not stored email folder
access as the "data recovery" badge used by Jon in his first post may
lead one to assume.  Of course the reason they think they are able to
use the argument that "email is both storage and communications" to
justify this is largely because they haven't yet digested the meme
that you should have separate storage keys.

I also heartily agree with William Allen Simpson's comments.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: 



> The last thing that really, really bugs me is the hostility that's directed
> towards PGP Inc. because now we're an Inc.

There is no hostility towards PGP, Inc.  It is just that many people
think your software contains a feature which has very bad consequences.
Incidentally, I heard a speech by Phil Zimmermann the day before PGP
5.5 was released.  He expressed deep concerns about key escrow,
epxressly including PGP products.  Think about it.

Personally, I think a corporation has the right to access their
employees' business communications, so as long as private messages
remain private, there CAK is no big problem (not that it is exactly
useful, either).  However, when you claim that you are reacting to
to non-existant public safety concerns, I wonder what the real agenda
is.

It is also surprising that you fail to recognize the difference
between communications keys and storage keys.






From admax at elan-vital.com  Sat Oct 11 21:04:52 1997
From: admax at elan-vital.com (admax at elan-vital.com)
Date: Sat, 11 Oct 1997 21:04:52 -0700 (PDT)
Subject: Home Sweet Home!
Message-ID: <199710120404.VAA04338@toad.com>


Hi,

I was wondering if you would like a FREEoverview of
a home business which can bring you both PERSONAL
and FINANCIAL FREEDOM.  If so, please reply with the 
word "freedom" in the subject header and I will send it right away.

Sincerely,

Dan Askew
"Free at Home"
Home Business Owner
801-325-5204

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
We belong to the Direct Email Advertisers Association and the On-line
Marketers Association.  Both of these organizations promote professional and
responsible use of email marketing. If you need bulk email services, accounts,
resources, flame-proof emailing, or any of a host of services,  go to:
http://www.thehitman.com  Type "askew" in the "who referred you" field.

P.S. Should you prefer not to receive notices, please
reply with the word "remove" in the subect header. Thank you.






From ravage at ssz.com  Sat Oct 11 06:49:41 1997
From: ravage at ssz.com (Jim Choate)
Date: Sat, 11 Oct 1997 21:49:41 +0800
Subject: Foreign Terrorist List (fwd)
Message-ID: <199710111358.IAA26517@einstein.ssz.com>



Forwarded message:
>From owner-travel-advisories at stolaf.edu Sat Oct 11 04:19:58 1997
Date: Thu, 9 Oct 1997 11:00:03 -0400
From: owner-travel-advisories 
Subject: Foreign Terrorist List
Sender: Wally Doerge <76702.1202 at compuserve.com>
To: travel-advisories at stolaf.edu
Message-ID: <199710091103_MC2-235E-2001 at compuserve.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Precedence: bulk

STATE DEPARTMENT TRAVEL INFORMATION - Foreign Terrorist List
============================================================
Publication of List of Foreign Terrorist Organizations - Public 
Announcement
 October 8, 1997

 U.S. DEPARTMENT OF STATE
 Office of the Spokesman

The Secretary of State has designated as foreign terrorist 
organizations thirty organizations that engage in terrorist activity 
that threatens the security of United States nationals or the 
national security of the United States, pursuant to the 
Anti-Terrorism and Effective Death Penalty Act of 1996 (P.L. 
104-132).  Designation as a foreign terrorist organization carries 
legal consequences for persons who aid these organizations, for the 
organizations funds, and for representatives and members who seek 
to enter the United States.  The list of foreign terrorist 
organizations was published in the Federal Register on October 8, 
1997.

The Department of State has no specific information regarding 
threats to U.S. citizens at this time as a result of the designation 
of foreign terrorist organizations, but believes some of the groups 
may consider changing their attitude toward targeting U.S. interests 
in reaction to their designation.  American citizens traveling 
abroad should always seek to minimize their risks by being aware of 
their surroundings and exercising caution as to their activities.  
U.S. citizens planning to travel abroad should consult the 
Department of State's country-specific Travel Warnings, Consular 
Information Sheets, and regional travel brochures.

This Public Announcement expires on January 8, 1998.

----- ----- ----- ----- ----- ----- ----- ----- ----- ----- ----- ----- -----
The "travel-advisories at stolaf.edu" mailing list is the official Internet and
BITNET distribution point for the U.S. State Department Travel Warnings and
Consular Information Sheets.  To unsubscribe, send a message containing the
word "unsubscribe" to:	travel-advisories-request at stolaf.edu

Archives of past "travel-advisories" postings are available at the URL:
"http://www.stolaf.edu/network/travel-advisories.html" or via Gopher:
gopher.stolaf.edu, Internet Resources/US-State-Department-Travel-Advisories






From aba at dcs.ex.ac.uk  Sat Oct 11 06:49:44 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sat, 11 Oct 1997 21:49:44 +0800
Subject: r.e. OpenPGP document status
In-Reply-To: <3.0.3.32.19971011053745.00727b78@pop.pn.com>
Message-ID: <199710111234.NAA02880@server.test.net>




Rodney Thayer  writes:
> The message formats draft(s) are being worked on now.  We've only
> had official WG status for something like two weeks.  A little
> patience is in order, I think.

PGP Inc is the group being impatient.  They have been rushing ahead
implementing things behind closed doors which some of us are arguing
should be made non-conforming (WILL NOTs) in the standard.

If PGP doesn't backoff a bit _they'll_ have non-conforming
implementations, and will have to change them.  The danger is that in
a Netscape-like manner, they will use their implementation and
deployment as arguments to justfiy their design decisions rather than
being involved in open design decision justifications as part of the
standardisation process.

This is not how the IETF standardisation process is supposed to work.
Trial implementation of proposals is fine, closed door design and
sudden deployment and mass sale by the market dominator to pre-empt
standardisation I think is not.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



Hi,

Another good souce of references for programming the PC architecture across
the full range of processors and system extensions (ie PCMCIA) is the 'PC
Systems Architecture Series' of books put out by Addison-Wesley for
MindShare, Inc. Mindshare also has various training courses and seminars.
If interested (I am in no connected to them nor do I receive any $'s from
them):

BBS: 214-705-9604
mindshar at interserv.com
CompuServe: 72507,1054


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http:// www.ssz.com/  |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From tcm at dev.null  Sat Oct 11 09:12:32 1997
From: tcm at dev.null (Tim C. McVeigh)
Date: Sun, 12 Oct 1997 00:12:32 +0800
Subject: Nuke Denver!
Message-ID: <343F9F3A.6FAF@dev.null>



http://www.hoffman-info.com/essay7.html

The Show Trial of the Manchurian Candidate Has Concluded According to
the Script

The masterfully choreographed show trial of Manchurian candidate Tim
McVeigh has concluded
according to the script, thanks to a government-mouthpiece "news media,"
a suborned jury, a
crooked Federal judge and an incompetent (or perhaps worse) "defense"
team. Part of the script
has been McVeigh's tendency toward self-incrimination:

Immediately after the bombing of the Federal building, as TeamInfinity
notes, McVeigh did
"everything but send up a flare to draw attention to himself... speeding
out of the state of Oklahoma
at almost 100 mph in a yellow car with no license plate, virtually
guaranteeing that he would be
stopped...Timothy McVeigh is a highly trained combat NCO who won a
Bronze Star for courage
under fire in the Gulf. Having been stopped by a state trooper, being
armed with a pistol, and
knowing that he now faced either execution or imprisonment for the rest
of his natural life, why did
McVeigh make no move at all to defend himself or escape, instead
surrendering like a little lamb?"

>From his arrest onward, Mr. McVeigh has filled the same role as Sirhan
Sirhan, James Earl Ray,
Arthur Bremer (George Wallace's assailant), Charles Manson and David
Berkowitz: he has failed to
contradict, in the course of the investigation preceding his conviction,
the tale the government wove
around him. If McVeigh continues to fulfill the pattern, after the klieg
lights have been turned off and
the national spotlight is dimmed, when he becomes a convict on death
row, rather than a defendant
in the trial of the year, he will begin to chirp certain truths that the
script decreed would not be
emitted during the "trial." The credibility of those revelations will be
greatly reduced since they will
be written off by the media as "jail-house conspiracy theories by a
desperate death-row inmate."
The same pattern emerged with "Son of Sam" David Berkowitz, another
mind-controlled patsy who
only divulged truthful details concerning his co-conspirators and the
other shooters, after he was
entombed in Attica prison with a sentence of 300 years. A similar
pattern may be observed in the
passive behavior of Ted Kaczynski, the alleged "Unabomber," who I also
believe to be a
mind-controlled scapegoat. --Michael A. Hoffman II Copyright�1997.







From zog at dev.null  Sat Oct 11 09:22:18 1997
From: zog at dev.null (ZOG)
Date: Sun, 12 Oct 1997 00:22:18 +0800
Subject: Information Warfare
Message-ID: <343FA1B1.4575@dev.null>



    The Campaign for Radical Truth in History http://www.hoffman-info.com

         PO Box 849, Coeur d'Alene, Idaho 83816 .Visit our Bookstore

 ZOG Advances Control over Information with Clinton's Executive Order 13010
                          for "Information Warfare"

        by Michael A. Hoffman II Copyright�1997. All Rights Reserved

Excerpt: "Managing the new risks inherent in an information-based society
requires a different type of information exchange within the industry and
between industry and government...Key to its success will be protecting the
privileged information from both government and the private sector from
unauthorized disclosure."

      -- Robert T. Marsh, Chairman, President's Commission on Critical
                          Infrastructure Protection

The Zionist Occupation Government (ZOG) further advanced Communist-like
controls over American infrastructure, and underscored the cooperation
between the Communist and Capitalist mentalities, when U.S. President Bill
Clinton, with virutally no scrutiny from the Establishment news media,
signed totalitarian Executive Order 13010 last July (1997).

This Order established a new wing of the secret, banker-controlled
government of the United States. While Clinton's Executive Order itself is
written in the lingo of the bureaucrat and hence is largely insipid, its
"fruits" are not.

Executive Order 13010 is concerned with cyberspace "threats" to the power
structure; with computer hackers who have the ability to interefere with
government, business and industry operations. Well, that's the cover story
anyway. In practice, the Executive Order authorizes a commission of bankers,
industrialists and secret policemen (and police women) to gather
intelligence on dissidents, government critics and anyone who is a potential
threat to the continuing hegemony of the Aryan-Zionist ruling class.

Here is a portion of the remarks delivered at a meeting (chaired by Janet
"The Witch of Waco" Reno), by Robert T. Marsh, Chairman, President's
Commission on Critical Infrastructure Protection, at the Bankers Roundtable,
Washington, DC on September 11, 1997:

"One of our toughest problems -- across all infrastructures -- is the
sharing of information. There is already a heavy volume of information
passed by industry -- especially banks, as you well know -- to government as
part of the regulatory process and through law enforcement.

"Managing the new risks inherent in an information-based society requires a
different type of information exchange within the industry and between
industry and government. Furthermore, managing these new risks calls for
partnership at many different levels, from policy-making aimed at preventing
a crisis to responding if such a crisis occurs. The Commission has some
specific proposals in this regard:

"We will recommend the establishment of an Information Sharing, Analysis,
and Warning "Organization" -- a public-private organization that embodies
the trust essential for the partnership between government and the
owners/operators for successful infrastructure assurance.

"We envision an 'information clearinghouse' staffed by up-and-comers from
both government and industry who will receive relevant information from all
sources -- public and private, anonymous or attributable -- analyze this
information to assess what is happening in the infrastructures, decide on
the necessary protective measures to be taken, then disseminate needed
information to both government and the private sector. Key to its success
will be protecting the privileged information from both government and the
private sector from unauthorized disclosure.

"Would you be willing to take turns providing a talented young banker from
your company to represent the banking and finance sector inside such an
organization?

"Enhance industry's information sharing capability by creating Sector
Information Assurance Coordinators that best suit each infrastructure's
information-sharing needs -- either through an existing association or by
creating a new entity. In essence, we are proposing that each industry
designate a representative to be the channel for exchanging information with
the government. Your reaction?

"Create a National Infrastructure Assurance Council -- a very high level
council comprised of senior CEOs from throughout the critical
infrastructures, meeting regularly with selected Cabinet Officers...

"These recommendations lay the foundation for the 'trusted environment' to
achieving the public-private partnership essential for protection into the
next century."

What we are seeing here is the establishment of a thought police agency
within the Federal government with links to law enforcement, concealed under
weasel words such as "Information Clearinghouse" and "Sector Information
Assurance." This recalls the Pentagon term for the slaughter of Iraqi
civilians by the U.S. Air Force-- "collateral damage."

Dr. Goebbels at least had the relative honesty to call his agency the
Ministry of Propaganda. The Zionist Occupation Government refers to their
propaganda and secret police functions with the bland title of "National
Information Assurance Council." They're not propagandists, they're "Sector
Information Assurance Coordinators."

Mr. Marsh's reference to the gathering of "anonymous" information is of
interest. Here is the keystone of all totalitarian powers--the anonymous
snitch who turns in the hated old lady next door as a witch only because he
can do so without attribution. Our Anglo-Saxon Common Law requires two
witnesses and the U.S. Constitution insures the right to face one's
accusers, but ZOG is operating on other principles. Chairman Marsh:

"The objective is to achieve voluntary participation of all players within
each infrastructure and to assemble and exchange information without fear of
attribution to specific sources."

That is the chairman of a government commission speaking. This is not
conspiracy theory. These remarks are on the record. They constitute the
Revelation of the Method (cf. my book, "Secret Societies and Psychological
Warfare").

The System is becoming increasingly vulnerable, especially the banking
system which is the biggest con-game of all, since it is based entirely on
the confidence of the public in a commodity which in itself has zero
value--paper notes referred to as "money." Wealth is created and dynastic
families within the Aryan-Zionist ruling class are maintained, by the
circulation or withdrawal of worthless Federal Reserve paper to which the
public is taught to attribute value.

In a similar fashion, the worthless mandates and orders of the Federal
government, promoting a gigantic military-industrial complex in the service
of War-Zionism and the Novus Odo Seclorum of Satan, sodomy and aborticide,
are advanced almost entirely through the value of the fear and awe the
public is taught to have for the Federal government.

As both our funny-money and our funny-government become more and more
obviously worthless in the eyes of even some of the masses of goyim, the
confidence game can no longer be manintained on the basis of psychological
warfare principles alone. The risk factor inherent in the System's "Truth or
Consequences" gambit (discussed at length in my book) has reached the point
where the risk must be "managed" by the function of cyber police.

This is what Clinton's Executive Order 13010 establishes-- a gigiantic
listening post for the secret police through the auspices of business and
industry. Banks having been informing on their customers for years--since
the administration of Ronald ("Super Patriot") Reagan who rubber-stamped the
most onerous bank-reporting rules in our nation's history. Chairman Marsh
admits this:

"There is already a heavy volume of information passed by industry --
especially banks, as you well know--to government as part of the regulatory
process and through law enforcement."

Now the "turn in your neighbor" ethic of the banks is being mandated for all
levels of U.S. commerce through the recruitment, in Mr. Marsh's words, of
"elite CEOS."

The whole point is to shore up flagging confidence in the Federal
government's con-game, as Marsh admits:

"Both the financial service industry and government require strong public
confidence -- the industry in order to derive growth, and the government in
order to derive political viability. Each is central to the daily lives of
virtually every American, and the degree of trust the public is willing to
place in them depends directly on the reliability of the services provided.
Infrastructure, as the carrier of the communications and transactions which
deliver those services, is, therefore, critical to the performance of both.
With the retention of public confidence as a common bond, how might the
industry and government better cooperate to assure that critical financial
services are secured in the information age?"

The chairman of the President's Commission on Critical Infrastructure
Protection is saying that bankers have an interest in deceiving the people
just as government has. The bankers' interest is in continuing to reap
profits and the government's interest is to maintain itself in power against
populist opposition forces.

Chariman Marsh says that the public will only continue to be deceived
("trust"), if the shylocks can keep the game running smoothly. Of course,
that's quite a hat trick in view of the fact that the public is becoming
increasingly aware that the objective of ZOG's game is their own
enslavement. The focus of ZOG in this regard is the "information age."

ZOG's desire is to redouble their spying on us and to further
institutionalize that spying at all sectors of business and commerce and
then link it to the secret police ("law enforcement") for various sorts of
economic, political and career reprisals and penal sanctions.

Here is Mr. Marsh, this time in a speech to the New York Federal Reserve
bankers, September 24, 1997 on what they fear most:

"But, as you well know, major trends of change -- globalization, industry
restructuring, Internet banking, and cyber cash --combine to create new
risks. This is true within the financial services industry as well as the
telecommunications and electric power industries upon which financial
services heavily depend...it is the vulnerability to a possible coordinated
attack on physical operations centers, or on the complex 'system of systems'
which enables this industry to function world-wide, that is of rising
concern."

Marsh before a meeting of Harvard University's John F. Kennedy School of
Government, Sept. 20, 1997, speaking about "illegal" government activity in
connection with "information warfare":

"Let me talk briefly about a recent Joint Staff exercise with which some of
you are probably familiar. This was just one in a series of no-notice
exercises, but this one focused specifically on information warfare. Some of
the issues raised were quite troubling -- including the fact that the Joint
Staff ended up fighting this war, which was not only bad but illegal. They
include many of the questions that the Commission has been grappling with
for the past year: Who should take the lead in responding to a cyber attack
on the United States? Should there be a Commander In Chief for information
warfare? Where are the borders in the cyber age? What are the jurisdictions?
Is this a law enforcement or a defense problem?"

Chairman Robert Marsh's ties are to the military-industrial complex. He is
the former CEO of Morton-Thiokol Corporation, a notorious polluter and
builder of components for nuclear warhead-laden missiles. Mr. Marsh
currently is a trustee of the MITRE Corporation.

According to investigative reporter Stephen Knight in his book, "Jack the
Ripper: The Final Solution," London's Mitre Square was a dumping ground for
the Ripper's victims. Knight states: "Mitre Square has strong Masonic
significance. In fact it is fair to say it was the most Masonic of all
places in London, except for the Great Hall of the Grand Lodge itself."
(London: Grafton Books, 1977, p. 175). I am not here implying that Mr. Marsh
is necessarily a murderer or in league with Jack the Ripper, only that his
relationship with the Mitre name is a synchronicity worth noting. (For the
significance of "synchronicity" to the ruling class cf. the predictive
modeling of the commodities markets and the "catastrophe theory" studies of
Prof. Christopher Zeeman of Warwick University).

Stephen D. Mitchell of the US Justice Dept. is a member of the Marsh
commission. Here he discusses the "insider threat"--the fear the government
has of patriots and dissidents being hired in "critical infastructure" areas
such as banks and of how to screen these "insiders" out of employment. He
also expresses the government's frustration with state privacy laws:

"Privacy is trickier. Our outreach revealed a degree of frustration among
infrastructure owners and operators, some of whom wanted to take greater
employee security precautions than some laws might otherwise allow....The
importance of individual privacy has made obtaining background information
on a potential or current employee a fertile area for strong state laws.
Though grounded in best intentions, this has resulted in unpredictable
disparities of approaches across state lines. The bottom line: a critical
infrastructure owner and operator may in some instances be discouraged if
not prevented from asking many of the types of questions that could help
identify and prevent a growing insider threat to our infrastructures."
--Department of Defense, Worldwide Anti-Terrorism Conference, Aug. 21, 1997.

Other members of the President's Commission on Critical Infrastructure
Protection:

Merritt Adams, ATT Corporation. Richard P. Case, IBM. Dr. Mary Culnan,
Georgetown University. Peter Daly, U.S. Treasury. John C. Davis, National
Security Agency. Brenton Greene, Dept. of Defense. William B. Joyce, CIA.
Stephan D. Mitchell, Dept. of Justice. Irwin Pikus, Dept. of Commerce. John
R. Powers, FEMA. Susan Siemans, FBI. Frederic Struble, Board of Governors,
Federal Reserve bank. Nancy Wong, Pacific Gas and Electric.

Relevant Links:

President's Commission on Critical Infrastructure Protection:

http://www.pccip.gov/index.html

Executive Order 13010: http://www.pccip.gov/eo13010.html

----------------------------------------------------------------------------

                 archives / bookstore / news bureau / home







From nobody at REPLAY.COM  Sat Oct 11 09:45:06 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 12 Oct 1997 00:45:06 +0800
Subject: Information Warfare
Message-ID: <199710111634.SAA19572@basement.replay.com>



ZOG translated from the Talmud:
> Stephen D. Mitchell of the US Justice Dept. is a member of the Marsh
> commission. Here he discusses the "insider threat"--the fear the government
> has of patriots and dissidents being hired in "critical infastructure" areas
> such as banks and of how to screen these "insiders" out of employment. 

  Too late...

> He also expresses the government's frustration with state privacy laws:
> "Privacy is trickier. Our outreach revealed a degree of frustration among
> infrastructure owners and operators, some of whom wanted to take greater
> employee security precautions than some laws might otherwise allow....

  Yep, Corporate America is crying out for GAK and the right to keep
their
employees interned in Government Work Camps.

> The bottom line: a critical
> infrastructure owner and operator may in some instances be discouraged if
> not prevented from asking many of the types of questions that could help
> identify and prevent a growing insider threat to our infrastructures."

  "Before I send you for your drug-test and prostrate exam, I'm going to
need to know your bra/condom size."

> --Department of Defense, Worldwide Anti-Terrorism Conference, Aug. 21, 1997.

  Shit! I thought I was at the Cypherpunks physical meeting.
  I mean, Kent Crispin and Hallam-Baker were there...
  Say, you don't think...

YellowWireMonger






From tcmay at got.net  Sat Oct 11 10:28:18 1997
From: tcmay at got.net (Tim May)
Date: Sun, 12 Oct 1997 01:28:18 +0800
Subject: Building the Surveillance State
Message-ID: 



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I predict that nearly every company which enforces the PGP 5.5 corporate
snoopware will in fact routinely convert every incoming and outgoing
message to plaintext for searching by keywords, topics, etc.

This would be analogous to every phone call, incoming and outgoing, being
recorded. Except that instead of having security people _listen_ to each
recording, the messages can be glanced at quickly, marked for further
review, compiled into dossiers, or searched for the keywords of interest to
the security people.

(Please note that I am not saying such phone call or e-mail monitoring is
illegal, or should be illegal. A property owner is free to define his own
policies for how he uses his own property. This includes company phones,
company computers, and even the time of employees while they are on his
premises. The issues are not the legality or ethicality of such recordings
and monitorings, but the dangers. And whether people such as ourselves
should help build or deploy such surveillance capabilitities. Or work for
companies with such surveillance policies.)

I further predict that this will actually _increase_ the amount of e-mail
surveillance being done. Whereas today it is of course easy for companies
to surveil unencrypted employee mail, I doubt that most of them do. But the
adoption of snoopware like PGP 5.5 will raise the consciousness of company
security people. "Hmmhh, maybe we ought to buy some of those e-mail keyword
analyzers and combine them with our new purchase of PGP 5.5? If our
employees are encrypting, we'd better keep tabs on them."

By building in such easily-enforceable snooping capabilities, and by
building in such things as the ability to reject even _incoming_ e-mail
which has failed to encrypt to the corporate key (as I understand the
product), this greatly moves us toward a surveillance era.

Is this what "Pretty Good Privacy" really stands for?

- --Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
- ---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."



-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBND+11FK3AvrfAt9qEQKOZQCdFRS6Ogl3da7TDFxmFF7E9kE16RsAoPaG
iFjXzww6H5c1no3iYGvL6BGD
=wt4J
-----END PGP SIGNATURE-----






From alan at ctrl-alt-del.com  Sat Oct 11 10:48:04 1997
From: alan at ctrl-alt-del.com (Alan)
Date: Sun, 12 Oct 1997 01:48:04 +0800
Subject: Building the Surveillance State
In-Reply-To: 
Message-ID: <3.0.3.32.19971011104004.03eec138@ctrl-alt-del.com>



At 10:22 AM 10/11/97 -0700, Tim May wrote:
>
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>I predict that nearly every company which enforces the PGP 5.5 corporate
>snoopware will in fact routinely convert every incoming and outgoing
>message to plaintext for searching by keywords, topics, etc.
>
>This would be analogous to every phone call, incoming and outgoing, being
>recorded. Except that instead of having security people _listen_ to each
>recording, the messages can be glanced at quickly, marked for further
>review, compiled into dossiers, or searched for the keywords of interest to
>the security people.
>
>(Please note that I am not saying such phone call or e-mail monitoring is
>illegal, or should be illegal. A property owner is free to define his own
>policies for how he uses his own property. This includes company phones,
>company computers, and even the time of employees while they are on his
>premises. The issues are not the legality or ethicality of such recordings
>and monitorings, but the dangers. And whether people such as ourselves
>should help build or deploy such surveillance capabilitities. Or work for
>companies with such surveillance policies.)
>
>I further predict that this will actually _increase_ the amount of e-mail
>surveillance being done. Whereas today it is of course easy for companies
>to surveil unencrypted employee mail, I doubt that most of them do. But the
>adoption of snoopware like PGP 5.5 will raise the consciousness of company
>security people. "Hmmhh, maybe we ought to buy some of those e-mail keyword
>analyzers and combine them with our new purchase of PGP 5.5? If our
>employees are encrypting, we'd better keep tabs on them."
>
>By building in such easily-enforceable snooping capabilities, and by
>building in such things as the ability to reject even _incoming_ e-mail
>which has failed to encrypt to the corporate key (as I understand the
>product), this greatly moves us toward a surveillance era.
>
>Is this what "Pretty Good Privacy" really stands for?

I seem to remember that it was just this sort of feature set that Phil
Zimmerman was grousing about when ViaCrypt came out with their "Business
Version".  It was used as one of the reasons for his takeover of ViaCrypt.

I guess it shows you just how much influence he has on PGP inc now...

"We have always supported the needs of law enforcement.  We have always
been at war with terrorists and law breakers." - Winston Zimmerman

---
|              "That'll make it hot for them!" - Guy Grand               |
|"The moral PGP Diffie taught Zimmermann unites all| Disclaimer:         |
| mankind free in one-key-steganography-privacy!"  | Ignore the man      |
|`finger -l alano at teleport.com` for PGP 2.6.2 key  | behind the keyboard.|
|         http://www.ctrl-alt-del.com/~alan/       |alan at ctrl-alt-del.com|






From tcmay at got.net  Sat Oct 11 11:03:26 1997
From: tcmay at got.net (Tim May)
Date: Sun, 12 Oct 1997 02:03:26 +0800
Subject: More dangers of corporate snoopware
Message-ID: 




Suppose I want to send a private message to Andy Grove at Intel.  With
current systems, I would encrypt to his public key and send it to him. Only
he, or those with access to his private key, could read the message.

But suppose CAK becomes common, and suppose Intel has adopted PGP 5.5.

I presume I have to also encrypt to Intel's corporate key...or one of them.
(I assume different users in different departments may have different CAK
keys.)

So, who can read my message besides Andy? The Security Operations
department? The Key Compliance Officer? Or, perhaps, only those _higher_
than Andy Grove, e.g., no one.

And suppose I send a communication to a lower-level person? How many
higher-level persons will be able to read the message?

Will companies really accept that lower-level security people will have
access to the communications about business deals, technology deals, etc.?
The prospects for abuse are obvious.

Or will there be provisions for overriding the PGP 5.5 snoopware features?
Will it become a status symbol to have reached the level of trust where
one's private e-mail is not subject to snoopware encryption?

I suppose it's up to companies to figure out all of these troublesome
issues. I just hope the architecture of PGP 5.5 is pliable enough to allow
the market to decide which options to turn on, which to turn off, and which
to take out completely.

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From emc at wire.insync.net  Sat Oct 11 11:38:03 1997
From: emc at wire.insync.net (Eric Cordian)
Date: Sun, 12 Oct 1997 02:38:03 +0800
Subject: Citizen Foils Armed Home Invasion
Message-ID: <199710111828.NAA20966@wire.insync.net>



RAINBOW CITY, Ala. (AP) -- Officers who went to a house with a
warrant to search for drugs were met at the door by a couple in
bulletproof vests and a surprise gunfight.
 
A blast from an assault weapon, apparently fired through the
front door, killed Chris McCurley, 46, the recently appointed
chief of Etowah Country's drug task force, authorities said.
 
Etowah County Sheriff James Hayes said a man and woman came to
the door wearing bulletproof vests when law officers arrived
Friday at their new house in a quiet neighborhood near the Coosa
River about 65 miles northeast of Birmingham.
 
After McCurley was shot, the man walked outside and continued
firing, striking three more officers before he was finally shot
down by police hiding behind trees, said Minnie Bellew, who lives
across the street.
 
Ezra George Petersen, 50, was hospitalized with minor gunshot
wounds to his extremities, Hayes said. He was under guard at
Gadsden Regional Medical Center. The woman, Connie Stozzie, 30,
was taken to jail and was on investigative hold.
 
Petersen shot at officers with an AK-47 assault weapon with a
100-round drum of ammunition, Hayes said.
 
Officer Gary Lee Entrekin, 34, was in serious condition with a
gunshot wound to the back, said M.D. Garmon, a spokesman at
Riverview Regional Medical Center in Gadsden.
 
Altoona police officer Khris Yancey, 26, was shot in the back,
but his wounds were not thought to be serious. Reserve officer
Rick Correll, 46, was in fair condition with wounds to an arm and
foot.
 
``The law enforcement community and its supporters will not rest
in this county until Petersen gets what he justly deserves -- and
that's the electric chair,'' Hayes said.
 
Neighbors said the tall, tattooed Petersen was a friendly man
frequently seen riding a motorcycle. He had bought $20 worth of
oranges Wednesday from Mrs. Bellow's grandson, who was selling
fruit for a school fund-raiser.
 
``He was real nice. I talked to him about his motorcycles, all
the stuff he did to them,'' 14-year-old Jake Bellew said.

--
Eric Michael Cordian 0+
O:.T:.O:. Mathematical Munitions Division
"Do What Thou Wilt Shall Be The Whole Of The Law"
 






From alan at ctrl-alt-del.com  Sat Oct 11 11:42:32 1997
From: alan at ctrl-alt-del.com (Alan)
Date: Sun, 12 Oct 1997 02:42:32 +0800
Subject: More dangers of corporate snoopware
In-Reply-To: 
Message-ID: <3.0.3.32.19971011113316.0410dd68@ctrl-alt-del.com>



At 10:56 AM 10/11/97 -0700, Tim May wrote:
>
>
>Suppose I want to send a private message to Andy Grove at Intel.  With
>current systems, I would encrypt to his public key and send it to him. Only
>he, or those with access to his private key, could read the message.
>
>But suppose CAK becomes common, and suppose Intel has adopted PGP 5.5.
>
>I presume I have to also encrypt to Intel's corporate key...or one of them.
>(I assume different users in different departments may have different CAK
>keys.)
>
>So, who can read my message besides Andy? The Security Operations
>department? The Key Compliance Officer? Or, perhaps, only those _higher_
>than Andy Grove, e.g., no one.
>
>And suppose I send a communication to a lower-level person? How many
>higher-level persons will be able to read the message?
>
>Will companies really accept that lower-level security people will have
>access to the communications about business deals, technology deals, etc.?
>The prospects for abuse are obvious.

I wonder how many of them know if their mail can be read now?  Any admin
could just use `less /var/spool/mail/andyg` to read the unencrypted mail
queue. 

>Or will there be provisions for overriding the PGP 5.5 snoopware features?
>Will it become a status symbol to have reached the level of trust where
>one's private e-mail is not subject to snoopware encryption?

There will always be an out for management.  Managers will not like the
idea of someone being able to read their mail, thus, they will make rules
that they do not have to follow.  (People who think that such rules will be
equally enforced have never worked for a big company.) 

But the higher up the corporate ladder, the bigger risk that they will have
more info to sell out to the competition.  

This sort of policy is only to tighten management's grip on the proles, not
solve any real problem within the corporation.  (Kind of like drug testing,
but without all that messy urine.)

>I suppose it's up to companies to figure out all of these troublesome
>issues. I just hope the architecture of PGP 5.5 is pliable enough to allow
>the market to decide which options to turn on, which to turn off, and which
>to take out completely.

But those who will make the rules will not think through those issues.
Those decisions will be made for totally alien reasons.  Control will be a
big one.  Because it is there will be another.  The corporate GAKware
features of 5.5 will be a big thing with the management types who think it
is a good thing to measure workers keystrokes and monitor their precious
bodily fluids.

---
|              "That'll make it hot for them!" - Guy Grand               |
|"The moral PGP Diffie taught Zimmermann unites all| Disclaimer:         |
| mankind free in one-key-steganography-privacy!"  | Ignore the man      |
|`finger -l alano at teleport.com` for PGP 2.6.2 key  | behind the keyboard.|
|         http://www.ctrl-alt-del.com/~alan/       |alan at ctrl-alt-del.com|






From nobody at bureau42.ml.org  Sat Oct 11 12:26:38 1997
From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer)
Date: Sun, 12 Oct 1997 03:26:38 +0800
Subject: No Subject
Message-ID: 



So many things I would have done, but clouds got in the way.







From eric at clever.net  Sat Oct 11 13:41:30 1997
From: eric at clever.net (Cyberdog)
Date: Sun, 12 Oct 1997 04:41:30 +0800
Subject: anonymous informer quality up
Message-ID: 



U.S. News Online
October 20, 1997

Sinister obstruction? Or just incompetence?

...

Thompson staffers were tipped off about the tapes by an anonymous E-mail
message in early September.

Last Wednesday night, almost a month after
the initial tip, a Clinton lawyer called Thompson's committee with a
message that began, "You're not going to believe this, but . . ."







From randerso at ece.eng.wayne.edu  Sat Oct 11 14:03:47 1997
From: randerso at ece.eng.wayne.edu (Ryan Anderson)
Date: Sun, 12 Oct 1997 05:03:47 +0800
Subject: Why Jon Callas keeps picking nits (Re: Why Corporate Message Recovery isn't Key Escrow)
In-Reply-To: <3.0.3.32.19971010145353.00ad9330@mail.pgp.com>
Message-ID: <3.0.2.32.19971011155857.0069ea28@ece.eng.wayne.edu>



-----BEGIN PGP SIGNED MESSAGE-----

At 02:12 AM 10/11/97 +0100, Adam Back wrote:

>You should have 3 types of key:
>
>1. signature keys
>2. transient encryption keys
>3. storage keys

>
>The signature keys you never escrow.  You certify.  If something goes
>wrong you re-issue, release revocation cert, and re-certificate.
>
>The transient encryption keys are for communications, you delete them
>immediately after use.  Yes I'm talking forward secrecy here.  If you
>don't like forward secrecy, well at least don't escrow the encryption
>keys.

Huh?   Okay, PGP uses IDEA for transit keys.  These are encrypted to two 
different PGP public keys.   

These are only used once.  (Well, you make that assumption, but with even a 
decent PRNG it's a reasonably safe assumption)

The signature keys (in the proposed method) are the PGP keys (either RSA or 
DH, it's not important) are the personal keypairs of each person.  The 
company doesn't keep a copy of these.  They can sign with this in an 
unforgable manner.  (Well, in practice I doubt that's true, because I've seen 
very few places that have even mild local-workstation security, but that's 
besides the point)

Is there a problem here?

- From the description Jon gave of the system, you can designate anyone as
the 
other key-id to encrypt to in your signature block.  (Or whatever that part 
of the key is called).  The guy in the next cube, your boss, one company-wide 
key, etc.

So yes, in theory this could be used to implement GAK.  Supposedly in the 
version of PGP in use it's trivial to remove this extra recipient from the 
list of encryption keys.  It's not even needed if you don't have that key on 
your ring.  (From what Jon said)

When you compalin about use of storage keys/communication keys your clouding 
the issue.

The storage keys can be (and probably are in some cases) simply pgp encrypted 
files, as if they were in transit.  I tend to encrypt some files on my hard 
drive with pgp, by encrypting to myself and signing  so that onyl I can 
decrypt them, and I've got record that I did create the archive.  I can see 
this being done in a company to simplify shared storage usage without 
security problems.  Using the multiple recipient option your recovery key-id 
can be used to decrypt these files.  Of course, if they're modified, they 
can't be resigned, so you'd know, but...

This is a *simple* solution that eliminates problems with encrypting hard 
drives, etc. 

Where is the problem with this system?  This is software that (according to 
Jon's claim) at least one company has decided they need for their security, 
and it keeps the number of pass phrases that employees need to memorize at 
one - their PGP key.

>Storage keys you make damn sure you can recover.  You escrow these for
>real.  Company safe sounds about right.  Secret splitting could be
>nice also.

Why not just encrypt it to yourself with PGP?  Isn't that simpler?  Add a 
recipient of the recovery id.  Boss, coworker, person's key in another 
division, whatever.  Everybody gets different storage keys.  No need to worry 
about accidently compromising one of the storage keys (IDEA symmetric keys, 
of course).  You then just need to keep the secret  halfs of the public keys 
secure.  Not a big deal if you have the rest of the system working.

>You shouldn't be recovering transient messages, you should be
>recovering stored data.

What the hell is the difference?  Speed of recovery?

Give an example of the difference between what he's doing and what you would 
propose. Otherwise you're just rejecting this system blindly.
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQCVAwUBND/agDc3ytqHnNyNAQExygP/fjl70OenYyTLc86OgFNZf5fkM+b3RUxw
WFsYNme/thDSdsnmfTCTTqE63b3ZRoj/mR0jjb4aloXw83TxWuEY9j9sQql8yTBt
SoRQAxPnP33bWlCTbQrOBPFvMw2lyfCrL307mXnfBpnW3h0cngRxjfu7IBBBPzVF
/5TzMK47WBY=
=RLoK
-----END PGP SIGNATURE-----


-----------------------------------------------------------------------
Ryan Anderson -      "Who knows, even the horse might sing" 
Wayne State University - CULMA   "May you live in interesting times.."
randerso at ece.eng.wayne.edu         
PGP Fingerprint - 7E 8E C6 54 96 AC D9 57  E4 F8 AE 9C 10 7E 78 C9
-----------------------------------------------------------------------






From aba at dcs.ex.ac.uk  Sat Oct 11 14:30:05 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sun, 12 Oct 1997 05:30:05 +0800
Subject: PolicyMaker & GAK compliance
In-Reply-To: <199710111842.LAA03434@s20.term1.sb.rain.org>
Message-ID: <199710112123.WAA05223@server.test.net>




Hal Finney  writes:
> Adam Back writes:
> > I would be nice to see the topic of the recipient refusing email based
> > on policies relating to third party access to messages in transit
> > being addressed in the standard when and if PGP gets to that stage.
> >
> > [ecash processing]
> 
> This is a good example of a possible future kind of key assertion.
> Are you confident that you can decide which kinds of recipient refusal
> are morally correct and which kinds are not?

Not automatically, no, I doubt it would work.

> Is it the role of the IETF and the Open-PGP process to make this
> determination?  I would say not.  Rather, we should standardize data
> structures and conventions which allow people to express those
> conditions and assertions which are useful to them.

Yes.  I agree.

> There are a whole range of possible assertions which you might object to:
> 
>  [examples of PolicyMaker style policies]
> 
> You can take these case by case and decide for yourself whether each
> one is acceptable or not by your own standards.  But I don't think it's
> going to be possible to come up with a set of objective rules which will
> decide whether any given assertion is allowed.
> 
> Fundamentally, you are asking to make it illegal for a key to request
> encryption to an additional recipient.  That's what it comes down to.
> You want to forbid this class of assertions.

Yes.  I was getting carried away.  It would be too complex, most
likely.

The thrust of your argument seems to be that there would be little use
making pgp 5.5 non-GAK compliant, because PolicyMaker style statements
will be so flexible that they will be GAK compliant anyway.

So, when are PGP starting work on PolicyMaker?  Is it intended to
introduce this functionality in this first round standardisation?  It
seems to me that adding PolicyMaker functionality could take some
considerable time due to the huge complexity of the task.


Also, just because GAK compliance will become possible if and when
PolicyMaker style extensions are implemented, doesn't mean that PGP
can expect popular support for actually going ahead and implementing
GAK compliancy in pgp5.5; nor can it expect to gain popular support
for the uncharacteristic big brotherish mentality displayed by those
working at PGP in implementing the SMTP policy enforcer behind closed
doors to enforce other people to modify their behaviour to honour
third parties GAK or CAK requests.

I think the whole thing is a huge PR fluff up.  I'm suprised that
those at PGP were all able to agree to do it without arguments being
expressed by employees, and without those arguments leaking out of the
company (given the picture Jon Callas painted of strong privacy and
freedom biases at PGP).  If there had been open discussion of the
product's design prior to development, this feed back could have been
obtained earlier.

I presume the PGP PR person (who ought to get the sack in my opinion)
thought that a sudden press release of such marvelous new feature as
PGP snoopware and a snoopware enforcer for third parties would go down
well.  It doesn't.  The enforcer is rudely enforcing the companise
opinions on people who have no connection with the companies snoopware
policies.  You should keep such matters within the company by using
escrowed storage keys to acheive snoopware.

For these reasons I still argue that we should:

- add storage keys to the standard

   It's more secure to do this.  That should be argument enough in
   itself.  It also is much cleaner separating key functionality out
   into separate keys where those keys have vastly different recovery,
   life time, and security requirements.

- use storage key escrow to implement PGP snoopware instead of burdening
  the OpenPGP standard with the stigma of GAK compliancy

   This method ties in with the use of storage keys.  It is nearly as
   effective a snoopware design.  It also isn't GAK compliant.  It
   also doesn't result in cypherpunks shouting at you.

- don't use the special sub-packet type to flag GAK compliancy

   I think the above shows that the neither the standard, nor PGP Inc
   needs the GAK compliant sub-packet, so scrap it, and save the
   argument up for the much more defensible position of a generalised
   PolicyMaker style  key usage restriction assertions

- scrap the controversial SMTP snoopware policy enforcement app

   Use storage key escrow to implement PGP snoopware instead of
   burdening the OpenPGP standard with the stigma of GAK compliancy


It's difficult to get standards which don't reflect big brotherish
aims when the good reputation of PGP Inc and Phil Zimmermann is
apparently behind it.  Something weird is going on at PGP
headquarters.  PRZ is also silent.  Are all the people at PGP Inc in
accord in thinking that the snoopware policy enforcer is a really cool
pro-privacy app?  Some of the usually more vocal PGPers have remained
silent throughout the entire episode.  Also as Tim note's the lack of
a Zimmermann Telegram (tm) getting suspiciously overdue.  Is he
dragging his feet of snoopware and GAK compliancy?

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0




Now that we're considering (within the IETF OpenPGP standardisation
framework) the prospect of having a separate communications key, and
storage key, there are some aspects of communications keys which are
currently less than ideal because of their current misuse to also
function as storage keys.

This argues for a new functionality to be given to communication only
keys.  This is all tied up with the idea of Perfect Forward Secrecy
(PFS), which is basically the statement of the fact that
communications keys are more sensitive than storage keys, because your
attacker by definition has a copy of the encrypted communication.
(You're sending over an open network where copying all traffic is a
low cost exercise for a savvy system cracker, or spook, or industrial
espionage).  

In contrast an attacker often will have to break into your premises to
obtain the data protected by your storage keys.  Another aditional
vulnerability of communication keys is that the US government is very
interested in obtaining copies of them via their "key escrow"/"key
recovery"/GAK initiative.  The strongest anti-GAK statement you can
make is to use forward secrecy.  I've raised this point before, but
the meme doesn't seem to have penetrated yet.

Hal Finney  wrote:
> Adam mentioned the idea of forward secrecy in email communications.
> I'm not sure how that would work technically, but it sounds like
> an interesting possibility.  

It ties in quite well with what is in my view proper handling of
communication keys.  If we can break the tie with one key being used
for both storage and communication, we can start to reflect in the
protocol better security practice in the handling of communication
keys.

Forward secrecy is one way of looking at it.  It doesn't have to be
real interactive forward secrecy as you might get in an SSH session,
or an SSL session, or some of the IPSEC standards, though these are
other examples which could server as examples showing that forward
secrecy is a good idea, for anyone who would like to argue against it.

The basic principle is that you want to have communication keys which
don't live for a long time.  So one form of weak forward secrecy you
could have would be to mark your El Gamal or RSA communications for
much more frequent update, by giving it a short expiry date.  Say once
per week.

Some people currently do this manually anyway.  For example see Dave
Wagner's web page (www.cs.berkeley.edu/~daw/) where he describes what
he does with keys.  (He has a long term signature only key which he
uses to sign short lived "communication only" keys which he discards
after expiry).  What I am arguing for essentially is building this
kind of improved communication key handling into the OpenPGP spec for
keys marked as "communication only".


In addition I think it would be nice to enable a new kind of
communications key which is based on discrete log so that people who
choose to use PGP protocols for more interactive email transfer
protocols than SMTP can generate keys very quickly.  I was originally
thinking that this would have to be DH, but perhaps you can simulate
DH PFS with El Gamal by securely wiping the private parameters of
expired communications keys, and keeping the public modulus and g
value.  (This has similarities with the quick method in PGP5.x of
generating El Gamal keys with precomputed shipped primes that you
already have).  The advantage being that you may be trying to generate
keys frequently, so you may not want to wait for a full new 4096 bit
El Gamal or 2048 bit RSA key generation, when you are not anticipating
the sudden delay in sending messages.


I was originally thinking it would be done by having a new DH key type
(in addition to RSA, El Gamal, DSA).  

(Incidentally Hal, you may recognise in this the reason for some of my
annoyance that PGP Inc is mislabelling El Gamal as "DH" -- with my
earlier ideas on this proposal there would have been a _real_ DH.  It
also gets around objections to do with not being able to decide what
DH keys are (as they are negotiated not randomly generated directly)
which Hal raised as a reason why PFS (at least with DH) would disallow
functionality where key capabilities are included in the public
communications key encrypted packet, the last time this was discussed.
Clearly you could work around this restriction if you had to -- just
include the information in an extra packet encrypted with the
contained key and some symmetric algoirthm for example, though this
may limit algorithm choice at least for that packet).

You can use PFS in an asynchronous "where possible" mode for
non-interactive email transport situations.  That is you would perhaps
send new communications keys parameters with each message that defines
in it's key sub-packet preferrences that it is capable of using
communications only keys, and will be able to handle "recipients comms
key as part of message".  This might make sense where comms keys are
being updated too quickly to burden a key server with, or where comms
keys are not public (an aditional use for Hal's described no-export
flag for signatures, but here applied to communications keys), but are
specific to that communicating pair. (For paranoid people who are
changing comms keys on each receipt, you would need to do this).

As soon as one party has replied to a mail from the other, you can
switch to forward secrecy.  This would lead to emails such as "hi, can
you reply to this message please".  These are kind of similar to the
"hi can you send me your public key" you get back from people when you
haven't included your public key in your mail to them, and they don't
have access to a keyserver.

You can also then use this new "communications only" key setup to cope
with fully interactive email delivery for systems using email
transports other than standard SMTP.

You should probably overlap sending communications keys if you aren't
relying on keyservers due to frequency of key update, or for
convenience for people without access to keyservers, so that the
person sending you email is less likely to have no current
communications key for you if you are using keys sent in the message.
So towards the end of the month (if you had a policy of using
communications only keys with monthly updates) replacing keys monthly
start sending the next months communications key also, marked as not
for use until it's starting date.

(The use of very transient communications keys I think would imply a
need for two communications keys: you'll need a long term
communications key which is used for initial non-PFS mail in order to
set up PFS.)

With the separation of storage and communications keys all the
architecture has much better security decisions:

- We are able to treat communications with variable amounts of
  sensitivity, by giving different key expiry time periods to comms only
  keys.

- We are also able to secure and escrow our long term data storage in
  mail box folders, or PGP encrypted files without having to live with
  a GAKware compliant implementation of snoopware.  We can storage
  escrow keys appropriately without all the name calling and bad PR
  caused by enraged crypto anarchists, and crypto consultants.

You _know_ it makes sense :-) 

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0


FIVE MINUTES FREE!
Just for you if you're over 18.

http://www.virtualthrills.com

Signup for free and use your free time.







From aba at dcs.ex.ac.uk  Sat Oct 11 16:21:14 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sun, 12 Oct 1997 07:21:14 +0800
Subject: the case for separate comms keys
In-Reply-To: <3.0.2.32.19971011155857.0069ea28@ece.eng.wayne.edu>
Message-ID: <199710112231.XAA05916@server.test.net>




Ryan Anderson  writes on cpunks:
> Adam Back  writes:
> >You should have 3 types of key:
> >
> >1. signature keys
> >2. transient encryption keys
> >3. storage keys
> >
> >The transient encryption keys are for communications, you delete them
> >immediately after use.  Yes I'm talking forward secrecy here.  If you
> >don't like forward secrecy, well at least don't escrow the encryption
> >keys.
> 
> Huh?   Okay, PGP uses IDEA for transit keys.  These are encrypted to two 
> different PGP public keys. [...]  These are only used once.

The security principle I am referring to is that by doing as PGP
currently does, and using encryption keys in place of separate
communications and storage keys you are exposing your past traffic to
undue risk.

I am not at all referring to symmetric keys, because the fact that
they are randomly generated and used once doesn't protect them from
recovery via the compromise of your long encryption key and your
attackers copy of your encrypted communications.  The reason for
randomly generating IDEA session keys is a separate one.

The argument for having separate storage and communication keys is a
similar one to the now accepted argument that it is a good idea to
have separate signature and encryption keys.  The obvious advantage of
separating signature keys from encryption keys (introduced in pgp5) is
that if you escrow keys you don't want to escrow signature keys as all
this enables is forgery.

> The signature keys (in the proposed method) are the PGP keys (either
> RSA or DH, it's not important) are the personal keypairs of each
> person.  The company doesn't keep a copy of these.  They can sign
> with this in an unforgable manner.
> 
> Is there a problem here?

No.  I wasn't discussing signature keys.

> - From the description Jon gave of the system, you can designate
> anyone as the other key-id to encrypt to in your signature block.
> (Or whatever that part of the key is called).  The guy in the next
> cube, your boss, one company-wide key, etc.

Yes.  That's half of the story.  The other half of the story is that
PGP went ahead and implemented a SMTP snoopware policy enforcer which
could just as easily be used to enforce GAK.

> So yes, in theory this could be used to implement GAK.  Supposedly
> in the version of PGP in use it's trivial to remove this extra
> recipient from the list of encryption keys.  

I'm not sure that the fact that the pgp5.0 client doesn't attempt to
force you to use the GAK compliancy key adds much to my comfort level
that the whole thing won't end up being used for mandatory GAK.  My
scepticism is derived from the fact that the enforcement of the GAK
compliancy key is provided by another marvelous PGP Inc big brother
innovation: the SMTP snoopware/GAK compliancy policy enforcement app.

The argument doesn't really become apparent until you consider the
effects of lots of people (say 80% of companies) using PGP's GAK
compliancy enforcement.  A few more thin edge of the wedge moves on
the part of the USG GAK proponents (eg deputising service providers as
GAK compliancy enforcers, something which has already been discussed
in the past with the Clipper series), and you will suddenly be unable
to exchange mail with anyone without using GAK.  Sure you have a
"choice", you can send email to people that will bounce 100% of the
time, whoever you send to due to lack of GAK compliance field.
(Except for perhaps a few die hard cypherpunks).

> It's not even needed if you don't have that key on your ring.  (From
> what Jon said)

I'm not sure what you mean here.

> When you compalin about use of storage keys/communication keys your
> clouding the issue.

It might appear complex, but actually adding the distinction between
communications and storage keys greatly simplifies things, and it
allows you to make more appropriate security decisions about key life
times, and escrow.  It also allows you to implement the message
snooping function in a more secure way, and with less big brotherish
overtones.

Using separate storage keys allows you to:

- escrow storage keys within your company without including GAKware
  compliancy

- discard communications keys often (by giving them short life-spans)
  which greatly enhances your security

> The storage keys can be (and probably are in some cases) simply pgp
> encrypted files, as if they were in transit.  

Storage keys could be symmetric keys if they are for your own use
only, or you could escrow them if you want to share access, or your
company wants the extra assurance of data availability that storage
key escrow brings.  There might be some security advantages to using
symmetric keys even.  (Public key sizes are a faster sliding and more
uncertain target than symmetric key sizes.

> I tend to encrypt some files on my hard drive with pgp, by
> encrypting to myself and signing so that onyl I can decrypt them,
> and I've got record that I did create the archive.

You can sign and encrypt with symmetric keys also. "pgp -cs."  Quite a
useful combination.

I used to do the opposite of what you do... I used to use pgp -cs,
because I explicitly didn't want the public key baggage, and danger
that 1024 bit keys might be readable in 10-20 years, the then maximum
key size.

> I can see this being done in a company to simplify shared storage
> usage without security problems.  Using the multiple recipient
> option your recovery key-id can be used to decrypt these files.  Of
> course, if they're modified, they can't be resigned, so you'd know,
> but...

It's probably simpler to just escrow storage keys.  That is just give
management a copy to put in the fire proof safe.  Or secret split or
whatever.

You could use multiple crypto recipient if you wanted to -- it's
basically just another way of acheiving the same thing.

There is one (quite practical) reason, however, to use symmetric
storage keys.  Speed.  If you're encrypting lots of files (perhaps
using an encrypted parition driver such as Peter Gutmann's SFS), you
won't have time to encrypt to public keys, never mind multiple public
keys.

If the company keeps it's employee's storage keys in escrow, the fact
that you're using a symmetric key works fine.

> This is a *simple* solution that eliminates problems with encrypting
> hard drives, etc.

I don't see that it's any more difficult to do as I outline above,
which is better security practice in any case.

> Where is the problem with this system?  This is software that
> (according to Jon's claim) at least one company has decided they
> need for their security, and it keeps the number of pass phrases
> that employees need to memorize at one - their PGP key.

Don't confuse key functionality with user ergonomics.  PGP or other
vendors could easily implement a unified interface to a secured
private key database containing all of your persistent private keys.
You need only have one key.  Or perhaps no keys -- in a secured
environment, or with keys stored on smart cards.

> >Storage keys you make damn sure you can recover.  You escrow these for
> >real.  Company safe sounds about right.  Secret splitting could be
> >nice also.
> 
> Why not just encrypt it to yourself with PGP?  Isn't that simpler?
> Add a recipient of the recovery id.  Boss, coworker, person's key in
> another division, whatever.  Everybody gets different storage keys.
> No need to worry about accidently compromising one of the storage
> keys (IDEA symmetric keys, of course).  You then just need to keep
> the secret halfs of the public keys secure.  Not a big deal if you
> have the rest of the system working.

I'm not really fussy beyond the fact that it will be less efficient in
space (extra public key packets would be significant for a disk block
level partition encrypter), and the performance issues with using
public key crypto to encrypt lots of files to multiple people. 

> >You shouldn't be recovering transient messages, you should be
> >recovering stored data.
> 
> What the hell is the difference?  Speed of recovery?

Nope speed of recovery is not the issue.

> Give an example of the difference between what he's doing and what
> you would propose. Otherwise you're just rejecting this system
> blindly.

I'm sure I've given these reasons earlier in the thread, but I'll
summarise them again:

1. It is more secure to use short lived communications keys because
communications keys are more sensitive than storage keys.  This is
because with communications your attacker has copies of your
ciphertext as you're sending it over an insecure open communications
medium.  Your storage data is on your hard disk, possibly in a secured
environment.

2. People shouldn't be able to recover the data from communications
because for security reasons it should be encrypted with transient
communication keys.  You are purposelly securely wiping the key after
some period.  Keeping extra doors into the communication weakensn this
protection.

3. given that secured communications are now defined as transient in
nature, for security reaons: the natural way to archive such
communicated data is to re-encrypt it for a storage key.

4. people don't really want access after the fact to their transient
communications, they want access to their archived email.

5. you can still implement corporate snooping, and I acknowledge that
businesses have a right to do this (though personally I may not choose
to work for a company which does this).  But you can implement message
snooping, by implementing key escrow of the storage key used to secure
your email archives.  To enforce this to the extent that you can, you
build in automatic archiving in a way which is hard to defeat in the
mail client to decrypt communication with the comms key, and then
re-encrypt with the escrowed storage key.

6. Given the marked difference in life time, security requirements,
and data availability requirements between stored data and transient
communications keys is it any wonder that you can achieve a more
flexible, more secure system by separating functionality of your keys
-- it really is a very similar argument as to the argument over why
you should have separate storage and communications keys.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0


     Hello!

     If you would like to find out how you can get paid to advertise 
your own product, service or business on the Internet, please reply
to  and type 'info' in the
subject line.

     If this has been sent to you in error, please accept my apology
and reply to the forementioned address and type 'remove' in the 
subject line to be taken off my mailing list. 





From nobody at REPLAY.COM  Sun Oct 12 09:36:13 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 12 Oct 1997 09:36:13 -0700 (PDT)
Subject: No Subject
Message-ID: <199710121636.SAA08699@basement.replay.com>


>Dimitri V*l*s  writes:
>> Apparently a 'bot was installed on toad.com to discard my
>> submissions from the "unedited" list _after my article which
>> prompted the C2net threatening lawyer letter did make it through the
>> "unedited" list (but was censored from the "flames" list by C2Net).
>
>Your claim has some plausibility, I'll grant.  You were already
>singled out for special treatment, in that John Gilmore did
>unsubscribe you, and block you from re-subscribing.  We know that much
>because he admitted it himself.

Some of us use the old-fashioned way:

:0
* ^From.*bwalk.dm.com
   /dev/null

My procmail log has a bunch of /dev/null entries coming from the unedited
Cypherpunks list. Since spam gets tagged and filtered separately, it looks
like they're V*l*s - he's the only one I know of on cpunx-unedited who's
auto-killed by my mail filters without some kind of notification.

I'll look more closely in the future. Not at his posts, but at the log.







From 90953084 at juno.com  Sun Oct 12 10:46:23 1997
From: 90953084 at juno.com (90953084 at juno.com)
Date: Sun, 12 Oct 1997 10:46:23 -0700 (PDT)
Subject: Deliverable Mail
Message-ID: <106422XGY74505@2000nomorehassles.net>



/////////////////////////////////////////////////////////////////
CREDIT CENTER***CREDIT CENTER***CREDIT CENTER***CREDIT CENTER
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
If you received this electronic mailing by mistake, please pardon the
intrusion.

Dear Friend;

Are you or somebody you know experiencing credit problems?  If the
answer is yes, our special offer might be just the cure you have been
looking for.  No longer will you have to live like a second class
citizen due to a bad credit report.  Bad credit can happen due to a
variety of reasons and can happen to anybody.  There is no profile of a
person with credit problems, it can happen to anybody.  In fact, one in
three Americans live with some form of bad credit.  Fortunately, the
United States Government has passed many laws under the Fair Credit
Reporting Act, all of which protect your rights as a consumer.  Our
manuals will show you how to use these Federal Laws to your advantage to
repair your credit, obtain a new credit report or add good credit to
your credit report!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
*****  'THE FRESH START PROGRAM II' (TM) *****

Have you recently been denied credit due to a bad credit report?  Have
you seen your credit report lately?  If your answered yes, then you need
to take advantage of the 'FRESH START PROGRAM II' (TM) NOW!  This manual
is unique in that it shows you how to obtain a brand new Social Security
number which will allow you to open a brand new, fresh credit report. 
Using guidelines set forth by the Social Security Administration, this
easy-to-follow manual will guide you through the steps necessary to
obtaining your new Social Security Number.  Regardless of your present
credit, you can open a new credit file free of ANY judgements,
charge-off's, foreclosures, bankruptcies, bad credit, tax liens's,
garnishments, late pays and inquiries.

////////////////////////////////////////////////////////////////

***** THE 'WorldCard' (TM) INSTANT CREDIT Credit Card *****

This program is very simple.  It extends to you a $5,000 instant line of
credit in the exclusive 'WorldCard' (TM) Wholesale Purchasing Club. 
This credit card comes to you with absolutely NO credit checks!

You will receive the 'WorldCard' (TM) Wholesale Purchasing Club catalogs
with over 5,000 items to choose from.  Jewelry, toys, tools, gift items,
housewares and much more are available.  After your first purchase, each
quarter you will receive updated catalogs with brand new items
available.

You will be required to make a small down-payment with your orders
and then make a monthly payment of 10% of the unpaid balance.  It's just
that simple!  Your good credit with WorldCard will be reported to the
credit bureau's, which will show your excellent credit!

As a special BONUS, if you take advantage of this offer within the next
24 hours, you will be given $200 in cash certificates!  $100 may be used
on the first $300 unpaid balance and the other $100 may be used after
you have charged $600 on your new account.

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

***** 'STOP COLLECTION AGENCIES COLD' (TM) *****

If you have ever experienced the humiliation of a collection agency
calling you at home or at work, then this hard-hitting manual will put
an IMMEDIATE stop to those calls!

Millions of collection agency telephone calls and letters are made or
sent each week to those who owe money.  Consumers have been helpless to
stop the harassment of these predators, UNTIL NOW!

This manual will show you how to put an end to these telephone calls and
letters, INSTANTLY!  At the same time, these collection agencies will be
forbidden to EVER call or write you again!!  This manual has the inside
secrets the credit world does not want you to have!

Gain back your self-esteem and piece-of-mind by ordering 'Stop
Collection Agencies Cold' (TM) TODAY!!!

/////////////////////////////////////////////////////////////////

***** 'THE COMPLETE CREDIT REPAIR KIT' (TM) *****

Good credit empowers you to qualify for personal loans, automobile
loans, business loans, credit cards, home loans and other types of
credit you may apply for at the very best interest rate.  As you know,
if you don't have excellent credit, lenders will NOT extend credit to
you!  The Fair Credit Reporting Act will allow you to legally and
permanently ERASE the negative information on your credit bureau file.

Anything damaging to your credit, such as bankruptcies, judgements, tax
liens, slow pays, repossessions, charge off's, foreclosures, late
payments, student loans and inquiries may be permanently and legally
REMOVED from your credit report!

If bad credit on your credit file is standing in the way of your
achieving the American dream, then order 'The Complete Credit Repair
Kit'(TM) NOW!!!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

IMS
5201 Kingston Pike, Suite 6-216
Knoxville, Tennessee 37919

YES, please rush the manuals checked below:

_____   'The Fresh Start Program II' (TM)         	$34.95

_____   'WorldCard' (TM) Credit Card            	$34.95

_____   'Stop Collection Agencies Cold' (TM)   	 $34.95

_____   'The Complete Credit repair Kit' (TM)   	$34.95

_____   TAKE ALL FOUR (SAVE over $39)   	$99.95


$____________  Sub-Total

$4.95    Shipping & Handling for each manual ordered
$15.00   RUSH Delivery (Optional)

$____________  TOTAL ENCLOSED

I Have Enclosed (Check One):
_____   Cashiers Check
_____   Money Order
_____   Personal Check
_____   FAX ORDER


SHIPPING INFORMATION:

Name:__________________________________________________
Address:________________________________________________
City:_______________________State:________Zip Code:_________
Telephone Number:___________________

Your E-Mail Address (For order confirmation):___________________

////////////////////////////////////////////////////////////////

FREE  -  FREE  -  FREE  -  FREE  -  FREE  -  FREE  -  FREE  -  FREE  

Fax your order within 24 hours and receive a special Kodak film book
entitling you to
100 rolls of Kodak film as well as five 6X10 and ten 4X5 enlargements
FREE!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

Please tape your signed personal check in the space below and fax to
IMS.  The 24 hour facsimile number is 1-423-681-6520.

******************************************************

FAX 1-423-681-6520

Please TAPE Your Check Here

Please SIGN Your Check

******************************************************

THANK YOU For Your Order!!!











From trei at relay-1.ziplink.net  Sat Oct 11 22:08:10 1997
From: trei at relay-1.ziplink.net (Trei Family)
Date: Sun, 12 Oct 1997 13:08:10 +0800
Subject: CMR paves the road to GAK, and provides no corporate security.
Message-ID: <3.0.1.32.19971012005421.007ab570@pop3.ziplink.net>



I've been mulling over PGP5's CMR feature for a while, trying to
decide what I think of it. It hasn't been easy, but I've come down
against it. I'm restricting my discussion to the use of CMR in 
corporate email. I am not addressing stored data.

> Jon Callas (jon at pgp.com) writes:

> There are two things I will discuss in this missive:

> (1) The assertion that Corporate Message Recovery is "just like Clipper"
> and why this is not true.
> (2) The fear a number of people have expressed that Corporate Message
> Recovery (CMR) could be used by the US government to slide in GAK. 

> I think we're agreed that CMR isn't itself GAK and I'll talk some about why
> it isn't with (1).

I think that we're a lot more worried that the presence of features like CMR
will make it easier for governments to mandate GAK. It's much tougher to 
insist on GAK if a switch requires new software to be developed, and
for everyone to purchase, install, and use espionage-enabled software. If
CMR -
like facilities are already in the software, then GAK could be mandated
overnight 
by executive order.

The inclusion of CMR drastically lowers the barriers to mandated GAK.

>CMR isn't like Clipper:

>* Clipper was a 64-bit key. CMR symmetric keys are full-strength keys (128
>bits or more), backed with a full-strength public key.

A word of advice: don't try to discuss Clipper in this forum without checking
your facts. Clipper used an 80 bit key.

> * Clipper's key was set in hardware by the manufacturer, and users were
> required to use it. 

Actually, the chips left the manufacturer 'blank'. They were to have their
unit keys set by some ill-defined process involving government employees.
It never really got nailed down, since Clipper was killed before the
key escrow agencies and systems were ramped up beyond demonstration levels.

> A CMR key is a software-enabled key, no user is ever
> required to use it.

With a CMR feature in place, a government can say "Starting now, encrypt 
to this key or we'll throw you in jail." Without CMR, they can't really do
this.

> There are cases in which a user might "volunteer" to
> use a CMR because they work for someone who requires it, 

[or because the State says it will toss his sorry ass in jail if he
 does not]

> but that's a
> problem we'll address with the PGP Secure Resume Server which allows
> headhunters to securely and anonymously find people who've made bad career
> decisions.

[or bad citizenship decisions?]

> * A CMR key can be revoked, reissued, or changed. You can periodically
> change it as a matter of policy. You can even stop using it. Clipper's was,
> again, set in hardware, with no option of not using it. 

Once again, you're unlikely to do this if the State decides that that would
be a good reason to jail you.

> * The Clipper symmetric algorithm was secret; CMR keys use publicly
> available algorithms.

True, but the point is moot - most people beleive that the NSA is perfectly
competant to write secure symmetric ciphers without outside review, and 
since they had given themselves a backdoor, there was no reason to leave 
the window unlocked as well.

> * With Clipper, there was always a concern that an outside agency had the
> keys. This is true with a number of other systems (the so-called key
> recovery systems), and is the reason that a number of them are lumped
> together with the term GAK. Note that the user-organization creates a CMR
> key, and the end-user enables it. If any government gets access to this
> key, it is because either (1) they solved the Discrete Logarithm Problem,
> (2) they broke the public CMR key, (3) they black-bagged your CMR key, or
> (4) they are using a subpoena, warrant, or discovery to get the key. We're
> working on a way around (1), we can't do anything about (2) or (3), but
> these are fine reasons not to use CMR! If you're beset by (4), you need
> lawyers, not cryptographers.

If the State could do (1), they would not be asking for key recovery in the
first place. (2) and (3), are greatly aided by CMR, since CMR provides 
high value targets; breaking or black-bagging a single key gives you access
to a great deal of traffic, and in the case of (4), you lose 5th Amendment
protection, since a third party holds a key.

> * With Clipper, there was a central repository of all the keys. With CMR,
> there is not. I discussed that in detail in my message, "Why Corporate
> Message Recovery isn't Key Escrow."

Once again, you haven't checked the record. Clipper keys were to be split, 
with different halves going to different government agencies. There were
fairly elaborate plans to prevent posession of only one half giving an
attacker an advantage. Thus there were *two* repositories, not one. 
(From the point of view of the paranoid, this was not much of a
comfort - both repositories belonged to the same entity.)

> I have noticed that a number of people have the tacit assumption that
> business people and corporations are in cahoots with the FBI, waiting to
> hand over everyone's secret key. As in all parts of life, there are many,
> many businesspeople and corporate execs who are not particularly moral. But
> I don't think that their immorality takes this form. If we could examine
> the dark, secret thoughts of a corporate scumwaffle -- the ones that he
> *really* hopes don't hit the papers -- I sincerely doubt that, "Oh, Louis,
> I love it when you rummage my drawers" is among them.

Here's an alternative interpretation. 

I think that 'business people and corporations' feel (with considerable 
justification, I might add) that they have a moral right to control the 
information which flows in and out of their worksites, just as they 
have a right to control to flow of material goods on and off of their 
premises. 

To control the flow of material goods, companies install security systems,
guards, metal detectors, etc. Depending on the type of good and it's value,
these more or less work, though they're never perfect; when the marginal cost
of improving security exceeds the loss that the improvement would prevent, 
you stop adding security. In the extreme case, the diamond workers of Namibia
have to undergo a full-body X-ray whenever they leave the diamond reserve.

Companies would like to be able to able to exercise similar control over data.
However, bits behave differently than do atoms. Physical barriers are almost
perfectly transparent. An employee can slip a multi-gigabyte DAT tape in
a shirt pocket, or transfer stego'd data undetected inside innocent cover
data,
perhaps with non-CMR'd superencryption.

For data, physical barriers - firewalls, passwords, isolated lans, access
controls
encryption, et al, can work more or less effectively to prevent
unauthorized outsiders
from acquiring data they should not. 

However, there is *no* way in which you can prevent a person you have
authorized to
receive data from making whatever use of it they desire, even if those uses
are 
opposed to your reasons for giving them the data.

CMR serves to give corporate executives the illusion that they can control the
uncontrollable. It lets them think they can monitor the expression of their
employess, while they can not. It lets them beleive that they can use
technology
to protect corporate proprietary data from theft by disloyal employees, while 
they can not. The only way to protect data is to make sure that employees 
share the goals and ends of the corporation; ie, give them a reason to be
loyal 
and trustworthy.

Classified agencies know this. In the classified world, there is a huge effort
to protect data from outside attack. There is a similarly intense effort to 
check that only loyal, reliable, trustworthy people get clearances, and 
strong 'need to know' controls to restrict what data even they can see.
However,
once a cleared person has acheived properly authorized access to classified 
data, there is (in my observation) remarkably little done to prevent them 
from deliberately walking off with it.

CMR provides an illusion that this loss can be prevented. It looks good in a
chief security officer's report; it gives warm fuzzies to senior management.
However, it provides no real security. In fact, it actually weakens security, 
since anyone with licit or illicit access to the CMR key(s) can read the data.

> Now then, the next topic is the fear that CMR will be used in some
> insidious government plot to slip in GAK everywhere.

> I worry about this, too. But I don't think it's feasible that CMR can be a
> stalking horse for GAK. If the government wants to GAK-enable all PGP,
> they'll have to have a plan similar to this:

[Strawman GAK plan deleted]

Here's a more realistic scenario.

1. OpenPGP with CMR becomes a standard, and is widely accepted and
installed. PGP gets
rich. (Are you going to claim that this could never happen?)

2. An executive order is signed by the President, ordering that all encrypted 
email include the FBI public key as a recipient. He notes that this will be
no 
burden to industry, since it's a freebie with the industry standard CMR
facility.

To summarize:

1. CMR cannot prevent disloyal employees from sending messages that their
   employers would want to prevent.

2. CMR, widely deployed, would greatly ease a transition to mandated GAK.

Given CMR's inability to provide an a desirable goal (improve corporate
security),
coupled with the severe downside (paving the road to GAK), I have decided that
I must oppose it.

> Jon Callas jon at pgp.com

Peter Trei
trei at ziplink.net






From adam at homeport.org  Sat Oct 11 23:31:44 1997
From: adam at homeport.org (Adam Shostack)
Date: Sun, 12 Oct 1997 14:31:44 +0800
Subject: Internet Via Electric Lines?
In-Reply-To: <199710081351.GAA15055@toad.com>
Message-ID: <199710120611.CAA29682@homeport.org>



At Interop, someone mentioned to me that Nortel has announced a system
for getting 192k over power lines.  Theres a link on their home page,
but its broken.

On another topic, someone asked me about a "new breakthrough in
quantum computing."  Anyone know of an announcement in the last week?

Adam


Peter Trei wrote:
| > To:            cypherpunks at cyberpass.net
| > From:          Jonathan Wienke 
| > I heard on the ABC hourly news that some genius had figured out a way
| > to use electrical power lines for data transmission, so that the power
| > grid could be integrated into the Internet.  Does anyone have any
| > details / pointers?


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume







From aba at dcs.ex.ac.uk  Sun Oct 12 02:57:53 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sun, 12 Oct 1997 17:57:53 +0800
Subject: negative security aspects of GAK compliance
Message-ID: <199710120948.KAA00212@server.test.net>




I think there is a clear technical security case against the GAK
compliant packet, which I would like to see comments on from people
who think the political GAK compliant argument is not significant.

This ties in with using separate storage and communications keys, and
with the better security practice of having shorter lived
communications keys to provide forward secrecy from the point of
issuing new communication keys (could be once per month, once per
week, or once per message).

Once you acknowledge that it is more secure to have short lived
communication keys (which in my view it very clearly is), it should be
clear that by putting a GAK compliancy packet feature, or other second
recipient you are weakening the security because that is another door
into a message which you are trying to make forward secret -- you are
trying to ensure that after the fact, no-one, not even the recipient
can decrypt the old traffic.  (This is a very good way of ensuring
that third parties, like industrial espionage spies, people using
black mail or the Feds using rubber hoses, or supeonas or other legal
or extra legal forms of coercion, can't obtain from you keys to
decrypt it either, so they don't get plain text).  

The fact that the extra door into the message is outside the
recipients control means that his own security could be compromised by
sloppy practice on the part of that key holder.


This argues that if people are to insist on using the enforced second
recipient model for corporate snooping at all, they should for
security reasons be at least using short lived communications keys for
the GAK compliancy packet also.

Or, as I would argue, most secure of all is not using GAK compliancy
packets at all, but rather to use escrowed storage keys to retain
access to mail archives.  This is more secure because you don't keep
second doors into what should be a communication encrypted with as few
as possible (namely: one) transient communications key, with security
policy control being in the hands of the person who owns the key (the
recipient).

As I have pointed corporate access to stored email can be acheived
with similar amounts of snooping enforceability by having the PGP5.5
mail client store to an escrowed communications key after decryption,
or even to re-encrypt after decryption to a long term storage company
archive access bot within the LAN (with such encrypted messages
themselves being wrapped in an extra comms encryption envelope using
short term communications key if you like).


I would be interested to see anyone refute this security argument from
a security point of view.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <3.0.2.32.19971012063205.006e7b34@ece.eng.wayne.edu>



-----BEGIN PGP SIGNED MESSAGE-----

At 11:31 PM 10/11/97 +0100, Adam Back wrote:

>to exchange mail with anyone without using GAK.  Sure you have a
>"choice", you can send email to people that will bounce 100% of the
>time, whoever you send to due to lack of GAK compliance field.
>(Except for perhaps a few die hard cypherpunks).

My reading of Jon's post was that the SMTP policy enforcer only worked for 
outgoing messages.  Perhaps that's wrong, but that needs to be double-
checked.  See below as well...

>> It's not even needed if you don't have that key on your ring.  (From
>> what Jon said)
>
>I'm not sure what you mean here.

The snooping key.  If it doesn't exist on *my* keyring.  (Say I have your 
key, but not the key designate as your snooping key...)  [BTW: Forgive the 
English, I'm tired and speaking in choppy sentences]

If I have your key, but not the other key that I'm also supposed to encrypt 
to, PGP (whichever versions, I'm not entirely sure how the feature set breaks 
down, but I believe this applies to all versions of 5.x)  will not even 
mention that there was another key it would've have offered to encrypt to.

>> When you compalin about use of storage keys/communication keys your
>> clouding the issue.
>
>It might appear complex, but actually adding the distinction between
>communications and storage keys greatly simplifies things, and it
>allows you to make more appropriate security decisions about key life
>times, and escrow.  It also allows you to implement the message
>snooping function in a more secure way, and with less big brotherish
>overtones.
>
>Using separate storage keys allows you to:
>
>- escrow storage keys within your company without including GAKware
>  compliancy
>
>- discard communications keys often (by giving them short life-spans)
>  which greatly enhances your security

Greatly complicating the "web of trust" method, but..  You can only chain 
signatures so far before you run into problems, and getting people to 
continuosly recertify could be a major pain, but I can see the point you are 
making.   It got clearer.


>> The storage keys can be (and probably are in some cases) simply pgp
>> encrypted files, as if they were in transit.  
>
>Storage keys could be symmetric keys if they are for your own use
>only, or you could escrow them if you want to share access, or your
>company wants the extra assurance of data availability that storage
>key escrow brings.  There might be some security advantages to using
>symmetric keys even.  (Public key sizes are a faster sliding and more
>uncertain target than symmetric key sizes.

Well, at least with RSA keys, I believe the memory requirements to handle 
current factoring algorithms are quite untenable for 2048 bit keys.  I think 
768 is out of the range of current systems.  I think this came up on the RC5 
(Bovine) mailing list, and the figures for the required server was something 
absolutely ridiculous.  To distribute the job using the more efficient 
algorithm required machines with 128 meg of ram, but the slower one was a bit 
more doable.

In short, I don't think 2048 RSA keys are reasonable target in the forseeable 
future.  [Remember, Moore's law is only applicable for another 12 years or 
so.  Then quantum mechanics starts to be a serious problems, and electrons 
start switching channels in the chips.]

But this is a bit of a wandering topic now.  Let me continue...

>You can sign and encrypt with symmetric keys also. "pgp -cs."  Quite a
>useful combination.

Hmm.. I must've missed that.  

>I used to do the opposite of what you do... I used to use pgp -cs,
>because I explicitly didn't want the public key baggage, and danger
>that 1024 bit keys might be readable in 10-20 years, the then maximum
>key size.

Well, I wasn't really encrypting anything I really cared about.  It was 
backups of autoexec.bats and config.syss, I just wanted another copy that I 
*knew* when it was made, it wouldn't get overwritten, and it wouldn't get 
modified without me knowing.   And I needed something to use PGP for, so...

In all honesty, the public key baggage is 512 bytes ( I think, possibly bits. 
 I've forgotten now )  Quite insignificant if you're dealing with CAD 
drawings.  The added benefit of reducing passphrase uses is quite significant 
(with current PGP versions, the database of keys is a better idea actually).  
Possibly more portable across a range of users as well.

>> I can see this being done in a company to simplify shared storage
>> usage without security problems.  Using the multiple recipient
>> option your recovery key-id can be used to decrypt these files.  Of
>> course, if they're modified, they can't be resigned, so you'd know,
>> but...
>
>It's probably simpler to just escrow storage keys.  That is just give
>management a copy to put in the fire proof safe.  Or secret split or
>whatever.

I was actually thinking something along the lines of creating a file - 
encrypting it to your whole workgroup, and leaving it on a server.  Now you 
have the advantage of not having any security problems even if the server is 
compromised [without workstation compromise, of course], and all the 
important people can access it.  Of course, the last person to modify it 
resigns it, and it gets dropped into your RCS system.

you get the added advantage of being able to rotate your keys here as well, 
so even if one key is compromised, and the server is compromised, you don't 
lose the whole system.  Identical argument as for communications keys.

>You could use multiple crypto recipient if you wanted to -- it's
>basically just another way of acheiving the same thing.
>
>There is one (quite practical) reason, however, to use symmetric
>storage keys.  Speed.  If you're encrypting lots of files (perhaps
>using an encrypted parition driver such as Peter Gutmann's SFS), you
>won't have time to encrypt to public keys, never mind multiple public
>keys.

That's a different problem.  For that you're [in this ultra-theoretical 
world] probably going to want something along the lines of this:  Symmetric 
encryption for speed on the partition, and that key stored with several 
recipients in the same place as the Secure Partition Driver (SPD).  (This 
falls in the, "If you're going to build a system, make sure you think of 
everythign you want and make sure it fits in the framework somewhere" method)

>If the company keeps it's employee's storage keys in escrow, the fact
>that you're using a symmetric key works fine.

I'm not sure you need to escrow anything, as long as there is a way to share 
things among certain groups of people.  Jon's ideas of non-hierarchical 
recovery systems seem a lot more secure anyway, especially with the rest of 
this thread.

Oh - for the situation with Andy Grove (Intel CEO) describe earlier on this 
thread - let me give this suggestion:
	AG's key w/extra encryptions to CFO (or Pres. of Board, or someone else with 
significant influence and a close working relationship.  Backup for problems 
with intransit e-mail.)
	Similar setups for everyone else in the company.  Probably the top-level 
executives all have AG as the backup.  This elminates snooping entirely in 
the company, on the top level execs.  This partially hierarchical method 
wouldn't be horrible, and limits snooping to the level above you, or to 
peers, depending on setup.

>> Give an example of the difference between what he's doing and what
>> you would propose. Otherwise you're just rejecting this system
>> blindly.
>
>I'm sure I've given these reasons earlier in the thread, but I'll
>summarise them again:

Yeah, you covered them fairly well, and cleared up the issues where I 
honestly thought it was a fear-mongering problem.  I still don't completely 
agree with you, but we've clarified the problem areas.  Thanks.  (Too many 
wars get *way* too religous on the net.  Let's try and avoid that here, ok?)


-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQCVAwUBNECnJDc3ytqHnNyNAQGzAAP/bnYQQKdBnTY5HKc2fNlMYefYwZhdNXZo
aYNDhmybGM8756SIp0uuKaaf1t2f22is1/XdxaN2aHO+5qyHSc/EwgV4tWeQ1SXt
zBhMBM4phbTFSHl8FJUdRI9qcMxfoIfdoyJ5/CuYo83gJBwsrov6NZQylAlRR66K
VUAohcY/BxM=
=t0mO
-----END PGP SIGNATURE-----


-----------------------------------------------------------------------
Ryan Anderson -      "Who knows, even the horse might sing" 
Wayne State University - CULMA   "May you live in interesting times.."
randerso at ece.eng.wayne.edu         
PGP Fingerprint - 7E 8E C6 54 96 AC D9 57  E4 F8 AE 9C 10 7E 78 C9
-----------------------------------------------------------------------






From aba at dcs.ex.ac.uk  Sun Oct 12 04:07:12 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sun, 12 Oct 1997 19:07:12 +0800
Subject: CMR paves the road to GAK, and provides no corporate security.
In-Reply-To: <3.0.1.32.19971012005421.007ab570@pop3.ziplink.net>
Message-ID: <199710121053.LAA01120@server.test.net>




[Padgett, you're Cc'd because I'm quoting something you once claimed
on Perry's list, I think]

I agree with basically every word Peter Trei wrote.  It's not often
you agree with a long post like that 100%, but I could not fault a
single point.

Contrast that to PGP's Jon Callas's recent posts where I found myself
disagreeing with a large proportion of both technical and political
points.

Just a couple of nit-picky comments on various things, and some
re-iteration of the technical arguments against GAK compliancy (to
supplement Peter's good political arguments):

> >* Clipper was a 64-bit key. CMR symmetric keys are full-strength keys (128
> >bits or more), backed with a full-strength public key.
> 
> A word of advice: don't try to discuss Clipper in this forum without checking
> your facts. Clipper used an 80 bit key.

Clipper was definately advertised as a 80bit key, I agree.

But I did once see someone else claim that it was a 64 bit key, and
this was by Padgett Peterson, who is usually pretty good with facts,
though perhaps his claim was speculation in this case.  (I've added
him to the Cc).

His reasoning was that the 16 bit checksum (which Matt Blaze
demonstrated could be brute forced thereby trashing the GAK
enforcement) would come out of the 80bit key size, thereby meaning
that it was only an effective 64 bit key.  I suppose this claim if it
is correct would be similar to DES keys being 64 bit, but 8bits being
parity (checksum again), and therefor being only 56 bit effective.
The DES case would set a precedent for NSA design involvement using
larger "keys" than effective keys.  If this is true, the clipper /
skipjack system was even more flawed than we believed, as not only was
it possible to brute force the checksum, but the key space could have
been brute forced also, possibly without knowing the algorithm either,
just by buying lots of clipper chips (though I think this would
require knowledge of the checksum algorithm).  But clearly the NSA
could have brute forced the traffic in addition to having back doors.

Of course, I think it likely that the key was actually a 96 bit key
with an effictive key size of 80bits after the 16 bit checksum.

Regardless, if Padgett's speculation is correct, I suspect this is not
what Jon was thinking.

> > * With Clipper, there was a central repository of all the keys. With CMR,
> > there is not. I discussed that in detail in my message, "Why Corporate
> > Message Recovery isn't Key Escrow."
> 
> Once again, you haven't checked the record. Clipper keys were to be split, 
> with different halves going to different government agencies. There were
> fairly elaborate plans to prevent posession of only one half giving an
> attacker an advantage. Thus there were *two* repositories, not one. 
> (From the point of view of the paranoid, this was not much of a
> comfort - both repositories belonged to the same entity.)

I must defend Jon a little bit here in that it was fairly widely
agreed that the wording in some of the Clipper documents (perhaps
FOIAed, perhaps released normally, don't know) that the NSA would have
an extra access for "national security" (there's that magic root
password to the constitution again).  The presumtion a lot of people
held was that the NSA would have a second unified copy of the split
databasee to enable this national security access.  I'm not sure of
course that this is actually ever explicitly admitted anywhere, and it
could be that they would just have direct access to both split
databases, but I wouldn't really have thought this was the likely; I
suspect the NSA would've wanted access without others even with in
special wire-tapping courts knowing their tapping activities.

Whether or not this is what Jon was referring to I don't know.


I agree with the negative political aspects Peter expressed of PGP's
"GAK compliancy" (as I like to call it) in PGP's pgp5.5 & SMTP policy
enforcer.

I also think there is a purely technical security case to be made
against this architecture which I have tried to lay out clearly in my
post titled:

	Subject: negative security aspects of GAK compliancy

Peter made some security points about this also.  I think we should be
able to win the argument about GAK compliancy purely on technical
reasons.

The only vaguely logical objection I've seen to arguing against GAK
compliancy on political grounds was Hal Finney's assertion that
OpenPGP should move towards more generalised forms of key assertions
in the form of PolicyMaker-like key assertions (Matt Blaze has a paper
and system called PolicyMaker).

However PolicyMaker I suspect will be a long time coming, and may not
be supported by all vendors due to complexity, and in addition even
with PolicyMaker, the same political and security arguments against
actual use of PGP Inc's GAK compliancy field (or PolicyMaker
assertions to the same effect) still forcefully apply.  And there are
still in particular security and political arguments against
implementing corporate access to mail archives, or corporate
sent/received mail snooping by using the SMTP GAK compliancy policy
enforcer.

Lastly I would comment that it is sad that we on cypherpunks are
having to expend so much energy trying to persuade PGP Inc with it's
supposed pro-privacy stance, and supposedly pro-privacy employees,
that they should be working against GAK, and even to get them to
acknowledge that what they are doing is pro-GAK, and big brotherish is
an uphill struggle.

PGP Inc with their poor PR management, and hugely insensitive pro-GAK
moves mean that PGP Inc is pissing away Phil Zimmermann's good
reputation at a huge rate of knots.

Wake up PGP.  Look what you are becoming.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710121103.MAA01338@server.test.net>




Adam Back  wrote:
> As I have pointed corporate access to stored email can be acheived
> with similar amounts of snooping enforceability by having the PGP5.5
> mail client store to an escrowed communications key after decryption,
                                   ^^^^^^^^^^^^^^

Typo: that should be "storage key".

> I would be interested to see anyone refute this security argument from
> a security point of view.

And I am very interested to hear arguments against the logic of that
message.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710121258.NAA01459@server.test.net>




Ryan Anderson  writes:
> At 11:31 PM 10/11/97 +0100, Adam Back wrote:
> 
> >to exchange mail with anyone without using GAK.  Sure you have a
> >"choice", you can send email to people that will bounce 100% of the
> >time, whoever you send to due to lack of GAK compliance field.
> >(Except for perhaps a few die hard cypherpunks).
> 
> My reading of Jon's post was that the SMTP policy enforcer only worked for 
> outgoing messages.  Perhaps that's wrong, but that needs to be double-
> checked.  See below as well...

I'm fairly sure this is not the case.  The reason I think that this is
not the case is because Jon described two flags which go in the GAK
compliancy sub-packet:

Flag1:  this flag is an advisory note to the person who obtains a
	public key which has the GAK compliancy self signature
	sub-packet; it tells the person about to use the key that the
	company the person who owns this public key works for would
	like it if you would "please" encrypt to the contained
	corporate snoopware master key.

Flag2:	this flag is the same as the flag1 above plus it is a big
	brotherish/little brotherish warning that if you _don't_
	encrypt to the GAK compliancy key also, that the recipient
	will not receive the message.

I understood the reason that the recipient will not receive the
message when you don't honour keys with flag2 to be that the SMTP
policy enforcer would either bounce the message, or eat it, or send it
to the company snoopware czar to who can take due note in his employee
dossier collection that this employee is receiving email from
suspicious cypherpunk persons who don't believe in snoopware.

The above functionality is the reason I'm arguing that PGP's method of
implementing corporate snoopware is GAK compliant: clearly the whole
system is ready tailored for GAK.  The only thing left to do is plug
in the governemnts key in the GAK compliancy field, and for the
government to mandate that companies, and deputised ISPs use the
software and the GAK master key.

If/when this GAK compliancy gets used as the architecture for real
live mandatory GAK, the SMTP policy enforcer may be set up to narc out
the suspicious person who doesn't believe in GAK to the Feds/NSA, and
they will then come and lock you up if they can trace your SMTP From
field to you.

This will make a mockery out remailers, because the remailer chain
will also be forced to have the GAK master key in it as enforced by
deputised ISPs running PGP's SMTP policy enforcers with GAK keys
installed as the GAK master key. 

> >> It's not even needed if you don't have that key on your ring.  (From
> >> what Jon said)
> >
> >I'm not sure what you mean here.
> 
> The snooping key.  If it doesn't exist on *my* keyring.  (Say I have your 
> key, but not the key designate as your snooping key...)  [BTW: Forgive the 
> English, I'm tired and speaking in choppy sentences]

Oh, I see what you mean.  The reason I didn't understand is that this
is not how I thought it works.  I think the key is provided right
there in the GAK compliancy field in an inseparable way.  (I could be
wrong on this, but this is the way I read Jon's message).

Even if have misunderstood the way that this key is bundled, it
doesn't really alter the fact that by "choosing" not to encrypt to
messages with the flag2 flag you will know that this is a waste of
time, because your message will not get past the SMTP policy enforcer.
So purposely stripping the key from your key ring, or separating the
key pair when someone sends you them together would just be another
way of exercising the choice PGP is claiming you have in "choosing" to
have your message bounced back at you.  A fairly meaningless "choice".

I would be interested to have this point about the way GAK compliancy
key is bound/bundled with the GAK compliancy sub-packet clarified by a
PGPer, or someone with more understanding of the draft docs, if this
much information is available yet.

> If I have your key, but not the other key that I'm also supposed to
> encrypt to, PGP (whichever versions, I'm not entirely sure how the
> feature set breaks down, but I believe this applies to all versions
> of 5.x) will not even mention that there was another key it would've
> have offered to encrypt to.

I don't think this is so because that would invalidate the semantics
of the flag1 and flag2 flags, which are what instructs PGP to warn you
of this requirement for this key.  The flag is an attribute of the key
itself, though I do suppose you might be able to strip off the
attribute in much the same way as you can remove signatures from keys
with pgp -krs.

> >Using separate storage keys allows you to:
> >
> >- escrow storage keys within your company without including GAKware
> >  compliancy
> >
> >- discard communications keys often (by giving them short life-spans)
> >  which greatly enhances your security
> 
> Greatly complicating the "web of trust" method, but..  

I don't think it complicates web of trust.  The only certification you
need of communications keys is for you to sign them with your
signature key.  Your signature key semantics, and the web of trust is
unchanged.

> You can only chain signatures so far before you run into problems,
> and getting people to continuosly recertify could be a major pain,

It will be automatic .. you won't notice because all the OpenPGP
compliant application which supports this proposed (strongly
encouraged MAY, please!) feature will do when it creates a new
communications key is to sign the communications key with your
signature key.  It won't involve third parties re-issuing
certificates.

It is the same way that certification and WoT interacts with
potentially shorter life-span dual use encryption keys at the moment.
The WoT certificates go on your longer life signature key, and it is
you who signs your encryption key.  Same argument, though now applied
to encryption keys marked as "communications only".

> >There might be some security advantages to using
> >symmetric keys even.  (Public key sizes are a faster sliding and more
> >uncertain target than symmetric key sizes.
> 
> Well, at least with RSA keys, I believe the memory requirements to
> handle current factoring algorithms are quite untenable for 2048 bit
> keys.  I think 768 is out of the range of current systems.

512 bit I think is reckoned to be feasible for an academic crack of
similar scale to the recent RSA challenge DES break.  The memory for
the final matrix crunching phase might be the only arguable point.

However, this doesn't really give me 20 years worth of assurance
because, well Rivest and friends encrypted the message "squeamish
ossifrage" back in 1977 or thereabouts, firm in the belief that it
would not be broken for 1000s of years.  Factoring advances have meant
that that ~380 bit keys (squeamish ossifrage was RSA129 digits
decimal) is now relatively easy.  Paul Leyland and friends broke a 384
bit blacknet key as a private attack without massive internet
collaboration.

I'm not sure anyones promising, or has any mathematical proof that new
factoring algorithms won't provide similar factoring speedups.  How
many years are 1024 bit RSA keys good for?  All you can use as
estimators is the current factoring algorithms.  I'm not sure how
certain these estimates are for long term purposes.

In contrast if there is nothin wrong with 3DES nor IDEA, the key space
protects you, modulo Moore's law which is easier to predict.  (Also
modulo quantum computing break-throughs, in both cases, erk!)

> I think this came up on the RC5 (Bovine) mailing list, and the
> figures for the required server was something absolutely ridiculous.
> To distribute the job using the more efficient algorithm required
> machines with 128 meg of ram, but the slower one was a bit more
> doable.

Yes.  But memory on workstations is increasing in leaps and bounds.
It is very common now for personal PCs and even laptops to have 32Meg.
A few years ago we were living below the 640k barrier.  Leave it a few
years, and people will have the required memory levels.  A few more
years on from that people will be grizzling about living below the 4Gb
barrier (restriction from using 32 bit addresses).

Anyway, one of the factoring gurus may come up with another novel
implementation or algorithm tweak to tune down memory requirements.
Or a newly discovered faster factoring alorgithm may have huge memory
advantages over current alogirthms.

> In short, I don't think 2048 RSA keys are reasonable target in the
> forseeable future.  [Remember, Moore's law is only applicable for
> another 12 years or so.  Then quantum mechanics starts to be a
> serious problems, and electrons start switching channels in the
> chips.]

The future is uncertain.  But it is marginally less uncertain for
well tried and tested symmetric keys ciphers.

> But this is a bit of a wandering topic now.  Let me continue...
> 
> >You can sign and encrypt with symmetric keys also. "pgp -cs."  Quite a
> >useful combination.
> 
> Hmm.. I must've missed that.  

Don't think it says it anywhere, but you can combine flags in lots of
logical ways which aren't documented as such, and most of which work
as you might reasonaly extrapoloate them to.  There are single letter
flags for most letters of the alphabet, the full number of
combinations must be quite large.  Quite a few of them mean
*something*.  Some of them are even phonetically pleasing: -feast etc :-)

> Well, I wasn't really encrypting anything I really cared about.  It
> was backups of autoexec.bats and config.syss, I just wanted another
> copy that I *knew* when it was made, it wouldn't get overwritten,
> and it wouldn't get modified without me knowing.  And I needed
> something to use PGP for, so...

Signature only might've been enough for backups of stuff in plaintext
on the disk like autoexecs.

> In all honesty, the public key baggage is 512 bytes ( I think,
> possibly bits.  I've forgotten now ) Quite insignificant if you're
> dealing with CAD drawings.  

Sure.  But you were also talking about autoexecs and other small files
where it could get significant.  The significant lose howver is the
performance -- say you recursively encrypt all the files in a
directory, each to 2 or 3 multiple crypto recipients.  It'll crawl.

> >It's probably simpler to just escrow storage keys.  That is just give
> >management a copy to put in the fire proof safe.  Or secret split or
> >whatever.
> 
> I was actually thinking something along the lines of creating a file
> - encrypting it to your whole workgroup, and leaving it on a server.
> Now you have the advantage of not having any security problems even
> if the server is compromised [without workstation compromise, of
> course], and all the important people can access it.  Of course, the
> last person to modify it resigns it, and it gets dropped into your
> RCS system.

I see.  Sounds reasonable.  You should be able to achieve that with
the current dual use PGP keys, or with the new "storage only" keys via
crypto recipients.

If your document is on the Internet, on the web perhaps, you'd need to
be aware of the reduced security in using long term storage keys as
opposed to short term communications keys, but other than that I can't
see a problem.

The point is that where you have a directional communication, you
should treat those keys as sensitive.  Where it is not a directional
communication, you can't, so you lose that extra security; for
applications where this is acceptable, I wouldn't argue for
restricting your ability to do it.

> you get the added advantage of being able to rotate your keys here
> as well, so even if one key is compromised, and the server is
> compromised, you don't lose the whole system.  Identical argument as
> for communications keys.

I think I understand what you're saying for shared storage keys.  But
I don't think it's an identical argument at all for communications
keys.

If you define communications keys as short lived highly sensitive
keys, as perhaps in SSL, or SSH (both of which use some forms of
forward secrecy), you can't retain the ability to recover the message
after the fact for security reasons.

However I posit that people don't really want access to the plaintext
stored inside encrypted communications for their own purposes for the
simple reason that they don't have a sendmail log including all the
message bodies.

Together with the security advantages of not being able to decrypt
communications traffic yourself after the fact, this argues that
people who do want full email archives for company legal or snooping
purposes, or just folder for their own use (I know I keep lots of
email in folders) can either store in the clear, or store encrypted
with a storage key, or store with an escrowed storage key, or store
encrypted to multiple storage keys as crypto-recipients as you
suggest.

> >There is one (quite practical) reason, however, to use symmetric
> >storage keys.  Speed.  If you're encrypting lots of files (perhaps
> >using an encrypted parition driver such as Peter Gutmann's SFS), you
> >won't have time to encrypt to public keys, never mind multiple public
> >keys.
> 
> That's a different problem.  For that you're [in this ultra-theoretical 
> world] 

I don't think it's that theoretical.  Don't PGP have such an encrypted
disk driver for the MAC?  I think this is the way forward for simpler
storage encryption: encrypt the lot.  Saves arguments about forgetting
to encrypt stuff, or forgetting you did decrypt and leaving plaintext
copies around in /tmp or whever as well.

> probably going to want something along the lines of this: Symmetric
> encryption for speed on the partition, and that key stored with
> several recipients in the same place as the Secure Partition Driver
> (SPD).

Your suggestion is one reasonable way of acheiving this.  You can also
acheive the same flexibility with an extra indirection with symmetric
storage keys (optionally held in escrow).  In fact I think this is
what later versions of Peter Gutmann's SFS do.  The reason he uses for
this is that it allows you to change your passphrase without
re-encrypting the whole disk, because the _actual_ disk encryption key
is encrypted itself with the hash of your passphrase, rather than
using the hash of the passphrase directly as the key.

> (This falls in the, "If you're going to build a system, make sure
> you think of everythign you want and make sure it fits in the
> framework somewhere" method)

Well I agree, I think it's reasonable for us to consider the major
uses, plaintext recovery demands, and security aspects of the
different types of uses for keys: transient communication keys,
storage keys, and signature keys.

> >If the company keeps it's employee's storage keys in escrow, the fact
> >that you're using a symmetric key works fine.
> 
> I'm not sure you need to escrow anything, as long as there is a way
> to share things among certain groups of people.  Jon's ideas of
> non-hierarchical recovery systems seem a lot more secure anyway,
> especially with the rest of this thread.

It doesn't really matter one way or the other.  You can build
non-hierarchical recovery systems with either method.  (You can escrow
storage keys in your department, just as easily as add second crypto
recipient within your department.  I think the security is basically
the same for escrow or multiple recipient when we're talking about
storage.

The same security equivalence argument applies if you accept the
premise that you need access to transient communications.  I don't
accept this premise.  This premise is a fallacy promulgated by the
likes of Freeh.  If you don't escrow communications keys at all you
gain extra security for the same reason that it is less secure
actually to escrow storage keys, or use multiple recipient as another
way to achieve storage key escrow than to not use storage key escrow.
However with storage you live with this because a) data availibility
is important, and b) the risk isn't as great with storage because your
attacker has to breach physical security to obtain the data from your
disks and tapes.

> Oh - for the situation with Andy Grove (Intel CEO) describe earlier on this 
> thread - let me give this suggestion:
> 
> 	AG's key w/extra encryptions to CFO (or Pres. of Board, or
> someone else with significant influence and a close working
> relationship.  Backup for problems with intransit e-mail.)
> 
> 	Similar setups for everyone else in the company.  Probably the
> top-level executives all have AG as the backup.  This elminates
> snooping entirely in the company, on the top level execs.  This
> partially hierarchical method wouldn't be horrible, and limits
> snooping to the level above you, or to peers, depending on setup.

The suggestions about snooping heirarchy -- who can read who's mail
within the company -- are independent of which architecture you choose
to use to allow access to the mail (escrow storage keys or use
multiple crypto recipient for storage keys).  (This can all be
enforced with similar levels of resistance to bypass by building the
archive and snooping features into the mail client to do this after
decryption).

Where you start to get argument from me is when you start unduly
exposing what should be transient communications keys to construct
this corporate snooping pecking order.

> >I'm sure I've given these reasons earlier in the thread, but I'll
> >summarise them again:
> 
> Yeah, you covered them fairly well, and cleared up the issues where
> I honestly thought it was a fear-mongering problem.  I still don't
> completely agree with you, but we've clarified the problem areas.
> Thanks.

That's what it's all about -- meaningful discourse so that we can
collectively improve each others understanding of the problems at
hand, pointing out flaws in each others arguments until we reach
agreement, eliminating misunderstanding.  With that a clarified
picture of the security issues and best architecture, we can then go
on to design suitable security protocols which best reflect this.

> (Too many wars get *way* too religous on the net.  Let's try and
> avoid that here, ok?)

Hey, as long as we steer clear of PGP arguments about mandatory GAK
compliancy, this is all friendly discourse :-) 

On religious arguments: I must admit to strong negative feelings about
PGP Inc or the OpenPGP standard using weaker security methods to
enable GAK compliancy.  My reason for expressing these opinions is the
hope that we can talk PGP out of this big brotherish SMTP policy
enforcer, and associated GAK compliant fields, and to give my input to
try to steer the OpenPGP process away from incorporating said GAK
compliancy field into the standard.

Also as I hope I have explained relatively clearly in my other post
titled:

	Subject: negative security aspects of GAK compliance

that GAK compliancy is independently from political arguments a
security design flaw.  And so I think that we should be able to reject
it on technical grounds alone as a design with weaker security.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



Adam Back  writes:
>> > Unfortunately I wasn't on cypherpunks-unedited at the time, but I
>> > thought that it was immediate send out from toad.com without going via
>> > Sandy.
>>
>> Going over my notes I see that at least one of my submissions - the
>> one quoting the C2Net lawyer letter in its entirety - didn't appear
>> even on cypherpunks-unedited.
>
>I think I saw this claim made before around the time of the "moderation
>experiment".
>
>The only ways I can see that this could have happened are either that:
>
>  i)  John Gilmore started editing cypherpunks-unedited at Sandy/C2net's
>      request
>
>  ii) cypherpunks-unedited was edited all along by someone (John or Sandy)
>
>i) is sort of feasible, perhaps there are others who were on unedited
>and were counting who could confirm this.  Toto I think was.

Apparently a 'bot was installed on toad.com to discard my submissions from the
"unedited" list _after my article which prompted the C2net threatening lawyer
letter did make it through the "unedited" list (but was censored from the
"flames" list by C2Net).

>ii) is hard to believe because the fact that something is edited shows
>-- when the editor is sleeping you get lag.
>
>I'm fairly sure I didn't see the C2 legal letter you posted yesterday
>before.

I'm sorry to have to return to this topic that's been beaten to death and
causes me intense nausea. I figured I'll comment on two more attempts to
revise history by lying C2Net shills from Hewlett Packard and Oracle.

Please recall that C2Net created 3 lists on toad.com:
 unedited
 flames
 C2Net-approved

At one point, all my submissions to cypherpunks appeared on "unedited" and
then on "flames" with about a 3-second delay, indicating a 'bot at work. The
'bot was scrubbed when C2net decided that my writings were not suitable for
auto- forwarding to the "flames" list either. For about a week, numerous
articles by myself, Tim May, et al appeared on "unedited" but not on "flames".

Howver toward the end of the "moderation experiment" apparently a 'bot on
toad.com was filtering my submissions from the 'unedited' list as well. My Jan
30th announcement that C2Net filtered out of the flames list _did show up on
the unedited list. However my following articles, like the one quoting C2Net's
threatening lawyer letter (which I cc'd to numerous people, including JYA,
who, not surprisingly, declined to put it on his archive) did _not appear on
the "unedited" list. Nevertheless at least one lying C2Net shill from Hewlett
Packard claims that my articles appearing on the unedited list on January 30th
prove that I wasn't being filtered from "unedited" one week later.

Another lying C2net shill, Jason E. Durbin, a technical writer for Oracle,
just wrote in news.admin.net-abuse.policy:

}For those unfamiliar with the tactics Vulis uses when attempting to
}destroy moderated fora, take a look at the current, ongoing thread
}called "Stronghold" (and other variations on same) on the Cypherpunks
}mailing list archived at:
}
}http://infinity.nus.sg/cypherpunks/current/date.html#start
}
}It summarizes (including Vulis' take on the situation) Vulis' attack
}on the mailing list itself via a feigned attack on the Stronghold
}security server.
}
}In summary, make such an annoyance of yourself by whatever means
}necessary (posting binaries, running an insultbot, making false
}accusations, etc.) to get yourself threatened with banishment, then
}rally the free speech advocates by painting yourself as the innocent
}harmed party even though no banishment occurred.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
}
}Interesting insights into how Vulis attempts to manipulate his victims
}into damning themselves while making him look like a victim.
}Interesting reading.

"No banishment occured" - more bizarre lies from C2Net and their supporters.

Oh, and I don't recall sending binaries to this list either.

This reminds me of the claim by Rich Graves, another C2Net/Cygnus shill, that
I'm sending "hundreds" of articles a day to this mailing list.

You may recall that the same C2net/Oracle shill Jason Durbin has been
following up on my Usenet articles in sci.crypt, comp.unix.questions, etc
with lies and libel: claiming, e.g., that I "lie about my credentials",
that I don't even have a master's degree, etc. Is C2Net paying Jason Durbin
to badmouth my academic credentials?

>From Jason Durbin's Net.Scum page:

Jason E. Durbin, jdurbin at nl.oracle.com, jed at poisson.com,
slothrop at poisson.com, jed at best.com, jed at netcom.com.

Jason claims to work for Poisson Corporation, 8 Avocet Drive, #211, Redwood
Shores, CA 94065, tel +1 415 637 0435, JD503.

In real life, Jason is a lowly technical writer for Oracle Corporation, 500
Oracle Parkway, Redwood City, CA 94065, tel: +1 800 345 3267, +1 415 506 7000,
(+1 605 506 7000), fax: +1 415 506 7200.

Jason's manager in the technical writing department is:
Sanford Dreskin
Mail Stop:  MS-40P12
Office tel: +1 415 506 2181
Office fax: +1 415 506 7228
Home tel: +1 510 376 9526
Home addr: 859 Augusta Drive, Moraga, CA 94556-1051

In what ways are Durbin and the Hewlett-Packard liar affiliated with C2Net?

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps






From nobody at REPLAY.COM  Sun Oct 12 06:53:39 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 12 Oct 1997 21:53:39 +0800
Subject: Phone Line Internet
Message-ID: <199710121344.PAA20721@basement.replay.com>




Inter at ctive WeekOctober 10, 1997

                      Nortel Unveils 1-Megabit Phone Line
                      Ethernet

                      By Peter Lambert 
                      1:00 PM EDT 

                      Northern Telecom Inc. announced the Nortel 1-Meg
Modem, a
                      modem designed to extend Ethernet-equipped
personal computer
                      access across standard telephone lines. 

                      The company plans to deliver plug-in modules for
its DMS phone
                      company central office switches and its Internet
Thruway voice switch
                      bypass device in the first half of 1998. It will
license the 1-Meg
                      Modem technology to modem makers. 

                      The 1-Meg will deliver 1-megabit-per-second speeds
downstream
                      into homes or businesses and
120-kilobit-per-second speeds in the
                      other direction, and like Ethernet-connected local
area network
                      (LAN) interfaces, the modem will always be on,
requiring no dial-up
                      connection. 

                      The technology will offer compatibility with both
frame relay and
                      Asynchronous Transfer Mode (ATM) backbone
networks. 

                      Separately, Nortel finalized a deal to gain an
unspecified equity interest
                      in NetSpeed Inc. and rights to integrate
NetSpeed's Digital Subscriber
                      Line technology into its own products. NetSpeed's
ATM-based
                      LoopRunner Digital Subscriber Line Access
Multiplexer is designed to
                      terminate up to 560 users per central office
system rack. 

                      Nortel can be found at www.nortel.com 

                      NetSpeed can be found at www.netspeed.com 

                           Email Peter Lambert






From aba at dcs.ex.ac.uk  Sun Oct 12 08:22:41 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sun, 12 Oct 1997 23:22:41 +0800
Subject: Stronghold
In-Reply-To: 
Message-ID: <199710121508.QAA04569@server.test.net>




Dimitri Vulis  writes:
> Apparently a 'bot was installed on toad.com to discard my
> submissions from the "unedited" list _after my article which
> prompted the C2net threatening lawyer letter did make it through the
> "unedited" list (but was censored from the "flames" list by C2Net).

Your claim has some plausibility, I'll grant.  You were already
singled out for special treatment, in that John Gilmore did
unsubscribe you, and block you from re-subscribing.  We know that much
because he admitted it himself.

Also Attila said something recently about some of his messages being
excluded from the unedited list, and being able to repost them at
night and have them go through.  He said he thought Tim May
experienced similar problems.

This is a serious charge because we were lead to believe that unedited
was completely unedited -- it was supposed to be straight through, and
neither John or Sandy ever admitted to editing unedited, yet according
to these claims it appears that it was being edited.

There are sort of plausible reasons why mail can disappear -- freak
delivery problem (happens now and then), or perhaps flakiness of
toad's majordomo to many changes being made to it.  It is sort of
within the bounds of believeability that these posts could have
disappeared by accident.

Given that multiple people are saying things about unedited being
edited (either by bots or by hand selection) it seems likley that
there was something sneaking going on towards the end, even with the
unedited list.

> At one point, all my submissions to cypherpunks appeared on
> "unedited" and then on "flames" with about a 3-second delay,
> indicating a 'bot at work.  The 'bot was scrubbed when C2net decided
> that my writings were not suitable for auto- forwarding to the
> "flames" list either.

Wow.  That is a somewhat plausible claim also, one it might be
possible to verify from article headers in list archives.

> For about a week, numerous articles by myself, Tim May, et al
> appeared on "unedited" but not on "flames".

I can confirm my belief that this part is true.  Numerous people have
verified this, which ocurred after Sandy faced his engineered
"dilemma" :-)

> My Jan 30th announcement that C2Net filtered out of the flames list
> _did show up on the unedited list. However my following articles,
> like the one quoting C2Net's threatening lawyer letter (which I cc'd
> to numerous people, including JYA, who, not surprisingly, declined
> to put it on his archive) 

I'd be interested to hear John Young confirm or deny this.  He if I
recall correctly was also critical of C2's handling of the affair, and
I would have thought that with his normal 'tude to censorship of
documents, he would've put it up.  So what happened John?

> did _not appear on the "unedited" list. Nevertheless at least one
> lying C2Net shill from Hewlett Packard claims that my articles
> appearing on the unedited list on January 30th prove that I wasn't
> being filtered from "unedited" one week later.

Some thing's just can't be proven.  That logic clearly doesn't flow.

> Another lying C2net shill, Jason E. Durbin, a technical writer for Oracle,
> just wrote in news.admin.net-abuse.policy:
> 
> [Dimitri bashing by Jason Durbin]
> 
> "No banishment occured" - more bizarre lies from C2Net and their supporters.

Yup, that one is incorrect -- we've established that because John
Gilmore admitted to unsubscribing you, and blocking you from
re-subscribing.

> Oh, and I don't recall sending binaries to this list either.

No, can't say I recall you sending binaries either.

> This reminds me of the claim by Rich Graves, another C2Net/Cygnus
> shill, that I'm sending "hundreds" of articles a day to this mailing
> list.

Not hundreds, I agree.  However there were a few rather long ones
about "dandruff covered Armenians" :-), something involving some
claimed historic ethnic cleansing.

> You may recall that the same C2net/Oracle shill Jason Durbin has
> been following up on my Usenet articles in sci.crypt,
> comp.unix.questions, etc with lies and libel: claiming, e.g., that I
> "lie about my credentials", that I don't even have a master's
> degree, etc. Is C2Net paying Jason Durbin to badmouth my academic
> credentials?

Your credentials are independently verifiable.  I have seen claims by
people who have said that they had satisfied themself of your
credentials by calling the university you got your PhD from.  I have
not done this myself, but I take your word for it.  

However another aspect to this argument over credentials is a comment
that arose when another person with a PhD who used the title "Dr" in
his From line subscribed to the list.  That person was Fred Cohen.
His above average education in having his PhD didn't seem to reflect
in his posts, and several people commented on this fact.  It seems to
be that listing qualifications in From fields is asking for rude
comments, or it seems to attract criticism :-)

I can say I like the practice.

Was a time on this list when there were quite a number of people who
had PhD's.  Jim Gilogly does I think, Atilla T Hun, no doubt lots of
others, several past or present list members are post grad students
studying for PhD's (and no doubt being distracted from their PhD
topics by reading cpunks).

I won't bother discussing my academic qualifications; it doesn't
really seem necessary to discuss them on list.

People's comments have value independently of their qualifications.
It can be largely orthogonal to their paper qualifications.  A lot of
people in the computer field got their qualifications in other fields.
Paul Kocher for instance if you look at his resume seems to have a BSc
in Biology or something, however this clearly doesn't get in his way,
as he does pretty high level crypto consulting (RSADSI, Netscape,
etc).

Anyway, perhaps it's time for a repost of the potted sequence of
events I constructed of the events as I was able to verify them at the
time.  Uh... dig dig, I'll find it in a bit.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



Dammit Adam.  I respect your opinion and your knowlege about
these issues, but I think that you've been fooled by Minitru's
machinations.


Minitru would _like_ for the world's businessmen to be 
presented with a choice between "brittle" crypto-- private keys
held solely by owners, plaintext available solely to recipient,
where every forgotten password, missed keystroke or disgruntled
saboteur means the company loses valuable data permanently-- or
GAKked crypto where these problems of brittleness are solved by
Big Brother paternally providing backups when you find yourself
in need.


In reality neither of these is an acceptable alternative for 
serious use of strong crypto in business.  Escrow is a 
valuable business concept, which was invented by businessmen 
centuries ago and has been used ever since because it 
provides significant value to the participants who voluntarily
enter into the escrow contracts.  In the context of the 
information age and crypto, escrow will be one of the basic 
building blocks of the new era, both for basic business 
purposes-- serving the same purpose that escrow has always 
served but with heightened importance to pseudonymous, global 
commerce-- and for building cryptosystems which are robust in
the context of data being shared among many people (e.g. a 
company).


The issue is not how many people are given access to your keys
or your data.  The issue is whether you maintain your right to
control who those people are (including, but not limited to, 
your right to decide that you will be the only person with 
access), or whether others with delusions of grandeur and 
obedient police forces can compel you or trick you into giving
them access.


Don't let Minitru continue to confuse the issue-- you'll be 
left with nothing but false alternatives.  Escrow is good and 
necessary and inevitable-- ask any businessman.  GAK is not
escrow.  Escrow is not GAK.


Regards,

Zooko






From aba at dcs.ex.ac.uk  Sun Oct 12 09:36:21 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Mon, 13 Oct 1997 00:36:21 +0800
Subject: repost: potted history of moderation experiment
Message-ID: <199710121624.RAA05266@server.test.net>




Dimitri's discussion of the moderation experiment prompted me to dig
up this history of the event I wrote shortly after the distributed
lists were setup.  I did promise around this time to repost this later
after the moderation experiment to ensure that it wouldn't be itself
censored.

If Attila and Dimitri's suspicions are correct, in addition to the
below, cypherpunks-unedited may actually have been hand edited, and
have had filters placed on it which rejected certain postsers articles
out of hand, or auto-forwarding them to cypherpunks-flames.  Other
list members may be able to verify some the uncertainty surrounding
these aspects of the censorship experiment.

Enjoy,

Adam

==============================8<==============================
Date: Sun, 16 Feb 1997 23:49:09 GMT
From: Adam Back 
To: cypherpunks at toad.com
Subject: Moderation experiment and moderator liability


There appears to be a bit of a hush up surrounding the circumstances
of the pause in the moderation experiment and subsequent change of
moderation policy.

To clear the air, I think it would be kind of nice if the full story
were told, so I'll gather here a history as I understand it.
Information from my archives (those I have), and from asking around in
email.

I realise that some of the actions that I am claiming of participants
in this sequence of events seem hard to believe given their high
reputation capital.  I was myself initially dubious on the strength of
the reputation capital of those being critisized.

However the below is the sequence of events as close as I can
determine.

I welcome being proven wrong on any points.


Events:

1. Dimitri Vulis posted a lot of off topic posts over a period of time

2. Dimitri reposted a couple of 50k Serdar Argic revisionist articles 

3. Dimitri challenged John Gilmore to shut him up

4. John unsubscribed Dimitri, and modified majordomo at toad.com to
siltently ignore Dimitri's attempts to resubscribe.  Dimitri could
still post, and presumably read cypherpunks with a different email
address or via an archive.  It was a token unsubscription only.

5. When Dimitri figured out what John had done, he made many posts
denigrating John as a censor

6. Much discussion ensued critisizing John for blocking Dimitri

7. Over Christmas some joker subscribed cypherpunks at toad.com to a load
of sports mailing lists, Hugh Daniels and John cleaned up the mess

8. Followed a long thread on hardening lists against spam attacks

9. John made a post to the list announcing that the list would be
moderated for one month from Jan 11 as an experiment, and included
Sandy Sandfort's proposed moderatation policy and offer to act as
moderator.  It appeared that the moderation experiment was Sandy's
suggestion, and that John had agreed to go along with it.

10. Some discussion both pro and con of moderation, and the technical
, free speech, and legal aspects followed

11. Moderation started Jan 19, the main list became the moderated list

12. Lots of people complained about the moderation, some defended it
Tim May quietly unsubscribed

13. Some people complained about inconsistency in moderation -- some
articles which went to flames were not flamish, but made by posters
with low reputation capital, or were following up to posts which were
flamish.

14. After a while some people commented on Tim's absence, and sent him
mail asking what happened.  Tim posted an article explaining that he
had left because of the imposed moderation without discussion.

15. John followed up with a post defending the moderation experiment,
and arguing for it's popularity (he claimed as evidence the number of
posters who had not taken the trouble to move to the unedited list).

16. Dimitri posted an article where he claimed that there was a
security flaw in Stronghold.  Stronghold is C2Nets commercial version
of the freeware Apache SSL web server.  Sandy is employed by C2Net.

17. Sandy dropped the posting entirely -- it went to neither
cypherpunks (edited), nor cypherpunks-flames.  He considered that
forwarding the posting would have made him legally liable.  Sandy is a
lawyer by profession.  He did not explain this situation on the list.

18. Tim May had by now subscribed to cypherpunks-flames, and posted
several follow-ups to Dimitri's posting, discussing the issue of
Dimitri's post being dropped, and stated that Dimitri's posting was
not flamish, and should not have been dropped in his opinion.  Tim's
postings were also silently dropped, going to neither of cypherpunks
(edited), and cypherpunks-flames.

19. Sandy made an announcement that he was ending his participation in
the moderation experiment.  Still no explanation of why posts were
dropped, or even admission that they were.

20. The two moderated cypherpunks lists (cypherpunks and
cypherpunks-flames) went dead for some time.

21. Tim received a warning from C2Net's lawyers that if he did not
desist from mentioning that Dimitri had posted an article criticising
a C2Net product that he would be sued!

22. John posted a statement where he explained Sandy's sudden
announcement of ending his particpation.  John explained that Sandy
had "hit a pothole in the moderation experiment when Mr. Nemesis
submitted a posting containing nothing but libelous statements about
Sandy's employer".  Sandy did not drop Johns posting even though it
covered the same topics that had resulted in Tim's posts being
dropped, and resulted in Tim receiving legal threats from C2Net.  In
the same post John said that he had come to the conclusion that he was
no longer willing to host the cypherpunks list.  In this post John
announced that Sandy had been persuaded to continue to moderate for
the remainder of the moderation period, and gave the new policy.  The
changes were that anything other than crypto discussion and discussion
of forming a new cypherpunks list would go to flames, and anything
that Sandy thought was libelous would be dropped silently.

23. Sandy posted a statement affirming that he would continue to
moderate, and that if any cypherpunks wished to discuss his prior
moderation policy and performance as a moderator that they do it on
new lists which they create themselves.


(If Sandy's current moderation criteria mean that he feels obliged to
forward this post to cypherpunks-flames as off-topic, or even to
silently drop it from both moderated lists, so be it.  I will simply
repost it later, when the moderation experiment is over on one of the
new lists.  In the event of myself receiving legal threats, I shall
simply post it via a remailer, or rely on someone else to do so.  C2
does not appear to be running any remailers at the moment, otherwise I
would use a remailer hosted at c2.net as the exit node in the remailer
chain.)


The positive outcome of all this has been to make the cypherpunks list
more resilient to legal attack.  The new distributed list seems to be
progressing well, and will be less liable to attack.  Filtering
services continue, as they should.  And alt.cypherpunks has been
created as a forum ultimately resistant to legal attack.

Also I should say that I would hope that no one holds any long term
animosity towards any of the players in this episode, many of the
people have been very prolific in their work to further online privacy
and freedom, and I hope that we can all put this chapter behind us.


Now more fun things...

Anyone checked out the DES breaking project?

Over on 

        http://fh28.fa.umist.ac.uk/des/ 

are details of mailing lists where people are organising breaking
RSADSIs DES challenge.  For the RC5/32/12/6 (48 bit RC5) break which
took 13 days, it seems there were a peak of 5000 machines involved.
At this rate it will take 8 months to break DES.

Adam
--
print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



Hi,

You folks have been pretty board the last couple of days, must not be much
happening on the crypto or civil-liberties front.....;(


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http:// www.ssz.com/  |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From tcmay at got.net  Sun Oct 12 10:19:53 1997
From: tcmay at got.net (Tim May)
Date: Mon, 13 Oct 1997 01:19:53 +0800
Subject: D-H Forward Secrecy for E-Mail?
In-Reply-To: <199710120948.KAA00212@server.test.net>
Message-ID: 



At 2:48 AM -0700 10/12/97, Adam Back wrote:

>Once you acknowledge that it is more secure to have short lived
>communication keys (which in my view it very clearly is), it should be
...


Just what are some of the issues with us getting D-H-type perfect forward
secrecy with something like e-mail? I assume this must be possible, of
course, as D-H is used in just these ways. (The Comsec 3DES phone I have
does this, of course.) (To repeat what has already been said, forward
secrecy means some of the important keys are not kept or stored, and so a
subpoena at some future time to produce the keys used in a communication is
pointless. Cf. Schneier for more.)

First and foremost as a requirement would be the need for a back-and-forth
communication, in a real-time or nearly real-time mode. This rules out
conventional e-mail with its long a variable latencies for delivery. (Not
to mention diverse clients and their inability to respond automatically!)

But IRC, chat rooms, Internet telephony, etc., are all common. With
latencies of ~seconds, or even less.

I picture conventional e-mail being replaced, for this application, with
this kind of system. Maybe D-H forward secrecy systems already exist....

Forward secrecy might be arrangable even with long-latency links...it seems
to me. (Through a series of links, compute and store the D-H parameters,
then use them with conventional e-mail for the "payload" message?)

--Tim May


The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From sunder at brainlink.com  Sun Oct 12 11:09:06 1997
From: sunder at brainlink.com (Ray Arachelian)
Date: Mon, 13 Oct 1997 02:09:06 +0800
Subject: [NTSEC] NT 5 questions (fwd)
Message-ID: 





=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.|  Ray Arachelian    |Prying open my 3rd eye.  So good to see |./|\.
..\|/..|sunder at sundernet.com|you once again. I thought you were      |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run  |\/|\/
../|\..| "A toast to Odin,  |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were....            |.....
======================= http://www.sundernet.com ==========================

---------- Forwarded message ----------
Date: Sun, 12 Oct 1997 16:44:38 -0000
From: Peter Fey 
To: ntsecurity at iss.net
Subject: Re: [NTSEC] NT 5 questions

Hi Matt,

first - the last 2-3 days I've been 'BEHIND' the list - had to read some 200
mails to get by.  ;-)()
So maybe someone else did anser just your first question.

> One of the addition to NT is disk encryption w/escrow.  Is this the
> Kerberos aspect of it?

Right, one of the new features of NT 5 is the EFS (Encryption File System)
including a feature called data-recovery.

The EFS is an additional layer above good-old NTFS to allow users to encrypt
single files, directories and whats below or whole drives. One reason
Microsoft added EFS was to nihilate tools like NTFSDOS --- reading an
NTFS-volume just by booting it on a DOS-disk in the NTbox. Another is
protection of -lost- notebooks and the like ...

As the whitepaper on the M$ site shows, the made up a pretty easy to handle
and ?? pretty secure ?? to deal with system. Using asymmetric cryptography -
i.e. private and public keys - they are up2date in technology and supporting
weak and strong encryption 40/56 bit DES they confirm with the US export
restrictions on cry. An migration path from 40 to 56 bit is mentioned too -
if restrictions will lower down. (Hope so !)

The second aspect of EFS ist the ?option? to data-recovery (not key recovery
or key escrow). There is one/more Security Agents -the Admin or delegated
persons- whose public key will be used in an additional encrypted-block to
give companies the possibility to restore the !! DATA !!! encrypted with the
public key of that Sec-Agent.

NOTE: The private key of the user will not be used or made public to anyone
at anytime !!  (Replace anyone by Company, Manager, Hacker, Government, FBI
or the like) By this it seems to be true data-recovery as should be. The
open question states itself - what backdoors did/had to M$ implement to cope
with US.

---

Kerberos v5 is something completely different ! It is build up to replace
the silly plaintext and the clever (but broken) challenge/response protocols
of older versions of NT. [Call for Hackers]

On the one hand you will loose lots of compatibility but gain lots of
security. It is strongly used in the authentication of the new directory
structure of NT 5 (another withepaper to read). Kerb v5 also points in the
direction of DCE / *NIX compatibility.

---

IMHO the effort of M$ is quite good but not nearly completed as there are
several needed features not implemented yet and announced for NT 5.x or 6.
And its a BETA if you have it !
As you can think I'm really hot to get the NT5 beta to test those new
features.

---

Discuss it   : )

Peter
simply a german student (and nearly MCSE)









From jya at pipeline.com  Sun Oct 12 11:52:36 1997
From: jya at pipeline.com (John Young)
Date: Mon, 13 Oct 1997 02:52:36 +0800
Subject: Stronghold
Message-ID: <1.5.4.32.19971012183512.006a9260@pop.pipeline.com>



Dimitri and Adam queried about me receiving a C2-lawyer 
letter to DV:

I didn't see the letter, either on cpunks unedited (where I remained
subscribed throughout the experiment and happily continue to be
despite genocidal warnings to desist). Nor did I get a copy directly 
from Dimitri as he claims to have sent as cc, which I doubt.

I suspect that if there is, or was, such a letter, it's either a fabrication 
of Dimitri himself, or a message he calculatedly sought so he could
flag wave it. A page from the book of secret agents.

Dimitri, Allah bless his carcass, is a learned and deft provocateur.

So the problem I've got with Dimitri's allegations is that he's 
demonstrated that he has the skills and godless urge to spoof,
spook and hound anybody who crosses him for Rasputin purposes 
not yet disclosed. Not that that's unusual hereabouts -- and who 
truly wants forgo comforting righteousness to confront an evil soul.

Insecure smart cards, those (we) highly miseducated warriors 
seeking warfare, in our ability to engender and prolong grievances 
against others and deny theirs of us, and draw people into our webs 
of revenge and expatiation, against enemies of imagination and 
passion.

In this DV, among many, is a fierce do-or-die competitor with, say,
Tim May, and I still have a hunch that the two (or many) are in 
cahoots (if only in like mindedness and bulldog tenacity), now, and 
maybe at the beginning of the grand  experiment of testing 
cypherpunkian elasticity with orchestrated provocateurism.
 
All of us stirring the witches brew with fake innocence and real
malice.

None of us are going to quietly give up addiction to bloodlust,
and will forever nightsweat insults and succumb to the urge to 
do vainglorious battle for vaporware honor.

Dementia, due, as ever, to miseducation, haywire ambition, 
filmic fantasies of glory and immortality, dampened only by
inevitable glandular wind-down.

Is this dustup really about the faults of likeminded C2 and 
Dimitri, or our shared need for diversion from dread of 
disappearance without a trace?

Billy Sunday






From nobody at bureau42.ml.org  Sun Oct 12 12:36:55 1997
From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer)
Date: Mon, 13 Oct 1997 03:36:55 +0800
Subject: No Subject
Message-ID: 



http://www.telcomtraining.com/downloads/






From dlv at bwalk.dm.com  Sun Oct 12 16:42:39 1997
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Mon, 13 Oct 1997 07:42:39 +0800
Subject: Stronghold
In-Reply-To: <1.5.4.32.19971012183512.006a9260@pop.pipeline.com>
Message-ID: 



John Young  writes:

> Dimitri and Adam queried about me receiving a C2-lawyer 
> letter to DV:
> 
> I didn't see the letter, either on cpunks unedited (where I remained
> subscribed throughout the experiment and happily continue to be
> despite genocidal warnings to desist). Nor did I get a copy directly 
> from Dimitri as he claims to have sent as cc, which I doubt.

I' quite certain that I cc'd the letter to JYA.

I think JYA is having a credibility problem.

If I send you the letter again, will you place it in your WWW archives?


> I suspect that if there is, or was, such a letter, it's either a fabrication 
> of Dimitri himself, or a message he calculatedly sought so he could
> flag wave it. A page from the book of secret agents.

Are you questioning the authenticity of the letter from C2Net's lawyers?

Give me your fax # and and I'll fax it to you.  Ask c2Net to verify
whether it's authentic.

> 
> Dimitri, Allah bless his carcass, is a learned and deft provocateur.
> 
> So the problem I've got with Dimitri's allegations is that he's 
> demonstrated that he has the skills and godless urge to spoof,
> spook and hound anybody who crosses him for Rasputin purposes 
> not yet disclosed. Not that that's unusual hereabouts -- and who 
> truly wants forgo comforting righteousness to confront an evil soul.
> 
> Insecure smart cards, those (we) highly miseducated warriors 
> seeking warfare, in our ability to engender and prolong grievances 
> against others and deny theirs of us, and draw people into our webs 
> of revenge and expatiation, against enemies of imagination and 
> passion.
> 
> In this DV, among many, is a fierce do-or-die competitor with, say,
> Tim May, and I still have a hunch that the two (or many) are in 
> cahoots (if only in like mindedness and bulldog tenacity), now, and 
> maybe at the beginning of the grand  experiment of testing 
> cypherpunkian elasticity with orchestrated provocateurism.
>  
> All of us stirring the witches brew with fake innocence and real
> malice.
> 
> None of us are going to quietly give up addiction to bloodlust,
> and will forever nightsweat insults and succumb to the urge to 
> do vainglorious battle for vaporware honor.
> 
> Dementia, due, as ever, to miseducation, haywire ambition, 
> filmic fantasies of glory and immortality, dampened only by
> inevitable glandular wind-down.
> 
> Is this dustup really about the faults of likeminded C2 and 
> Dimitri, or our shared need for diversion from dread of 
> disappearance without a trace?
> 
> Billy Sunday
> 


I think Tim May is cool, except when he flames me for now reason.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps






From jya at pipeline.com  Sun Oct 12 18:13:49 1997
From: jya at pipeline.com (John Young)
Date: Mon, 13 Oct 1997 09:13:49 +0800
Subject: Stronghold
Message-ID: <1.5.4.32.19971013005209.009584e8@pop.pipeline.com>



Dimitri wrote:

>Give me your fax # and and I'll fax it to you.  Ask c2Net to verify
>whether it's authentic.

Okay. That's a deal. Send it under the river, and I'll put it on our site.

Fax: 212-799-4003.  

Don't give up if it's busy, the line's also used for losing bets.

My credibility went south years ago, sent packing by disbelieving
housemates and offspring. Inflated baby jesus loves me, though.

John






From aba at dcs.ex.ac.uk  Sun Oct 12 18:27:17 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Mon, 13 Oct 1997 09:27:17 +0800
Subject: D-H Forward Secrecy for E-Mail?
In-Reply-To: 
Message-ID: <199710130116.CAA01032@server.test.net>




Tim May  writes:
> At 2:48 AM -0700 10/12/97, Adam Back wrote:
> 
> >Once you acknowledge that it is more secure to have short lived
> >communication keys (which in my view it very clearly is), it should be
> ...
>
> Just what are some of the issues with us getting D-H-type perfect forward
> secrecy with something like e-mail? I assume this must be possible, of
> course, as D-H is used in just these ways. (The Comsec 3DES phone I have
> does this, of course.) (To repeat what has already been said, forward
> secrecy means some of the important keys are not kept or stored, and so a
> subpoena at some future time to produce the keys used in a communication is
> pointless. Cf. Schneier for more.)
> 
> First and foremost as a requirement would be the need for a back-and-forth
> communication, in a real-time or nearly real-time mode. This rules out
> conventional e-mail with its long a variable latencies for delivery. (Not
> to mention diverse clients and their inability to respond automatically!)

It is difficult to have true interactive PFS for the reasons you
describe.

I did spend some time trying to work out a DH variant which could do
forward secrecy entirely non-interactively, but I couldn't find
functions with the desired properties.  If anyone is interested I can
repost the discussions of this, and my current note pad style
scribblings attempting to find said functions.  I am not convinced it
is impossible; perhaps some one will figure it out at some stage.  (I
have been having an intermittent on going discussion with Hal Finney
on this topic on and off list for the last year or so).

In the mean time what is entirely reasonable to do with email, with
pgp5.5 is to use short lived communications keys.  That is
communications keys which are planned to live for 1 week, say.

This would not result in immediate PFS as with interactive DH, but it
will be PFS at the end of the week.

You could do it more frequently if you wished.

As pgp 5.0 uses key servers directly from the mail client (and some
other clients do also), this all works out because you just publish
your new weekly communications key on the keyserver, and this
eliminates the need for interactive communications with your recipient
which true DH PFS requires.  In fact I think you could do this right
now, if you made it clear to others that your key has short expiry in
your .signature or whatever.  As I mentioned in another post David
Wagner currently does just this.


In my last post in the thread with subject:

	Subject: Re: negative security aspects of GAK compliance 

I think I have proved that you can't sensibly use pgp 5.5 with short
lived communications keys without also adding storage keys.  People
are acknowledging the logic that:

1. short term communications keys are more secure
2. it is a security mismatch to use long term CAK keys with short term
   communications keys
3. if you use short term CAK keys, you can't recover stored email for long
4. if you use short term communications keys the recipient you can't
   even read old email folders
5. therefore you need storage keys also
6. as a side effect PGP Inc's GAK compliant implementation of
   corporate access to stored email is fundamentally flawed, and has to
   be replaced with a different non GAK compliant method.

(I'm working on that last point, it does follow, and I think the logic
is sound).

> Forward secrecy might be arrangable even with long-latency links...it seems
> to me. (Through a series of links, compute and store the D-H parameters,
> then use them with conventional e-mail for the "payload" message?)

That is another way to do DH, and also is entirely reasonable.  You
could have this automatically for example if you were using one of the
IPSEC proposals which has forward secrecy at the IP transport layer.
If the systems which your mail went through to be delivered all used
IP level forward secrecy, the SMTP traffic would all be forward
secret.

However this form of forward secrecy has a different security focus;
keys are owned by machines rather than people, which means that it is
probably less secure.  For example you are relying on the security of
the recipients SMTP server.  

Also the last hop of the link, between the recipients POP3 mailbox,
and the users dial up machine is unsecured typically at the moment.
Some IPSEC security on this link (or SSH tunneling) also would be
possible then allowing that last hop to be secured.  However it is a
bit like GSM mobile phone encryption, the links are secured, but the
traffic goes in the clear through the base station.  The traffic ends
up in clear in the recipients ISPs POP3 mailbox.

Of course, you would actually encrypt the payload email also; the
setup is more secure than no forward secrecy, because with out
tampering with machines.

IPSEC with forward secrecy is a _really_ big win for our side, because
it automatically defeats government GAK plans; what use is GAK for
fishing expeditions if you can't get the ciphertext because all the
links are protected with forward secrecy.  It preempts GAKkers in an
area where they have little control: IETF standardisation processes.
The standards process I think refused to accept "for export" key
sizes, on the grounds that the standards should not be weakened by
political considerations.  With an internationally agreed, widely
deployed IPSEC standard with forward secrecy, the GAKkers will be
screwed because to change it will eventually mean cutting yourself off
from the internet, and there will be much software to unpublish, and
much inertia to overcome.

I presume it is for these types of reasons that John Gilmore and
others are enthused with the tracking the IPSEC standardisation
process, and in John's case in organsing his free S/WAN project to
produce a free linux IPSEC implementation.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710122318.AAA00826@server.test.net>




Jonathan Seybold  writes:
> 
> Adam, one aspect of your suggestion puzzles me:
> 	One thing which concerns me most is KNOWING when a message I send
> (or receive) could be read by someone else. The PGP CMR scheme makes this
> very clear: if there is an extra CMR key, the message may be read by
> whomever controls that key, if not, only the recipient may decrypt the
> message.
> 	If, however, the message is secretly re-encrypted to a corporate
> storage key AFTER it is received, I will never know that.

You will if you mark the key with this information.

This is the same approach PGP is already using to provide the GAK
compliant implementation of corporate access to stored emails.

> The reality is that:
> 	1) Organizations have a legitimate need to recover information. You
> can argue about this as much as you want. 

I'm not arguing.  Of course they do.

What I _am_ arguing is that in designing systems to provide companies
with data recovery mechanisms that you should a) not weaken security
more than necessary, and b) that it would be nice if you used a method
which doesn't introduce GAK compliancy for communications keys.

I presented I think in plenty of detail an alternate mechanism which
is both non-GAK compliant, and more secure.  So what is the problem?
Is there a technical flaw in my solution?

> A great many organizations will simply NOT INSTALL systems which do
> not accommodate this. If businesses, law firms and many other
> organizations will not use PGP, we will not have a viable standard.

Agreed 100%.  This is why I went to great pains to demonstrate
precisely how you could achieve recovery of stored messages in a more
secure and non-GAK compliant way.

> which are easy to use and administer, which balance the rights of
> the individual against those of the organization, and which do not
> mislead people inside OR OUTSIDE of the organization.

my proposed mechanism for stored email recovery copes with all that.

> 	This means, I believe, that they should NEVER INVOLVE HIDDEN BACK
> DOORS THAT USERS ARE NOT AWARE OF.

Agreed.  You can flag backdoors with either solution.

> PGP Inc. has tried to work through these issues in a new way. I think that
> we have agonized through a lot of trade-offs and come up with something
> that will really work -- and work well.

It works well enough, but it could be made much more secure, by
separating storage key functionality from transient message key
functionality.  This would also give you the chance to resolve the
articificially created need for GAK compliancy, which arises because
you are being forced by this lack of distinction between key
functionalities to use one key for both long term storage and what
should be transient communications key usage.

> 	There is always the danger that someone is going to use your tools
> in ways that you do not approve of. We are trying to make it as easy as
> possible for people to do the "right" thing, and to discourage them from
> doing the "wrong" thing (like secret snooping).
> 	 With regard to GAK, the objective should be to accommodate
> legitimate corporate needs without setting in place the foundation for GAK.

If that is PGP's aim, they failed most miserably.

> We have tried very hard to do this by creating the foundation for a highly
> flexible and decentralized approach which allows different organizations to
> do things in very different ways. We have also tried to keep everything
> very visible so that every party to a conversation knows exactly how
> "private" that conversation is.

Decentralised control is good, of course, but the pgp5.5 and SMTP
policy enforcer is a ready to roll GAK system.  

The visibility principle is good but is an entirely separable issue.

> 	I think that the sort of thing that PGP Inc is doing is the best
> defense against GAK. It knocks the pins out from under the argument being
> used in this country that corporate message recovery requires a key escrow
> infrastructure, 

Yes, it is better than a government arranged "key recovery" key
infrastructure.

> and will almost certainly lead to a wide variety of
> organization-specific implementations that will be jealously guarded
> and very difficult to corral. I cannot imagine your 80% scenario
> working in the U.S. where there are so many small and medium-sized
> organizations and so much concern about government intrusion. 

If the OpenPGP standard is to include the GAK compliancy features, and
these competing systems use this standard, as long as the sum of the
OpenPGP compliant systems gets to 80% (or whatever) it doesn't matter
whether this is mostly provided by PGP, or mostly by GAK sellout
companies like IBM, or TIS.  It is a dangerous development to have a
largely fielded compatible set of GAK compliant products, whoever the
providers are.

Email encryption needs to be standardised, otherwise people can't talk
to each other.  This suggests to me that one standard _will_ evolve as
the winner, or if there are other standards, they will be backwards
compatible to this main standard.  A very related example of this kind
of principle in action is the fact that most secured web traffic is
secured by Netscape's SSL.

> I do worry a little more about countries like France, but I have yet
> to see any guaranteed "safe" alternative (including yours) that the
> French Government is likely to accept.

The French Government used require licenses for crypto, which were
hard to come by, and crypto without licenses was illegal.  In that
framework you couldn't see them liking PGP period.

More recently they have been swaying towards allowing crypto without
licenses, but only if it is GAK compliant.  PGP 5.5 & SMTP policy
enforcer should be a sell out.  Maybe y'all should pitch it to the
French government and SCSII (their NSA).

> 	I am very interested in seeing criticism and suggestions for
> improvement and would like to see this discussed and debated as openly as
> possible. In particular, I would be interested in how one could reconcile
> your scheme of separate transmission and storage keys with my concern that
> everyone party to an exchange always be informed about who might be able to
> read that exchange.

That's simple: you already have the mechanism, just put one of those
attributes Jon described on the key stating this fact.

> However, I think that some of this discussion should be separated from the
> Open PGP discussion. NO ONE wants to build any sort of mandatory message
> recovery scheme into the base Open PGP specification. PGP Inc itself is
> committed to always providing a base client software product which does not
> implement message recovery keys.

Glad to hear it.  Can we take it from that that PGP won't be arguing
for the GAK compliancy flag Jon Callas described to be part of the
standard then?  This is needed for said non "message recovery" base
client product to also be OpenPGP compliant.

> 	The key structure needs to be flexible enough to accommodate all
> kinds of uses we cannot now envisage. Yes, I believe that CMR keys should
> be supported -- as should a lot of other things we need to talk about.

CMR keys and the way that PGP has designed their associated flags and
the SMTP policy enforcer app are what make PGP GAK compliant.  

Also there are clear security advantages to _never_ send
communications encrypted to two keys.  There are clear security
advantages to separating the functionality of storage and
communications keys.  Communications keys are the most sensitive of
all, and should have the shortest life times.  In some applications
this could be minutes.

> Finally, let's dispense with the non-productive PGP Inc- bashing. We
> founded this company to take something which was going to die because it
> had no company behind it, and push it forward. PGP Inc was the first step
> in that process. Open PGP is the next step.

The PGP bashing PGP observes is an attempt by the pro-privacy crypto
community to influence PGP to re-think the GAK compliancy, and to
point out the more secure way to implement corporate recovery of
stored email messages without GAK compliancy.

I reserve the right to bash any company which attempts to field GAK
compliant software.

> 	Most companies are very ambivalent about "open" standards. Most of
> the time, "open" to them means something which they control and everyone
> else adheres to. PGP Inc, on the other hand, is very committed to the
> spirit of open standards. We understand very well that we will only be
> successful if there is an open and completely interoperable international
> standard.
>
> 	I also want to assure you that all of the things we do get
> extensively debated within PGP. Thus far, we have always been able to work
> out consensus decisions which, I believe, are more sophisticated and better
> thought-out for that debate. In all of this I have never heard ANYONE at
> PGP Inc. suggest that the company add any feature or capability to the
> software in order to appease any government agency. GAK is just as scary to
> us as it is to you.

If PGP wants to make an additional stance against GAK here are my
recommendations:

1. remove GAK compliancy fields
2. scrap SMTP GAK compliancy policy enforcer app
3. separate storage and communications keys 
4. use shorter lived communications keys giving forward secrecy
5. implement corporate recovery of stored mail folders with escrowed
   storage keys

Forward secrecy is _the_ strongest statement you could possibly make
against GAK.

>	Jonathan Seybold
>	Chairman, PGP Inc.

Adam Back
Protocol designer, Cypherpunks list member






From aba at dcs.ex.ac.uk  Sun Oct 12 18:28:32 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Mon, 13 Oct 1997 09:28:32 +0800
Subject: negative security aspects of GAK compliance
In-Reply-To: <199710121609.JAA09605@s20.term1.sb.rain.org>
Message-ID: <199710130026.BAA00930@server.test.net>




I also was pondering this question as to which purpose the current
"encryption key" could be used for; should it become the
"communications key", or should it be the "storage key".

Clearly it could be used for either; and is in fact currently used for
both, which is where the security problem arises.

What you have described (very clearly as always) is the case for
making the current "encryption key" the "communications key".  You are
forced to make this choice because there is only one key available,
and without a communications key .. well you can't communicate :-)

However this leaves the question: what do you use for a "storage key"?


To see why this argument is important, you can see that you have
painted yourself into a corner where you will be forced to admit that
you need to have separate storage and communications keys.  Probably
this doesn't bother you as you didn't react adversely to my earlier
description of how it was a good idea to separate key functionality.
Let me quote:

Hal Finney  writes:
> This should facilitate more frequent changeover of encryption keys as Adam
> Back describes, which can be good security practice.  It is a significant
> improvement provided by the new key structures of PGP 5.

It is indeed.  It is also very good for another reason: it allows
corporate escrow of encryption keys without simultaneously allowing
the company to forge signatures.

However you have created a problem for your self in the following
argument which suggests that you must have two encryption keys; one
for storage and one for communication.  It also suggests that my
method for achieving corporate recovery of email is better acheived
without the GAK compliancy field (second recipient) which was my
earlier point.

> Adam wrote:
> 
> > This argues that if people are to insist on using the enforced second
> > recipient model for corporate snooping at all, they should for
> > security reasons be at least using short lived communications keys for
> > the GAK compliancy packet also.
> 
> That sounds reasonable, at least if the first recipient is also using
> short lived keys.  Presumably these kinds of policies would be established
> by the corporate security office.  But certainly if one class of keys
> uses short lived keys then it would be logical for the other class to
> do so as well.

By doing it this way you do claw back some of the security lost by
having a second crypto recipient, as you say.  However you now can't
recover communications past the expiry date of the short lived
corporate key.

As the whole point of corporate message recovery is to guarantee
message recovery of stored messages (or at least this is the user
requirement Jon Callas gave in his post explaining the need for CAK),
you have just thrown away much of that ability.  This is an extreme
pity because you are now faced with a dilemma.

Your dilemma is, do you:

a) use short lived encryption keys (for both user and corporate master
key), and have good security but limited recovery of stored encrypted
email after that short period.  Also the poor user won't be able to
even access, never mind recover his stored encrypted email!

b) or do you use a long term encryption key for the corporate master
key, and hence good recovery of stored encrypted email, but poorer
security (and as an additional disincentive end up building a GAK
compliant system.)


This dilemma highlights really very well my point as to why you really
do need separate storage and encryption keys.  Introduce them, and
both problems vanish.

You can then:

- Have short term communications keys for the employee
- Have long term storage keys for the user escrowed with the company
- Have long term key recovery storage key for the company

It's beautiful, everything falls into place, and it's more secure.

Also as a convenient side-effect the way that you build a corporate
stored message recovery scheme under this system is non-GAK compliant,
which saves you from being screamed at by cypherpunks, and from being
dissed in the NYT and other places.  Presumably given Jonathan
Seybolds clear statement of PGP's aims:

Jonathan Seybold  wrote:
>        With regard to GAK, the objective should be to accommodate
> legitimate corporate needs without setting in place the foundation
> for GAK.

this side-effect of removing the GAK compliancy should therefore be
very pleasing to PGP also.

The way that you implement corporate recovery of stored encrypted
messages once you accept the clear need for separate communications
and storage keys is easily derivable from new the key purposes.  It is
basically as easy to circumvent as the previous GAK compliant method.
Several PGP employees commenting on this didn't seem to think
enforceability was that big a deal.  (I agree with them: if all it
takes is to super encrypt with PGP itself, it's not worth losing sleep
over.)

Here's how to do corporate recovery of stored encrypted messages, now
with the new separated storage and communications key functionality:

1. Corp. employee receives encrypted email, the email is encrypted to
the employee's short life time communications key.

- employee decrypts email with pgp5.6 client

- pgp5.6 client encrypts the plaintext to users long term storage
  key, and to the companies recovery key as a second
  "storage-recipient", and places in received mail folder

2. Corp. employee sends encrypted email

- The pgp5.6 mail client encrypts plaintext of email to users long
  term storage key and to the companies long term storage recovery key
  and stores in the sent email folder

- The pgp5.6 mail client encrypts the plaintext of the email to the
  recipients short lived communications key and passes on to the MTA

3. Normal user access of encrypted stored email

- user's email client decrypts stored email with users storage key

3. User forgets password, or dies, or leaves in a huff, company needs
access to stored email

- company uses company recovery key to decrypt users stored email


An alternate set up would be to escrow the users long term storage key
with the company.  Basically equivalent.  But I think it is probably
easier to use multiple recipient as it saves the headaches of having
to securely transmit 10000 users storage keys securely.  Much easier
to install the software with the department/company recovery key bound
into it, and to remote update the company recovery key by fetching the
new from the company key server when it expires.

There are lots of other issues of course, with regard to architecture
of recovery setup.  However there is a basic equivalence between key
escrow and session key recovery methods, and you can acheive all kinds
of departmental escrow jus the same as you could with the previous
system.

> Actually it's likely that the corporation will change its shared access
> keys more frequently than user keys, at least if they are using an
> access model where there are relatively few shared keys.  It will be
> easier to change a few keys which are controlled by corporate officers
> than to get every one of 10000 employees to generate a new key every week.

I can't see any reason why you would not be able to entirely automate
and hide the process of generating new communications keys every week,
every day, or _every communication_.

The process can be handled automatically by the software.

With El Gamal you have a very computationally cheap way to generate
keys other than the first key; discard the private components, and
treat the public modulus as a pre-computed prime as you currently do
for the fast key generation option on EG key generation.


I feel somewhat better about this post than previous ones; I haven't
been rude to PGP, and I feel some progress has been made in clarifying
things.  Perhaps it's just interacting with Hal, who always was one of
the most level headed people on cypherpunks; it's much harder to pick
faults in what he says, and he doesn't make ill thought out political
statements.

I think there are still some issues to resolve if we start to talk
about "per communication" communication key updates, but for per week,
or per month or whatever, I think the above is good.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710130033.BAA01002@server.test.net>




I wrote:

> However another aspect to this argument over credentials is a comment
> that arose when another person with a PhD who used the title "Dr" in
> his From line subscribed to the list.  That person was Fred Cohen.
> His above average education in having his PhD didn't seem to reflect
> in his posts, and several people commented on this fact.  It seems to
> be that listing qualifications in From fields is asking for rude
> comments, or it seems to attract criticism :-)
> 
> I can say I like the practice.
    ^^^

typo, I meant to write "I _can't_ say I like the practice".

And yes, Jim Choate, re moderation re-runs some of us do have too much
time on our hands :-)

We make this time by not sleeping much, jeeze it's 1:30am and I'm just
starting to get going on the GAK compliancy argument in another thread
again, and I've got an article submission deadline for tomorrow also,
which I haven't even started yet!

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710130223.WAA15345@users.invweb.net>



In <199710130116.CAA01032 at server.test.net>, on 10/13/97 
   at 02, Adam Back  said:

>As pgp 5.0 uses key servers directly from the mail client (and some other
>clients do also), this all works out because you just publish your new
>weekly communications key on the keyserver, and this eliminates the need
>for interactive communications with your recipient which true DH PFS
>requires.  In fact I think you could do this right now, if you made it
>clear to others that your key has short expiry in your .signature or
>whatever.  As I mentioned in another post David Wagner currently does
>just this.

Adam,

Have you considered the logistical nightmare that this would cause?? I can
see that you are unaware of the precarious state the current PGP Public
Key Server Network is in. Right now it is getting by but this increase in
load would bring it all to a screeching halt. There have been suggestions
of moving key distributution to the DNS but I seriously doubt even it
would handle the traffic.

Also what happens to the "web of trust" in such a system of high key
turnover?

Exactly how much added security is provided by all of this?? While Forward
security via DH "may" be more secure is the added expense of implementing
such a system justified?? We all could switch to using OTP's for maximum
security but I doubt that few if any would justify the cost of such a
system.

PS: current PGP key format does have a field for key expiration. Until 5.0
it was only used in the Viacrypt version.

-- 
---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
---------------------------------------------------------------






From rah at shipwright.com  Mon Oct 13 10:38:32 1997
From: rah at shipwright.com (Robert Hettinga)
Date: Mon, 13 Oct 1997 10:38:32 -0700 (PDT)
Subject: DCSB: Carl Ellison on Identity and Certification for Electronic Commerce
Message-ID: 



--- begin forwarded text


X-Sender: rah at pop.sneaker.net
Mime-Version: 1.0
Date: Mon, 13 Oct 1997 12:52:18 -0400
To: dcsb at ai.mit.edu, dcsb-announce at ai.mit.edu
From: Robert Hettinga 
Subject: DCSB: Carl Ellison on Identity and Certification for Electronic
 Commerce
Cc: cme at cybercash.com
Sender: bounce-dcsb at ai.mit.edu
Precedence: bulk
Reply-To: Robert Hettinga 

-----BEGIN PGP SIGNED MESSAGE-----


               The Digital Commerce Society of Boston

                            Presents

                          Carl Ellison
                         CyberCash, Inc.

                    Identity and Certification
                     for Electronic Commerce

                      Tuesday, November 4, 1997
                             12 - 2 PM
                 The Downtown Harvard Club of Boston
                   One Federal Street, Boston, MA



It is a common belief that you can not trust someone on the net
unless/until you establish his "identity" via an interactive protocol in
which the other person establishes proof of ownership of a given private
key and a transfer  of certificates which establish a binding between that
key and a person's  "identity" (in the form of a common name plus enough
information to make it unique in some global hierarchy of names).  This
talk will establish that the proof of key ownership is the primary value
obtained from this process and that the global hierarchy of names is
effectively useless.  It will propose certificates for electronic commerce
which use a person's public key to identify him, avoiding the hierarchy of
names.


Carl Ellison is a cryptographic engineer with CyberCash, Inc., of Reston
VA. He has been involved in cryptography since about 1978 and seriously
involved since doing his first cryptanalysis in 1986.  With the
introduction of PEM in the early 1990's, he found the PEM certification
process to be a killing roadblock and has studied certification and the
establishment of  identity since that time.


This meeting of the Digital Commerce Society of Boston will be held on
Tuesday, November 4, 1997, from 12pm - 2pm at the Downtown Branch of the
Harvard Club of Boston, on One Federal Street. The price for lunch is
$30.00. This price includes lunch, room rental, various A/V hardware, and
the speaker's lunch. ;-).  The Harvard Club *does* have dress code: jackets
and ties for men (and no sneakers or jeans), and "appropriate business
attire" (whatever that means), for women.  Fair warning: since we purchase
these luncheons in advance, we will be unable to refund the price of your
lunch if the Club finds you in violation of the dress code.

We will attempt to record this meeting and put it on the web in RealAudio
format at some future date

We need to receive a company check, or money order, (or, if we *really*
know you, a personal check) payable to "The Harvard Club of Boston", by
Saturday, November 1, or you won't be on the list for lunch.  Checks
payable to anyone else but The Harvard Club of Boston will have to be
sent back.

Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston,
Massachusetts, 02131. Again, they *must* be made payable to "The Harvard
Club of Boston", in the amount of $30.00. Please include your e-mail
address, so that we can send you a confirmation

If anyone has questions, or has a problem with these arrangements (We've
had to work with glacial A/P departments more than once, for instance),
please let us know via e-mail, and we'll see if we can work something
out.

Upcoming speakers for DCSB are:

December  James O'Toole        Internet Coupons
January   Joseph Reagle        "Social Protocols": Meta-data
                                 and Negotiation in Digital Commerce
February  Donald Eastlake      SET


We are actively searching for future speakers.  If you are in Boston on
the first Tuesday of the month, and you would like to make a
presentation to the Society, please send e-mail to the DCSB Program
Commmittee, care of Robert Hettinga,  .

For more information about the Digital Commerce Society of Boston, send
"info dcsb" in the body of a message to  .
If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in
the body of a message to  .

We look forward to seeing you there!

Cheers,
Robert Hettinga
Moderator,
The Digital Commerce Society of Boston


-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQEVAwUBNEJRn8UCGwxmWcHhAQGICggAoRXxsE1E2LsAxMX0jeg0nWbBxTKV5u6k
riMP3EGN1UC/niyJu5rz8cB98y+YpdhfMBcw/qvgPvqt8h/ep897KMNKvVtYGloE
8Uyb6xf8czX3cD2VQ/M5c+eTEcjlorojUYSeo3d2eyc2e1aX+g23ydVkfawZPDBa
f5DCUs5hN1s+ehThV9QpsyN31lpuc4YgUiSpWZCscbkrpXPM0zY2m/GhMdgNXw97
sHs2P3Pmnkgt61Yfkf6u1pMdxt3hpmgv78LLuFaZcsyIAk2Aur2yku53FqarFomo
55Qu1BnrRYH21+RE757wLzic4fXreYnkfNCo2bz/RXLkO7piVwqGsQ==
=E24t
-----END PGP SIGNATURE-----

-----------------
Robert Hettinga (rah at shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/
Ask me about FC98 in Anguilla!: 



For help on using this list (especially unsubscribing), send a message to
"dcsb-request at ai.mit.edu" with one line of text: "help".

--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/
Ask me about FC98 in Anguilla!: 







From ravage at ssz.com  Sun Oct 12 20:11:32 1997
From: ravage at ssz.com (Jim Choate)
Date: Mon, 13 Oct 1997 11:11:32 +0800
Subject: James A. Michner [non-crypto]
Message-ID: <199710130327.WAA30859@einstein.ssz.com>



Hi,

Thought some of you might care to know that James A. Michner the Pulitzer
prize winning author who lives here in Austin, Tx. has decided to take
himself off the kidney dialysis machine that has been keeping him alive.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http:// www.ssz.com/  |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From nobody at REPLAY.COM  Sun Oct 12 20:43:33 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Mon, 13 Oct 1997 11:43:33 +0800
Subject: Auto-archiving cleartext is GAK
Message-ID: <199710130335.FAA19075@basement.replay.com>



Advocates of the model where software is automatically archived on
receipt, either in cleartext or re-encrypted with a corporate key,
need to be aware that there are problems with it:

No notification to sender about the policy.

Imagine encrypting this mail to your friend sue at microsoft.com: "Hey Sue -
it's been a while.  Is your boss still being such a wiener?  That was a
great imitation you did of the jerk at the party last month.  He still
doesn't know you're shopping your resume around, right?  What a luser."
You might have thought you had a certain level of privacy when you
encrypted it to your friend's personal key, but you didn't.  This is going
to cause embarrassment and misunderstandings.  People should know if their
mail is going to be automatically saved in the clear to a company archive.
The best way to make sure of that is to have the sender be the one to do
it, or not.

No way to prevent third-party access.

With the corporate message recovery feature, the sender has the
option of simply ignoring the recovery key and sending it encrypted just
to the recipient.  Some corporations won't let it through, others will.
Some companies will want mail to be made recoverable by default, while
still allowing an escape clause for personal mail and special purposes
(like for "sensitive" mail which needs protection against subpoena
and discovery).  They can use the "optional" CMR mode.  Again, senders
are always notified as to which mode is being used by a given company,
and senders can be confident that if they don't use the third-party key,
no access will be possible.  With automatic encryption and archival on
receipt, all mail will be archived, and senders have no notice and no
guarantee that stated policies will be followed.

No escape via super-encryption.

Even if the company is mandating a recovery key and filtering out
messages which aren't encrypted to it, the sender still has the option to
super-encrypt with the recipient key alone, before sending the message
encrypted to the corporate recovery key.  This ensures that only the
recipient's personal key can read the message.  With software which
automatically saves the cleartext of the message, once the user reads
the data it is available to the corporation via the snoopware.

Facilitates GAK!

Suppose this solution is adopted, and software is developed which
automatically re-encrypts received email and sends it to a secure archive.
It's robust and works with a wide variety of email packages.  Now the
government could simply mandate this to be used for all mail reading
software.  The secure archive would be a remote archive maintained by
the FBI to protect public safety.  All plaintext would be sent there,
encrypted by the FBI key.  The business software would already support
this.  This is GAKware!  Unlike with a CMR system, the sender would
have no way to prevent access.

Can't handle forgotten passphrases.

People forget passphrases all the time.  With re-encryption on receipt,
there is no way to recover gracefully from this error.  All the incoming
encrypted data is lost until you can notify everyone who has sent mail to
resend it, and get your new key out to all of them.  These may be purchase
orders, sales leads and other important documents which represent lost
business if they can't be recovered.  This is going to invite people to
use poor security practices like writing down passphrases or choosing
ones which are easy to guess.  Worse, it...

Invites key escrow.

In order to prevent this problem, employees may be forced to share
their secret keys with corporate management.  Software will be written
to facilitate this process.  Crypto companies are already doing this.
Nortel Entrust allows key generation by management, where employees
are given the keys and management keeps a copy.  Shades of Clipper!
This also fails the notification requirement.  Don't believe me?  Take a
look at this description of the Nortel Entrust product:

> Recovering Lost Keys
>    
>    Many data security systems require that users have passwords to access
>    their keys. However, with some information security systems, disaster
>    strikes when users forget their passwords. When users of such systems
>    forget their passwords, not only do they lose their keys -- they also
>    lose all the information encrypted with those lost keys (forever).
>    Entrust, however, provides an easy way to securely recover keys.
>    
>    If users forget their Entrust passwords, they call their Entrust
>    Administrator to request that their encryption key pairs be recovered.
>    After setting up the users for key recovery using Entrust/Admin, the
>    Entrust Administrator provides each recovered user with a new
>    reference number and authorization code. Users then enter this
>    information as part of the Recover User operation in Entrust/Client.
>    This operation sets up a protected communication session between
>    Entrust/Client and Entrust/Manager for encryption key pair recovery.
>    When Entrust/Client recovers a user's encryption key pair, it
>    automatically creates a new signing key pair.
>    
> Updating Keys
>    
>    While users can recover their key pairs if they forget their
>    passwords, there are some situations in which users may want to get
>    new key pairs altogether. For instance, the security policy of an
>    organization may dictate that users get new key pairs every two years.
>    In this case, a Security Officer uses Entrust/Officer to specify that
>    key update occurs every 24 months. The term key update refers to the
>    automatic creation of new encryption key pairs and signing key pairs
>    at specified times. Any Security Officer can specify the frequency of
>    key updates.
>    
>    Every time users log on to Entrust, the software checks to see if key
>    update is required. If this is the case, Entrust/Client makes a
>    request to Entrust/Manager for a new encryption key pair. Once the new
>    encryption key pair is generated, Entrust/Manager delivers the new key
>    pair in a protected communications session. Delivery of the new
>    encryption key pair is completely transparent to the user.

No system is ideal.

Before pushing this re-encryption model as a panacea, think about the
implications.  No system which provides automatic access to business data
is going to be privacy friendly.  Any such system can be perverted into
supporting GAK.  Load it up with all the disclaimers you like, but if
you advocate software which contains key escrow and which automatically
provides cleartext to third parties, you are not advocating software
which protects privacy.  Be prepared to be called an advocate of GAK next
time you push for software which automatically archives cleartext, because
if it can save it for business, it can save it for government.






From dlv at bwalk.dm.com  Sun Oct 12 20:48:45 1997
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Mon, 13 Oct 1997 11:48:45 +0800
Subject: James A. Michner [non-crypto]
In-Reply-To: <199710130327.WAA30859@einstein.ssz.com>
Message-ID: 



Jim Choate  writes:

> Thought some of you might care to know that James A. Michner the Pulitzer
> prize winning author who lives here in Austin, Tx. has decided to take
> himself off the kidney dialysis machine that has been keeping him alive.

ObPerrygram: unless there were stego messages hidden in his books, you're
waaaaaaaaaaaay off-topic, Jim.

Harold Highland, whom I've had the honor of meeting a few times, passed
away about a month ago.  There's a eulogy by Gene Spafford in the IEEE
Electronic Newsletter on Security and Privacy.

Also a good friend who worked with me at NASA (and worked on the Apollo
project before) just passes a way.

Feels like a plague on good people.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps






From aba at dcs.ex.ac.uk  Sun Oct 12 21:04:59 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Mon, 13 Oct 1997 12:04:59 +0800
Subject: the GAK meme war: beware of NewSpeak and Minitru memes (was Re: Is Adam Back falling for one of Minitru's tricks?)
In-Reply-To: <199710121557.RAA13185@xs2.xs4all.nl>
Message-ID: <199710130339.EAA01978@server.test.net>




Zooko Journeyman  writes:
> 
> Dammit Adam.  I respect your opinion and your knowlege about
> these issues, but I think that you've been fooled by Minitru's
> machinations.

I'm all ears to such an alarming prospect.  I also respect the
Journeyman's insights (to return the compliment :-)

We have to be watchful that we don't start using NewSpeak, and to not
get inadvertently drawn into perpetuating the GAKkers insidious false
memes -- often out-right fallacies -- spread by the GAKkers as part of
their mandatory GAK campaign.  It is often staggering how successful
the GAKkers are in spreading these memes, given each GAKker meme's
inherent fallacy once it is examined at all closely.  Often the terms
the GAKkers choose for their memes are hijacked existing technical
terms with nice wholesome sounding rings to them.  "key escrow", "key
recovery", etc.

Even in these circles, on cypherpunks, we see it.  People using the
NewSpeak terms "key escrow", "key recovery".  Having the press release
their memes as "news", and having the press give the photogenic chief
GAK spokesperson Freeh lots of air time helps the GAKkers cause no
end.  The "four horsemen of the infocalypse" being the GAKkers other
favourite false meme -- that you can prevent criminals using crypto by
restricting the law abiding populace's access to non GAKked crypto.
And another false meme is that export controls are designed to stop
terrorists obtaining crypto -- what they are designed to do is hinder
companies building in crypto, by with-holding 50+% of the market place
for strong crypto from US companies, and by spreading FUD.

The efforts of Tim May and others to provide alternate non-NewSpeak
terms and to propagate those helps a lot.  Cypherpunks have had some
success in this area.  Carl Ellison's 'GAK' acronym is doing well,
other cypherpunks PR wins being the Big Brother Inside logo & sticker
campaign, KRAP acronym (dumbly named by the GAKers themselves: Key
Recovery Alliance Program).  Also "four horsemen of the infocalypse".

(My reason for not attributing all these pro-crypto phrases and memes
is that I don't know where they all came from -- the majority I think
Tim is responsible for, but like all good memes they become part of
the langauge, like the rhetorical question "Who is John Galt?" in Ayn
Rand's novel.  People often don't know the origin).

Another succesful cypherpunks meme is to continue calling GAK GAK in
the face of new editions of the NewSpeak dictionary handed down from
DC, where new PR terms are given to new attempts at GAK.  For example,
first there was Clipper I, which backfired to the extent that
`Clipper' ended up meaning `big brother wants to read your mail, and
tap your phones'.  Then they tried a new name, cypherpunks called it
clipper II, which partly blew the GAKkers cover, as they were trying
to sneak it through under a different name.  We are now on Clipper IV,
or V, I've even lost count!  We're still calling it GAK, or Clipper
XII or wherever the count is.

Anyway, lets discuss Zooko's insights into this NewSpeak issue:

> Minitru would _like_ for the world's businessmen to be presented
> with a choice between "brittle" crypto-- private keys held solely by
> owners, plaintext available solely to recipient, where every
> forgotten password, missed keystroke or disgruntled saboteur means
> the company loses valuable data permanently-- or GAKked crypto where
> these problems of brittleness are solved by Big Brother paternally
> providing backups when you find yourself in need.

I agree with that 100%.  You can see that meme being spread in press
releases, and in quotes from Freeh etc.  Jon Callas was perpetuating
this meme in his post about PGP's controversial business snoopware.
The whole "key recovery" PR renaming of GAK was intended to exploit
this spin:

 "businesses need access to their information, therefore they need the
  government to have access to their communications".  

Now hold-on-there one minute!  Why should businesses give the
government access to keys for recovering their own data?  Surely they
would keep backup copies of their own keys in their company safe, or
with their lawyer, or whoever the want!  Also (and it simply _amazes_
me that people do not notice this switch), companies data is on their
frigging disks! .. not flying around in transit bouncing between flaky
SMTP servers.  Lucky Green occasionally steps in to correct this myth.
Tim May did a nice expose of this myth yesterday.  The cunning GAKker
ploy that so called "escrow agents" or "trusted third parties" would
be "independent" was just so much fluff to divert criticism from
giving keys directly to government.  It means the same thing, and the
NSA reserves rights to the whole master key database anyway. (TTP
being another GAK term, an oxymoron if ever I heard one).

> In reality neither of these is an acceptable alternative for 
> serious use of strong crypto in business.  Escrow is a 
> valuable business concept, which was invented by businessmen 
> centuries ago and has been used ever since because it 
> provides significant value to the participants who voluntarily
> enter into the escrow contracts.  In the context of the 
> information age and crypto, escrow will be one of the basic 
> building blocks of the new era, both for basic business 
> purposes-- serving the same purpose that escrow has always 
> served but with heightened importance to pseudonymous, global 
> commerce-- and for building cryptosystems which are robust in
> the context of data being shared among many people (e.g. a 
> company).

Yep agree.  So long as we're talking about escrow of data stored on
disks.

I do not believe there is a case for escrow of communications in
transit.  I have been arguing that the most secure, and least GAK
friendly way of implementing escrow of archived email communications
is to decrypt the communications and store them with an escrowed
storage key.

> The issue is not how many people are given access to your keys
> or your data.  The issue is whether you maintain your right to
> control who those people are (including, but not limited to, 
> your right to decide that you will be the only person with 
> access), or whether others with delusions of grandeur and 
> obedient police forces can compel you or trick you into giving
> them access.

I agree with this statement also.

However some of the technical issues feed back into the political
process, and mean that it is dangerous to build certain types of
escrow systems, because they can be useful to GAKkers.  PGP Inc's
pgp5.5 and SMTP policy enforcer is 100% GAK ready.  It could be used
to implement a GAK system tomorrow, for example for the Chinese, or
Singaporeans who seem to want GAK, if PGP could export it to them.  We
_know_ the USG/NSA/FBI want to have mandatory GAK also.  Is it really
wise to hand them software and an installed user base on a plate like
that?

So I am also arguing against systems which are GAK compliant in this
way.

You will notice that a central theme for the GAKkers is that they want
to snoop communications, and so they naturally enough primarily want
access to communications keys.

Well this functionality is clearly not required for business data
recovery, nor even for recovery of archived email (when it is
re-encrypted with different storage keys, or just decrypted and stored
in plaintext).

So as long as you build corporate data recovery systems which truly
only recover storage keys, we're all fine and happy.


The meme that you need to have escrow of keys used to protect
communications in transit in order for a company to retain recovery
capability of it's employees mail folders is an especially tough one
to kill.  Even you, Zooko, and PGP Inc are guilty of that one.

One problem with this meme is it didn't have a label for a long time,
there was no term which described the problem, so it got lumped in
with CKE (Commercial Key Escrow) or CAK (Company Access to Keys) which
have much less negative overtones.  The chant "CAK good GAK bad" is
burnt into many peoples brains.

PGP Inc kindly provided a label for this problem, doubtless in their
minds at the time it was a friendly term: it is 

	CMR or "Commercial Message Recovery"

However there-in lies the precise same fallacy that the GAKkers are
promulgating with the "key escrow" and "key recovery" memes, that you
somehow need escrow of transient communication keys to access data
stored on your frigging disk!

PGP have propogated the GAKkers "key recovery" fallacy into the
corporate world with their CMR term, and GAKware implementation.  CMR
sounds reasonably palatable because they, like the GAKkers, chose it
to sound positive.  The sad thing is they probably didn't even realise
they were being fooled by the Minitru "key recovery" meme still, so
powerful was the meme that it blinded them to the falacy.

One problem with CMR is that it is a security flaw; it is bad security
practice to put second doors into transient communications, and that
it is GAK compliant.  And CMR is GAK compliant because if you do what
PGP have done with their CMR implementation, you have done want the
GAKkers want you to do with their "key recovery" and "key escrow"
campaigns.  You have implemented something which provide them on a
plate a really slick smooth migration path to mandatory GAK.

"GAK compliant" is the term I coined to express this aspect of the
problem with CMR.

We could kind of use a term for CMR which expressed it's negative
aspects, it is basically the technology the GAKkers want you to use
but being used for Companies.  This is what the GAKkers were trying to
do with the KRAP (Key Recovery Alliance Program) which was clipper
IV(?)  Only now PGP are inadvertently doing it for them.

Candidates which explain what CMR really is are Tim's "snoopware", or
perhaps "GAKware".  GAKware seems like a fair description, and is a
little harsher than snoopware.  It seems a fair description because it
is basically GAK enforcement technology being offered for sale to
companies under the guise of "data recovery".

> Don't let Minitru continue to confuse the issue-- you'll be 
> left with nothing but false alternatives.  Escrow is good and 
> necessary and inevitable-- ask any businessman.  GAK is not
> escrow.  Escrow is not GAK.

The above is the point were we diverge, and I think it is you, Zooko,
who has been conned by Minitru, or at least by PGP Inc, which was in
turn conned by Minitru.

Now that we have the terms we can express the problem concisely:

- Company data recovery of stored data is good -- companies need
  availability of their data

- GAK is bad -- because GAK means governments wanting master snoop
  keys into your messages, so that they can keyword scan them on
  fishing expeditions

- GAKware used for commercial applications is bad, because it provides
  the GAKkers with a deployed software base

- GAK compliancy in GAKware/snoopware is bad because it provides the
  GAKkers with a smooth migration path from:

	no GAK -> business deployed GAK -> mandatory GAK

  where business GAK is the process PGP Inc are starting right now by
  deploying GAK compliant software.

- Companies should acheive recovery of encrypted stored copies of
  communications which are encrypted with transient communications
  keys by encrypted stuff on disks with "storage keys", and stuff in
  transit with "communications keys".

- Communications keys should be short lived, the shorter lived the
  better, because this is the antithesis of GAK: not only can the
  government not snoop your communications, but they can't get you to
  decrypt them afterwards, because you won't have they keys.  (Forward
  secrecy being basically that you delete keys after use, or after some
  tunable, relatively short time period, 1 hour, 1 week, etc)

Say no to PGP Inc GAKware.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: 



At 9:50 AM -0700 10/10/97, Tim May wrote:
>I don't think we've yet seen a good example of massive amounts of e-mail
>being examined in a "discovery" process, yet, but we saw the effects on IBM
>during its antitrust issues in the 70s. Basically, every scrap of paper,
>every desk calendar, every internal memo, everything, had to be turned over
>to opposing counsel.

A group from IBM who had developed a telephone based audio messaging system
many years ago described it at Share (the IBM large systems users' group)
many years ago.  They described their system as being used by the top level
IBM executives.  They also described the aggressive "no backups" policy and
mentioned the discovery process in the Justice Department vs. IBM suit.
Tim's point is very real.


-------------------------------------------------------------------------
Bill Frantz       | Internal surveillance      | Periwinkle -- Consulting
(408)356-8506     | helped make the USSR the   | 16345 Englewood Ave.
frantz at netcom.com | nation it is today.        | Los Gatos, CA 95032, USA







From frantz at netcom.com  Sun Oct 12 21:06:56 1997
From: frantz at netcom.com (Bill Frantz)
Date: Mon, 13 Oct 1997 12:06:56 +0800
Subject: CAK as a really bad form of corporate networking
In-Reply-To: 
Message-ID: 



At 10:28 AM -0700 10/10/97, Tim May wrote:
>One way to look at the market for CAK is that a company is too flaky to
>have a corporate network or backup strategy and is using CAK as a kind of
>crude networking scheme. E-mail, with cc:ing of the company crypto czar, is
>a way to archive or pool company traffic. A rather back-assed approach, it
>seems to me.

Another way to look at it is:  Large corporations aren't much different
from governments.  Their management doesn't know what is going on down in
the trenches, and they are scared.


-------------------------------------------------------------------------
Bill Frantz       | Internal surveillance      | Periwinkle -- Consulting
(408)356-8506     | helped make the USSR the   | 16345 Englewood Ave.
frantz at netcom.com | nation it is today.        | Los Gatos, CA 95032, USA







From attila at hun.org  Sun Oct 12 21:08:52 1997
From: attila at hun.org (Attila T. Hun)
Date: Mon, 13 Oct 1997 12:08:52 +0800
Subject: GET OFF THE DIME: PGP 5.5: Attitude
Message-ID: <19971013.035233.attila@hun.org>



-----BEGIN PGP SIGNED MESSAGE-----

    There is one all important consideration in this debate:
 
        would you rather have PGP, Inc. with its preeminent 
        stature in the defense of freedom, freeware, and
        privacy as well as an established, TRUSTED product 
        defining THE system which meets the need of the 
        free world business, but is not selling out to 
        GAK or CAK? 

        or, would you rather see IBM, HP, TIS and others with 
        their GAK products and potentially even backdoors?
        are any of these vendors even planning to give us 
        source code so we might have a warm and fuzzy feeling
        until someone blows a hole in it 10 years from now?

        or, how about Bigfoot from the jungles of Redmond? 

        PGP is the *only* small business with a name for
        the corporate MIS types.

        the answer is simple; stop arguing, squat, and move.

    When I initially composed this message it read:

        now, if the idealists, and the opinionated pragmatists
        would actually reflect on exactly what Jon Callas said,
        starting with Locke, instead of what they "think" he
        said, they might understand the philosophy for data
        storage and recovery which PGP is proposing versus GAK
        or CAK which PGP is not proposing.

        the more vituperative among us can be dismissed out
        of hand as the issue is less of personal privacy than
        it is one of reasonable property protection, 
        documentation, and defensible security provisions.

    Jon Callas generally stated the problems adequately, and the 
    solutions or conventions, in the running duels; unfortunately
    Jon is on the wrong side in an anarchic forum: as the bear;
    Jon's protagonists are the dogs, and we all know the results of
    the bear pit. truth was not a problem per se, just reason.

    as I think I made clear in my original FOCUS presentation, GAK 
    (or CAK) must be dismissed out of hand. The issue reduces to: by
    what means is general responsibility accomplished? most ignored
    my premise, the few attacked for the same reason they always
    attack: crypto-anarchy, take-no-prisoners, or the only good
    JAKer [sic -freudian] is a dead one.

    historically, all of the elements of multi-key encryption
    with separate keys for signing, transmitting, and archiving
    have been available options with scripts or program wrappers 
    since PGP burst on the freeware zone in its present incarnation.

    Meanwhile, the battles raged on with the defiant pragmatism
    of Adam Back balanced by Bill Gieger's careful affirmation of
    my premises in my prior FOCUS message response to Jon Callas: 
    there is nothing in PGP 5.5 which can not be done with scripts
    and PGP 2.6. In fact, I stated my policy: session key and
    storage key. I had not implemented a separate signature key,
    but will be limiting my current public key to a signature key;
    and, creating a new encryption key. a good point, and well 
    taken.

    other than possibly Bill Gieger, not one of the cypherpunk
    idealists, nor rationalists, in this thread has ever been 
    required to face the realities of an employer.  if they had been
    or are employers, they would understand all the perqs they
    presume are freebies or rights, are mere privileges --including
    personal freedoms not in the interest of the employer during
    company work periods, on company premises, or representing the
    company outside the facilities.

    I empathize with Jon Callas' complaint about the blues, and his 
    plaintive "wanna trade" comment to Adam, but the blues come
    with the turf; likewise, the position of the buck stops here 
    gives the idealists another nail for the coffin they have
    conjured for Jon and PGP "selling out to the enemy".

    the occupation of employer can be one of the least satisfying 
    ways of living; department heads are not far behind --it's all
    about personal (not personnel) relations and diaper changing.
    as a scientist and developer, I never really enjoyed the 
    boss tasks; more than once, I closed out when my function
    deteriorated to leader of the nursery.

    If PGP, hopefully with support, cooperation, and assistance from
    Cypherpunks, can offer workable and tenable solutions, which can
    satisfy the real needs of business for defensible audit trails,
    and which offer basically the same protection as current paper
    storage trails, PGP may be able to deploy their system as the 
    *de facto standard* before any of the other systems take root.

    If PGP does not provide workable solutions for business, from
    simple PGP 2.6 to the SNMP managed "enforcer" and a simplified
    "frying the egg" means of establishing filing systems which meet 
    both the overall needs of the business and the compartmentalized
    needs of restricted area and secure operations, some one else 
    will --and corporate {a,im}morality applies their myopic vision
    only to the bottom line --GAK.

    for instance, if PGP can deliver *encryption management systems*
    which can provide control of the entire spectrum of corporate
    needs, perceived or real, such as:

      * no key escrow or management key (preferred, obviously)
      * session key with storage key (incl. some multi-key)
            group, department, corporate, etc.
      * multiple public key encryption (foolish for external)
      * limited CAK (certainly not desirable)
      * general CAK (an unreasonable sin)
      * GAK (the unpardonable sin)

    they have given business the *choice* of system management. It 
    is important to keep in mind that the basic PGP product will
    do any of these formats as it currently stands with external
    controls. different business models have different levels of
    security requirements. hard core cases will buy in because they 
    understand GAK and their foolish corporate mentality has no
    concern for the individual --get it installed, and the troops
    will push to bring it back to the preferred model using company
    security, not employee privacy, as the argument.  

    better GAK with PGP than asking PGP to refuse to permit the use 
    of their product in a GAK/CAK environment. GAK and CAK have no 
    relationship to PGP --they are a corporate mindset and there is
    absolutely nothing PGP or cypherpunks can do about it --except
    educate the customers that there are far more secure methods of
    date recovery than hanging their shorts out in public for big
    brother to cut the clothesline.

    In other words, why should any cypherpunk, except our resident
    nihilistic anarchist, object if PGP's SNMP system provides
    industry with tools which can deploy the **less** objectionable
    control systems?  or even the objectionable ones?

    if PGP does not or is not willing to provide the systems, and in
    the absence of these tools from an alternative *trusted* source,
    we will see GAK, just plain unabridged GAK, the simplest means to
    control for the Corporate Operations Officer (COO), or some
    other equivalent abomination spreading across the land like the
    ominous black cloud roiling across the land from an oil refinery 
    fire.

    major corporations, most of them victims of many years of
    litigation, subpoenas, and judgements with their peers and 
    with the government will just cave in to GAK --it covers all the
    bases, albeit very insecurely, but that is the fire next year: 
    worry about tomorrow tomorrow.

    despite the general hue and cry of selling out to the enemy 
    which arose in cypherpunks with the PGP defense department 
    contract, as long as PGP 5.5 and its SNMP enforcer are
    implemented as Jon Callas claims, that contract may be the best
    government friend this community has today. PGP will be placing 
    a product which covers the full spectrum of "privacy invasion"
    within the forces of evil.

    there are two ways to define a product in a market of this 
    magnitude, a market which matches David and Goliath. PGP, by
    virtue of its freeware status is the standard the world over;
    by selling to the enemy, PGP will have proven it can be all
    things to all people --use what you need from it.

    Bubba/Goliath has been rumbling and jousting, but his own parts
    are buying the product that works.  a very critical point.

    secondly, by market penetration, F{reeh,uck} is left standing in
    the middle of street, pulling his short arm.

    but if David fails to hurl that stone, Bubba will hand us GAK.

    the real issue in privacy is where does privacy begin, and 
    where do corporate rights and responsibilities start, and do 
    private rights end?

    defined classically: on company premises there is little if any 
    legally enforceable individual privacy regarding communications. 

    in NY brokerages, it is well known that brokers have their usual
    company computers, and a laptop with a modem, often wireless.
    if they are overly concerned there is always ssh --not ppp.
    even then, they are on company premises with company power and
    lights....

    however, this discussion is intended to focus on business 
    communications, not their ethics, or lack thereof and not 
    personal communications which should be inviolate, and performed
    away from work.

    the corporate paper trace works two ways --proving you did what
    you said you would, or would not do --or as I put it to 
    subordinates in a hatchetman cleanup: CYA on the sins of
    commission and omission. 

    proper maintenance of paperwork, in an auditable form, is not 
    just a sieve to collect fodder for big brother; you can, and
    should protect (or hang, of course) yourself with paperwork.
    Obviously, if you are engaged in questionable, unethical, or 
    illegal practices, saved paper is dangerous; I can not imagine
    Bill Gate$ archiving notes or email .

    the real goal is "safe" record keeping, just like paper copies; 
    
    no-one likes employer snooping (or employee snooping). 
    unfortunately, the long running trust and honesty of years
    ago is not justifiable today, so there are rules.

    as for government snooping, give 'em a freeway salute.

    whether it is storage keys for Adam, or session keys, whatever,
    the issue is the same: anything you do to abridge the simplicity
    of the key pair is a potential privacy problem --as well as an 
    additional opportunity for breach of security. 

    the paper equivalent of one encryption key which can be lost is
    placing the paper copy in an access proof, unpickable safe and
    losing the key --and the safe self-destructs when tampered.
    would these same people place their only paper copy in this
    safe? (probably, since "losing" your key is generally 
    described only as your bad karma).
    
    master keys are foolish and I dismiss GAK or CAK out of hand.
    encryption and filing policies which include a session key, a
    department key, or something which gives some sense of
    information security is preferable to the master key.  the more
    diversity, the more security.

    I also believe it is preferable to encode the message twice: 
    once to the recipient(s), the second with the company provided
    session key, whatever level. the logic is that using a separate
    encoding pass (which obviously must be essentially simultaneous)
    is less risky and a little less tacky than sending a message
    with dual keys --small point, but a consideration. it would 
    not be difficult to rework a public key pair engine to dump to
    company records at the same time the communication record is
    released.

    as a comparison to the abuses which inherently will evolve with 
    GAK:  prisoners, convicted felons:  murderers, rapists,
    pedophiles, etc. have more rights than "free" men (even though
    felons' civil rights are stripped for life at the time of
    conviction).

    censors for the incarcerated are only allowed to check incoming
    mail for money, drugs, weapons, eg: contraband; they are not
    permitted to slit the outgoing envelope. in addition to the 
    regulations, the intelligence level of a hack would not
    understand the shading of allusions in plain text! even Dapper
    Joe Gotti, the Teflon Don, is entitled to the privacy of his
    personal correspondence unless there is a show cause order.

    to be both honest and pragmatic, certainly the privacy rights of
    some of some problem prisoners are violated.

    theoretically, GAK and CAK would be acceptable in a perfect 
    world, and if the federal government and the rest of the
    information snoops would unfailingly adhere to Constitutional
    "commandments." human nature has proven more than once, and it 
    will prove it again, it is not likely everyone will be
    incorruptible. in fact, I will go so far as to say that 
    *everyone* has a price --even Tim May .

    however, anybody who has eyes or ears knows, comprehends, and 
    accepts that all governments rule by power --even the United
    States; and, that the control of information is the power to
    control. today, it is even more accepted that governments are,
    at best, a necessary evil --and corrupt, paranoid, and nosy
    governments at that; one which will violate your rights if it
    is, or they think it might be, in their interests to do so.
    
    few do not know that our governments are rotten to the core on
    privacy issues; the US, even more than the other members of 
    Western society, has been abrogating, and will continue to
    perniciously abrogate, our rights.

    unfortunately, each centralization of the filing system permits
    the government, or lawyers litigating, a clearer path of access. 
    
    in reality, encrypted electronic records are significantly safer
    filing cabinets than those filled with paper, but they are still
    records maintained. paper filing cabinets are fast disappearing;
    records are either microfilmed, or converted to bits, or both. 
    Xerox, for instance, has a combination system which maintains an
    optical image and a scanned text digital image which can be
    processed with pattern recognition, etc.

    people say the damnedest things in email without thinking. 
    given the ubiquity of computers, data recovery advances, and
    governmental intentions, everyone, whether or not it is personal
    or business, needs to learn the virtue of compartmentalization;
    files need to be organized: separate the necessary documentation
    from the routine and sublime --purge the latter regularly from
    visible system. following this procedure is not illegal if it is
    a regular practice, and, even more importantly, it is not
    performed to obfuscate or impede an investigation, civil or
    criminal.

    fundamentally, the worst thing we can do is permit the government 
    to think they gained something by necessary business practice on 
    the way to their perverted goal of transparent crypto. there is 
    no question they will use their standard ploy that we have 
    already agreed to backup procedures for data storage safety 
    --so what is the difference if you permit us to maintain a key;
    remember, we're from the government, and we're here to help you.
    trust me-- yeah, right! 

    on the other hand, we should be encouraged by the decision of 
    the European commission to totally stiff the U.S. request for 
    them to comply with the F{reeh,uck} mandate; likewise, they 
    chastised the French. The difference in France v. the US is that
    if you do not ask the French government, they do not tell you: 
    "no". 

    If the European commission does follow through with their
    intentions, and I have no doubt they will as European
    politicians recognize both security and discreetness, they will
    be submitting EC legislation before the end of the year
    encouraging strong encryption both to facilitate commerce and to
    protect against the criminal elements; they fully realized the
    folly of expecting criminals not to use strong encryption even
    if it is illegal. firearms in the hands of criminals are also
    illegal. 

    either F{reeh,uck} and Bubba can get off their horses and sell
    the EC hardware and software, or they can lose it all.
    Interestingly. the software will probably be PGP --except the
    revenue will not come home to PRZ, let alone America. Great 
    trade policy, Bubba. where did you say you're from? Arkansas?

    the actions of the more pragmatic, and obviously privacy
    conscience, European leaders only paints a sharper contrast with
    the intentions of the U.S. government. 

    have no doubt, the U.S. government is no different than Lucifer
    who intended to remove from mankind any choice. the actions of
    the U.S. government since the Civil War have been an insidious
    assumption of centralized power, including unaccountable police,
    and a systematic plan of supposed emergencies to expand the
    control of the few at the expense of the many.

    when the smoke of the battle clears, if PGP is not its original
    pristine, highway salute to the powers that be "old self," any
    "concessions" in behalf of corporate responsibility will be
    judged on their appearance, not the effectiveness of the
    solution. Then the flaming idealists will sing and dance for
    blood, claiming PGP released the dogs of war, beginning the 
    inexorable dance to our doom.

    the disruptive class must be put aside (to argue among 
    themselves) and the rest of need to get down to work:

    we must educate the users, washed and unwashed alike, that 
    "doing business" is not necessarily cozying up to the devil;
    while simultaneously affirming that we can not and will not
    tolerate arrangements with any similarity to GAK, CAK and the
    four horsemen.

    on the other hand, if the government does not disassemble and 
    chastise Bill Gate$, I fear Bill's intentions far more than I do
    the federal government, starting with crash prone mediocrity and
    including Gate$' standard no source code policies-- "trust me".

    sure, Bill, I trust you; just come a little closer....

 --
 "When I die, please cast my ashes upon Bill Gates. 
     For once, let him clean up after me! " 
 ______________________________________________________________________
 "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1
Comment: No safety this side of the grave. Never was; never will be

iQCVAwUBNEGcK704kQrCC2kFAQGkvgP9GdIrtrxBBA/48TZ+VKFStV4pl687EfxH
fKinV1RNgTI33MoTXcxsy7nKRkX6b8PRk6/k33vTiWLwrUPrhFQPL0i49EIBZsfJ
FOTEdGEQE16DosImiFFCGp5TUlG8dx1C9OJeutaWV9D9lBf8zNBilpPUFpbnQdYn
b1Rd7f7ShIk=
=lMeS
-----END PGP SIGNATURE-----






From nobody at bureau42.ml.org  Sun Oct 12 23:19:16 1997
From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer)
Date: Mon, 13 Oct 1997 14:19:16 +0800
Subject: attn bianca@dev.null
Message-ID: <8Pk/60CN9k8u0ApmJNymeg==@bureau42.ml.org>



-----BEGIN PGP MESSAGE-----
Version: 2.6.2

hIwDMZZV/34Ws4kBA/0e8y/+mb1njlI9qSuYCHtCDWMW6/d0Q6UESImTu1mX5HgV
zu1byxtOM4gA32JY51XpnnY8l2s4QIhcPznmvFrXl13ND8PXjT9eAeSfzQHGjUn/
l+P1wIVF+aTLr6w4rH1FEAzTrPw3IdU2iz4dMLH2R1OqPIitEF8EFoeUdJneqKYA
AAkP4bLj4zaX5YtsVg4i0tOTZASi50WcqdHi3hIOENNiCQSaSzqT+8tTg92yQFPH
N4/sUHAvZSnTolyiJ4p8tIVqRkJYpjYNTXhWWTL4lH6qbn0GSyh8XWrE5Q9lwKZ6
zex3Oeh0eH+GhMGHHzp+Dtusu4yXTqI0HWmlhv3LOfUV1pBYs9aqKA9wJli4a6Uj
l9BiubvWm1lZ0GE/MA+Y/Qp2rvgSne1+t0965zL8I4wKgURi3KeNlSMoKeDlLwb9
pi5CIKtOSmFbTG919VLK8Asqm/gib254ug8bV9T6UbfCAWjVV5NZpviLYZ7BvDgs
Bj0cGcCh1t1FGWCBj78cQXSMsvxqSPY6CwibiV+Hw9DgMSC4FjiRdxamQxL322uE
CQIqlG502CSiUccpoQa9FapIv7HhKR2HDtooy+RIGMwQbbY8rqWEjDN1uZVaPAbm
eMLAxFE0LvuAWtuFdUYFXcAG3kjH+Mar5iMtNVF7s5mMN9KxBMb39A4pKPaSoGEN
DGgrqg8Y6kAHg7VnEQK14nA3AgQqyxVDPOuo61XfaTB6/4sF0we4noAPUyQzI9Tu
kJjZ2t3YvHBN2i3ZaAdKuokmYEYKXpExCGWAcKdoU4thNsO5EnQiES5XS2oPGjTZ
moxQYe5XH9aqf/2yc1KfRcONVVIB5lvHUm70j09ltR5Ikt4QC63qBlmqW1v9lJi4
m3BMdvFwxvAYsQQDwT1jl/Jcai+NrXrTqJIi8Do2aJFgPbew1yHiMIYss1WonLxu
aUAd9mrFCl13NKl/uzPfPW0+yXTCSmkds0UYLqdVFM6Pa1IBa3hvpGk9VRyiVOJZ
ZnzCjMefQh63D4VkMh9oa8J7P2S5MWH0zNFyqvMbBiWQuD0+NkUOO0PpdkcdFI64
EkHqF4JrR55kVpp7+gjsKkiO640UmQPkcJqAuCPPnDasAADflEnpeFngKn4/yHaE
5IFUFvwve9qHpdqPrhv2t1OGGZzSQJkqZlfd6PhqBp7ZpvWuMgEFEoJatcyhiuvQ
kuf7Dc7WSro8dCdKzR8HePKyvQ6keEhf22t4xk+vbzl7qrXkNqsXQcFsvvbXnH0z
TGcQYpDhvXHqEitB3NNSxJ6+ILFqDeZ9FX4wz1aD0B8DbNutqN+PW0Czx70qjaUQ
vF3At7BJIjG9P8fN4Gqvcj4VEuJdCtmTRYodAJemh2WgXRRYSwaZQdx7XRfsPgW6
Yg8ka9itwAalVBglYYXYB18+g2gu/vPnpr5oFjgyl9leQWbi0kn0BiEAckOPIIrW
ukS/SBUOPAH2AYxQ1uLk1Kip0ERvD6UoXaIJ0r7Bm9EkifIbuIypcOpXgOOJqPkr
O5rD4BAeDC5fsQBo1ov24+C9kft6IX1mSjRm2XuJvjA3ek+SJglz6q4rmi5wP4Ai
r+sxCHEP3UQM3mub5qrzQBpYdkj7O3nX0zt9OXPeonHuuiPobO9EP2K58kffMdpU
ZIhBcKzndFK3LZ/6Nij6TFLbz9pcZsYz/PQw8nsQopnMLT7pQ8K0a8o32JNKw/kY
GoHLCii9e0xAw8Ut4QKJST/g33tbIV2jebrl9F2BzJ6+0uygin13D95w8QVoFRFn
J/YuueGiNFwK58mik61aRVD0gSCl8GOeYyDp5jsAiQIdRKt2knwndT0AFUjl7rjH
cDgABFKV3nx6n5bwNa8zrXIfaa4zuoRrXm/zLi8KgVKUQAy3r5OfgmlLndgQ9j6x
9tGyFFQh9nRoJBfvR9MGZHh8Ylz6jKbaOTmfIp7eOFOOSdnsujycC3BQjtuLyiBv
crMRpdO3YgxPZYR4I8m+Q3cppgz06jj/vCJuzilzSPA079wRczDl6xcQk48Fkv0N
IMiL+MUTMBxMZpKmxETaRWFFf/d8SxtHQcpWQI6iceMbhw7AVEdf9wwEFU/uA5CW
15PVQsq9sU6Jx9/EVaauZQtbyFDxalElrvPSYPvzAEUfi90gzP8SMY+rDgRUGBWD
aZEpg9QqvqZ1Pwj4/gSW63JwXdWOI6WUybEkQG0bQScKj/Pm/eKPnwJ6qeVpw654
T8RU5MbpVjbOeXgw6DvyWQBXTbs6zdBjYVEzGbQ0+WsQN21MON+dr3wFn9bXnYZR
BGYg4PMuOzSTXKVJTh/VpmbiilJZM7FRBpTaKDppExDOItHjvetzWs7o7OrjQR84
3Nx4jW6jIFEfRxwVnuNxx3SZP9I0ofTROw36y0fFOIGxq6dkimuJAU0BHUw3fahK
w2AZZnZKxqziAP6fvqK5OklSeqtZOXGiP/MFXG7f+0AiDFnFD9aQz9ChTHBlE2kM
AFQ3PQq/hJfAJJ+JzgRvi7fHoy90z703NghOBUEnz9PAziag5IRrtPIE/4Rgizlt
1D0G7qj4iMrqR/O/ZljG9rEbKjE5a0H36Zxj8IBO2nGqVGUM3NiKzE2qSNVJOhKC
MgTXYQILJaLumK52H1+4uwqozHGBOebfQvz+QvWJTe08AalP3ZQzV8NaOlWG2JPJ
QDis0zr04Rv1ZQmmheIVHuxsTjyEwCAuJjVUtMifV43cHVZjDUP5WsuThQgGbF+L
ZkdeO0WriD0R4yLX4WSZxTZ/GJpzd4j1u6sGkOWoL80ct/RMta6Pq0Lb2o5vWThP
54YmouF3MCZEo6VD/PjRuJiyHA5AtEU2/gU4iIJtsVlsQJXFIp1S84Mr+kDnF12n
5zymrg873HWuA5GFRbvc6TF2rpssz0SC9XJFA7DvNc+YEGPlTay/lzLnmWczpDDu
fGO/bZUOhIBs3p83AGapO9p3SVxKydOfemNwK6NR1rkAliXs7trAoLuaYQ+L7jje
ypI1CTUpaQvsf1J40y9Lpf91J6m29sJX5XkKJEcXWCq2vj/T+6d5+r+C3nwYmaa4
gcQF44bP8npM2HVEVA1RHxh7XLTEojuAjE5SottyEgiWsRgx5Pk8nu6oywMvSALQ
xSjPrGR4bRqCrbIEiQEV/EAERIF6+DHhVKgiACD2M4rgcAAT0x5ddvJ/tdCvYzX4
zsDd2VqmTtPLuf9dVoitKHaoxX05EeR17tRXyDtsfmB+i6MCLDf4JVm9Ds7AEpCC
UHKoU4yncVO6DJxMMtM0ottd
=okR2
-----END PGP MESSAGE-----







From frantz at netcom.com  Sun Oct 12 23:52:43 1997
From: frantz at netcom.com (Bill Frantz)
Date: Mon, 13 Oct 1997 14:52:43 +0800
Subject: Defeating MITM with Eric's Secure Phone
In-Reply-To: <199710110651.BAA02401@email.plnet.net>
Message-ID: 



At 11:53 PM -0700 10/10/97, John Kelsey wrote:
>This is *almost* right.  We need to add one more thing,
>though:
>
>1.      Alice calls Mallory, thinking she's calling Bob.
>She reads the first three digits to him.  He makes the
>connection fall apart.  At the same time, Mallory calls Bob,
>pretending to be Alice, and causes the connection to fall
>apart at the same time.

John - You're absolutely right.  I haven't had a phone connection fail
after connect for a coon's age, but I remember the bad old days of living
in GTE-land.  (For example, the time I called my wife from work and she
asked me to call Kristine and have her call because no one in Los Gatos
could call out.)

A comm failure during authentication should be enough reason to go to the
next set of 16 words.

N.B. I was assuming that Alice would only commit one digit to Bob before
having Bob commit one digit to her.  It seems from our analysis that doing
it one digit at a time greatly improves the chances of catching Mallory
early.


-------------------------------------------------------------------------
Bill Frantz       | Internal surveillance      | Periwinkle -- Consulting
(408)356-8506     | helped make the USSR the   | 16345 Englewood Ave.
frantz at netcom.com | nation it is today.        | Los Gatos, CA 95032, USA







From frantz at netcom.com  Sun Oct 12 23:58:00 1997
From: frantz at netcom.com (Bill Frantz)
Date: Mon, 13 Oct 1997 14:58:00 +0800
Subject: IETF policy on refusing to allow politics to weaken protocols(Re: Why Adam Back keeps politicizing technical issues)
In-Reply-To: <199710110431.AAA21720@users.invweb.net>
Message-ID: 



At 2:41 AM -0700 10/11/97, Adam Back wrote:
>
>5. The IETF process should be accepting proposed designs and deciding
>on the best ones, which PGP Inc, and the other suppliers would then go
>and implement.  As it is now, as William Allen Simpson just pointed
>out, PGP Inc is cruising ahead implementing, and deploying things
>without bothering with the OpenPGP process.

Just a quick reality check here.  Frequently implementations have proceeded
IETF standards.  That is one of the strengths of the IETF process (as
compared with e.g the CCITT.)



-------------------------------------------------------------------------
Bill Frantz       | Internal surveillance      | Periwinkle -- Consulting
(408)356-8506     | helped make the USSR the   | 16345 Englewood Ave.
frantz at netcom.com | nation it is today.        | Los Gatos, CA 95032, USA







From frantz at netcom.com  Mon Oct 13 00:02:04 1997
From: frantz at netcom.com (Bill Frantz)
Date: Mon, 13 Oct 1997 15:02:04 +0800
Subject: CMR paves the road to GAK, and provides no corporate security.
In-Reply-To: <3.0.1.32.19971012005421.007ab570@pop3.ziplink.net>
Message-ID: 



At 9:54 PM -0700 10/11/97, Trei Family wrote:
>Classified agencies know this. In the classified world, there is a huge effort
>to protect data from outside attack. There is a similarly intense effort to
>check that only loyal, reliable, trustworthy people get clearances, and
>strong 'need to know' controls to restrict what data even they can see.
>However,
>once a cleared person has acheived properly authorized access to classified
>data, there is (in my observation) remarkably little done to prevent them
>from deliberately walking off with it.

There's damn little you can do in a free society.  KeyKOS provided a
facility where you could give information to a program and ensure it could
not communicate it elsewhere.  However this facility involved running the
program in what amounted to solitary confinement.  While you can get away
to doing this to programs, people are (rightfully) different.


-------------------------------------------------------------------------
Bill Frantz       | Internal surveillance      | Periwinkle -- Consulting
(408)356-8506     | helped make the USSR the   | 16345 Englewood Ave.
frantz at netcom.com | nation it is today.        | Los Gatos, CA 95032, USA







From kent at bywater.songbird.com  Mon Oct 13 01:22:01 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Mon, 13 Oct 1997 16:22:01 +0800
Subject: What's really in PGP 5.5?
In-Reply-To: 
Message-ID: <19971013011450.42022@bywater.songbird.com>



On Thu, Oct 09, 1997 at 11:36:54PM -0400, Ray Arachelian wrote:
> On Wed, 8 Oct 1997, Anonymous wrote:
> 
> > Second, what if an employee doesn't come back from vacation?  You've got
> > messages sitting in his inbox which go back three weeks.  All encrypted
> > to his personal key, which is gone.
> 
> Shut up Kent, yes, we know it is you posting this rant.  

Actually, no, it wasn't.

> The above fails
> due to one single little key word "his personal key." If it is his
> personal key, then the business has no business reading his email.

Perhaps he has no business having a personal key on a company machine. 
He's a fool if he does, anyway -- if the company wanted to snoop his
key they just go in after hours, install a keyboard sniffer, and grab
his passphrase...the bottom line is, Ray, that if it is on a corporate
machine, the corporation has access, whether the employee thinks so or
not. 

[...]

> This is a stupid arguement.  Go away.

Unwitting self reference is so delicious :-).

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From semprini at theschool.com  Mon Oct 13 01:28:29 1997
From: semprini at theschool.com (semprini at theschool.com)
Date: Mon, 13 Oct 1997 16:28:29 +0800
Subject: Encryption Program
Message-ID: <199710130820.BAA29369@k2.brigadoon.com>



Hello. I just posted an encryption program on the web. It uses a key-
generated pseudorandom stream of characters that get XORed with the 
plaintext to produce the cyphertext. For decryption, the same stream 
is run against the cyphertext. (Such is the nature of the XOR 
operation.) You can download the program at:

http://www.brigadoon.com/~semprini/3dmx

I am interested in other people's views, comments, questions, etc. on 
this program. Any questions, comments, etc. can be sent to me at 
"semprini at theschool.com".

Thanks,

Dylan






From aba at dcs.ex.ac.uk  Mon Oct 13 02:11:52 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Mon, 13 Oct 1997 17:11:52 +0800
Subject: D-H Forward Secrecy for E-Mail?
In-Reply-To: <199710130223.WAA15345@users.invweb.net>
Message-ID: <199710130438.FAA02474@server.test.net>




William Geiger  writes:
>    at 02, Adam Back  said:
> >As pgp 5.0 uses key servers directly from the mail client (and some other
> >clients do also), this all works out because you just publish your new
> >weekly communications key on the keyserver, and this eliminates the need
> >for interactive communications with your recipient which true DH PFS
> >requires.  
> 
> Have you considered the logistical nightmare that this would cause?? I can
> see that you are unaware of the precarious state the current PGP Public
> Key Server Network is in. 

The keyservers using pgp2.x as the key lookup engine are struggling
because the database code isn't very good.  But the experimental MIT
keyserver, and Tage Stabell-Kulo's key server code on the key server
in Norway fairly whistle through key lookups.  PGP Inc also is using
the better keysever code -- I think based on the one at MIT
implemented by Marc (surname escapes me right now).

> Right now it is getting by but this increase in load would bring it
> all to a screeching halt. 

It all depends on how up to date you are on keyserver performance
problems; perhaps you are more up to date than myself, perhaps not.

The answer I think which must come in any case is a distributed key
server system because the current 100% replication method seems
unlikely to scale to likely future demands, with or without forward
secrecy.  If your company holds keys for it's employees on it's openly
accessible key server, this distribution will be very similar to DNS,
and similarly scalable.

> There have been suggestions of moving key distributution to the DNS
> but I seriously doubt even it would handle the traffic.

I think this is taking it too far.  Have you considered how much
traffic DNS handles right now?  I would have thought it would be many
orders of magnitude more than forward secret email is going to cause.
Web traffic is the bulk of network communications, just imagine the
DNS lookups caused by 50 million netters clicking away. 

Bear in mind also hear that most users will probably be entirely
satisfied with a communications key update time of 1 week.  It is
probably mostly cypherpunks, or people with high value communications
to secure who would opt for more frequent key updates.

Bear in mind also that once the new key has been issued, you could
also release a deletion request for the previous one on the keyserver
in the form of a revocation certificate.

> Also what happens to the "web of trust" in such a system of high key
> turnover?

Nothing.  It is unaffected.  The WoT is only based on signature keys.
You personally certify your communication with your signature key.

> Exactly how much added security is provided by all of this?? 

Lots.  Consider: you are the average PGP user, you have one key
generated per year if you are lucky (probably more like once per life
time).  You are in a company, and the company has a heck of a time
persuading people not to use dumb passwords, or leave their passwords
on yellow sticky notes conveniently stuck to the corner of the
screen.

Scenario: the cleaner is bribed to switch on a machine with a supplied
boot floppy to put in the drive, and writes down the password on the
sticky note.

So, without forward secrecy the attacker now has all the traffic said
PGP user wrote in the life time of his encryption key.  What's that 1
years traffic?  (He'll have collected the ciphertext by eavesdropping
on SMTP traffic travelling over the internet).

With say once-a-day forward secrecy, the attacker gets nothing, no
previous communications, and no future communications.

Granted the attacker can install a replacement version of PGP to try
to get future traffic, but the company can run automated audit checks
of varying sophistications each morning to check if machines have been
switched on, and if files have been altered.  If tampering is
detected, or perhaps every morning you re-install the machine from
scratch remotely, as the MIT project did.  (Reckoned to be a human
resource efficient method of running networks -- got a problem with
your machine -- reload it, the lot no arguments).

> While Forward security via DH "may" be more secure is the added
> expense of implementing such a system justified??

Forward secrecy in a way is not something you need to argue about
adding or not as such, because in a sense you've already got it, built
in to pgp5.0.

To see what I mean you'd need to read Hal Finney's recent post on the
OpenPGP list, where he described how you could already achieve forward
secrecy using the fact that you've got a separate encryption key and
signature key.

You just set the encryption key to have a short expiry, and generate a
new one when it does expire.  You sign the encryption keys with your
signature key to transfer the WoT based trust to them.


The only extra functionality I am arguing for over what PGP5.0 already
has is some built in support for this type of usage, so that pgp will
manage the generation of new keys at the key expiry point
transparently.  That much as such doesn't need any modifications to
the current PGP standard.  It's an implementation issue.  Another
vendor could easily already implement this type of functionality.

Also I'm arguing for separate communications and storage keys, I think
this is almost essential once PGP starts to work with escrow schemes,
because there are similar arguments for separating storage and
communications keys as there were for creating separate signature and
encryption keys from the original single key.

> We all could switch to using OTP's for maximum security but I doubt
> that few if any would justify the cost of such a system.

Actually I hear Fred Piper was semi-seriously arguing for this ... his
argument went like this: mass storage is cheap and getting cheaper
fast; often the communications needed could be covered for years worth
of comms between to organisations by exchanged of a small read only
storage device.  Simple, and fool proof, etc.  But I digress.

> PS: current PGP key format does have a field for key expiration. Until 5.0
> it was only used in the Viacrypt version.

I know, convenient for implementing this type of feature.


I was also arguing for support for once per message forward secrecy.
You should like that one because I was arguing that this should be
done with out keyservers.  Just send the key to the person your
communicating in the email you would like a forward secret reply to.

I also personally prefer people to send me keys in email, because the
pay per second phone lines here at home mean that I tend want to avoid
doing too many online key lookups, so I think this would be an
individually useful feature.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <19971013013515.41006@bywater.songbird.com>



On Fri, Oct 10, 1997 at 11:40:46AM +0100, Adam Back wrote:
> 
[...]
> 
> If the company has an approval system for official statements (seems
> reasonable, if it's a press release, important contractual decision,
> etc), then Alice can send a copy to the legal beagles for the ok, and
> they can send it on.

Isn't it the whole presumption that what Alice is sending is important
company information? That is, that Alice *is* a 'legal beagle' or some
such?  Casual or semi-private email may or may not be allowed, 
depending on how paranoid or repressive the company, but that isn't 
the issue, as I see it.  The issue is 'important company email'.

[...]

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From vipul at best.com  Mon Oct 13 02:32:20 1997
From: vipul at best.com (Vipul Ved Prakash)
Date: Mon, 13 Oct 1997 17:32:20 +0800
Subject: What's really in PGP 5.5?
In-Reply-To: <19971013011450.42022@bywater.songbird.com>
Message-ID: <199710131441.OAA00334@fountainhead.net>



Kent Crispin wrote:

> Perhaps he has no business having a personal key on a company machine. 
> He's a fool if he does, anyway -- if the company wanted to snoop his
> key they just go in after hours, install a keyboard sniffer, and grab
> his passphrase...the bottom line is, Ray, that if it is on a corporate
> machine, the corporation has access, whether the employee thinks so or
> not. 

this entirely depends on the specific protocol followed by the 
corporation and the employee. its not unethical for the corporation
to have access to the employee's _work_ key and data encrypted
with the key if they mutually decide it that way. The employee 
can always use a different crypto system for his personal data. 
and its not unethical for a firm to sell a key-escrow product. 
enforcing the use of key escrow is. 

vipul

-- 
Powell lingered. "How's Earth?" 
It was a conventional enough question and Muller gave the 
conventional answer, "Still spinning."
				      -- "Reason", Asimov. 
==================================================================
Vipul Ved Prakash                 | - Electronic Security & Crypto 
vipul at best.com 	                  | - Web Objects 
91 11 2233328                     | - PERL Development 
198 Madhuban IP Extension         | - Linux & Open Systems 
Delhi, INDIA 110 092              | - Networked Virtual Spaces






From whgiii at invweb.net  Mon Oct 13 03:53:08 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Mon, 13 Oct 1997 18:53:08 +0800
Subject: D-H Forward Secrecy for E-Mail?
In-Reply-To: <199710130438.FAA02474@server.test.net>
Message-ID: <199710131045.GAA20731@users.invweb.net>



In <199710130438.FAA02474 at server.test.net>, on 10/12/97 
   at 11, Adam Back  said:


>William Geiger  writes:
>>    at 02, Adam Back  said:
>> >As pgp 5.0 uses key servers directly from the mail client (and some other
>> >clients do also), this all works out because you just publish your new
>> >weekly communications key on the keyserver, and this eliminates the need
>> >for interactive communications with your recipient which true DH PFS
>> >requires.  
>> 
>> Have you considered the logistical nightmare that this would cause?? I can
>> see that you are unaware of the precarious state the current PGP Public
>> Key Server Network is in. 

>The keyservers using pgp2.x as the key lookup engine are struggling
>because the database code isn't very good.  But the experimental MIT
>keyserver, and Tage Stabell-Kulo's key server code on the key server in
>Norway fairly whistle through key lookups.  PGP Inc also is using the
>better keysever code -- I think based on the one at MIT implemented by
>Marc (surname escapes me right now).

Actually the it is the new pgp5.0 servers that are having the problems.
The PGP Inc. server may be doing ok but they are not part of the Network
(they have cut-off their connection and are not sending out nor receiving
keyring updates to the other servers).

>> Right now it is getting by but this increase in load would bring it
>> all to a screeching halt. 

>It all depends on how up to date you are on keyserver performance
>problems; perhaps you are more up to date than myself, perhaps not.

>The answer I think which must come in any case is a distributed key
>server system because the current 100% replication method seems unlikely
>to scale to likely future demands, with or without forward secrecy.  If
>your company holds keys for it's employees on it's openly accessible key
>server, this distribution will be very similar to DNS, and similarly
>scalable.

I agree that the 100% replication can't last the number of keys and key
requests will become beyond what a PC based system can handle.

>> There have been suggestions of moving key distributution to the DNS
>> but I seriously doubt even it would handle the traffic.

>I think this is taking it too far.  Have you considered how much traffic
>DNS handles right now?  I would have thought it would be many orders of
>magnitude more than forward secret email is going to cause. Web traffic
>is the bulk of network communications, just imagine the DNS lookups
>caused by 50 million netters clicking away. 

Yes but everyone's Ip's aren't changing every week. It's not just a matter
of the multitude of requests that would be required in this systems as
everyone will need to update all their keys on a weekly basis but also the
DNS records will be having this turnover. the DNS system has enough
problems as it is let alone what would happen with the implementation of
forward secrecy would cause (my best guess that within a week or two the
whole thing would crash and burn).

>Bear in mind also hear that most users will probably be entirely
>satisfied with a communications key update time of 1 week.  It is
>probably mostly cypherpunks, or people with high value communications to
>secure who would opt for more frequent key updates.

Even a weekly turnover of all keys would be too much.

>Bear in mind also that once the new key has been issued, you could also
>release a deletion request for the previous one on the keyserver in the
>form of a revocation certificate.

You would have to otherwise you would run out of storage very quickly.

The best I can think of handleing the key distribution problem is to
attach a copy of your key to every correspondence and then have the client
automatically check and see if it has changed and update the keyring as
needed. If find both the automatic processing & sending the key with every
messages quite bothersome (these are PKS implementation issues that should
be covered in a different thread).

>> Also what happens to the "web of trust" in such a system of high key
>> turnover?

>Nothing.  It is unaffected.  The WoT is only based on signature keys. You
>personally certify your communication with your signature key.

>> Exactly how much added security is provided by all of this?? 

>Lots.  Consider: you are the average PGP user, you have one key generated
>per year if you are lucky (probably more like once per life time).  You
>are in a company, and the company has a heck of a time persuading people
>not to use dumb passwords, or leave their passwords on yellow sticky
>notes conveniently stuck to the corner of the screen.

>Scenario: the cleaner is bribed to switch on a machine with a supplied
>boot floppy to put in the drive, and writes down the password on the
>sticky note.

>So, without forward secrecy the attacker now has all the traffic said PGP
>user wrote in the life time of his encryption key.  What's that 1 years
>traffic?  (He'll have collected the ciphertext by eavesdropping on SMTP
>traffic travelling over the internet).

>With say once-a-day forward secrecy, the attacker gets nothing, no
>previous communications, and no future communications.

>Granted the attacker can install a replacement version of PGP to try to
>get future traffic, but the company can run automated audit checks of
>varying sophistications each morning to check if machines have been
>switched on, and if files have been altered.  If tampering is detected,
>or perhaps every morning you re-install the machine from scratch
>remotely, as the MIT project did.  (Reckoned to be a human resource
>efficient method of running networks -- got a problem with your machine
>-- reload it, the lot no arguments).

Well IMHO this scenario does not forward your cause much. If the physical
security is that bad (unrestricted access to equipment, weak passphrases,
Post-it-Notes, ...ect) then the information an attacker is looking for is
more than likely going to be available to him without messing with the PGP
keys. If the reverse is true and the physical security is strong the the
case for short-term separate keys is gone as the risk of exposure to a
long term key is greatly reduced.

>> While Forward security via DH "may" be more secure is the added
>> expense of implementing such a system justified??

>Forward secrecy in a way is not something you need to argue about adding
>or not as such, because in a sense you've already got it, built in to
>pgp5.0.

>To see what I mean you'd need to read Hal Finney's recent post on the
>OpenPGP list, where he described how you could already achieve forward
>secrecy using the fact that you've got a separate encryption key and
>signature key.

>You just set the encryption key to have a short expiry, and generate a
>new one when it does expire.  You sign the encryption keys with your
>signature key to transfer the WoT based trust to them.

>The only extra functionality I am arguing for over what PGP5.0 already
>has is some built in support for this type of usage, so that pgp will
>manage the generation of new keys at the key expiry point transparently. 
>That much as such doesn't need any modifications to the current PGP
>standard.  It's an implementation issue.  Another vendor could easily
>already implement this type of functionality.

I have some serious reservations of the security implications of frequent
changes to the keys. It has the potential for the user to disregard all
changes to the keys (think how quick the warning pop-ups in Netsacpe get
ignored and/or disabled by the user). The other possibility it to make the
key changes transparent to the user which I do not like at all for obvious
reasons (I do not see complete isolation of the user from the cryptosystem
as a Goodthing(TM) ).

>Also I'm arguing for separate communications and storage keys, I think
>this is almost essential once PGP starts to work with escrow schemes,
>because there are similar arguments for separating storage and
>communications keys as there were for creating separate signature and
>encryption keys from the original single key.

Well I have been thinking more on this. I still am not sold that separate
keys are needed but even if they are I am inclined to believe that PGP is
not the place for them. I am leaning towards the opinion that file
encryption should be handled by the files system along with other disk
security features. This seems more appropriate than having your e-mail
client doing individual file encryption.

>> We all could switch to using OTP's for maximum security but I doubt
>> that few if any would justify the cost of such a system.

>Actually I hear Fred Piper was semi-seriously arguing for this ... his
>argument went like this: mass storage is cheap and getting cheaper fast;
>often the communications needed could be covered for years worth of comms
>between to organisations by exchanged of a small read only storage
>device.  Simple, and fool proof, etc.  But I digress.

>> PS: current PGP key format does have a field for key expiration. Until 5.0
>> it was only used in the Viacrypt version.

>I know, convenient for implementing this type of feature.

>I was also arguing for support for once per message forward secrecy. You
>should like that one because I was arguing that this should be done with
>out keyservers.  Just send the key to the person your communicating in
>the email you would like a forward secret reply to.

>I also personally prefer people to send me keys in email, because the pay
>per second phone lines here at home mean that I tend want to avoid doing
>too many online key lookups, so I think this would be an individually
>useful feature.

I do my keylookups automatically durning the msg filtering process which
is done in parallel to the message Dl's. The outbound message lookups are
a little more time consuming but is compensated by fewer keys to look for
both because fewer messages on the outbound side and the use of key caches
on the client machine for the most used keys for sig verification and
encryption. Also logging of e-mail addresses that do not use PGP cuts down
on the number of lookups needed ( I only keep trusted keys in my pubring
all others are kept in the cache for performance reasons ).


-- 
---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
---------------------------------------------------------------






From tm at dev.null  Mon Oct 13 05:27:45 1997
From: tm at dev.null (TruthMonger)
Date: Mon, 13 Oct 1997 20:27:45 +0800
Subject: [RePol] First Post!
In-Reply-To: <0f045e50bea80f9d8eee2e6994b8052b@anon.efga.org>
Message-ID: <34421071.7F14@dev.null>



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Jari Aalto, confirmed by veteran, respected CypherPunk 
Dr. Dimitir Vulis, KOTM, to be a government disinformation
artist, wrote:

> | Sat 97-10-11 Anonymous  list.repol
> | I've downloaded pgp.
> 
> | How do I send the key to this list ?
 
> Don't!

  DO!
 
> [From ema-tipgp.html]

  Notice there is no verifiable URL pointer given for this alleged
reference. Typical of spoofing attacks. 

> 10.0 General PGP guidelines

  According to who? Aunt Ema, or Tot?

>     10.1 About including the public key in the mail message
> 
>         Do not distribute your public key by mail or Usenet post,
because
>         there are more proper ways. People generally do not want
that 'you'
>         send the key to them, instead they want to get it by itself
from
>         some trusted channel: finger or key server. The reason for
this
>         should be obvious: email is not a secure channel, anyone can
>         replace the contents of your mail with something other.

  Bullshit. Email is no less secure than other channels on the
InteNet.
(Is too!) {Is not!} (Is too!) {Is not!} (Is too!) {Is not!}
The chances of your public key being compromised through email to a 
mailing list are slim.

>         Use some/all of the ways here to make your public key
available:
> 
>         o   Put it in your ~/.plan file, so people can simply finger
>             you for it. Open the ~/.plan file and just insert key
there,
>             ,then anyone who fingers you can read the key:
> 
>             % finger foo at site.com

  Bad idea! It makes it vulnerable to attack by those with access to
your system(s), as well as to attack by outside hackers.
 
>         o   Post it to a public-key server which in turn
automatically
>             ,distributes your key to all the other keyservers.

  Be aware that the public-key servers are run by agents of the
federal
government whose goal is to prevent crypto users from avoiding
registering
their keys with coming GAK laws.


> | I'm new at all this anonymous stuff!
> 
> Please read the pgp docs that came along the program. More pgp and
> remailing pointers can be found from my main page
> 
>         ftp://cs.uta.fi/pub/ssjaaa/ssjaaa.html

  Which is full of lies!

  Please note that the proper procedures for obtaining and using
Crypto Keys are outlined by CypherPunk Notable Newbie of the Year,
A. Hoir, in a series of posts on the CypherPunks mailing list.

  I am including my public key below, within the body of this email,
and it can be verified by checking it against the listing for my
keys on the keyserver at http://www.pgp.com/ .

  Lastly, and most importantly, take the time and effort to verify
for yourself any claims made by those posting to mailing lists, in
general, and using anonymous or misleading personas, in particular.

TruthMonger

>
*===================================================================*
> To unsubscribe or subscribe send a message of UNSUBSCRIBE or
SUBSCRIBE to
> the email address REMAILER-POLITICS-REQUEST at SERVER1.EFGA.ORG

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: PGP for Personal Privacy 5.0

mQDiBDRCDGgRAgDz0VR8oKaE3LeAkKi1tnNfTPaUQzhXFD0Tf7HTmO1BxSqxVO8U
mxvPCTtw2KLRtYt+udXeHDsduyDxxBC8U0xrAKD/BLyXv9cjrG1pr+y4yaor4TH7
6wH/RlhBvKUwZ2/NOWcS3RKxz/25LoW7Y6LTT4ahiFWQUMFpOBRxclsiLajOoci3
8pdjqr2Oy5uJP6EbUARMFgUThAIAwvqTOSpVumu4ib50yojvuYniN01tg9c3jmCv
KV28a/LHEpug3R1FusI1BaOuQVTRyLgmoJRhl9uqjonUS/vdgrQlSmFyaSBBYWx0
byA8amFyaS5hYWx0b0BudGMubm9raWEuY29tPokAUQQQEQIAEQUCNEIMaAUJAAFR
gAQLAwECAAoJENVQ+s43zWjf9p0An164iqcY9UfDDacAhKQh0PJ534aoAKDTHx68
3h+G5qyNPYxZXTrVBJy0CLkAjQQ0QgxxEAIA/2RE3cUr5HlC5rDt3D+6LqbA6pt/
Yj8cEhCKzfXepCKyMowSKcSeucikNdFkSpNf4jVZN0aAt3aLgQiubKRdVQACAgIA
ojrQS61RR4FHVsn6hi78CIUfdJFtjcPB4PgHMj5VQUCv9QN926d7mk13PCPjeWU3
4eip3RaukG/WfeaQXT58OIkATAQYEQIADAUCNEIMcQUJAAFRgAAKCRDVUPrON81o
3xgEAJ4yQ2yR8W3yLefi5YyhfRNc5kGRYwCfYgVqqCamaOpJhNWfUNfzVVIB7Ng=
=SubM
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNEIPuNVQ+s43zWjfEQKX+wCg5MydykFtaUVN9Pj9mYbT55SdWzMAoKeD
SlKAfuAz3OGRko9Chm11NBFy
=S6R7
-----END PGP SIGNATURE-----






From aba at dcs.ex.ac.uk  Mon Oct 13 05:57:13 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Mon, 13 Oct 1997 20:57:13 +0800
Subject: IETF policy on refusing to allow politics to weaken protocols(Re: Why Adam Back keeps politicizing technical issues)
In-Reply-To: 
Message-ID: <199710131140.MAA01044@server.test.net>




Bill Frantz  writes:
> At 2:41 AM -0700 10/11/97, Adam Back wrote:
> >
> >5. The IETF process should be accepting proposed designs and deciding
> >on the best ones, which PGP Inc, and the other suppliers would then go
> >and implement.  As it is now, as William Allen Simpson just pointed
> >out, PGP Inc is cruising ahead implementing, and deploying things
> >without bothering with the OpenPGP process.
> 
> Just a quick reality check here.  Frequently implementations have proceeded
> IETF standards.  That is one of the strengths of the IETF process (as
> compared with e.g the CCITT.)

I must admit some ignorance of the IETF processes due to my only
understandings being gained from intermittent following of the IPSEC
standardisation process, and in that respect I thank you for the data
point...

However, I would defend that my understanding is, and my point was
more that proposals with trial implementations should be used as
discussion points, and as competing draft proposals rather than being
used as arguments for it being necessary to build compatibility with
just because someone has rushed off and sold copies of them, prior to
ratification of those proposals by the standardisation process.  And
that independently of the technical merits of those proposals, or
arguably even in the face of evidence that there are more secure
alternatives to these proposals.

The IETF standardisation process is supposed to make decisions based
on technical merit.  Not based on marketing clout.  Nor even based on
reputation capital, something which PGP surely has in abundance, as
transferred to it by Phil Zimmermann with his virtual net.god status.

I also take exception to PGP's Will Price's attempt at silencing
negative discussion of the security and political aspects of PGP's
GAKware, in his rhetoric on this being an inappropriate forum for
discussion of political aspects of CMR.  If Will Price thinks that we
should just lie down and accept PGP fielding inferior security GAKware
systems, and accept PGP trying to impose them on the standard, he can
think again.  Crypto politics can't help but play some part in
discussion of crypto standards.  

As Tim May pointed out in an earlier post, we gave the same roasting
to companies participating in the Key Recovery Alliance Program, and
to companies like TIS, and IBM for various GAK sell out deals.  In
fact, Netscape got worse roastings for far lesser crimes than PGP's
crimes in attempting to architect GAKware into the OpenPGP standard,
or if that fails, in PGP's death wish in attempting to commit
reputational suicide by implementing and widely deploying GAKware.

My concern specifically is that some of the less desirable aspects of
the way that PGP have implemented CMR should not be adopted into the
standard for interoperability reasons alone.  I am worrying that PGP
Inc will shortly be using this line of reasoning, for backwards
compatibility with pgp5.5 functionality for similar reasons as one
might reasonably argue for backwards compatibility with pgp2.x.

I noticed that Ian Grigg (Systemics) also expressed this point about
standards process manipulation well in his article.

Systemics has a much better track record for open development, and
openness of design decisions than PGP Inc since it's incorporation, or
before that than the pgp3.0 development team of two in beetling
themselves off in a room at Sun or wherever and taking ages to develop
software.  (No offense intended to said developers technical ability,
which I respect immensely, the error was organisational.)

Systemics is also outside of the US and for that reason better placed
to compete internationally.  PGP Inc is losing reputation capital to
Systemics and other such small companies in eroding it's support from
netizens by fielding GAKware systems.

(I have no affiliation with Systemics).

Adam






From nobody at REPLAY.COM  Mon Oct 13 06:21:03 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Mon, 13 Oct 1997 21:21:03 +0800
Subject: James A. Michner [non-crypto]
Message-ID: <199710131315.PAA20235@basement.replay.com>



Jim Choate wrote:
> Thought some of you might care to know that James A. Michner the Pulitzer
> prize winning author who lives here in Austin, Tx. has decided to take
> himself off the kidney dialysis machine that has been keeping him alive.

I guess that means the end of The True Story of the InterNet...






From jeffb at issl.atl.hp.com  Mon Oct 13 06:59:38 1997
From: jeffb at issl.atl.hp.com (Jeff Barber)
Date: Mon, 13 Oct 1997 21:59:38 +0800
Subject: Stronghold
In-Reply-To: <199710121508.QAA04569@server.test.net>
Message-ID: <199710131452.KAA26663@jafar.issl.atl.hp.com>



Adam Back writes:

> Dimitri Vulis  writes:

> > did _not appear on the "unedited" list. Nevertheless at least one
> > lying C2Net shill from Hewlett Packard claims that my articles
> > appearing on the unedited list on January 30th prove that I wasn't
> > being filtered from "unedited" one week later.
> 
> Some thing's just can't be proven.  That logic clearly doesn't flow.

For the record, I made no such claim.  In fact, my exact words were:

[me:]
> Since obviously none of us who were on the -unedited list can say for 
> sure whether we received everything sent to it, I can't say with 
> certainty this never happened.  But....
> This is the problem with being known as a liar.  Nobody is inclined to
> believe what you say without substantitation.  So I still don't see any
> reason to believe that anything was "censored" from the unedited list.

But Dimitri has claimed that there were "numerous people" who were 
CC'd to the message that is alleged to have disappeared from -unedited.
I'm sure they'll all be chiming in to back him up just like John Young 
did. :-)


-- Jeff (C2Net shill?  now if I can only get Sameer to pay me for it)






From raph at CS.Berkeley.EDU  Mon Oct 13 06:59:40 1997
From: raph at CS.Berkeley.EDU (Raph Levien)
Date: Mon, 13 Oct 1997 21:59:40 +0800
Subject: List of reliable remailers
Message-ID: <199710131350.GAA14260@kiwi.cs.berkeley.edu>



   I operate a remailer pinging service which collects detailed
information about remailer features and reliability.

   To use it, just finger remailer-list at kiwi.cs.berkeley.edu

   There is also a Web version of the same information, plus lots of
interesting links to remailer-related resources, at:
http://www.cs.berkeley.edu/~raph/remailer-list.html

   This information is used by premail, a remailer chaining and PGP
encrypting client for outgoing mail. For more information, see:
http://www.c2.org/~raph/premail.html

   For the PGP public keys of the remailers, finger
pgpkeys at kiwi.cs.berkeley.edu

This is the current info:

                                 REMAILER LIST

   This is an automatically generated listing of remailers. The first
   part of the listing shows the remailers along with configuration
   options and special features for each of the remailers. The second
   part shows the 12-day history, and average latency and uptime for each
   remailer. You can also get this list by fingering
   remailer-list at kiwi.cs.berkeley.edu.

$remailer{'cyber'} = ' alpha pgp';
$remailer{"mix"} = " cpunk mix pgp hash latent cut ek ksub reord ?";
$remailer{"replay"} = " cpunk mix pgp hash latent cut post ek";
$remailer{"jam"} = " cpunk mix pgp hash middle latent cut ek";
$remailer{"winsock"} = " cpunk pgp pgponly hash cut ksub reord ?";
$remailer{'nym'} = ' newnym pgp';
$remailer{"squirrel"} = " cpunk mix pgp pgponly hash latent cut ek";
$remailer{'weasel'} = ' newnym pgp';
$remailer{"reno"} = " cpunk mix pgp hash middle latent cut ek reord ?";
$remailer{"cracker"} = " cpunk mix remix pgp hash ksub esub latent cut ek reord post";
$remailer{'redneck'} = ' newnym pgp';
$remailer{"bureau42"} = " cpunk mix pgp ksub hash latent cut ek";
$remailer{"neva"} = " cpunk pgp pgponly hash cut ksub ?";
$remailer{"lcs"} = " mix";
$remailer{"medusa"} = " mix middle"
$remailer{"McCain"} = " mix middle";
$remailer{"valdeez"} = " cpunk pgp pgponly hash ek";
$remailer{"arrid"} = " cpunk pgp pgponly hash ek";
$remailer{"hera"} = " cpunk pgp pgponly hash ek";
$remailer{"htuttle"} = " cpunk pgp hash latent cut post ek";
catalyst at netcom.com is _not_ a remailer.
lmccarth at ducie.cs.umass.edu is _not_ a remailer.
usura at replay.com is _not_ a remailer.
remailer at crynwr.com is _not_ a remailer.

There is no remailer at relay.com.

Groups of remailers sharing a machine or operator:
(cyber mix reno winsock)
(weasel squirrel medusa)
(cracker redneck)
(nym lcs)
(valdeez arrid hera)

The remailer list here has been out of date for some time, but should
be up to date now. I'm still working on updating the web page.

Last update: Mon 13 Oct 97 6:45:44 PDT
remailer  email address                        history  latency  uptime
-----------------------------------------------------------------------
hera     goddesshera at juno.com             ------------  5:55:28  99.50%
squirrel mix at squirrel.owl.de              ----- ------  3:25:30  99.49%
nym      config at nym.alias.net             **####+## +#     1:16  95.21%
cyber    alias at alias.cyberpass.net        *+++**+** *+    11:56  94.67%
mix      mixmaster at remail.obscura.com     +++++*++* +     26:05  94.54%
redneck  config at anon.efga.org             *##**++** ##     1:47  94.48%
neva     remailer at neva.org                *+ + -+-  -   1:33:09  94.37%
winsock  winsock at rigel.cyberpass.net      ..--..--- -+  9:43:02  94.02%
jam      remailer at cypherpunks.ca          ++++*+++  +*    23:21  94.00%
cracker  remailer at anon.efga.org           *++*+*++  ++    17:35  93.90%
replay   remailer at replay.com              ****** ** **     3:46  93.78%
bureau42 remailer at bureau42.ml.org         ----- ---     3:30:56  87.00%
arrid    arrid at juno.com                   --------- -   8:26:08  86.01%
reno     middleman at cyberpass.net          +++ *+++      1:01:28  66.48%
valdeez  valdeez at juno.com                               4:58:22 -25.98%

   History key
     * # response in less than 5 minutes.
     * * response in less than 1 hour.
     * + response in less than 4 hours.
     * - response in less than 24 hours.
     * . response in more than 1 day.
     * _ response came back too late (more than 2 days).

   cpunk
          A major class of remailers. Supports Request-Remailing-To:
          field.
          
   eric
          A variant of the cpunk style. Uses Anon-Send-To: instead.
          
   penet
          The third class of remailers (at least for right now). Uses
          X-Anon-To: in the header.
          
   pgp
          Remailer supports encryption with PGP. A period after the
          keyword means that the short name, rather than the full email
          address, should be used as the encryption key ID.
          
   hash
          Supports ## pasting, so anything can be put into the headers of
          outgoing messages.
          
   ksub
          Remailer always kills subject header, even in non-pgp mode.
          
   nsub
          Remailer always preserves subject header, even in pgp mode.
          
   latent
          Supports Matt Ghio's Latent-Time: option.
          
   cut
          Supports Matt Ghio's Cutmarks: option.
          
   post
          Post to Usenet using Post-To: or Anon-Post-To: header.
          
   ek
          Encrypt responses in reply blocks using Encrypt-Key: header.
          
   special
          Accepts only pgp encrypted messages.
          
   mix
          Can accept messages in Mixmaster format.
          
   reord
          Attempts to foil traffic analysis by reordering messages. Note:
          I'm relying on the word of the remailer operator here, and
          haven't verified the reord info myself.

   mon
          Remailer has been known to monitor contents of private email.
          
   filter
          Remailer has been known to filter messages based on content. If
          not listed in conjunction with mon, then only messages destined
          for public forums are subject to filtering.
          

Raph Levien






From skoked at mail2.c-flash.net  Mon Oct 13 22:35:51 1997
From: skoked at mail2.c-flash.net (skoked at mail2.c-flash.net)
Date: Mon, 13 Oct 1997 22:35:51 -0700 (PDT)
Subject: After All,-----It Is *YOUR* Life
Message-ID: <199710140535.WAA15149@toad.com>


                                   After all, It is *YOUR* Life--

  I would like to let YOU in - on a small Gold Mine!!  I have....

If you are like many other people who don't like going to work-This is for YOU!!
Even if you love your job (especially if You don't) - This is for YOU!!

What I'm about to say maybe UNBELIEVABLE at first, But read on...

THIS IS NOT A SCAM--- I am an ordinary Joe just like YOU!!

EVERYTHING YOU NEED----(except a small amount of dedication and time) 
Is being offered to *YOU* ---*RIGHT NOW*!!!   The rest will follow !!!

I'm going to share with You--- My *FREE* Software--- To get You started on Your way !!!
---WHAT HAVE YOU GOT TO LOSE?--- 

-Soon, from 9 to 5 , You will be doing all of the things You only dreamed of !!!
                                                   ***RIGHT NOW***
To get YOUR *FREE* Software, Reply with the subject 'FREE' 

P.S.- Reply only with Subject 'FREE' (nothing else should be in this field)

///////////////////////////////////////////////////////////////////////////////
This Message was Composed using Extractor Pro Bulk E- Mail Software. If 
you wish to be removed from this advertiser's future mailings, please reply 
with the subject "Remove" and this software will automatically block you 
from their future mailings.If you do not reply only with subject "Remove", there is
no way for you to be "Removed"........So please do so if you want to be "Removed".
////////////////////////////////////////////////////////////////////////////////


                                   





                                             





From vipul at best.com  Mon Oct 13 07:44:50 1997
From: vipul at best.com (Vipul Ved Prakash)
Date: Mon, 13 Oct 1997 22:44:50 +0800
Subject: GOST
Message-ID: <199710131950.TAA00414@fountainhead.net>




I am developing a product that would use GOST for encrypting data 
streams. This is mostly beacuse its design and simplicity hold
considerable aesthetic value, atleast for me. 

Most of the related text I have read indicates
that some SBOX sets can be cryptographically weak, and
its a good idea to use SBOX data as key data instead. 

Pointers? 

-- 
Powell lingered. "How's Earth?" 
It was a conventional enough question and Muller gave the 
conventional answer, "Still spinning."
				      -- "Reason", Asimov. 
==================================================================
Vipul Ved Prakash                 | - Electronic Security & Crypto 
vipul at best.com 	                  | - Web Objects 
91 11 2233328                     | - PERL Development 
198 Madhuban IP Extension         | - Linux & Open Systems 
Delhi, INDIA 110 092              | - Networked Virtual Spaces






From mione at boeing.rutgers.edu  Mon Oct 13 08:02:33 1997
From: mione at boeing.rutgers.edu (Tony Mione)
Date: Mon, 13 Oct 1997 23:02:33 +0800
Subject: IETF policy on refusing to allow politics to weaken protocols (Re: Why Adam Back keeps politicizing technical issues)
In-Reply-To: <199710131140.MAA01044@server.test.net>
Message-ID: <971013100300.ZM23083@boeing.rutgers.edu>



On Oct 13, 12:40pm, Adam Back wrote:
> Subject: Re: IETF policy on refusing to allow politics to weaken protocols
>
> Bill Frantz  writes:
> > At 2:41 AM -0700 10/11/97, Adam Back wrote:
> > >
> > >5. The IETF process should be accepting proposed designs and deciding
> > >on the best ones, which PGP Inc, and the other suppliers would then go
> > >and implement.  As it is now, as William Allen Simpson just pointed
> > >out, PGP Inc is cruising ahead implementing, and deploying things
> > >without bothering with the OpenPGP process.
> >
> > Just a quick reality check here.  Frequently implementations have proceeded
> > IETF standards.  That is one of the strengths of the IETF process (as
> > compared with e.g the CCITT.)
>

	The reality is that standards generally drag long behind the need for
new technology. In any standards org worth thier weight in salt, the group will
look at existing implementations (not trial implementations but ones that have
been in use for some time). This is called 'Prior Art'. Without prior art, it
is not easy to determine which features or schemes work and which do not.

	The problem we are running into here is that PGP Inc. is marketting
about the only prior art available for this technology. In addition, business
needs will not stand still waiting for a standard to come out in 1-2 years.
This creates a somewhat dangerous situation as Adam has pointed out (Note: I am
NOT PGP-Inc.-bashing. This is merely an outcome of what happens when a vendor
tries to take their technology and 'open' it up).

	I would be concerned if this relatively new addition were being added
to the internet-drafts currently being produced by the group. I know they have
tried to wrestle with all of the issues. I just think we need some more
'experiential' evidence that it is the correct solution. In general, standards
only describe the 'bare-minimum' that an implementation must do to be
'compliant'. There is nothing wrong with leaving certain bells-and-whistles out
of the first pass at a standard. Vendors are always free to add proprietary
features to thier product. That is where the market competition comes in. PGP
Inc. implements thier CMR feature on top of the OpenPGP standard. Another
company attacks the problem a different way and adds a different 'extension'.
In about 5 years, a new standards group updates the 'OpenPGP' standard, argues
over the different schemes and adopts the one with the best technical merit.

> I must admit some ignorance of the IETF processes due to my only
> understandings being gained from intermittent following of the IPSEC
> standardisation process, and in that respect I thank you for the data
> point...
>
> However, I would defend that my understanding is, and my point was
> more that proposals with trial implementations should be used as
> discussion points, and as competing draft proposals rather than being
> used as arguments for it being necessary to build compatibility with
> just because someone has rushed off and sold copies of them, prior to
> ratification of those proposals by the standardisation process.  And
> that independently of the technical merits of those proposals, or
> arguably even in the face of evidence that there are more secure
> alternatives to these proposals.
>
> The IETF standardisation process is supposed to make decisions based
> on technical merit.  Not based on marketing clout.  Nor even based on
> reputation capital, something which PGP surely has in abundance, as
> transferred to it by Phil Zimmermann with his virtual net.god status.
>

	To Adam and others, I would say, work like mad to develop pgp-like
implementations (based on available documents of 2.6 or 5.0 formats) and add in
alternative mechanisms to do the same function (as per Adam's discussion of the
3-key system : signature, transit-encryption, and storage). To others in this
group, I would say keep it simple...especially on a first pass at a standard.

	I have noticed an interesting phenomena in a number of IETF groups. One
group develops a standard that is huge and nearly unimplementable. Another
group comes along and says "We can do it simpler than that". They start
designing and writing documents, run into the same issues the first group did
and eventually start solving them the same way leading to another large
unimplementable standard. Witness: X509 -> PKIX -> SPKI -> OpenPGP. OpenPGP was
supposed to be different because it had a large established user base. Then,
all of a sudden, everyone is arguing over the same issues as the first three
groups...global naming problems, certificate flexibility, key recovery, policy
enforcement...


>...
>
> Adam
>-- End of excerpt from Adam Back

--
Tony Mione, RUCS/NS, Rutgers University, Hill 055, Piscataway,NJ - 732-445-0650
mione at nbcs-ns.rutgers.edu                 W3: http://www-ns.rutgers.edu/~mione/
PGP Fingerprint : E2 25 2C CD 28 73 3C 5B  0B 91 8A 4E 22 BA FA 9F
Editorial Advisor for Digital Systems Report   ***** Important: John 17:3 *****






From nobody at REPLAY.COM  Mon Oct 13 08:54:14 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Mon, 13 Oct 1997 23:54:14 +0800
Subject: America as a Shake Down Extortion State
Message-ID: <199710131547.RAA04977@basement.replay.com>



-----BEGIN PGP SIGNED MESSAGE-----

Ryan Anderson wrote:
>That's the point - you ignore the legislation until it becomes a problem 
>for you.  Then you challenge it and get a legal precedent to stop it from 
>happening again.
>
>The judicial system is in *much* better shape than the legislative system 
>(even though they are strongly related)
>
>This, however, is not to say that the judicial system is in good shape.

You're ignoring the fact that the legislative and the judicial are just two 
different horns on the same beast.  "Please impale me with the kinder, 
gentler horn," is what you're saying.

Let's face it.  This "challenge it and get a legal precedent" approach has 
done absolutely nothing to stop America, formerly one of the freest 
countries on earth, from slowly devolving into a socialist police state.

That's why I say fuck the lawyers, and fuck the legislators, too.  If a 
roomful of morons are writing up ludicrous rules and you're gullible enough 
to listen to them, then who's the real moron?

Ignore them.  Set a precedent in life.  I'm suggesting active civil 
disobedience by every thinking person in this country.  I'm not saying blow 
up a federal building or any other such nonsense.  Be responsible for your 
actions, but act!  And act intelligently...

[ Imastun ]


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNEISTnC/ZQW0eQF1AQHZ2wP9GpVnZj7M8GErkJY9aKrpU9tSgLM99AKz
CdLiDDpJGTLV1w09xhEpHFJWqgBx/Uq+6GdK/ih1Osrdu5vzYHh93eTGWGU1nmYD
cbxl8TQOfVw9KbG3drrHx+Azvv6QzYJrrV4e2xPkoGuEeQUByFcemR9XIpcwmg8a
9r/7hyV3dTo=
=xnIk
-----END PGP SIGNATURE-----










From jim.burnes at ssds.com  Mon Oct 13 09:45:09 1997
From: jim.burnes at ssds.com (Jim Burnes)
Date: Tue, 14 Oct 1997 00:45:09 +0800
Subject: Phone Line Internet (too slow)
In-Reply-To: <199710121344.PAA20721@basement.replay.com>
Message-ID: <34424DC4.E51DD8A5@ssds.com>



Anonymous wrote:

> Inter at ctive WeekOctober 10, 1997
>
>                       Nortel Unveils 1-Megabit Phone Line
>                       Ethernet
>
>

etc etc...

>                       The 1-Meg will deliver 1-megabit-per-second speeds
> downstream
>                       into homes or businesses and
> 120-kilobit-per-second speeds in the
>                       other direction

This is too slow upstream for future technology needs.  I'll admit that the

upstream is almost as fast as a 2B+D ISDN setup, but research that I've
done suggest that 384kb is necessary for VHS quality realtime video.

So Nortel will deliver enough downstream bandwith for you to be a video
consumer, but not a provider.  How typical.

I'll wait for xDSL, thank you.

Jim Burnes


--

      "How do you explain school to higher intelligence?"
               Elliot to his brother in ET








From ariel at watsun.cc.columbia.edu  Mon Oct 13 09:45:13 1997
From: ariel at watsun.cc.columbia.edu (Ariel Glenn)
Date: Tue, 14 Oct 1997 00:45:13 +0800
Subject: patenting big brother
Message-ID: 



if it's not one thing, it's another.

Ariel Glenn
ariel at columbia.edu
-----

http://www.nytimes.com/library/cyber/week/101397patents.html

Engineer Invents Computerized Surveillance System

            By TERESA RIORDAN

Imagine that a city park were studded with discreetly
placed cameras that fed images into computers programmed to keep
a watchful eye. This may sound darkly Orwellian, but
David Aviv, a former aerospace engineer, has patented exactly
such a system as a way of combating crime. 

Aviv said his invention, which he calls the Public Eye,
used pattern recognition to detect robberies or acts of violence. 

He said he had digitized and stored a library of physical
interactions. "We employed actors to do re-enactments of
muggings," he said. "We had 10 different sizes of muggers
and 10 different sizes of victims." 

The camera sends to a computer the real-time images of a person
getting money from an automated teller machine, for example. The
computer then takes a snapshot and compares the image against the
library of threatening interactions. 

"It takes another snapshot and then another snapshot and does a similar
comparison over and over again to reduce false alarms," Aviv
said. "I'm describing this in slow motion, but it
actually takes place every fraction of a millisecond." 

If the computer detects a malicious act, an alarm promptly alerts the 
police or a paid guard. 

Aviv said he also used a type of pattern recognition,
called word gisting, to detect aggressive verbal interactions. Muggers,
according to Aviv's research, use a limited vocabulary.
"Mostly they say, 'Give me your money,' and then use a lot of cuss
words," he said. His word-gisting library contains about 20
basic words, spoken in a number of different dialects. 

How is Aviv's system different from having a human guard
observe a bank of television monitors? "Guards get tired," Aviv
said. "And they are expensive." Aviv estimated that it cost
about $130,000 a year to have one site manned by guards 24
hours a day. "My system you could lease at $500 a month,"
he said. "You're not going to eliminate all guards, because you
still need someone to run over when a hostile act is taking
place." 

Aviv's company, ARC Inc., which is based in Las Vegas, is
seeking financing for further development of the surveillance
system. He received patent 5,666,157. 






From rishab at dxm.org  Mon Oct 13 09:58:35 1997
From: rishab at dxm.org (Rishab Aiyer Ghosh)
Date: Tue, 14 Oct 1997 00:58:35 +0800
Subject: free market (was RE: GET OFF THE DIME: PGP 5.5)
Message-ID: <199710131653.JAA11142@shell5.ba.best.com>




Attila wrote:
       would you rather have PGP, Inc. with its preeminent 
        stature in the defense of freedom, freeware, and
        privacy as well as an established, TRUSTED product 
        defining THE system which meets the need of the 
[etc]


if i remember right, the idea behind PGP when it first
came out was that you ought not trust ANYBODY.
that's why you have the source code@!

it's a free market. if PGP Inc wants to make money,
and needs to meet the corporate demand for some sort of 
alternative-key mechanism to snoop on their employees
(or keep backups of important correspondence when 
employees forget their keys) so be it. as an individual,
it hardly matters to me if it's PGP or Microsoft that's
selling this stuff - remember, crypto software doesn't
read your mail, people do, and if my company wants to 
be able to read my mail it'll buy the tools from anyone
who's selling. frankly i couldn't be bothered if the tools
are from "TRUSTED" PGP or Evil Bill. for all i know, 
my employer is quite happy with GAK too.

of course if i'm willing and able to work independently
of any company, then i _do_ have control over the privacy
software i use, and in that case, if i'm paranoid enough,
i can always go through the source code.

-rishab






From tm at dev.null  Mon Oct 13 10:40:49 1997
From: tm at dev.null (TruthMonger)
Date: Tue, 14 Oct 1997 01:40:49 +0800
Subject: InfoWar Epilogue 2 / TEXT
Message-ID: <344259FD.4E65@dev.null>



----------------------------------------------------------------------------
----------------------------------------------------------------------------

                       The True Story of the InterNet
                                  Part III

                                   InfoWar

                  Final Frontier of the Digital Revolution

                     Behind the ElectroMagnetic Curtain

                        by TruthMonger 

Copyright 1997 Pearl Publishing
----------------------------------------------------------------------------
----------------------------------------------------------------------------

                          InfoWar Table of Contents

   * Epilogue
   * Jonathan

----------------------------------------------------------------------------

                                  Epilogue
----------------------------------------------------------------------------

The tattered remnants of the Magic Circle sat quietly in front of the lines
drawn in the dirt of the floor of the cave.
Alexis placed a white rock in one of the squares. Jonathan placed a black
rock next to it.

They were engaged in the use of one of the first computers used to wage
InfoWar�an ancient oriental game, called 'Go.'
Fortunes and kingdoms were won and lost over the placement and arrangement
of black and white stones. Like 0 and 1, on and off, yin and yang.

Cowboy was thinking of an article he had pulled up from the past, titled,
"The History of Chess," or some such, from a magazine called 'Playboy.'
It described chess as originating in primitive times, with a board having
only one square on it. Each player had one playing piece, and you could put
your piece on the square, as long as you were willing to back it up with
your fists.
He thought about the battle for control of the InterNet that was taking
place a century in the past. The more things change�
----------------------------------------------------------------------------
----------------------------------------------------------------------------

                                  Jonathan

                  "I've looked at life from both sides now,
                   From win and lose, and still, somehow,
                       It's life's illusions I recall
                      I really don't know life�at all.
                               - Joni Mitchell

During the censorship crisis on the CypherPunks list, when the list members
were trying to make sense of what was going down, a lone voice whispering in
the wilderness pointed out that the battle being waged had little to do with
censorship, and everything to do with InfoWar.

The Tao whispers so that it will be heard by those who do not have all of
their attention tied up in shouting.
The Tao whispered during the censorship crisis, just as it had whispered in
the madness that overtook Germany, then Europe, then the World. It was heard
by the Hermit, and echoed by the Fool. It whispered "InfoWar."

But it seemed that no one had heard�
----------------------------------------------------------------------------

The Process of human alchemy marches on: Revelation of the Method. They are
Making Manifest All that is Hidden and what a hell-fire joke it is--for
almost no one is paying conscious attention, even as the secrets of the time
are dropped like pearls before wine.
-Michael A. Hoffman II
----------------------------------------------------------------------------

�at least, until history took a step back, and a step to the left.
----------------------------------------------------------------------------

The whole goal of the hijacking of the phrase "key escrow" to
camouflage GAK was to obscure the difference between voluntary
and involuntary participation.

Someone getting access to your secrets against your will,
whether by trickery, threat of force, or burglary is not
escrow. At least, not until the USG deliberately chose to
abuse that word to throw a mask of legitimacy upon its rotten
idea of mandatory wiretapping for all digital communication.

Damn, but it is frustrating to see such a bare-faced NewSpeak
gambit succeed so brilliantly against otherwise literate people.
Everyone should read George Orwell's paper on (ab)use
of language in politics. None of the examples he cites are
nearly as worthy of Minitru as is this single conceptual hijacking.
-Zooko Journeyman
----------------------------------------------------------------------------

At the time that the Trei Transponder exploded, PGP, the holy icon of the
CypherPunks, was under a full-scale frontal attack by�the CypherPunks.
The reason�Corporate Message Recovery.

Just as the assault by the Dark Forces on PRZ and PGP had alerted the Magic
Circle to a soft spot on the underbelly of Gomez and his Dark Allies, the
assault on CMR and PGP by the CypherPunks alerted the Dark Forces that they
had been premature in celebrating their InfoWar victory in their assault on
the CypherPunks list.

About a century too early�
----------------------------------------------------------------------------

I presume the PGP PR person (who ought to get the sack in my opinion)
thought that a sudden press release of such marvelous new feature as
PGP SnoopWare and a SnoopWare Enforcer for Third-parties would go down
well. It doesn't.
-Adam Back
----------------------------------------------------------------------------

Although PGP's 'Corporate Message Recovery' software had its proponents and
detractors on the CypherPunks list, the bottom line was that it marked a
change in the battle front in the Crypto Wars.
Even Philip R. Zimmerman, himself, was not happy with the PGP name being
lent to a product which amounted to an expansion of the definition of
privacy to include Little Brother as the 'owner' of everyone's privacy
within a company, and thus, by future extension of the concept, Big Brother
as the 'owner' of everyone's privacy within a nation (and eventually, within
the New World Order).

After a short period of CypherPissing about the few pros and many cons of
this new direction in the encryption battle front, the CypherPunk aphorism,
"The answer to noise, is more noise." began to take hold, with Tim May
broaching the possibilities that "forward secrecy systems" might hold for
empowering the individual caught deep within the bowels of the Great
Machine.

Wittingly, or unwittingly, the CypherPunk Philosopher King sidestepped the
Ministry of Truth's new definition of privacy by counter-attacking with a
subtle, but important redefinition of email, by using a seemingly innocent
reference to "conventional e-mail" in his post exploring the possibility of
simply 'routing around' the 'damage' (an old CypherPunk tradition).
Perhaps the answer to 'InfoWar,' is 'more InfoWar.'
----------------------------------------------------------------------------

Gomez stared at the mountain of references that his Dark Allies and their
human minions had gleaned from email, news groups, mailing lists and web
sites from around the InterNet-references to troubling new trends and
technologies that foreshadowed a threat to the future that had been
preordained by the Evil One.

PHil's Unified Corporate Key-Yardstick of Outbound Uniformity.

No details, but the reference to Zimmermann was obvious. Had he just begun
to explore new developments in the Corporate Key technology that had been
slipped into the mix of his original concept behind PGP, or did he already
have methodologies in place to defend against the misuse of Corporate
Message Recovery?

SAK - Saboteur Access to Keys

This had the Mark of the Toad written all over it.
Throughout the Corporate Message Recovery system, identical corporate keys
began showing up on different systems. All indications were that people
inside the corporations had access to a method of slipping in the Saboteur
Key in a way which its footprint mirrored that of the original key.

Destination Escrow

This seemed to be the most dangerous of all the quickly emerging
'unconventional email' technologies. It had all the marks of a collaborative
effort between the CypherPunks, the Circle of Eunuch, Alt2600, MI9, COM-12,
and a host of other freeh-dumb fighters.
Remailers, Eternity Servers, Crowds, DevNull Addressing, Inner Onion
Routing-all seemed to play some part in this diverse, but highly effective
methodology of disguising the true routing and final destinations of email
and other communications.

Some of the DE technologies seemed to be escrowed internally, catching the
email after it had been processed by the email system, and before it had
been sent to its destination, either changing the destination, or mirroring
the message to other destinations, as well.
Some seemed to have the secret code for their true destination escrowed at
some point in the InterNet routing system itself, outside the watching eyes
of internal system security personnel.

Distributed Key Escrow

The Dark Allies were not certain what DKE technology actually referred to,
but it was suspected that many communications contained plain-text stego
which was protected by use of a distributed encryption and decryption key
which could not be compromised except by accessing the systems of all who
held a part of the key.
Unlike the public-private key technology, it seemed to be highly resistant
to attack by gaining control of systems and routers, or any form of
Man-in-the-Middle attacks. It was suspected that they were combined with the
use of a new type of distributed remailer, as well, but this had been
impossible to confirm, as of yet.

Gomez frowned�it looked like InfoWar was going to be a battle, after all.
----------------------------------------------------------------------------

One thing that the Magic Circle knows from our long battle with Gomez was
that he is, above all things, thorough.

There is no doubt in our minds that the Dark Allies, upon searching the
rubble of our last safe house, will find the small platinum plaque which
will provide not only a verification of the presence of the Circle of
Eunuchs and the CypherPunks concealed deeply within the heart of WebWorld,
but also a confirmation that:

"The end of our beginnings, will be to arrive from where we started, and to
know it for the first time."
-The Magus

It will not take long for the Dark Allies to notify Gomez, both now and a
century in the past, that the front of the plaque reads:

                     Trei Transponder � Peter Trei 1997
     "Those who do not learn from the future, are doomed to repeat it."

And Gomez will undoubtedly understand, for the first time, the true meaning
of the motto of a small computer company formed in Tucson, Arizona, a
hundred years previously, when he reads, on the back of the plaque:

                                  Built by:
                           Pearl Harbor Computers
                       "It Ain't Over 'Till It's Over"
----------------------------------------------------------------------------

                           CypherPunks Write Code
----------------------------------------------------------------------------

                        "The Xenix Chainsaw Massacre"

                 "WebWorld & the Mythical Circle of Eunuchs"

           "InfoWar (Part III of 'The True Story of the InterNet')

                Soviet Union Sickle of Eunuchs Secret WebSite
----------------------------------------------------------------------------







From tm at dev.null  Mon Oct 13 10:43:42 1997
From: tm at dev.null (TruthMonger)
Date: Tue, 14 Oct 1997 01:43:42 +0800
Subject: InfoWar Epilogue 2 (Part III of 'The True Story of the InterNet')
Message-ID: <344259C9.5243@dev.null>

A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 9517 bytes
Desc: not available
URL: 

From aba at dcs.ex.ac.uk  Mon Oct 13 12:33:17 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Tue, 14 Oct 1997 03:33:17 +0800
Subject: mailing list attacks (was Re: Stronghold)
In-Reply-To: <199710131452.KAA26663@jafar.issl.atl.hp.com>
Message-ID: <199710131455.PAA02279@server.test.net>




Jeff Barber  writes:
> > Dimitri Vulis  writes:
> > > did _not appear on the "unedited" list. Nevertheless at least one
> > > lying C2Net shill from Hewlett Packard claims that my articles
> > > appearing on the unedited list on January 30th prove that I wasn't
> > > being filtered from "unedited" one week later.
> > 
> > Some thing's just can't be proven.  That logic clearly doesn't flow.
> 
> For the record, I made no such claim.  In fact, my exact words were:
> 
> [me:]
> > Since obviously none of us who were on the -unedited list can say for 
> > sure whether we received everything sent to it, I can't say with 
> > certainty this never happened.  But....
> > This is the problem with being known as a liar.  Nobody is inclined to
> > believe what you say without substantitation.  So I still don't see any
> > reason to believe that anything was "censored" from the unedited list.

One additional reason to believe that at least some things were
disappearing from the unedited list was Attila's claim that some of
his posts weren't getting through to the unedited list also.

Notice that I don't say why they were disappearing because that is
almost difficult to prove at this point.  I detailed Attila's claims
in the post you are replying to.

> But Dimitri has claimed that there were "numerous people" who were 
> CC'd to the message that is alleged to have disappeared from -unedited.
> I'm sure they'll all be chiming in to back him up just like John Young 
> did. :-)

Mailing lists are pretty vulnerable to spoofing in various ways.  At
the time of the attack, an additional possible class of spoof which
may or may not have been occuring would have been:

For someone to use the list of subscribers available for the lists
homed at majordomo @ toad.com to fuck with peoples minds.  For example
by sending messages with forged From & other headers making them
appear as if they did come from toad.com to all subscribers, or some
subset of them.

That would allow one to construct some very interesting problems: for
example Sandy apparently passing to the edited list something which
seemed violently out of character, but sending it to everyone but him,
so that he would deny seeing it even, and look like every one else as
if he were blatantly lying.

Or to generally mess with who you sent to for different lists and
combinations of lists.  This would allow you to construct all sorts of
apparently independently confirmable conspiracy theories.

I'm not sure some of these things weren't happening.  There are a few
current and former list members who delight in this kind of clever
prank.

Reckon you could do something about some of these attacks by adding
signatures on outgoing mail from the mailing list, and by posting
regular message digests of posts to the list to make it harder for
people to deny service to one individual.

Even unsubscribing and subscribing other people was not prevented
originally with toad, but there are existing methods to solve this
problem in that newer versions of majordomo allow nonces to be sent
for confirmations of these things.  Doesn't stop recursive list
subscriptions, nor subscribing one list to another (because the
attacker can see the nonce appear in the list).

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710131652.RAA02526@server.test.net>




William Geiger  writes:
> >I think this is taking it too far.  Have you considered how much traffic
> >DNS handles right now?  I would have thought it would be many orders of
> >magnitude more than forward secret email is going to cause. Web traffic
> >is the bulk of network communications, just imagine the DNS lookups
> >caused by 50 million netters clicking away. 
> 
> Yes but everyone's Ip's aren't changing every week. It's not just a matter
> of the multitude of requests that would be required in this systems as
> everyone will need to update all their keys on a weekly basis but also the
> DNS records will be having this turnover. the DNS system has enough
> problems as it is let alone what would happen with the implementation of
> forward secrecy would cause (my best guess that within a week or two the
> whole thing would crash and burn).

Your argument neglects that it was you who was arguing for DNS
distribution of keys.  I was never too keen on this idea.  Your
descriptions of the near breaking point reaffirms my dislike, though
I'm not sure I agree with your crash and burn predictions.  Mind, DNS
maintenance is not something I have a great deal of familiarity with.

My comparison was intended to be "implementing forward secrecy by
storing comms keys on keysevers using ad-hoc distribution of
distributed keyservers would cause orders of magnitude less traffic in
total than current DNS requests".  I think that sounds entirely
reasonable.

By ad-hoc distribution of key-servers I mean key servers which don't
have replication but rather store keys for some designated set of
users within a set of domains.  The DNS would be a good place to store
the resolving mechanism for deciding where the keyservers live.
Similar perhaps to the way you use a DNS MX record to find a mail
exchanger for the domain name you're trying to send to.  Use DNS
keyserver extension record to find keyserver IP address.

With that architecture, the whole thing sounds pretty scalable, and
adds negligble extra overhead to the DNS system.  Storing the keys
themselves directly into DNS is something people get interested in for
IPSEC, and for that application it seems more reasonable.

> >Bear in mind also that once the new key has been issued, you could also
> >release a deletion request for the previous one on the keyserver in the
> >form of a revocation certificate.
> 
> You would have to otherwise you would run out of storage very quickly.

Indeed!

> The best I can think of handleing the key distribution problem is to
> attach a copy of your key to every correspondence and then have the client
> automatically check and see if it has changed and update the keyring as
> needed. 

My thoughts also.  In fact for particularly short lived keys I have a
scheme worked out where key servers are not used at all.  I haven't
really described this scheme yet, as people seem to be raising enough
objections over the logical uses of current PGP functionality.

> If find both the automatic processing & sending the key with every
> messages quite bothersome (these are PKS implementation issues that
> should be covered in a different thread).

Well I thought it was a neat idea.  Perhaps that is because you have
the world view that every email recipient has a direct IP or at least
a dialup with flat rate connection charge, and also another reason I
thought it was neat was because I was considering it as a mechanism to
enable per message forward secrecy in a manner which I still haven't
explained in any detail.

> [protecting against users who store keys on sticky notes]
> 
> Well IMHO this scenario does not forward your cause much. If the physical
> security is that bad (unrestricted access to equipment, weak passphrases,
> Post-it-Notes, ...ect) then the information an attacker is looking for is
> more than likely going to be available to him without messing with the PGP
> keys. 

Yeah, well perhaps it wasn't that great an example.  However you can
see that extra security is being imparted even into this less than
ideal scenario.  These security problems are representative of the
problems some real life businesses face.  Most company employees do
not extract as much fun from the arcane fine points of best security
practice as we do.  They probably view security as an inconvenient
imposition, forcing them to learn things they don't want to know
about.

> If the reverse is true and the physical security is strong the the
> case for short-term separate keys is gone as the risk of exposure to
> a long term key is greatly reduced.

Ooh no.  It's not gone at all.  I think you are being a tad closed-
minded here.

If you have excellent security practice, you are still vulnerable to a
number of attacks which my proposal gives extra protection from:

1. being blackmailed, or having the password for your encryption key
   with 1 year expiry period rubber-hosed from you

2. having a keyboard sniffer installed by the Feds burgling your house
   whilst you are out.

3. having a virus installed by an attacker remotely or directly
   infecting your machine

With all 3 of these cases your security is blown wide open, despite
your 100 bit entropy pass-phrase and crypto-anarchist 'tude: "you'll
get my key when you pry it my cold dead fingers", and apparent
reasonable security precautions you will have blown your security.  If
your key had a 1 year expiry that might mean the Feds get up to 1
year's worth of the plaintext from the encrypted traffic they had been
meticulously collecting from their collaboration with invweb.net.

Now consider what happens to the above attacks when you have forward
secrecy:

1. blackmail/rubberhose .. it's kind of hard to not notice black mail
   or having passwords rubber hosed from you.  So as you have used my
   recommendations of the most paranoid forward secrecy setting (1 new
   key per message, sent in message) the attacker gets zip.  He gets
   nothing.  With a key update time of 1 day, your attacker gets up to
   one days plaintext, or with 1 week update up to 1 weeks comms.

2. keyboard sniffer .. presuming that you don't notice it, the
   attacker gets traffic going forward in time, but doesn't get old
   traffic

3. virus .. presuming that you don't notice it, the attacker gets
   traffic going forward in time, but doesn't get old traffic

I think that is a security advantage, wouldn't you agree?


There are quite a lot of precedents for using forward secrecy... for
example SSH, SSL, and some of the IPSEC protocols.  They aren't using
forward secrecy for phun, they're using it to increase security also.

Granted it's easier to do interactive forward secrecy with IP
connections than email, but forward secrecy is just another term which
describes something we are all already very familiar with: key expiry.

Consider why does PGP provide you with a mechanism to expire keys.
The reason is because it's acknowledged that it's a good idea to
change the keys now and then -- because this provides you with forward
secrecy -- the longer you use the same key the more the risk that it
is compromised accumulates, and the more value it will have to the
attacker because of the larger number of messages it is protecting.

So all I am really saying is that shorter key expiry times give you
more security... not that radical a statement I don't think.

> >That much as such doesn't need any modifications to the current PGP
> >standard.  It's an implementation issue.  Another vendor could easily
> >already implement this type of functionality.
> 
> I have some serious reservations of the security implications of frequent
> changes to the keys. It has the potential for the user to disregard all
> changes to the keys (think how quick the warning pop-ups in Netsacpe get
> ignored and/or disabled by the user). The other possibility it to make the
> key changes transparent to the user which I do not like at all for obvious
> reasons (I do not see complete isolation of the user from the cryptosystem
> as a Goodthing(TM) ).

Heh.  Well there is where we part company then, because I do think
hiding some parts of the crypto innards where this is appropriate is a
good thing.  I think the generation of new transient keys is one such
case.

You are already using this mechanism every day anyway: your SSL
enabled web browser will be setting up key exchanges using short lived
communications keys with secure web servers.  You do see notices when
you haven't agreed to trust this organisation before, but you will
observer that netscape asks you if you would like to trust this
organisation this session only, or for all further sessions.

What I am proposing is the same "for all further sessions", applied to
PGP.  I reckon it is more secure because you have the PGP WoT to help
guide you in your decisions, where as I currently find a lot of web
sites using uncertified server keys, and I'm not sure how much
security the very limited numbers of hierarchical server certifcate
issuers provide in practice.  I prefer the PGP WoT where I can get
face to face transfer of keys with people.  The trust is much more
immediate.

> >Also I'm arguing for separate communications and storage keys, I think
> >this is almost essential once PGP starts to work with escrow schemes,
> >because there are similar arguments for separating storage and
> >communications keys as there were for creating separate signature and
> >encryption keys from the original single key.
> 
> Well I have been thinking more on this. I still am not sold that separate
> keys are needed but even if they are I am inclined to believe that PGP is
> not the place for them. I am leaning towards the opinion that file
> encryption should be handled by the files system along with other disk
> security features. This seems more appropriate than having your e-mail
> client doing individual file encryption.

I agree with you there.  That is way the most appropriate place to put
storage encryption.  However (and this is my point also in another
form), if you were to do this, you would want to use a different key
than the one you use for protecting communications keys, because the
storage key may have different expiry requirements, and different
escrow requirements.

But... we have a circular dependency in our argument here, because
when I was arguing that you didn't need to encrypt the contents of
your mail folders 10 messages back or so, you jumped in and said that
you kept email communications encrypted in your mail folder.

I accepted your point, and countered that if you wanted to encrypt
messages in your mail folder, that you should use a storage key to do
so.  (Otherwise you couldn't sensibly make use of the expiry feature
on your communications key, as when your comms key expired, so would
your access to your mailbox!)

I agree with your above suggestion that it is actually easier, safer
etc, to use disk level encryption systems.  However I do think we have
to face that these are not that widely deployed yet, and that people
like yourself a few days back are correct in arguing that there may be
a case for building the functionality of encryption of stored traffic
in folders.  As PGP Inc is fielding integrated Mail clients which have
mail folders managed by the mail client, this gives us the case for
separate storage and communications keys.

This also gives a convenient place to put escrow -- you escrow the
storage key.

This implementation would completely avoid all arguments about PGP 5.5
being GAKware.

> >I also personally prefer people to send me keys in email, because the pay
> >per second phone lines here at home mean that I tend want to avoid doing
> >too many online key lookups, so I think this would be an individually
> >useful feature.
> 
> I do my keylookups automatically durning the msg filtering process which
> is done in parallel to the message Dl's. 

A clever optimisation to be sure.

> The outbound message lookups are a little more time consuming but is
> compensated by fewer keys to look for both because fewer messages on
> the outbound side and the use of key caches on the client machine
> for the most used keys for sig verification and encryption. 

I don't have a key cache, and my keyring is only 216k.  But I'm
curious about your automated process .. are you also checking all
signatures that you can by downloading the keys and checking out the
WoT for all received mailing list traffic etc?  This would cleary
result in a much bigger key ring.

> Also logging of e-mail addresses that do not use PGP cuts down on
> the number of lookups needed

Good optimisation.  It sounds really as if your OS/2 setup is more
advanced than a lot of other stuff around.

My setup is GNU emacs with Pat LoPresti's mailcrypt.el PGP and
remailer support lisp extension for emacs RMAIL and emacs GNUS
(newsreader).  I love it to bits.  It is totally excellent.  It
doesn't have a couple of your optimisations, but other than that it's
pretty good.  When you send messages, if you don't have the key it
will fetch it for you by trying keyservers, then finger user at domain.
It can snarf keys out of mail messages, paste keys into them, sign,
encrypt, check signatures, use remailers (type I and mixmaster).

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710131924.UAA02724@server.test.net>




Anonymous gives some more good feed back on the PGP GAK argument.  A
real battle of wits here, anonymous appears to be a pro, probably a
PGP employee, anonymous doesn't miss anything (apart from the fact
that he has apparently swallowed whole the "communications key
recovery" fallacy being spread by the GAKkers).

Anonymous writes:
> Advocates of the model where software is automatically archived on
> receipt, either in cleartext or re-encrypted with a corporate key,
> need to be aware that there are problems with it:
> 
> No notification to sender about the policy.
> 
> [..]  People should know if their mail is going to be automatically
> saved in the clear to a company archive.  The best way to make sure
> of that is to have the sender be the one to do it, or not.

Hmm, you've turned that argument on it's head there, and come up with
an interesting counter point.

I'm not sure it's that valuable a distinction though, because you
can't enforce it either way.  You really have no idea what the
recipients software is doing, nor who the recipient is printing out
and showing your email to.

I think that the best that can be hoped for is that it is considered
fair play, and a convention that businesses are encouraged to adopt,
that second reader policy, and storage policy is flagged.

Following from your concerns it would seem we currently have 3
possible "how I treat email" flags:

- email is readable by company
- email is being archived for company records
- email is being archived in the clear
- email is discarded after reading

Interestingly pgp 2.x has an option to partially suggest that last
one, a kind of "don't save in clear" request (from pgp.hlp in pgp263i):

Use -m to force display of plaintext only (no output file)

I know one person who used to regularly send me stuff encrypted this
way -- it used to cause my mail client to barf (emacs RMAIL &
mailcrypt.el) because it couldn't cope with this, so I had to manually
read it with the command line pgp, which would insist on displaying it
to you with it's pager, and not storing it to file.

Quite a nice privacy touch.


Anyway you used your point to argue that:

> The best way to make sure of that is to have the sender be the one
> to do it, or not.

which I take to mean that you are using that to argue that the PGP
GAKware enforcement feature is a good idea.

I strongly disagree because a) communications keys should be shorter
lived than storage keys, b) the way the PGP GAKware enforcement and
flags are implemented is literally an full GAK implementation, c) that
it is less secure to put extra doors into what should be for security
reasons short lived keys.

> No way to prevent third-party access.
> 
> With the corporate message recovery feature, the sender has the
> option of simply ignoring the recovery key and sending it encrypted just
> to the recipient.  Some corporations won't let it through, others will.

True.

> Some companies will want mail to be made recoverable by default, while
> still allowing an escape clause for personal mail and special purposes
> (like for "sensitive" mail which needs protection against subpoena
> and discovery).  They can use the "optional" CMR mode.  Again, senders
> are always notified as to which mode is being used by a given company,

Notifying senders of the archiving and access policy is good and to be
encouraged, however it never proves anything about what is actually
happening to your email, nor can it.

> and senders can be confident that if they don't use the third-party key,
> no access will be possible.  

I don't think this is true.  They will have no more proof that this is
the case than they will have with the storage recovery key solution.
Consider: the company could just as easily take copies of the email
after the user decrypts it with CMR.

The user may have an _expectation_ that there is no third party
access, but they can only hope that their expectation tallies with the
truth of the situation, and this is the case for either my storage
recovery solution, or PGP's CMR solution.

So there are no meaningful differences from this angle.

There are two major and definately meaningful differences between
corporate storage recovery (CSR) and CMR:

- CMR is a fully functional GAK implementation CSR is not

  This is directly analogous to the difference between GAK and data
  recovery, and was the reason the cypherpunks that Jon Callas
  observed chanting "key recovery bad data recovery good" where
  chanting.  The irony was Jon didn't realise that he was falling for
  the GAKker promulgated fallacy that these cypherpunks were chanting
  against, and yet he was using the same chant in his arguments not
  realising what it meant.

- CSR is more secure because:
  a) it allows shorter lived communications keys
  b) because it leaves no long term doors into communications, whereas
     CMR leaves two doors into communications

> With automatic encryption and archival on receipt, all mail will be
> archived, and senders have no notice and no guarantee that stated
> policies will be followed.

You have no guarantees either way.  You can implement any
functionality for storage, escrow, and message snooping with varying
loose degrees of tamper resistance into either CSR or CMR, using a
combination of storage key escrow (CSR) and Mail client enforcement or
GAKware (CMR) with the session key going over the wire encrypted to
the GAK master key.

As I said above, the best we can do is to encourage truth in
advertising about storage policy and number of people who can read;
and to provide flags to express these meanings within the OpenPGP
standard.

> No escape via super-encryption.
> 
> Even if the company is mandating a recovery key and filtering out
> messages which aren't encrypted to it, the sender still has the option to
> super-encrypt with the recipient key alone, before sending the message
> encrypted to the corporate recovery key.  This ensures that only the
> recipient's personal key can read the message.  With software which
> automatically saves the cleartext of the message, once the user reads
> the data it is available to the corporation via the snoopware.

Wew.  Hadn't thought of it that way.  Well you could choose to
implement it that way, or you chose not to at your option.  It hadn't
even entered my head to implement it that way! and I would strongly
argue against so doing.  (I am starting to appreciate how PGP people
must feel about my criticisms of their features; never-the-less, I am
confident that my argument is correct, and it is they who have allowed
themselves to be blinded by the GAKkers fallacy of escrowing
communications keys (the chanting cypherpunks mantra explained above)).

However, and this shows how you can still trivially hack around it,
you could super encrypt to a key which wasn't storage escrowed.

I also have said things about "official email" and "unofficial email"
which I considered companies should be encouraged to provide for their
employees, and there is a case to be made for this as argued by Tim
May and Bill Frantz recently, which is that it is probably not in the
companies interests.

I originally started out thinking that companies didn't as such need
much in the way of access to old email messages, or that they could
store them in the clear and encrypt the whole disk with recoverable
storage keys.  However some tenacious people (you?) started arguing
that it would be a security breach to store email in the clear after
having encrypted it for communications.  There is also the case to
consider of the PGP Inc mail client which does not integrate disk
storage functionality.

Therefore I was worked out a sample architecture demonstrating that
you could archive email in encrytped form if you wanted to acheive
this without needing GAK compliant architectures such as CMR.

I would also defend myself from the above slur that I was trying extra
hard to ensure that there is no escape from super encryption.

I have lots of ammunition, don't worry :-)

The reason that I am trying to demonstrate that you can enforce any of
this at all, is that some of the GAKware proponents on the list
(anonymous and not) argue that it is necessary not just to have access
to communications keys for data recovery purposes to ensure data
availability (there's that recurring fallacy again), but also that it
should be possible for the company to snoop on the user without the
user being able to avoid this.

If you are at all worried that your GAKware CMR system doesn't quite
meet up with the flexibility of my system in allowing you to get all
little brotherish and enforce things, well I can make a suggestion as
to how to increase the enforcement rate of your GAKware system.

Do a web search on "Binding Cryptography" by a guy called Bert-Jaap
Koops, and a couple of co-authors (I think another of the authors is
the main author, but I don't remember their names right now.)  I was
particularly disappointed at the time with Bert-Jaap for allowing his
name to be put on a paper describing a technology which has only one
purpose: GAK enforcement, and expressed this to him.  However I
suppose technology is neutral -- it is what you use it for that is the
problem, probably it could have some other uses.

So, y'all PGP Inc GAK lovers will love what this allows: it allows you
to enforce at your GAKware big brotherish SMTP policy enforcer app on
the inbound direction that not only is the El Gamal key with the
correct key-id there in the GAK master key second recipient, but that
the same session key is in use inside of the users PKE packet.

Not that I'm suggesting that you do that or anything, I merely draw it
to your attention to demonstrate my point that either of the systems
can be implemented in varying amounts little brotherishness, but that
the over-riding point still remains that CMR is a fully functional GAK
system where-as CSR is functionally useless for GAKkers because they
want to read your communications, not what is stored on your disk.

This is because the GAKkers will have to break in to your building to
get your disk, this is not nearly enough fun for the Feds, because
they kind of fancied having push button remote key word scans of the
entire world communications.

(Remember the meme the chanting cypherpunks were trying to promulgate
as described above: governments want access to comms keys, businesses
want access to storage keys.  This cypherpunks meme is absolutely
central to the whole argument).

> Facilitates GAK!
> 
> Suppose this solution is adopted, and software is developed which
> automatically re-encrypts received email and sends it to a secure archive.
> It's robust and works with a wide variety of email packages.  Now the
> government could simply mandate this to be used for all mail reading
> software.  

You are indeed an observant anonymous person!  I'm obviously dealing
with an extremely bright person, even if he seems to have swallowed
the inherent fallacy of the communications "key recovery" meme which
the GAKkers are promulgating.

I too fretted over this possibility.  And this is why I tried to avoid
the idea that you would have a central company archive of stored
encrypted email.  I couldn't work out a way to ensure that the
communications which were intended to occur inside the corporate LAN
could be prevented from being abused to implement GAK, a problem that
you so observantly spotted also.

Aside from being awkward and implementing it with screwy transfer
protocols so that it was all non-standard, it seems inherently
difficult to avoid.

So firstly I switched to contenting myself with satisfying what PGP
Inc claimed the user requirements for CMR where.  To me this meant
that centralised backup would have to be avoided to avoid GAK
compliance.  You could argue independently that not doing this is far
less little brotherish anyway.  Also that you can enforce to some
reasonable degree storage on the local machine, to give second access
to the users mail folder, which is better than having a central
snoopware HQ, which can then be perverted to become NSA GAKware HQ.
(Granted the employee could purposely trash the disk by taking it out
and breaking it -- but you'd still have backups from the last backup
point -- and we're not after 100% success rate because there are other
easier ways to bypass the system).

Jon Callas claimed the main company requirement for data recovery was
for companies to be able to retain data availability.  So if we take
him at face value, that presumably means that companies don't
especially want high assurance snoop functionality to read email where
recipients refuse to decrypt it, or go to extra efforts like
super-encryption.  Jon Callas and other PGP employees also argued as a
plus point for the CMR design that it was easy to bypass.  This
suggested that users could deny company data availability in a number
of ways, and that PGP employees wouldn't be losing sleep over that.

Well CSR achieves all that.  You can hack it in various basically
analogous ways that you can hack CMR.

Now, as I describe above, the reason that I started talking about
tamper proof clients was to demonstrate to those who complained of
loss of company ability to snoop in the face of a company employee
hostile to the snooping.  If you don't like that (and I sure as fuck
don't), well don't build the little brotherism in either.

But, if you do want to have some kind of mildly enforceable corporate
snoopware well you can do it with reencryption to an escrowed storage
key or to a key recovery storage key.

For people who want to stop employees beyond that I think it is
reasonable to say that this is disproportionate effort spent on the
problem given other physical avenues for company information leaks.

If a company is that way inclined that could say that attempts to
subvert the snoopware was a sackable offense.  (Again not that I'm
arguing we should be encouraging companies to do any of these things,
but rather than in proposing the CSR method as a non GAK compliant
replacemnt for CMR, I am being challenged to demonstrate it can do
everything that CSR can do with similar levels of enforceability).

> The secure archive would be a remote archive maintained by the FBI
> to protect public safety.  All plaintext would be sent there,
> encrypted by the FBI key.  The business software would already
> support this.  This is GAKware!  Unlike with a CMR system, the
> sender would have no way to prevent access.

He could prevent as I argued above; also you could build more secure
and similarly hard to bypass GAKware (CMRware) with Binding
Cryptography and a restriction to El Gamal keys.  Anway I would
strongly argue against fielding a system which worked in this way, for
the exact same reasons that I am arguing against PGP Inc's fielding of
the CMR system: because as you so rightly and observantly point out it
is GAK.  (I am not noticing you say much about CMR being GAK
... perhaps you actually acknowledge it is GAK, but are trying (and I
think failing) to show that CSR is GAK too.  Well no dice, I think CSR
allows non GAK compliant functionality with a large degree of
flexibility.  CMR on the other hand just _is_ GAKware.  If you
remember the KRAP (Key Recovery Alliance Program) and have the
documents handy I am sure that if you go down the checklist that you
will find that pgp5.5 matches just about all of the hotly contested
NSA given requirments.

> Can't handle forgotten passphrases.
> 
> People forget passphrases all the time.  With re-encryption on receipt,
> there is no way to recover gracefully from this error.  All the incoming
> encrypted data is lost until you can notify everyone who has sent mail to
> resend it, and get your new key out to all of them.  These may be purchase
> orders, sales leads and other important documents which represent lost
> business if they can't be recovered.  This is going to invite people to
> use poor security practices like writing down passphrases or choosing
> ones which are easy to guess.  Worse, it...

Lets think this through.  You have 3 keys.

- storage keys
- signature keys
- communications keys

You can escrow storage keys if you want -- this provides data
availability.  As an alternate and approximately equivalent mechanism
you can use storage key recovery (with a second storage recipient).

Signature keys we shouldn't have any arguments about I think because
y'all presumably agree that the user should be the only hodler of
those to prevent third parties forging his signature.

Communications keys, for security, and non-GAK compliant design
reasons you also should not escrow.

I think that your complaint is the same as that raised by someone
else, that is if some emails come in and in the mean time the employee
forgets his passphrase, you lose the emails because you can't recover
the communications key, because it is treated like signature keys; no
escrow, no backup.

This is a valid complaint.

However as a fob to the significance of this I can offer:

- if the email is important value "official communications" as you
  suggest, it might be an idea for the sender to archive them anyway
  in case they disappear down a blackhole in transit, or it will be
  independently likely that the important company document / figures /
  source code will be stored on the senders disk somewhere.

It's the only down side I can see for the system, which allows you to
avoid GAK compliancy.  It also has a number of quite major security
advantages which I discussed with William Geiger in the thread on DH
forward secrecy in email.

> Invites key escrow.
> 
> In order to prevent this problem, employees may be forced to share
> their secret keys with corporate management.  

You could do this as a solution.  However it has GAK problems, and has
as you say Clipper overtones, using the same master access method.

However you could also view it this way: you will likely be encrypting
the private parts of the communications key with the same passphrase
as the private parts of the signature key.  If the user forgets their
signature passphrase you'll have to issue them with a new set of
certificates for their newly generated signature key.  This is also
inconvenient, but you live with it because of the over-riding
principle that signature keys should only be held by individuals.

With communications keys the main reason not to escrow them is that
doing so builds a GAK system.  Thus is harder to argue that these
restrictions are inherently necessary unless you want to avoid GAK so
much that you are willing to live with this weakness.

I'll think on this part to see if I can find some way to tune down the
significance of this type of data loss.  Do you have any ideas?

One which comes to mind is smart cards for key tokens.  Harder to
forget.  Still you _can_ lose them.

There is however a separate danger with smart cards, they are kind of
a form of escrow themselves if they are not tamper-proof enough
because someone with resources may be able to recover the keys from
them.

Smart cards are however very convenient for key storage.

> Software will be written to facilitate this process.  Crypto
> companies are already doing this.  Nortel Entrust allows key
> generation by management, where employees are given the keys and
> management keeps a copy.  Shades of Clipper!  This also fails the
> notification requirement.  Don't believe me?  Take a look at this
> description of the Nortel Entrust product:

Yeah I believe you.  Some folks don't give a shit about privacy, nor
about GAK.  The $ is all that counts to them.  Selling their mother
for a bit of change wouldn't cause them a second thought.

> No system is ideal.
> 
> Before pushing this re-encryption model as a panacea, think about the
> implications.  No system which provides automatic access to business data
> is going to be privacy friendly.  Any such system can be perverted into
> supporting GAK.  Load it up with all the disclaimers you like, but if
> you advocate software which contains key escrow and which automatically
> provides cleartext to third parties, you are not advocating software
> which protects privacy.  Be prepared to be called an advocate of GAK next
> time you push for software which automatically archives cleartext, because
> if it can save it for business, it can save it for government.

The difference is still centered around the central fallacy that the
GAKkers are promulgating that the government should be allowed to have
access to all of your communication keys to allow the company to
protect data availibility.

The problem is that your disk is not stored in those communications,
so having the communications key back from the government key recovery
infrastructure does nothing to help you recover your disk data in
event of a disk crash.

In addition my simple observations derived from this are that well:

- if government is so damn keen on gaining access to communications
  keys, we'd better make damn sure we have no data on disk encrypted
  with communications keys!

- if government is so damn keen on encouraging companies to build GAK
  products (clipper, tessera, KRAP (Key Recovery Alliance Program)
  Public Key Infrastructure ("CAs" with copies of communications keys,
  as if you want them backed up)), well I'm going to do my damnest to
  make sure that I don't write the software.  If PGP Inc chooses not
  to write a GAK compliant product, and the PGP standard is
  successful, well then we have done all we can to frustrate
  government GAK plans

Given those observations, lets take a look at this claim:

> No system is ideal.
> 
> Before pushing this re-encryption model as a panacea, think about the
> implications.  

I'm trying.  Your feed back is helping to explore the limitations and
flexibilites of CSR as new scenarios are explored.

> No system which provides automatic access to business data is going
> to be privacy friendly.  

Well it's a little brotherish sort of activity perhaps, but some argue
that companies have property rights which you could use to conclude
that if they are paying for your time, and they own the machines, and
the networking facilities, that perhaps this isn't so unreasonable.

Provided you stick to data stored on disks you minimise your problems
of being accuesed of GAK.

> Any such system can be perverted into supporting GAK.

I have given you a CSR architecture which is non GAK compliant.  Your
task is to deploy this as widely as you can.  Then with 80% of
companies using non GAK compliant software, the GAKkers are going to
be struggling.

The other scenario, PGP Inc's CMR, is already GAK enabled.  It
provides a smooth migration path to GAK.  With 80% of companies using
that type of GAK compliant software we're screwed.  PGP will be the
guilty party.

> Load it up with all the disclaimers you like, but if you advocate
> software which contains key escrow and which automatically provides
> cleartext to third parties, you are not advocating software which
> protects privacy.

There can be legitimate reasons for restrictions on privacy within
companies where this is required to ensure data availability.  The
main points about this are that a) you recommend the policy of
informing users (ensuring that they know that the data on this disk is
backed up, that this email folder is backed up etc.) b) that PGP
doesn't use the excuse that a GAK system _could_ be built by
perverting CSR as an excuse to fields something which is unavoidably a
GAK compliant system: CMR.  With CSR you as implementer and to a
certain extent standards setter have the power to do something about
having a non-GAK compliant installed software base.  With CMR you have
no choice but to implement and field GAK compliant software.

> Be prepared to be called an advocate of GAK next time you push for
> software which automatically archives cleartext, because if it can
> save it for business, it can save it for government.

I don't think that is really fair.  My motives for exploring the
functionalities is driven by other peoples user requirements which
they are thrusting on me with the challenge that I show that they can
be met with CSR.  I have almost completely been able to show that this
can be done for the things which have been thrust at me.

This in no way indicates that I _like_, or approve of the little
brotherish, or snoopy things people are challenging me to show can be
implemented with CSR.

But what I am certain of is that you _can_ build a non-GAK compliant
system with CSR, which can have just about any functionality you care
to add (snooping, weakly enforced email archiving to recoverable keys,
separate "official" and "unofficial" email boxes, flexible storage key
recovery architecture).

I am also certain that CMR as implemented by PGP is a fully
functioning ready to roll GAK compliant system.

Lets try a different tack: I'll issue _you_ a challenge: can you
modfiy the CMR proposal so that it still achieves stored email data
recovery and so that it is no longer GAK compliant.

I don't think you can do it.  I'll be happy to be proven wrong.

I think you'll find as you try to work your way around away from GAK
compliance it that you will end up with something which _is_ CSR.

Well?

(Thanks for the long debate... I hope it has been useful).

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710131951.OAA23622@raid2.fddi.phoenix.net>



While I agree with the general points you make in your Crypto Blues, 
I also agree with what I am reading from others regarding paving the 
way for GAK.  This is probably because you didn't actually deal with 
those criticisms individually in your rant.

To say that you will draw a line somewhere down the road is 
ineffectual. It's not unlike the gun owners who won't join an 
organization, won't communicate with their elected representatives, 
and rely on "Well, if they come for *my* gun, they'll have to pry it 
from my cold, dead fingers!"  It's too late by then.  If and when it 
comes time for one or more of you to decide to quit rather than do 
what is wrong, it will be way too late.  I'm reminded of the 
far-left-liberal comic and actor Dennis whatshisname who, in a 
standup act, made reference to the "cold, dead fingers" view of some 
gun owners and said, "That'll work!"

Whoever it was who said that the capitalists would sell the 
communists the rope with which to hang them was right.  It is even 
worse in today's brain-dead business world where policy decisions are 
made by bean counters who can't see more than 90 days past their 
bottom line and have no visibility whatsoever of the rich component 
mix of that bottom line.  I have no doubt that if and when the time 
comes that the government puts out RFPs for ID chip implant systems 
or tattooing barcodes on our foreheads there will be no scarcity of 
companies lining up to get the contracts.  Free enterprise doesn't 
automatically confer intelligence, forward view, or an understanding 
of freedom and the long-term consequences of undermining it.

It is incumbent on everyone who favors individual liberty and
privacy to do everything possible to prevent the infrastructure for
GAK and other police state measures from being put into place.  Adam
Back is entirely correct in believing only in technical solutions,
not words.  It must remain technically difficult, even impractical,
for politicians and bureaurats to simply prescribe how mechanisms
put in place by well-meaning people will be used to invade privacy
and monitor communications.  The best defense against censorship is
a technological structure that defeats censorship before it starts. 
The best defense against the destruction of privacy is a
technological structure that makes invasion of privacy difficult or
impossible.  It is far better to have a system in which a
destructive proposal fits badly and threatens to cause innumerable
uncontrollable consequences than one which lays the groundwork for
the easy implementation of destructive proposals.

The risk-of-loss set of arguments is also in some ways a large red 
herring.  There is nothing particularly unique about crypto that 
makes the potential loss of information qualitatively different than 
countless garden variety risks with which people deal every day.  
May organizations have stopped backing up desktop PCs.  Most 
everyone tried to do those backups at one time, but as disk sizes 
and data volumes increased it became impractical in many 
organizations.  This represents a far greater risk than the loss of 
messages or files the same employees may keep in encrypted form, but 
there are no interest groups or government bodies trying to propose 
Desktop PC Escrow systems.

Many employees wittingly or unwittingly use the strongest crypto in
existence, from which there is *no* recovery under any circumstances
should the employee drop dead: wetware storage.  Rate of
technological change and increasingly full "plates" have combined to
reduce documentation to historic lows.  If a document becomes
obsolete, even false, virtually the moment it is completed, it is
less likely to be written.  If it's never written because its 
durability is in question or there is too much else to do, it can 
never be recovered except from the functioning mind of the custodian 
of the information, but no one is proposing "brain escrow."  The 
costs of dealing with the loss of an employee with a headful of 
unique knowledge are becoming an expected and largely unnoticed 
thing, like the expectation of a third world business that a simple 
action like fixing a piece of hardware may involve a large multiple 
of the time and money it would cost in any U.S. city.  And still the 
bean counters haven't a clue.

It is even quite common these days that when one of those custodians
leaves an organization there is insufficient staffing to make even a
feeble attempt to pick up what the departing person has left behind.
Rate of obsolescence aggravates this by making it seem easier to
just implement the next version or product than pick up the pieces
of managing the old one.  I've seen people depart, leaving a cube
full of diskettes, manuals and, presumably, notes, only to see the
organization move someone else with different job responsibilities
into the cube and never, ever, not even once retrieve or look at any
of the materials of the departed employee -- not their PC, their
files, their desk, their file cabinets, their manuals -- nothing.

Individuals can also wipe their mail files, wipe their disks, suffer 
disk failures, etc.  They can take the only copy of something home 
and die in a fiery car crash.  They can drop their laptops from 
heights more than the prescribed 2 inches.  It is not possible to 
list the ways in which information can be lost and/or compromised, 
ways with which key recovery cannot possibly attempt to deal.  Since 
many of those things happen all the time in the real world on a daily 
basis it goes unnoticed that the vast majority of them are dealt with 
by the people involved without comment and largely without noticeable 
adverse consequences, just as when smoking was common in offices it 
wasn't particularly noticed that most offices didn't burn down 
despite the widespread use of open flame and smoldering materials in 
tens, perhaps hundreds of millions of instances daily.

Loss of encrypted information is almost a non-issue in reality, 
somewhat like the non-issue of the risk of flying by scheduled 
airline.  Crypto, like airliners, increases the probability that a 
loss will be more noticeable by virtue of quantity, but has no 
inherent effect on the likelihood that a greater percentage of total 
information will be lost.  An employee generally exercises the 
same type of diligence in this area as in the myriad other 
areas where some thought and action must be directed at 
preventing catastrophic loss.  The motivation is the same, 
too:  retention of employment and avoidance of lawsuit.  An 
operations manager already has to figure out how to make sure that 
last year's backups will not only be physically safeguarded but also 
capable of being read and restored should they be needed, for 
example.  There is nothing more magic about "crypto" than there is 
about "backup" in this sense.

Crypto, like the Internet, is a mere conceptual hook on which the
ignorant (strongly represented in the so-called "news" media) can
hang a set of alarms and not necessarily needed solutions.  It's 
an umbrella under which those who have nothing better to do can 
collect a set of issues for conceptual amplification and 
synergistic alarm enhancement, obscuring the fact that many 
functional counterparts to those issues are in the fabric of 
everyday business work.  

The mere use of a computer involves a larger quantity and more
serious degree of "gotchas" than arise in the use of crypto on those
computers, and has for many decades. The manpower lost in the 10+
years it took us all to move past the 640K limit and the 1960's
technology of DOS on the PC platform probably exceeded what would be 
required to do brute force solutions of the worldwide Y2K problem.  

Imagine that someone had latched onto the business danger of loss of
source code in 1960 and had sensitized everyone to the issue to the 
point where this kind of discussion and debate were being conducted 
over the need for national and worldwide standards and mechansisms 
for commercial and government protection against the loss of source 
code.  Imagine the Congress of the U.S. effectively taking the 
position that businesses are too stupid to safeguard the source 
code that runs their enterprises and that the government must 
require the filing of copies of all source code in case anyone 
loses some.  Or that all compilers and source editors have 
source recovery features.  Would that have sounded reasonable at any 
time in the last 30-40 years?  Would it sound reasonable today?

Yes, some people and organizations have lost source code.  No, most
people and organizations have not lost their critical source code. 
Those that do tend to weed themselves out, just as those who tend to
make bad decisions and take self-destructive actions in any area of
life, business or personal, tend to reduce their own effectiveness 
and participation in the game.

GAK is different, of course, in that it brings the agenda of the 
politics of power into the fray, and thus crypto has become the 
subject of an array of efforts as disingenuous as the safety 
arguments of unions when fighting to preserve a completely obsolete 
and useless job function.  All of a sudden governments who never gave 
a rat's ass about the risks to commercial entities of losses of any 
other kind of information in any other context are falling all over 
themselves to promote GAK because they are suddenly overcome by 
altruism.  Right.  Or because they have had a revelation and have 
remembered that commerce is good for the country and government is 
supposed to be a means of providing stable legal and public 
safety structure and not an end in and of itself.  Sure.  

Government never misses a chance to take opportunistic advantage, and
the chance to treat crypto as something qualitatively different than
thousands of other business and personal privacy questions and
mechanisms is too good to pass up.  The opportunity for government
to gain access to information that just happens to be digital is of
far greater significance than any offered justification based on the
danger to businesses that they will be too stupid to assure their
own access to their own information or the danger to nations that a
few people or groups of people may be able to communicate in ways
that preclude surveillance.  The only thing that GAK is about is
government power over individuals and groups -- the gradual
conversion of citizens into subjects, just without all the trappings
of old-fashioned royalty and notions of the divine right of kings.  
Governments see this as an opportunity to gain access to private 
communications in ways that would never have been acceptable in the 
days of paper letters and envelopes.  Because politicobureaucrats, 
like ants, cooperate instinctively to concentrate power in the halls 
of authority we see mulitple facets to the attack on privacy, but 
they are only that -- facets of the same ugly stone.

If the best minds fall into step to build and facilitate the
mechanisms to destroy individual liberty because "someone will do
it," we are lost.  If "someone" does it, but the best minds are
working to make a police state technologically infeasible, we may
not see the light of freedom extinguished after all.  In the past
this battle was heavily influenced by material resources. 
Increasingly, the playing field is being leveled by technology.  The
likelihood that a small number of individuals can significantly
influence the balance has passed the threshold of credible
probability, witness Phil's PGP and numerous other developments. 
This likelihood is on an upward trend, but the forces of darkness
are also making better and better use of technology.  Every person
who can make a difference and isn't committed to individual freedom
is an effective participant in its destruction.  If we have to
explain to our children and grandchildren why they have microchip
transponders in their asses and all their communications are
archived by the government it will be a pretty weak justification to
say that we brought home the paychecks without interruption.

Thomas Junker
tjunker at phoenix.net






From randerso at ece.eng.wayne.edu  Mon Oct 13 13:32:05 1997
From: randerso at ece.eng.wayne.edu (Ryan Anderson)
Date: Tue, 14 Oct 1997 04:32:05 +0800
Subject: America as a Shake Down Extortion State
In-Reply-To: <199710131547.RAA04977@basement.replay.com>
Message-ID: <3.0.2.32.19971013162440.006bd108@ece.eng.wayne.edu>



-----BEGIN PGP SIGNED MESSAGE-----

>Let's face it.  This "challenge it and get a legal precedent" approach has 
>done absolutely nothing to stop America, formerly one of the freest 
>countries on earth, from slowly devolving into a socialist police state.

Well, I'd have to point out that America still qualifies as one of the freest 
countries on the Earth.  It's just that the average has gotten worse (and 
we're a bit closer to it now than we used to be.)


-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQCVAwUBNEKDhzc3ytqHnNyNAQGchAP/YQSwPYI8aQuf/HZP84Wf9Lbpw+DZzrzu
2XHnVUTHf9m7DG5DFUurdWWPulyx/HdnWsRMbNpHW4a8ktlRRBQIg3UdcrG1U+q9
ty80/EuPHzwKRbe2pGqObsS8qntzlhLJHIPBoT0Pq+23SJ4WYsVilDUf0zK31haw
/r0y5E6w9nk=
=2W7L
-----END PGP SIGNATURE-----


-----------------------------------------------------------------------
Ryan Anderson -      "Who knows, even the horse might sing" 
Wayne State University - CULMA   "May you live in interesting times.."
randerso at ece.eng.wayne.edu         
PGP Fingerprint - 7E 8E C6 54 96 AC D9 57  E4 F8 AE 9C 10 7E 78 C9
-----------------------------------------------------------------------






From tm at dev.null  Mon Oct 13 13:55:06 1997
From: tm at dev.null (TruthMonger)
Date: Tue, 14 Oct 1997 04:55:06 +0800
Subject: mailing list attacks (was Re: Stronghold)
In-Reply-To: <199710131455.PAA02279@server.test.net>
Message-ID: <3442853B.74BF@dev.null>



Adam Back wrote:
> Mailing lists are pretty vulnerable to spoofing in various ways.  At
> the time of the attack, an additional possible class of spoof which
> may or may not have been occuring would have been:
> 
> For someone to use the list of subscribers available for the lists
> homed at majordomo @ toad.com to fuck with peoples minds.  For example
> by sending messages with forged From & other headers making them
> appear as if they did come from toad.com to all subscribers, or some
> subset of them.
> 
> That would allow one to construct some very interesting problems: for
> example Sandy apparently passing to the edited list something which
> seemed violently out of character, but sending it to everyone but him,
> so that he would deny seeing it even, and look like every one else as
> if he were blatantly lying.
> 
> Or to generally mess with who you sent to for different lists and
> combinations of lists.  This would allow you to construct all sorts of
> apparently independently confirmable conspiracy theories.
> 
> I'm not sure some of these things weren't happening.  There are a few
> current and former list members who delight in this kind of clever
> prank.

Many weird things happened during the course of the list censorship, not
the least of which was that every time someone on the list pointed out
apparent discrepancies between what was announced as being done and
reality, the mechanizations behind the list would change to become
more obscure.
More than one list member called this bullshit when I pointed it out, 
then shit a brick  when they researched the matter themselves, and 
found it to be true.

I was subscribed to all three lists at one time or another, and was
also subscribed from more than one account. I also had another list
member forward me their archive of posts from the lists.
There was a variety of interesting things which one could divine from
the different 'versions' of the list that appeared from these three
sources, one of which was that some controversial posts seemed to
go out from toad.com to *only* the person who sent it (or to people
who were cc:'d on the post), making it appear to the sender that 
their post had gone out to everyone on the list.
I had already suspected this from the fact that some rather outrageous
posts seemed to go unnoticed on the list, and I had confirmed it to
a certain extent by cc:'ing and bcc:'in certain individuals, but an
analysis of all the posts in my possession, from different sources,
confirmed it beyond doubt.

Although a variety of individuals could confirm various details of 
what I have described, the 'facts' are still pretty much meaningless
to those who did not personally do the footwork themselves.
Much the same applies to the Corporate Message Recovery of the new
alien-PGP being discussed on the Cypherpunks list.
Your best weapon is your nose. When something smells bad, it usually
is. All of the analysis I did of list posts served mainly to convince
myself that my original deductions, based on far less information,
were correct.

My main problem with the new product is that it trades on the name and
reputation of PGP to promote a product which serves a totally different
market and need.
It is similar to my using the status of a long-established
"TruthMonger's
Crazy Ramblings" mailing list to promote "TruthMonger's Trustworthy
Health
Products Mailing List" to the three list subscribers. (Or the use of
John
Lennon's music to sell sneakers... )

The *real* question is: "Does the packaging have a picture of an actor
in
a white smock, with a stethescope around his neck, a big-breasted nurse,
licking her hot, wet lips, and a child, petting a dog?"
If it does, then buy all of the company's stock that you can get your
hands on.

TruthMonger






From nospam-seesignature at ceddec.com  Mon Oct 13 15:03:20 1997
From: nospam-seesignature at ceddec.com (nospam-seesignature at ceddec.com)
Date: Tue, 14 Oct 1997 06:03:20 +0800
Subject: Attitude and Assumptions
In-Reply-To: <3.0.3.32.19971010180024.00ad8ce0@mail.pgp.com>
Message-ID: <97Oct13.175129edt.32259@brickwall.ceddec.com>



On Fri, 10 Oct 1997, Jon Callas wrote:

> In the course of all the discussion here, I have seen a number of implicit
> attitudes and assumptions that irritate me. This is a short rant to air my
> irritation.

I would hate to see your *long* rants ...................:^)

> The first thing that bugs me is what I'm calling Crypto-Correctness. I
> don't know a single person on cypherpunks who is against privacy, or is
> against the notion that in the information society, keeping and bearing
> crypto is an inalienable human right. Politically, I'm a Lockeian, and put
> privacy up there with Locke's basic trio of life, liberty, and property. As
> part of this, I fight the stupid notion that because there are bad people
> out there, rights should be abridged. 

I express it as private information is my property and I should have
whatever means necessary to protect it.  And as crypto can be directly
used only as a shield and not a sword, there are no reasonable arguments
against me using it.

> I believe that the central thesis of crypto-freedom is that it doesn't
> matter if a document is on paper or in a text file; it doesn't matter if a
> conversation is on the phone or in a restaurant. The medium doesn't matter.
> My papers and effects have the same protection on a disk as on paper itself.

This is really unexplored.  I would extend rights in the physical world
into cyberspace.  And you are right [in an elided section] that
corporations or businesses aren't thought of.  Most of the arguments
against intellectual property is toward releasing it where it is free, but
there is an equal or greater threat of charging for the information
without paying royalties.  There are vandals, but there are also thieves.

> We all know that deployment is the key. But real deployment means deploying
> to people who don't know how their toaster works, too. If we don't solve
> this problem, we'll get hit with the backlash. Just you wait, once crypto
> becomes trendy, there will be a Time cover story with some headline like,
> "How Much Privacy is Enough? Who's Really After You, Anyway?" and in it
> will be sob stories about how people lost their passphrases, were
> blackmailed by employees (ask me, I have real-world tales of this), or
> can't decrypt their backups. Congress will have hearings, and they aren't
> going to be fun to watch. Is trying to head this eventuality off (yes, I
> believe it's inevitable) really the work of Satan?

No, but I don't know if your solutions are real.  Does PGP 5.5 prevent
encrypting non-CAK, then reencrypting CAK to pass through the mailers?
GAK/CAK has lots of technical problems, and I don't know that you have
solved them.  You assume that someone like the boss in the Dilbert cartoon
is going to make this all work (or will they write the corporate
passphrase on their deskpad)?

I tend to be neutral to CAK, except that I can't think of an easy way to
create something that is not snake-oil (i.e. that is easy, doesn't
compromise security if the CAKeepers are dunces, and insures that data
encrypted is accessible by the TTPs).

> The last thing that really, really bugs me is the hostility that's directed
> towards PGP Inc. because now we're an Inc.

> We put out a freeware product, hoping people will upgrade to the for-pay
> version. If you're thinking of your own startup, let me give you some
> investment advice: the crowd who thinks the X-files is a documentary
> doesn't upgrade to the for-pay version.

The windows versions I have seen don't allow me to select algorithms (they
default to CAST, so how do I get 3DES or IDEA), and neither did the Linux
version - the beta segfaulted on at least one combination of algorithms. 
Are all these little problems fixed?  And if so, you had to modify the
source, so is there a diff file you are going to publish much less a press
release saying what is or is not fixed (I see the part about
batch-friendly, but is that there yet, and how would I use that - you
could put your manuals online). 

I can't even buy a license for the scanned version which I can at least
fix these problems.  I would pay the $49 for the license to use a working
Linux version.  Maybe you should add a license issuing page to your server
so I can click and get an digitally signed HTML license (with a physical
one to be mailed later if needed). 

But for now my choice is to take a chance on the $49 downloadable version
(will it be another $49 for a half-fixed version, and another $49 when
the IETF finishes with the spec and 6.0 meets it?).  Does anything happen
differently if it has problems and I report them?

By the way, I can't even download it - your server requires switching to a
port our firewall doesn't let through (9999) which I emailed your
webmaster about three months ago.  There are other common alternate ports
that are allowed.  So I can't even really get the $49 version, I must pay
$79 (or spend an hour creating an IP tunnel to a recognized US DNS-IP
address which is what I did last time - I might do that for the freeware
version but not to purchase something). 

So I don't know if any of the problems in the freeware or betas are fixed,
and I can't even download it from your website.  Some hostility to the
"Inc." might be from your consumer relations more than your philosophy.

--- reply to tzeruch - at - ceddec - dot - com ---







From attila at hun.org  Mon Oct 13 15:11:51 1997
From: attila at hun.org (Attila T. Hun)
Date: Tue, 14 Oct 1997 06:11:51 +0800
Subject: Building the Surveillance State
In-Reply-To: <3.0.3.32.19971011104004.03eec138@ctrl-alt-del.com>
Message-ID: <19971013.163259.attila@hun.org>



-----BEGIN PGP SIGNED MESSAGE-----

on or about 971011:1040 
    Alan  was purported to have 
    expostulated to perpetuate an opinion:

+At 10:22 AM 10/11/97 -0700, Tim May wrote:
+>
+>-----BEGIN PGP SIGNED MESSAGE-----
+>Hash: SHA1
+>
+>I predict that nearly every company which enforces the PGP 5.5 corporate
+>snoopware will in fact routinely convert every incoming and outgoing
+>message to plaintext for searching by keywords, topics, etc.
+>
    I really think you are overreacting on this one --sure some will,
    but corporations who reduce employees to a level of "distrust"
    will find the employees doing same as they become inurred with
    the attitude that they are distrusted --so why not?

+>This would be analogous to every phone call, incoming and outgoing, being
+>recorded. 
+>
    stockbrokers work under those conditions, and have for years.

    dispute resolution

+>Except that instead of having security people _listen_ to each
+>recording, 
+>
    voice recognition software today easily handle a conferance call
    with more than adequate accuracy to support digital keyword sorting.
    NSA has been doing that for years, and the software is at the PC
    level now.

+>the messages can be glanced at quickly, marked for further
+>review, compiled into dossiers, or searched for the keywords of interest to
+>the security people.
+>
    same reason as above; if you give no level of trust, you will have
    no level of respect or honesty.  employers also realize that the
    "mental health" and attitude of their employees is critical to job
    performance --and employee retention; turnover is expense in more 
    ways than money.

    to blanket label corporations to scan for keywords in all cases is
    like saying all Southern slave owners were Simon Legree --which is
    patently absurd since destroying or dehibilitating the collateral
    was damaging to their personal finances.  sure, there will be bad
    apples...  personally, I have seen secure facilities where you
    check your fingers in at the desk... and, you need to whiz, you are
    not only escorted to the porcelain, but the security guard will be 
    right next to you.

+>(Please note that I am not saying such phone call or e-mail monitoring is
+>illegal, or should be illegal. A property owner is free to define his own
+>policies for how he uses his own property. This includes company phones,
+>company computers, and even the time of employees while they are on his
+>premises. The issues are not the legality or ethicality of such recordings
+>and monitorings, but the dangers. And whether people such as ourselves
+>should help build or deploy such surveillance capabilitities. Or work for
+>companies with such surveillance policies.)
+>
    it sounds trite to say that if we do not, someone else will. I would
    rather believe we should be involved in the project to a) try and
    maintain a reference point of "wisdom", and b) even more importantly,
    to *know* there are no further trap doors, etc.  'know thine enemy'

+>I further predict that this will actually _increase_ the amount of e-mail
+>surveillance being done. Whereas today it is of course easy for companies
+>to surveil unencrypted employee mail, I doubt that most of them do. But the
+>adoption of snoopware like PGP 5.5 will raise the consciousness of company
+>security people. "Hmmhh, maybe we ought to buy some of those e-mail keyword
+>analyzers and combine them with our new purchase of PGP 5.5? If our
+>employees are encrypting, we'd better keep tabs on them."
+>
    law of diminishing returns. employers are sensitive to employee
    grousing.  second, if the system is using keyword search, it should
    be coming up blank in personal mail.

    as for the libel message to sue at m$, the message should not have
    been sent --PGP or no PGP.  get a hotmail account!

+>By building in such easily-enforceable snooping capabilities, and by
+>building in such things as the ability to reject even _incoming_ e-mail
+>which has failed to encrypt to the corporate key (as I understand the
+>product), this greatly moves us toward a surveillance era.
+>
+>Is this what "Pretty Good Privacy" really stands for?

    again, get a hotmail account.

    either PGP provides a complete range of control in the SNMP goody
    or systems with less flexibility will be deployed, systems that 
    are truly GAK.

    the real issue for cypherpunks, and the whole range of the 
    privacy forums, watch lists, Declan, Meeks, whatever is to
    broadcast the fact that PGP 5.5 can be used for storage key
    levels which most of us are willing to accept.

    stand up and be counted on the soapbox. I have been involved in 
    crypto since a lot of years before DH and RSA were published. I
    never really thought about separate signature and encryption 
    keys 

    I actually encryt very little, but sign everything --and am in
    the process of REXXing a script to sign html documents for email.

    that is the purpose of discussion; even old dawgs can learn new tricks 
    occasionally.

+I seem to remember that it was just this sort of feature set that Phil
+Zimmerman was grousing about when ViaCrypt came out with their
+"Business Version".  It was used as one of the reasons for his takeover
+of ViaCrypt.

+I guess it shows you just how much influence he has on PGP inc now...

    no, not how much influence Phil has at PGP, but how much influence the 
    needs of business influence Phil and PGP.

    look at it this way.  the boss is the employee of the customers.

+"We have always supported the needs of law enforcement.  We have always
+been at war with terrorists and law breakers." - Winston Zimmerman

    yeah, right.  dont you mean 'Neville Zimmerman'?

 --
 "When I die, please cast my ashes upon Bill Gates. 
     For once, let him clean up after me! " 
 ______________________________________________________________________
 "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1
Comment: No safety this side of the grave. Never was; never will be

iQCVAwUBNEJTUL04kQrCC2kFAQFOqwP/VSF0J57tdkeNORshR8+zx363wPMyEjlA
7b1wvRs25dHP3jL3NBttKgt7PPMCrDCgZe+xZVnTTsn+I74tLrNr9NO6kvOMYi8d
WlHQJL5P5uelkMsdK2xAvaf5MoKLYEIX4TjIKsurvcyKhgdqs7ls3A2zh6LCXg3g
Qjk+ZVTnuUA=
=nfbf
-----END PGP SIGNATURE-----






From attila at hun.org  Mon Oct 13 15:11:55 1997
From: attila at hun.org (Attila T. Hun)
Date: Tue, 14 Oct 1997 06:11:55 +0800
Subject: D-H Forward Secrecy for E-Mail?
In-Reply-To: 
Message-ID: <19971013.173323.attila@hun.org>



-----BEGIN PGP SIGNED MESSAGE-----

    great idea, Tim. [total previous text follows my comments]

    paraphrase of Tim's basic suggestion:

        ...to consider DH session keying in real time or the latency of 
        maybe IRC, etc (several seconds?) to be able to dispose of the 
        session keys which makes subpoenas signifantly more difficult.

    Netscape's default mail setting is to handshake the destination
    server.  eg through sendmail. it will not return until it gets it
    or times out --then it tells you to try later and there is no
    way to file it easily --in other words, a problem to avoid.

    I am presuming the DH keys would be a wrapper on an already 
    encrypted message, although target machine can re-encrypt to
    recipient on a secure machine.

    1)  sendmail could be modified to do yet another function (essentially 
        describe in b); or,

    2)  I would prefer to run yet another daemon on every machine at a 
        specific port with the usual 'who are you' identify sequences, 
        preferably even changing it to call back to lesson spoofing, 
        despite the fact additional logic is required to kill denial of 
        service attacks.

        all that would be required would be the n number months/years
        wait for IETF to agree on a port and the protocol...

        the rest of it is pretty stock at the daemon side. the inside
        is where the fun begins.  If the message is already encrypted,
        (was inside DH wrapper) it can be delivered; otherwise:

        a)  if the machine is secure, the email can be delivered to the
            user's box

        b)  if the machine is the usual, then the daemon needs to use
            a local secret key to encode to the local user's public
            key to maintain an encrypted message.

    complicated? not from my perspective v. some of the other nightmares.

    using sendmail would be the fastest route to enablement, but it 
    probably would be years before sendmails were updated and aan old
    sendmail could just accept the call and hang one or the other without
    a resolution.

    the more we are wired, the more feasible it becomes.

    it would be nice if the usual store and forward of sendmail could
    be utilized. I think it would be very difficult to use sendmail itself,
    but it should be possible to use an independent daemon to perform
    the same function.  there would just be multiple DH sessions --much 
    like the cp remailer network; the few times I used mixmaster a few
    years ago, I sent an encrypted packet.
 ______________________________________________________________________
 "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1
Comment: No safety this side of the grave. Never was; never will be

iQCVAwUBNEJmJL04kQrCC2kFAQFyPQQAmDaB819149GNqJF1SZqhs2rxCAHADnlx
fMBgmBOhJi/bKnKafcEhMDnTWL82GtA9lpeVP5IkW9aQH8DCdQpoKbhmQ2lQZCEy
PHUpbDyVGDxOg5sCp9kDYImF0h6qVEtSDynxUVgAWiApmfCGGx5NoL4aAxDwg8gg
aOrxTePVFRw=
=xmTi
-----END PGP SIGNATURE-----


on or about 971012:1016 
    Tim May  was purported to have 
    expostulated to perpetuate an opinion:

+At 2:48 AM -0700 10/12/97, Adam Back wrote:

+>Once you acknowledge that it is more secure to have short lived
+>communication keys (which in my view it very clearly is), it should be
+...

+Just what are some of the issues with us getting D-H-type perfect
+forward secrecy with something like e-mail? I assume this must be
+possible, of course, as D-H is used in just these ways. (The Comsec
+3DES phone I have does this, of course.) (To repeat what has already
+been said, forward secrecy means some of the important keys are not
+kept or stored, and so a subpoena at some future time to produce the
+keys used in a communication is pointless. Cf. Schneier for more.)

+First and foremost as a requirement would be the need for a
+back-and-forth communication, in a real-time or nearly real-time mode.
+This rules out conventional e-mail with its long a variable latencies
+for delivery. (Not to mention diverse clients and their inability to
+respond automatically!)

+But IRC, chat rooms, Internet telephony, etc., are all common. With
+latencies of ~seconds, or even less.

+I picture conventional e-mail being replaced, for this application,
+with this kind of system. Maybe D-H forward secrecy systems already
+exist....

+Forward secrecy might be arrangable even with long-latency links...it
+seems to me. (Through a series of links, compute and store the D-H
+parameters, then use them with conventional e-mail for the "payload"
+message?)

+--Tim May


+The Feds have shown their hand: they want a ban on domestic
+cryptography
+---------:---------:---------:---------:---------:---------:---------:----
+Timothy C. May              | Crypto Anarchy: encryption, digital
+money, ComSec 3DES:   408-728-0152 | anonymous networks, digital
+pseudonyms, zero W.A.S.T.E.: Corralitos, CA  | knowledge, reputations,
+information markets, Higher Power: 2^2,976,221   | black markets,
+collapse of governments. "National borders aren't even speed bumps on
+the information superhighway."







From attila at hun.org  Mon Oct 13 15:12:15 1997
From: attila at hun.org (Attila T. Hun)
Date: Tue, 14 Oct 1997 06:12:15 +0800
Subject: CMR paves the road to GAK, and provides no corporate security.
In-Reply-To: <199710121053.LAA01120@server.test.net>
Message-ID: <19971013.170615.attila@hun.org>



-----BEGIN PGP SIGNED MESSAGE-----

    original message(s) follow my comments:

    1.  agreed that GAK is awful from a security standpoint. it is just
        a huge hole open to abuse by supposedly trusted escrow agents and
        the usual government dishonesty and deceit.

        on top of that, GAK is an unpardonable sin, with CAK not far
        behind.

    2.  CMR does not lead to GAK. let's get the terms correct as to what
        can be done, versus what will be done.

        a)  there will be companies who start with GAK/CAK since it is
            simple to issue an order of compliance.

        b)  there will be companies who need to maintain content audit
            trails a) to prove they either did or did not do as stated,
            b) development records, etc. for instance for patents, c)
            historical customer records.

            hopefully this class will use signature, communications,
            and individual or group storage keys.  the need for encryption
            is paramount on computer systems --it is the equivalent of
            the locked file cabinet, sometimes in a locked secure area.

        c)  PGP today can meet the requirements of GAK, CAK, CMR, or
            just about any format you wish --and make corporate control
            a reality. 

            I could have a crude, but workable control program which would 
            prevent the use of pgp standalone as well --and I could have it
            up and running by tonight.

            secondly, add a few modifications to sendmail, and trying to
            slip one through the system is history.

    stating that CMR leads to GAK is the same argument that mary jane
    starts the victim on the road to horse.  

        -how's that allegorical illusion to blow by keyword scanners?

    likewise, I still believe I would much rather see PGP, Inc. implement
    a SNMP system to mandate corporate policy which can be adjusted from
    zero for the libertarians to GAK for the unpardonable sinners.  at
    least the employees of the latter can protest the ignorance of 
    management; despite the general attitude that all management personnel
    are the south ends of northbound horses, management is interested in
    calm, productive employees.

    if the government does mandate GAK, and really gets serious about
    enforcing it, there will be a lot of changes, and I for one will
    trade my computer for something more necessary as I build a bunker to     
    protect myself and children --there will be no government about that 
    time, or at least a government we will recognize.

        attila out, again


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1
Comment: No safety this side of the grave. Never was; never will be

iQCVAwUBNEJawL04kQrCC2kFAQHBCQQAqr0jk2wilOVAx83ZBEyU9ZLzFp0WVk9F
AoWlZwefOxngL+iCZbalLdrr94CECmLes3ugmbDukQfyminSlFsVVSKMkRD64uRm
91giq52/FUPjH4mE1IJZsj/07F0/slydkDcsBI7awfvl8VFxbAGF0oJDY4fAHlz9
ZBpxvSoPewo=
=jdGv
-----END PGP SIGNATURE-----

on or about 971012:1153 
    Adam Back  was purported to have 
    expostulated to perpetuate an opinion:

+[Padgett, you're Cc'd because I'm quoting something you once claimed on
+Perry's list, I think]

+I agree with basically every word Peter Trei wrote.  It's not often you
+agree with a long post like that 100%, but I could not fault a single
+point.

+Contrast that to PGP's Jon Callas's recent posts where I found myself
+disagreeing with a large proportion of both technical and political
+points.

+Just a couple of nit-picky comments on various things, and some
+re-iteration of the technical arguments against GAK compliancy (to
+supplement Peter's good political arguments):

+> >* Clipper was a 64-bit key. CMR symmetric keys are full-strength keys (128
+> >bits or more), backed with a full-strength public key.
+> 
+> A word of advice: don't try to discuss Clipper in this forum without checking
+> your facts. Clipper used an 80 bit key.

+Clipper was definately advertised as a 80bit key, I agree.

+But I did once see someone else claim that it was a 64 bit key, and
+this was by Padgett Peterson, who is usually pretty good with facts,
+though perhaps his claim was speculation in this case.  (I've added him
+to the Cc).

+His reasoning was that the 16 bit checksum (which Matt Blaze
+demonstrated could be brute forced thereby trashing the GAK
+enforcement) would come out of the 80bit key size, thereby meaning that
+it was only an effective 64 bit key.  I suppose this claim if it is
+correct would be similar to DES keys being 64 bit, but 8bits being
+parity (checksum again), and therefor being only 56 bit effective. The
+DES case would set a precedent for NSA design involvement using larger
+"keys" than effective keys.  If this is true, the clipper / skipjack
+system was even more flawed than we believed, as not only was it
+possible to brute force the checksum, but the key space could have been
+brute forced also, possibly without knowing the algorithm either, just
+by buying lots of clipper chips (though I think this would require
+knowledge of the checksum algorithm).  But clearly the NSA could have
+brute forced the traffic in addition to having back doors.

+Of course, I think it likely that the key was actually a 96 bit key
+with an effictive key size of 80bits after the 16 bit checksum.

+Regardless, if Padgett's speculation is correct, I suspect this is not
+what Jon was thinking.

+> > * With Clipper, there was a central repository of all the keys. With CMR,
+> > there is not. I discussed that in detail in my message, "Why Corporate
+> > Message Recovery isn't Key Escrow."
+> 
+> Once again, you haven't checked the record. Clipper keys were to be split, 
+> with different halves going to different government agencies. There were
+> fairly elaborate plans to prevent posession of only one half giving an
+> attacker an advantage. Thus there were *two* repositories, not one. 
+> (From the point of view of the paranoid, this was not much of a
+> comfort - both repositories belonged to the same entity.)

+I must defend Jon a little bit here in that it was fairly widely agreed
+that the wording in some of the Clipper documents (perhaps FOIAed,
+perhaps released normally, don't know) that the NSA would have an extra
+access for "national security" (there's that magic root password to the
+constitution again).  The presumtion a lot of people held was that the
+NSA would have a second unified copy of the split databasee to enable
+this national security access.  I'm not sure of course that this is
+actually ever explicitly admitted anywhere, and it could be that they
+would just have direct access to both split databases, but I wouldn't
+really have thought this was the likely; I suspect the NSA would've
+wanted access without others even with in special wire-tapping courts
+knowing their tapping activities.

+Whether or not this is what Jon was referring to I don't know.


+I agree with the negative political aspects Peter expressed of PGP's
+"GAK compliancy" (as I like to call it) in PGP's pgp5.5 & SMTP policy
+enforcer.

+I also think there is a purely technical security case to be made
+against this architecture which I have tried to lay out clearly in my
+post titled:

+	Subject: negative security aspects of GAK compliancy

+Peter made some security points about this also.  I think we should be
+able to win the argument about GAK compliancy purely on technical
+reasons.

+The only vaguely logical objection I've seen to arguing against GAK
+compliancy on political grounds was Hal Finney's assertion that OpenPGP
+should move towards more generalised forms of key assertions in the
+form of PolicyMaker-like key assertions (Matt Blaze has a paper and
+system called PolicyMaker).

+However PolicyMaker I suspect will be a long time coming, and may not
+be supported by all vendors due to complexity, and in addition even
+with PolicyMaker, the same political and security arguments against
+actual use of PGP Inc's GAK compliancy field (or PolicyMaker assertions
+to the same effect) still forcefully apply.  And there are still in
+particular security and political arguments against implementing
+corporate access to mail archives, or corporate sent/received mail
+snooping by using the SMTP GAK compliancy policy enforcer.

+Lastly I would comment that it is sad that we on cypherpunks are having
+to expend so much energy trying to persuade PGP Inc with it's supposed
+pro-privacy stance, and supposedly pro-privacy employees, that they
+should be working against GAK, and even to get them to acknowledge that
+what they are doing is pro-GAK, and big brotherish is an uphill
+struggle.

+PGP Inc with their poor PR management, and hugely insensitive pro-GAK
+moves mean that PGP Inc is pissing away Phil Zimmermann's good
+reputation at a huge rate of knots.

+Wake up PGP.  Look what you are becoming.

+Adam


 --
 "When I die, please cast my ashes upon Bill Gates. 
     For once, let him clean up after me! " 

 "Experience keeps a dear school, but fools will learn in no other."     
        --Benjamin Franklin
 ______________________________________________________________________
 "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 






From attila at hun.org  Mon Oct 13 15:18:18 1997
From: attila at hun.org (Attila T. Hun)
Date: Tue, 14 Oct 1997 06:18:18 +0800
Subject: typo & too much time (Re: Stronghold)
In-Reply-To: <199710130033.BAA01002@server.test.net>
Message-ID: <19971013.190136.attila@hun.org>



on or about 971013:0133 
    Adam Back  was purported to have 
    expostulated to perpetuate an opinion:

+I wrote:

+> However another aspect to this argument over credentials is a comment
+> that arose when another person with a PhD who used the title "Dr" in
+> his From line subscribed to the list.  That person was Fred Cohen.
+> His above average education in having his PhD didn't seem to reflect
+> in his posts, and several people commented on this fact.  It seems to
+> be that listing qualifications in From fields is asking for rude
+> comments, or it seems to attract criticism :-)
+> 
+> I can say I like the practice.
+    ^^^

+typo, I meant to write "I _can't_ say I like the practice".

-----BEGIN PGP SIGNED MESSAGE-----

    as I always refer to my degree of {in}competence:

        PiledHigherDeeper

    in Zuerich is was Hr. Dr. Prof....  but then, the Swiss love 'em.

    as for Cohen, he was a fraud, and will always be a fraud. he was
    defrocked of his professors gown for some irregularity.

    he was fun to attack though 


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1
Comment: No safety this side of the grave. Never was; never will be

iQCVAwUBNEJxT704kQrCC2kFAQG93AQAsaqNFV30tbmOmanknXUwLXWTk8vN1Gpy
QQVUq/+yNJHRvoIusYclewZVJc5/29VIrDTVs8NYAh9hjiwoaHpSW82SAaIsz2eX
JS2Cr+8i4/QsV/lDWsykJT00QcP9lommpg4zJ3BNtwblKdfXAnQy9NDuxlCFGOtZ
ZEM5m+nL2gs=
=rNOp
-----END PGP SIGNATURE-----






From whgiii at invweb.net  Mon Oct 13 15:53:00 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Tue, 14 Oct 1997 06:53:00 +0800
Subject: Key Lookup Optimizations (Was: Re: D-H Forward Secrecy for E-Mail?)
Message-ID: <199710132248.SAA27545@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <199710131652.RAA02526 at server.test.net>, on 10/13/97 
   at 05, Adam Back  said:

>> >I also personally prefer people to send me keys in email, because the pay
>> >per second phone lines here at home mean that I tend want to avoid doing
>> >too many online key lookups, so I think this would be an individually
>> >useful feature.
>> 
>> I do my keylookups automatically durning the msg filtering process which
>> is done in parallel to the message Dl's. 

>A clever optimisation to be sure.

>> The outbound message lookups are a little more time consuming but is
>> compensated by fewer keys to look for both because fewer messages on
>> the outbound side and the use of key caches on the client machine
>> for the most used keys for sig verification and encryption. 

>I don't have a key cache, and my keyring is only 216k.  But I'm curious
>about your automated process .. are you also checking all signatures that
>you can by downloading the keys and checking out the WoT for all received
>mailing list traffic etc?  This would cleary result in a much bigger key
>ring.

For the inbound processing of mail I have the following automated
processes:

- -- Messages is downloaded and checked to see if it is a PGP Message (This
is handled by the mailers filters).

- -- If the message is signed the keyid of signature is extracted from the
sig-block and a lookup is performed on the index table for both the users
pubring & sig_cache.

- -- If the key is not found in either then the message is placed in a queue
and a keylookup thread is spawned.

- -- There is a setup for which servers and how many to try when doing the
lookups.

- -- If no key is found on the servers then a canned e-mail message is sent
to the sender requesting his keys. The message is taken out of the queue,
marked that no key was found and that a request had been sent out.

- -- If a key is found it is added to the key cache (sig_cache.pgp). Then
normal sig verification is performed.

- -- After X amount of hits on a key in the cache the key is flagged as a
commonly used key for the user so he can pursue authenticating the key (no
sense in going through a lengthy authentication procedure for a key that
is only used once).

- -- Attached keys are detached from messages and stored in new.pgp keyring
(auto adding of keys to ones keyring is a Badthing (TM) ).

- -- Encrypted messages are decrypted.

All PGP output is appended to the bottom of the message so the info is
there when the user opens the message. If a message is in MIME format then
the below is appended as MIME attachments using text/X-PGPCheck MIME type.
A sample is provided below:

- --------------------------------------------------------------------
MR/2 PGP Signature Check  13 Oct 1997 12:19:55
- --------------------------------------------------------------------


File has signature.  Public key is required to check signature.

Key matching expected Key ID 142DD151 not found in file
'd:\pgp\pgp263a\pubring.pgp'.

WARNING: Can't find the right public key-- can't check signature
integrity.

Plaintext filename: WHGIII\34425839

- --------------------------------------------------------------------
MR/2 PGP Signature Check [Secondary Keyring]  13 Oct 1997 12:19:55
- --------------------------------------------------------------------


File has signature.  Public key is required to check signature. .
WARNING: Bad signature, doesn't match file contents!

Bad signature from user "Ian Brown ".
Signature made 1997/10/13 15:15 GMT using 1024-bit key, key ID 142DD151

WARNING:  Because this public key is not certified with a trusted
signature, it is not known with high confidence that this public key
actually belongs to: "Ian Brown ".

Plaintext filename: WHGIII\34425839

PGPRC=1
PGPRC2=1


>> Also logging of e-mail addresses that do not use PGP cuts down on
>> the number of lookups needed

>Good optimisation.  It sounds really as if your OS/2 setup is more
>advanced than a lot of other stuff around.

- -- For the outbound messages the following procedures are in place:

- -- All messages are signed with the user having an option of disabling
this signature either on a per message basis (through the use of a message
template at creation time) or default conditions can be set in the filter
no to call the signing script (things like don't sign messages to
majordomo, or messages going to remailers, ...ect)

- -- Outbound messages can be flagged for encryption on a per message basis
(through the use of a message template at creation time) or default
conditions can be set in a special default.ndx file used by the encryption
script.

- -- The encryption script first extracts all the e-mail addresses from the
To:, Cc:, & Bcc: lines.

- -- It then does a lookup on the default.ndx table. This is where several
issues are resolved.

    1) No key for address. An address can be flagged as a no-encrypt
address. This is mostly for mailing lists and receivers that do not use
PGP.

    2) Default key for address. An address can be flagged as encrypt and
the keyid for that address is included in the entry for that address. This
handles things like userid does not match the e-mail address for the
person you are sending to (change of address, ect...). Also the issue of
multiple keys having the same e-mail address are handled (their can be 5
keys all with the address john_doe at domain.com in the userid fields but
only one is the real john_doe at domain.com that you are talking to).

    3) Always encrypt flag. You can flag an address to alway encrypt too
regardless of wether the message was flagged for encryption at creation
time. (hmmmm starting to get into the realm of policy enforcement here
).

- -- Unless an address is flagged as no-encrypt then a lookup on the keyring
indexes for both the pubring and crypt_cache are performed.

- -- If and address is not found then a keyring lookup is performed. A
separate cache is kept for the encrypted keys and a similar process of
flagging frequently used keys is in place as with the sig_cache.

- -- now that all the addresses are processed 3 copies of the message are
created:

    1) Encrypted message. This message is sent to all the addresses where
valid keys have been found.

    2) Plain Text message. This message is sent to all addresses where
they have been flagged no-encrypt in the default.ndx.

    3) Error message. This message is returned to the message editor and
the user is informed why the message could not be encrypted and then it is
up to him to resolve the problem. Most common errors are no key found for
the address and multiple keys with the same address found. Both these
conditioned can be resolved by making the proper entries in the
default.ndx file.

        3A) There is a setting flag that tells the script not to split the
message as above and error the complete message unless all addresses can
be encrypted to.

        3B) their is an exception option on 3A where a split message is
not in error if the only addresses with no_keys are flagged as public
distribution (mailing list, newsgroups, ...ect).

    4) BCC messages. Bcc's create a unique problem to the encrypt to
multiple recipients function. Because of the format of the encryption
block the list of keys used to encrypt is known to all who care to look.
This goes against the purpose of a BCC which is to hide a recipient from
the rest. In this case I create a separate message for each BCC and
encrypt that message with only the key for the BCC recipient.

    5) All split messages contain a X-Distribution list containing all the
e-mail addresses that the messages was sent to (minus the BCC's of
course).

I have allot more goodies implemented and/or working on but that should be
enough for one message (direct keyring manipulation, remailer support,
stamper support, PGP/MIME, balanced b-tree as keyring, ...ect). Much of
the optimization work I have been doing is for server side processing
useing very large keyrings (+20Mb) but that is another thread in itself.
Plus I have a PGP GUI which has many other features for key management &
WOT not practical for the automated processing code.

>My setup is GNU emacs with Pat LoPresti's mailcrypt.el PGP and remailer
>support lisp extension for emacs RMAIL and emacs GNUS (newsreader).  I
>love it to bits.  It is totally excellent.  It doesn't have a couple of
>your optimisations, but other than that it's pretty good.  When you send
>messages, if you don't have the key it will fetch it for you by trying
>keyservers, then finger user at domain. It can snarf keys out of mail
>messages, paste keys into them, sign, encrypt, check signatures, use
>remailers (type I and mixmaster).

Sounds good except the retrieval of keys from the finger. This is a
serious weakpoint in your security. Say you have Adam who wishes to
communicate with Mary. He get's Mary's key from her .plan file via finger.
Eve has control of the server and replaces Mary's key with her own. Now
you encrypt message to Mary but you are using Eve's key. Eve decrypts the
message re-encrypts with Mary's and neither of you are the wiser. This is
also a weakness in the distributed key approach as it presents a single
source of failure unless some type of redundancy is built in. I know that
there are many issues involved in this and probably should be spun off
into a separate thread if you are interested in pursuing it (too many
disjointed subjects in one thread tends to become confusing).

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNEKmhI9Co1n+aLhhAQGgfQP/ZnRMzHAFSgfREts8Op5P+JHfRJHG5khl
pUexNZh+VmGpuEkKVMCcIVvYJrICWop7XSYtnI6W0mKd3E2TppVgOplpOvnsHVCv
cp1hS8a9MfkBns+Jf7xGG4Z2V3crqGP5ZpcF/PR8Yj8o9wHwx5YoqSLYnF5VTzVM
OevaTH+8vJE=
=VZeI
-----END PGP SIGNATURE-----






From jmayorga at netscape.com  Mon Oct 13 16:19:47 1997
From: jmayorga at netscape.com (John Mayorga)
Date: Tue, 14 Oct 1997 07:19:47 +0800
Subject: Quantum Computing
In-Reply-To: <199710120611.CAA29682@homeport.org>
Message-ID: <3442A853.ADDA4522@netscape.com>

To answer Adam's question on quatum computing, see:
http://feynman.stanford.edu/qcomp/artlist.html

Interesting stuff.  Nothing to do with encryption (except maybe breaking it in
the future).

John E. Mayorga

Standard disclaimer





Adam Shostack wrote:

> At Interop, someone mentioned to me that Nortel has announced a system
> for getting 192k over power lines.  Theres a link on their home page,
> but its broken.
>
> On another topic, someone asked me about a "new breakthrough in
> quantum computing."  Anyone know of an announcement in the last week?
>
> Adam
>
> Peter Trei wrote:
> | > To:            cypherpunks at cyberpass.net
> | > From:          Jonathan Wienke 
> | > I heard on the ABC hourly news that some genius had figured out a way
> | > to use electrical power lines for data transmission, so that the power
> | > grid could be integrated into the Internet.  Does anyone have any
> | > details / pointers?
>
> --
> "It is seldom that liberty of any kind is lost all at once."
>                                                        -Hume






begin:          vcard
fn:             John Mayorga
n:              Mayorga;John
org:            Netscape Communications Corp.
adr;dom:        ;;501 E. Middlefield Road, Mountain View, CA 94043, USA;9;;;
email;internet: jmayorga at netscape.com
tel;work:       4556
x-mozilla-cpt:  ;0
x-mozilla-html: FALSE
version:        2.1
end:            vcard





From tm at dev.null  Mon Oct 13 16:20:20 1997
From: tm at dev.null (TruthMonger)
Date: Tue, 14 Oct 1997 07:20:20 +0800
Subject: CMR paves the road to GAK, and provides no corporate security.
In-Reply-To: <19971013.170615.attila@hun.org>
Message-ID: <3442AA75.A8E@dev.null>



Attila T. Hun wrote:

>         c)  PGP today can meet the requirements of GAK, CAK, CMR, or
>             just about any format you wish --and make corporate control
>             a reality.
> 
>             I could have a crude, but workable control program which would
>             prevent the use of pgp standalone as well --and I could have it
>             up and running by tonight.
> 
>             secondly, add a few modifications to sendmail, and trying to
>             slip one through the system is history.
> 
>     stating that CMR leads to GAK is the same argument that mary jane
>     starts the victim on the road to horse.

  One problem is that Corporations are learning that it is in their best
interests, and moreover, *possible*, to computerize access to private
employee information both on and off the jobsite.
  As well, corporations share information amongst themselves that they
do not share with even the employee in question.

  There was the case of a man who tested positive for AIDS when getting
a physical, etc., for company health insurance. The health insurer 
turned him down for coverage, and wouldn't tell him why, although they
told his employer and every other health agency in the world. The man's
wife contacted AIDS much later and is now going to die, as well. 

  Companies exist who *require* their employees to put in long, unpaid
hours, center their life around the company, yet regard all of the
employees communications, even during *unpaid* time, to be owned by
them. Then they will turn around and fire said employee when they
read his/her private email and find out there is a history of cancer
in the family, or some such, even if it is in their imagination.
  There are already cases of people being denied health coverage
because of 'pre-existing' conditions, based on the fact that their
company communications revealed that their great-grandfather had the
same disease, etc.

  These are just small examples off the top of my head, but I know I
see more and more use of private information gleaned from inside and
outside companies to determine everything from health coverage to
promotions.
  I personally know of a woman who has been consistently denied 
promotions because her company's investigation of her revealed that
many of her female relatives have a large number of children. When
she changed jobs, that information was actually sent to her new
employer. (Perhaps she could spend the next ten years of her life
suing someone/everyone, but that's no way to live.)

  The strange shit is already happening, and will increase, as the
Corporations feel that what is good for the Government Gander is
good for the Corporate Goose.

TruthMonger






From nobody at bureau42.ml.org  Mon Oct 13 17:00:55 1997
From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer)
Date: Tue, 14 Oct 1997 08:00:55 +0800
Subject: No Subject
Message-ID: 



Jim Choate  wrote:

> Thought some of you might care to know that James A. Michner the Pulitzer
> prize winning author who lives here in Austin, Tx. has decided to take
> himself off the kidney dialysis machine that has been keeping him alive.

The same organizations who seek to banish the
Suicide Doctor Kevorkian are probably up in arms
over this announcement.

"This should be illegal!"

"Keep him alive!"

Suicide is illegal in most "democracies" for one
reason - so that the State can confiscate the
material goods of the deceased.







From nobody at REPLAY.COM  Mon Oct 13 17:07:15 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Tue, 14 Oct 1997 08:07:15 +0800
Subject: Hmm
Message-ID: <199710132345.BAA01369@basement.replay.com>




Mr-Anonymous-type-person wrote:
> www.telcomtraining.com/downloads

what's the l/p Mr. Anonymous?        






From anon at anon.efga.org  Mon Oct 13 17:21:51 1997
From: anon at anon.efga.org (Anonymous)
Date: Tue, 14 Oct 1997 08:21:51 +0800
Subject: None
Message-ID: <2c3ca4d2c91ee39c9c59f084d31180a3@anon.efga.org>



On terrorists, one of the Four Horsemen.



IS THE ASSAULT ON NATIVE INTELLIGENCE &
GOOD WILL WE CALL THE EVENING NEWS
ANYTHING OTHER THAN AN ACT OF TERRIORISM?


What was the Gulf War but terrorism
wearing the death mask of order?--
One big car bomb it was
the guys who drove it
are dying now one by one--ignored!

Is acid rain a form of terriorism? (Think for yourself.)
Is GATT or NAFTA anything but a pact among brigands--the World Bank, the
   IMP their backup men?
How long before they fight over the spoils?
Who'll do the fighting for them?"








From rah at shipwright.com  Mon Oct 13 17:24:33 1997
From: rah at shipwright.com (Robert Hettinga)
Date: Tue, 14 Oct 1997 08:24:33 +0800
Subject: Public Key Smart Card
Message-ID: 




--- begin forwarded text


Date: Mon, 13 Oct 1997 18:48:39 -0400
From: Robert Hettinga 
Reply-To: rah at shipwright.com
MIME-Version: 1.0
To: rah-web 
Subject: Public Key Smart Card

http://www.businesswire.com:80/cgi-bin/sr_headline.sh?/bw.101397/501100

              [(c) 1997 Business Wire | www.businesswire.com]
----------------------------------------------------------------------------


BW1111  OCT 13,1997       5:29  PACIFIC      08:29  EASTERN

( BW)(GEMPLUS) Gemplus Announces Availability Of GPK4000, Public Key
Smart Card

    Business Editors

    MONTGOMERYVILLE, Penn.--(BUSINESS WIRE)--Oct. 13, 1997--

       First Smart Card To Combine Digital Signature,
    On-Board Key Generation, and Electronic Payment With
               Multi-Application Functionality

   Gemplus today announced the availability of GPK4000, the first
public key smart card to combine digital signature, on-board key
generation, and electronic payment with multi-application
functionality.
   The GPK4000 smart card, with its advanced cryptographic
co-processor, can be used to secure Internet, intranet and extranet
transactions in such applications as electronic commerce and computer
security.
   GPK4000 features full cryptographic functionality, including
1024-bit RSA-based digital signature at sub-second speed and 4 Kbytes
of application memory.  Additionally, it provides an on-board key
generation mechanism that ensures that the private component of the
public key that performs the cardholder's digital signature is never
seen outside the card.
   GPK4000 keys, whether generated internally or loaded by the
issuer, can be certified by any certification authority through the
card's ability to store industry-standard X.500 certificates in the
card's memory.  The card has also been specifically designed to
strengthen the security of Web sites that rely on the SSL3 protocol
for mutual authentication of client and Web server.
   "We are pleased that industry leader Gemplus has chosen RSAs
industry leading technology for their high-quality, high- performance
smart card,"  said Jim Bidzos, president of RSA Data Security, Inc.
"RSA is considered to be the most trusted encryption available,
whether for Web browsers or smart cards.  When it comes to
applications of smart cards such as electronic cash or personal
identity, there is no such thing as too much security.  Users can use
these smart cards with the greatest of confidence."
   Gemplus GPK4000 cards will be used in the upcoming version 2.0
release of ImagineCard, the only complete security solution for both
corporate applications and Web services, jointly developed by
Hewlett-Packard, Informix and Gemplus.
   "The additional capabilities of Gemplus GPK4000 enable our
customers to deploy more comprehensive smart card applications based
on ImagineCard solutions,"  said Christian Roy, general manager of HP
Enterprise Networking and Security Division.  "Through ImagineCard
and the strength of Gemplus GPK4000 card, HP meets its commitment to
bring the benefits of smart cards to support the extended enterprises
business processes."
   "Authentication is a necessary component for the widespread
adoption of electronic commerce,"  said Anil Pereira, director of
corporate marketing for VeriSign.  "VeriSign Digital Ids stored on
Gemplus GPK4000 smart cards provide Internet and corporate network
users with a convenient, portable method for secure access to online
resources and a trusted, proven solution to participate in secure
communications and online payments."

                  Gemplus Public Key Cards

   GPK4000 is the second in a line of Gemplus public key smart cards
for securing Internet, intranet and extranet services.  The GPK2000
card, with 512- and 768-bit key lengths was announced in 1996.
   The GPK (Gemplus Public Key) family will continue to be enhanced,
with future versions including more memory and additional
functionality.  The GPK card range is compliant with ISO7816-1, -2,
-3, -4 and is EMV compatible.  GPK4000 features a suite of developer
algorithms, including RSA, DSA/DSS, DES, Triple-DES, MD5 and SHA1.

                     GPK Developers Kit

   The GPK Developers Kit enables developers to prototype
applications.  It includes:

    --  PILOT GPK, Windows-based software for rapid application
        development and personalization;

    --  A card reader (GCR410) with RS232 serial port connection;

    --  Sample GPK4000 cards; and

    --  A reference manual and application notes.

                        About Gemplus

   Gemplus Corporation is the North American subsidiary of Gemplus
Group, the world's leading producer of magnetic stripe and smart
cards.  It manufactures and sells memory cards, microprocessor cards
(both contact and contactless), magnetic stripe cards, as well as
electronic tags.  It also designs and markets software, terminals and
systems; and provides personalization, consultancy and training
services to offer its customers comprehensive solutions.
   In 1996, Gemplus Group's total sales were $440 million.  By the
end of 1997, the company will have a production capacity of 900
million plastic and smart cards.
   Gemplus sells its products worldwide for such applications as
public and cellular telephony, financial transactions, loyalty,
transportation, education, healthcare, gaming, identity, access
control, pay TV, security for computer networks and electronic
commerce.  Information about Gemplus' products and services can be
found on the World Wide Web at: http://www.gemplus.com.
-0-
All trademarks are the property of their respective owners.

    --30--kdb/ny*

    CONTACT:  Dr. Patricia Neptune
              Neptune Group International Inc.
              (203)221-2820 or
              pneptune at neptunegp.com

    KEYWORD:  PENNSYLVANIA
    INDUSTRY KEYWORD:  COMPUTERS/ELECTRONICS COMED PRODUCT

Today's News On The Net - Business Wire's full file on the Internet
                          with Hyperlinks to your home page.
                          URL: http://www.businesswire.com

                                  [Image]

--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/
Ask me about FC98 in Anguilla!: 







From tcmay at got.net  Mon Oct 13 19:16:12 1997
From: tcmay at got.net (Tim May)
Date: Tue, 14 Oct 1997 10:16:12 +0800
Subject: Suicides don't forfeit their property
In-Reply-To: 
Message-ID: 



At 4:42 PM -0700 10/13/97, bureau42 Anonymous Remailer wrote:
>Jim Choate  wrote:
>
>> Thought some of you might care to know that James A. Michner the Pulitzer
>> prize winning author who lives here in Austin, Tx. has decided to take
>> himself off the kidney dialysis machine that has been keeping him alive.
>
>The same organizations who seek to banish the
>Suicide Doctor Kevorkian are probably up in arms
>over this announcement.
>
>"This should be illegal!"
>
>"Keep him alive!"
>
>Suicide is illegal in most "democracies" for one
>reason - so that the State can confiscate the
>material goods of the deceased.

This would be a nice example if it were true. But it isn't true in the
U.S., for example.  I don't know the situation in France, the U.K.,
Germany, etc., but at least in the U.S. this is generally not so.

In California, and in other states I suspect, suicide has nothing to do
with probate. Were I to kill myself tonight, my heirs would inherit as if I
had died of some disease, or been murdered by the Thought Police.

(ObAproposOfNothing, I was out working in my yard last night, with Monterey
and Pacific Grove gloriously visible in the distance. Had I been looking
with my telescope or binoculars, I could've seen John Denver's plane go
down.)

--Tim May


The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From tcmay at got.net  Mon Oct 13 19:17:51 1997
From: tcmay at got.net (Tim May)
Date: Tue, 14 Oct 1997 10:17:51 +0800
Subject: D-H Forward Secrecy for E-Mail?
In-Reply-To: 
Message-ID: 



At 10:33 AM -0700 10/13/97, Attila T. Hun wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>
>    great idea, Tim. [total previous text follows my comments]
>
>    paraphrase of Tim's basic suggestion:
>
>        ...to consider DH session keying in real time or the latency of
>        maybe IRC, etc (several seconds?) to be able to dispose of the
>        session keys which makes subpoenas signifantly more difficult.
...

Just to clarify, I am far from the first to suggest this. In fact, my
ramblings were inspired by seeing Adam Back's comments (and he was of
course not the first either to discuss the advantages of perfect forward
secrecy for e-mail).

Probably my latest ramblings have a lot to do with the posts about the
Comsec secure phone. It, of course, offers perfect forward secrecy. To wit,
if the Feds demand that I produce the keys used for a phone call I had last
week with Hugh Daniel, for example, I can honestly shrug and say "You don't
seem to understand these things."

Lots of advantages to somehow applying this to e-mail. (As Lee Tien and
others have noted, the D-H protocol can be applied to e-mail. A point cited
by Diffie and Hellman about 20 years ago. The issue is integration with
mailers, latency times, etc.)

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From azur at netcom.com  Mon Oct 13 22:54:36 1997
From: azur at netcom.com (Steve Schear)
Date: Tue, 14 Oct 1997 13:54:36 +0800
Subject: Quantum Computing
In-Reply-To: <199710120611.CAA29682@homeport.org>
Message-ID: 



Some of the papers on this site don't paint a hopeful picture that quantum
computers will live up to some of its biggest boosters insofar as crypto
and factoring problems are concerned.  For example see:

http://feynman.stanford.edu/qcomp/plenio/plenio/plenio.html

Others seem down right gleeful:

http://feynman.stanford.edu/qcomp/bennett-nature95

They all seem to agree that practical quantum computers are still a long
way off.

--Steve

At 4:01 PM -0700 10/13/97, John Mayorga wrote:
>To answer Adam's question on quatum computing, see:
>http://feynman.stanford.edu/qcomp/artlist.html
>
>Interesting stuff.  Nothing to do with encryption (except maybe breaking it in
>the future).
>







From alan at ctrl-alt-del.com  Mon Oct 13 23:07:16 1997
From: alan at ctrl-alt-del.com (Alan)
Date: Tue, 14 Oct 1997 14:07:16 +0800
Subject: patenting big brother
In-Reply-To: 
Message-ID: <3.0.3.32.19971013215203.03a1e500@ctrl-alt-del.com>



At 12:39 PM 10/13/97 EDT, Ariel Glenn wrote:

>http://www.nytimes.com/library/cyber/week/101397patents.html
>
>Engineer Invents Computerized Surveillance System
>
>            By TERESA RIORDAN
>
>Imagine that a city park were studded with discreetly
>placed cameras that fed images into computers programmed to keep
>a watchful eye. This may sound darkly Orwellian, but
>David Aviv, a former aerospace engineer, has patented exactly
>such a system as a way of combating crime. 
>
>Aviv said his invention, which he calls the Public Eye,
>used pattern recognition to detect robberies or acts of violence. 

This sounds like something from "Agent of Chaos" by Norman Spinrad.  Now
all they need is the plug to flood the area with lethal radiation...

---
|              "That'll make it hot for them!" - Guy Grand               |
|"The moral PGP Diffie taught Zimmermann unites all| Disclaimer:         |
| mankind free in one-key-steganography-privacy!"  | Ignore the man      |
|`finger -l alano at teleport.com` for PGP 2.6.2 key  | behind the keyboard.|
|         http://www.ctrl-alt-del.com/~alan/       |alan at ctrl-alt-del.com|






From azur at netcom.com  Mon Oct 13 23:11:02 1997
From: azur at netcom.com (Steve Schear)
Date: Tue, 14 Oct 1997 14:11:02 +0800
Subject: Canadian crypto export/re-export rules
Message-ID: 



Can anyone point me to a site with accurate and complete information?

--Steve







From ichudov at Algebra.COM  Mon Oct 13 23:40:19 1997
From: ichudov at Algebra.COM (Igor Chudov @ home)
Date: Tue, 14 Oct 1997 14:40:19 +0800
Subject: Statists trying to outlaw anonymity and privacy
Message-ID: <199710140633.GAA13279@manifold.algebra.com>



Dear Friends,

As many of you no doubt know, a new moderated group,
comp.org.cauce, has been proposed. One of the main goals
of moderators is to prevent users of one-way anonymous
remailers and those who munge (alter) their addresses
to avoid being spammed, from posting to the group.

Their proposal would force users to reveal their Internet
identities and expose them to spam.

The proponents hope, apparently, that the more spam people
get, the more will they support CAUCE's statist lobbying for
more government regulations.

During the discussion they have shown complete disregard and
ignored all requests from users who attempted to help them
accommodate anonymous posting. To get more YES votes, they
removed the most controversial provisions from the charter, 
while IN THE SAME DAY promising that these provisions will 
still be enforced.

As someone who defends privacy and anonymity  on the Internet,
I ask you to vote on this important matter. I will vote NO
on this newsgroup.

Feel free to repost this message to any fora you deem appropriate.

To find the Call For Votes, go to news.groups newsgroup, and find
article titled "CFV: comp.org.cauce moderated". You will find the
charter and the instructions on how to vote.

Thank you for your attention.

	- Igor.






From stewarts at ix.netcom.com  Mon Oct 13 23:43:58 1997
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Tue, 14 Oct 1997 14:43:58 +0800
Subject: GOST
In-Reply-To: <199710131950.TAA00414@fountainhead.net>
Message-ID: <3.0.3.32.19971013233228.006e7940@popd.ix.netcom.com>



At 07:50 PM 10/13/1997 +0000, Vipul Ved Prakash wrote:
>I am developing a product that would use GOST for encrypting data 
>streams. This is mostly because its design and simplicity hold
>considerable aesthetic value, at least for me. 
>
>Most of the related text I have read indicates
>that some SBOX sets can be cryptographically weak, and
>its a good idea to use SBOX data as key data instead. 
>Pointers? 

S-box structure is one of the critical issues in designing
Feistel-type networks; if you understand the mathematics
very very well, you can do it yourself, and if you don't,
then you don't understand it well enough to be sure
the S-boxes are secure enough, and thus you shouldn't
be selling it to customers.

An advantage of GOST for the Soviets was that they could 
use the same code, with different sets of S-boxes for the
military, civilian government, and other applications,
and the KGB could easily read things they wanted easily read
but the things that needed to be harder to read were hard.

				Thanks!
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From bd1011 at hotmail.com  Tue Oct 14 00:57:12 1997
From: bd1011 at hotmail.com (Nobuki Nakatuji)
Date: Tue, 14 Oct 1997 15:57:12 +0800
Subject: RSADSI open RC2 encryption algorithm
Message-ID: <19971014074326.1917.qmail@hotmail.com>



RSADSI open RC2 encryption algorithm.

http://www.imc.org/draft-rivest-rc2desc



______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com






From aba at dcs.ex.ac.uk  Tue Oct 14 02:57:16 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Tue, 14 Oct 1997 17:57:16 +0800
Subject: GET OFF THE DIME: PGP 5.5: Attitude
In-Reply-To: <19971013.035233.attila@hun.org>
Message-ID: <199710140835.JAA01158@server.test.net>




Attila T Hun  writes:
>     There is one all important consideration in this debate:
>  
>         would you rather have PGP, Inc. with its preeminent 
>         stature in the defense of freedom, freeware, and
>         privacy as well as an established, TRUSTED product 
>         defining THE system which meets the need of the 
>         free world business, but is not selling out to 
>         GAK or CAK? 
> 
>         or, would you rather see IBM, HP, TIS and others with 
>         their GAK products and potentially even backdoors?
>         are any of these vendors even planning to give us 
>         source code so we might have a warm and fuzzy feeling
>         until someone blows a hole in it 10 years from now?

_Of course_ we all agree that it is much better to have PGP Inc
implement a CAK system than IBM, HP, TIS or other GAK-sellout'ers.

Attila, I generally liked your rant, and agreed with pretty much most
of it.  However I would repeat what I said to Jon Callas with his
nicely written rant which started this thread on `attitude' (modified
for Attila rant relevance):

: [bucko big snip]
: 
: Well, it was a nice rant, Attila.  Most of it was even crypto-correct :-)
: 
: But the problem is you didn't address the point causing PGP's perceived
: hostilities.  Not once.

Now as you say above, if there was no choice on how to implement CAK,
well we'd all be forced to agree that PGP Inc hard no alternative but
to do what they have done and implement something which can be
directly used as a fully functional GAK system, because of the
requirement for company availability of data.  We'd feel unhappy about
it, as Jon Callas himself admitted of the CMR design but acknowledging
the user requirement and inevitability, in similar ways that you have
been arguing for.

We'd then be acknowledging the nice balances which PGP have put in as
expressed by PGP's Jon Callas and Jon Seybold respectively: the
principle of transparency: that PGP is recommending that companies
flag mail addresses which are "company use" mail boxes where the
company may be reading; and Jon Seybold's point about decentralised
company escrow designs being much better than centralised ones.  Both
are very good points.

The point is that, _of course_ we acknowledge these points; that is a
complete no-brainer.


_This_ is the point I am trying to get across:

- If you (as a crypto software company) have users who have a
  requirement for data recovery of stored email (and there is a pretty
  reasonable business case for this), then as a company which claims
  to be against the dangers of mandatory GAK, you should do everything
  you can to make your system non-useful to the GAKkers purposes.  PGP
  has done somethings in this direction (the two points I list above
  for example).  But they could do more:

- I have laid out a perfectly feasible design for providing a fully
  functional non-GAK compliant "Commercial Data Recovery" (CDR) system.
  I have not seen any PGPers anonymous or otherwise who have come up
  with any flaws in this design; nor even with any functionalities
  which it is not capable of meeting with similar degrees of weak tamper
  resistance to the GAK compliant CMR design.

Did you miss that argument?

I'll use the term "data recovery" to describe it to highlight the key
differences between PGP's method which is Commercial _Message_
Recovery, because the "message recovery" design philosophy is a
fallacy adopted by swallowing the GAKkers "key escrow" arguments.  The
argument that you somehow need to escrow transient communications keys
to allow governments access to information stored on disks.  That
people swallow this argument never ceases to amaze.

You will notice that there have been no technical refutations of my
CDR design.  I and others have I think been able to demonstrate that
it is just as flexible, and to boot more secure.

> [bucko huge snip]

I agree with the rest of Attila's points.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0




If we take the design goal of designing a commercial data recovery
system which is not GAK compliant, we can most succinctly state this
design goal as the task of ensuring that:

- at no point will any data transferred over communications links be
  accessible to anyone other than the sender and recipient with out
  also obtaining data on the recipient and/or senders disks


I think we can distill the design principles required to meet the
design goal of a non-GAK compliant Corporate Data Recovery (CDR) down
to ensuring that:

1. no keys used to secure communications in any part of the system are
   a-priori escrowed with third parties

2. second crypto recipients on encrypted communications are not
   used to allow access to third parties who are not messaging
   recipients manually selected by the sender

3. communications should be encrypted to the minimum number of
   recipients (typically one), and those keys should have as short a
   life time as is practically possible

Included in 2) is the principle of not re-transmitting over
communication channels keys or data re-encrypted to third parties
after receipt -- that is just structuring -- and violates design
principle 2.


With these three principles you still have lots of flexibility because
you can escrow storage keys, do secret splitting of storage keys, and
store keys encrypted to second storage accessors on the local disk for
stored data recovery purposes.

As an additional bonus, principle 3 adds extra security against
attackers gaining access to encrypted traffic after the fact -- the
recipient no longer has the key -- this is a form of forward secrecy.


Systems designed to the CDR design principles are of significantly
less use to GAKkers than PGP Inc's GAK compliant Commercial Message
Recovery (CMR) design.  The CDR design significantly hinders the take
up of GAK if widely deployed.  

Design principle 3 -- forward secrecy -- is inherently hostile to
GAKkers, and is the strongest statement you can make against GAK: you
are purposelly _destroying_ communications keys at the earliest
possible moment to ensure that GAKkers can not obtain the keys by
legal and extra-legal coercion, black mail, and rubber hose
cryptanalysis.

The whole system translates into the Feds having to come and
physically take your disk to obtain information about you, which is
much better than GACK, and not what the GAKkers are interested in at
this point.  The GAKkers would like to install themselves, and coerce
companies into installing for them (via GAKker/USG/NSA/NIST organised
efforts such as the 56 bit export permit for companies installing key
escrow; and efforts such as the Key Recovery Parners Alliance (KRAP)).
I fear that PGP Inc's CMR proposal inadvertently meets most of the
NIST/NSA specified KRAP requirements.

What the GACKers want is systems where they can perform routine key
word scanning and fishing expeditions into your communications from
the comfort of their offices, without your knowledge.  This is push
button Orwellian government snooping.

Within the constraints imposed by the CDR design principles, there is
plenty enough flexibility to acheive the commercial data recovery
functionality to similarly weak levels of enforcability as achieved by
the CMR design.  Weak levels of enforceability are appropriate because
there are other exceedingly easy bypass routes: super-encryption, and
walking out of the office with a DAT tape.


I would like to organise a collaborative effort to write a white paper
discussing how to implement various functionalities using the CDR
design principle.

Then I would like to see discussion of which set of these
functionalities which best acheive the user requirement for company
data recovery.

Lastly I would like to see a collaborative development effort to
provide a example implementation of a CDR system which can be used as
a discussion point for the OpenPGP standardisation process.

I suppose the best place to discuss this process is the IETF forum for
discussion of the OpenPGP standard, the OpenPGP mailing list
(subscribe by sending message body "subscribe ietf-open-pgp" to
"majordomo at imc.org").

I have already had people express in email to me their interest in
doing this.  Those people can speak up if they want to.  Technical
input is sought from people opposed to GAK compliant software, and
from PGP Inc, and others defending PGP's GAK compliant CMR proposal.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0


If you did not request to be put on the One Nation mailing list please
respond with "REMOVE" in the Subject line while leaving the message (below)
intact.

No email is sent without a request having first been received.

GWB, Scott Balson, One Nation web site operator.
____________________________________________________________________________
__________ 

Dear One Nation supporters in NSW,

Pauline Hanson's One Nation is now establishing an on-line working group of
One Nation members.

Conditions of involvement in this working group are:
	- being a bona-fide paid up member of One Nation.
	- the desire to be proactive in undertaking tasks and assisting One Nation
where you can.

This working group will play a very important support role for the party as
we approach the next federal election.

We do not want to say too much more until working group members have been
selected. If you would like to enquire about joining this group please
complete the information below:

______________________________________________________

Your Full Names:

Your Full Address:

Your Contact Phone no:
 
Your Fax no:

Your One Nation Membership number:

One Nation branch (at which you are a member):

_____________________________________________________

Thank you in anticipation of your valued support in this important area.



Pauline Hanson






From dformosa at st.nepean.uws.edu.au  Tue Oct 14 03:47:55 1997
From: dformosa at st.nepean.uws.edu.au (? the Platypus {aka David Formosa})
Date: Tue, 14 Oct 1997 18:47:55 +0800
Subject: Suicides don't forfeit their property
In-Reply-To: 
Message-ID: 



-----BEGIN PGP SIGNED MESSAGE-----

On Mon, 13 Oct 1997, Tim May wrote:

[...]

> >Suicide is illegal in most "democracies" 

> This would be a nice example if it were true. But it isn't true in the
> U.S., for example.

It is legal in Austrailia.  However I belave that suiside should be made
illegal and should always be punshied by the death penity.


- -- 
Please excuse my spelling as I suffer from agraphia see the url in my header. 
Never trust a country with more peaple then sheep.  ex-net.scum and proud
You Say To People "Throw Off Your Chains" And They Make New Chains For
Themselves? --Terry Pratchett

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBNENJdKQK0ynCmdStAQHLuQQAmrDIjCIoWW7Gt3Xd+HdSI9k+nZa8jXie
zo5T4Djr6sPvc2EpYoE9Z0rn7z16ce9LfannfbpI2xY8KXQ5rxZOyKStGjzPMCh8
R7xEpqCfTxNq0kHpm+VIltDx/qeqFSrnNG2YWdZ210mAd/8Jt4+iysNLMUIMMC+b
rpBuPtjTCfQ=
=NO16
-----END PGP SIGNATURE-----






From dformosa at st.nepean.uws.edu.au  Tue Oct 14 03:57:23 1997
From: dformosa at st.nepean.uws.edu.au (? the Platypus {aka David Formosa})
Date: Tue, 14 Oct 1997 18:57:23 +0800
Subject: Encryption Program
In-Reply-To: <199710130820.BAA29369@k2.brigadoon.com>
Message-ID: 



-----BEGIN PGP SIGNED MESSAGE-----

On Mon, 13 Oct 1997 semprini at theschool.com wrote:

> Hello. I just posted an encryption program on the web. It uses a key-
> generated pseudorandom stream of characters that get XORed with the 
> plaintext to produce the cyphertext.

Why do peaple keep posting examples of this lame cryptosystem?  I mean how
meany examples of XOR with the output of a pydorandom strame do we have to
see? 

Semprini please find some good books on Crypto (and read the sci.crypt
FAQ) to see why what you have done is week.

- -- 
Please excuse my spelling as I suffer from agraphia see the url in my header. 
Never trust a country with more peaple then sheep.  ex-net.scum and proud
You Say To People "Throw Off Your Chains" And They Make New Chains For
Themselves? --Terry Pratchett

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBNENE1qQK0ynCmdStAQGoQAQA1HWIeTuCIhOKSc+owY7tkgp/ENlIXy5r
J3Wy5pF7JuopRrR7F0xoj3Y3hv/IAcXFD2jhjziAGdqiqQR+hnTQWJZHROB/G+4v
osAFM1v/2aOTV8gLca+xRDYpVVt+wWy0dWOHYrKIebEldnnhFVJp5fRSngdjqcjY
yLB7BqVFFBk=
=RQN1
-----END PGP SIGNATURE-----






From biz at savoynet.com  Tue Oct 14 19:04:25 1997
From: biz at savoynet.com (biz at savoynet.com)
Date: Tue, 14 Oct 1997 19:04:25 -0700 (PDT)
Subject: No Subject
Message-ID: <199710150203.WAA24552@moscow.savoynet.com>


////////////////////////////////////////////////////////
Realizing that many of you do not wish to receive UCE,
if you would please type REMOVE in the Subject Header,
you will not hear from me again, you WILL be permanently
removed. If you don't do this, and send me a nasty reply,
there will be no way for me to REMOVE you.
/////////////////////////////////////////////////////////

We are looking for reseller for our Virtual Pets/Electronic Pets

Tamagotchi Style Virtual Pets

On sale  

3 in 1 Electronic Pets ( We have 200,000 pcs in our Taiwan factory ready to ship )


Price: $3.5 FOB Taiwan at quantity 1000 UP
Smaller quantity: price by request.

This is most popular electronic toy. We can provide the "Virtualc Pets", Dinosaur, Puppy, Kitten 3 in 1

It can be re-set, so you can play with your pet for a long long time. If you are interested in these products. Please contact with us.

mailto:biz at savoynet.com 


Long Well Electronic Corp.

P.O Box 15211, Fremont, CA 94539



 









From zooko at xs4all.nl  Tue Oct 14 04:17:16 1997
From: zooko at xs4all.nl (Zooko Journeyman)
Date: Tue, 14 Oct 1997 19:17:16 +0800
Subject: commercial data recovery
Message-ID: <199710141053.MAA03610@xs1.xs4all.nl>



[Note-- I am not subscribed to ietf-open-pgp at this time.  My
 apologies if this submission from a non-subscriber is 
 unwanted.  I will be brief.  --Zooko]


Adam, I applaud your effort to steer discourse toward 
productive work re: GAK, CMR, CDR.  I haven't thought about 
your idea enough to have a definite opinion, but at first blush
it seems a promising strategy to design high-security and 
forward-secrecy for communication but recovery/sharing features
for stored data.


I wonder if it is too much early-days to start talking about
advanced protocols e.g. secret-splitting in IETF-Open-PGP?  
Probably so.  Better just punch out a standard with current
tech...



Hm.  What about the idea of storing your data remotely (for
cost-efficiency, safety, etc.) using encryption to maintain 
your privacy?  In that case, the distinction between comms and
storage keys is blurred.  A company may choose to e.g. store 
all long-term data at Zooko's Backup Server, encrypted in such
a way that some combination of corporate keys (controlled by 
individual employees and/or departments) is necessary to 
decrypt each package of data.  This would open the door, as you
fear, for a government to mandate that _its_ key be added to 
each set, with authority to open any package even without the 
cooperation of any corporate keys.


I'm not sure how to weigh the relative risks and benefits.  
I (ever so humbly) think that Zooko's Backup Server would be a
great value for businesses, and that part of that value would
be the ability to make data unlockable by various keys, both
for administrative/internal security purposes and for 
robustness against accidents and saboteurs.


Zooko's Backup Server can be physically located in a country 
free of such intrusive organizations, but of course it is the
intrusive organizations of the _client's_ country that become
important with that kind of protocol...


Regards,

Zooko

P.S.  There is already a company whose name I have forgotten 
that offers hard-drive backups over TCP/IP.  They use some 
encryption but I don't know how strong.






From alexlh at xs4all.nl  Tue Oct 14 05:21:43 1997
From: alexlh at xs4all.nl (alexlh at xs4all.nl)
Date: Tue, 14 Oct 1997 20:21:43 +0800
Subject: commercial data recovery
In-Reply-To: <199710141053.MAA03610@xs1.xs4all.nl>
Message-ID: 



On Tue, 14 Oct 1997, Zooko Journeyman wrote:

> Zooko's Backup Server can be physically located in a country 
> free of such intrusive organizations, but of course it is the
> intrusive organizations of the _client's_ country that become
> important with that kind of protocol...

How about also having Alex' Backup Server, and using some
shared-secret/whatever tech to ensure that you need to contents of _both_
servers to actually reconstruct the data. This would be a 'Distributed
Encrypted Backup Sysyem'.

This might make it very hard for anyone to access your data without your
knowledge/cooperation.

And if you use something like Onion Routers, it might even be quite
impossible for some lawenforcement agency to actually find out which one
of those encrypted files on the servers contains your backup.

Alex

---
I dabble in techno-house and sometimes,
I do that badass hip-hop thang...
But the F U N K gets me every time!






From aba at dcs.ex.ac.uk  Tue Oct 14 07:53:36 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Tue, 14 Oct 1997 22:53:36 +0800
Subject: commercial data recovery
In-Reply-To: <199710141053.MAA03610@xs1.xs4all.nl>
Message-ID: <199710141329.OAA02853@server.test.net>




Zooko Journeyman  writes:
> Adam, I applaud your effort to steer discourse toward 
> productive work re: GAK, CMR, CDR.  I haven't thought about 
> your idea enough to have a definite opinion, but at first blush
> it seems a promising strategy to design high-security and 
> forward-secrecy for communication but recovery/sharing features
> for stored data.

Thank you.  I would encourage others to read the proposal, and
provide criticisms of it.

> I wonder if it is too much early-days to start talking about
> advanced protocols e.g. secret-splitting in IETF-Open-PGP?  
> Probably so.  Better just punch out a standard with current
> tech...

I agree entirely.  The motivation for attempting to formalise the CDR
design principles, and for exploring designs which are non-GAK
compliant is based on these lines of reasoning, that we should:

1. Persuade PGP Inc that there are less GAK friendly ways of
   implementing data recovery

2. If that argument fails, and in the event that PGP were to try to
   influence the IETF OpenPGP forum to adopt any features relating to
   pgp5.5 GAK compliant functionality into the OpenPGP standard that we
   have an alternate proposal well enough thought through to compete
   with PGP's CMR proposal with sound technical arguments.

3. Of improving the state of the technology by working to include
   forward secrecy as much as possible into secure email messaging.
   This is a very effective method of giving the bird to the
   GAKkers, by purposefully destroying communications keys as soon as
   possible after the fact.  This is consistent with the CDR design
   goal: make the GAKkers job as difficult as possible.  Frustrating the
   GAKkers is a fun, morally satisfying activity.

> Hm.  What about the idea of storing your data remotely (for
> cost-efficiency, safety, etc.) using encryption to maintain 
> your privacy?  In that case, the distinction between comms and
> storage keys is blurred.  A company may choose to e.g. store 
> all long-term data at Zooko's Backup Server, encrypted in such
> a way that some combination of corporate keys (controlled by 
> individual employees and/or departments) is necessary to 
> decrypt each package of data.  This would open the door, as you
> fear, for a government to mandate that _its_ key be added to 
> each set, with authority to open any package even without the 
> cooperation of any corporate keys.

The application you describe has very interesting implications for the
CDR vs CMR debate.

I think that one way that you could implement remote backup in a way
which is sympathetic to CDR design principles like this:

- The communications security aspect could be acheived via the normal
  design for securing communications derived from the CDR design
  principles.  That is using short lived communications keys with no
  third party access to communications in transit without access to
  hard disks at either end.

- The data would be super-encrypted to the companies backup recovery
  storage key(s).

This technically violates the CDR design goal and principles of not
allowing third party access to communicated data, super encryption
doesn't negate this, it is just more structuring.

However, super-encryption does minimise the damage by preserving CDR
principle that recovery of data should require physical compromise of
one or both end points, which I think is an important principle, and
a useful property in this case.

This lesson leads to the corollary to the CDR principles that:

- if you can't keep to the principle of not transmitting data with third
  party recovery information attached,

that:

- super-encryption of the transmitted recoverable data can be
  used to at least preserve the requirement for one or both ends of
  the communication to be compromised to effect third party access.



But still, the remaining way that this system could be perverted would
be as you say for the GAKkers to demand to be one of the storage
accessors for the encrypted disk backup, and for the GAKkers to then
attempt to coerce the remote storage service provider to hand over the
ciphertext, or for the government to set themselves up as a central
provider of off site backup services.

The GAKkers desire for automatic access to communicated storage data
is frustrated to the maximal extent possible by those CDR design
principles we have managed to retain.  To achieve automated access the
GAKkers must start replacing software, and we have prevented automatic
snooping of our backup data whilst it is in communication, with
software we have fielded.

- CDR design principles do not prevent someone modifying software, but
  as we all know deployed systems are additional obstacles to overcome:
  they have to coerce some company in to implementing the new software
  with built in GAK, and they have to coerce everyone into replacing
  their existing software with this unpopular new software.

Widely deployed systems can be large obstacles.  The mess the US IRS
in with their millions of lines of hard to modify source attest to
this fact.

The IRS scenario has some lessons for us, for possible additional CDR
design principles:

- keep the source code out of reach of GAKkers so that they can not
  coerce us so easily to modify it.  Off shore backup might be useful;
  destroy the backup recovery key if GAK comes in.

- make systems non-interoperable where this does not interfere with
  functionality

- have mandatory GAK company contingency plans such as moving the
  company to Switzerland.

That first suggestion costs so much in the loss of user access to
source code to assure ourselves that there is no backdoor that we
probably can't employ it.  The other two look like sound principles to
me.


> Zooko's Backup Server can be physically located in a country 
> free of such intrusive organizations, but of course it is the
> intrusive organizations of the _client's_ country that become
> important with that kind of protocol...

One comfort which can be drawn from the above design using super
encryption inside a communications envelope protected with short lived
non-escrowed communication keys, is that the fielded software could
not be used as-is to prevent the practice of jurisdiction shopping.

Another comfort is that companies can, even if forbidden from using
offshore remote backup facilities, simply stop using remote backup
facilities at all, unless the GAKkers really go overboard and demand
that all citizen units will run this government remote backup software
to upload diffs of their disks to government run backup services.  I'm
sure they would love to do that, and charge you for the "service" too.

Also I expect there would be significant political hurdles for the
GAKkers to overcome in mandating government run remote backup services
for citizen units, or even for companies in our countries.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0


I've tried varios purmutations of the map rules to no positive effect.
map ppp0 192.168.1.0/24 -> 206.142.xx.yy/32 portmap tcp/udp 10000:20000
repeat except substitute   ^^^^^^^^^^^^^ with 0.0.0.0 or ppp0. Neither works.

I ran tcpdump on ppp0 on the gateway and sure enough, the box is sending
down the modem link 192.168.1.10 (the particular LAN host trying to
initiate an outside connection) as the source IP. Now if everything were
correct shouldn't it be the IP addr of the local end of the PPP link as
hosted on the gateway box? (ie 206.142.xx.yy)

ipnat -l has never once shown any indication of active connections.
Either nat is seriosly not working under stock v2.1 (anyone prove it does
work?) or there are some undocumented and not exactly obvios dependencies
with regard to kernel options.

Can someone please mail me a kernel config that is guarenteed to work on a
stock v2.1 box for i386 architecture?

BTW, how come kernal option IPNAT isn't documented ANYWHERE? It's not even
in the ALL file.

--------
Windows95: noun. 32-bit extensions and a graphical shell for a 16-bit
  patch to an 8-bit operating system originally coded for a 4-bit
  microprocessor, written by a 2-bit company that can't stand 1 bit of
  competition. (author unknown)







From schneier at counterpane.com  Tue Oct 14 08:51:33 1997
From: schneier at counterpane.com (Bruce Schneier)
Date: Tue, 14 Oct 1997 23:51:33 +0800
Subject: Why CMR is bad civic hygene;the short version
Message-ID: 



The FBI has publically stated that they want to ban unescrowed encryption.
A couple of years ago, people like Brock Meeks and EPIC predicted this;
they were universially regarded as alarmists.

The problem with corporate key escrow is that it puts an infrastructure in
place that can very easily, with a simple switch of public policy, turn
into GAK.

Diffie has said that the FBS's position is a strawman, and that some kind
of voluntary system will be put in place as a compromise.  Then, in a few
years, eliminating the voluntary nature will be seen as "closing a
loophole."

Technological infrastructure moves very slowly.  Political moods can move
very quickly.  If companies (like PGP) install a key escrow infrastructure,
it will take one well-timed disaster to convince Congress to pass a law
putting the whole thing under government control.

As Phil Zimmermann said many years ago (I have no idea where he stole it
from): "It's poor civic hygene to install technologies that may someday
facilitate a police state."

Data recovery is essential for stored corporate data.  This is a seperate
problem than corporate key escrow.  Communications keys (used for email)
are fundamentally different than storage keys (used for files).  Someone
sent me email recently and told me that those keys are treated the same in
PGP; I have trouble believing that this is true.

And if everyone is bashing PGP Inc badly over this, it's because people
expected more out of them.  A company like TIS, who gets significant (I
originally wrote "most of its," but I don't know if that's true anymore)
funding from the NSA anyway, is expected to roll over for the Feds.  PGP
Inc was not.

Bruce

**********************************************************************
Bruce Schneier, President, Counterpane Systems     Phone: 612-823-1098
101 E Minnehaha Parkway, Minneapolis,MN  55419       Fax: 612-823-1590
                                            http://www.counterpane.com







From schneier at counterpane.com  Tue Oct 14 08:54:47 1997
From: schneier at counterpane.com (Bruce Schneier)
Date: Tue, 14 Oct 1997 23:54:47 +0800
Subject: PGP Key Escrow and Congress
Message-ID: 



The attached is from Barbara Simons of the U.S. ACM.  Note item 4, where
Congressional staffers point to PGP as an example of key escrow software
being possible.  To those of us fighing the government control of
cryptography, this is not helpful.

Bruce

--------------------------------------------------------------------------

Date:         Mon, 13 Oct 1997 13:27:03 PDT
Reply-To: "Barbara Simons" 
Sender: ACM US Public Policy Committee 
From: "Barbara Simons" 
Subject:      Hill ... Blues
To: USACM at ACM.ORG

On Thursday and Friday of last week I met with Hill staffers of the
following Congresspeople: Sen. Feinstein, Sen. Boxer, Rep. Eshoo,
Rep. Campbell, and Sen. Kerrey.  As you may have noticed, there was a Ca.
theme to the group, with the exception of Nebraska's Kerrey, of S909 fame.

Both Feinstein's and Boxer's staffer suggested that I speak with Kerrey's
staff, which is how I ended up meeting with Christopher McLean, Kerrey's
Legislative Counsel, and Lorenzo Goco, who is Special Assistant to the
Vice Chairman of the Senate Select Committee on Intelligence.

My discussion with them was very interesting and somewhat lively.  I don't
know whether or not they had noticed our letter in opposition to S909,
but they at least appeared to be surprised when I said that we had written
such a letter, a copy of which was given to each at the meeting.
I had the strong impression that McLean and Goco had had a hand in the
writing of S909.  They certainly were well versed in the arguments.

Here is some of what they said:

1.  S909 impacts only the government, NOT universities that receive
    government funding for networks.  This is not our interpretation of
    the bill, and I'd be interested in hearing from some of the lawyers
    who are on USACM as to whether or not they agree with McLean and Goco.

2.  If we are concerned about the well being of the computer industry in
    the U.S., we should be supporting S909, since the alternatives are
    either a more draconian bill or no bill at all, with the maintenance
    of the status quo export restrictions.  They claim that Clinton will
    veto any bill that does not contain provisions that address some of
    law enforcement's concerns.

3.  If we are concerned about inappropriate behavior vis-a-vis key escrow
    or recovery, we should be supporting S909, since it includes strong
    penalties for unlawfully revealing or obtaining others' keys.

4.  The NSA states that key recovery is doable and will not jeopardize
    national security.  And there is an existence proof for key recovery
    software in the new PGP release.

5.  Yes, they would like to see widespread use of key recovery, but their
    idea is to encourage the development of encryption with key recovery
    by using the buying power of the government to cause widespread and
    inexpensive key recovery encryption to come into being.

6.  They are simply doing what the NRC report recommended, namely "testing"
    key recovery on the government without imposing it on the citizenry.

7.  Key recovery or key escrow are simply attempts at maintaining the
    status quo for law enforcement, who are now able to wiretap at will.


Some of these are old arguments that we've been hearing for a while,
but some are newer.  In particular, points 4 and 6 are difficult to
refute without getting into some technical details.  Both points also
undercut the argument that a key recovery infrastructure potentially
weakens security.  After all, the NSA thinks it's secure enough that it
can be used by the government.

Barbara







From frantz at netcom.com  Tue Oct 14 09:25:46 1997
From: frantz at netcom.com (Bill Frantz)
Date: Wed, 15 Oct 1997 00:25:46 +0800
Subject: proposal: commercial data recovery
In-Reply-To: <199710140937.KAA01187@server.test.net>
Message-ID: 



At 2:37 AM -0700 10/14/97, Adam Back wrote:
>...
>2. second crypto recipients on encrypted communications are not
>   used to allow access to third parties who are not messaging
>   recipients manually selected by the sender
>...
>
>Included in 2) is the principle of not re-transmitting over
>communication channels keys or data re-encrypted to third parties
>after receipt -- that is just structuring -- and violates design
>principle 2.

This requirement tries to enforce something which can not be enforced by
technical means.  That is, when you send another person some data, there is
no technical way you can prevent them from using it however they want.  For
example, a user can always program his filters (given something like
procmail) to send decrypted data anywhere he wants.

The idea that you can control what users do with data thru technical means
is the most common flaw I see when people think about security.


N.B. I applaud Adam's direction of building the data recovery businesses
need without helping 3rd parties engage in undetected snooping.  Keeping
the decryption keys (if data is not stored in the clear) near the
legitimate copies seems to be a useful step in this direction.


-------------------------------------------------------------------------
Bill Frantz       | Internal surveillance      | Periwinkle -- Consulting
(408)356-8506     | helped make the USSR the   | 16345 Englewood Ave.
frantz at netcom.com | nation it is today.        | Los Gatos, CA 95032, USA







From bianca at dev.null  Tue Oct 14 09:40:22 1997
From: bianca at dev.null (Bianca)
Date: Wed, 15 Oct 1997 00:40:22 +0800
Subject: Miss Canadian Slut International
Message-ID: <34439A4B.4813@dev.null>



Dear Mr. Beauvais,
  I noticed on a visit to your website that you are a "Proud sponsor of
Miss Canada Int. 97/98."
  I was wondering if you are reconsidering your sponshership in light
of the fact that they award the title to sluts and whores.

  I was watching Jenny Jones, and thought that the lady, Gabrielle, was
a very nice young woman, and a good role model for young women, but
a representative of Miss Canada International corrected my error by
pointing out that the woman is a trashy whore for taking a job with
a legitimante Canadian business which she disapproved of.

  Accordingly, I am informing all of my male friends that it will be
perfectly acceptable to slip their hands up the skirts of future Miss
Canada International contestants, since they are all sluts and whores.
  I was wondering if this also applies to the models you represent and
work with, since you seem to be proud of an sponsering an organization
that regards the bright and talented young women who represent them
as sluts and whores. Do you also regard the women that you work with as
sluts and whores?

Sincerely,
 Bianca






From nobody at REPLAY.COM  Tue Oct 14 10:23:21 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Wed, 15 Oct 1997 01:23:21 +0800
Subject: Australian Key Escrow Bill Before Parliament for VPNs
Message-ID: <199710141708.TAA17940@basement.replay.com>




------- Forwarded Message

Date: Tue, 14 Oct 1997 17:08:36 +1000
From: Paul Montgomery 
Subject: [Oz-ISP] Interception law IS a threat to ISPs

A couple of ISPs in messages under the "Interception" heading have
pooh-poohed the new interception law that is going through government
processes at the moment. FYI, the following PC Week Australia story
shows that it's not something to be sneezed at, if you want to
differentiate yourself by offering remote access or VPN services that
are secured using encryption. As mentioned in the story, Telstra,
OzEmail, Access One, Connect.com.au and Magna Data are only the largest
of growing band of ISPs who are already constructing VPNs for business
customers.

It's going to take more than an a packet sniffer to decrypt secure
messages going through your network. If you're preparing a VPN trial
with something like Data Fellows' F-Secure VPN software, which doesn't
allow for key recovery, then you're up the proverbial creek as regards
your obligations under this new law. You'll have to keep an extra key
for the Feds, ASIO, NCA etc, and only use cryptography software that
includes key recovery.

You'll also have to be involved in a lengthy approval process with the
Attorney-General's department and the ACA, which is dangerously
open-ended. The system will be that you have to submit your plans for
new secure network products every year, and the law enforcement agencies
have a set amount of time to protest that they can't access it. This
process will add three months, at minimum IMHO, to the development of
new services.

And yes, INTIAA has been keeping an eye on it, but they've been getting
the wrong information from the Department of Communication. I wouldn't
say they've been lied to, but they've been given the wrong end of the
stick.


- -- START STORY [from PC Week Australia, October 17, pp 1/38]

New Law Hurts Net Security
Security forces want access to encrypted ISP traffic
By Paul Montgomery
[reproduction for commercial purposes not allowed etc etc]

The Virtual Private Network (VPN) revolution in Australia is being
undermined by new legislation from the Liberal government that would
weaken security on communications passing through Internet service
providers (ISPs).

The Telecommunications Legislation Amendment Bill, which went to a
second reading in the Senate last week, is aimed at giving government
agencies such as the Federal Police, ASIO and the National Crime
Authority access to data and voice traffic�and ISPs will have to fund
its implementation.

The bill threatens ISPs� ability to provide secure remote access and VPN
services, by compelling them to include an extra cryptographic key for
police, in a weakened version of encryption that is called �key escrow�.

Any modifications needed to encryption technology would not only weaken
security, but mean extra costs passed on to corporate customers.

Senator Richard Alston, the Minister for Communications, the Information
Economy and the Arts, said in a speech to the Senate that interception
was an �essential service� and that Attorney-General Daryl Williams
would be given the power to determine the specifics of the proposed
law�s effect.

Senator Alston recently took over policy coordination for cryptography
(see PC Week, October 3, page 12), but the decision on this bill was
made back in March.

�The introduction of some new telecommunications services have been
significantly delayed, with obvious adverse consequences for business
and consumers,� Alston said, which sources say is a reference to
Telstra�s OnRamp ISDN service.

Alston also hinted that the government was lobbying switch vendors, at
an international level, to include interception capabilities in their
equipment.

Chris Cheah, assistant secretary of the networks policy branch at
Senator Alston�s department and one of the officials involved in
drafting the bill, confirmed that the bill applied to ISP-encrypted VPN
and remote access services.

�If [ISPs] are offering VPNs which have built-in encryption, and they�re
saying to their customers that they will deliver in a secure form to a
person at the other end, then they will have to provide decryption,�
Cheah said.

He stressed, however, that there would be no requirement for an ISP to
decrypt an end user�s own encryption.

Telstra, OzEmail, Access One, Connect.com.au and Magna Data are already
offering VPNs, expected to be a lucrative market for network
outsourcing, but a central part of the technology is the security gained
from scrambling messages with strong cryptography, using such products
as F-Secure VPN from Data Fellows (see page 16).

Danny Ng, business development manager for Internet and intranet at Bay
Networks, said that because Internet access is not an inherently
high-margin business, many ISPs were looking to differentiate themselves
by offering outsourced remote access or VPN services.

�VPN technology is evolving very quickly, and one of the cornerstones to
it is security, which usually means encryption,� Ng said.

For major carriers such as Telstra, the delivery point could be the
local exchange closest to the agency wanting the interception, but it
would most likely remain at the premises for smaller ISPs, according to
Cheah.

�If ISPs want to get into serious carriage service provision, they will
be subject to the same provisions as telcos. That means being able to
provide interception capabilities,� Cheah said.

The bill also removes the burden of keeping up with Internet technology
from police and security agencies by ordering ISPs to prepare annual
reports on their plans for new crypto services.

Luke Carruthers, secretary of ISP representative body INTIAA (Internet
Industry Association of Australia), said that the impression he had from
meetings with the government on the bill was that ISPs would not have to
decode encrypted transmissions.

INTIAA is meeting with the Australian Communications Authority and the
government this week to work out the details of the legislation.
Carruthers will argue the ISPs� case.

�I would expect this issue to be taken up fairly strenuously by the
people who it affects the most,� he said.

- -- END STORY

- -- 
Paul Montgomery, Net journalist for PC Week, lives like a JavaBean.
mailto:monty at apnpc.com.au Tel: +61-2-9936-8793 Fax: +61-2-9955-8871

------- End of Forwarded Message








From lutz at IKS-JENA.DE  Wed Oct 15 01:23:53 1997
From: lutz at IKS-JENA.DE (Lutz Donnerhacke)
Date: Wed, 15 Oct 1997 01:23:53 -0700 (PDT)
Subject: Security flaw in PGPverify of INN
Message-ID: 

Hi,

I was urged to send you the following information. I noticed CERT and tale
itself. But tale claims that the problem is not a problem of pgpverify, it's
a problem of some krauts trying to send checkgroups monthly using a bot.

The checkgroups mentioned were send since a year. They do not include Date:
and Message-ID: because these values were not predictable by the human
signer and the bot does not know the passphrase to work with.

In consequence there are checkgroups out there which can be resend at any
time causing a lot of trouble, because the signature is still valid even if
a new Message-ID: and Date: line are used.

The obvious fix is to modify pgpverify to block such control messages.
ftp://ftp.iks-jena.de/pub/mitarb/lutz/ contains the necessary fixes.

HTH

Content-Type: application/pgp-signature


-------------- next part --------------
A non-text attachment was scrubbed...
Name: hqx00000.hqx
Type: application/octet-stream
Size: 512 bytes
Desc: "Untitled"
URL: 

From nobody at REPLAY.COM  Tue Oct 14 10:33:13 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Wed, 15 Oct 1997 01:33:13 +0800
Subject: Telstra Australia admits it lied about net
Message-ID: <199710141716.TAA18754@basement.replay.com>



http://www.australian.aust.com/computer/fulltext/c1014b.htm

         Telstra: We were wrong about Net
         By GEOFF LONG 

October 14: A Telstra official has admitted that the carrier
overestimated the congestion problems associated with the Internet,
one of the prime reasons given when it wanted to introduce timed local
calls.

Speaking at the launch of Telstra's Big Pond Business services, Big
Pond general manager John Rolland said congestion caused by Internet
users connecting for long periods was not as big an issue as they
first thought.

He added that the about-face was in line with similar findings from
North American carriers and switch manufacturers Alcatel and Ericsson.

Mr Rolland said that the main problem areas are where ISPs are
situated, but that these were manageable: "What is clear is that in
the medium term we will have hot spots, especially around ISPs."

However, these could be addressed by working with the ISPs and
managing connectivity better.

The remarks came in response to Telstra promoting permanent modem
connections as part of its Big Pond Business offering.







From sunder at brainlink.com  Tue Oct 14 11:20:01 1997
From: sunder at brainlink.com (Ray Arachelian)
Date: Wed, 15 Oct 1997 02:20:01 +0800
Subject: Security flaw in PGPverify of INN (fwd)
Message-ID: 





=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.|  Ray Arachelian    |Prying open my 3rd eye.  So good to see |./|\.
..\|/..|sunder at sundernet.com|you once again. I thought you were      |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run  |\/|\/
../|\..| "A toast to Odin,  |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were....            |.....
======================= http://www.sundernet.com ==========================

---------- Forwarded message ----------
Date: Tue, 14 Oct 1997 17:34:11 +0200
From: Peter Simons 
To: BUGTRAQ at NETSPACE.ORG
Subject: Re: Security flaw in PGPverify of INN

-----BEGIN PGP SIGNED MESSAGE-----

I am replying to the "security problem" report in pgpverify written by
Lutz Donnerhacke, which has been delivered via several mailing lists,
including BUGTRAQ and Best-Of-Security. Normally I'd simply ignore
this article, but this is so breath-takingly ridiculous that I have to
set a few facts straight.

Lutz Donnerhacke  wrote:

 > I was urged to send you the following information. I noticed CERT and tale
 > itself. But tale claims that the problem is not a problem of pgpverify, it's
 > a problem of some krauts trying to send checkgroups monthly using a bot.
 >
 > The checkgroups mentioned were send since a year. They do not include Date:
 > and Message-ID: because these values were not predictable by the human
 > signer and the bot does not know the passphrase to work with.
 >
 > In consequence there are checkgroups out there which can be resend at any
 > time causing a lot of trouble, because the signature is still valid even if
 > a new Message-ID: and Date: line are used.
 >
 > The obvious fix is to modify pgpverify to block such control messages.
 > ftp://ftp.iks-jena.de/pub/mitarb/lutz/ contains the necessary fixes.

This is plain bullshit. pgpverify is working just fine and there's no
security leak or malfunction in the script.

The real story behind this 'report' is as follows: Lutz is the
moderator for the german language de.* USENET hierarchy. One of his
duties is to send out regular checkgroups and other control messages.

What he did is that he didn't include the Message-Id and Date header
into the signature of the control messages that he posted. He only
signed headers like From and Subject. So he posted control messages
with incomplete signatures for maybe a year, until this was first
noticed and publicly addressed by Ralph Babel.

The problem with these control messages is that anybody is able to
re-post them with a new Message-Id and Date. Due to the correct PGP
signature, most INNs will simply execute them, thus deleting all
changes in the hierarchy since the checkgroups was posted originally.
While this is not a major problem, it certainly is a problem, as all
groups that have been created past a certain date can easily be
removed, etc...

When his mistake became public, he didn't stand up for it and created
a new key to start posting correct control messages, rendering the old
ones useless, he put the blame on Tale and his script instead.

So please don't believe this "security flaw". pgpverify is working
just fine and if the responsible person will use PGP correctly, there
is no problem at all.

        -peter

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1

iQCVAwUBNEORSw9HL1s0103BAQEgugP9FWJMNivNBqmJElzoQ6pXnwvS6QsbLjQG
YrwHzvcYY3CAR7R446gr/WeuxW1JI1t9+yql8TNSvHeEXAX+qgz/ZMCjcjgjg0Pe
j0BuVLBBfKuBoxGZDQybRybu3d5Xflqk07W9HjPP0tDtdkUcjndHr2J1Ea/J4zTd
QgGNNUoZDFM=
=brmw
-----END PGP SIGNATURE-----






From aba at dcs.ex.ac.uk  Tue Oct 14 11:42:53 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Wed, 15 Oct 1997 02:42:53 +0800
Subject: proposal: commercial data recovery
In-Reply-To: 
Message-ID: <199710141811.TAA04798@server.test.net>




Bill Frantz  writes:
> At 2:37 AM -0700 10/14/97, Adam Back wrote:
> >...
> >2. second crypto recipients on encrypted communications are not
> >   used to allow access to third parties who are not messaging
> >   recipients manually selected by the sender
> >...
> >
> >Included in 2) is the principle of not re-transmitting over
> >communication channels keys or data re-encrypted to third parties
> >after receipt -- that is just structuring -- and violates design
> >principle 2.
> 
> This requirement tries to enforce something which can not be enforced by
> technical means.  That is, when you send another person some data, there is
> no technical way you can prevent them from using it however they want.  For
> example, a user can always program his filters (given something like
> procmail) to send decrypted data anywhere he wants.

I agree with that statement entirely.

The principle has deeper meaning than your point.  It acknowledges
that there are limits to what can be done to enforce things in
software.  What it argues is that you should enforce what you can
where this helps you to make your software less useful to GAKkers
without modifications.  So if this means that the GAKkers can't use
your software with out getting you to re-write it, or without making
the modifications themselves this is good because fielded systems have
intertia.  It takes time and costs money to make software updates,
doubly so where people will be hostile to those updates.  People who
would otherwise not care about GAK will suddenly "care" because they
are too lazy to update their system, or becaues the update will cost
them money.


Btw. Lest it is not clear, when I say "should" in this discussion of
the anti-GAK protocol design process I mean "should" according to my
CDR or "anti-GAK" protocol design principles.  If following these
principles causes you to have non functioning or unsaleable designs,
and when this occurs you should still try to violate as few of the
design principles as possible.


So for your .procmail filter example: what the principle says is that
you should make it as non-automatable as possible in your software to
do this redirection in electronic form.  The danger about automated
redirection in electronic form is that there will be a nice little box
saying for you to type: "recovery at lazarus", where lazarus is the
address of the recovery machine on your LAN, but then the GAKkers can
pass laws and all the people who bought your software will be
automatically able to comply by filling in that box with
"thoughtpolice at nsa.gov"; alternately the GAKkers may buy your software
for re-sale in Iraq and then fill in the field with or
"thoughtpolice at mil.iq", with the result that Iraqis.

So for example with your .procmail example: the email client should
decrypt the traffic with short lived keys to provide forward secrecy,
and re-encrypt the plaintext for storage in your mail folder with a
recoverable key (presuming you want corporate data recovery of your
mail folder in case your dog chews your smart card key token).

Forwarding of email at the .procmail level won't help the GAKkers in
this case because the email is still encrypted; and the anti-GAK
protocol design principles state that the encrypted message should be
encrypted to one recipient only: you.

The anti-GAK design principles also mean that you should offer no
tools to decrypt from the command line.  This ensures that GAKkers
will be hindered from using software provided by you to cobble
together a GAK system, without writing and distributing software
themselves.

Think of the CDR or anti-GAK software principles as attempting to
codify your natural predilections as a GAK hating protocol designer.
They codify how best to design your software to hinder GAKkers.


Clearly the GAKkers can pass a law saying that you must manually
forward each of your emails after decryption to them, but if the
software provides no easy way to automate this process they are asking
the impossible if there are 10 million US citizens using the software.

Contrast this to PGP Inc's CMR design where all that is required is a
change to one field for completely automated over the wire key word
searches.

> N.B. I applaud Adam's direction of building the data recovery businesses
> need without helping 3rd parties engage in undetected snooping.  Keeping
> the decryption keys (if data is not stored in the clear) near the
> legitimate copies seems to be a useful step in this direction.

I like your locality point.

It is something I had not earlier considered had more than binary
meaning (communicated or not ever communicated).  However it does.
The Frantz corollary to the anti-GAK protocol design principles is
then:

i)  recovery information should be kept as close to the data as possible

ii) if recovery information is moved it should in preference not be
    transferred using over communications networks, and should
    not be transferred automatically by the software without requiring
    human interaction.


You can see that this design principle leads to some at first
apparently absurd requirements, but actually they are all sensible and
pertinent.  If the software requires user interaction to transmit
recovery information this means therefore that it should not be
possible with the software as is to write automatic scripts; this
contributes to the uselessness of the software to the GAKkers.

Of course there are ways around everything (eg. scripting software
which allows mouse and keyboard actions to be automated); but we are
trying to avoid easy cobbling together actions by the GAKkers allowing
them to convert our software designed under anti-GAK principles into
one which can then becomes automated GAK system.


Also clearly there is some user intelligence required in the design
process to work out functionalities it is worth forgoing where it
comes to this by comparing their potential value to the GAKker against
the ergonomic or utility advantage to the user.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



Is the guy still around who wrote " Magic Money" and if so where can I
communicate with him?  Apparently his name is "Product
Cypher".



Thanks,


Eric Wilhem






From sw at cryptosoft.com  Tue Oct 14 13:50:38 1997
From: sw at cryptosoft.com (Stefan D. Wolf)
Date: Wed, 15 Oct 1997 04:50:38 +0800
Subject: info
Message-ID: <3443D640.2871@cryptosoft.com>








From semprini at theschool.com  Tue Oct 14 14:14:57 1997
From: semprini at theschool.com (semprini at theschool.com)
Date: Wed, 15 Oct 1997 05:14:57 +0800
Subject: Encyrption Program
Message-ID: <199710141958.MAA22050@k2.brigadoon.com>



This is in response to the several posts regarding the assumed 
weakness in the program I wrote:

    While it is true that PRNG's are not very good, because of the 
inherent lattice structure, I believe I found a way around that 
problem. To work around the lattice problem, I used a systm of cubic 
arrays. The program first creates sixteen cubic arrays, and fills 
them one space at a time with random characters. When the stream of 
characters to be XORed with the plaintext is generated, it picks a 
random cube and a random location with that cube. The resulting 
"random" character is then XORed with the appropriate character of 
the plaintext. If someone can prove to me that this method is stupid 
or easily breakable, I would actually be happy. So, those of you bent 
on proving that I'm wrong, I heartily encourage you to do so. As I 
mentioned before, you can download both the compiled version *and* 
the source at "http://www.brigadoon.com/~semprini/3dmx". If you are 
having trouble reaching that site, e-mail me and I will send you a 
copy via e-mail.

    Thank you for your interest and criticisms. They have been 
helpful.

--Dylan






From smith at securecomputing.com  Tue Oct 14 14:21:13 1997
From: smith at securecomputing.com (Rick Smith)
Date: Wed, 15 Oct 1997 05:21:13 +0800
Subject: proposal: commercial data recovery
In-Reply-To: <199710140937.KAA01187@server.test.net>
Message-ID: 



It should be clear by now that privacy is not the only security objective
sought by customers of information security products, nor even by all
customers of crypto products. Practical users rarely pursue privacy at all
costs, nor do they pursue accountability and traffic visibility at all
costs. Many must find a balance between two fundamentally conflicting goals.

Regarding the practical uses of e-mail key disclosure, let me include one
from the guard/firewall world that I haven't seen mentioned yet:

We've been shipping products since 1994 that scan the contents of e-mail
messages and reject contents that violate specified filtering criteria.
Sites use it to block importation of viruses or other inappropriate
attachments, and to block the export of improperly released information.
Most of these systems have been sold to the government and use the Message
Security Protocol to encrypt data. The system rejects messages that don't
contain an extra key so that the firewall can scan message contents.

This violates the assumed requirement that the contents of an e-mail
message must not be viewed by anyone except the message's author and
recipient.

However, it's a security trade-off that some organizations want to make for
certain applications.

PGP's key recovery protocol isn't the perfect solution, but it would help
resolve a big problem. To send mail through these systems, the users must
be trained to include the firewalls as message recipients -- this produces
a copy of the symmetric key encrypted with the firewalls' individual PKs.
If a user forgets, then the message can not pass through. The PGP approach
of warning or demanding another PK token would help solve that problem at
least in simple cases.

ObPolitics: Personally, I think it's too soon to tell if PGP's
implementation would benefit the FBI in its pursuit of wiretapping keys. At
most it might resolve whether such mechanisms are in fact a practical
technology. I'm not yet convinced.

Also, if commercial sites have already co-opted PGP's recovery key for
their own uses, it's not clear that the FBI will be able to use it for
clandestine investigations. If they approach the site's IS managers to
acquire copies of the firewall keys, there's a good chance a rumor will get
back to the people being targeted for surveillance. Also, I believe the
overhead for separate eavesdropping keys would produce too clear a sign to
everyone that the FBI is listening. There is no precendent for such a thing
and even if it's adopted temporarily I doubt it will persist. People will
notice, it it will make them mad -- it will show them that the FBI is
indeed under everyones' bed. Even the FBI can't stand up against broadly
based grassroots pressure. Of course, I've been wrong before about politics.

Rick.
smith at securecomputing.com           Secure Computing Corporation
"Internet Cryptography" now in bookstores http://www.visi.com/crypto/







From japhy at enteract.com  Tue Oct 14 14:36:26 1997
From: japhy at enteract.com (Japhy Ryder)
Date: Wed, 15 Oct 1997 05:36:26 +0800
Subject: CDL is here!! (fwd)
Message-ID: <199710142105.QAA08646@enteract.com>



----- Forwarded message from mega at cash-site.com -----

>From mega at cash-site.com Tue Oct 14 13:49:23 1997
From: mega at cash-site.com
Message-Id: <199710141849.NAA10744 at enteract.com>
Date: Tue, 14 Oct 1997 14:46:05 -0400
X-Sender: mega at cash-site.com
To: mega at cash-site.com
Subject: CDL is here!!

CDL - the "first" true software that will "change your life"

Commissions paid direct from the field DIRECT to YOU!!!

No more worries about receiving checks - YOU get paid
first!

The FIRST company to tap into the $200 billion dollar software 
industry as a "home business"

Packed with software...loaded with value...$200+ CD packed 
full of software included!


There's only ONE WAY to find out more - go download the 
software for FREE.....install it and look at it - it will blow your mind!!

(backed by major corporations)  

Download your FREE copy today at:

http://www.makecash.net/cdl

A great way to "make some extra cash"

Explosive Opportunity to get in FIRST!!

REMEMBER - this is the FIRST in a multi-billion dollar field..are
you going to watch us or join us!!

We have full support:

conference calls daily

toll free sizzle line

fax-on-demand

FREE webpages

WOW!!!

FREE Download!    http://www.makecash.net/cdl

///////////////////////////////////////////////////////////////////////////////
This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply 
with the subject "Remove" and this software will automatically block you 
from their future mailings.
////////////////////////////////////////////////////////////////////////////////


----- End of forwarded message from mega at cash-site.com -----






From japhy at enteract.com  Tue Oct 14 14:36:39 1997
From: japhy at enteract.com (Japhy Ryder)
Date: Wed, 15 Oct 1997 05:36:39 +0800
Subject: Hi from the Girls...... (fwd)
Message-ID: <199710142106.QAA08859@enteract.com>



----- Forwarded message from 36568300 at 18565.com -----

>From 36568300 at 18565.com Mon Oct 13 20:04:20 1997
From: 36568300 at 18565.com
Date: Mon, 13 Oct 97 15:26:38 EST
To: mailmaster at fish.net
Subject: Hi from the Girls......
Message-Id: <6730057729034.43209 at fish.net>
Reply-To: mailmaster at fish.net
X-Pmflags: 340788480
X-Uidl: 1834e532395abb83946c924b47abc32f
Comments: Authenticated sender is 


BEWARE!!! WARNING!!! NOTICE!!!
This is an adult site.  You must be 18 to enter.   If you are offended by
subjects of sexual nature PLEASE DO NOT ENETER!!!!

In the event you enjoy sex you must join us for the youngest, hotest live sex
on the net.  You hear us, see us, and direct our every move. To  join us now
just click on the higlighted text below:


      http://youngnlusty.com


Love, 

The girls at Young N Lusty


----- End of forwarded message from 36568300 at 18565.com -----






From japhy at enteract.com  Tue Oct 14 14:42:13 1997
From: japhy at enteract.com (Japhy Ryder)
Date: Wed, 15 Oct 1997 05:42:13 +0800
Subject: Cyber Promotions Selling Off Its Own Mailing List (fwd)
Message-ID: <199710142106.QAA08791@enteract.com>



----- Forwarded message from cyberout at pleaseread.com -----

>From undeliver at pleaseread.com Mon Oct 13 20:24:07 1997
Message-Id: <199710140123.UAA09407 at enteract.com>
Date: Mon, 13 Oct 1997 21:07:02 -0400 (EDT)
X-1: NEW! Click on http://www.cyberpromo.com for FREE AUTORESPONDERS!
X-2: This server blocks unauthorized email relaying.
X-3: Link To Anti-Relay Code
X-4: THIS MAIL WAS SENT THROUGH IEMMC'S NEW REMOVE FILTRATION SYSTEM!
X-Advertisement: Visit http://www.iemmc.org for name removal information.
From: cyberout at pleaseread.com
To: fulldatabase at pleaseread.com
Organization: Cyber Sender 7.0
Subject: Cyber Promotions Selling Off Its Own Mailing List


 ANNOUNCEMENT: Cyber Promotions is SELLING OFF ITS OWN MAILING LIST!
 
 For the first time, you can own Cyber Promotions proprietary list of 2.9 million
 email addresses.  This is the same list to which Cyber has sent its e-Mags and
 exclusives.  This list has never been sold before!  You can take advantage of
 Cyber Promotions hard work since 1994.  Cyber has painstakingly collected these
 email addresses from the following sources...
 
 * Online classified advertisements
 * Subscribe requests
 * Autoresponder requests
 * FreeResponder owners
 * FreeRelay recipients
 * Online business-related profiles
 * Web visitors
 * Internic records
 * Web mall advertisers
 * ... and much more!
 
 Since many of the people in this database have been on this exclusive list for
 over 6 months, they have had many opportunities to unsubscribe.  This list only
 includes people who have not requested removal.  Very few of these email
 addresses are available from other sources.  You can use this list over and
 over again.  You stand to make big money if you market your product, service
 or opportunity to this database.
 
 Regular price will be $2995 -- ONE WEEK SPECIAL only $995 -- (SAVE $2000)
 
 YOU CAN BE ONE OF THE VERY FIRST PEOPLE TO BENEFIT
 FROM THE BEST MONEY-MAKING EMAIL LIST EVER!
 
 So, don't wait.  Order this list today before your competitors get to it first!
 
 This list is available on CD-ROM.  You can receive it via 2nd day Airborne
 Express.
 
 Call Cyber Promotions at (215) 628-9780 between 10am and 7pm
 Eastern, and ask for Brian or Alan.  Dont delay!  This is the list you've been
 looking for.
 
 48 hour special:  Order within 48 hours and receive free limited versions of
 Stealth Bomber (send 50,000 emails an hour from your local dialup account and
 cloak your account id) and List-X (collect your own email addresses). Call NOW!
 
 
 
 (For list removal, hit reply and type "remove")
 
 


----- End of forwarded message from cyberout at pleaseread.com -----






From japhy at enteract.com  Tue Oct 14 14:43:14 1997
From: japhy at enteract.com (Japhy Ryder)
Date: Wed, 15 Oct 1997 05:43:14 +0800
Subject: FREE HOME BUSINESS KIT WITH OVER $600 IN FREE SOFTWARE!! (fwd)
Message-ID: <199710142105.QAA08711@enteract.com>



----- Forwarded message from netbiz at mail2.c-flash.net -----

>From netbiz at mail2.c-flash.net Mon Oct 13 23:00:35 1997
From: netbiz at mail2.c-flash.net
Message-Id: <199710140400.XAA11339 at enteract.com>
Date: Mon, 13 Oct 1997 22:57:49 PDT
Date: Mon, 13 Oct 1997 22:57:49 PDT
Subject: FREE HOME BUSINESS KIT WITH OVER $600 IN FREE SOFTWARE!!
X-Mailer: Emailer Platinum (tm) by Internet Marketing Inc.

////////////////////////////////////////////////////////
Realizing that many of you do not wish to receive UCE,
if you would please type REMOVE in the Subject Header, 
your name will be REMOVED permanently from our mailing lists.
All addresses being sent to now have be cleaned through our 
REMOVE System. By typing REMOVE in the header, you will no longer
receive mail from this address!! Thank You!
/////////////////////////////////////////////////////////

This is a 100% FREE OFFER to get your own FREE HOME BUSINESS KIT. 

This is NOT a Scam, Nor a Pyramid Scheme, but is however a Legal Legitimate 
Network Marketing Business!!!  

This Business is a FULLY licensed Telecommunications Company
operating with licenses in all 50 states.  There are absolutely 
NO PURCHASE REQUIREMENTS to join our company.

SORRY...THIS OFFER IS FOR US RESIDENTS ONLY!!!!

THE FREE HOME BUSINESS KIT INCLUDES:

1)    FREEDOM Bulk Emailer worth $400.00
2)    CHECKR SOFTWARE, worth $200.00 allows you
       to accept checks over fax,phone, or email.
3)    Over 30 Million Email Addresses
4)    FREE PERSONALIZED WEB SITE
5)    Premade Marketing Letters and Templetes
6)    Over 1600 FREE Sites To Advertise Your Business
7)    Personalized Guidance and Direction
8)    Over 50% Savings on Long Distance Bills at only 9.9 cpm
9)    Over 90% Savings on Calling Cards, with NO SURCHARGE!
10)  800/888 Personal or Business Phone Lines
       at 9.9cpm for only $1.50/month!!
11)  Huge Income Potential!!
12)  Monthly Residual Income!!
13)  Plus Much, Much More!!

 BEFORE YOU READ ANY FURTHER, YOU NEED TO KNOW THAT THE 
 FOLLOWING BUSINESS OPPORTUNITY WILL COST YOU 
 ABSOLUTELY NOTHING! 
 IT'S 100% FREE!!!!!

Do You Know 3 People That Use Long Distance?
Dumb Question Huh?

If you GAVE those 3 people a FREE Business Kit including all the Necessary
Software, Do You Think They Might Know 3 People Who Use Long Distance?

What if You Told Them They Could:
Save on every Long Distance Call! (24 Hours a Day!) 
Long Distance Rates as low as 9.9 cents per minute>
AT&T, MCI, and Sprint can't touch this!

800/888 for your home!
Avoid calling home collect! Perfect for kids away at college 
or even use it to check your messages. Your cost for this is the same
9.9 cents per minute!
AT&T charges a $10.00 monthly service fee for this feature.
It's ONLY $1.50 per month with us!

No-Surcharge Calling Card!
Save almost 90% with rates as low as 19 cents a minute!
(MCI, Sprint, and AT&T charge 80 cents minimum surcharge per call.) 
Pick your own card number and PIN for convenience. 

One More Thing . . . Don't confuse THIS with phone "clubs" who charge
a monthly fee ($10-$50) for the "rights" to get a discount. 
Remember, you don't have to join anything to receive any of these
great communication services, like long distance, paging and calling cards! 

Introducing The Easiest, Most Profitable, and Fun Way to Not Only Save Money,
but to Work Part Time at Home and Get Paid!!!

Lets' Take a Look at the Realistic Income You Can Generate By Just Telling 3
People!!

You Tell 3 People about this offer = 3 people
Those 3 Tell 3 People about this = 9 people
Those 9 Tell 3 People about this = 27 people
Those 25 Tell 3 People about this=81 people
Those 81 Tell 3 People about this=243 people
Those 243 Tell 3 People about this=729 people
Those 729 Tell 3 People about this=2187 people
Those 2187 Tell 3 People about this=6561 people

Now add up all 8 levels of people to get = 9,840 people

YOU KNOW HAVE 9,840 PEOPLE ON YOUR SUCCESS TEAM

Now The Fun Part!!

We know just by human nature that people could spend an average of $25.00 per
month on Long Distance. Some people spend 10 times that, and others may not
spend any. For all practical purposes, lets say all 9,840 people spent only
$25.00 per month on Long Distance.

9,840 people x $25.00/month = $246,000/month on Long Distance!!

HERE'S WHERE YOUR REWARD COMES IN!!

Because You Told 3 People and got the ball rolling you are now paid 2%
commission on the total monthly phone bill in your team.

That's $246,000 Dollars X 2% Commissions

= $4,920.00/per month in your pocket!!!

WOULD THAT HELP INCREASE YOUR LIFESTYLE A BIT? 

YOU KNOW IT WOULD!! 

BUT TELLING 3 PEOPLE IS VERY CONSERVATIVE!!

What would your income be if you told 5 people?

I can't tell you, because you wouldn't beleive me!!

So is this for real, or am I just blowing smoke?

You Bet It's For Real!! People using Long Distance Is as natural as the air
we breath, and the food we eat. This can, and will happen if you do your
part!!

What is your part?

1.You need to Tell 3, Tell 4, Tell 5, etc. and spread around your ID#, 
mine is #AH603800

2.You need to work with your downline to make sure that they Tell 3, Tell 4,
Tell 5, etc.

3.You need to stay in touch and teach them how to do what you just did!!


My favorite saying is 

"Give a Man a Fish, and Feed Him For a Day!
Teach a Man to Fish, and Feed Him For Life!"

�
So What Do You Need to Get Started?

You Need to Contact Me For More Detailed Information including the 
Toll Free Sign Up Number and Web Site...You can contact me
at netbiz at mail2.c-flash.net and type "MORE INFO" in the subject header,
or leave a message for me at 414-669-3722, and make sure
you leave your email address and phone number. 

After you sign up FREE, send me an email at netbiz at mail2.c-flash.net,
be sure to include your name, address, telephone number, 
email address, and your new ID# they will assign you, and  I
will rush out your FREE BUSINESS AND MARKETNG KIT, including
FREEDOM BULK MAIL SOFTWARE, and CHECKR, check by fax
or phone software. Plus Your FREE MARKETING START UP KIT!!!




















----- End of forwarded message from netbiz at mail2.c-flash.net -----






From omegam at COMMUNIQUE.NET  Tue Oct 14 15:51:33 1997
From: omegam at COMMUNIQUE.NET (Omegaman)
Date: Wed, 15 Oct 1997 06:51:33 +0800
Subject: PGP CAKware & IETF controlled Open-PGP standard
In-Reply-To: 
Message-ID: <199710142232.RAA21399@sakaki.communique.net>



Adam Back writes:
 > Jonathan Seybold  writes:
 > > Adam, one aspect of your suggestion puzzles me:
 > > 	One thing which concerns me most is KNOWING when a message I send
 > > (or receive) could be read by someone else. The PGP CMR scheme makes this
 > > very clear: if there is an extra CMR key, the message may be read by
 > > whomever controls that key, if not, only the recipient may decrypt the
 > > message.
 > > 	If, however, the message is secretly re-encrypted to a corporate
 > > storage key AFTER it is received, I will never know that.
 > 
 > You will if you mark the key with this information.

This is a straw man anyway.  You don't know this now.  Someone you are
communicating with could already be forwarding plaintext to a third
party unbeknownst to the sender.  

This is a "do you trust the recipient" issue.

 > What I _am_ arguing is that in designing systems to provide companies
 > with data recovery mechanisms that you should a) not weaken security
 > more than necessary, and b) that it would be nice if you used a method
 > which doesn't introduce GAK compliancy for communications keys.
 > 
 > I presented I think in plenty of detail an alternate mechanism which
 > is both non-GAK compliant, and more secure.  So what is the problem?
 > Is there a technical flaw in my solution?

No.  But there is in their's(PGP Inc.) as I think you and others have
amply demonstrated.  The technical issues alone are enough to reject
usage of PGP5.5's CMR features.

It intrigues me that there has been virtual silence from PGP employees
on the technical issues.  Only Hal Finney via the IETF-Open-PGP has come
anywhere near commenting upon this.  I haven't seen anyone from PGP
Inc. comment on your data-recovery implementation ideas.  

In my optimistic moments, I take this as a sign that internally, PGP
inc. is giving consideration to producting more sensible and effective
solutions.  (Maybe even as outlined here)

 > > 	This means, I believe, that they should NEVER INVOLVE HIDDEN BACK
 > > DOORS THAT USERS ARE NOT AWARE OF.
 > 
 > Agreed.  You can flag backdoors with either solution.

See above.  The prescence of flags does not prevent this.  By
definition I might add ;).  Trust issues, etc. are involved.

 > It works well enough, but it could be made much more secure, by
 > separating storage key functionality from transient message key
 > functionality.  This would also give you the chance to resolve the
 > articificially created need for GAK compliancy, which arises because
 > you are being forced by this lack of distinction between key
 > functionalities to use one key for both long term storage and what
 > should be transient communications key usage.

Hal Finney's description of key sttributes indicate that implementing
separate storage keys would not be hard for PGP Inc to implement in
the next release.  

 > Decentralised control is good, of course, but the pgp5.5 and SMTP
 > policy enforcer is a ready to roll GAK system.  

Of course, other companies could have (and will) implement similar
systems.  That PGP, with it's reputation and stated policies, would is
surprising.  

Hopefully, PGP will live up to their reputation by realizing this
misstep and correcting it with a more secure, less GAK-compliant
implementation. 
 
 > The PGP bashing PGP observes is an attempt by the pro-privacy crypto
 > community to influence PGP to re-think the GAK compliancy, and to
 > point out the more secure way to implement corporate recovery of
 > stored email messages without GAK compliancy.
 > 
 > I reserve the right to bash any company which attempts to field GAK
 > compliant software.

The "bashing" in this notoriously harsh forum has been rather tender
in my view.

Perhaps the perception of "bashing" is based on recognition (and
guilt) that the CMR mechanism is flawed and goes against "the spirit
of PGP."  Methinks, y'all doth protest too much.
 
-- 
---------------------------------------------------------------------
Omegaman |"When they kick out your front door,
   PGP Key fingerprint =        | How are you gonna come? 
   6D 31 C3 00 77 8C D1 C2      | With your hands upon your head,   
   59 0A 01 E3 AF 81 94 63      | Or on the trigger of your gun?" 
Send email with "get key" as the| -- The Clash, "Guns of Brixton"
"Subject:"to get my public key  |   _London_Calling_ , 1980
---------------------------------------------------------------------






From aba at dcs.ex.ac.uk  Tue Oct 14 15:58:44 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Wed, 15 Oct 1997 06:58:44 +0800
Subject: proposal: commercial data recovery
In-Reply-To: 
Message-ID: <199710142242.XAA08180@server.test.net>




Rick Smith 
> Regarding the practical uses of e-mail key disclosure, let me include one
> from the guard/firewall world that I haven't seen mentioned yet:
> 
> We've been shipping products since 1994 that scan the contents of e-mail
> messages and reject contents that violate specified filtering criteria.
> Sites use it to block importation of viruses or other inappropriate
> attachments, and to block the export of improperly released information.
> Most of these systems have been sold to the government and use the Message
> Security Protocol to encrypt data. The system rejects messages that don't
> contain an extra key so that the firewall can scan message contents.

I'm not sure whether pgp5.5 has this ability to screen messages prior
to reading, and also not sure whether it has the ability to snoop
messages prior to sending built in.

The basis is there for the functionality in the enforced second
recipient, but I'm not sure whether the client, or SNMP management
tools, or SMTP policy enforcer implement this functionality.

I'd welcome clarification from PGP Inc., employees, or anyone in the
US has tried the pgp5.5 software for business suite.

> This violates the assumed requirement that the contents of an e-mail
> message must not be viewed by anyone except the message's author and
> recipient.

It does yes.  And that demonstrates that the principle is achieving
it's function in high-lighting areas of a design which could be used
for GAK purposes.

> However, it's a security trade-off that some organizations want to
> make for certain applications.

Absolutely.  You should try hard though to see if there are any
software hacks or protocol reorganisations you can do to make the
system unusable for GAK, or as close to unusable as you can.

> PGP's key recovery protocol isn't the perfect solution, but it would help
> resolve a big problem.

Where that problem is can messages be screen by processes?  One
solution if you restrict yourself to processes is to move the function
to the client and scan after decrypt.  This isn't as easy to integrate
into existing MUAs but would be possible for fresh re-writes like
pgp5.x clients.

If you want ability for humans to scan messages manually as well, and
you can't live with the modifications in the client, you can do this
within the CDR design principles:

Have all email received by the company encrypted to the companies
public key.  Have your virus filter/human screener check the email,
and then pass on to user in clear, or pass on to user encrypted with
users key.

Actually this is more secure than your solution, because the client
already has an in memory master key; and now you have one crypto
recipient rather than two to blow your security for you by allowing
inadvertent key compromise.

For outgoing email, configure the mail client plugin to either send in
plain-text, or to sign only (one hopes with non escrowed signature
keys, else your MIL friends will be able to forge each others mail),
or to encrypt to the outgoing filtering agent, and have the outbound
mail hub filter, or forward to human screener content checking.

CDR compliant.  Has some extra resistance to GAK corruption.

As an additional application of CDR anti-GAK principles you could do
the small software hack of allowing the clients and/or mail filtering
agents to only communicate with each other if the machine IP addresses
look like they are on the same mail hub.

Don't provide source.  (I suspect your company doesn't anyway for this
kind of app, or do MIL people like to inspect source?)

So now your system has a number of extra protections against being
used for GAK.  They are not perfect, but you've done what you can, and
it's a definate improvement over what you had before.


However I'm not sure it matters for your application really whether it
is GAK compliant or not.  This is because your application sounds like
it is mainly for defense contractors, and MIL or NSA type use.  As far
as I'm concerned that lot deserve GAK.  Keep themselves honest :-)

> To send mail through these systems, the users must be trained to
> include the firewalls as message recipients -- this produces a copy
> of the symmetric key encrypted with the firewalls' individual PKs.
> If a user forgets, then the message can not pass through. The PGP
> approach of warning or demanding another PK token would help solve
> that problem at least in simple cases.

You can acheive the same functionality by insisting on mail being
encrypted for the firewall.  Firewall can re-encrypt for intended
user.

> ObPolitics: Personally, I think it's too soon to tell if PGP's
> implementation would benefit the FBI in its pursuit of wiretapping keys. At
> most it might resolve whether such mechanisms are in fact a practical
> technology. I'm not yet convinced.

I think you have a point there and that it's not entirely clear how
this would work out.

> Also, if commercial sites have already co-opted PGP's recovery key for
> their own uses, it's not clear that the FBI will be able to use it for
> clandestine investigations. If they approach the site's IS managers to
> acquire copies of the firewall keys, there's a good chance a rumor will get
> back to the people being targeted for surveillance. 

I don't think that's the way it will work.  What they'll do is require
SEC cleared companies to provide this key as a matter of law to the
government.  If cheating is detected the bosses will get prison terms.
Then they'll slowly spread it from SEC cleared firms to other
companies.  Maybe Public companies.  Then they'll create a reichstag
fire FBI constructed publicity type cases; perhaps money laundering,
or purported mafia front business as an example of a public threat
from allowing companies to communicate without escrow.  Individuals
too, some terrorist cases, a few more large scale bombings.  No
problem.

If PGP provided facility for multiple enforced extra crypto
recipients, it would be even more GAK compliant, as companies could
just put a NSA key into the recipient box.


The CDR design principles also apply to standards.  Standards are very
powerful things.  If OpenPGP requires capability to understand and
encode to second crypto recipients which are not message recipients
for conformancy, we are in trouble also because all clients will then
be required to make GAK easier to enforce; the capability is right
there in pgp5.0 and pgp5.5 now.

If on the other hand the OpenPGP standard does not include the second
non message recipient crypto recipient feature, then companies who do
chose to do so must build up their own client base outside of the
installed client base, because they won't be able to build
GAK and have interoperability at the same time.

(We'll see whether or not PGP argue for this feature to go in the
standard in a bit, when the draft standard is released, and
discussions commence).

Also remember that another danger with GAK software is that your
country might be too liberal for the government to get away with
various things, but others aren't.

We don't want to encourage civil rights abuses.  In some countries
saying non-government approved thoughts results in prison terms,
torture, and painful death.

> Also, I believe the overhead for separate eavesdropping keys would
> produce too clear a sign to everyone that the FBI is
> listening. There is no precendent for such a thing and even if it's
> adopted temporarily I doubt it will persist. People will notice, it
> it will make them mad -- it will show them that the FBI is indeed
> under everyones' bed. Even the FBI can't stand up against broadly
> based grassroots pressure. Of course, I've been wrong before about
> politics.

Well I hope you're right of course, but I feel PGP could do more to
prevent the scenario I present above, which I feel is fairly
realistic.

I also hope I have provided some worked examples of the logic in
applying the CDR design principles.

(They are counter-intuitive sorts of principles to work with because
they are all negatives: don't do this, don't do that, no
recommendations as such on what _to do_.  This is because what you do
is explore the solution space outside of the restriction they apply on
it.  They are also strange in that it is unusual to see formally
codified cryptographic property design principles which reflect
entirely a political issue.  Must me a first :-)

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: 




I have an even simpler solution to the problem of how the OpenPGP committee
should solve the key recovery/message recovery/corporate/GAK problem: Don't.

Just decide and announce that neither plaintext nor key recovery will be
part of the OpenPGP spec. This is a cleaner and simpler approach, and the
functions of encryption are placed front and center.

(Let some other task force deal with building some kind of "OpenGAK" or
"OpenSnoopware" program!)

That is, OpenPGP need only worry about providing a robust, secure, etc.,
open standard for end-to-end encyption (communication) and local encryption
(storage). Don't try to solve the "disaster planning" problem ("Alice hit
by a truck") by building snoopware/escrow into the core cryptosystem, and
don't try to solve the snoopware ("What is Alice saying to Bob?") desires
of companies either.

For comparison, we certainly don't see the world's telecommunications
bodies, committees, and companies working on a "conversation recovery" mode
to make the job of enforcing the U.S. Digital Telephony and similar
wiretapping desires.

Dealing primarily with communication and file security is what PGP has
historically focussed on, in all versions from 1.0 to 5.0 (not counting the
anomaly of ViaCrypt). Sounds fine to me. The "mission" of PGP and other
public key cryptosystems (until now) has been to secure communications and
files, not to provide mechanisms for corporations to monitor
communications. (Disaster planning, for "what if Alice gets hit by a
truck?" scenarios, are of course handled by having Alice lock up her
private keys in her safe, or perhaps her department manager's safe,
whatever. This is a dangerous security flaw, if the key is released, but
has the advantage that it's a fairly conventional recovery approach, and is
not built into the cryptosystem itself. Trying to solve this problem, that
of "backup keys" or "spare keys" floating around, is not easy in any
case...OpenPGP would do well to just avoid the issue and let conventional
disaster planning measures deal with the problem.)

If corporations, agencies, governments, etc., want to have access to
Alice's files, to Alice's communications to Bob, this is really a file
managment and archiving strategy problem, not something OpenPGP has to
concern itself with.

Keep it Simple, Stupid. KISS. Often the simplest approach to dealing with
complex specifications and conflicting desires is to just ignore them.

Let Big Brother and Little Brother try to get snoopware deployed when
OpenPGP is widely available.

Whether PGP, Inc. will go along with this is unlikely, but this doesn't
change the reasons for keeping OpenPGP true to the original aims of PGP.

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From vipul at best.com  Tue Oct 14 16:26:58 1997
From: vipul at best.com (Vipul Ved Prakash)
Date: Wed, 15 Oct 1997 07:26:58 +0800
Subject: GOST
In-Reply-To: <3.0.3.32.19971013233228.006e7940@popd.ix.netcom.com>
Message-ID: <199710150254.CAA00671@fountainhead.net>



Bill Stewart wrote:

> S-box structure is one of the critical issues in designing
> Feistel-type networks; if you understand the mathematics
> very very well, you can do it yourself, and if you don't,
> then you don't understand it well enough to be sure
> the S-boxes are secure enough, and thus you shouldn't
> be selling it to customers.

Thanks, I shall look up Feistel-type networks. Nope, I don't 
understand the mathematics very very well, and that's why I 
asked. While I haven't seen the official GOST specs but all 
the reference I could find indicates that GOST specs don't 
discuss the process of generating SBOX permutations and GOST 
sboxes are not mathematically understood. 

Regarding the developer's ethical responsibilities with experimental 
technology I rather have the consumer decide (and of course 
document the limitations).

Thanks, 
Vipul 

-- 
Powell lingered. "How's Earth?" 
It was a conventional enough question and Muller gave the 
conventional answer, "Still spinning."
				      -- "Reason", Asimov. 
==================================================================
Vipul Ved Prakash                 | - Electronic Security & Crypto 
vipul at best.com 	                  | - Web Objects 
91 11 2233328                     | - PERL Development 
198 Madhuban IP Extension         | - Linux & Open Systems 
Delhi, INDIA 110 092              | - Networked Virtual Spaces






From schneier at counterpane.com  Tue Oct 14 16:28:56 1997
From: schneier at counterpane.com (Bruce Schneier)
Date: Wed, 15 Oct 1997 07:28:56 +0800
Subject: Encyrption Program
In-Reply-To: <199710141958.MAA22050@k2.brigadoon.com>
Message-ID: 



At 3:58 PM -0500 10/14/97, semprini at theschool.com wrote:
>This is in response to the several posts regarding the assumed
>weakness in the program I wrote:
>
>    While it is true that PRNG's are not very good, because of the
>inherent lattice structure, I believe I found a way around that
>problem. To work around the lattice problem, I used a systm of cubic
>arrays. The program first creates sixteen cubic arrays, and fills
>them one space at a time with random characters. When the stream of
>characters to be XORed with the plaintext is generated, it picks a
>random cube and a random location with that cube. The resulting
>"random" character is then XORed with the appropriate character of
>the plaintext. If someone can prove to me that this method is stupid
>or easily breakable, I would actually be happy. So, those of you bent
>on proving that I'm wrong, I heartily encourage you to do so. As I
>mentioned before, you can download both the compiled version *and*
>the source at "http://www.brigadoon.com/~semprini/3dmx". If you are
>having trouble reaching that site, e-mail me and I will send you a
>copy via e-mail.

Good luck, but be aware that you won't get much free analysis.  In
general, algorithms that aren't published don't get looked at very
carefully (mostly because there's no real upside in doing so--at least
if the algorithm is published you can get a paper out of a break).

You might have more luck if you posted the algorthm (not in source
code, but in a mathematical description) along with a comprehensive
analysis of its security against existing attacks.  (There is a lot
of published research on the analysis of stream ciphers, although the
field is much less well-studied than block cipher analysis.)  Good
security arguments, proofs even, will make more people interested.

Cheers,
Bruce

**********************************************************************
Bruce Schneier, President, Counterpane Systems     Phone: 612-823-1098
101 E Minnehaha Parkway, Minneapolis,MN  55419       Fax: 612-823-1590
                                            http://www.counterpane.com







From bgrosman at sydney.healey.com.au  Tue Oct 14 16:29:50 1997
From: bgrosman at sydney.healey.com.au (Benjamin Grosman)
Date: Wed, 15 Oct 1997 07:29:50 +0800
Subject: Encyrption Program
In-Reply-To: <199710141958.MAA22050@k2.brigadoon.com>
Message-ID: 



> random cube and a random location with that cube. The resulting 
> "random" character is then XORed with the appropriate character of 
> the plaintext. If someone can prove to me that this method is stupid 

The way I understand this is that only one character is chosen and this
same character is XORed with all plaintext for that session. Therefore,
given that there are 8 bits in an unsigned char (which I am assuming you
are using based on your choice of the word "character"), meaning that 
there are only 2^8 (256) possible 8 bit characters, hence only 256
different possible outcomes. Such a short keyspace is linearly searchable
in a very small amount of time, making the encryption scheme particularly
weak.

If I am writing this based on a false understanding of your scheme, would
you mind clarifying exactly the points in which I am in error, so that I
might analyse with that information taken into account.

Yours Sincerely,

Benjamin Grosman







From gnu at toad.com  Tue Oct 14 17:06:52 1997
From: gnu at toad.com (John Gilmore)
Date: Wed, 15 Oct 1997 08:06:52 +0800
Subject: New Mailing List:  Terrorism
Message-ID: <199710142348.QAA18574@toad.com>



Sounds like some "civil rights oriented" EMS, fire, law enforcement,
intelligence community, etc people should join, and let the rest of us
know what they are doing...

	John

From: churton.budd at mediccom.org (Churton Budd)
Date: Sat, 11 Oct 1997 10:55:40 GMT

TERRORISM
---------
TERRORISM is intended for discussion about terrorism response and
prevention, including intelligence gathering and emergency responses.
Topics include weapons of mass destruction, suspicious activities,
educational and funding opportunities, politics, and response ideas.
TERRORISM is an open forum to EMS, fire, law enforcement, intelligence
community, disaster preparedness & response, and military personnel with
an interest in preventing and responding to terrorist incidents.  
Announcements about new educational opportunities and grants are
welcome, as are new products, services, or technologies directly related
to terrorism response. 
Listname: terrorism
Post to: terrorism at mediccom.org
subscription command:  subscribe terrorism
                       sent to:  listserv at mediccom.org






From bromage at cs.mu.oz.au  Tue Oct 14 17:09:04 1997
From: bromage at cs.mu.oz.au (Andrew Bromage)
Date: Wed, 15 Oct 1997 08:09:04 +0800
Subject: commercial data recovery
In-Reply-To: <199710141053.MAA03610@xs1.xs4all.nl>
Message-ID: <199710142358.JAA02842@mundook.cs.mu.OZ.AU>



-----BEGIN PGP SIGNED MESSAGE-----

G'day all.

Zooko Journeyman wrote:

> I wonder if it is too much early-days to start talking about
> advanced protocols e.g. secret-splitting in IETF-Open-PGP?  

One list member has encouraged me to write an internet-draft for a key
quorum system, so I am.  The trouble is that my proposed implementation
needs some info that isn't in the current IETF draft (the format of the
"string to key" object).

Is it actually documented anywhere that we can access?

Cheers,
Andrew Bromage

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBNEQHMBF7J5ORR6ohAQEtJQP/XlunlxxrKDwh0zlTBiWeURSvUbo3Lvup
vp+Ex9gyraWuX+eaIoioQw+iQ7uLlWxeCRPVlVrpsnYG4YJF7vO1QKVxHuTZEbXj
wUZyS8WXv+3TRjakCfKf2nNP6lDgYs2W67eZhmYzuwC/2uNn078DbAWg8TLcy1ji
GvKEy0n4pLI=
=4Ypn
-----END PGP SIGNATURE-----






From shamrock at cypherpunks.to  Tue Oct 14 17:13:13 1997
From: shamrock at cypherpunks.to (Lucky Green)
Date: Wed, 15 Oct 1997 08:13:13 +0800
Subject: Just say "No" to key recovery concerns...keep OpenPGP pure
In-Reply-To: 
Message-ID: 



On Tue, 14 Oct 1997, Tim May wrote:
> (Disaster planning, for "what if Alice gets hit by a
> truck?" scenarios, are of course handled by having Alice lock up her
> private keys in her safe, or perhaps her department manager's safe,
> whatever. This is a dangerous security flaw, if the key is released, but
> has the advantage that it's a fairly conventional recovery approach, and is
> not built into the cryptosystem itself.

Tim,
The system above you are proposing is [C,G]AK, plain and simple. This is
what some companies are doing already. And it is a Bad Thing.

[Sidetrack: which is of course why PGP had to find another solution to
present to those customers already using GAK. IMHO, and I can't help but
be a bit surprised that I find myself in the minority on this
issue, at least as far as the list is concerned. What PGP did was
_elegant_.]

-- Lucky Green  PGP encrypted email preferred.
   "Tonga? Where the hell is Tonga? They have Cypherpunks there?"






From tcmay at got.net  Tue Oct 14 17:20:24 1997
From: tcmay at got.net (Tim May)
Date: Wed, 15 Oct 1997 08:20:24 +0800
Subject: Just say "No" to key recovery concerns...keep OpenPGP pure
In-Reply-To: 
Message-ID: 



At 4:48 PM -0700 10/14/97, Lucky Green wrote:
>On Tue, 14 Oct 1997, Tim May wrote:
>> (Disaster planning, for "what if Alice gets hit by a
>> truck?" scenarios, are of course handled by having Alice lock up her
>> private keys in her safe, or perhaps her department manager's safe,
>> whatever. This is a dangerous security flaw, if the key is released, but
>> has the advantage that it's a fairly conventional recovery approach, and is
>> not built into the cryptosystem itself.
>
>Tim,
>The system above you are proposing is [C,G]AK, plain and simple. This is
>what some companies are doing already. And it is a Bad Thing.

Maybe it's a bad thing, maybe it's not. But at least it isn't built into
the cryptosystem itself. (As noted, building it into the infrastructure is
very dangerous.)

(Personally, I keep a diskette containing a copy of my secret keys, and a
"hint message to myself" reminding me of my passphrases, in a Safe Place
(tm). If I had a lawyer, I might seal an envelope with such a diskette in
it and ask him to hold it for me. And if I had a company, I might insist
that employees using crypto as part of their everyday jobs make similar
arrangements. Such has it always been with crypto, right?)

Building the options into a cryptosystem make it entirely too easy to
government to mandate GMR (Government Message Recovery).

>[Sidetrack: which is of course why PGP had to find another solution to
>present to those customers already using GAK. IMHO, and I can't help but
>be a bit surprised that I find myself in the minority on this
>issue, at least as far as the list is concerned. What PGP did was
>_elegant_.]

No, PGP Inc. did not "have" to do anything. Any more than Schlage Locks has
to develop a strategy for dealing with customers who leave spare keys under
rocks, or with their neighbors, etc. Or that telephone switch companies
have to develop a strategy for delivering phone surveillance products, even
though some companies make it a practice to monitor or snoop on employee
calls.

You are a minority for the reasons Phil Zimmermann, Bruce Schneier, Peter
Trei, and many other people have expressed: what the New PGP Inc. is doing
is not in keeping with the personal privacy goals formerly espoused.

And as Schneier noted yesterday, the support by PGP for "message recovery"
is already being used by Congress as an arguing point that it is indeed
practical and should be made mandatory.

Snooware is snoopware. PGP should stay out of this can of worms.

(I can't resist another possible parallel. It's a fact that some companies
use video surveillance, and microphones, to monitor employees. For drug
use, for theft of produced goods, etc. And this is usually legal, except in
some circumstances (restrooms, break rooms, and so forth).  So, suppose a
CRT maker decided to "meet this need" for employee surveillance by building
a small video camera into each of its "Monitors for Monitors" line of CRTs?
Would you still say that this is _elegant_? Me, I'd harshly criticize the
company making the monitors, not because it is illegal, but because
building in a surveillance state infrastructure is very dangerous and even
immoral.)

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From aba at dcs.ex.ac.uk  Tue Oct 14 17:48:12 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Wed, 15 Oct 1997 08:48:12 +0800
Subject: why Phil Zimmermann should be speaking out against pgp5.5 and CMR
Message-ID: <199710150017.BAA08707@server.test.net>




(Readers may notice PRZ's email address on the Cc line, this is an
open letter addressed to him).

In the debate on the controversial pgp5.5 commerical message recover
(CMR) system, I noticed someone made the comment that they couldn't
see what the big deal is with enforced multiple crypto recipients who
aren't also message recipients, as pgp2.x has had non-enforced
multiple crypto recipients for ages.

I will put the case for why this practice should be avoided for
security reasons.

I would like to also put the case of why the enforced multiple crypto
recipient construct should be avoided in building messaging systems
where the designers would like to avoid building GAK compliant
systems.


The security reasoning is simple: there are is an extra door into the
encrypted data: via the CMR key.  Introducing an extra door reduces
security, because there are now two keys which could be compromised to
gain access to the data.

That was simple.  Possibly not that major a problem, perhaps both keys
are so well secured that the additional leakage is academic.  In that
case, fair enough.


Now the GAK compliant case:

Firstly it is important to understand the subtle but very significant
difference between enforced crypto recipients who aren't message
recipients and normal pgp2.x style multiple crypto recipients.

This difference is as much to do with the way that mail clients and
plugins have used the pgp2.x multiple crypto recipients in fielded
systems as with the actual messaging packet differences.

A message recipient is someone who's email address is listed in a To:
Cc: or Bcc: field in your mail client.

A crypto recipient is someone who will be able to decrypt the message.
Pgp is a hybrid crypto system, a message consists of the email
encrypted with a randomly generated symmetric key, the session key.
The session key is in turn encrypted to the public key of the
recipient, these are called Public Key Encrypted (PKE) packets.  To
implement multiple crypto recipients pgp simply tacks on as many PKE
packets as there are crypto recipients; each PKE packet being the
session key encrypted to the public key of one of the crypto
recipients.


Now in most fielded PGP email plugins, and clients which take notice
of Cc: and Bcc: fields, the number of crypto recipients ties directly
with the number of message recipients.

This makes it difficult therefore for the existing systems to automate
encryption to a third party without software modifications.  If a
company which is hoping to become a market leader (a hint PGP) were to
retain this functionality, GAKkers would find it difficult to use this
software to effectively impose GAK.

Sure you can Cc: your message to the NSA key.  This would be voluntary
GAK.  Carl Ellison and a number of others suggested this whimsically
years back.  As in "What's all the fuss about voluntary key escrow,
I'll implement voluntary key escrow for you right now, get DIRNSA to
generate a key, and I'll sign it, and put it on the keyservers -- end
of problem".  Carl Ellison had a very good point.  The government
doesn't want voluntary key escrow, they want as some suspected all
along mandatory key escrow, they want GAK (the GAK term is
coincidentally another Carl Ellison meme).

The reason this is voluntary GAK is that the user in most mail systems
would have to go to some concious effort to do this, and may forget
some of the time.  (It's difficult to make "forgetting" a 5 year
jailable offense).

Now I'm well aware that some email clients, and MTAs will no doubt
allow you to forward copies of all your email transparently to another
party.  (Please don't flood us with replies describing such
functionality).  But this is not really the point; it doesn't matter
if you can forward copies of your encrypted email
"thoughtpolice at nsa.gov" -- they can't decrypt it with out the
recipients key.


Now we come to the danger of PGP Inc's CMR mechanism.

CMR breaks this traditional premise that the crypto recipients
correspond one-to-one with the message recipients.

What it allows is instructions to be given in a public key that tell
the software to encrypt messages intended for the owner of this key to
two message recipients.

This means that for example:

If Phil Zimmermann is using his own companies pgp5.0 mail client (and
I presume he is), that if the US Government were to pass a law
requiring everyone to generate new CMR keys that he would be able to
comply without changing his software.  This is why I would argue that
even pgp5.0 is GAK compliant, it knows how to understand CMR public
keys.

(I am not actually sure if the pgp5.0 mail client can generate CMR
public keys, but the pgp5.5 one can for sure, I'd welcome
clarification on this point).

The new mandatory GAK law would mean that if he didn't generate a CMR
key he would go to jail.  So he complies.  The terms of the law
dictate that the CMR recipeint in individual's mail clients must be
"thoughtpolice at nsa.gov".

Now the next time one of PRZ's favourite resistance groups that he
likes to tell us stories about send him an email thanking him for the
useful piece of software he provided them with, the USG can listen in
because the pgp5.0 software which the resistance fighters have
presumably also upgraded to will understand PRZ's CMR key.  The USG
will if it suits their purposes sell this information to the
government in the originating country, and they will have the death
squads go kill the resistance fighters if they can determine their
identities from the leaked message.

This kind of makes a mockery of what PRZ and the PGP brand stands for.


Now the pgp 5.5 defenders at PGP Inc will jump up at this point and
tell us that this is not so because pgp 5.0 has ability to strip out
the second enforced recipient.  Well it does.  However, PGP Inc has
come up with another related clever innovation: their SMTP policy
enforcer.

This ensures that when resistance fighters attempt to send PRZ email
inside the PGP Inc offices (where they will be presumably field
testing their GAKware software suite), that if they do take off the
CMR recipient, that their mail will bounce.

So not being technical crypto gurus, they will try not taking it off
next time and the NSA will read the mail again, resulting in the
resitance fighters death.

Or perhaps alternatively if they really did want to send him email for
an important reason, like perhaps to warn him that the corrupt
government they were fighting against was going to introduce a law of
mandating the use of pgp5.5 by all ISPs and individuals, they would
have no way to reach him.  This would suit PRZ quite well, because he
probably wouldn't want to hear that.


Actually it is possibly not fair to pick on PRZ, as I consider it
somewhat likely than PRZ is dragging his feet internally to PGP, but
is powerless to stop the corporate mindset now at the helm.  And if so
I apologise for making points at his expense.  But also it is
important that if PRZ is against this move, that he speak up.  That
act would have major significance in altering PGP Incs mind.

It might also result in a parting of the ways, but I understand from
attenders at a physical cypherpunks meeting in the US that PRZ when
quizzed about PGP Inc corporate mentality meaning the company would
eventually sell out to GAK, relayed that he would quit rather than
have be associated with this.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710151308.HAA03204@mroe.cs.colorado.edu>


Hello!

According to Matthew Patton:
> I've tried varios purmutations of the map rules to no positive effect.
> map ppp0 192.168.1.0/24 -> 206.142.xx.yy/32 portmap tcp/udp 10000:20000
> repeat except substitute   ^^^^^^^^^^^^^ with 0.0.0.0 or ppp0. Neither works.

> I ran tcpdump on ppp0 on the gateway and sure enough, the box is sending
> down the modem link 192.168.1.10 (the particular LAN host trying to
> initiate an outside connection) as the source IP. Now if everything were
> correct shouldn't it be the IP addr of the local end of the PPP link as
> hosted on the gateway box? (ie 206.142.xx.yy)

> ipnat -l has never once shown any indication of active connections.
> Either nat is seriosly not working under stock v2.1 (anyone prove it does
> work?) or there are some undocumented and not exactly obvios dependencies
> with regard to kernel options.

Do you have
  option IPFILTER
and perhaps
  option IPFILTER_LOG
set?

> [...]

> BTW, how come kernal option IPNAT isn't documented ANYWHERE? It's not even
> in the ALL file.

Because it's integrated with the IPFILTER (option IPFILTER).

Besides: ipnat(1), ipnat(4), ipnat(5)...

Regards, Felix.





From rfarmer at HiWAAY.net  Tue Oct 14 18:13:14 1997
From: rfarmer at HiWAAY.net (Randall Farmer)
Date: Wed, 15 Oct 1997 09:13:14 +0800
Subject: Encryption Program
Message-ID: 



Although I don't know the PRNG in Visual Basic (the one 3dmx uses) well enough 
to do much real analysis, the description of an attempt to correct a problem in
it shows a weakness in the "enhanced" version...here's a slightly
abridged/clarified copy of the message I sent the author about it.

-------------------------------------------------------------------------------


...
>     While it is true that PRNG's are not very good,

Well, there isn't any big problem with PRNGs as a class -- RC4 is based on a
PRNG, and it's okay to use as long as you know its limitations (i.e., just so 
you don't try using the same key twice or anything similarly silly).

...  
> I believe I found a way around that problem...I used a syst[e]m of cubic 
> arrays. The program first creates sixteen cubic arrays, and fills them one
> space at a time with random characters. When the stream of characters to be
> XORed with the plaintext is generated, it picks a random cube and a random
> location with[in] that cube. 

I can't do much real analysis since I don't know how Visual Basic's PRNG works,
but with a truly secure PRNG like one you would see in a good stream cipher,
you can't predict x bits of the PRNG's output with more than 1/2^x probability
of bring right without doing exhaustive search of the keyspace.

However, your arrays almost surely won't be filled with the *exact* same
quantity of each character, so, even if the bytes in your PRNG's output are
selected randomly from the arrays, some bytes are more likely to be a byte in
your "enhanced" PRNG's output than others. Therefore, given a bunch of the
stream, one can guess the next 8 bits of the PRNG's output with more than 1/256
probability of being right, meaning your PRNG doesn't fit the bill.

To sum it up, no matter what Visual Basic's PRNG does, that method *can't* be
100% secure. 

...

---------------------------------------------------------------------------
Randall Farmer
    rfarmer at hiwaay.net
    http://hiwaay.net/~rfarmer







From goddesshera at juno.com  Tue Oct 14 18:14:30 1997
From: goddesshera at juno.com (Anonymous Remailer)
Date: Wed, 15 Oct 1997 09:14:30 +0800
Subject: proposal: commercial data recovery
Message-ID: <19971014.182212.13567.28.goddesshera@juno.com>



On Tue, Oct 14, 1997 at 10:37:21AM +0100, Adam Back wrote:
> 
> If we take the design goal of designing a commercial data recovery
> system which is not GAK compliant, we can most succinctly state this
> design goal as the task of ensuring that:

I take a certain sad pleasure in reminding people that among my first
posts on this list I warned that cypherpunks had better design a
commercial key recovery system, or one they didn't like would be
forced down their throats.  Attila now spouts my line exactly, Adam is
busy designing (though he still can't bring himself to use the term
'key recovery', being meme-dominated as he is), and Tim nods
approvingly. 

Good luck, gentlemen -- you should have been doing this a year ago.

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html



This message was automatically remailed. The sender is unknown, unlogged,
and nonreplyable. Send complaints and blocking requests to
.






From aba at dcs.ex.ac.uk  Tue Oct 14 18:57:43 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Wed, 15 Oct 1997 09:57:43 +0800
Subject: Just say "No" to key recovery concerns...keep OpenPGP pure
In-Reply-To: 
Message-ID: <199710150138.CAA09580@server.test.net>




Lucky Green  writes:
> On Tue, 14 Oct 1997, Tim May wrote:
> > (Disaster planning, for "what if Alice gets hit by a
> > truck?" scenarios, are of course handled by having Alice lock up her
> > private keys in her safe, or perhaps her department manager's safe,
> > whatever. This is a dangerous security flaw, if the key is released, but
> > has the advantage that it's a fairly conventional recovery approach, and is
> > not built into the cryptosystem itself.
> 
> Tim,
> The system above you are proposing is [C,G]AK, plain and simple. This is
> what some companies are doing already. And it is a Bad Thing.

It is GAK pervertable, but it is much more resistant to GAK perversion
than PGP Inc's CMR system.  I think Tim can reason pretty well without
cribbing from the anti-GAK principles, but that he could present
marginally more GAK-hostile systems by using the anti-GAK principles.
(Or perhaps he would figure them out anyway but figures them to be too
complex... my only real claim is that by working to these principles
that it helps clarfiy what you are trying to defend against, and
trying to avoid in your systems).

The reason that you are right that what Tim suggests is GAK
pervertable is that it partly violates one of the anti-GAK design
principles I have been trying to hone.

It violates the principle that recovery information should not be
communicated (via sneaker net on a floppy to the company safe).

It does however obey the corollary that: if you figure you must move
recovery data, you should at least make it inconvenient, avoid
electronic communicated recovery data, and generally require the
recovery data to be as localised as possible.  (Also the principles
state that you should use forward secret comms keys, but I think that
might be pushing it for sneaker net between machines and a laptop in
the safe for ergonomics reasons :-)

Here is how use of the anti-GAK design principles can help to provide
a more GAK hostile system:

It is better to use recovery rather than escrow.  (Encryption of
Alice's private key with a companies recovery key).  This allows you
then to store the recovery information more locally to the data,
closest possible locality to data being another anti-GAK design
principle.

Now how is this harder than GAK?  Heh well you need to use your
imagination and try to make a system designed to fuck with the GAKkers
minds at this point.  Remember not only do you design the system to
not communicate the key automatically, you try your best to prevent it
being removed from the system.

Here's a few ideas:

You store the recovery info on the users disk only, but you do your
damnest to obfuscate it.  Encrypt it with keys hidden in the
executable, obfuscate the code to hell and back, and don't provide
source for that module.  (Obfuscation tricks like interpreter of
encrypted instruction streams ought to take a little bit of
unwinding).

You also hide the recovery data inside the keyrings, and obfuscate
them to hell and back around the file system in slack space etc.  This
is to make it harder to copy to a floppy.

So now the GAKkers can still get your recovery info, because they
could theoretically unwind that problem.  But it is sure a lot harder
than requiring every one to email them a copy of the key they just put
on a disk.  The software doesn't give you any help obtaining your key
in a mailable form, or in a form to stick on a floppy either.  In fact
it does it's damnest to prevent it.

This is the kind of monkey-wrenching PGP should be investigating,
rather than investing time in designing `elegant' GAK implementations.

Combine with forward secrecy with as quick update time as you can
manage without interfering with ergonomics issues, and the GAKkers
have got to come back every 5 minutes, and grab a copy of your entire
disk, or reverse engineer the obfuscation, to grab the next obfuscated
key.

> [Sidetrack: which is of course why PGP had to find another solution to
> present to those customers already using GAK. IMHO, and I can't help but
> be a bit surprised that I find myself in the minority on this
> issue, at least as far as the list is concerned. What PGP did was
> _elegant_.]

Wow, Lucky! I usually consider you to be spot on most such things, but
I think you failed to hit the bulls-eye there; in fact I think you
missed the dartboard entirely!

I thought it was you who was pointing out earlier the fallacy induced
by the key escrow meme (escrowing transient communicatoins keys with
governments or companies to recover data stored on frigging disks!)
(Actually you applied it just to goverments but the argument extends
to companies perfectly).

The only way that it's elegant is that it is an elegant fully ready to
roll GAK implementation.

(Notice Bruce Schneier's forward of a case of a GAKker already
starting to crow about the demonstration of GAKware feasibility in
PGP).

There are plenty of less GAK compliant things you can do than what
they are doing.  The anti-GAK design principles help to clarify
thought in designing a full spectrum from mildly GAK resistant through
to rabidly GAK-hostile.  I would hope that PGP (and you lot at C2Net)
will crank the setting up to mad dog rabid anti GAK mode with nested
obfuscated interpreters interpreting each other interpreting
instruction sequences to recover keys.  And busting your butts to make
your systems ergonomic and slick to the extent that the competitors
GAKware products look like dried up turds in comparison.  Deployment
being probably the most important anti-GAK principle of all!

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <3.0.2.32.19971014223017.006d0c04@ece.eng.wayne.edu>



-----BEGIN PGP SIGNED MESSAGE-----

>[Sidetrack: which is of course why PGP had to find another solution to
>present to those customers already using GAK. IMHO, and I can't help but
>be a bit surprised that I find myself in the minority on this
>issue, at least as far as the list is concerned. What PGP did was
>_elegant_.]

Actually, I think you'll find that most people on the list think PGP's method 
is better than a lot of other things.  It is elegant.  But, as Adam has been 
pointing out, there are better methods. :-)




-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQCVAwUBNEQquDc3ytqHnNyNAQGHvwP+JYTOg5IhciQ9Evm7W9jrmwxx8DNb7oww
n2KTeveEIj6K2lHksLZHvbT7//zfTXcol7IiPoHSnoHL6Z6Q6af6+7O5I9VwPNWo
+jGOLpbCFtdpvniaeugLCaji5/oQTx9HMu05n5Gj+iERShesCiXJaSU7CBq6qRi5
4iFmn7nxNkU=
=Ej6P
-----END PGP SIGNATURE-----


-----------------------------------------------------------------------
Ryan Anderson -      "Who knows, even the horse might sing" 
Wayne State University - CULMA   "May you live in interesting times.."
randerso at ece.eng.wayne.edu         
PGP Fingerprint - 7E 8E C6 54 96 AC D9 57  E4 F8 AE 9C 10 7E 78 C9
-----------------------------------------------------------------------






From pgut001 at cs.auckland.ac.nz  Tue Oct 14 19:46:06 1997
From: pgut001 at cs.auckland.ac.nz (Peter Gutmann)
Date: Wed, 15 Oct 1997 10:46:06 +0800
Subject: the case for separate comms keys
Message-ID: <87688287402369@cs26.cs.auckland.ac.nz>




Death rays from Mars made Adam Back  write:
 
>You can also acheive the same flexibility with an extra indirection with
>symmetric storage keys (optionally held in escrow).  In fact I think this is
>what later versions of Peter Gutmann's SFS do.  The reason he uses for this is
>that it allows you to change your passphrase without re-encrypting the whole
>disk, because the _actual_ disk encryption key is encrypted itself with the
>hash of your passphrase, rather than using the hash of the passphrase directly
>as the key.
 
There are also a few other reasons for doing this, and I've extended the idea
used in SFS for use with my cryptlib encryption toolkit.  Instead of encrypting
just the key, you also encrypt the algorithm details, ie:
 
    E          ( algorithm, algorithmInfo, key )
     passphrase
 
    E                             ( data )               
     algorithm, algorithmInfo, key
 
This makes the job of an attacker somewhat harder because even if they have
some means of performing a reasonable attack on the second encryption step,
they won't know exactly what it is, so even if it only has a 40-bit key they
might need to search half a dozen algorithms before finding the right one.
This makes it a lot harder to just brute-force everything going past in the
hope of finding something useful.  This is especially entertaining for
algorithms like RC5 and Safer, where you can produce dozens of variations by
playing with algorithm parameters, in effect adding extra bits to the key
length.
 
As Adam mentions, you can also escrow[0] the second key (which SFS does using a
threshold scheme with the parameters controlled by the user).  In this way the
user can change their password without destroying the ability of the escrow to
access the data.
 
Finally, using the session-key mechanism means you never encrypt two lots of
data using the same key, and means you can encrypt a single message for
multiple recipients just like the public-key equivalent.
 
Peter.
 
[0] This is "escrow" used in the true sense, not the GAK euphemism.  It's
    completely under the control of the user, it's optional, and it's intended
    for recovery of stored data when you forget the passphrase.
 






From uk1o at rz.uni-karlsruhe.de  Wed Oct 15 10:55:26 1997
From: uk1o at rz.uni-karlsruhe.de (uk1o at rz.uni-karlsruhe.de)
Date: Wed, 15 Oct 1997 10:55:26 -0700 (PDT)
Subject: CVS: cvs.openbsd.org: ports
In-Reply-To: <199709181910.NAA20539@harmony.village.org>
Message-ID: <199710151308.HAA03190@mroe.cs.colorado.edu>


Hello!

[older mail]

According to Warner Losh:
> In message <199709160731.JAA11130 at waldorf.appli.se> Niklas Hallqvist writes:
> : To people with commit access: committing to ports won't work, it's a
> : sup mirror where files will get overwritten.  Instead discuss changes
> : on ports@ and when good, mail to imp@ with explanations for
> : consideration of including into FreeBSD.

> This particular patch was committed to the FreeBSD tree last night.

> I do think that there will come a time when OpenBSD needs to have its
> own ports tree.  95% of this tree could be a mirror of the FreeBSD,
> but there are some interesting issues that need to be resolved that
> haven't been (like the libcrypt issues).

How about suggesting a make variable HAS_LIBCRYPT to the FreeBSD people?
We could set it in  or something like this (to a value
meaning "we don't have it and we don't need it either), and FreeBSD could
do similar.

Another way were patching the third party program's Makefile accordingly.
We should introduce a patches-${OPSYS} directory having precedence before
the patches directory of a port. Thus we could maintain our special patches
for ports which need them while continuing to use the FreeBSD ports where
they work out of the box. I see now that this is already implemented in
, so we could just USE that.

> Warner

Regards, Felix.





From weingart at natasha.brandonu.ca  Wed Oct 15 11:20:12 1997
From: weingart at natasha.brandonu.ca (Tobias Weingartner)
Date: Wed, 15 Oct 1997 11:20:12 -0700 (PDT)
Subject: CVS: cvs.openbsd.org: ports
In-Reply-To: <199710151308.HAA03190@mroe.cs.colorado.edu>
Message-ID: <14196.876929326@natasha.brandonu.ca>


On Wednesday, October 15, uk1o at rz.uni-karlsruhe.de wrote:
>
> Another way were patching the third party program's Makefile accordingly.
> We should introduce a patches-${OPSYS} directory having precedence before
> the patches directory of a port. Thus we could maintain our special patches
> for ports which need them while continuing to use the FreeBSD ports where
> they work out of the box. I see now that this is already implemented in
> , so we could just USE that.

I've already made a similar message to the ports list.  It was shot down.
But maybe now that we see the "trouble" with the current setup, we can
re-evaluate that.  Personally, I think we could share 95% of the ports
stuff between open/freebsd, but it would be nice to have the ability to
fix things in a local cvs tree, without having to wait for the fix to go
through channels.


--Toby.
*----------------------------------------------------------------------------*
| Tobias Weingartner | Email: weingart at BrandonU.Ca | Need a Unix sys-admin?  |
| 6B-1137 Lorne Ave. |-----------------------------| Send E-Mail for resume, |
| Brandon, Canada    | Unix Guru? Admin, Sys-Prgmr | and other details...    |
|----------------------------------------------------------------------------|
|      %SYSTEM-F-ANARCHISM, The operating system has been overthrown         |
*----------------------------------------------------------------------------*







From shamrock at cypherpunks.to  Tue Oct 14 20:56:01 1997
From: shamrock at cypherpunks.to (Lucky Green)
Date: Wed, 15 Oct 1997 11:56:01 +0800
Subject: Just say "No" to key recovery concerns...keep OpenPGP pure
In-Reply-To: 
Message-ID: 



On Tue, 14 Oct 1997, Tim May wrote:
> 
> And as Schneier noted yesterday, the support by PGP for "message recovery"
> is already being used by Congress as an arguing point that it is indeed
> practical and should be made mandatory.

I missed that one. [Just spent four days at an intensive training
improving my fail-safe skills].

-- Lucky Green  PGP encrypted email preferred.
   "Tonga? Where the hell is Tonga? They have Cypherpunks there?"






From imp at village.org  Wed Oct 15 12:10:35 1997
From: imp at village.org (Warner Losh)
Date: Wed, 15 Oct 1997 12:10:35 -0700 (PDT)
Subject: CVS: cvs.openbsd.org: ports
In-Reply-To: 
Message-ID: <199710151405.IAA20043@harmony.village.org>


In message  uk1o at rz.uni-karlsruhe.de writes:
: How about suggesting a make variable HAS_LIBCRYPT to the FreeBSD people?
: We could set it in  or something like this (to a value
: meaning "we don't have it and we don't need it either), and FreeBSD could
: do similar.

The problem isn't in the BSD make files, but rather in the makefiles
of the ports.  True, many FreeBSD ports' patches add -lcrypt blindly
to the makefile, but that could change.

: Another way were patching the third party program's Makefile accordingly.
: We should introduce a patches-${OPSYS} directory having precedence before
: the patches directory of a port. Thus we could maintain our special patches
: for ports which need them while continuing to use the FreeBSD ports where
: they work out of the box. I see now that this is already implemented in
: , so we could just USE that.

There already is the patches-${OPSYS} that can be used for this
purpose.

Warner





From shamrock at cypherpunks.to  Tue Oct 14 21:17:09 1997
From: shamrock at cypherpunks.to (Lucky Green)
Date: Wed, 15 Oct 1997 12:17:09 +0800
Subject: Just say "No" to key recovery concerns...keep OpenPGP pure
In-Reply-To: <199710150138.CAA09580@server.test.net>
Message-ID: 



On Wed, 15 Oct 1997, Adam Back wrote:

> 
> Lucky Green  writes:
> 
> > [Sidetrack: which is of course why PGP had to find another solution to
> > present to those customers already using GAK. IMHO, and I can't help but
> > be a bit surprised that I find myself in the minority on this
> > issue, at least as far as the list is concerned. What PGP did was
> > _elegant_.]
> 
> Wow, Lucky! I usually consider you to be spot on most such things, but
> I think you failed to hit the bulls-eye there; in fact I think you
> missed the dartboard entirely!

So I am told. Which is surprising to me, since usually I am told that that
I am too "paranoid" and "uncompromising".
 
> I thought it was you who was pointing out earlier the fallacy induced
> by the key escrow meme (escrowing transient communicatoins keys with
> governments or companies to recover data stored on frigging disks!)
> (Actually you applied it just to goverments but the argument extends
> to companies perfectly).

I can't help but see a difference between enforcing to encrypt to a
default key and storing the user's key outright. IMHO, the former entails
less potential for abuse.

> (Notice Bruce Schneier's forward of a case of a GAKker already
> starting to crow about the demonstration of GAKware feasibility in
> PGP).
> 
> There are plenty of less GAK compliant things you can do than what
> they are doing.  The anti-GAK design principles help to clarify
> thought in designing a full spectrum from mildly GAK resistant through
> to rabidly GAK-hostile.  I would hope that PGP (and you lot at C2Net)
> will crank the setting up to mad dog rabid anti GAK mode with nested
> obfuscated interpreters interpreting each other interpreting
> instruction sequences to recover keys.  And busting your butts to make
> your systems ergonomic and slick to the extent that the competitors
> GAKware products look like dried up turds in comparison.  Deployment
> being probably the most important anti-GAK principle of all!

Amen to the latter. I honestly don't see what PGP could have done better
and still achieved deployment in companies that keep copies of all
employees keys *today*. And yes, I think what PGP is doing is
better than keeping copies of the keys of all employees. Anyway, I now
have access to the entire PGP 5.5 system and will subject it to thorough
analysis. Methinks many people arecurrently rendering opinions on a design
they haven't even seen yet.

Certainly, the part of PGP's SMTP agent that prevents you from  screwing
up by accidentaly sending sensitive email unencrypted stands a good chance
of being installed at my site. [Can we all agree that this is a useful
feature]? More than once, I failed to encrypt an email that I meant to
encrypt.

As for C2 and GAK: as Lucky Green, I speak _only_ for myself. And I can
therefore say that if my employer was to imlement GAK, I would quit the
day I found out about it. It isn't going to happen.

 -- Lucky Green  PGP encrypted email preferred.
   "Tonga? Where the hell is Tonga? They have Cypherpunks there?"






From tcmay at got.net  Tue Oct 14 22:13:00 1997
From: tcmay at got.net (Tim May)
Date: Wed, 15 Oct 1997 13:13:00 +0800
Subject: Just say "No" to key recovery concerns...keep OpenPGP pure
In-Reply-To: <199710150138.CAA09580@server.test.net>
Message-ID: 




I'll try a different way of making my points...

At 9:12 PM -0700 10/14/97, Lucky Green wrote:

>I can't help but see a difference between enforcing to encrypt to a
>default key and storing the user's key outright. IMHO, the former entails
>less potential for abuse.

All other things being equal, maybe the former is slightly less intrusive
than the latter. But maybe not even this, as the two give the same results.
After all, what's the real difference between "all mail, incoming and
outgoing, must also be encrypted to a CMR key" and "you must deposit a copy
of your key with us"?

And things are most definitely not equal, in the "all other things being
equal" sense.

To wit, with the "storing a user's key outright" approach, if thousands of
companies and whatnot are doing this, there will be a mishmash, a welter,
of confusing, conflicting, byzantine arrangements. Some employees will
store their mandated spare keys in the department safe, some will put them
in "open upon my death" envelopes, some will "forget" to update the files
with their latest keys, and so on.

With this chaotic and anarchic approach, of "let a thousand solutions
bloom," Big Brother will have the devil of a time forcing GAK/GMR
(_Government_  Message Recovery_).  It's essentially the chaotic, anarchic,
non-system being used today. (And I've seen little evidence corporations
are collapsing; as noted in several messages, very few pieces of e-mail are
terribly critical, and even fewer can't be recovered from local files...the
market for CMR is for law enforcement and e-mail snoopers.)

By contrast, a CMR system BUILT INTO PGP (!) will potentially become
widespread, especially if support of the non-CMR-compliant version
languishes. Or, God forbid, CMR is mandated (perhaps by "Standard
Accounting Practices" sorts of pseudo-mandates).

I'll take the chaotic and anarchic solution.

And no matter how "elegant" PGP Inc.'s solution is--which I reserve
judgement on, not having studied in as much detail as, say, Adam Back
has--no matter how "elegant," it is still building a dangerous tool for
surveillance into a widely-deployed product.

--Tim May




The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From aba at dcs.ex.ac.uk  Wed Oct 15 00:06:41 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Wed, 15 Oct 1997 15:06:41 +0800
Subject: Just say "No" to key recovery concerns...keep OpenPGP pure
In-Reply-To: 
Message-ID: <199710150550.GAA11404@server.test.net>




Lucky Green  writes:
> On Tue, 14 Oct 1997, Tim May wrote:
> > 
> > And as Schneier noted yesterday, the support by PGP for "message recovery"
> > is already being used by Congress as an arguing point that it is indeed
> > practical and should be made mandatory.
> 
> I missed that one. 

They're right too that it is possible (though less secure).

That's the purpose of the anti-GAK design principles, see [1] below.
They codify a design process for how to fuck with:

- protocol designs
- standardisation processes
- implementations

to make them as GAK-hostile as possible.

There is a scale from:

pro-GAK: (USG, NSA, TIS, IBM) (give me video cams in all bedrooms)

GAK neutral: (implementer who just implements ignoring political argument of
  whether or not GAK will come in believing it irrelevant)

GAK-hostile: (implementer who is rabidly anti-GAK, and wants to stop
  the GAKkers at all costs; he wants to manipulate protocol standards
  settings processes to ensure what results is not just `not GAK' if
  implemented in one way, he wants to make sure that it is impossible to
  be both conformant to the standard and implement GAK, then he wants to
  implement to that anti-GAK-infiltrated standard and deploy as many
  of his units as possible all implemented as GAK-hostily as possible,
  with user ergonomics, functionality and presentation m$ would die for).

I really truthfully am completely puzzled as to PGP.  They make nice
pro-privacy rants (eg Jon Callas), but yet they are implementing a GAK
compliant system, and one which can also be used to itself fullfill
full GAK requirements without any software modifications.  It could
literally be plugged in tommorrow.  This is inconsistent.

Then myself, Tim May, Peter Trei, Bruce Schneier, Peter Gutmann, and
most of the rest of cpunks, and OpenPGP, go over and over what is
wrong with it, how to do it in non-GAK pervertable ways, or not to do
it at all.

And pgp _doesn't get it_.

I am non-plussed.

Are we suffering group hallucination here and are we all totally
confused?  Or is something very strange going on insde pgp's building?

What _is_ going on in there?  Are they arguing?  Are they blissfully
ignorant that the GAKkers are applauding their efforts?  Has the
corporate mind set take over?  Have they done a deal with the Feds?
Have they got $ signs in front of their eyes and forgotten that they
were once pro-privacy (those that ever were; I guess some of the are
just various suits).

I thought they were supposed to be on our side?

> [Just spent four days at an intensive training improving my
> fail-safe skills].

`fail-safe'?  As in blowing holes in cardboard cutouts with `fed'
written across them at 50 yds with a large bore weapon full of
hollow-points?  Sounds phun :-)

Another form of backup plan is to get the fuck out when GAK hits.  Go
move to switzerland, or anguilla or somewhere from which to continue
your after the fact monkey wrenching.  (Is switzerland any good?  Only
place other than UK I have citizenship -- actually not true have US
two through wife dual nationality, but I'm not sure about US right
now -- may get to GAK before UK lot do).

(pls excuse if `fail-safe' means something entirely unrelated, I'm not
familiar with the euphamism/technical term).

Adam

[1]
======================================================================
Date: Tue, 14 Oct 1997 10:37:21 +0100
From: Adam Back 
To: ietf-open-pgp at imc.org
Cc: cypherpunks at cyberpass.net
Cc: cryptography at c2.net
Subject: proposal: commercial data recovery

If we take the design goal of designing a commercial data recovery
system which is not GAK compliant, we can most succinctly state this
design goal as the task of ensuring that:

- at no point will any data transferred over communications links be
  accessible to anyone other than the sender and recipient with out
  also obtaining data on the recipient and/or senders disks


I think we can distill the design principles required to meet the
design goal of a non-GAK compliant Corporate Data Recovery (CDR)
system down to ensuring that:

1. no keys used to secure communications in any part of the system are
   a-priori escrowed with third parties

2. second crypto recipients on encrypted communications are not
   used to allow access to third parties who are not messaging
   recipients manually selected by the sender

3. communications should be encrypted to the minimum number of
   recipients (typically one), and those keys should have as short a
   life time as is practically possible

Included in 2) is the principle of not re-transmitting over
communication channels keys or data re-encrypted to third parties
after receipt -- that is just structuring -- and violates design
principle 2.


With these three principles you still have lots of flexibility because
you can escrow storage keys, do secret splitting of storage keys, and
store keys encrypted to second storage accessors on the local disk for
stored data recovery purposes.

As an additional bonus, principle 3 adds extra security against
attackers gaining access to encrypted traffic after the fact -- the
recipient no longer has the key -- this is a form of forward secrecy.


Systems designed to the CDR design principles are of significantly
less use to GAKkers than PGP Inc's GAK compliant Commercial Message
Recovery (CMR) design.  The CDR design significantly hinders the take
up of GAK if widely deployed.  

Design principle 3 -- forward secrecy -- is inherently hostile to
GAKkers, and is the strongest statement you can make against GAK: you
are purposelly _destroying_ communications keys at the earliest
possible moment to ensure that GAKkers can not obtain the keys by
legal and extra-legal coercion, black mail, and rubber hose
cryptanalysis.

The whole system translates into the Feds having to come and
physically take your disk to obtain information about you, which is
much better than GACK, and not what the GAKkers are interested in at
this point.  The GAKkers would like to install themselves, and coerce
companies into installing for them (via GAKker/USG/NSA/NIST organised
efforts such as the 56 bit export permit for companies installing key
escrow; and efforts such as the Key Recovery Parners Alliance (KRAP)).
I fear that PGP Inc's CMR proposal inadvertently meets most of the
NIST/NSA specified KRAP requirements.

What the GACKers want is systems where they can perform routine key
word scanning and fishing expeditions into your communications from
the comfort of their offices, without your knowledge.  This is push
button Orwellian government snooping.

Within the constraints imposed by the CDR design principles, there is
plenty enough flexibility to acheive the commercial data recovery
functionality to similarly weak levels of enforcability as achieved by
the CMR design.  Weak levels of enforceability are appropriate because
there are other exceedingly easy bypass routes: super-encryption, and
walking out of the office with a DAT tape.


I would like to organise a collaborative effort to write a white paper
discussing how to implement various functionalities using the CDR
design principle.

Then I would like to see discussion of which set of these
functionalities which best acheive the user requirement for company
data recovery.

Lastly I would like to see a collaborative development effort to
provide a example implementation of a CDR system which can be used as
a discussion point for the OpenPGP standardisation process.

I suppose the best place to discuss this process is the IETF forum for
discussion of the OpenPGP standard, the OpenPGP mailing list
(subscribe by sending message body "subscribe ietf-open-pgp" to
"majordomo at imc.org").

I have already had people express in email to me their interest in
doing this.  Those people can speak up if they want to.  Technical
input is sought from people opposed to GAK compliant software, and
from PGP Inc, and others defending PGP's GAK compliant CMR proposal.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710150633.HAA11426@server.test.net>




> > I thought it was you who was pointing out earlier the fallacy induced
> > by the key escrow meme (escrowing transient communicatoins keys with
> > governments or companies to recover data stored on frigging disks!)
> > (Actually you applied it just to goverments but the argument extends
> > to companies perfectly).
> 
> I can't help but see a difference between enforcing to encrypt to a
> default key and storing the user's key outright. IMHO, the former entails
> less potential for abuse.

Tim covered that pretty well.  Inconvience is significant.  If we can
redesign the protocols or backup procedure so that the GAKker must
modify software before GAK is even possible we have largely won.  If
we can accomplish subversion of the OpenPGP standard we may be on to a
winner too...  if PGP can't implement their beloved GAK functionality
without being a non-conforming application.

All it takes is for the standard not to accept the pgp5.5 CMR key
extension.  It really is too new and experimental to include says all.

Let's include it as a may says Callas.  No thanks says all, we don't
want any of it; too new too experimental.

If it comes to it, and I figured I could get away with it from a sales
perspective I would toss out encrypted email data recovery altogether
in preference to implementing GAK for the GAKkers.

Implementing GAK for GAKkers has similar immorality to blowing away
freedom fighters in foreign countries for sport -- it results in dead
freedom fighters, and dead thought criminals (say boo to some
governments, and they'll have your head on a platter within hours).

The effect is not quite as direct, but it is surely the effect.

Even for selfish reasons we don't want GAK for ourselves, and this
eventuality is far from impossible in our respective countries.

> > There are plenty of less GAK compliant things you can do than what
> > they are doing.  The anti-GAK design principles help to clarify
> > thought in designing a full spectrum from mildly GAK resistant through
> > to rabidly GAK-hostile.  I would hope that PGP (and you lot at C2Net)
> > will crank the setting up to mad dog rabid anti GAK mode with nested
> > obfuscated interpreters interpreting each other interpreting
> > instruction sequences to recover keys.  And busting your butts to make
> > your systems ergonomic and slick to the extent that the competitors
> > GAKware products look like dried up turds in comparison.  Deployment
> > being probably the most important anti-GAK principle of all!
> 
> Amen to the latter. I honestly don't see what PGP could have done better
> and still achieved deployment in companies that keep copies of all
> employees keys *today*. 

Sure they could.  Just simply switching from CMR to CDR:

Store encryption key encrypted to a company recovery key on their
disk.  Or on a floppy in the safe even.

No enforced second recipient necessary.  Recovery of archived messages
possible.

Enforced second recipients are worse than straight forward escrow.

This kind of thing is better for the reasons Tim listed in his defense
of storing the keys in the safe on a floppy as opposed to second
recipient.


How about forward secrecy?  You could make it even less GAK friendly
if the keys only lasted for seconds.  Then what are you going to do?
Send a constant stream of keys to NSA HQ?  What if the software tried
it's hardest to not allow recovery or access to it's keys (it's hardly
likely to given the desire for forward secrecy).  So how can that be
perverted for GAK?

Does PGP investigate these?  Hell no!  They whinge: ergonomics, too
complicated, not possible, you are having a group halucination, you
don't understand software design.

Yeah, that's right ain't it, we're group hallucinating, and Schneier
-- bah they ain't listening to him -- he's just not understanding it
right.

> And yes, I think what PGP is doing is better than keeping copies of
> the keys of all employees. Anyway, I now have access to the entire
> PGP 5.5 system and will subject it to thorough analysis. Methinks
> many people arecurrently rendering opinions on a design they haven't
> even seen yet.

You could have a point there.  Could you investigate and let us know
what it does?

important questions which I think are unclear:

- does it provide message screening functionality (human reading mail
  prior to delivery in both directions?)

- is pgp5.0 able to generate GAK compliant keys (CMR keys)?

- how much control does the SNMP remote configuration provide in
  restricting user

- can you have multiple CMR keys attached to a public key (like one
  for your company and one for the NSA?)

> Certainly, the part of PGP's SMTP agent that prevents you from  screwing
> up by accidentaly sending sensitive email unencrypted stands a good chance
> of being installed at my site. [Can we all agree that this is a useful
> feature]? More than once, I failed to encrypt an email that I meant to
> encrypt.

That part is a truly excellent feature.  I do this myself manually,
the mechanism I use that I read offline and use linux, so my mail is
sitting in /usr/spool/mqueue waiting to go when the connectivity comes
up.  So I go check the files I care about prior to actually
connecting.

However that's not the controversial SMTP policy enforcer property.
PGP Inc employees described that it rejects mail which is not CAK
compliant.

> As for C2 and GAK: as Lucky Green, I speak _only_ for myself. And I can
> therefore say that if my employer was to imlement GAK, I would quit the
> day I found out about it. It isn't going to happen.

I wasn't suggesting C2 was GAK friendly.  I was attempting to suggest
that there are things you can do to be even more rabidly GAK-hostile
than you already are.  Think: monkey wrench GAKkers who might put this
product to a work in a GAK setup.  Make the product be awkward about
the types of functionalities which they will want, make it drag it's
feet, make it hide data which it doesn't want transmitted, make it
cease to function when servers aren't local (eg. local LAN servers,
make them refuse to work for IP#s not on the same sub domain).  Be
imaginative.

PGP are at very best GAK neutral.  It doesn't try hard to stop GAKkers
deriving use from it.  It tries somewhat to prevent users hacking
around it's GAK features.  It coincidentally (if you believe GAK
neutral design philosophy) happens to be pretty useable to the
GAKkers.  It implements a method for a company which doesn't turn on
the GAK feature to advertise that keys are read by company.  Yeah
nice, but big deal right?

Contrast with trying to do all you can to ensure the product can not
be used for GAK without a protocol modification, or without software
recall, or non-backwards compatible widely fielded international
standard rewrite.  They do not appear to have tried any of these.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710150647.HAA11450@server.test.net>




Tim May  writes:
> I'll try a different way of making my points...
> 
> At 9:12 PM -0700 10/14/97, Lucky Green wrote:
> 
> >I can't help but see a difference between enforcing to encrypt to a
> >default key and storing the user's key outright. IMHO, the former entails
> >less potential for abuse.
> 
> All other things being equal, maybe the former is slightly less intrusive
> than the latter. But maybe not even this, as the two give the same results.
> After all, what's the real difference between "all mail, incoming and
> outgoing, must also be encrypted to a CMR key" and "you must deposit a copy
> of your key with us"?

CMR keys are the root of all evil in pgp5.5.  Without them almost any
permutation of recovery care to construct would be less useful to the
GAKkers, for all the organisational, and inconvenience reasons Tim
describes.  Governments have problems handling complexity.  

So make their job complex.  If you were one of the people writing the
IRS tax software back in the 60s, and you were in deep cover, a
proto-cypherpunk, and were bright enough to see the future
possibilites you would have done all you could to fuck up the IRS
system.  You would have obfuscated the code.  You would have put logic
bombs in it.  You would have destroyed the source code
surreptisiously.  (Destroying source code has analogies to destroying
keys at earliest opportunity, you are destroying something which your
enemy needs).

Any bets as to if any of this actually happened on purpose?  I reckon
so.

So, do you all reckon we can make task of fielding GAK impossibly
complex for such a big disorganised government?

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <3.0.3.32.19971014235437.006f93d4@popd.ix.netcom.com>



According to an article in today's Mercury News or SFExaminer,
Telstra has also decided that 70% of the bits on US-Australia
Internet connections are now going from Australia to the US
rather than the earlier ~100% US->Australia direction -
so it wants a major reevaluation of who pays for the
trunks connecting the Internets in the two countries
(currently Telstra pays most of the costs.)

>http://www.australian.aust.com/computer/fulltext/c1014b.htm
>         Telstra: We were wrong about Net
>         By GEOFF LONG 
>October 14: A Telstra official has admitted that the carrier
>overestimated the congestion problems associated with the Internet,
>one of the prime reasons given when it wanted to introduce timed local
>calls.
>
>Speaking at the launch of Telstra's Big Pond Business services, Big
>Pond general manager John Rolland said congestion caused by Internet
>users connecting for long periods was not as big an issue as they
>first thought.

				Thanks!
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From tech21 at tectel.com  Wed Oct 15 15:53:51 1997
From: tech21 at tectel.com (tech21 at tectel.com)
Date: Wed, 15 Oct 1997 15:53:51 -0700 (PDT)
Subject: I have seen the future.....
Message-ID: <199710152249.PAA17195@holland.it.earthlink.net>




I HAVE SEEN THE FUTURE
And it will change your world soon...       
 
I receive a lot of telephone calls.  All of them interesting-some 
of them fascinating. Seldom though, do I receive a call that
I would truly refer to as "compelling." 

That is, of course, until my phone rang about 3 weeks ago. 
I still can't believe it. Odd call. 
Gentleman wanted some information-specific information.
Of course I had a few questions that I needed answered first.

"What's the product?"
"Can't tell you," came a rather hollow reply.
"Can't tell me? Why not?"  I pressed, becoming increasingly 
more curious-and irritated-by the moment.
Seeming to change the subject he said, "We want you to come 
take a look, and give us your opinion."
"Come where? And give you my opinion on what?"
"We'll send you a plane ticket."

Three days later, I found myself staring out the window 
of that early morning Delta flight as we made our final approach, 
wondering what in the world I have got myself into.

Met with the founders and the young man who had 
invented the technology. I guess it was about 
55 minutes into the presentation that I 
understood what these guys were up to,
and the profound effect this was going to have
upon the world-our world.  

While I sat there riveted on the CEO's every word, 
transfixed by the passion emanating from his steel blue eyes, 
I felt like some character in a spy novel, 
conspiring on a plot to overthrow the government.  
One day, I'll tell you the whole story.      

What you ask could have such a profound effect upon our world?


THE TOTAL DESTRUCTION OF THE TELE-COMMUNICATION INDUSTRY
AS IT CURRENTLY EXISTS!!

I've recently been invited to the high technology company 
discussed above. It is a new publicly traded company.
It will be the Microsoft of the telephone industry. 
It is extremely well funded and has patented high technology.

The proprietary technology is the most significant advance 
in over 100 years of tele-communications. 
Protected by 2 patents covering 48 applications,
we have a private network infrastructure at a pre-opening 
investment of approximately 23 million dollars. 
We are not re-sellers of Long Distance time; rather a 
direct competitor to AT&T and  others.

To illustrate the potential of this proprietary technology: 
the internal cost of AT&T to complete a call is calculated
at approximately 3 cents per minute; 
MCI and Sprint the second and third largest competitor based on 
cost of approximately 4 cents per minute.  
Our private network "compression technology" can accomplish 
the same call for as little as 2/ 100th of a cent per minute.  

For example, AT&T and MCI just announced they were going to 
cut their basic rates by 5% during the daytime and 15% during 
the nighttime. On a 15 minute coast to coast call AT&T's 
new price will be $4.65 during the day for their 
average customer, our regular price to every customer 
every day (24 hours per day, 7 days per week) is $1.18.  
We can afford to beat AT&T pricing because of our technology.  

But you ask, do I have to use any special equipment. 
Absolutely not.  Just pick up the phone and call the party
you want to reach. Pricing is only the tip of the iceberg 
with our new technology.  Our multimedia products are going 
to make your life so much easier. Star Trek is here, 
right now and our smart communications platform will bring it to you.  
AT&T, MCI, and Sprint, look out there is a new major player in town.

We will only work with a limited number of individuals to launch
this company. If you think you have what it takes or have
proven that you do, do not wait a moment longer. This is a 
ground floor business opportunity, with a compensation package
potentially 300% more lucrative than our nearest competitors. 

Would you agree I have something here that spells opportunity? 
If yes, we need to talk further, immediately.
     
Call for information and cassette 1-800-741-6240 
or e-mail us at technology at tectel.com 
Please indicate your name, address, and 
telephone number in the body of your response.

************************************************************
Removal Instructions...
It is in no way my intention to send anything to anyone 
who is not interested in the information; 
If you would like to receive future updates, 
simply reply to this message
with "subscribe" in the subject line to subscribe at tectel.com 
and indicate your name, address, and telephone number 
in the body of your response.  Please complete all information.
If we do not hear from you, you will be automatically 
removed from future updates and will not be contacted again.





From m4 at nts.umn.edu  Wed Oct 15 16:03:42 1997
From: m4 at nts.umn.edu (Marshall Midden)
Date: Wed, 15 Oct 1997 16:03:42 -0700 (PDT)
Subject: Document on Customizing OpenBSD after install
Message-ID: <199710152020.PAA24415@unet.unet.umn.edu>


Is there a checklist someplace on what to do after the install of OpenBSD 2.2?

I'm thinking like:
   1) Go into /etc
	a) Verify disks and network interfaces configured correctly.
	   Files: fstab, hosts, myname, hostname.le0, mygate, resolv.conf, defaultdomain.
	   You might wish to turn off multicast routing in /etc/netstart.
	b) Edit motd to make lawyers comfortable and delete "Welcome".
	c) Fix passwd via "vipw" to change passwords, set up users, etc.
	   Make sure password on "root".  Default is no password from console, and
	   disabled from network.  Make sure to edit "group" for any user groups,
	   and to put people into the wheel group if they need root access.
	d) Any local configuration change in: rc.conf, rc.local
	e) printcap, hosts.lpd	Get printers set up
	f) Tighten security:
		fbtab		Set security for X
		inetd.conf	Turn off extra stuff, add that which is really needed.
		rc.securelevel	Turn on Network Time Protocol.
	g) kerberosIV		Get kerberos configured.  Remember to get a srvtab.
	h) aliases		Local mail delivery (set postmaster, etc).  Run newaliases
	   after changes.
	i) bootptab		If this is a bootp server.
	j) ccd.conf		If using concatenated disks (striped, etc).
	k) exports		If this is an NFS server.
	m) NIS (old yellow pages), hosts.equiv, defaultdomain, etc.
	n) ifaliases for www, etc.
	o) daily, weekly, monthly.
	p) "amd" directory if using this package.
	q) rbootd if needed for remote booting (ethernet MAC address to IP translation).
	r) Any other files and directories in /etc.

   2) crontab -l.		Do you need anything else?
   3) After the first nights security run, change ownerships and permissions on things.
	Best bet is to have permissions as in the security list.





From stewarts at ix.netcom.com  Wed Oct 15 01:08:40 1997
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Wed, 15 Oct 1997 16:08:40 +0800
Subject: Technical Description of PGP 5.5
Message-ID: <3.0.3.32.19971015004322.0068ca64@popd.ix.netcom.com>



Jon Callas presented a technical description of PGP5.5 at this 
month's Bay Area Cypherpunks meeting, as well as flak catching on the 
politics discussion; Phil Zimmermann and other PGP folks also helped.
This posting is an attempt to summarize the technical parts
and leave the politics for other messages.  Perhaps there's been some
technical discussion on OpenPGP, but feel free to forward this there if not.

1) PGP 5.5 API Toolkit -  It's the core of the PGP5.5 GUI and SMTP tools.
	It'll be out Real Soon Now.  It's a major change from the 
	PGP 5.0 Toolkit, which is based on ViaCrypt's older code.
	The toolkit knows about all the features in the message
	formats, so even if the application programs from PGP
	don't provide a given friendly or hostile feature,
	you can still write it yourself, and so can the Bad Guys.

2) PGP 5.* message format - unchanged - uses the multiple recipients,
	without any indication of or dependence on relationships
	between the recipients.  The format is approximately
		Recipient Record 1 - KeyID1, E(sessionkey, PubKey1)  ....
		Recipient Record N - KeyIDN, E(sessionkey, PubKeyN)
		Message - E(Message, sessionkey)
	KeyID is the 32-bit KeyID, rather than a fingerprint.
	I don't know if the format or the PGP 5.x software can 
	generate or accept messages with recipient records for
	two different keys with the same keyid (or whether it matters
	if the keys are for DH*, RSA, or both.)
		* DH can be spelled "E L  G A M A L" -- Blame Cylink :-)

	While 5.0 did introduce new data formats, they're not stealthy,
	and features like the SMTP filters depend on being able to
	know how many recipient-key records a message contains,
	where their boundaries are, and what their KeyIDs are.

3) PGP 5.* public key format - The 5.5 features are actually present 
	in the 5.0 key record formats, but there wasn't any 
	implementation that used the extra fields.  
	The record for keys is about like this, though I may have some
	of the details wrong.  The record for the RSA Keys uses the 
	old format; this format is for newer keys.

	Key Record type 
	KeyID
	UserName
	Algorithm ID - the interesting combo is ElGamal and DSA
	Encryption Key
	OptionalCMRK_1: (Mandatory/Optional flag1, Msg Recovery KeyID1)
	 .....
	OptionalCMRK_N: (Mandatory/Optional flagN, Msg Recovery KeyIDN)  
		(Note: the format allows multiple records, PGP5.5 only 
		generates one, though it might accept and use multiple.
		Nobody indicated whether more than one CMRK indicates
		that the sender should encrypt to all CMRKs, pick one,
		or do something interesting like secret-share.)
		(Note: the KeyID is a 32-bit KeyID, not the full 
		fingerprint, 	which has amusing deadbeef attacks. 
		(Unless I remembered wrong.))
	Signature Key 
	Self-Signature on (Encryption Key, Signature Key, UserName)
		(I don't know if the self-signature includes the CMRKs,
		but I think it includes the user names.)
	Optional_Signature_1: (Signature KeyID1, Signature1)  .....
	Optional_Signature_N: (Signature KeyIDN, SignatureN) 
		(I don't remember if it's just the KeyID or the 
		full fingerprint.)
		(Note: Signatures are only on the signature key,
		so you can change the encryption key and keep your
		collection of web of trust signatures; this is secure
		because the encryption key is signed with YOUR sig key,
		and your sig key is signed by your friends' sig keys.)

	The signature structure is interesting, since it lets you
	implement forward secrecy somewhat conveniently - 
	just change your encryption key.  	I don't know if the 
	5.0 / 5.5 implementations can easily handle multiple
	records for the same KeyID, so there may be some 
	transition issues, but that's an implementation question, 
	not a data format question.

	The CMRK** is obviously the new and controversial feature.
	The key is attached to the recipient's key, not the 
	sender's program, which has some implications in who 
	has to participate in any message escrow activities 
	and where they take place.  To some extent this is planned, 
	and to some extent it's just the consequences of what parts 
	of the system you have control over and what you don't.
	This approach has the recipient publish a CMRK KeyID,
	and has the sender decide whether to use it,
	rather than having the sender's system specify who 
	gets the CMR copy.  
	- Since this is the data format, it doesn't have any control 
	over what the sender really does; 	any enforcement is in the 
	sender's or recipient's client or in the SMTP mail filters.  
	- The format just contains the CMR KeyID, not the key itself;
	looking up the key is a separate job.
		(** Corporate Message Recovery Key?  Cover My Rear Key?)

	NOT TALKED ABOUT, but possibly relevant: www.pgp.com says:
		"Using PGP�s Administrative Wizard, for example, 
		administrators can set key generation configurations; 
		require encryption for all email messages sent by a set 
		of users; enable corporate message recovery; and 
		limit the ability of users 	to perform certain actions, 
		such as key generation."
	I assume the parts about key generation are limitations on the
	client, either generating PGP Crippleware?  It can't be 
	that heavy a restriction, since users could use PGP5.0,
	or 2.6.2 if the rest of the company can accept RSA keys,
	but it's sounds disturbing and it would be nice to see 
	documentation.  Could it be limits in the keyserver instead?

	Also not talked about - CERTIFICATE SERVER, and 
		CERTIFICATE SERVER REPLICATION ENGINE
	which has lots of cool LDAP directory lookup stuff.  
	The web page didn't say anything about policy administration 
	on the server, but it's another obvious hook, assuming people 
	in a company use it (e.g. a key server could only store keys 
	with CMRKey set to Mandatory, though I don't know if the 
	initial PGP CS version does that sort of thing.)

4) PGP 5.5 Implementation and GUI - 
	- When you generate a 5.5 DH key, you have the option of 
	specifying a CMRK and setting the Mandatory/Optional flag.
	I don't remember if there's an option to force you to use the 
	CMRK, or to set a default CMRK or default value for the 
	Mandatory flag, but the PGP folks kept saying things about 
	always asking you things and always letting you know 
	when it's going to do things.
	- The PGP 5.5 implementation puts at most one CMRK in the 
	record, though it doesn't choke on receiving multiples.
	- If you receive a key record containing CMRKs, PGP 5.5 stores
	them; I don't remember if it alerts the user at that point or
	only when the user uses the key later on.
	- If you encrypt a message using 5.0, it ignores the CMRK.
	- When you are encrypting a message, the GUI lets you pick 
	what keys to encrypt to.  If one of the keys has a CMRK, 
	if the Mandatory flag is not set, it asks if you want to 
	set the CMRK as a recipient.
	If the Mandatory flag is set, it puts the CMRK as a recipient.
	Either way, you can delete the recipient, and it doesn't 
	enforce it, and it also makes the CMR keys show up in red etc.
	It will nag you if you delete a mandatory, but won't stop you.
	(I think I got those details right.....)
	Also, if there's a CMRK KeyID, and your keyring doesn't 
	contain the key for that KeyID, it asks if you want to fetch 
	it from the keyserver.

	- As far as I remember, if you have a CMRK Mandatory set on 
	one of your keys, and you receive a message addressed to 
	your key, it doesn't check if the message was also addressed 
	to your CMRK.
	A Bad Guy could build an implementation that did this, but
	the messages are interoperable with PGP 5.0 and don't contain
	any indication that any recipients use or are CMRKs, so it's
	easy to work around if they do.  And a Bad Guy could also build
	in Passphrase Leakage or other evil things anyway.

	Again, the CMRK belongs to the recipient, not the sender,
	and deciding to encrypt to it belongs to the recipient.
	The ViaCrypt BusinessGAK version had a feature that let you
	compile in a Message Recovery Key that the sender was forced to
	use (which was a clone of the Always-Encrypt-To-Self code.)
	This is #defined out in both 5.0 and 5.5; the PGP folks 
	tried to see what happened if they #defined it in when 
	compiling, and it nicely dumped core when they used it.

5) SMTP filters - PGP Policy Management Agent for SMTP
	is really separate programs for Incoming and Outgoing mail.
	None of the PGP 5.5 features do more than nag you about using 
	them; they don't have an enforcement mechanism.  The 
	SMTP filters, on the other hand, are designed for enforcement,
	and some of the interesting security and control issues
	come from the interaction between the filters and the PGP5.5.
	The PGP folks said that their particular implementation
	was a quick and basic job using the toolkit -
	so even though it's not particularly draconian or intrusive,
	it's easy for people to write their own that are more hostile.

	Neither filter, for instance, saves copies or forwards copies
	of mail to an archive or corporate enforcers or runs scripts -
	all they do is pass or bounce the mail (with configurable message).  
	But you could write one that did, if you were that type of company.
	Source is not provided ("Look, we have to have _something_ to sell"),
	but some of the toolkit example code will be fairly similar.

	The filters don't look inside encrypted packets (so they
	don't have to manage private keys or other dangerous things).
	This does mean that they can check for encryption or signatures,
	but can't check if there's a signature inside an encrypted message.

6) Incoming SMTP filter - Really simple
	Remember - CMRKs are attached to the recipient, not the sender;
	this is the only place you can enforce that for your employees.
	Incoming mail is checked to see if it's acceptable, and either
	passed to a "real" SMTP server or bounced with a message
	(typically includes a policy statement or URL and/or
	a pointer to a key server handling the CMRKs.)
		Note that all the filtering is based on KeyIDs - 
		not email senders or email recipients or transport info.
	Messages can be rejected if they're unencrypted, or rejected if 
	the encryption recipients don't include one of a set of keys.
	Unless I'm remembering wrong if the list of keys was not
	dependent on the recipients, so you can't do things like
	"If Recipient=PurchasingClerk Require PurchasingBoss", 
	though you can require "One Recipient in set 
		PurchasingBoss, SalesBoss, EngrBoss", etc.
	Unfortunately, this pushes the company toward using one CMRkey,
	since it's not very flexible, though it can easily handle 
	multiples.

	There may have been an option to accept signed mail,
	or that may have only been in the Outgoing SMTP server.

	There wasn't an option to reject unencrypted mail.  
	(You could probably fake this by accepting unencrypted messages 
	while also requiring encrypted messages to include a recipient 
	whose key is not published anywhere and not publishing that 
	keyid so nobody runs a deadbeef attack on it.  
	I haven't verified this...)

	There wasn't an option to email a copy to the archive;
	you could write your own, but presumably any site that wants to
	save copies of all encrypted messages is already saving copies
	of all unencrypted messages already.  Or they're really
	only making sure there's a CMRKed copy of the session key
	so they can decrypt the message on the late recipient's disk
	after he gets hit by a bus or a subpoena.

7) Outgoing SMTP filter - more complex.
	IF Sender_IPaddr in LIST, Evaluate RULE (parameter KeyIDList) ->
	-> Accept (fwd to SMTP server)  OR Reject with parameterized 
	bouncemessage.  You only get one list of IP addresses, and you 
	can only accept/reject, but the rulesets are flexible, and you 
	can chain multiple filters together (the filter can run on 
	Port 25 but can also run on other ports, and can forward to 
	an SMTP server on other ports, so you can stack a bunch of 
	these on a single box and chain them together.)
		Note that this doesn't look at the sender's or 
		recipients' email addresses, just the sender's 
		IP address.  This is sometimes limiting 
		(consider mail servers with multiple users, or 
		multi-user machines, or people who do multiple 
		functions from one machine), but it's more secure than 
		trusting easily forged information like the sender and 
		sender's address.  A fancier system would include these 
		in filtering capability.  That capability may have been
		left out on purpose, or it may just be limited 
		development time.
	(I don't remember if you can use multiple rulesets, 
	but you can stack.)  I also don't remember 
	all the possible rules, but this is close:
	- Require Encryption  (yeah!)
	- Require Encryption to Key on KeyIDList 
		-- remember that CMRKs are attached to recipients' keys,
		not to senders' keys or mail packages, so the senders 
		have to include any required keys themselves unless the 
		recipients' CMRK keys are administered jointly with 
		the SMTP server.  (Sending them enough bounce messages 
		may give them a hint, but the sender's PGP5.5 system 
		won't do it automatically.)
		Thus, it's easy for CompanyA BuildingA to make sure that
		messages to CompanyA BuildingB employees are encrypted 
		to one of CompanyA's CMRKs, but it doesn't have a clue 
		about CompanyB's CMRKs or RandomRecipient's CMRKs, 
		though if the recipients put their keys and CMRKs on 
		some public keyserver a more sophisticated (and slower)
		SMTP gateway could check.
	- Require Signature (Remember that it can't look inside 
		encrypted messages, so it only does this for 
		unencrypted signed messages.)
	- Require Signature from KeyIDList - since this ruleset is 
		used along with IP address lists, you could require 
		things like
		"All email from Purchasing's machines are signed by 
			Purchasing"
		"All email from the PR department is signed by the 
			Marketroid Key"
		"All email from PR users is also signed by 
			someone technical" :-)
		"All email from technical people is signed by 
			Corporate Security" :-(
		"All email from the company president's key is signed by 
			PR and Legal" (Note that this doesn't let you say 
			"All email purporting to be from the company 
				president" 
			since it doesn't read email headers.)
		"All mail from the company president's real key is 
			signed by the company president or her secretary"
	- Block encrypted mail, block signed mail (I think both of 
		these were there, and if they weren't, you could 
		implement them by some combination of features.)
	- Clear Text	- you can allow this or block it.

Storage Keys vs. Signature Keys vs. Message Encryption Keys -
	As described above, PGP5.* does use separate keys & algorithms
	for signatures and encryption, except for the old RSA keys.
	Storage Keys are a different issue - the main distinctions
	between storage keys and message encryption keys are
	- storage keys are used by the owner, while message encryption 
		keys are used by someone other than the owner for 
		items that will be given to the owner.
	- storage keys are useful when you have the storage media,
		message encryption keys are useful when you have a
		copy of the message, either legitimate or eavesdropped.
	- message encryption cyphertext gets mailed; stored
		cyphertext just sits there :-)

	PGPdisk is a pure storage key system, and perhaps there 
	would have been less political furor if PGP had done 
	Corporate Storage Recovery Keys, but it's not a mainstream 
	product for PGP Inc., and only runs on Macs.  
	Doing the storage job right means integrating with
	backup servers (disk drives get crashed or scribbled
	far more often than employees get hit by trucks...)
	which isn't PGPInc's specialty.

	In reality, users often use PGP for storage, including for
	messages they've received (depending on their mail GUI)
	and for files on disks (encrypted to themselves.)
	File-by-file encryption is easier to back up securely than
	whole-disk encryption, which requires either dumping the whole 
	disk to backup media or copying to the backup in the clear.
	The latter is especially useful if the backup server is also
	an encrypted storage system, but the copying may be a security
	risk, unless you do really fancy things, 	and there's the 
	whole question of whether the backup storage is encrypted 
	with the same keys as the primary (hit-by-truck risk) or with 
	a different key (corporate message access equivalence risk.)

Business environment and documentation - [Mostly non-technical]
	PGP is a real business.  They've got deadlines, 
	they've got accountants, they've got people beating them up 
	to ship code by the end of the quarter so they can bill people,
	they've got customers telling them they won't buy stuff until 
	they get Feature X added or removed, all the usual stuff.
	The design consultants who used to do their export controlled 
	web site left them a maze of twisty little CGI scripts, 
	all different, so getting actual technical documentation out 
	has taken far more work than anybody had time to do before 
	a release date.  (Some documentation is claimed to exist :-)
	Their SMTP packages could have had far more features, but they
	felt this at least minimally met their requirements, and there
	was some thought toward extensibility.

	While 5.0 did introduce new data formats, they're not stealthy,
	because they haven't seen much (any?) paying-customer demand,
	and features like the SMTP filters depend on being able to
	know how many recipient-key records a message contains,
	where their boundaries are, and what their KeyIDs are.
	So they recommend that people who want stealth go work OpenPGP
	and build formats that work to pressure PGP Inc. into using it.

	One of Phil's goals had been to design a system that provided 
	the business message recovery features their customers were 
	asking for without providing access to users' private or 
	signature keys, as a counter-argument to the GAK advocates 
	who claim they need it.	[ As might be expected, 
	much heated discussion occurred on this issue.  :-) ]

	Some things that time pressure makes it difficult to
	think about, or at least implement, beside stealth, 
	are features like secret-sharing the session keys to CMRKs
	(it's not possible to do this cleanly, without affecting
	a bunch of other things), or making session key recovery
	a difficult and slow process so it doesn't get done often
	(e.g. zeroing the bottom N ~ 32-40 bits of session key
	so recovery requires some brute force as well as the keys.)
	Building in the ability to crack messages using a single
	master key is really bad (though at least it can be a
	different master key per user or per message); perhaps when
	5.6 or 6.0 handles multiple CMRKs it will implement them
	by secret-sharing rather than making them each full recipients.

- Customers -
	Some of the customers do want to "recover" all their users' 
	traffic. Others wanted to make sure that mail to a customer 
	service rep got encrypted to the other customer service reps 
	also, or at least to the rep's boss, so someone could handle
	the business if the original recipient was away.

	One of the more obnoxious customers was implementing CAK by
	having the Corporate Security department generate keys and
	hand them to the users on floppies; this gives them a less
	obnoxious approach that they're willing to try.

	One of the customers was really paranoid about making sure
	their employees didn't leave their CAD drawings encrypted
	and then steal them or extort money from the company for
	decrypting the plaintext when they quit; apparently the
	idea of using a document management system like programmers
	use for source code control had never occurred to them....
				Thanks!
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From bianca at dev.null  Wed Oct 15 01:12:21 1997
From: bianca at dev.null (Bianca)
Date: Wed, 15 Oct 1997 16:12:21 +0800
Subject: Just say "Huh?" to key recovery concerns...keep OpenPGP pure
In-Reply-To: 
Message-ID: <3444764D.1731@dev.null>



I hate to insert a modicum of realism into an otherwise wonderful debate
currently taking place on the Cypherpunks list in regard to the saints
or sinners (depending on the angle that one is pissing from) at PGP,
Inc.(arcerated, if PRZ hadn't folded his hand).
However, my Bullshit Meter indicates that bullshit is currently 'en
vogue' as the preferred 'opiate of the masses' and that the ultra-fine
distinctions between GAK and CMR that are being hotly debated on the 
list are likely to be largely ignored by the huddled masses, yearning 
to be monitored.

SURVEILLANCE==SECURITY
Call it Double Speak or Spin Doctoring, it doesn't really matter. The
citizen-units have bought into the 'America's Funniest Home Videos of
Law Enforcement Agents Busting Dark Skinned Threats To Decent Americans
On Prime-Time TV Thanks To Total Video Surveillance of the Citizenry'
message being promulgated by the mainstream entertainment/news media.

This is why nobody even blinked when legislation was recently passed
which criminalized the possession of toilet plungers, except for those
involved in meeting the legitmate needs of law enforcement to shove
toilet plungers up the citizens' assholes.
(Hell, I usually pay extra for that...)

OK, so I just made that stuff up. Nonetheless, it *could* be true at
some point in the near future, if DoubleSpeak, NewSpeak, SpinSpeak
and I'mTooTiredToFightItAnymoreSpeak become the unchallenged rule
of the day (which is not far from becoming a total reality).

However, the point which I am not terribly concerned about making
is this:
  The great sin of ViaCrypt/PGP is that they are failing to maintain
standards of integrity that are far above that of the large mass of
humanity that they are counting on to comprise the bulk of their
customer base.

What is the quote...??? 
"Nobody ever went broke underestimating the intelligence of the
public." (?)

I would very much prefer that ViaCrypt separate their 'Corporate Message
Recovery' software from the PGP name/reputation-capital, but I would
rather the situation remain as it is than to see PGP/ViaCrypt go under
and leave the encryption software field to those with *no* history of
'doing the right thing.'
I sincerely hope that the CMR software is the result of those designing
it getting caught up in the erronius security concepts being promulgated
by those with a fascist axe to grind, and that it is not the result of
people of integrity 'consciously' averting their gaze from reality in
order to increase their bottom line.

If the current form of PGP/CMR is the result of normal diversion of the
optimum design, due to the time/monetary pressures of everyday business,
then the flaws in the product can be rectified in the future.
If this is not the case, then it will be incumbent upon those who are
aware of the dangers the technology presents, in its current form, to
develop viable methods of circumventing the technology's flaws and/or
weaknesses.

To tell the truth, my main concern with the direction that PGP/CMR has
taken is that there are not many role models left in life, and it would
be a shame to lose yet another one due to lack of the character and
perserverance that is needed to go against the grain of everyday
business reality.
The posts to the Cypherpunks list surrounding the issues involved in
the current release of corporate PGP have been very enlightening to
those of us who count on those such as Peter, Adam, William and others
to 'shake it down' from a technical perspective. However, the pros and
cons being debated on the list will have little meaning in the long
run if those of us who are capable of understanding the issues involved
do not take the time, and make the effort, to fully understand the
implications involved, and to use whatever influence we have in society
and the computer industry to rail against the dangers and work toward
optimum solutions to the weaknesses and shortcomings in the technology
which can threaten privacy, liberty and freedom.

The fact of the matter is, although a company does indeed have a right
to exercise control and supervision over their business affairs, they 
have no right to exercise the same amount of control and supervision 
over an employee's phone call or email to his or her spouse, or family
members, or their communications with the cable company over when they
can be present at home to have their cable TV hooked up.
If a company has set up a system whereby an employee needs to ask
permission to make an unmonitored phone call, or send a personally
encrypted email during the course of the business day, then the
company and the employee have become adversaries.

Governments and Corporations become fascist dictators 'by default.'
When they remain conscientious, humanitarian institutions over a long
period of time, it is the result of the efforts of those within the
governments and corporations to 'make' it so.
If man does not rule the machine, then the machine will rule the man.
[Women rule *both* (;->)------(<-;)]

There is a far cry of diffenence between:
1) "Boss, can I have permission to talk privately, without supervisory
  monitoring, to my child's doctor, since he/she is sick and the doctor
  needs to speak frankly and privately to me?"
and
2) "Boss, I needed to speak privately to my child's doctor, so I 
  bypassed the monitoring mechanisms and informed my supervisor
  as to my reasons for doing so."
and
3) "Boss, I damn glad I work in one of the few remaining companies
  where I am trusted to act in the best interests of both myself
  and the company, and not be spied on over every minor detail out
  of a sense of mistrust."

I realize that we live in a world where the company president (of
Borland?) can steal company secrets and take them with him/her to
his/her new place of employement. And janitors can go through the
garbage to gain access to company secrets that they can sell to
the competition.
However, I truly believe that TOTAL SECURITY is an impossible goal,
and that internal company security should be geared toward making
it necessary for outside forces to attack the system in order for
the corporate information system to be compromised.
The situation within a company is much the same as the situation
within a country. Even the most fascist and draconian of rules 
and regulations will not prevent the anti-fascists and anti-
draconians from playing the secrecy/security game better than
one's own players. (Or prevent the janitor from inadvertently
leaving valuable corporate information lying on the top of the
garbage pile.)

Corporate Security is not a far cry different from National 
Security or Private Security.
All involve an elliptical curve beyond which 'security' becomes
our oppressor, rather than our savior.

I have listened closely to both sides of the debate over corporate
interests versus government shenanigans, and do not disagree too
strongly with either side of the debate.
I believe what may be understated is the reality that any government,
any philosophy or psychology, any devised system of democracy or
security, is dependent upon the knowledge, wisdom and integrity of
those who are involved in upholding the concepts underlying it.

It matters little whether the Supreme Court is 'stacked' with
liberals or conservatives, it is still 'stacked.'
It matters little whether we are 'pretending' to listen to the
arguments of our 'liberal' or 'conservative' foes, we are still
'pretending' to be men and women of reason.

The great danger that exists is that men and women of high intellect
and reason will make the mistake of assuming that their fellow
primates are working off of the same game sheet as they are.
If the same party takes all of the steps backward, as the other
party keeps stepping forward, then the word 'compromise' is being
misused. Buy a clue...

I have no more desire to live in a world full of Dimitri Vulis's 
than I do to live in a world full of Tim C. Mays.
I want to live in a world full of CypherPissers who shoot themselves
in the foot as often as they shoot each other in the head, so that
the Universe maintains its natural balance.
Ignorant incompetence is a far less troubling manifestation than is 
that of conscious evil. Yet we live in a world that 'condemns' the
former and 'compromises' with the latter.

What I find troubling is the fact that 'evil' seems to have a game
plan, while 'good' seems to be locked in an endless argument over
how to proceed so that every aspect of life remains unequivocably 
'equal,' no matter whether nature itself cries out against it.
In effect, 'evil' is in agreement, and advances, while 'good' is
locked in battle with itself, arguing over how many angels can 
stand on the head of a pin.

The longer we refrain from speaking out against the evils of Waco,
the more we will be faced with OKC bombings. If all of us had
protested loud and long over the Waco injustice, then there would
have been no need for the universe to balance it out with OKC.
The turbulence and/or violence of our future is dependant upon
where we draw the line, as individuals and as a society, where 
we say, "This far, and no further."

The end result of the government's promotion of GAK, or PGP's
implementaion of CMR, will not be dependent upon the aims and
goals of those promoting and developing the concepts and the
underlying methodologies behind them, but upon the willingness
or unwillingness of you and I to 'go gently into the night'
when we are faced with an opponent who steps across the line
we have drawn in the sand to represent our own beliefs and
level of personal integrity.
The more of us who are willing to compromise by 'moving' that
line, the more that Doom closes quickly around us, and we are
hung on the cross, with Nine Inch Nails.

Bianca
~~~~~~

>  -- Lucky Green  PGP encrypted email preferred.
>    "Tonga? Where the hell is Tonga? They have Cypherpunks there?"

  "Alice? Alice? Who the fuck is Alice? Is she a Cypherpunk?"






From nobody at REPLAY.COM  Wed Oct 15 01:40:12 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Wed, 15 Oct 1997 16:40:12 +0800
Subject: Equal rights for receivers
Message-ID: <199710150815.KAA25357@basement.replay.com>



Remind me again:

Why was it OK when the SENDER could choose to encrypt to an additional
key, but it's a threat to the free world if the RECEIVER is allowed to
request the same thing?






From imp at village.org  Wed Oct 15 16:46:02 1997
From: imp at village.org (Warner Losh)
Date: Wed, 15 Oct 1997 16:46:02 -0700 (PDT)
Subject: CVS: cvs.openbsd.org: ports
In-Reply-To: <14196.876929326@natasha.brandonu.ca>
Message-ID: <199710152134.PAA21613@harmony.village.org>


In message <14196.876929326 at natasha.brandonu.ca> Tobias Weingartner writes:
: I've already made a similar message to the ports list.  It was shot down.
: But maybe now that we see the "trouble" with the current setup, we can
: re-evaluate that.  Personally, I think we could share 95% of the ports
: stuff between open/freebsd, but it would be nice to have the ability to
: fix things in a local cvs tree, without having to wait for the fix to go
: through channels.

I would like to support this 100%.  This would also help with the
-lcrypt problem, et al.

Recall that bsd.port.mk already supports this.  We can start doing it
right away...

Warner





From lutz at taranis.iks-jena.de  Wed Oct 15 02:32:05 1997
From: lutz at taranis.iks-jena.de (Lutz Donnerhacke)
Date: Wed, 15 Oct 1997 17:32:05 +0800
Subject: Security flaw in PGPverify of INN (fwd)
In-Reply-To: 
Message-ID: 



* Ray Arachelian quoted:
>So please don't believe this "security flaw". pgpverify is working
>just fine and if the responsible person will use PGP correctly, there
>is no problem at all.

Please don't believe this "security flaw". Everything is working just fine
and if all users will use our software correctly, there is no problem at all.






From wprice at pgp.com  Wed Oct 15 02:38:36 1997
From: wprice at pgp.com (Will Price)
Date: Wed, 15 Oct 1997 17:38:36 +0800
Subject: proposal: commercial data recovery
In-Reply-To: <199710140937.KAA01187@server.test.net>
Message-ID: 



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Adam:

First, let me state some overriding design goals of a data recovery system
required to ensure privacy: the sender must know and consent to every key
that will be able to read the message during its lifetime, the encryption
must be end-to-end, and the recipient must know exactly who else can
decrypt the message.  The sender's privacy is paramount as it is their data
which is being trusted to the system.  These are basic principles not only
of a data recovery system, but for any cryptosystem.

The design you have been espousing for the last week or so in your many
messages takes the power out of the hands of the sender and encourages
automated violations of the sender's privacy by the recipient (perhaps even
unbeknownst to the recipient).  In your model, the recipient automatically
decrypts and then re-encrypts to a data recovery key -- even though
end-user computers are likely to be insecure thus making this decrypt &
reencrypt step rather specious at best.  The only information the sender
has before sending the message is "your message might be able to be read"
by someone else, or more likely no information whatsoever as there is no
need to put such information in the protocol as far as the format is
concerned.  Either way, the sender is thus easily led into a false
assumption of security.  The encryption is not end-to-end but rather is
completely unwrapped in the middle and then rewrapped introducing serious
security flaws, and the sender has no idea to whom the message will be
auto-reencrypted by the receiver.

As an actual data recovery system, it also fails fundamental tests.  If I
encrypt critical data to a colleague wiping it from my system after
sending, then the colleague is incapacitated before receipt and processing
of the message, the data can never be retrieved.  A data recovery system
must solve this kind of issue -- data recovery here means that from
end-to-end the data is recoverable in case of emergency.  One cannot ignore
message transit time in this -- it can take days for a message to travel
from AOL to the outside world.  If you don't need data recovery, don't use
it, but at least respect the people who do need it and need it to actually
work at all points.

>With these three principles you still have lots of flexibility because
>you can escrow storage keys

I'm truly amazed that you would attack in such a spiteful fashion a simple
system which adds a recipient-requested, sender-approved extra recipient
which is end-to-end wherein all recipients are under the sender's control
and each recipient knows who can read the message with no key escrow using
the same old PGP message format we all know and love without change, and
yet you propose a much less secure system which allows hiding critical
information from the sender and does not adequately perform its stated
purpose of data recovery.

- -Will


Will Price, Architect/Sr. Mgr.
Pretty Good Privacy, Inc.
555 Twin Dolphin Dr, Ste.570
Redwood Shores, CA 94065
Direct (650)596-1956
Main   (650)572-0430
Fax    (650)631-1033
Pager  (310)247-6595
wprice at pgp.com
Internet Text Paging: 



PGPkey: 


-----BEGIN PGP SIGNATURE-----
Version: PGP for Business Security 5.5

iQA/AwUBNESODay7FkvPc+xMEQIVuACfZwywDZSvGlsxefZuTyO6A+TFxlUAn39a
0FkpIVd4jcAIYpVNpIpofdSB
=nj0q
-----END PGP SIGNATURE-----






From I.Brown at cs.ucl.ac.uk  Wed Oct 15 04:14:42 1997
From: I.Brown at cs.ucl.ac.uk (Ian Brown)
Date: Wed, 15 Oct 1997 19:14:42 +0800
Subject: proposal: commercial data recovery
In-Reply-To: 
Message-ID: <3444A29F.A843CE5A@cs.ucl.ac.uk>



-----BEGIN PGP SIGNED MESSAGE-----

> The design you have been espousing for the last week or so in your many
> messages takes the power out of the hands of the sender and encourages
> automated violations of the sender's privacy by the recipient (perhaps even
> unbeknownst to the recipient).

Whatever you do, the recipient has the plaintext (has the argument
really descended to this level?) As Ian Grigg has pointed out, there are
*no* technical means a message sender can employ to stop the recipient
'violating their privacy'. You are splitting hairs again. As Adam has
repeatedly pointed out, there is no problem with flagging on a key that
the message may be read by someone else. This is actually more honest
than a scheme where 'this message can be read by key X' flags are used;
once the recipients have the plaintext, they can give it to whoever they
like to read. Adam's scheme does not put in place an infrastructure
which encourages automated snooping. It leaves it entirely up to
separate organisations as to whether they implement data recovery. Have
you *read* Bruce Schneier's post on how quickly GAK proponents in
Washington have picked up on this? Are you proud to have provided an
argument for S909? Are you happy to have the NSA using you as an
argument that GAK works?!!!

> The NSA states that key recovery is doable and will not jeopardize
> national security. And there is an existence proof for key recovery
> software in the new PGP release.

Adam's design does NOT "encourage automated violations of the sender's
privacy" - that I would reserve for PGP 5.5. You split hairs yet again
by claiming PGP 5.5 is "a simple system... wherein all recipients are
under the sender's control". As Adam has pointed out in his "many
posts", it's not much use letting the sender remove the extra recipient
if they know the message will then simply be bounced. Adam's request for
you to remove these fields make the system simpler. His communications
key idea adds additional security, but that is the only reason for the
increased complexity - an *additional* security feature.

This argument is exhausting. You may not give two hoots what I, or Adam
Back, or any number of people say. But could you not at least listen to
Schneier, who you must admit is quite an authority in this field? Even
if you *were* right, you have not managed to convince him. Do you really
think it's going to be good for PGP Inc if he recommends that clients
and anyone else who asks should not use PGP Inc products?

Ian.

-----BEGIN PGP SIGNATURE-----
Version: Cryptix 2.2.2

iQCVAgUBNESio5pi0bQULdFRAQEBygQArMB8FRo7wQ5HrLyw/CdHjJY2YPfnLYzw
qfSSxJEEszAnkBfMEM15VIc61QnrYSW43y/+Q5DhrS8SZteG5oDs2+x32MCPvAND
sm5k/4K20o6/aC5ZZO9mHaCZU3yY6ZGsfazop1MOgkIgp6HKnWLU73gNaQzV43T/
l4zXvCPGSAA=
=Tg/+
-----END PGP SIGNATURE-----






From zeus at alt.net  Wed Oct 15 04:39:26 1997
From: zeus at alt.net (Dr. Zeus)
Date: Wed, 15 Oct 1997 19:39:26 +0800
Subject: Stronghold
In-Reply-To: 
Message-ID: <3444A62C.22B@alt.net>



Dr.Dimitri Vulis KOTM wrote:
> 
> Adam Back  writes:
> >> > Unfortunately I wasn't on cypherpunks-unedited at the time, but I
> >> > thought that it was immediate send out from toad.com without going via
> >> > Sandy.
> >>
> >> Going over my notes I see that at least one of my submissions - the
> >> one quoting the C2Net lawyer letter in its entirety - didn't appear
> >> even on cypherpunks-unedited.
> >

Just where was the Lawyer's letter?  Did it have any telephone number
on it?  I want to call that guy and make sure it was really from him.

> >I think I saw this claim made before around the time of the "moderation
> >experiment".
> >
> >The only ways I can see that this could have happened are either that:
> >
> >  i)  John Gilmore started editing cypherpunks-unedited at Sandy/C2net's
> >      request
> >
> >  ii) cypherpunks-unedited was edited all along by someone (John or Sandy)
> >

Are John and Sandy still sucking and fucking each other?

> >i) is sort of feasible, perhaps there are others who were on unedited
> >and were counting who could confirm this.  Toto I think was.
> 
> Apparently a 'bot was installed on toad.com to discard my submissions from the
> "unedited" list _after my article which prompted the C2net threatening lawyer
> letter did make it through the "unedited" list (but was censored from the
> "flames" list by C2Net).
> 
> >ii) is hard to believe because the fact that something is edited shows
> >-- when the editor is sleeping you get lag.
> >
> >I'm fairly sure I didn't see the C2 legal letter you posted yesterday
> >before.
> 
> I'm sorry to have to return to this topic that's been beaten to death and
> causes me intense nausea. I figured I'll comment on two more attempts to
> revise history by lying C2Net shills from Hewlett Packard and Oracle.
> 
> Please recall that C2Net created 3 lists on toad.com:
>  unedited
>  flames
>  C2Net-approved
> 
> At one point, all my submissions to cypherpunks appeared on "unedited" and
> then on "flames" with about a 3-second delay, indicating a 'bot at work. The
> 'bot was scrubbed when C2net decided that my writings were not suitable for
> auto- forwarding to the "flames" list either. For about a week, numerous
> articles by myself, Tim May, et al appeared on "unedited" but not on "flames".
> 
> Howver toward the end of the "moderation experiment" apparently a 'bot on
> toad.com was filtering my submissions from the 'unedited' list as well. My Jan
> 30th announcement that C2Net filtered out of the flames list _did show up on
> the unedited list. However my following articles, like the one quoting C2Net's
> threatening lawyer letter (which I cc'd to numerous people, including JYA,
> who, not surprisingly, declined to put it on his archive) did _not appear on
> the "unedited" list. Nevertheless at least one lying C2Net shill from Hewlett
> Packard claims that my articles appearing on the unedited list on January 30th
> prove that I wasn't being filtered from "unedited" one week later.
> 
> Another lying C2net shill, Jason E. Durbin, a technical writer for Oracle,
> just wrote in news.admin.net-abuse.policy:
> 
> }For those unfamiliar with the tactics Vulis uses when attempting to
> }destroy moderated fora, take a look at the current, ongoing thread
> }called "Stronghold" (and other variations on same) on the Cypherpunks
> }mailing list archived at:
> }
> }http://infinity.nus.sg/cypherpunks/current/date.html#start
> }
> }It summarizes (including Vulis' take on the situation) Vulis' attack
> }on the mailing list itself via a feigned attack on the Stronghold
> }security server.
> }
> }In summary, make such an annoyance of yourself by whatever means
> }necessary (posting binaries, running an insultbot, making false
> }accusations, etc.) to get yourself threatened with banishment, then
> }rally the free speech advocates by painting yourself as the innocent
> }harmed party even though no banishment occurred.
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> }
> }Interesting insights into how Vulis attempts to manipulate his victims
> }into damning themselves while making him look like a victim.
> }Interesting reading.
> 
> "No banishment occured" - more bizarre lies from C2Net and their supporters.
> 
> Oh, and I don't recall sending binaries to this list either.
> 
> This reminds me of the claim by Rich Graves, another C2Net/Cygnus shill, that
> I'm sending "hundreds" of articles a day to this mailing list.
> 
> You may recall that the same C2net/Oracle shill Jason Durbin has been
> following up on my Usenet articles in sci.crypt, comp.unix.questions, etc
> with lies and libel: claiming, e.g., that I "lie about my credentials",
> that I don't even have a master's degree, etc. Is C2Net paying Jason Durbin
> to badmouth my academic credentials?
> 
> >From Jason Durbin's Net.Scum page:
> 
> Jason E. Durbin, jdurbin at nl.oracle.com, jed at poisson.com,
> slothrop at poisson.com, jed at best.com, jed at netcom.com.
> 
> Jason claims to work for Poisson Corporation, 8 Avocet Drive, #211, Redwood
> Shores, CA 94065, tel +1 415 637 0435, JD503.
> 
> In real life, Jason is a lowly technical writer for Oracle Corporation, 500
> Oracle Parkway, Redwood City, CA 94065, tel: +1 800 345 3267, +1 415 506 7000,
> (+1 605 506 7000), fax: +1 415 506 7200.
> 
> Jason's manager in the technical writing department is:
> Sanford Dreskin
> Mail Stop:  MS-40P12
> Office tel: +1 415 506 2181
> Office fax: +1 415 506 7228
> Home tel: +1 510 376 9526
> Home addr: 859 Augusta Drive, Moraga, CA 94556-1051
> 
> In what ways are Durbin and the Hewlett-Packard liar affiliated with C2Net?
> 

Yes, this c2Net needs investigated as a troublemaker.

> ---
> 
> Dr.Dimitri Vulis KOTM
> Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps







From zeus at alt.net  Wed Oct 15 04:43:06 1997
From: zeus at alt.net (Dr. Zeus)
Date: Wed, 15 Oct 1997 19:43:06 +0800
Subject: Statists trying to outlaw anonymity and privacy
In-Reply-To: <199710140633.GAA13279@manifold.algebra.com>
Message-ID: <3444A8EA.B0E@alt.net>



Igor Chudov @ home wrote:
> 
> Dear Friends,
> 
> As many of you no doubt know, a new moderated group,
> comp.org.cauce, has been proposed. One of the main goals
> of moderators is to prevent users of one-way anonymous
> remailers and those who munge (alter) their addresses
> to avoid being spammed, from posting to the group.
> 
> Their proposal would force users to reveal their Internet
> identities and expose them to spam.
> 
> The proponents hope, apparently, that the more spam people
> get, the more will they support CAUCE's statist lobbying for
> more government regulations.
> 
> During the discussion they have shown complete disregard and
> ignored all requests from users who attempted to help them
> accommodate anonymous posting. To get more YES votes, they
> removed the most controversial provisions from the charter,
> while IN THE SAME DAY promising that these provisions will
> still be enforced.
> 
> As someone who defends privacy and anonymity  on the Internet,
> I ask you to vote on this important matter. I will vote NO
> on this newsgroup.
> 
> Feel free to repost this message to any fora you deem appropriate.
> 
> To find the Call For Votes, go to news.groups newsgroup, and find
> article titled "CFV: comp.org.cauce moderated". You will find the
> charter and the instructions on how to vote.
> 
> Thank you for your attention.
> 
>         - Igor.

I say we bomb the shit out of the newsgroup if it gets formed.
We need a new newsgroup flooding and blasting.

Those basdtards like CAUCE who try to censor make it very
legal to take the gloves off and just wipe them out with
mailbombing and SYN and ping attacks!!!

KILL CAUCE!!!  They are all mostly Pedophiles!

-Dr. Zeus






From delta7 at onlinebiz.net  Wed Oct 15 19:44:32 1997
From: delta7 at onlinebiz.net (delta7 at onlinebiz.net)
Date: Wed, 15 Oct 1997 19:44:32 -0700 (PDT)
Subject: "21 Days To Freedom"
Message-ID: <199710160244.TAA26376@toad.com>


How do you feel about taxes?

Every dollar you save in taxes is...

MONEY IN YOUR POCKET.

Do you want to learn how to legally save a FORTUNE in taxes...starting TODAY?

We will show you how to BUILD WEALTH QUICKLY.  And protect your assets.

You will never worry about creditors, ex-spouses, or government intervention
again.  

CREATE FREEDOM for yourself.  NOW.

This information is available to taxpayers in the United States, and also foreign countries.

For an exciting FREE REPORT, please send any e-mail message to Strikegold at answerme.com.  You will receive your FREE REPORT immediately.





From jkatz at cpio.org  Wed Oct 15 20:02:27 1997
From: jkatz at cpio.org (J. Joseph Max Katz)
Date: Wed, 15 Oct 1997 20:02:27 -0700 (PDT)
Subject: Document on Customizing OpenBSD after install
In-Reply-To: <199710152020.PAA24415@unet.unet.umn.edu>
Message-ID: 


Re...

In the coming weekend, I'll be updating the newuser FAQ
(for things like PPP and 2.2). I'm sure a post-install checklist would be
a welcome addition.

B U T . . . .

Not everyone runs things like Kerberos or DNS. Keep in mind that many
people use OpenBSD for many things and in many environs. The OpenBSD setup
on my firewall at the office is much different than the Sparc, Alpha, and
P5/133 I run it on at home. The setup on my router machine at home is also
much different than the other machines in my house. There are ways people
have setup OpenBSD on embeded systems to do things like manage the
fuel/air mix ratio on their Corvettes (OK, one person I know of planned
that, but couldn't get the financing for the car...) I hope that draws the
picture.

As for the verification after install, that is sort of "auto-manditory"--
if a filesystem isn't mounted right, /etc/fstab has to be checked out. If
the network doesn't work, the network files must be examined to "make it
go." As oopposed to attacking this as a checklist, how about it is
attacked as "If networking doesn't work, check hostname.(interface)"-- but
there is more to that then just files in /etc (boot -c in order to
reconfigure hardware addresses)

/----------------------------------------------------------------
/ Jonathan Katz, jkatz at cpio.org         /  http://www.cpio.org
/ Student, Unix geek, Security guy      /  http://posse.cpio.org
/ President and Founder: Corinne Posse  /  http://jon.katz.com
/ Phone: +1 (317) 590-7092              /  "OpenBSD: Secure!"
/     "The meek may inherit the earth,      
/             but Gale and I will seize the stars!"

On Wed, 15 Oct 1997, Marshall Midden wrote:

> Is there a checklist someplace on what to do after the install of OpenBSD 2.2?
> 
> I'm thinking like:
>    1) Go into /etc
> 	a) Verify disks and network interfaces configured correctly.
> 	   Files: fstab, hosts, myname, hostname.le0, mygate, resolv.conf, defaultdomain.
> 	   You might wish to turn off multicast routing in /etc/netstart.
> 	b) Edit motd to make lawyers comfortable and delete "Welcome".
> 	c) Fix passwd via "vipw" to change passwords, set up users, etc.
> 	   Make sure password on "root".  Default is no password from console, and
> 	   disabled from network.  Make sure to edit "group" for any user groups,
> 	   and to put people into the wheel group if they need root access.
> 	d) Any local configuration change in: rc.conf, rc.local
> 	e) printcap, hosts.lpd	Get printers set up
> 	f) Tighten security:
> 		fbtab		Set security for X
> 		inetd.conf	Turn off extra stuff, add that which is really needed.
> 		rc.securelevel	Turn on Network Time Protocol.
> 	g) kerberosIV		Get kerberos configured.  Remember to get a srvtab.
> 	h) aliases		Local mail delivery (set postmaster, etc).  Run newaliases
> 	   after changes.
> 	i) bootptab		If this is a bootp server.
> 	j) ccd.conf		If using concatenated disks (striped, etc).
> 	k) exports		If this is an NFS server.
> 	m) NIS (old yellow pages), hosts.equiv, defaultdomain, etc.
> 	n) ifaliases for www, etc.
> 	o) daily, weekly, monthly.
> 	p) "amd" directory if using this package.
> 	q) rbootd if needed for remote booting (ethernet MAC address to IP translation).
> 	r) Any other files and directories in /etc.
> 
>    2) crontab -l.		Do you need anything else?
>    3) After the first nights security run, change ownerships and permissions on things.
> 	Best bet is to have permissions as in the security list.
> 






From iverson at usa.net  Wed Oct 15 06:15:17 1997
From: iverson at usa.net (Casey Iverson)
Date: Wed, 15 Oct 1997 21:15:17 +0800
Subject: Stronghold
Message-ID: <3.0.16.19971014090056.5787e0a8@pop.netaddress.com>



At 02:35 PM 10/12/97 -0400,John Young wrote:

>Dimitri, Allah bless his carcass, is a learned and deft provocateur.

Wrong!

Vulii is a KGB loving, decrepid, diseased ridden  sack of Russian puss and
excrement.
His only reason for existence is to spread lies, disinformation, and filth.
He shouldn't have  the protection of the U.S. Constitution and the
toleration of this list.






From jf_avon at citenet.net  Wed Oct 15 06:52:16 1997
From: jf_avon at citenet.net (jf_avon at citenet.net)
Date: Wed, 15 Oct 1997 21:52:16 +0800
Subject: Bill Gates and Gun laws
In-Reply-To: <199710141949.NAA06963@broadway.sfn.saskatoon.sk.ca>
Message-ID: <199710151352.JAA13494@cti06.citenet.net>



> 
> Cdn-Firearms Digest     Tuesday, October 14 1997     Volume 02 : Number 031
> cdn-firearms-digest at sfn.saskatoon.sk.ca
[mega-snip]
> ------------------------------
> 
> Date: Tue, 14 Oct 1997 12:43:32 -0600
> From: Dave Hammond 
> Subject: FW: USA - Bill Gates wants your guns
> 
> Don't like Bill Gates or his octopus like grip on the software market? Been 
> looking for a reason to give Microsoft the finger and shop elsewhere? Well, 
> here it is.........
> 
> 
> by HUNTER T. GEORGE
> OLYMPIA, Wash. (AP) - A gun-control measure on the Washington ballot has
> turned into a Western shootout in this state, where nearly one out of
> five residents owns a pistol.
> In this gun battle, the two sides are armed with cash and
> soundbites.
> On one side is the state medical association, law enforcement
> leaders, religious groups, the state's largest teachers union and
> Microsoft chairman Bill Gates, among other Seattle-area business
> leaders.
> They back the measure, which would require handgun owners to
> pass an exam or take an eight-hour safety course to get a license.
> It would also require trigger locks on all handguns sold or
> transferred in the state.
> On the other side are gun rights organizations, like the
> National Rifle Association, and police groups, which say the
> measure is an invasion of privacy, an infringement of the right to
> bear arms and a smokescreen for a hidden agenda: registration and
> eventual confiscation of handguns.
> ``What they're doing is basically using children and hiding
> behind a phony handgun safety ballot title,'' said Alan Gottlieb,
> chairman of the Bellevue-based Citizens Committee for the Right to
> Keep and Bear Arms. ``These people don't want education. They want
> to make it very hard for people to buy a handgun or use one, and
> that's exactly what this initiative does.''
> If voters OK the measure on the Nov. 4 ballot, Washington will pass some
> of the strictest gun laws in the nation.
> Only a dozen states require some sort of handgun permit or
> license, and just two - Massachusetts and Connecticut - have passed
> laws requiring trigger locks, but only at the retail level. Washington's
> would require them on all guns sold, even person to person.
> Nine of the nation's largest gun makers announced Thursday that
> they would provide childproof locks with all of their new handguns
> - - about 80 percent of those sold in the United States. President
> Clinton has pushed for legislation requiring the locks, but House
> and Senate committees rejected the provision earlier this year.
> No public polls on the measure have been released so far, but
> some of the richest people in the state back it: Gates gave
> $35,000; his father, lawyer William H. Gates, donated $150,000, and
> philanthropist Harriet Stimson Bullitt contributed $50,000.
> The safety requirements, they say, would be like taking a
> driver's test before getting a license. The goal is to reduce
> accidental shootings, particularly those involving children who find
> loaded guns in the home.
> A study in the Journal of the American Medical Association found
> that 30 people 19 or younger died in unintentional shootings in
> Washington state between 1991 and 1995. And 211 others were
> hospitalized for gunshot wounds.
> `I'm personally unwilling to tolerate that kind of carnage in
> our state,'' said Dr. Roy Farrell, campaign spokesman and a gun
> owner. ``Terrible tragedies happen that shouldn't happen if the gun
> was stored properly.''
> 
> ------------------------------
[snip]
>  Mailing List Commands:        majordomo at sfn.saskatoon.sk.ca






From nobody at REPLAY.COM  Wed Oct 15 07:11:36 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Wed, 15 Oct 1997 22:11:36 +0800
Subject: Telstra Australia admits it lied about net
Message-ID: <199710151403.QAA28893@basement.replay.com>



Of course any stats put forward by Telstra are probably a complete 
fabrication. Telstra's arrogance exists due to its century long
tradition of government backed monopoly resulting in a drain on
Australia's resources and misallocation of capital on such a scale
it defies imagination. It is par for the course for Telstra to now be 
seeking funding from US taxpayers/consumers. (PS. I heard the same 
figures you quote below being bandied about here about a week or so 
ago.)

Bill Stewart writes:
> According to an article in today's Mercury News or SFExaminer,
> Telstra has also decided that 70% of the bits on US-Australia
> Internet connections are now going from Australia to the US
> rather than the earlier ~100% US->Australia direction -
> so it wants a major reevaluation of who pays for the
> trunks connecting the Internets in the two countries
> (currently Telstra pays most of the costs.)






From courier at message4U.com  Wed Oct 15 22:14:21 1997
From: courier at message4U.com (courier at message4U.com)
Date: Wed, 15 Oct 1997 22:14:21 -0700 (PDT)
Subject: Start Saving Now...
Message-ID: <199710160402.VAA24069@nevwest.nevwest.com>


Dear Money Saver..


Are you..


Paying MORE than 9.9 Cents Per Minute For Long Distance or 888/800 Service ?

Paying a monthly minimum or access charge for your long distance
or for an 800/888 number ???

Getting 6 second increment billing  ???


If  NOT...


Give us a call...


We can get you the service
Without the hassle
Without the games
Without the extra charges

Pay LESS For Phone Service (s)

(812) 949-2205

NOON - 10 PM
EDT
MON - FRI


OR VISIT: http://www.cyberamish.com


courier at message4U.com


P. S.  We also have a SUPER RATE on phone cards...19 CENTS PER MINUTE !
          


NONE OF THE ABOVE PHONE SERVICES INVOLVE MULTI-LEVEL MARKETING




TO BE REMOVED FROM THIS LIST
REPLY TO THIS MESSAGE & TYPE
REMOVE IN SUBJECT AREA ONLY






From kent at bywater.songbird.com  Wed Oct 15 07:46:09 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Wed, 15 Oct 1997 22:46:09 +0800
Subject: Technical Description of PGP 5.5
In-Reply-To: <3.0.3.32.19971015004322.0068ca64@popd.ix.netcom.com>
Message-ID: <19971015071258.47724@bywater.songbird.com>



On Wed, Oct 15, 1997 at 12:43:22AM -0700, Bill Stewart wrote:
> Jon Callas presented a technical description of PGP5.5 at this 
> month's Bay Area Cypherpunks meeting, as well as flak catching on the 
> politics discussion; Phil Zimmermann and other PGP folks also helped.
> This posting is an attempt to summarize the technical parts
> and leave the politics for other messages.  Perhaps there's been some
> technical discussion on OpenPGP, but feel free to forward this there if not.

No, there has been little technical discussion.  Maybe I've missed 
it, but I haven't seen from Adam a succint writeup of what his design 
actually is -- most of what he writes is so inflated with steaming 
anti-GAK rhetoric that it's hard to get a coherent picture.  Perhaps 
he will take your example to heart, and post a strawman design, and 
leave the politics to other messages.

> 1) PGP 5.5 API Toolkit -  It's the core of the PGP5.5 GUI and SMTP tools.
> 	It'll be out Real Soon Now.  It's a major change from the 
> 	PGP 5.0 Toolkit, which is based on ViaCrypt's older code.
> 	The toolkit knows about all the features in the message
> 	formats, so even if the application programs from PGP
> 	don't provide a given friendly or hostile feature,
> 	you can still write it yourself, and so can the Bad Guys.
> 
> 2) PGP 5.* message format - unchanged - uses the multiple recipients,
> 	without any indication of or dependence on relationships
> 	between the recipients.  The format is approximately
> 		Recipient Record 1 - KeyID1, E(sessionkey, PubKey1)  ....
> 		Recipient Record N - KeyIDN, E(sessionkey, PubKeyN)
> 		Message - E(Message, sessionkey)
> 	KeyID is the 32-bit KeyID, rather than a fingerprint.
> 	I don't know if the format or the PGP 5.x software can 
> 	generate or accept messages with recipient records for
> 	two different keys with the same keyid (or whether it matters
> 	if the keys are for DH*, RSA, or both.)
> 		* DH can be spelled "E L  G A M A L" -- Blame Cylink :-)
> 
> 	While 5.0 did introduce new data formats, they're not stealthy,
> 	and features like the SMTP filters depend on being able to
> 	know how many recipient-key records a message contains,
> 	where their boundaries are, and what their KeyIDs are.

Correct me if I'm wrong, but this seems to imply that the CMR fields 
in the key structure are really just a convenience -- if PGP, Inc. 
didn't write an smtp filter that enforced a CMR key, someone else
(say a firewall vendor) could do so easily, defining whatever 
relationship between keys they wanted.

To make that a bit stronger, it seems like *any* model that uses 
persistent encryption keys essentially enables CMR-like functionality 
in a smtp filter -- it could be done using pgp 2.6.

And therefore, PGP Inc might as well get the business, because if 
there is demand, someone will.

In the meantime they can work on perfect forward secrecy.
[...]

> - Customers -
> 	Some of the customers do want to "recover" all their users' 
> 	traffic. Others wanted to make sure that mail to a customer 
> 	service rep got encrypted to the other customer service reps 
> 	also, or at least to the rep's boss, so someone could handle
> 	the business if the original recipient was away.
> 
> 	One of the more obnoxious customers was implementing CAK by
> 	having the Corporate Security department generate keys and
> 	hand them to the users on floppies; this gives them a less
> 	obnoxious approach that they're willing to try.
> 
> 	One of the customers was really paranoid about making sure
> 	their employees didn't leave their CAD drawings encrypted
> 	and then steal them or extort money from the company for
> 	decrypting the plaintext when they quit; apparently the
> 	idea of using a document management system like programmers
> 	use for source code control had never occurred to them....

Things aren't that simple.

In any case, in large organizations (corporate or government) one of
the biggest motivations for snooping is prevention of management
embarassment.  It's seriously embarassing, for example, to read in the
paper in the morning that one of your employees has been maintaining a
public ftp porn archive on the company computers....you can fire the
employee, but the damage has been done.  

It's a cold fact that some employees are stupid, and others are bad. 
Snooping is more a result of this fact than it is innate evil on the
part of management. Of course it is nicer to work in a trusting 
environment, but the problems go both ways.

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From nobody at REPLAY.COM  Wed Oct 15 07:54:27 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Wed, 15 Oct 1997 22:54:27 +0800
Subject: No Subject
Message-ID: <199710151440.QAA03381@basement.replay.com>



Brief Background: In the last two months Australia (at this time under
a so called conservative Liberal Government) has re-affirmed its
anti-market controlled economy approach to economics with the
establishment of an IT bureaucracy, forcing ISP's to 'join' the TIO
and fund its operations, establishing the framework for a possible
cencorship regime on the internet, proposed legislation for key
escrow wrt VPN's and pursuing its favoured entrail reading approach to
economics by yet again believing it can 'pick winners' in the market
and allocate resources more efficiently than the market can; an
approach any socialist or totalitarian would be proud to support.

There is very little organised effort to oppose these measures. I
expect that people elsewhere will soon be able to look to Australia as
a testing ground for all the worst case scenarios long discussed on
cypherpunks.

Now the State has announced it's intention to forcefully mandate
authentication on the internet by imposing yet another taxpayer funded
bureaucracy and to hell with the market solutions already provided at
no cost to citizens. Shame on you Australia.

(Are politicians genetically selected on their ability to make
precisely the wrong decision in any given circumstance? Actually wrt
authentication there is no problem to solve. Doing nothing was the
best thing to do. Of course what this is really about is limiting
entry to markets, corruption and fraud on the public.)

http://www.theage.com.au/daily/971015/news/news7.html
Push to tie up loose ends on Internet

                               By GERVASE GREENE, 

                               Canberra 

Online commerce may exceed $6 billion by 2001, but it will be of
little use if customers and businesses cannot identify each other on
the Net.

Federal Cabinet yesterday approved steps to create a national system
for online authentication.

The Government will establish a body to oversee all authentication
systems.  The Communications Minister, Senator Richard Alston, said
this would significantly boost electronic commerce.

"With predictions that electronic commerce in Australia will increase
more than four-fold to $6.3 billion by 2001, the Government is well
aware that development of trust and confidence by businesses and
consumers in the reliability and security of online transactions will
be critical to the development of the information economy," he said.

A group of industry and government experts will report by March next
year on possible functions and powers of the watchdog. This will
include determining the technical standards required before an
identification system obtains certification. Several corporations have
marketed safety systems to exploit concern about the safety of online
transactions.

Sophisticated encryption will also be necessary before certification
is granted.

Civil liberty groups have called for anonymous transactions to be
possible, while law enforcement bodies have sought access to records
and transactions that would amount to an effective exemption from
privacy obligations.








From giff at va.pubnix.com  Wed Oct 15 08:26:46 1997
From: giff at va.pubnix.com (Frank (Giff) Gifford)
Date: Wed, 15 Oct 1997 23:26:46 +0800
Subject: Encryption Program (fwd)
Message-ID: 



(I had only sent this to the 'other' mailing list and not here - my
appologies to those who get this for a second time.  -Giff)


On Mon, 13 Oct 1997 semprini at theschool.com wrote:

> Hello. I just posted an encryption program on the web. It uses a key-
> generated pseudorandom stream of characters that get XORed with the 
> plaintext to produce the cyphertext. For decryption, the same stream 
> is run against the cyphertext. (Such is the nature of the XOR 
> operation.) You can download the program at:
> 
> http://www.brigadoon.com/~semprini/3dmx
> 
> I am interested in other people's views, comments, questions, etc. on 
> this program. Any questions, comments, etc. can be sent to me at 
> "semprini at theschool.com".
> 
> Thanks,
> 
> Dylan
> 

I have downloaded the program and read over it's contents (the .frm
files).  It's Visual Basic, which I am familiar with.

>From my reading of the code (assuming that the code I read was, in fact,
the code which does the encrypting) - the key supplied is not used - or at
least not directly.

The user apparantly supplies three keys which are padded with 'random'
stuff each to get them to 32 bytes in length.  Then these are placed into
a special array where each bit gets its own position and various scrambing
is done 'randomly' on the data.  This is dependent on the key values and
what bits are on or off at a given time.  During this process, the 'seed'
for the RNG is reset to some unknown value (I believe the effective range
for the seed is 0..65535) the entire time the bits are processed.

Then, amazingly, those bits are not used again.

>From the RNG, a 4 dimensional array (called a 'cube') is created with
elements 0..15 for each of the four sides.  The contents are filled from
the RNG with a value 0..255.

Then during the encryption process of a file, the program will choose four
random numbers 0..15 to use as indexes into the cube.  The number found
there is XORed with the datafile byte to get the encrypted/decrypted
answer.

*whew*  Hope you followed that, I'm trying to be complete and concise.

The upshot seems to be (and I haven't written any code to try this out
yet):  This method fails to the chosen plaintext attack where I ask the
opponent to encrypt a large file of (say) all zero bytes.  The encrypted
result I should then be able to XOR directly against the target file to
get the original contents.

A less efficient but more satisfing method is to simply try all seed
values for the RNG.  Even if I don't know the RNG process, if the seed
values are only 0..65535 (as I believe they are), trying all possible
decryptions by this manner will give me the correct answer.  If I know
something about the file (i.e. being English text) I should have no
problem finding the right answer programmatically.

If I am incorrect about my reading of the program or its operation, please
let me know.

-Giff







From cynthb at sonetis.com  Wed Oct 15 08:32:05 1997
From: cynthb at sonetis.com (Cynthia Brown)
Date: Wed, 15 Oct 1997 23:32:05 +0800
Subject: Puerile Forgery (was: Re: Cole Harbor Students)
In-Reply-To: <343E4B61.6FE8@bone_dis.com>
Message-ID: 



On Fri, 10 Oct 1997, someone from sk.sympatico.ca wrote:

> Boy, do I feel like an idiot.

Just in case some people don't read headers, that message DID NOT come
from me. 

Cynthia
===============================================================
		   Cynthia H. Brown, P.Eng.
E-mail:     cynthb at iosphere.net  | PGP Key:  See Home Page
Home Page:  http://www.iosphere.net/~cynthb/
Junk mail will be ignored in the order in which it is received.

        Klein bottle for rent; enquire within.






From scannmann at nevwest.com  Wed Oct 15 23:42:58 1997
From: scannmann at nevwest.com (scannmann at nevwest.com)
Date: Wed, 15 Oct 1997 23:42:58 -0700 (PDT)
Subject: Free Sex Test Drive !
Message-ID: <199710160641.XAA19293@nevwest.nevwest.com>


============================================
WARNING! ADULTS ONLY!
This site contains Sexually Oriented Material. By entering this site you're consenting 
that you're over 18 and approve the viewing of adult material. 
============================================

Hi my name is Lisa ! I would like to let you know about the hottest adult web site on the web, rated top 10 with FREE LIVE STRIP & STEAMING VIDEO CONTENT with lesbian, gay, fetish, domination, bizzare, group sex, one on one, we have to much to list. See to believe 1000+ hot pics & more. Also hot phone sex like this 1-800-LICK-CUM  check it out FREE, FREE, FREE !!! 

http://www.69her.com    http://www.cyberhardcore.com






From tm at dev.null  Wed Oct 15 09:10:00 1997
From: tm at dev.null (TruthMonger)
Date: Thu, 16 Oct 1997 00:10:00 +0800
Subject: Security flaw in PGPverify of INN (fwd)
In-Reply-To: 
Message-ID: <3444E254.25F0@dev.null>



Lutz Donnerhacke wrote:
> * Ray Arachelian quoted:
> >So please don't believe this "security flaw". pgpverify is working
> >just fine and if the responsible person will use PGP correctly, there
> >is no problem at all.
 
> Please don't believe this "security flaw". Everything is working just fine
> and if all users will use our software correctly, there is no problem at all.

I am writing:
Please don't believe this "security flaw". democracy is working
just fine and if the responsible person will use democracy correctly, 
there is no problem at all.

Tmongruther
[Government Email Montior National Security Approval # CP709-PC]
[Inspected by # 13]







From rah at shipwright.com  Wed Oct 15 09:11:52 1997
From: rah at shipwright.com (Robert Hettinga)
Date: Thu, 16 Oct 1997 00:11:52 +0800
Subject: Clinton - Gore selling out Internet to ITU to Preserve Key EscrowEncryption?
Message-ID: 




--- begin forwarded text


Date: Wed, 15 Oct 1997 09:01:54 -0400
Reply-To: cook at netaxs.com
Originator: com-priv at lists.psi.com
Sender: com-priv at lists.psi.com
Precedence: bulk
From: Gordon Cook 
To: Multiple recipients of list 
Subject: Clinton - Gore selling out Internet to ITU to Preserve Key Escrow
Encryption?
X-Comment:  Commercialization and Privatization of the Internet

A COOK Report Editorial

Exceedingly strange events are underway inside the Beltway. By January of
this year a coalition of industry figures had decided that IAHC was a
cabal of internet old timers out to create a clique that could impose a
DNS "socialist" solution. This solution, they claimed, would ensure the
failure of any private enterprise led initiatives to open a true free
market in DNS services. They convinced the Clinton Administration to
intervene to stop the cabal from what they also alleged was its threat to
American sovereignty. Namely that, in involving the ITU as the repository
of its MOU, it sought to deliver control of the Internet into the hands of
a stodgy bureaucracy which was in fact an enemy of the net.

Fast forward through eight months of Clinton Administration meddling and
we have some rather shocking results beginning to emerge. The Inter Agency
Working Group on DNS issues is drafting a report that says IAHC was right
after all and that just a few tweaks are needed to open up the process.
The draft shows no understanding of the DNS issues themselves and comes up
with no clear alternatives to the much scorned WIPO role in DNS dispute
resolution. These matters are now coming out into the open. In an article
yesterday in Communications Week International, Ken Cukier writes: "They
[the IAHC] laid a decent foundation and [we] need to modify the plan to
build on that foundation," said Ira Magaziner, a senior adviser on
Internet matters to President Bill Clinton. The IAHC seems "open and
flexible" to the idea of changing portions of the plan based on increased
Internet community input, Magaziner added." The article goes on to explain
how the Administration is embracing the hated IAHC process that its
intervention was initially designed to halt.

But we remind our readers that another concern that led to government
intervention was not just anger over IAHC but also fear of the ITU. But no
problem, the fear of the ITU seems to be no more. We quote below from a
just published interview with Pekka Tarjanne, the ITU Secretary General
from Finland. While the IAHC initially promised that the only role of the
ITU would be to act as repository for signatories to the MoU on DNS, Pekka
Tarjanne now foresees the ITU as the most likely repository for all
internet governance functions - including getting into issues of content.
Brian Kahin and Mike Nelson have turned the enemy into the friend. Why?
Such are the wondrous ways of life in DC. NTIA has been given the green
light to shape internet policy within the US. To hell with the Congress,
the FCC and the NSF.

[Speaking of collateral congressional problems, we'd certainly like to see
someone sue NSI to prevent the return of the 23 million from the
infratsructure fund to NSF for NGI use.]

We expressed our dismay about this last week in an open letter to NTIA
head Larry Irving. We must have struck some raw nerves, for when Dave
Farber posted our original complaint to Irving on his IP list, we received
a few days later the following delightful reply (posted by Dave again to
his list.)

Date: Tue, 14 Oct 1997 11:14:52 -0400
From: "Gregory C. Simon" 

Cook: "Gregory Simon." Hmmm. Domestic affairs advisor to Al Gore? On the
wrong side of privacy issues? Not much beloved by EPIC. On the wrong side
of information issues. Point man for the administration a year ago at the
WIPO meetings in Geneva, where the justly defeated treaty would have given
publishers copy rights over virtually everything. See www.cic.org. Seems
that Greg has left the White House and is working for the lobbying firm
run by John Podesta's brother? Meanwhile John Podesta continues to work on
the inside as one of President Clinton's most intimate advisors. In charge
of Bill's daily schedule we are told. Greg seems to be offended that I am
not a cheer leader for his ex-employer's policies.

Simon: Dear All: The open letter from Gordon Cook to Larry Irving is
profoundly misguided and uninformed. The basic premise is ludicrous --
that Henry Geller somehow set the parameters of NTIA's authority by his
personal views.

Cook: No. Wrong the premise was that Geller as first head of NTIA was
fully in favor of the conditions agreed upon for its founding. That it
could be an advocate for the desires of the President in telecom matters
but that it would NOT make and originate policy.

Simon: NTIA is the voice of the Administration on many matters but it is
also part of the brain. During my tenure in the White House with Vice
President Gore, we relied heavily on NTIA's institutional knowledge and
analytical skills in formulating and executing policy decisions.

Cook: In other words with NTIA as the brain, this administration, uses it
to make policy.

Simon: Larry Irving in particular has been astoundingly and unerringly
prescient in identifying policy areas that will rise to the top of the
public policy debate. His views have often carried the day with the
President and Vice President.

Cook: NTIA making telecom policy again contrary to the views of the
original founders. I haven't talked to Elliot Maxwell at FCC, but Greg,
you might like to give him a call. I am told that he shares these same
views. And I am told this by someone who participated in the policy making
at NTIA's founding with whom I have just had a conversation tonight.

Simon: In my dealings with NTIA on the DNS issues I have detected none of
the prejudice Mr. Cook asserts. Reading symbolism into such simple
gestures as granting additional comment time and giving great weight to
every bit of gossip emanating from a free give and take discussion within
the government smacks of clinical paranoia.

Cook: No Greg. It's having good sources who are so disgusted by the lack
of cluefulness on the part of the administrations policy makers that they
talk. I knew this was coming down the pike. Cukier's article published
yesterday confirms it.

Simon: Finally, is it necessary to wave the bloody shirt of encryption
into every policy debate no matter how remote? Must everything be related
to a government conspiracy to read your mail?

Cook: Given the slipperiness of this Administration, I stand by what I
said on this issue. If the minions of the administration, of which you are
clearly one, can strip internet policy making away from NSF and Congress,
then they can march ahead with their intent to give Freeh and Ft George
Meade the keys to the private communications of every American citizen.
And since Kahin and Nelson have decided to deliver the Internet via IAHC
to the ITU after all, we could all wake up one day and find the keys to
our most private correspondence turned over to an international
organization called the ITU, which uses its treaty power like the World
Trade Organization to overrule the sovereign power of the US Congress. The
shame is that Ira Magaziner doesn't yet realize what Kahin and Nelson are
doing to him. Note that the ITU also reflects the views of many European
governments are far less willing than our own to even give lip service to
the concerpt of a free Internet.

Cook: Before you reply that I have lost my mind, Greg read the cogent
paragraphs of the interview with ITU Secretary General Tarjanne below
where the good man, sensing victory, says that he foresees the ITU playing
a major role in Internet governance and foresees the possibility that the
ITU may get involved not only in conduit but content as well. Someone
exceedingly well familiar with ITU policy making noted in another
conversation tonight that the ITU constitution has long allowed controls
over encryption or in other instances has explicitly forbidden encryption
and that the ITU has the tools for coordinating such restrictions
internationally.

Simon: Surely there must be a more honest way to disagree than to impugn
everybody's motives all the time. And as for being cut off at the knees, I
personally repudiate Mr. Cook for bringing that level of vileness and
personal animus into the debate on a policy issue. Larry Irving has
devoted his professional career to public service, he deserves respect,
not threats.

Cook: Rather than turn my accusations into a personal attack, why you tell
us what the real policy of the administration is on these matters, if it
is indeed other than what I allege?

Cook: No I just put together what I hear from highly credible and
distinguished sources who for their own reasonss cannot go on record.and
reflect that against my belief that the government must never try to take
control of the internet. If it means saying that the high and mighty have
no clothes, so be it.  No matter. The cozy dance continues. Don Heath has
announced that next INET conference will be held in Geneva at ITU
headquarters.

Cook: Now it also looks like we owe Charles Pickering, the Republican
Chairman of the House Science Subcommittee on Basic Research, a debt of
gratitude for the hearings of two weeks ago. Problem is the double dealing
alleged there is not going on with IAHC. Sernovitz was wrong to accuse Jon
Postel of wanting to ship US developed assets to Geneva. It would seem to
be the White House that is the double dealer and the one ready to give
American assets to the ITU.

Sincerely,

Greg Simon

(In the interest of full disclosure, Mr. Simon, President and CEO of Simon
Strategies is a consultant to SAIC, the parent company of Network
Solutions.)

Cook: In the interests of full disclosure let it be said that we drank at
the federal till for 18 months working for the US Congress Office of
Technology Assessment and  driving from NJ to a rented bedroom on Capitol
Hill every week. Since March 1, 1992 we have published the staunchly
independent COOK Report on Internet from our front porch making our living
outside the beltway and fully independent of the interests that Mr. Simon
represents.

We must say we were amused at the Bellcore and NSI private mail that Greg
attached. Clearly we touched a raw nerve. :-)


Here with some relevant quotes from the Cukier article (at
http://www.emap.com/cwi/192/192news5.html) and the Tarjanne interview.

"The U.S. Department of Commerce, backed by a White House group studying
the Net's vital domain name system, is set to accept a modified version
of the plan for competitive domain name registrars devised by the
International Ad Hoc Committee (IAHC), which comprises Internet
organizations and United Nations-affiliate agencies.

"They [the IAHC] laid a decent foundation and need to modify the plan
to build on that foundation," said Ira Magaziner, a senior adviser on
Internet matters to President Bill Clinton. The IAHC seems "open and
flexible" to the idea of changing portions of the plan based on
increased Internet community input, Magaziner added.

The move will lay to rest months of uncertainty over the United States'
role in freeing Internet institutions from government control.

Significantly, the Department of Commerce will require the current
monopoly registrar of the popular .com domain, Network Solutions Inc.,
to release information pertaining to the system's operation, say
Clinton administration officials.

However, officials caution that the department's approach is not
universally supported in the federal government, and the internal
tensions may set the policy back.

Additionally, the IAHC's proposals that Geneva-based U.N. agencies be
involved in domain name governance was attacked by Charles Pickering,
the republican chairman of the House Science Subcommittee on Basic
Research, which sponsored the domain name system hearings.

Jon Postel, the head of the Internet Assigned Numbers Authority (IANA),
the Net's central authority on certain standards (CWI, 30 June),
remains cautious, however. "I just don't know," he said when asked
whether the U.S. government will promote Internet self-governance.

But Postel added: "Discussions have been fairly open in the
administration about endorsing the [Internet] community's plan," as
represented by the IAHC.

The Trajanne interview is found at
http://www.teledotcom.com/1097/features/tdc1097interview.html

The ITU's involvement with the Internet may not
            end with the DNS. In fact, it may just begin
            there, especially if the ITU's DNS solution
            holds sway. In a recent interview, Tarjanne not
            only defended the DNS accord but also predicted
            a growing role for the ITU in Internet
            governance, at the invitation of the world's
            government and industry leaders.

The ITU could eventually become involved
            in such content-oriented issues as pornography
            on the Internet, Tarjanne says. "We are not
            there yet, and I don't know if we will get
            there, but there is a clear possibility," he
            said. Some acknowledgment of the ITU's
            expanding role on the Internet could be written
            into the U.N. agency's bylaws when the ITU
            holds its quadrennial plenipotentiary
            conference--a kind of constitutional convention
            for the organization--in Minneapolis next
            October, according to Tarjanne.

Still, the Internet issue is pivotal for the
            ITU's future; without a role in the Internet,
            the ITU would become less and less relevant to
            global communications. Tarjanne is moving
            quickly to secure the ITU's future before his
            tenure as secretary general ends in January
            1999.

Tarjanne:  Traditionally, when we've talked about
            standardization in the ITU family it has been
            mainly technical standardization. But more and
            more we are involved in things that are called
            standardization but that have to do with, for
            instance, issues related to the generic
            top-level domain names or numbering
            systems--country codes are almost becoming
            viewed as a limited natural resource. As it
            relates to the Internet, we are facing a very
            interesting situation where questions concerned
            with conduit and content are being blurred.
            Basically, we have always dealt with conduit
            and have had nothing to do with content. But
            the situation is not that simple anymore. We,
            the conduit people, have to know what is
            happening on the content side, and vice versa,
            and there are questions that are very much
            interlinked.


What kind of content issues do you see as
            possibly requiring the ITU's attention?

            Tarjanne: There are lots and lots of things. Probably the
            most famous Internet-related questions have to
            do with all the kinds of content that are not
            considered to be legally or morally acceptable.
            These are very difficult for the national
            decision-makers alone to deal with because of
            the global nature of the network. The problems
            are those related to child pornography or
            things like that. They have not reached the
            point where there's any need for us to do
            anything except follow what's happening. But
            that is already a change. To be prepared for
            the future, we have to know what problems
            different countries have with respect to the
            content of international communications.

            Have your members asked you to look into these
            issues?

           Tarjanne:   Members have asked us to look into it and to
            follow it, but there are no concrete proposals
            for us to really take these matters up more
            seriously than that--than to follow them and
            collect information and be prepared to
            disseminate information. There's nothing on the
            agenda of our next few conferences, nor anything
            really serious in our study groups.

            What would happen if the Internet community
            rejected ITU governance?

            Tarjanne:  It's a theoretical possibility, but I don't
            think it's very realistic. But if they find a
            better forum than the ITU, we don't have any
            monopoly. Things can be done outside the ITU,
            sometimes in a better way than within the ITU.
            That's not a big problem. We are here within
            our mandate to be prepared to participate and
            help when asked to do so. That's what we have
            done.

            To go a little bit further, if something were
            to happen outside the ITU that would lead to
            problems because of the absence of a neutral
            global organization covering these issues, then
            of course it's up to the members of the ITU to
            look at things more carefully. But we are not
            there. It's a rather hypothetical question for
            the time being.


************************************************************************
The COOK Report on Internet               For subsc. pricing & more than
431 Greenway Ave, Ewing, NJ 08618 USA     ten megabytes of free material
(609) 882-2572 (phone & fax)              visit   http://cookreport.com/
Internet: cook at cookreport.com             New Special Report: Internet
Governance at the Crossroads ($175)  http://cookreport.com/inetgov.shtml
************************************************************************

--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/
Ask me about FC98 in Anguilla!: 







From smith at securecomputing.com  Wed Oct 15 09:44:55 1997
From: smith at securecomputing.com (Rick Smith)
Date: Thu, 16 Oct 1997 00:44:55 +0800
Subject: proposal: commercial data recovery
In-Reply-To: 
Message-ID: 



In response to some things I said about crypto and firewalls, Adam Back wrote:

>I'm not sure whether pgp5.5 has this ability to screen messages prior
>to reading, and also not sure whether it has the ability to snoop
>messages prior to sending built in.

It's not a feature of 5.5, it's a separate activity that relies on the
presence of a third party key. The actual inspection occurs at a security
choke point like a firewall. That way the tests are applied consistently
regardless of mistakes made by clients in software installation or
configuration.

You noted that it might in fact be possible to get the same result with a
more GAK resistant implementation, and I agree. For example, if the
principals all update their public keys fairly often, then there's no
relatively key that's easy to escrow. The practical version of forward
secrecy, as it were. I have no objection to that. As far as I can tell,
there's nothing intrinsic in the current PGP proposals to prevent such an
implementation.

Concerning your other examples, I agree that there are ways to trade off
between degrees of GAK sensitivity and various customer security
objectives. However, this whole discussion revolves around the fact that
people rely heavily on off the shelf solutions, and there aren't the right
tools to do everything you're suggesting. I'd like to see things in the
crypto marketplace be as flexible as possible. Just because a few provide
some features that could in theory be applied to GAK doesn't IMHO mean that
those will manage to prevail. A diverse marketplace of crypto devices is
essential for it to flourish -- one that gives every customer the flavor
they want. That way the general public will develop a working understanding
of it. And we'll all learn what really works and what doesn't.

Let's face it, crypto is at about the same stage as cars were when Henry
Ford started building them. We really know as much about how crypto will
change the future as he did about the effects of cars. We can't start
engineering in governors to restrict our speed, or be restricting our
designs to governor-proof transmissions.

I regret I'll have to bow out of this discussion because I'll be on travel
for a couple of weeks. Have fun everyone.

Rick.
smith at securecomputing.com           Secure Computing Corporation
"Internet Cryptography" now in bookstores http://www.visi.com/crypto/







From pghmain at pgh.org  Wed Oct 15 09:55:24 1997
From: pghmain at pgh.org (Admin Pgh Plan)
Date: Thu, 16 Oct 1997 00:55:24 +0800
Subject: Statists trying to outlaw anonymity and privacy
In-Reply-To: <3444A8EA.B0E@alt.net>
Message-ID: 



On Wed, 15 Oct 1997, Dr. Zeus wrote:

> Date: Wed, 15 Oct 1997 07:28:42 -0400
> From: "Dr. Zeus" 
> To: freedom-knights at jetcafe.org
> Cc: cypherpunks at algebra.com, mfi at pgh.org, drg at pgh.org
> Subject: Re: Statists trying to outlaw anonymity and privacy
> 
> Igor Chudov @ home wrote:
> > 
> > Dear Friends,
> > 
> > As many of you no doubt know, a new moderated group,
> > comp.org.cauce, has been proposed. One of the main goals
> > of moderators is to prevent users of one-way anonymous
> > remailers and those who munge (alter) their addresses
> > to avoid being spammed, from posting to the group.
> > 
> > Their proposal would force users to reveal their Internet
> > identities and expose them to spam.
> > 
> > The proponents hope, apparently, that the more spam people
> > get, the more will they support CAUCE's statist lobbying for
> > more government regulations.
> > 
> > During the discussion they have shown complete disregard and
> > ignored all requests from users who attempted to help them
> > accommodate anonymous posting. To get more YES votes, they
> > removed the most controversial provisions from the charter,
> > while IN THE SAME DAY promising that these provisions will
> > still be enforced.
> > 
> > As someone who defends privacy and anonymity  on the Internet,
> > I ask you to vote on this important matter. I will vote NO
> > on this newsgroup.
> > 
> > Feel free to repost this message to any fora you deem appropriate.
> > 
> > To find the Call For Votes, go to news.groups newsgroup, and find
> > article titled "CFV: comp.org.cauce moderated". You will find the
> > charter and the instructions on how to vote.
> > 
> > Thank you for your attention.
> > 
> >         - Igor.
> 
> I say we bomb the shit out of the newsgroup if it gets formed.
> We need a new newsgroup flooding and blasting.
> 
> Those basdtards like CAUCE who try to censor make it very
> legal to take the gloves off and just wipe them out with
> mailbombing and SYN and ping attacks!!!
> 
> KILL CAUCE!!!  They are all mostly Pedophiles!
> 
> -Dr. Zeus
> 

amen.






From ichudov at www.video-collage.com  Wed Oct 15 10:13:46 1997
From: ichudov at www.video-collage.com (Igor Chudov @ home)
Date: Thu, 16 Oct 1997 01:13:46 +0800
Subject: CFV: comp.org.cauce moderated -- support privacy and anonymity
In-Reply-To: <3447bfd7.22958863@128.2.84.191>
Message-ID: <199710151705.RAA20443@manifold.algebra.com>



For your information -- all anonymity advocates take note of the
comp.org.cauce Call For Votes which wants to outlaw anonymity.

The Call For Votes has been posted to news.groups, with a very 
lively discussion that followed. You may be amused to read it.

igor

In news.groups, phelix at vallnet.com  wrote:
* On 14 Oct 1997 11:57:07 -0400, moz at server2.mich.com (John C. Mozena) wrote:
* 
* >In article ,
* >Igor Chudov @ home  wrote:
* >
* >>We have exposed your arguments against munging as bogus.
* >
* >You have exposed nothing but your ability to be hateful.
* >
* >>But, what do you have against anonymity?
* >
* >Nothing. What right do you have, though, to force me and others to
* >inconvenience ourselves so you can post anonymously or protect yourself
* >from spam?
* >
* >>Vote AGAINST comp.org.cauce which wants to outlaw anonymity and
* >>use of spamblocked addresses. Go to news.groups and find the
* >>CFV for comp.org.cauce, with the ballot enclosed.
* >
* >Vote for comp.org.cauce, which protects the utility of a newsgroup and the
* >freedom of postmasters to not run anonymous posting services should they
* >not so desire.
* 
* Well, I just started reading this, and I didn't really know which way to
* vote.  But such an anti-anonymnity stance makes the choice clear:
* 
* vote *NO*.
* 
* Thanks for clearing things up, John.
* 
* -- Phelix
* 


-- 
	- Igor.

The average American spends a total of six (6) months in prison. 






From sg at dev.null  Wed Oct 15 10:19:30 1997
From: sg at dev.null (Snot Girls)
Date: Thu, 16 Oct 1997 01:19:30 +0800
Subject: Fuck You!
In-Reply-To: <343EADC9.1317@dev.null>
Message-ID: <3444F734.225F@dev.null>



Bianca *didn't* write:
> 
> I found your address, despite your subterfuge, and I am going to fuck
> up both you and your computer system.
> I don't like fuckwads sending bullshit to my email.
> 
> Fuck You
> (& the horse you rode in on)

That was Human Gus-Peter, being a lamer and accidentally cc:'ing
the toadster.
He's ok, since he helps us screw with the people who send us and
the toadster ads for pervert pictures. But we still made him
read Dumping Men By The Book, because he made fun of Cynthia,
but he thinks it's a manual for learning to be a male lamester.

Bianca is teaching us how to be good with computers but we're not
supposed to mess around with the cypherpunks list because we still
make a lot of mistakes.
She showed us how to get in the pervert picture system and get
out their secret passwords. We send them to kids whose parents
are cops with Bianca helping us make it look like they are from
the pervert picture people.
Not that we're troublemakers... (HG-P's uncle taught us to say that)

We don't like the pervert picture people making all of the alt.lists
full of their ads, so we subscribe their systems to all of the kids
mailing lists we can. We even wrote a script that does it for us
whenever we want.
Some of our best friends are pervert people but we don't like being
spammed with all of that crap.

We like the women cypherpunks and Igor, because we use his stuff
for being who we want to in our posts. The cypherpunks are pretty
funny even when you're being serious.
My name is Julia.

Bye.
ps-and thanks for your anonymous remailers because we use them a lot






From twaweb at inet2.twa.com  Wed Oct 15 11:05:45 1997
From: twaweb at inet2.twa.com (twaweb at inet2.twa.com)
Date: Thu, 16 Oct 1997 02:05:45 +0800
Subject: Trans World Specials e-mail confirmation
Message-ID: <19971015172525.8770.qmail@inet2.twa.com>



Thank you registering with the TWA Trans World Specials Electronic Faresale
notification program.

TWA posts faresales for the week on Tuesday mornings at
http://www.twa.com/html/flights/faresale.html.

If the routes you have selected in Trans World Specials match the faresale
cities - then you will receive the faresale by e-mail.

You can always update your profile and add or remove routes by returning to:
http://www.twa.com/odpairs

Thank you!






From eli at gs160.sp.cs.cmu.edu  Wed Oct 15 11:24:31 1997
From: eli at gs160.sp.cs.cmu.edu (Eli Brandt)
Date: Thu, 16 Oct 1997 02:24:31 +0800
Subject: FCPUNX:PGP Key Escrow and Congress
In-Reply-To: <199710141935.PAA13621@beast.brainlink.com>
Message-ID: <199710151811.LAA23906@toad.com>



Bruce Schneier wrote:
> From: "Barbara Simons" 
>
> Some of these are old arguments that we've been hearing for a while,
> but some are newer.  In particular, points 4 and 6 are difficult to
> refute without getting into some technical details.  Both points also
> undercut the argument that a key recovery infrastructure potentially
> weakens security.  After all, the NSA thinks it's secure enough that it
> can be used by the government.

Non-technical point: the NSA (reportedly) has no intention of using
GAK for classified information.  They know that it weakens security.

Do the privacy of the nation's data and the security of its
information infrastructure deserve the same consideration as the
Pentagon's "Confidential" memos?  When you're planning to build in a
single point of failure, this is a question you have to ask.

-- 
     Eli Brandt  |  eli+ at cs.cmu.edu  |  http://www.cs.cmu.edu/~eli/






From smith at securecomputing.com  Wed Oct 15 11:27:48 1997
From: smith at securecomputing.com (Rick Smith)
Date: Thu, 16 Oct 1997 02:27:48 +0800
Subject: Just say "No" to key recovery concerns...keep OpenPGP pure
In-Reply-To: <199710141329.OAA02853@server.test.net>
Message-ID: 



While I think that a variety of robust and successful products will proably
emerge that support various types of key recovery, I strongly agree with
Tim on engineering grounds: Keep It Simple, Stupid.

When it comes to deciding on the contents of a standard, let's keep in mind
that we're working with a relatively new technology. We'll make more
progress by standardizing proven concepts, and these integrated key
recovery hacks don't have the operating history that vanilla PGP has. If
anything, my experience with Guard keying suggests that the proposed
mechansims aren't enough. The problem has more hair than our sheepdog.

I don't think the protocol standard needs to take a political statement
about key recovery mechanisms, but it *must* outline the protocol's
traditional security objectives pretty much the way Tim outlined them. That
sets the context for a robust protocol that has a successful history.

Now I need to shut off my mailer and go pack my suitcase.

Rick.
smith at securecomputing.com           Secure Computing Corporation
"Internet Cryptography" now in bookstores http://www.visi.com/crypto/







From whgiii at invweb.net  Wed Oct 15 11:46:21 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Thu, 16 Oct 1997 02:46:21 +0800
Subject: FCPUNX:PGP Key Escrow and Congress
In-Reply-To: <199710151811.LAA23906@toad.com>
Message-ID: <199710151825.OAA20321@users.invweb.net>



In <199710151811.LAA23906 at toad.com>, on 10/15/97 
   at 02, Eli Brandt  said:

>Bruce Schneier wrote:
>> From: "Barbara Simons" 
>>
>> Some of these are old arguments that we've been hearing for a while,
>> but some are newer.  In particular, points 4 and 6 are difficult to
>> refute without getting into some technical details.  Both points also
>> undercut the argument that a key recovery infrastructure potentially
>> weakens security.  After all, the NSA thinks it's secure enough that it
>> can be used by the government.

>Non-technical point: the NSA (reportedly) has no intention of using GAK
>for classified information.  They know that it weakens security.

>Do the privacy of the nation's data and the security of its
>information infrastructure deserve the same consideration as the
>Pentagon's "Confidential" memos?  When you're planning to build in a
>single point of failure, this is a question you have to ask.

There are those of us who see a single point of failure in such
infrastructures as a GoodThing(TM).

-- 
---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
---------------------------------------------------------------






From tcmay at got.net  Wed Oct 15 11:58:20 1997
From: tcmay at got.net (Tim May)
Date: Thu, 16 Oct 1997 02:58:20 +0800
Subject: Just say "No" to key recovery concerns...keep OpenPGP pure
In-Reply-To: 
Message-ID: 



At 12:14 PM -0700 10/15/97, Rick Smith wrote:
>While I think that a variety of robust and successful products will proably
>emerge that support various types of key recovery, I strongly agree with
>Tim on engineering grounds: Keep It Simple, Stupid.
>
>When it comes to deciding on the contents of a standard, let's keep in mind
>that we're working with a relatively new technology. We'll make more
>progress by standardizing proven concepts, and these integrated key
>recovery hacks don't have the operating history that vanilla PGP has. If
>anything, my experience with Guard keying suggests that the proposed
>mechansims aren't enough. The problem has more hair than our sheepdog.
>
>I don't think the protocol standard needs to take a political statement
>about key recovery mechanisms, but it *must* outline the protocol's
>traditional security objectives pretty much the way Tim outlined them. That
>sets the context for a robust protocol that has a successful history.

Thanks for the comments, and the support is nice, too.

As Rick notes, the whole "foobar recovery" (where foobar may be plaintext
messages or keys) technology is untested, besides being dangerous in
various ways.

It represents an escalation of complexity, both for the users and the
developers. (My message is being directed at the OpenPGP folks trying to
figure out what features to support, not to PGP, Inc., which can make its
own decisions about how to spend its engineering and marketing
resources...though I hope they are taking the reactions of many of us to
heart.)

At this stage, where governments of the world are planning to make foobar
recovery mandatory (either GAK or GAP), it's a bad time to launch an
untested and potentially dangerous technology. As others have noted,
Congress is already using PGP's support of message recovery as evidence
that industry can rise to the challenge of providing message recovery for
law enforcement.

OpenPGP needs to stick to basics. And PGP, Inc. needs to get back to basics.

--Tim May


The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From jim at acm.org  Wed Oct 15 12:01:11 1997
From: jim at acm.org (Jim Gillogly)
Date: Thu, 16 Oct 1997 03:01:11 +0800
Subject: Personal use crypto export
Message-ID: <34450E74.5C1@acm.org>



I'm moved to repeat Matt Blaze's exercise of a couple of years
ago, where he went through the rigamarole to get an Official
Paper from Customs or State or whoever was in charge to take his
laptop out of the country with crypto on it for his personal use
overseas.  His experiences finding the right person to talk to
to get a form, then his inability to find a Customs official to
look at it on the way back, were semi-hilarious.

However, now that crypto exports in general have moved from ITAR
to EAR and BXA is in charge of general crypto exports, I can't find
out how to get the right form to take out a laptop with PGP (or
anything else) on it.  Can anybody give me a pointer to whoever
thinks they're in charge of this stuff?

Or have they given up on this phase?

Thanks...
-- 
	Jim Gillogly
	24 Winterfilth S.R. 1997, 18:38
	12.19.4.10.12, 7 Eb 10 Yax, Fifth Lord of Night






From tcmay at got.net  Wed Oct 15 12:27:38 1997
From: tcmay at got.net (Tim May)
Date: Thu, 16 Oct 1997 03:27:38 +0800
Subject: Security flaws introduced by "other readers" in CMR
In-Reply-To: <199710141935.PAA13621@beast.brainlink.com>
Message-ID: 



At 11:10 AM -0700 10/15/97, Eli Brandt wrote:

>Non-technical point: the NSA (reportedly) has no intention of using
>GAK for classified information.  They know that it weakens security.
>
>Do the privacy of the nation's data and the security of its
>information infrastructure deserve the same consideration as the
>Pentagon's "Confidential" memos?  When you're planning to build in a
>single point of failure, this is a question you have to ask.

This also applies to CMR as well. Whatever the perceived business reasons
for CMR, the fact is that it introduces additional failure points. No
longer will Alice and Bob be secure that at least there are no "other
readers" in the channel between them (what they do with the plaintext after
decryption is of course solvable by no technology).

And, contrary to some of what we've been hearing, even corporations have
continuing needs to know that a communication between Alice and Bob, within
a corporation or crossing the corporate boundary, is not being listened to
by any other person. Merger negotiations are one obvious example.

(There are workarounds, I suppose. CMR could have a "override" switch to
turn off the CMR to a second key. But who decides on this? Maybe a signed
message from a suitable higher-up? Ah, the complexity. And executives
wanting to bypass CMR can and will use other channels. So many of the goals
of CMR are out of reach....)

Instead of choosing an example where CMR apparently "works," such as
Crispin's example of a corporation using CMR to detect (as if it weren't
detectable in other ways!) that an employee is operating a porn ftp site
from company computers, let me throw out some examples where CMR introduces
flaws into a security system.

* Andy Grove sends a PGP 5.5-encrypted message to T.J. Rodgers, CEO of
Cypress Semiconductor, outlining the plans for Cypress to be acquired by
Intel. However, Cypress has implemented CMR, and one of the "second
readers" of Andy's message is the cryptically-named (no pun intended)
"CCCP" (Corporate Crypto Compliance Police), staffed by security guards and
personnel management droids. Major security flaw.

(Sure, one can imagine various levels of "second readers." But I rather
doubt that most of them will be _offices_, with changing staffs. While one
could, for example, designate "Gordon Moore" to be the second reader of all
files encrypted to Andy Grove's key, I rather doubt this is the way CMR
will play out.)

* Craig Livingstone, at whitehouse.gov, is the Key Compliance Officer for
all communications entering or leaving the White House. Enough said?

* Sheep-dipped cutouts in defense companies await their orders from DoD,
but find that other readers in their companies are monitoring them.

And so on.

"Three can keep a secret if two of them are dead." (Ben Franklin)

What will of course happen is that these "security flaws" will be plugged
by subterfuge. People will stop using the corporate mail for many such
tasks, and will use nonwork accounts. With some loss of efficiency, and
even more opportunities for leaks. (If firewalls are in place, on outside
net connections, employees can just dial out. Or use Metricom Ricochet
modems, if conditions are favorable for reception. Or wait until they go
home.)

In fact, CMR will mostly just mean bland, interdepartmental messages get
"recovered." As I said before, this is a pretty crude way to implement a
kind of corporate archiving of information.

Truly sensitive stuff--stuff about takeovers, foreign production plans, new
products, etc.--will be encrypted with channels having no nosy security
guards or Corporate Crypto Compliance Police silently listening in.

Which means we're back to square one. So why does PGP, Inc. bother?

And why should OpenPGP squander efforts worrying about this?

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From andy at CCMSD.chem.uga.edu  Wed Oct 15 12:30:06 1997
From: andy at CCMSD.chem.uga.edu (Andy Dustman)
Date: Thu, 16 Oct 1997 03:30:06 +0800
Subject: CFV: comp.org.cauce moderated -- support privacy and anonymity
In-Reply-To: <199710151705.RAA20443@manifold.algebra.com>
Message-ID: 



-----BEGIN PGP SIGNED MESSAGE-----

On Wed, 15 Oct 1997, Igor Chudov @ home wrote:

> For your information -- all anonymity advocates take note of the
> comp.org.cauce Call For Votes which wants to outlaw anonymity.

Yes, I find it particularly interesting that the CFV states only that "The
newsgroup is robomoderated to eliminate crossposts and advertisements
only" but does not mention that the robomoderation requires a repliable
(i.e., non-anonymous) e-mail address. (This IS mentioned for the voting
procedure, but not for the group itself. 

Also, in <6203tu$kuj at server2.mich.com>, the proponent for comp.org.cauce
states, "The CFV says people must return an e-mail sent to the address
from which they make the post," which, as near as I can tell, is a lie or
error; I got the ballot from my local server (<876781691.12806 at isc.org>)
and it says no such thing, only that it is robomoderated. "Robomoderated"
does not imply that you "must return an e-mail sent to the address from
which [you] make the post". Maybe it says that in the last RFD, but not in
the CFV. 

At any rate, if for some reason this CFV is approved, I will post
something to comp.org.cauce with the remailer, and when the reply comes
back (yes, the return address is valid), I'll reply to it, so cracker will
be able to post there, until somebody decides, using their "discretion",
to ban posts from the remailer address.

If it were comp.org.cauce.announce, I really wouldn't give a shit about
what the moderation policy is, but it's represented as a group where
"opinions contrary to those of CAUCE are solicited and welcomed," and I
don't have too much confidence that this will be the case.

Spam sucks but censorship is worse.

Andy Dustman / Computational Center for Molecular Structure and Design / UGA
    To get my PGP public key, send me mail with subject "send file key".
For the ultimate anti-spam procmail recipe, send me mail with subject "spam"
"Encryption is too important to leave to the government."  -- Bruce Schneier
http://www.athens.net/~dustman   mailto:andy at CCMSD.chem.uga.edu       <}+++<


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQEPAwUBNEUYFxOPBZTHLz8dAQE0OgfPTw5k5z9BfLUwVlORUW3dcgspkTsnB8xg
MZLxH/7mxsOcTkS/yjggqwKloMf5FS5kHB7rQ3D2aWboagxvGDaEU72d33fDs/uE
LyDT4+uHB4DVZibOcHXWGNY5QxC8Y2kPbzWpPE8PPrYQXbBpmxC2qYkO7wXtS0a4
zl9EnWai8xgE7GcRrHbOiqoxJ7LCEOUb1JuFJxloUOJ9ilWYaYs5CJ8ZW0itS4Fe
MLmF9iJOK/j/nK9RIIXfIH0011v52XosFtWBajWvZygmEdEnTG9HhkRc4XFODTiy
F8hoBlOiwnAOiSNOoCoxeLjhNe4L0TSHhU8G9Je4wlF1Pg==
=lZxq
-----END PGP SIGNATURE-----






From tcmay at got.net  Wed Oct 15 12:37:14 1997
From: tcmay at got.net (Tim May)
Date: Thu, 16 Oct 1997 03:37:14 +0800
Subject: Personal use crypto export
In-Reply-To: <34450E74.5C1@acm.org>
Message-ID: 



At 11:41 AM -0700 10/15/97, Jim Gillogly wrote:
>I'm moved to repeat Matt Blaze's exercise of a couple of years
>ago, where he went through the rigamarole to get an Official
>Paper from Customs or State or whoever was in charge to take his
>laptop out of the country with crypto on it for his personal use
>overseas.  His experiences finding the right person to talk to
>to get a form, then his inability to find a Customs official to
>look at it on the way back, were semi-hilarious.
>
>However, now that crypto exports in general have moved from ITAR
>to EAR and BXA is in charge of general crypto exports, I can't find
>out how to get the right form to take out a laptop with PGP (or
>anything else) on it.  Can anybody give me a pointer to whoever
>thinks they're in charge of this stuff?
>
>Or have they given up on this phase?

Given that Matt did the exercise the one time it was worth doing, as a
"demonstration," and given that nobody has been prosecuted for this sort of
thing, and given the "personal use exemption" issued a while back, what's
the point?

If your point is to show that you, too, can jump through hoops and run
around collecting papers, then it hardly seems fair for any of us to give
you help, right?

--Tim May

(P.S. I seem to recall that some time _after_ the Matt Blaze experience
there was an even more clearcut statement that laptops leaving the country
for temporary trips did not need _any_ permission forms, even officially. I
dimly recall this as part of the new BXA/EAR documents.)

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From goddesshera at juno.com  Wed Oct 15 13:27:12 1997
From: goddesshera at juno.com (Anonymous Remailer)
Date: Thu, 16 Oct 1997 04:27:12 +0800
Subject: FCPUNX:PGP Key Escrow and Congress
Message-ID: <19971015.140657.9807.7.goddesshera@juno.com>




On Wed, Oct 15, 1997 at 02:10:54PM -0400, Eli Brandt wrote:
> Bruce Schneier wrote:
> > From: "Barbara Simons" 
> >
> > Some of these are old arguments that we've been hearing for a while,
> > but some are newer.  In particular, points 4 and 6 are difficult to
> > refute without getting into some technical details.  Both points also
> > undercut the argument that a key recovery infrastructure potentially
> > weakens security.  After all, the NSA thinks it's secure enough that
it
> > can be used by the government.
> 
> Non-technical point: the NSA (reportedly) has no intention of using
> GAK for classified information.  They know that it weakens security.

You have this wrong.  In fact, NSA *supplies* keys for classified
encryption equipment.  They never told me whether they "escrowed"
copies of the keys they supply -- what do you think?

> Do the privacy of the nation's data and the security of its
> information infrastructure deserve the same consideration as the
> Pentagon's "Confidential" memos?  When you're planning to build in a
> single point of failure, this is a question you have to ask.

In fact, it's much more complex.  People with real classified data
don't trust encryption at all, and they only use it if they absolutely
have to.  They, unlike many cypherpunks, remember well that there are
other ways to get information besides running big computers, and if
you have protections against those in place already, crypto doesn't
buy much. 

But classified data isn't really interesting.  Though by any measure
there are huge amounts of it, it is dwarfed by the amount of
government data that is not classified.  To protect that data
government agencies will use comercial crypto, and "key recovery"
*will* be required in any commercial product purchased by a government
agency.  As use of crypto becomes commonplace business practice, the
government market will be huge, and consequently, commercial products
with key recovery *will* be prevelant.  Any company that doesn't 
supply it will be relegated to niche markets, and, if legal winds 
blow the wrong way, eliminated.

Crow



This message was automatically remailed. The sender is unknown, unlogged,
and nonreplyable. Send complaints and blocking requests to
.






From Hangman37 at aol.com  Thu Oct 16 04:35:14 1997
From: Hangman37 at aol.com (Hangman37 at aol.com)
Date: Thu, 16 Oct 1997 04:35:14 -0700 (PDT)
Subject: Hello!
Message-ID: <971016055142_1367903598@emout17.mail.aol.com>


   Have you ever wanted to contact a celebrity? Ever wanted your favorite
celebrity to send you a personalized autographed picture?  If you have, then
you will need this list.  It is a list of over 5,000 celebrity addresses.
And it is guaranteed that the celebrity you are looking for is on the list,
or you will get your money back!  You can get this complete list of over 
5,000 celebrity addresses for only $10.00.  My list has been used for:

                               Autograph Collecting 
                               Fund raising 
                               Real estate sales 
                               Security system sales 
                               Fan mail/appreciation letters 
                               Birthday cards 
                               Get-well cards 
                               Speaking invitations 

   Included is a document that explains the easiest and fastest ways to get
replies from the celebrity.  A list like this cannot be found for less!
For $10, you can get this list sent to your email address the next day after
receiving your order.  For an extra $2, you can get the list mailed to your
residence on a 3.5" disk.  Here's how to order:

If you want the list emailed to you................ Total = $10.00
If you want the list sent on a 3.5" disk.......... Total = $12.00

Please include your name, address, and be sure to include your email address.

Send checks or money orders to:

Jared Thorp
2829 N. Glenoaks Blvd.
Suite 106-179
Burbank, CA  91504-2660








From tien at well.com  Wed Oct 15 13:37:47 1997
From: tien at well.com (Lee Tien)
Date: Thu, 16 Oct 1997 04:37:47 +0800
Subject: Personal use crypto export
In-Reply-To: <34450E74.5C1@acm.org>
Message-ID: 



I agree with Tim May, I believe it's no longer an issue.  While the current
EAR/crypto regs don't expressly say "personal use OK," they can be read
that way under several exemptions, and I'm reliably told that BXA does.

In the draft EAR/crypto regs posted to John Young's site some months ago,
the BAG license exception, at (d) and (f) (see below), specifically
addresses crypto.  It's only a draft and may change, but I wouldn't worry
about it.

Lee Tien

�740.14  Baggage (BAG).

(a)  Scope.  This License Exception authorizes individuals leaving the
United States either temporarily (i.e., traveling) or longer-term (i.e.,
moving) and crew members of exporting or reexporting carriers to take to
any destination, as personal baggage, the classes of commodities and
software described in this section.

(b)  Eligibility.  Individuals leaving the United States may export or
reexport any of the following commodities or software for personal use of
the individuals or members of their immediate families traveling with them
to any destination or series of destinations.  Individuals leaving the
United States temporarily (i.e., traveling) must bring back items exported
and reexported under this License Exception unless they consume the items
abroad or are otherwise authorized to dispose of them under the EAR.  Crew
members may export or reexport only commodities and software described in
paragraphs (b)(1) and (b)(2) of this section to any destination.

(1)  Personal effects.  Usual and reasonable kinds and quantities for
personal use of wearing apparel, articles of personal adornment, toilet
articles, medicinal supplies, food, souvenirs, games, and similar personal
effects, and their containers.

(2)  Household effects.  Usual and reasonable kinds and quantities for
personal use of furniture, household effects, household furnishings, and
their containers.

(3)  Vehicles.  Usual and reasonable kinds and quantities of vehicles, such
as passenger cars, station wagons, trucks, trailers, motorcycles, bicycles,
tricycles, perambulators, and their containers.

(4)  Tools of trade.  Usual and reasonable kinds and quantities of tools,
instruments, or equipment and their containers for use in the trade,
occupation, employment, vocation, or hobby of the traveler or members of
the household being moved.  For special provisions regarding encryption
items subject to EI controls, see paragraph (f) of this section.

(c)  Limits on eligibility.  The export of any commodity or software is
limited or prohibited, if the kind or quantity is in excess of the limits
described in this section. In addition, the commodities or software must
be:

(1)  Owned by the individuals (or by members of their immediate families)
or by crew members of exporting carriers on the dates they depart from the
United States;

(2)  Intended for and necessary and appropriate for the use of the
individuals or members of their immediate families traveling with them, or
by the crew members of exporting carriers;

(3)  Not intended for sale or other disposal; and

(4)  Not exported under a bill of lading as cargo if exported by crew members.

(d)   *     *     * No items controlled for EI reasons may be exported or
reexported as unaccompanied baggage.

*     *     *     *     *

(f) Special provisions: encryption software subject to EI controls.

(1) Only a U.S. citizen or permanent resident as defined by 8 U.S.C.
1101(a)(20) may export or reexport encryption items controlled for EI
reasons under this License Exception.

(2) The U.S. person or permanent resident must maintain effective control
of the encryption items controlled for EI reasons.

(3) The encryption items controlled for EI reasons may not be exported or
reexported to Country Group E:2, Iran, Iraq, Sudan, or Syria.


At 10:41 AM -0800 10/15/97, Jim Gillogly wrote:
>I'm moved to repeat Matt Blaze's exercise of a couple of years
>ago, where he went through the rigamarole to get an Official
>Paper from Customs or State or whoever was in charge to take his
>laptop out of the country with crypto on it for his personal use
>overseas.  His experiences finding the right person to talk to
>to get a form, then his inability to find a Customs official to
>look at it on the way back, were semi-hilarious.
>
>However, now that crypto exports in general have moved from ITAR
>to EAR and BXA is in charge of general crypto exports, I can't find
>out how to get the right form to take out a laptop with PGP (or
>anything else) on it.  Can anybody give me a pointer to whoever
>thinks they're in charge of this stuff?
>
>Or have they given up on this phase?
>
>Thanks...








From goddesshera at juno.com  Wed Oct 15 13:41:55 1997
From: goddesshera at juno.com (Anonymous Remailer)
Date: Thu, 16 Oct 1997 04:41:55 +0800
Subject: FCPUNX:PGP Key Escrow and Congress
Message-ID: <19971015.140657.9807.5.goddesshera@juno.com>




On Wed, Oct 15, 1997 at 02:10:54PM -0400, Eli Brandt wrote:
> Bruce Schneier wrote:
> > From: "Barbara Simons" 
> >
> > Some of these are old arguments that we've been hearing for a while,
> > but some are newer.  In particular, points 4 and 6 are difficult to
> > refute without getting into some technical details.  Both points also
> > undercut the argument that a key recovery infrastructure potentially
> > weakens security.  After all, the NSA thinks it's secure enough that
it
> > can be used by the government.
> 
> Non-technical point: the NSA (reportedly) has no intention of using
> GAK for classified information.  They know that it weakens security.

You have this wrong.  In fact, NSA *supplies* keys for classified
encryption equipment.  They never told me whether they "escrowed"
copies of the keys they supply -- what do you think?

> Do the privacy of the nation's data and the security of its
> information infrastructure deserve the same consideration as the
> Pentagon's "Confidential" memos?  When you're planning to build in a
> single point of failure, this is a question you have to ask.

In fact, it's much more complex.  People with real classified data
don't trust encryption at all, and they only use it if they absolutely
have to.  They, unlike many cypherpunks, remember well that there are
other ways to get information besides running big computers, and if
you have protections against those in place already, crypto doesn't
buy much. 

But classified data isn't really interesting.  Though by any measure
there are huge amounts of it, it is dwarfed by the amount of
government data that is not classified.  To protect that data
government agencies will use comercial crypto, and "key recovery"
*will* be required in any commercial product purchased by a government
agency.  As use of crypto becomes commonplace business practice, the
government market will be huge, and consequently, commercial products
with key recovery *will* be prevelant.  Any company that doesn't 
supply it will be relegated to niche markets, and, if legal winds 
blow the wrong way, eliminated.

Crow



This message was automatically remailed. The sender is unknown, unlogged,
and nonreplyable. Send complaints and blocking requests to
.






From nobody at REPLAY.COM  Wed Oct 15 15:12:36 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Thu, 16 Oct 1997 06:12:36 +0800
Subject: No Subject
Message-ID: <199710152145.XAA20388@basement.replay.com>



Tim May  writes:
> This also applies to CMR as well. Whatever the perceived business reasons
> for CMR, the fact is that it introduces additional failure points. No
> longer will Alice and Bob be secure that at least there are no "other
> readers" in the channel between them (what they do with the plaintext after
> decryption is of course solvable by no technology).

I thought that was the whole point of the PGP design.  It makes the
presence of third parties clear and visible to all participants.  This
seems to be the fundamental principle.  PGP is designed to allow Alice
and Bob to be informed if third party access is built in.  Key escrow
and re-encryption are inherently less visible forms of message access.






From postmaster at thehitman.com  Thu Oct 16 06:30:24 1997
From: postmaster at thehitman.com (postmaster at thehitman.com)
Date: Thu, 16 Oct 1997 06:30:24 -0700 (PDT)
Subject: Web Biz Universal Remove List Update
Message-ID: <199710161330.GAA29483@toad.com>


Dear Cypherpunks MAILING LIST,
Thank you for adding your address to the Universal Remove  list

This email is simply a notification that you have been added to or updated in our Universal Remove  list(s). As a reminder, you submitted the following details to: www.thehitman.com

Cypherpunks MAILING LIST at cypherpunks at toad.com

Responsible Direct Email DOES exist at Web Biz!






From rdump at river.com  Wed Oct 15 15:44:29 1997
From: rdump at river.com (Richard Johnson)
Date: Thu, 16 Oct 1997 06:44:29 +0800
Subject: proposal: commercial data recovery
In-Reply-To: <199710140937.KAA01187@server.test.net>
Message-ID: 



At 02:34 -0700 on 10/15/97, Will Price wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Adam:
> ...
> The design you have been espousing for the last week or so in your many
> messages takes the power out of the hands of the sender and encourages
> automated violations of the sender's privacy by the recipient (perhaps even
> unbeknownst to the recipient). ...


This is simply a reflection of reality.  The sender has little real control
over what the recipient actually does with any message.  If the recipient
shares the information content, the sender is basically limited to civil or
criminal sanctions after that sharing becomes evident.

Designing a standard for encrypted communications that attempts to fight
that fact will likely be wasted effort.


Richard







From aba at dcs.ex.ac.uk  Wed Oct 15 16:04:34 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Thu, 16 Oct 1997 07:04:34 +0800
Subject: what can we do about PGP sell out and CMR?
In-Reply-To: 
Message-ID: <199710152229.XAA01119@server.test.net>




The 3 main GAK-hostile design principles are also independently good
security principles in protecting communications traffic.  There are
ways to acheive data recovery functionality without CMR.  I think I
have demonstrated amply what these methods are, and have given a
design methodology for designing such systems.  PGPers are just not
interested to hear.

>From Bill Stewart's report, given the apparent amount of effort PGP
have put into their CMR based enforcement policy functionality, I
predict they won't remove CMR whatever we, or Schneier, or anyone else
says or proves about more secure less GAK-friendly ways of
implementing corporate data recovery.  I also suspect they won't
listen to Tim's earlier argument that they do nothing about recovery
of messages rather than implement GAK.

This quote should give us clue as to why they will continue with CMR: 

	"we're a real company with accountants"

So they are not willing to follow through the anti-GAK design process
where this could hinder bottom lines.

Similar arguments would presumably present them with "no choice" but
to fulfill the order for 100,000 GAK compliant units from the
government terrorizing the freedom fighters PRZ likes to tell us
about who are already using PGP GAK compliant software: pgp5.0.

Tim May  writes:
> let me throw out some examples where CMR introduces flaws into a
> security system.
> 
> [snip]

I think Tim's points are very valid.  CMR functionality if put into
the OpenPGP standard _will_ be used by PGP competitors to implement
message screening and snooping by company security guards etc.  It
will I am almost positive in due course be used to field such software
in countries with poor civil rights records.

Maybe PGP is not fielding systems they are "advising" their clients to
use for GAK, or for message screening, but this is what is going to
happen.  Their good advice isn't as much comfort as an OpenPGP
standard which is as hostile to this practice as possible, and a pgp
data recovery implementation which is also hostile to this.

PGP do not want to hear this.  It will cost development time.

The many people who have expressed to me off list that PGP has sold
out, are I think correct.

> Which means we're back to square one. So why does PGP, Inc. bother?
> 
> And why should OpenPGP squander efforts worrying about this?

I think that except for carefully worded statements by PGP Inc
employees all those who have spoken on the topic in the OpenPGP forum
have agreed.  The CMR field should not go in OpenPGP.  This means that
the PGP SMTP policy enforcer will not meet the OpenPGP standard: it
will bounce mail from compliant implementations which ignore the CMR
field.

I think this means that the person who suggested this:

	OpenPGP is unlikely to continue to be supported by PGP Inc

to me in email made a good prediction.


What can we do about this situation?  Well we could build systems
which hack around the CMR system.  Easy enough: just put dud
"recovery" info inside.  We still have deployment problems.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710152254.XAA01167@server.test.net>




Anonymous writes:
> Remind me again:
> 
> Why was it OK when the SENDER could choose to encrypt to an additional
> key, but it's a threat to the free world if the RECEIVER is allowed to
> request the same thing?

It's a threat to the free world if the RECEIVER is allowed to request
the same thing when PGP Inc also goes ahead and implements an enforcer
to bounce mail failing to meet this `request'.  This is not a
`request', this is an `insistance'.  This is a ready to roll system
which could be used as-is to implement GAK.

It is also potentially dangerous even without the SMTP policy enforcer
because if this functionality (CMR public key extension) is part of
the OpenPGP standard, then conformant OpenPGP implementations are pre
GAK enabled -- when GAK comes in, they know how to send to CMR keys,
and the enforcement can be added later.


Notice also that using comparisons with pgp2.x multiple recipient
functionality to deflect criticism is a complete red herring: pgp2.x
multiple recipients do not request copies mail to keys to be sent to
other keys.

All crypto recipients correspond 1-1 to message recipients, and in
most cases there is only one message recipient (and therefore only 1
crypto recipient).  This is better security, and it can't be used for
GAK anywhere near as easily as CMR.

And yes turning encrypt-to-self on violates 1-1 correspondence with
message recipients, but encrypt-to-self is also a security flaw to use
this feature.  I rant about the security risk of encrypt-to-self
periodically, as a search of the archives would show. 

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710152047.VAA00959@server.test.net>




> Remind me again:
> 
> Why was it OK when the SENDER could choose to encrypt to an additional
> key, but it's a threat to the free world if the RECEIVER is allowed to
> request the same thing?

It's a threat to the free world if the RECEIVER is allowed to request
the same thing when PGP Inc also goes ahead and implements an enforcer
to bounce mail failing to meet this `request'.  This is not a
`request', this is an `insistance'.  This is a ready to roll system
which could be used as-is to implement GAK.

It is also potentially dangerous even without the SMTP policy enforcer
because if this functionality (CMR public key extension) is part of
the OpenPGP standard, then conformant OpenPGP implementations are pre
GAK enabled -- when GAK comes in, they know how to send to CMR keys,
and the enforcement can be added later.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710152245.XAA01135@server.test.net>





Part of the problem in this debate I think is that I have proposed
many alternate designs, with varying degrees of GAK-hostility.

Also I have been accused of using "lots of anti GAK rhetoric, but
giving no proposals" by Kent.  I reject that claim.  (I did use lots
of rhetoric, but this was to try to impress upon those arguing for CMR
of it's dangers.  They do not seem to acknowledge them.) I'll try in
this post to steer clear of anti-GAK rhetoric.  We'll instead take it
as a given that pgp5.5 and pgp5.0 are GAK compliant because of CMR and
that this is a bad thing.

Will is correct on one point: at the begining I had not properly
thought one aspect through: my earlier decrypt & re-encrypt construct
violates anti-GAK design principle 2; namely it is guilty of the same
violation as CMR, it has an effective second crypto recipient outside
of the senders control. I agree with Will Price's comments on the GAK
pervertability tendencies of this construct.  I spotted the error of
my ways since clarifying my thoughts on the subject by constructing
the more formalised anti-GAK design principles.  Readers will see my
codification of my recognition of the dangers of the re-encrypting
construct in corollary 1 of the anti-GAK design principles (copy of
principles below [1]).  The fact that I posted this corollary in
updated copies of the design principles prior to Will's post should
show that this claim is sincere and not an attempt at side stepping
Will's observation: he is correct, I agree.

The rest of Will's post seems to miss the point, so it seems to me
that the best way to transfer understanding of how to use the anti-GAK
design principles to design less GAK friendly systems is to present a
worked example.

This first simple CDR replacement for PGP's CMR method also attempts
to keep changes necessary to implementations and packet formats to a
minimum.  Please understand also that it violates one of the major
design principles in order to acheive this simplicity and so that
objections that it is not that much more valuable than CMR will be
countered by showing you how to achieve an even more GAK-hostile
design by removing the violation of design principle 3, albeit with
more coding effort and design modifications on PGP's part.  Never the
less it is already much harder to pervert for GAK than CMR.

Design 1.

Instructions:

- scrap the CMR key extension

- store a copy of the private half of the users PGP encryption key
  encrypted to the company data recovery key on the users disk.

- (optional) design the software to make it hard to copy the data
  recovery packet from the disk, hide the data, bury it in keyrings,
  stego encode it, whatever, use your imagination.  This is to attempt
  to restrict the third parties ability to by pass the principle of
  non communication of recovery information


Recovery method:

Custodian of recovery key inserts recovery floppy disk in machine,
decrypts copy of users private key, hands control back to user to
choose new passphrase.


Possible objections:

objection #1. what if disk burns?
counter #1:   backup your disk

objection #2: users don't back up disks
counter #2:   that is a good way to loose data :-) if they don't have
              the data the key protecting the data won't help them

GAK-hostility rating:

Harder to pervert for GAK than pgp5.5 / pgp5.0 CMR design.


I'd be interested to see Will, or Hal, or other PGPer's criticisms of this
simple modification, perhaps criticisms could most constructively answer:

- what is stopping you implementing this
- are there any plug ins which can't cope with this
- are there user requirements which it can't meet
- is there some fundamental flaw you think I have missed
- can you see ways that this could be perverted to implement GAK
  (yes I can too, btw, but...)
- are those ways logisitically harder for GAKkers to acheive than for CMR

Please be specific, no general waffle about understanding the
complexities of balancing user ergonomics, user requirements etc.
That is a no-brainer, you need to do this analysis, the cost function
for evaluating such design issus is now expressed explicitly in design
principle 4 rather than being assumed.  List problems and explain the
significance of the all important deployability criteria.

Cryptographic protocol designs are very flexible; most design goals can
be met, or worked around I claim within the positive GAK-hostility
side of the cryptographic protocol and product design solution space.

Lastly, I would encourage readers to be critical of the GAK-hostile design
principles themselves:

- can you see any aspects which inaccurately reflect trade-offs
- can you see methods to bypass inadvertently or deliberately the design 
  that might require another corollary to correct.

In anticipation of constructive criticism,

Adam

[1]
==============================8<==============================
GAK-hostile design principles

If we take the design goal of designing systems including
confidentiality which are not GAK compliant, we can most succinctly
state this design goal as the task of ensuring that:

- at no point will any data transferred over communications links be
  accessible to anyone other than the sender and recipient with out
  also obtaining data on the recipient and/or senders disks


We can then derive the design principles required to meet the design
goal of a non-GAK compliant system with confidentiality services down
to ensuring that:

principle 1:
   no keys used to secure communications in any part of the system are
   a-priori escrowed with third parties

principle 2:
   second crypto recipients on encrypted communications are not
   used to allow access to third parties who are not messaging
   recipients manually selected by the sender

principle 3:
   communications should be encrypted to the minimum number of
   recipients (typically one), and those keys should have as short a
   life time as is practically possible

principle 4:
   deployment wins.  violating any of principles 1 to 3 whilst
   still retaining some GAK-hostility can be justified where
   deployment is thereby increased to the extent that the violations
   increase the degree of GAK hostility in the target jurisdictions
   overall

Corrollary 1: Included in design principle 2) is the principle of not
re-transmitting keys or data after decryption over communication
channels, re-encrypted to third parties -- that is just structuring --
and violates design principle 2.

Corrollary 2: where communications are transmitted which violate
principles 1, 2 or 3 it is in general more GAK hostile to enforce as
far as possible that the recovery or escrow information remains in as
close proximity to the data as possible.

Corrollary 3: where communications are transmitted which violate
principles 1, 2 or 3 it is in general more GAK hostile to make these
communications as difficult to automate as possible.  For example no
scripting support is given to enforce that GUI user interaction is
required, and/or that the process is made artificially time consuming,
and/or that the communication must not use electronic communication
channels

==============================8<==============================






From hoffmang at pgp.com  Wed Oct 15 16:22:50 1997
From: hoffmang at pgp.com (Gene Hoffman)
Date: Thu, 16 Oct 1997 07:22:50 +0800
Subject: anti-GAK design principles: worked example #1
In-Reply-To: <199710152245.XAA01135@server.test.net>
Message-ID: 



On Wed, 15 Oct 1997, Adam Back wrote:

> 
> - store a copy of the private half of the users PGP encryption key
>   encrypted to the company data recovery key on the users disk.
> 

You would rather have PGP implement private key escrow?

Gene Hoffman
PGP, Inc.







From stewarts at ix.netcom.com  Wed Oct 15 16:26:44 1997
From: stewarts at ix.netcom.com (stewarts at ix.netcom.com)
Date: Thu, 16 Oct 1997 07:26:44 +0800
Subject: proposal: commercial data recovery
In-Reply-To: <199710140937.KAA01187@server.test.net>
Message-ID: <3.0.3.32.19971015113856.006aa938@popd.ix.netcom.com>



At 02:34 AM 10/15/1997 -0700, Will Price, probably annoyed at the
flaming that PGP5.5 has received, flames out Adam Back's proposal
for not doing the right things for his perceived market.
But PGP5.5 doesn't do most of those same things either.

>First, let me state some overriding design goals of a 
>data recovery system required to ensure privacy: 
>the sender must know and consent to every key
>that will be able to read the message during its lifetime, 

As Ian and Ian have pointed out, this is bogus - 
the sender can't control the recipients' uses of the message.
At most the sender has a right to control who receives the
message _until_ the recipient gets it,
and if they don't trust the recipient, they shouldn't send it.

>the encryption must be end-to-end, and 
This is fine.

>the recipient must know exactly who else can decrypt the message.  

PGP 5.5 does not provide this; the message headers only provide KeyID
for each recipient, not the person using the keys, so the recipient
only knows those recipients whose KeyIDs he knows or can look up.
(Plus deadbeef attacks make even those suspect.)

>In your model, the recipient automatically
>decrypts and then re-encrypts to a data recovery key -- even though
>end-user computers are likely to be insecure thus making this decrypt &
>reencrypt step rather specious at best.  

Again, this is bogus - if the recipient's computer is insecure,
then the data is insecure from the moment the recipient decrypts it,
a step that even PGP5.5 does not usually prevent :-)

>As an actual data recovery system, it also fails fundamental tests.
>If I encrypt critical data to a colleague wiping it from my system 
>after sending, then the colleague is incapacitated before receipt 
>and processing of the message, the data can never be retrieved.  

Bogus.  If you send critical data to a colleague entirely in the clear,
and sendmail eats it instead if delivering it to your colleague,
or the colleague's mailbox disk drive crashes before he reads it,
and you have wiped the only copy before confirming receipt of the message, 
you lose and PGP5.5 won't help any, since neither PGP5.5 nor the
PGP SMTP filters cause extra copies to be created.
If you do this sort of thing often, you need a new definition of critical.

What you need is automated message receipts, and the decryption system 
needs to offer your recipient a user-friendly way to send receipts
when he actually reads the message.  PGP5.5 doesn't do this 
(not its job - it's an encryption program, not a mail user agent) 
and the mail client's receipts aren't enough, since they don't know 
if your recipient could decrypt the message successfully  
(nor whether they could read the language it was written in,
nor whether the contents made any sense, 
nor whether the recipient agreed with the content of the message. :-)

>I'm truly amazed that you would attack in such a spiteful fashion

If you can't tell serious concerns from spite, your ego's in the way
(you've probably been reading too many negative reviews lately. :-)
There are serious problems with the PGP5.5 approach, even though it 
does solve real business problems that some of your real customers have,
or at least think they have.

>a simple system which adds a recipient-requested, sender-approved 
>extra recipient which is end-to-end wherein all recipients are 
>under the sender's control and

Only the choice of keys is under the sender's control, 
not the knowledge of what actual _people_ hold those keys or 
what the CMRKers will do with the data, or even whether they 
have received copies unless she mails copies them directly
In the PGP SMTP filter context, if the sender must include
certain keys to get the message delivered, that's a rather 
limited definition of "under the sender's control".

> each recipient knows who can read the message with no key escrow 

As above, the recipients don't know each other unless
they happen to have each others' KeyIDs on their keyservers,
and since PGP5.5 "elegantly" doesn't indicate whether a recipient
is there because the sender wanted them or whether they're CMRKers.
Sure, if there's only one real recipient, both sender and recipient
know the eavesdroppers, but if there's more than one real recipient,
there's no way to tell.

>using the same old PGP message format we all know and love without change, 
If you count 5.0 message format as "old" :-)  And while the
CMRK fields apparently were in 5.0 key record formats, they weren't used,
and the semantics are much different even if the syntax is the same.
Treating desired recipients and undesirable recipients the same
is one approach, but it doesn't accomodate people who want
secret sharing to prevent a single CMRker from recovering the message.

>and yet you propose a much less secure system which allows hiding 
>critical information from the sender and does not adequately perform 
>its stated purpose of data recovery.
I'm not flaming Adam's proposal here; that's a job for another message :-)
In particular, it seems to be evolving, and I haven't figured it out yet,
nor am I convinced there is a way to adequately perform the purposes
of data recovery.
				Thanks!
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From aba at dcs.ex.ac.uk  Wed Oct 15 16:52:09 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Thu, 16 Oct 1997 07:52:09 +0800
Subject: fallacy alert!
In-Reply-To: <199710152145.XAA20388@basement.replay.com>
Message-ID: <199710152321.AAA01692@server.test.net>




Anonymous writes:
> I thought that was the whole point of the PGP design.  It makes the
> presence of third parties clear and visible to all participants.  This
> seems to be the fundamental principle.

I have noticed serveral PGPers use this fallacy also.

It is a fundamental irrelevance.  If PGP Inc has selected this
principle as a guiding principle then they're nuts.

It matters not one whit what `statement of intent' you mark PGP CMR
extended public keys with.  That statement is semantically meaningless
as a design principle because it is utterly unenforceable.

Here are two examples to show how your expectation can be broken:

- the user decrypts your message encrypted to a `company access' key,
  and then proceeds to post it to cypherpunks

- you send a message encrypted to a `company access' key, but the
  company screwed up and lost the private half of the company access
  key

In neither case is the statement of intent honoured.  There are lots
of other ways to not honour such statements of intent, such as perhaps
forwarding a copy to your own supervisor at your company, or printing
out on paper and giving to secretary to file for future reference.

> PGP is designed to allow Alice and Bob to be informed if third party
> access is built in.  Key escrow and re-encryption are inherently
> less visible forms of message access.

re-encryption and forwarding tends to be GAK pervertable, it violates
design principle 2 as explained in corollary 1 of the anti-GAK
principles.  Do not do this.  (I didn't realise the full danger of
this construct until recently, and is one result which fell out of the
exercise of developing a codified set of design rules to guide
protocol designers away from building GAK-compliant or GAKker-useful
software).

"Key escrow" is too perverted a term to know even what you are
referring to.

If you mean data recovery (my CDR proposal) it is _exactly_ as visible
as CMR.  You can affix all the statements of intent you like to it.
(For all the good it will do you.)

There can be no enforcement of statement of intents.  All you can do
is hope that companies are not lying; encourage them to behave in ways
which you consider ethical.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710160011.AAA21851@manifold.algebra.com>



Thank you, Andy.

I hope that the proposal in its current form will not pass if we 
vote against it. In that case, an unmoderated group will be created.

igor

Andy Dustman wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> On Wed, 15 Oct 1997, Igor Chudov @ home wrote:
> 
> > For your information -- all anonymity advocates take note of the
> > comp.org.cauce Call For Votes which wants to outlaw anonymity.
> 
> Yes, I find it particularly interesting that the CFV states only that "The
> newsgroup is robomoderated to eliminate crossposts and advertisements
> only" but does not mention that the robomoderation requires a repliable
> (i.e., non-anonymous) e-mail address. (This IS mentioned for the voting
> procedure, but not for the group itself. 
> 
> Also, in <6203tu$kuj at server2.mich.com>, the proponent for comp.org.cauce
> states, "The CFV says people must return an e-mail sent to the address
> from which they make the post," which, as near as I can tell, is a lie or
> error; I got the ballot from my local server (<876781691.12806 at isc.org>)
> and it says no such thing, only that it is robomoderated. "Robomoderated"
> does not imply that you "must return an e-mail sent to the address from
> which [you] make the post". Maybe it says that in the last RFD, but not in
> the CFV. 
> 
> At any rate, if for some reason this CFV is approved, I will post
> something to comp.org.cauce with the remailer, and when the reply comes
> back (yes, the return address is valid), I'll reply to it, so cracker will
> be able to post there, until somebody decides, using their "discretion",
> to ban posts from the remailer address.
> 
> If it were comp.org.cauce.announce, I really wouldn't give a shit about
> what the moderation policy is, but it's represented as a group where
> "opinions contrary to those of CAUCE are solicited and welcomed," and I
> don't have too much confidence that this will be the case.
> 
> Spam sucks but censorship is worse.
> 
> Andy Dustman / Computational Center for Molecular Structure and Design / UGA
>     To get my PGP public key, send me mail with subject "send file key".
> For the ultimate anti-spam procmail recipe, send me mail with subject "spam"
> "Encryption is too important to leave to the government."  -- Bruce Schneier
> http://www.athens.net/~dustman   mailto:andy at CCMSD.chem.uga.edu       <}+++<
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.3ia
> Charset: noconv
> 
> iQEPAwUBNEUYFxOPBZTHLz8dAQE0OgfPTw5k5z9BfLUwVlORUW3dcgspkTsnB8xg
> MZLxH/7mxsOcTkS/yjggqwKloMf5FS5kHB7rQ3D2aWboagxvGDaEU72d33fDs/uE
> LyDT4+uHB4DVZibOcHXWGNY5QxC8Y2kPbzWpPE8PPrYQXbBpmxC2qYkO7wXtS0a4
> zl9EnWai8xgE7GcRrHbOiqoxJ7LCEOUb1JuFJxloUOJ9ilWYaYs5CJ8ZW0itS4Fe
> MLmF9iJOK/j/nK9RIIXfIH0011v52XosFtWBajWvZygmEdEnTG9HhkRc4XFODTiy
> F8hoBlOiwnAOiSNOoCoxeLjhNe4L0TSHhU8G9Je4wlF1Pg==
> =lZxq
> -----END PGP SIGNATURE-----
> 



	- Igor.






From ichudov at www.video-collage.com  Wed Oct 15 18:15:12 1997
From: ichudov at www.video-collage.com (Igor Chudov @ home)
Date: Thu, 16 Oct 1997 09:15:12 +0800
Subject: CFV: comp.org.cauce moderated -- support privacy and anonymity
In-Reply-To: <872169177.17960@isc.org>
Message-ID: 



[This message has also been posted.]
[I am objecting to a proposal that seeks to ban one-way anonymous
remailers and other forms of unrepliable addresses such as spamblocked
addresses].

In news.groups, WD Baseley  wrote:
* [my apologies to the net at large for replying sans *snecks* - I don't
* know which group is read by the person to whom I'm replying.]
* In article <3447bfd7.22958863 at 128.2.84.191>, phelix at vallnet.com
* >On 14 Oct 1997 11:57:07 -0400, moz at server2.mich.com (John C. Mozena) wrote:
* >>Igor Chudov @ home  wrote:
* >>>Vote AGAINST comp.org.cauce which wants to outlaw anonymity and
* >>>use of spamblocked addresses. Go to news.groups and find the
* >>>CFV for comp.org.cauce, with the ballot enclosed.
* >>
* >>Vote for comp.org.cauce, which protects the utility of a newsgroup and the
* >>freedom of postmasters to not run anonymous posting services should they
* >>not so desire.
* >
* >Well, I just started reading this, and I didn't really know which way to
* >vote.  But such an anti-anonymnity stance makes the choice clear:
* >
* >vote *NO*.
* 
* Since you just started reading this, I think you need more background
* before coming to a decision.  I'm not trying to influence it one way
* or another;  I'm just trying to give you more complete information.
* I'm posting and emailing, and I'm sure that if I get it wrong I'll be
* jumped upon thoroughly in the newsgroups - feel free to look there and
* see if that happened.

By all means, as one of the opponents of the proposal and supporter
of anonymity, I ask you to do so and also get your privacy-concerned
friends to take a close look at the debate.

For example, here's what the proponent said:

Mozena>>But, what do you have against anonymity?
Mozena>
Mozena>Nothing. What right do you have, though, to force me and others to
Mozena>inconvenience ourselves so you can post anonymously or protect yourself
Mozena>from spam?

* The RFD requires posters to use addresses which receive, and reply to,
* email; in other words, no munged, faked, spamblocked, or other
* bouncing or redirecting addresses.  There is nothing that says you
* must use your real name, or any other identifier, that tells who you
* really are.  If "the-return-of-zorro at example.com" receives and replies
* to email, it can be used to post to the proposed group.  "Anonymity",
* the ability to post without anyone knowing your true identity, is not
* really the issue.  Even anonymous remailers will work if they forward
* email in both directions.  But mungs and spamblocks will not work.

These are not anonymous remailers, they offer a much lower security,
they are not very reliable by their very design, and the only 
*true* anonymity can come from a one-way remailer.

The proposal, as it stands, seeks to outlaw the one-way anonymous
remailers.

* John Mozena's comment on anonymous posting services stems, I'm pretty
* sure, from an alternative offered by several folks.  The idea was:
* posters would add an 'X-Real-Address' line to their posts;  the
* moderation bot would use that line for correspondence, but remove it
* before making the post public.  John Mozena and others at CAUCE were
* unwilling to do this because of possible legal ramifications;  John
* likened it to running an anonymous posting service, and wondered what
* the consequences would be should someone use it to post copyrighted or
* sensitive information.

Well, this is NOT true. John objected to it with the argument that he
does not like unrepliable addresses appearing in newsgroups.

Anyway, all this talk about the X-Real_Address: field is NOT related to
true anonymity, by the very definition of the latter.

-- 
	- Igor.

The average American spends a total of six (6) months in prison. 






From jim.burnes at ssds.com  Wed Oct 15 18:16:06 1997
From: jim.burnes at ssds.com (Jim Burnes)
Date: Thu, 16 Oct 1997 09:16:06 +0800
Subject: Rules of Engagement on Video
Message-ID: 




I know this isn't directly cypher related, but oh well.

An award winning film, "Waco: the rules of engagement" is now
available on video.  Previously running at Art Houses and Film
Festivals it was produced by a few revolutionary media people.
Somehow it occurred to them that all the right-wingers had beaten
them to the punch making civil rights abuses known to the public.
Can't have any of that now, can we?  Why should *they* have all the
fun?

Anyway its been lauded as a very well balanced work.  Not like those
other people -- talking about evil, new world order conspiracies. ;-)

Probably most noteworthy is the included FLIR FBI footage (Forward Looking
InfraRed) which, under expert scrutiny, appears to show LEFs raining
automatic fire down on citizen units trying to escape the final
conflagration.  Here expert scrutiny is defined as the head of research
for the army night vision development group.

Its definitely the cure for those times when GAK starts looking like
reasonable, sensible and prudent alternative. 

I have absolutely no involvement or monetary connection to these
people.  I just wish they would have put it on video first.


"Is your religion BATF approved?"

---------- Forwarded message ----------
Date: Wed, 15 Oct 1997 12:34:04 -0700 (PDT)
From: SomFord Entertainment 
To: somford at worldnet.att.net
Subject: "Waco: The Rules of Engagement" Video Order Form

Thanks for your interest in obtaining the video of  "Waco: The Rules of
Engagement".
We are pleased to announce that it is finally available!  Please check the
website
periodically for ongoing reviews, press, announcements and updates to the
order form.

http://www.waco93.com/

"Waco: The Rules of Engagement"  Video Order Form

Print, Complete, And Mail This Form With Check Or Money Order To:
SomFord Entertainment, 8778 Sunset Bl., Los Angeles, CA 90069

Questions: 310-289-3900

     1. E-Mail Address:...............................................

     2. First Name:...................................................

     3. Last Name:....................................................

     4. Street Address:...............................................

     5. Apt. No., Other Info:.........................................

     6. City:.........................................................

     7. State/Province:...............................................

     8. Country:......................................................

     9. Postal Code:..................................................

     10. Phone:.......................................................

     11. "Waco: The Rules of Engagement" Video.........Quantity:......

           $25.00 for 1 tape.
           $22.50 each for 5 tapes.
           $20.00 each for 10 tapes.

           Bookstores and Catalogues, Call for Bulk Order Info.
           All Prices Include Domestic Shipping and Handling.
           CA Residents Please Add 8.25% Sales Tax.

     12. Total:.......................................................

     Make Check or Money Order Payable to: SomFord Entertainment.

     Comments Or Special Delivery Instructions:.......................





     Please allow three weeks for delivery. Thank you for your order










From tcmay at got.net  Wed Oct 15 18:34:02 1997
From: tcmay at got.net (Tim May)
Date: Thu, 16 Oct 1997 09:34:02 +0800
Subject: 
In-Reply-To: <199710152145.XAA20388@basement.replay.com>
Message-ID: 



At 2:45 PM -0700 10/15/97, Anonymous wrote:
>Tim May  writes:
>> This also applies to CMR as well. Whatever the perceived business reasons
>> for CMR, the fact is that it introduces additional failure points. No
>> longer will Alice and Bob be secure that at least there are no "other
>> readers" in the channel between them (what they do with the plaintext after
>> decryption is of course solvable by no technology).
>
>I thought that was the whole point of the PGP design.  It makes the
>presence of third parties clear and visible to all participants.  This
>seems to be the fundamental principle.  PGP is designed to allow Alice
>and Bob to be informed if third party access is built in.  Key escrow
>and re-encryption are inherently less visible forms of message access.

My explicit point was about what happens to plaintext _after_ it has been
received. Not an exceptionable point, it seems to me. CMR doesn't tell
anybody anything about who later sees the plaintext (it can't, which was my
point).

And CMR of course does not actually stop the practice of requiring
employees to physically "escrow" keys. I would expect that most companies
now requiring employees to deposit copies of their keys may well continue
to do so.

(And I'll bet the CMR keys are _also_ required to be escrowed...the CMR
keys are too valuable not to be copied multiple times.)

Finally, I stand by my point that it introduces security weaknesses in the
model.

--Tim May




The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From gbroiles at netbox.com  Wed Oct 15 18:48:21 1997
From: gbroiles at netbox.com (Greg Broiles)
Date: Thu, 16 Oct 1997 09:48:21 +0800
Subject: Security flaws introduced by "other readers" in CMR
In-Reply-To: <19971015173435.26095@rigel.infonex.com>
Message-ID: <3.0.3.32.19971015183740.008cad00@mail.io.com>



Tim May  wrote:

>Truly sensitive stuff--stuff about takeovers, foreign production plans, new
>products, etc.--will be encrypted with channels having no nosy security
>guards or Corporate Crypto Compliance Police silently listening in.
>
>Which means we're back to square one. So why does PGP, Inc. bother?

Because they've got customers who will pay for CAKware. 

Why will customers pay for it? Same reason the FBI wants GAK, even though
motivated/well-informed crypto users will superencrypt or otherwise bypass
the enforcement mechanisms. If you're the C in CAK or the G in GAK, access
to some data is better than access to no data - and the possibility of
enforcement radically alters the risk/benefit calculus of even intelligent
actors who see their interests as contrary to those of the [C,G]. 

As Jon Callas confirmed at the recent Cpunks physical meeting, the current
CAK/CAM/whatever system has very weak code re policy enforcement - for
example, it'll allow otherwise forbidden messages to pass through its
filters if even the "--- BEGIN PGP MESSAGE ---" lines are altered or
removed. It won't disassemble tar or zip or uuencode packages, or otherwise
attempt to discover simple attempts to bypass the enforcement mechanisms.
They're not trying to stop determined covert communicators - that's not
their threat model.


--
Greg Broiles                | US crypto export control policy in a nutshell:
gbroiles at netbox.com         | Export jobs, not crypto.
http://www.io.com/~gbroiles | http://www.parrhesia.com






From ichudov at Algebra.COM  Wed Oct 15 19:04:59 1997
From: ichudov at Algebra.COM (Igor Chudov @ home)
Date: Thu, 16 Oct 1997 10:04:59 +0800
Subject: Rules of Engagement on Video
In-Reply-To: 
Message-ID: <199710160142.BAA22468@manifold.algebra.com>



If you want to buy one (I do not as I do not have a VCR), ask
ddeming at ou.edu, he wanted to find 9 people to purchase the tapes at a
quantity discount.

igor

Jim Burnes wrote:
> 
> 
> 
> I know this isn't directly cypher related, but oh well.
> 
> An award winning film, "Waco: the rules of engagement" is now
> available on video.  Previously running at Art Houses and Film
> Festivals it was produced by a few revolutionary media people.
> Somehow it occurred to them that all the right-wingers had beaten
> them to the punch making civil rights abuses known to the public.
> Can't have any of that now, can we?  Why should *they* have all the
> fun?
> 
> Anyway its been lauded as a very well balanced work.  Not like those
> other people -- talking about evil, new world order conspiracies. ;-)
> 
> Probably most noteworthy is the included FLIR FBI footage (Forward Looking
> InfraRed) which, under expert scrutiny, appears to show LEFs raining
> automatic fire down on citizen units trying to escape the final
> conflagration.  Here expert scrutiny is defined as the head of research
> for the army night vision development group.
> 
> Its definitely the cure for those times when GAK starts looking like
> reasonable, sensible and prudent alternative. 
> 
> I have absolutely no involvement or monetary connection to these
> people.  I just wish they would have put it on video first.
> 
> 
> "Is your religion BATF approved?"
> 
> ---------- Forwarded message ----------
> Date: Wed, 15 Oct 1997 12:34:04 -0700 (PDT)
> From: SomFord Entertainment 
> To: somford at worldnet.att.net
> Subject: "Waco: The Rules of Engagement" Video Order Form
> 
> Thanks for your interest in obtaining the video of  "Waco: The Rules of
> Engagement".
> We are pleased to announce that it is finally available!  Please check the
> website
> periodically for ongoing reviews, press, announcements and updates to the
> order form.
> 
> http://www.waco93.com/
> 
> "Waco: The Rules of Engagement"  Video Order Form
> 
> Print, Complete, And Mail This Form With Check Or Money Order To:
> SomFord Entertainment, 8778 Sunset Bl., Los Angeles, CA 90069
> 
> Questions: 310-289-3900
> 
>      1. E-Mail Address:...............................................
> 
>      2. First Name:...................................................
> 
>      3. Last Name:....................................................
> 
>      4. Street Address:...............................................
> 
>      5. Apt. No., Other Info:.........................................
> 
>      6. City:.........................................................
> 
>      7. State/Province:...............................................
> 
>      8. Country:......................................................
> 
>      9. Postal Code:..................................................
> 
>      10. Phone:.......................................................
> 
>      11. "Waco: The Rules of Engagement" Video.........Quantity:......
> 
>            $25.00 for 1 tape.
>            $22.50 each for 5 tapes.
>            $20.00 each for 10 tapes.
> 
>            Bookstores and Catalogues, Call for Bulk Order Info.
>            All Prices Include Domestic Shipping and Handling.
>            CA Residents Please Add 8.25% Sales Tax.
> 
>      12. Total:.......................................................
> 
>      Make Check or Money Order Payable to: SomFord Entertainment.
> 
>      Comments Or Special Delivery Instructions:.......................
> 
> 
> 
> 
> 
>      Please allow three weeks for delivery. Thank you for your order
> 
> 
> 
> 
> 



	- Igor.






From jon at pgp.com  Wed Oct 15 19:19:56 1997
From: jon at pgp.com (Jon Callas)
Date: Thu, 16 Oct 1997 10:19:56 +0800
Subject: anti-GAK design principles: worked example #1
In-Reply-To: 
Message-ID: <3.0.3.32.19971015190021.00ae9730@mail.pgp.com>



At 11:45 PM 10/15/97 +0100, Adam Back wrote:
   

Okay, Adam, I'll be civil here, but here's something I want to note:

You've ranted, raved, politicized, propagandized, given ad hominem attacks,
and stated the opinion that anyone who disagrees with you is evil. You've
sent flames to our internal development lists, which is at least impolite.
Yet you say, "constructive criticism only." Sure. I'd like an apology from
you, though. Deal?


   
>   Also I have been accused of using "lots of anti GAK rhetoric, but
>   giving no proposals" by Kent.  I reject that claim.  (I did use lots
>   of rhetoric, but this was to try to impress upon those arguing for CMR
>   of it's dangers.  They do not seem to acknowledge them.) I'll try in
>   this post to steer clear of anti-GAK rhetoric.  We'll instead take it
>   as a given that pgp5.5 and pgp5.0 are GAK compliant because of CMR and
>   that this is a bad thing.

Uh huh. Steer clear of rhetoric, but we'll take it as a given that you're
right and everyone else is wrong. At least this is a de-escalation.
   
>   Design 1.
>   
>   Instructions:
>   
>   - scrap the CMR key extension
>   
>   - store a copy of the private half of the users PGP encryption key
>     encrypted to the company data recovery key on the users disk.

Okay -- constructive criticism only. I sincerely hope I'm reading this
correctly. You're saying that someone's private key should be encrypted to
the corporation's key. This sounds like key escrow to me. How does this
differ from the overly strict, nit-picking, freedom-threatening definition
that I gave? 

This is better than the throw-the-floppy-in-the-safe model in that the
company-readable version of your key is sitting on your machine. That's good. 

I see a threat here that if the corporation backs up my disk, they they
have my secret key and thus can read all files that key has ever encrypted.
This is bad. Normally, if they back up my system, they have my secret key,
but they have to hack my secret key. Most people's passphrases are easier
to crack than a public key, but I think this is worse.

With this system, the corporation can read everything I encrypt with that
key, because they effectively own it. Encrypting my secret key to them
essentially gives it to them. With CMR, I have the option of making some
files readable, and some not. This isn't necessarily a good thing -- some
companies want access to all data, and your proposal helps them.

I'm actually very surprised by this design of yours. On the scale of
property-balanced-with-privacy, you've come down hard on the side of
property. Your system makes it so that an employee of a company can *never*
use this key for a purpose the company can't snoop on. This isn't
necessarily bad, I think that people *should* have separate keys for work
and personal use. This just makes the work key definitely the work key. A
number of our customers will like that.
   
>   - (optional) design the software to make it hard to copy the data
>     recovery packet from the disk, hide the data, bury it in keyrings,
>     stego encode it, whatever, use your imagination.  This is to attempt
>     to restrict the third parties ability to by pass the principle of
>     non communication of recovery information
   
This is security through obscurity. We publish our source code, so this
won't work.
   
>   Recovery method:
>   
>   Custodian of recovery key inserts recovery floppy disk in machine,
>   decrypts copy of users private key, hands control back to user to
>   choose new passphrase.

Choosing a new passphrase is not sufficent. If the custodian ever uses that
key, it *must* be revoked, a new encryption key issued, and all data
encrypted with it re-encrypted. There is also the problem of
re-distributing the revocation and new encryption key to all the people who
have your old one. This is no worse than any other revocation problem, but
CMR does not require revoking the user's key.   
   
>   Possible objections:
>   
>   objection #1. what if disk burns?
>   counter #1:   backup your disk
>   
>   objection #2: users don't back up disks
>   counter #2:   that is a good way to loose data :-) if they don't have
>                 the data the key protecting the data won't help them

This is no different with CMR. One of the design goals of CMR is to avoid
the myriad logistic and security problems associated with data archival.
   
>   GAK-hostility rating:
>   
>   Harder to pervert for GAK than pgp5.5 / pgp5.0 CMR design.

Why? With your mechanism, if the G manages to A the K, then they can
decrypt every message that key has ever encrypted. I think this is a design
flaw. 
   
   
>   I'd be interested to see Will, or Hal, or other PGPer's criticisms of this
>   simple modification, perhaps criticisms could most constructively answer:
>   
>   - what is stopping you implementing this
>   - are there any plug ins which can't cope with this
>   - are there user requirements which it can't meet
>   - is there some fundamental flaw you think I have missed
>   - can you see ways that this could be perverted to implement GAK
>     (yes I can too, btw, but...)
>   - are those ways logisitically harder for GAKkers to acheive than for CMR
>   
>   Please be specific, no general waffle about understanding the
>   complexities of balancing user ergonomics, user requirements etc.
>   That is a no-brainer, you need to do this analysis, the cost function
>   for evaluating such design issus is now expressed explicitly in design
>   principle 4 rather than being assumed.  List problems and explain the
>   significance of the all important deployability criteria.
>   
>   Cryptographic protocol designs are very flexible; most design goals can
>   be met, or worked around I claim within the positive GAK-hostility
>   side of the cryptographic protocol and product design solution space.
>   
>   Lastly, I would encourage readers to be critical of the GAK-hostile design
>   principles themselves:
>   
>   - can you see any aspects which inaccurately reflect trade-offs
>   - can you see methods to bypass inadvertently or deliberately the design 
>     that might require another corollary to correct.
>   
>   In anticipation of constructive criticism,

Okay, general observations:

I'm really surprised at this. In the continuum between privacy and
property, you've come down hard on the side of property. You've said that a
key owned by a corporation is *fully* owned by the corporation, and any
employee who uses it for personal purposes is daft. This is not what I
expected you to be arguing.

Enforcement. Most corporations want some level of enforcement on their
policies. The enforcement we put in isn't fool-proof, but it's far easier
to comply than resist. This is a design goal. I have a concern that the
only enforcement that the corporation has is to take your private key. If
this is their only way to make you follow their rules, they'll do it. Many
of them will play nice if possible, but hardball if they have to.

Fair-warning. In my first missive, I talked about my own principles, and
one of them is the "fair-warning" principle. It states that users should
know what is going on. If you have a key that is used in this system, there
is nothing in it that tells me that your company can read a message I send
you. I see this as a flaw, and one that I consider to be a *very* big deal.
Full disclosure is one of my hot buttons.



I think this is breaks a number of your principles.

Principle 1: The end-user's keys *are* escrowed with the company. If my
disk is ever backed up, then the corporation has my secret key. In order to
keep it from being implicitly escrowed, I have to put it someplace like
off-line media that can be gotten to if I'm hit by a bus. If you disagree,
please tell me how this is different from escrow.

Principle 2: The corporation is always a tacit crypto-recipient. It's no
different than CMR, and has the additional disadvantage that senders don't
know that the implicit receivers are there.

Principle 3: Again, the corporation is a tacit recipient in *all* uses of
the key. With CMR, they are an explicit recipient, and it's possible to
exclude them. There's no way to exclude the corporation here.

Principle 4: I don't see how this differs between your proposal and CMR.


Lastly, I here's a summation of what I think.

I think it's an interesting proposal. You're much more of a
corporate-control proponent than I am. I think control and privacy have to
be balanced, whereas you obviously think corporate control is trump. We
disagree there.

I am uncomfortable at the ease with which the end user can lose their key.
The end user must somehow prevent the employer from even so much as backing
up their computer, or it's just plain escrow.

I am uncomfortable not only with your siding with the corporation against
the employee's privacy, but also with your siding against the privacy of
someone who sends a message to the employee. Furthermore, I think that the
absence of a disclosure mechanism in your protocol is for us, a fatal flaw.
We'd never implement a system that does not have disclosure.

I do not see how your system is GAK-hostile. I think it is no more
GAK-hostile than CMR, and potentially more GAK-friendly, because it is
based around manipulating the actual secret key material. The failure mode
of CMR is that an adversary can decrypt messages, whereas the failure mode
of your proposal is that the adversary gets the key.

	Jon

   
   Adam
   
   [1]
   ==============================8<==============================
   GAK-hostile design principles
   
   If we take the design goal of designing systems including
   confidentiality which are not GAK compliant, we can most succinctly
   state this design goal as the task of ensuring that:
   
   - at no point will any data transferred over communications links be
     accessible to anyone other than the sender and recipient with out
     also obtaining data on the recipient and/or senders disks
   
   
   We can then derive the design principles required to meet the design
   goal of a non-GAK compliant system with confidentiality services down
   to ensuring that:
   
   principle 1:
      no keys used to secure communications in any part of the system are
      a-priori escrowed with third parties
   
   principle 2:
      second crypto recipients on encrypted communications are not
      used to allow access to third parties who are not messaging
      recipients manually selected by the sender
   
   principle 3:
      communications should be encrypted to the minimum number of
      recipients (typically one), and those keys should have as short a
      life time as is practically possible
   
   principle 4:
      deployment wins.  violating any of principles 1 to 3 whilst
      still retaining some GAK-hostility can be justified where
      deployment is thereby increased to the extent that the violations
      increase the degree of GAK hostility in the target jurisdictions
      overall
   
   Corrollary 1: Included in design principle 2) is the principle of not
   re-transmitting keys or data after decryption over communication
   channels, re-encrypted to third parties -- that is just structuring --
   and violates design principle 2.
   
   Corrollary 2: where communications are transmitted which violate
   principles 1, 2 or 3 it is in general more GAK hostile to enforce as
   far as possible that the recovery or escrow information remains in as
   close proximity to the data as possible.
   
   Corrollary 3: where communications are transmitted which violate
   principles 1, 2 or 3 it is in general more GAK hostile to make these
   communications as difficult to automate as possible.  For example no
   scripting support is given to enforce that GUI user interaction is
   required, and/or that the process is made artificially time consuming,
   and/or that the communication must not use electronic communication
   channels
   
   ==============================8<==============================
   
   

-----
Jon Callas                                  jon at pgp.com
Chief Scientist                             555 Twin Dolphin Drive
Pretty Good Privacy, Inc.                   Suite 570
(415) 596-1960                              Redwood Shores, CA 94065
Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS)
              665B 797F 37D1 C240 53AC 6D87 3A60 4628           (RSA)






From krl at vicomp.com  Thu Oct 16 11:02:47 1997
From: krl at vicomp.com (K.R. Lewis)
Date: Thu, 16 Oct 1997 11:02:47 -0700 (PDT)
Subject: Document on Customizing OpenBSD after install
Message-ID: <1.5.4.32.19971016122647.0099686c@192.168.1.15>


At 10:46 AM 10/15/97 -0700, J. Joseph Max Katz wrote:  AND Randy Lewis has a remark
                                                       about JJMK's response....below
>Re...
>
>In the coming weekend, I'll be updating the newuser FAQ
>(for things like PPP and 2.2). I'm sure a post-install checklist would be
>a welcome addition.
>
>B U T . . . .
>
>Not everyone runs things like Kerberos or DNS. Keep in mind that many
>people use OpenBSD for many things and in many environs. The OpenBSD setup
>on my firewall at the office is much different than the Sparc, Alpha, and
>P5/133 I run it on at home. The setup on my router machine at home is also
>much different than the other machines in my house. There are ways people
>have setup OpenBSD on embeded systems to do things like manage the
>fuel/air mix ratio on their Corvettes (OK, one person I know of planned
>that, but couldn't get the financing for the car...) I hope that draws the
>picture.
>
>As for the verification after install, that is sort of "auto-manditory"--
>if a filesystem isn't mounted right, /etc/fstab has to be checked out. If
>the network doesn't work, the network files must be examined to "make it
>go." As oopposed to attacking this as a checklist, how about it is
>attacked as "If networking doesn't work, check hostname.(interface)"-- but
>there is more to that then just files in /etc (boot -c in order to
>reconfigure hardware addresses)

As a user of OpenBSD, and having tried to manage projects with it for
implementation of added features for customers...I could not agree with
the above position.

You see, if you are ALREADY familiar with OpenBSD then you will most likely
know exactly what to do when installing and seting up a system. New User's
Notes / Installation Checklist's will most likely be ignored by you.

However, if you are brand new to the system, then an Installation / Setup
Checklist (a good one) will prove to be essential. Wouldn't it be great if
just about every post to these groups from a new user was one like "..hey!
This OpenBSD thingy works great! The installation was a snap!.." or something
like that.  We all know that hardly happens now...but, it could.....

I, for one, believe strongly that a good 'Overview', 'Setup Notes' and 'Installation
Checklist' must somehow find it's way into the distribution. It is also clear
that the machine / arch specific differences will require unique versions
for each.

Randy
>
>/----------------------------------------------------------------
>/ Jonathan Katz, jkatz at cpio.org         /  http://www.cpio.org
>/ Student, Unix geek, Security guy      /  http://posse.cpio.org
>/ President and Founder: Corinne Posse  /  http://jon.katz.com
>/ Phone: +1 (317) 590-7092              /  "OpenBSD: Secure!"
>/     "The meek may inherit the earth,      
>/             but Gale and I will seize the stars!"
>
>On Wed, 15 Oct 1997, Marshall Midden wrote:
>
>> Is there a checklist someplace on what to do after the install of OpenBSD 2.2?
>> 
>> I'm thinking like:
>>    1) Go into /etc
>> 	a) Verify disks and network interfaces configured correctly.
>> 	   Files: fstab, hosts, myname, hostname.le0, mygate, resolv.conf, defaultdomain.
>> 	   You might wish to turn off multicast routing in /etc/netstart.
>> 	b) Edit motd to make lawyers comfortable and delete "Welcome".
>> 	c) Fix passwd via "vipw" to change passwords, set up users, etc.
>> 	   Make sure password on "root".  Default is no password from console, and
>> 	   disabled from network.  Make sure to edit "group" for any user groups,
>> 	   and to put people into the wheel group if they need root access.
>> 	d) Any local configuration change in: rc.conf, rc.local
>> 	e) printcap, hosts.lpd	Get printers set up
>> 	f) Tighten security:
>> 		fbtab		Set security for X
>> 		inetd.conf	Turn off extra stuff, add that which is really needed.
>> 		rc.securelevel	Turn on Network Time Protocol.
>> 	g) kerberosIV		Get kerberos configured.  Remember to get a srvtab.
>> 	h) aliases		Local mail delivery (set postmaster, etc).  Run newaliases
>> 	   after changes.
>> 	i) bootptab		If this is a bootp server.
>> 	j) ccd.conf		If using concatenated disks (striped, etc).
>> 	k) exports		If this is an NFS server.
>> 	m) NIS (old yellow pages), hosts.equiv, defaultdomain, etc.
>> 	n) ifaliases for www, etc.
>> 	o) daily, weekly, monthly.
>> 	p) "amd" directory if using this package.
>> 	q) rbootd if needed for remote booting (ethernet MAC address to IP translation).
>> 	r) Any other files and directories in /etc.
>> 
>>    2) crontab -l.		Do you need anything else?
>>    3) After the first nights security run, change ownerships and permissions on things.
>> 	Best bet is to have permissions as in the security list.
>> 
>
>
>..              .
                     ()        | Kenneth R. (Randy) Lewis
 _/_/         _/_/ _/_/        | email: krl at vicomp.com
  _/        _/      _/         | phone: +1 919 644 6306
   _/      _/       _/         |   fax: +1 919 644 6409
    _/    _/        _/         | smail: V.I Computer, Inc.
     _/  _/         _/         |        531 Encinitas Blvd
      _/_/          _/         |        Bldg 114
       _/         _/_/_/       |        Encinitas, CA 92024
.           .  computer corp.  | http://www.vmepower.com





From eb at comsec.com  Wed Oct 15 20:06:42 1997
From: eb at comsec.com (Eric Blossom)
Date: Thu, 16 Oct 1997 11:06:42 +0800
Subject: Personal use crypto export
In-Reply-To: 
Message-ID: <199710160207.TAA09116@comsec.com>



> I agree with Tim May, I believe it's no longer an issue.  While the current
> EAR/crypto regs don't expressly say "personal use OK," they can be read
> that way under several exemptions, and I'm reliably told that BXA does.
> 
> In the draft EAR/crypto regs posted to John Young's site some months ago,
> the BAG license exception, at (d) and (f) (see below), specifically
> addresses crypto.  It's only a draft and may change, but I wouldn't worry
> about it.
> 
> Lee Tien
> 
> =A7740.14  Baggage (BAG).
> 
> (a)  Scope.  This License Exception authorizes individuals leaving the
> United States either temporarily (i.e., traveling) or longer-term (i.e.,
> moving) and crew members of exporting or reexporting carriers to take to
> any destination, as personal baggage, the classes of commodities and
> software described in this section.


License Exception TMP also applies.  The following is from
bxa123096.txt on jya.com.  I had to go to the Federal Register to
find the actual text of the exception (Sorry, not easily at hand.)

    Note that License Exception TMP is available
    for temporary exports and reexports of encryption items except under
    the provisions for beta-test software. License Exceptions TMP and BAG
    effectively replace the Department of State's personal use exemption.
    Software and technology that was controlled by the Department of
    Commerce prior to December 30, 1996 are not affected by this rule and
    will continue to be eligible for the publicly available treatment.
    I think that I had to go to the Federal Register to dig it out.

Eric






From ravage at ssz.com  Wed Oct 15 20:06:55 1997
From: ravage at ssz.com (Jim Choate)
Date: Thu, 16 Oct 1997 11:06:55 +0800
Subject: update.341 (fwd) [edited]
Message-ID: <199710160311.WAA08752@einstein.ssz.com>



Forwarded message:

> From physnews at aip.org Wed Oct 15 14:00:06 1997
> Date: Wed, 15 Oct 97 10:28:48 EDT
> From: physnews at aip.org (AIP listserver)
> Message-Id: <9710151428.AA08697 at aip.org>
> To: physnews-mailing at aip.org
> Subject: update.341
> 
> PHYSICS NEWS UPDATE                         
> The American Institute of Physics Bulletin of Physics News
> Number 341  October 15, 1997  by Phillip F. Schewe and Ben
> Stein
> 
> THE 1997 NOBEL PRIZE FOR PHYSICS has been won by

[text deleted]

> THE FIRST SOLID MATERIAL THAT CAN REVERSIBLY
> SWITCH BETWEEN METAL AND INSULATOR at room
> temperature and pressure, and without changing its chemical
> makeup, has been created by researchers at UCLA (James Heath,
> heath at chem.ucla.edu).  The researchers prepare a Langmuir film,
> an ultrathin layer of material on a water surface. The film consists
> of a 2-D hexagonal pattern of silver nanocrystals (only nm size)
> with each nanocrystal's surface capped by compressible organic
> molecules.  Applying pressure to the film can decrease the distance
> between adjacent nanocrystals from 12 to 5 angstroms.  When
> compressed, the film becomes shiny and its optical properties match
> those of a thin metal film.  Prior to compression, the film has the
> optical properties of an insulator: in this state, the
> nanocrystalsbehave as semi-isolated particles and they do not share
> electrons.  As the separation between nanocrystals decreases, the
> researchers observe a transition from "classical coupling" (adjacent
> nanocrystals induce the movement of charge in each other and
> thereby transfer energy) to "quantum coupling" (nanocrystals begin
> to share electrons simultaneously and electrons delocalize, or cease
> to occupy a specific position in the material). (C. P. Collier et al,
> Science, 26 September 1997)
> 






From jf_avon at citenet.net  Wed Oct 15 20:33:12 1997
From: jf_avon at citenet.net (jf_avon at citenet.net)
Date: Thu, 16 Oct 1997 11:33:12 +0800
Subject: Liberal lawyer joke  from Cdn-Firearms Digest V2 #34
In-Reply-To: <199710151438.IAA08437@broadway.sfn.saskatoon.sk.ca>
Message-ID: <199710160324.XAA26598@cti06.citenet.net>



On 15 Oct 97 at 8:38, Cdn-Firearms Digest wrote:

> FOCUS:  A Liberal lawyer sitting in Parliament thinks that a new law will
> fix anything.  What is the difference between a Liberal lawyer sitting in
> Parliament and a sturgeon?  One is a scum-sucking bottom feeder, and the
> other is a fish.
> 






From pattonme at gnpr.pae.osd.mil  Thu Oct 16 11:44:22 1997
From: pattonme at gnpr.pae.osd.mil (Matthew E. Patton)
Date: Thu, 16 Oct 1997 11:44:22 -0700 (PDT)
Subject: kernal timezone options
Message-ID: <199710161400.KAA04735@gnpr.pae.osd.mil>


I'm not having much luck figuring out what values exist for the TIMEZONE and
DST kernel options. The default is 0 and 0 which puts my machine off by about
4 hours. The installation routine put in the proper link to US/Eastern or on
another box EST5EDT. This apparently is insufficient to get the date command
to behave. Incorrect time obviously impacts the entire system.

My bios clock is right on. So where are the integers defined that correspond
to the various zoneinfo files? This is definately man page material.

thanks for the continuing assistance.
ps, I figure -1 or -4 is the correct value for DST





From ravage at ssz.com  Wed Oct 15 20:46:17 1997
From: ravage at ssz.com (Jim Choate)
Date: Thu, 16 Oct 1997 11:46:17 +0800
Subject: pna.show_story?p_art_id=409724&p_section_name=Sci-Tech
Message-ID: <199710160356.WAA08989@einstein.ssz.com>



   CNN Custom News logo
   [LINK]
   Home
   World
   U.S.
   Weather
   Sports
   Business
   Sci-Tech
   Showbiz
   Lifestyle
   alt
   On Target
   Customize Profile 
   Help
   Feedback
   Switch User
   
   [ISMAP]
   
   InfoSeek 
   
   [INLINE] October 16, 1997 3:29 am GMT
   [INLINE]
   Sci-Tech Title [INLINE] Ad Space ________________________    ___Word
   ___Theme
   ______________ Options [INLINE]
   
   
   The story below was selected from CNN Custom News - a new personalized
   service that delivers only the news that's important to YOU.
   
   Sign up now to receive your personal news stories, weather, sports
   scores, and stock quotes from over 100 different sources - all for
   FREE. If you're already a user, please login. Custom News 
   
        NEW SURVEY SHOWS BIG RISE IN INTERNET USE, BUT NOT FOR SHOPPING
                                       
   LA Times
   14-OCT-97
   Consumers Don't Trust Internet Enough To Share Their Credit Card
   Information
   
   ORLANDO, Fla.--(BUSINESS WIRE)--Oct. 14, 1997-- More than one out of
   three Americans have become users of the Internet during the last
   year, primarily for information gathering, but decidedly not for
   shopping, according to a national survey reported today by a leading
   consumer researcher.
   
   "There is clearly something addictive about the availability of
   galaxies of information for the asking," said Britt Beemer, chairman
   of America's Research Group, the firm that conducted the research
   project, in his keynote address before the 21st Century Commerce &
   CALS Expo USA at the Orange County Convention Center.
   
   "However, it's a very different story for shopping," he adds, "where
   very few people (2.8 percent ) feel comfortable in using the Internet
   to make a purchase in cyberspace."
   
   Beemer, who pioneered the influence of fear of crime on shopping with
   his annual survey on the subject, says he is "surprised more people
   weren't actively patronizing the Internet to eliminate worry about
   their personal safety, particularly for shopping at night."
   
   When asked about the degree of trust they had for shopping at a store
   in the mall compared with a purchase via the Internet, respondents
   opting for the store (72.1 percent) outnumber Internet shoppers (6.7
   percent) by more than ten to one, the survey indicated.
   
   According to Beemer: "Most people (77.9 percent) are reluctant for
   security reasons to give their personal credit card data via the
   Internet to a virtual salesperson, but many others (26.9 percent)
   don't want to buy something they can't see and touch; 14.9 percent say
   they always buy in stores; 11.6 percent report they like to pay cash;
   and 11.1 percent simply enjoy shopping too much to let their computer
   have all the fun."
   
   The few products that do sell at all via the Internet include computer
   software, books, apparel, and home furnishings, but the percentages of
   people actually buying are nominal, Beemer says.
   
   Consumer use of the Internet to get information in influencing various
   purchasing decisions does appear to be increasing, with many people
   (45.9 percent) reporting they sought information prior to shopping,
   and 9.6 percent indicating they were searching for both information
   and advertising.
   
   Those who use the Internet say the reason they do so is to acquire
   information (68.4 percent); to chat with and meet people (7.1
   percent); and to keep track of their finances (6.1 percent).
   
   When it comes to information gathering, 41.0 percent are seeking the
   news of the day; 23.7 percent are getting data on companies; 12.8
   percent are looking for help in school work; 6.4 percent are checking
   out stock and bond prices related to their financial status; and 5.8
   percent are surfing for travel information, the study points out.
   
   "There is some hope down the road that people's fears and concern
   about using the Internet for various personal business purposes will
   ease," says Beemer.
   
   "When asked whether they would expect to make financial transactions
   in the future, nearly six out of ten said `no,' but nearly 10 percent
   (9.4 percent) answered in the affirmative," he reports.
   
   The survey was conducted during the last week of September, 1997 of a
   national sample of 1000 respondents. Of this number, 41.7 percent had
   no access to a computer either at home or at work; 24.6 percent both
   at home and at work; 17.7 percent at home; and 15.9 percent at work,
   only. The study has a margin of error of +/- 4.3 percent.
   
   America's Research Group is a leading consumer research firm,
   headquartered in Charleston, S.C. Its staff has interviewed three
   million Americans over the past dozen years, giving ARG the largest
   database of retail trends in America. Britt Beemer is the author of
   PREDATORY MARKETING, published early this year by William Morrow.
   
   
   
   
   
   Search the net: InfoSeek ___________________ ____ [Help]
   [INLINE] Ad Space 
   
   Top 
   
   Copyright © 1997 Cable News Network, Inc. A Time Warner Company
   ALL RIGHTS RESERVED.
   Terms under which this information is provided to you. [INLINE]
   






From brusinsk at ibdr.inf.tu-dresden.de  Thu Oct 16 11:51:38 1997
From: brusinsk at ibdr.inf.tu-dresden.de (Andreas Brusinsky)
Date: Thu, 16 Oct 1997 11:51:38 -0700 (PDT)
Subject: Perl 5.00401, gcc 2.7.2.3 ..
Message-ID: 



It was told in the mailinglists that with
the integration of the gnu utillities into the source tree
it is easy to keep up with changes of their utillities.

So what is the reason to stay on little elder versions of
perl and gcc?

Shouldn't gcc 2.7.2.3 and perl 5.00401 be within the source tree?

Why are they not?

Does the source tree really depend on the 'old' perl?

I got somehow the impression that gcc is a special adapted version
so I could understand that this is not integrated but perl?

Or am I utterly wrong because perl is a kind of compiler and gcc is a kind
of compiler so they dont need to be chaged becaus they work and may be more
fixed than real gcc/perl and utillities that demand perl5.00401 can
just be twiddled to use OpenBSD/perl ..

Thanks for comments.
 
        Bye   Brusi

            by           E-Mail: ab2 at inf.tu-dresden.de
                         Tel.-priv: 0351-8499347 (Germany/Dresden)
          \____






From kent at bywater.songbird.com  Wed Oct 15 20:52:29 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Thu, 16 Oct 1997 11:52:29 +0800
Subject: anti-GAK design principles: worked example #1
In-Reply-To: 
Message-ID: <19971015203509.42369@bywater.songbird.com>



On Wed, Oct 15, 1997 at 11:45:01PM +0100, Adam Back wrote:
> 
> 
> Part of the problem in this debate I think is that I have proposed
> many alternate designs, with varying degrees of GAK-hostility.
> 
> Also I have been accused of using "lots of anti GAK rhetoric, but
> giving no proposals" by Kent.

Adam, you've tossed out half-baked ideas buried in several thousand
lines of anti-GAK rant.  None of them were thought through in terms of
infrastructure impact.  The idea of reencrypting the data strikes me
as half-baked, as well -- I sit and wonder about the pass-phrase
handling for the transient encryption keys that are changing on a daily 
or weekly basis -- or is there no pass-phrase -- is the key just 
stored on disk with no protection


> I reject that claim.  (I did use lots
> of rhetoric, but this was to try to impress upon those arguing for CMR
> of it's dangers.  They do not seem to acknowledge them.)

The evidence seems to suggest that the PGP folks agonized pretty 
heavily over their design.  A stupid attack such as yours is far more 
likely to cement resistance than it is likely to win cooperation.

> I'll try in
> this post to steer clear of anti-GAK rhetoric.  We'll instead take it
> as a given that pgp5.5 and pgp5.0 are GAK compliant because of CMR and
> that this is a bad thing.

Trying real hard...

> Will is correct on one point: at the begining I had not properly
> thought one aspect through:

I suspect there are several other flaws you are now quite aware 
of...too bad, I hoped you had something.

[...]

> Design 1.
> 
> Instructions:
> 
> - scrap the CMR key extension
> 
> - store a copy of the private half of the users PGP encryption key
>   encrypted to the company data recovery key on the users disk.

I work for a large organization, I have a unix workstation, an
xterminal booting off a departmental server, and a Mac in my office. 
As is typical in large organizations, a system admin team takes care
of all routine administration of my systems.  They all have root, of
course, and routinely do system upgrades and software installs on my
Mac.

Your solution doesn't seem to fit this environment very well...
[...]

> Recovery method:
> 
> Custodian of recovery key inserts recovery floppy disk in machine,
> decrypts copy of users private key, hands control back to user to
> choose new passphrase.

Must be a very special boot floppy, of course, otherwise I just 
subvert the floppy driver, feign forgetting my passphrase, and 
collect the corporate crown jewels.  Or I hack into somebody else's 
system and corrupt their key...

[...]
> 
> - what is stopping you implementing this

It's completely unrealistic.

> - are there any plug ins which can't cope with this
> - are there user requirements which it can't meet
> - is there some fundamental flaw you think I have missed
> - can you see ways that this could be perverted to implement GAK
>   (yes I can too, btw, but...)
> - are those ways logisitically harder for GAKkers to acheive than for CMR
> 
> Please be specific, no general waffle about understanding the
> complexities of balancing user ergonomics, user requirements etc.

Unfortunately, for real products you do have to consider these 
factors. 

[...]
> 
> Adam
> 
> [1]
> ==============================8<==============================
> GAK-hostile design principles
> 
> If we take the design goal of designing systems including
> confidentiality which are not GAK compliant, we can most succinctly
> state this design goal as the task of ensuring that:
> 
> - at no point will any data transferred over communications links be
>   accessible to anyone other than the sender and recipient without
>   also obtaining data on the recipient and/or senders disks

This is great. 


> We can then derive the design principles required to meet the design
> goal of a non-GAK compliant system with confidentiality services down
> to ensuring that:
> 
> principle 1:
>    no keys used to secure communications in any part of the system are
>    a-priori escrowed with third parties
> 
> principle 2:
>    second crypto recipients on encrypted communications are not
>    used to allow access to third parties who are not messaging
>    recipients manually selected by the sender
> 
> principle 3:
>    communications should be encrypted to the minimum number of
>    recipients (typically one), and those keys should have as short a
>    life time as is practically possible

Key lifetime is a major issue.  Keys are either protected by 
pass-phrase, or vulnerable.  Think about how you are going to 
generate new keys every day, or every week...

Think about off-line composition of email -- I have a laptop, download
my mail from the pop server, compose email.  Now I can't store my
friends public keys on my disk, because they expire every day.  So I
have to go to the public keyserver for every correspondent's public
key -- if the keyserver is unaccessible I'm out of luck.  This
radically changes the expected semantics of email. 

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From m4 at nts.umn.edu  Thu Oct 16 11:57:35 1997
From: m4 at nts.umn.edu (Marshall Midden)
Date: Thu, 16 Oct 1997 11:57:35 -0700 (PDT)
Subject: Checklist, expanded
Message-ID: <199710161612.LAA14238@unet.unet.umn.edu>


NOTE: if upgrading or restoring files, it appears that some group numbers
have been changed.

-----------------------------------------------------------------------------
New installation checklist, after install and multi-user boot.
(Instructions for correcting not given.)

1) Login on console as "root".
2) Check the system date.  Type "date".  If necessary, set the system date,
   and/or change the symbolic link to get the correct Time Zone.
3) Put a password on root.  Run "passwd".
4) Check hostname.  Type "hostname".	(man "hostname" if need to change,
   and you also need to edit /etc/myname.)
5) Verify network interfaces configured correctly.
   a) "ifconfig -a".  Correct by editing /etc/hostname.{INTERFACE} and
      via "ifconfig" if you do not with to reboot.
      Loopback interface will look something like:
	lo0: flags=8009
		inet 127.0.0.1 netmask 0xff000000
      An ethernet interface something like:
	le0: flags=9863
		inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255

[Will someone else fill in the ppp and slip interfaces.]

   b) You may wish to turn off multicast routing in /etc/netstart by
      commenting out (place a # sign at start of line) the line:
	# route add -net 224.0.0.0 -interface $hostname
   c) Check for routing. ("netstat -r -n")  It will look something like:
      Routing tables

      Internet:
      Destination        Gateway            Flags     Refs     Use    Mtu
      Interface
      default            192.168.4.254      UGS         0 11098028      -  le0
      127                127.0.0.1          UGRS        0        0      -  lo0
      127.0.0.1          127.0.0.1          UH          3       24      -  lo0
      192.168.4          link#1             UC          0        0      -  le0
      192.168.4.52       8:0:20:73:b8:4a    UHL         1     6707      -  le0
      192.168.4.254      0:60:3e:99:67:ea   UHL         1        0      -  le0

      Fix via editing /etc/mygate, and using "route delete" and "route add"
      if you do not wish to reboot.
   d) If using the Bind Name Server (DNS), check /etc/resolv.conf.
      It might look something like:
	  domain nts.umn.edu
	  nameserver 128.101.101.101
	  nameserver 134.84.84.84
	  search nts.umn.edu. umn.edu.
      If using a caching name server add the line "nameserver 127.0.0.1" first.
      (Of course, you need to change "named_flags" in /etc/rc.conf and add
      the named.boot file in the appropriate place.  Same holds true if this
      is the name server for you domain.  Also make sure "named" is running.
      [Otherwise there are long waits while timeouts happen.])
   e) If using "NIS" (old yellow pages), check "domainname" and edit
      /etc/defaultdomain to correct.

[Will someone else fill in more here.  I refuse to use this package.]

6) Check disks correct.
   a) cat /etc/fstab
   b) df
   Edit "/etc/fstab" and "umount" and "mount" as necessary.  (See man pages.)
   c) You may want to do NFS partitions later, but you may do them now.
   d) If you are using concatenated disks, edit /etc/ccd.conf and use
      "ccdconfig -U" and "ccdconfig -C" till you have it correct.
      ("umount" and "mount" and edit /etc/fstab as needed.)
   e) Go into the "amd" directory if using this package.

[Will someone else fill in more here.  I do not use this package.]

7) The system should be usable now, but you may with to do more customizing,
   adding of users, etc.  Many sections may be skipped if you are not using
   that package (for example kerberos!).  My suggestions are to go into
   /etc ("cd /etc") and:
   a) Edit motd to make lawyers comfortable and make sure that no mention
      of the word "Welcome" appears.  (Some U.S. lawyers have stated that
      the word "Welcome" is an invitation to come on in.)
   b) Add users.  There is a "adduser" script.
      You can use "vipw", and edit "/etc/group" if you desire.  Make sure to
      put people in "/etc/group", under the "wheel" group if they need root
      access (non-kerberos).  Something like:
	wheel:*:0:root,m4
   c) Check for any local changes needed in /etc/rc.conf, /etc/netstart,
      /etc/rc.local, rc.securelevel..  Turning on something like the
      Network Time Protocol in /etc/rc.local and /etc/rc.securelevel requires:
      A) Making sure the package is installed.
	 (see http://www.openbsd.org under "Ports: a Nice Way to Get
	 Third-Party Software).
      B) Uncommenting the lines in rc.local (delete the # signs).
	 if [ -f /usr/local/etc/httpd/httpd ]; then
	       echo -n ' httpd';       /usr/local/etc/httpd/httpd
	 fi
      C) Uncommenting the lines in rc.securelevel (delete the # signs).
	 if [ -x /usr/local/sbin/xntpd ]; then
	       /usr/local/sbin/tickadj -Aq
	       echo -n ' xntpd';       /usr/local/sbin/xntpd
	 fi
   d) Edit /etc/printcap and /etc/hosts.lpd to get printers set up.
   e) You might want to tighten up security by editing:
	  fbtab           Set security for X -- when you install X ... .
	  inetd.conf      Turn off extra stuff, add that which is really needed.
   f) Go into /etc/kerberosIV and configure kerberos.  Remember to get a srvab.
   g) Edit /etc/aliases.  Set postmaster, etc.  Run newaliases after changes.
   h) If this is a bootp server, edit /etc/bootptab.  You will have to turn
      it on in /etc/inetd.conf, or run "bootpd" in stand-a-lone mode.
   i) If this is an NFS server
      A) make sure /etc/rc.conf has "nfs_server=YES".
      B) Edit /etc/exports and get correct.
      It is probably easier to reboot than get the daemons running, manually,
      but you can get the order correct by looking at /etc/netstart.
   j) Edit /etc/rbootd.config if needed for remote booting (ethernet MAC address
      to IP tranlation).
   k) Look at and possibly edit the /etc/daily, /etc/weekly, and /etc/monthly
      scripts.  Your site specific things should go in /etc/daily.local,
      /etc/weekly.local, and /etc/monthly.local.
   l) Look at the other files in /etc and edit as needed.
      (Do not edit files ending in ".db" -- like aliases.db, pwd.db, spwd.db,
      nor localtime, nor rmt, nor any directories.)

8) Check what is running via crontab "crontab -l".
   Do you need anything else?  Do you wish to change things?  For example:
	30  1  *  *  *   /bin/sh /etc/daily 2>&1 > /var/log/daily.out 
	30  3  *  *  6   /bin/sh /etc/weekly 2>&1 > /var/log/weekly.out 
	30  5  1  *  *   /bin/sh /etc/monthly 2>&1 > /var/log/monthly.out 

9) After the first nights security run, change ownerships and permissions
   on things.  Best bet is to have permissions as in the security list
   (the first of the two listed permissions, and the first group number of
   the two).  Use "chmod" and "chgrp" as needed.

10) Install packages to make the system more useful.
   A) Install your own.  Easiest way is to copy source and compile it.
   B) Copy vendor binaries and install them.  You will need to install any
      shared libraries, etc. (hint: "man -k compat")
   C) Install any of a large number of Third-Party Software that is available
      in source form.  (See http://www.openbsd.org under "Ports: a Nice Way
      to Get Third-Party Software).
   You may have "fun" installing due to various compiling errors.  Don't
   get discouraged easily!  Sometimes checking the mailing lists for past
   problems that people have encountered will result in a fix posted.





From globaladventures at alluwant.com  Thu Oct 16 12:45:48 1997
From: globaladventures at alluwant.com (globaladventures at alluwant.com)
Date: Thu, 16 Oct 1997 12:45:48 -0700 (PDT)
Subject: Discount Full-Service Travel
Message-ID: <199710161945.MAA00581@toad.com>



Good Morning,

We were given your name as someone who enjoys (or must) travel.

Global Adventures Travel Service is a full service, wholesale and retail travel agency.  Combining high-tech and high-touch to deliver an unparalleled level of customer service.  We have divisions specializing in Domestic and International Leisure Tours, Cruises, Business, Corporate, Singles, Seniors, and Last Minute Adventures.

Our prices are always low and service always high...

For a few current .specials. (as of 10/06/97), please hit reply and put the word "SPECIALS." in the subject line and push send  for an automated  response.  For a personal response, press reply, do not change subject, and just ask.... we will be glad to help!


Thank You for your time...

The Crew at Global Adventures Travel Service



///////////////////////////////////////////////////////////////////////////////////////////

If you would like to be taken off our mailing list....please hit reply and type the word 'remove' in the subject field and you will be omitted from Global Adventures future mailings....

///////////////////////////////////////////////////////////////////////////////////////////






From bd1011 at hotmail.com  Wed Oct 15 21:51:13 1997
From: bd1011 at hotmail.com (Nobuki Nakatuji)
Date: Thu, 16 Oct 1997 12:51:13 +0800
Subject: Where are another cypherpunk
Message-ID: <19971016041823.3461.qmail@hotmail.com>



Where are another cypherpunk mailinglist ?




______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com






From tcmay at got.net  Wed Oct 15 22:21:23 1997
From: tcmay at got.net (Tim May)
Date: Thu, 16 Oct 1997 13:21:23 +0800
Subject: Where are another cypherpunk
In-Reply-To: <19971016041823.3461.qmail@hotmail.com>
Message-ID: 



At 9:18 PM -0700 10/15/97, Nobuki Nakatuji wrote:
>Where are another cypherpunk mailinglist ?
>

Am another cypherpunks mailinglist at cyperpunk at dev.null.

You go there, chop chop.

You not talk about Misty here anymore, OK? We am tired hering about Misty
and your fees.

--Tim-san





The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From stewarts at ix.netcom.com  Wed Oct 15 22:35:44 1997
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Thu, 16 Oct 1997 13:35:44 +0800
Subject: FCPUNX:PGP Key Escrow and Congress
In-Reply-To: <199710151811.LAA23906@toad.com>
Message-ID: <3.0.3.32.19971015195247.006f448c@popd.ix.netcom.com>



At 01:27 PM 10/15/1997 -0500, William H. Geiger III wrote:
>>Do the privacy of the nation's data and the security of its
>>information infrastructure deserve the same consideration as the
>>Pentagon's "Confidential" memos?  When you're planning to build in a
>>single point of failure, this is a question you have to ask.
>
>There are those of us who see a single point of failure in such
>infrastructures as a GoodThing(TM).

However, they are incorrect :-)  The primary failure mode is
"someone official decides to rip off somebody's information".
A single point of failure means there's one big temptation target
where every official can rip off everybody's information -
but in this case that failure will not be repaired:
- it won't be reported most of the time, and 
	undetected failures are the worst.
- the cost of redesigning the system will be so large
	that even a glaring massive public failure
	won't lead to shutting it down.
- the least-bad "fix" for the problem will be to add
	official bureaucracy to the process of ripping off info,
	and maybe the individual miscreant will get wrist-slapped harshly.
- the failure will be blamed on the Four Horseman, not the system
- the probable "cure" will be to appoint a Data Privacy Ombudsczar,
	who will have authority to interfere with all sorts of
	private data but won't mess with the big Federal infrastructure.

Multiple small points of failure mean that it's less likely
that the official who wants to rip off information has access
to the set of information he wants to rip off.  You could argue
that there would be more officials with access, but probably not,
since a big pile of information is something that attracts officials
far faster than little boring piles.
				Thanks!
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From kent at bywater.songbird.com  Wed Oct 15 22:52:00 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Thu, 16 Oct 1997 13:52:00 +0800
Subject: FCPUNX:PGP Key Escrow and Congress
In-Reply-To: <199710151811.LAA23906@toad.com>
Message-ID: <19971015224407.08785@bywater.songbird.com>



On Wed, Oct 15, 1997 at 07:52:47PM -0700, Bill Stewart wrote:
> At 01:27 PM 10/15/1997 -0500, William H. Geiger III wrote:
> >>Do the privacy of the nation's data and the security of its
> >>information infrastructure deserve the same consideration as the
> >>Pentagon's "Confidential" memos?  When you're planning to build in a
> >>single point of failure, this is a question you have to ask.
> >
> >There are those of us who see a single point of failure in such
> >infrastructures as a GoodThing(TM).
> 
> However, they are incorrect :-)  The primary failure mode is
> "someone official decides to rip off somebody's information".
[...]

> Multiple small points of failure mean that it's less likely
> that the official who wants to rip off information has access
> to the set of information he wants to rip off.  You could argue
> that there would be more officials with access, but probably not,
> since a big pile of information is something that attracts officials
> far faster than little boring piles.

I don't suppose you are arguing that having multiple small points of 
failure makes GAK acceptable...

The 'single point of failure' mode is such obviously bad design that
NSA will never go for it -- they aren't dumb.  Consider that if you
have a single master key for all escrowed things (for example): that
single master key will have to be used for *every* wiretap, every FOI
act action, etc.  It will be in constant daily use by many people, 
and keeping it secure will be, practically speaking, impossible.

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From weingart at natasha.brandonu.ca  Thu Oct 16 14:00:08 1997
From: weingart at natasha.brandonu.ca (Tobias Weingartner)
Date: Thu, 16 Oct 1997 14:00:08 -0700 (PDT)
Subject: kernal timezone options
In-Reply-To: <199710161400.KAA04735@gnpr.pae.osd.mil>
Message-ID: <12041.877024993@natasha.brandonu.ca>


On Thursday, October 16, "Matthew E. Patton" wrote:
> I'm not having much luck figuring out what values exist for the TIMEZONE and
> DST kernel options. The default is 0 and 0 which puts my machine off by about
> 4 hours. The installation routine put in the proper link to US/Eastern or on
> another box EST5EDT. This apparently is insufficient to get the date command
> to behave. Incorrect time obviously impacts the entire system.
> 
> My bios clock is right on. So where are the integers defined that correspond
> to the various zoneinfo files? This is definately man page material.

Right on what?  You see, the bios clock should be in UCT time...
Just to complete things, TIMEZONE is in minutes, and DST is a flag,
set to 1 if the bios clock does DST time.  At least I believe that is
how it works...

--Toby.
*----------------------------------------------------------------------------*
| Tobias Weingartner | Email: weingart at BrandonU.Ca | Need a Unix sys-admin?  |
| 6B-1137 Lorne Ave. |-----------------------------| Send E-Mail for resume, |
| Brandon, Canada    | Unix Guru? Admin, Sys-Prgmr | and other details...    |
|----------------------------------------------------------------------------|
|      %SYSTEM-F-ANARCHISM, The operating system has been overthrown         |
*----------------------------------------------------------------------------*







From colpi at biotest.bio.purdue.edu  Thu Oct 16 14:13:52 1997
From: colpi at biotest.bio.purdue.edu (Daniel Colpi)
Date: Thu, 16 Oct 1997 14:13:52 -0700 (PDT)
Subject: Checklist
Message-ID: <199710161850.NAA17808@biotest.bio.purdue.edu>




Greetings and Salutations,

A few days ago, I asked for help in making a step by step list on how
to "copy" OpenBSD from one computer to another.  Well I got a few 
answers, but many people wanted me to post this list when I was done.
So this is it, a mindless checklist of everything I did to "convert 
a DEC 3100 to the Dark Side"

If you can think of something I have missed, please throw me an e-mail.

Thanks

Daniel Colpi
colpi at purdue.edu


======================================================================

So, you want another OpenBSD computer hu?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(assuming same disk setup, target is disk #0, and source is disk #1)
(also assuming rrz0a -> /    ; rrz0c -> swap
               rrz0d -> /usr ; rrz0e ->/usr/target  )
(Note: I am on a /bio backbone, this isn't going to be the same for you)
(Note: /bio/scratch3 is a temp space that I can write to)

___Save Files
   ___dump root to scratch (just in case)
                             -->% dump -0f /bio/scratch3/dump /dev/rrz0a
   ___/etc/passwd --> % mv /etc/passwd /bio/scratch3/passwd.target
   ___/etc/crontab
      ___any self created scripts you made to run with crontab
   ___/etc/fstab
   ___/usr/local/etc/mk-exports
   ___/etc/export.hosts
   ___/etc/export.fs.[n]
      (if you have a drive that is set up the way you want for target
      machine, you might want to save it to a file to save you some
      time)
      (Note: you might want to do this on a machine that is already
             converted)
   ___save your partition list  -->% disklabel -r /dev/rrz1a >> temp_part
                                   % mv temp_part /bio/scratch3
___Shut down target
___Connect source drive
___Make sure drives are jumpered not to conflict (target=>0 ; source=>1)
___Plug in and power up
   ___Make sure clock is right time (some old computers lose some time)
   ___Make sure you see both drives (ie drive 1 & drive 0)
___Run disklabel  (I had drouble labeling the disk, but this worked)
        -->% disklabel -r /dev/rrz1a >> temp
           % disklabel -B -R /dev/rrz0a temp
           % disklabel -e /dev/rrz0a
   ___ / = _______________
   ___ swap = ____________
   ___ /usr = ____________ / ______________ (target / source)
                                            (remove src if desired)
   ___ /usr/target = _______________
        (if you have a "cookie-cut" version you can just:)
        -->% disklabel -B -R /dev/rrz0a /bio/scratch3/temp_part
___Run newfs  -->% newfs /dev/rrz0[ad]
___Transfer files
          --->% mount /dev/rz0a  /mnt
              % cd /mnt
              % df -k .     (make sure enough room)
              % df -k /
              % dump 0f - /dev/rrz1a | restore -rf -
              % rm restoresystable   (if you don't do this you'll be sorry)
              % cd /
              % umount /mnt
              % mount /dev/rz0d  /mnt                ---+
              % cd /mnt                                 |
              % df -k .                                 |  Repeate this 
              % dump 0f - /dev/rrz1d | restore -if -    |   section if
      restore > add [all dir's you want to keep]        |     needed
      restore > extract                                 |       on
      restore > set owner/mode for /./? [yn] n          |     other
      restore > quit                                    |   partitions
      (Note: it will say "DUMP not completed" if you    |
       did not restore everything.  This is not a bad   |
       thing, ignore it)                                |
              % rm restoresystable (might not be there) |
              % cd /                                    |
              % umount /mnt                          ---+
___Configure  (BE CAREFUL to configure /mnt/etc  NOT /etc !!!!)
   ___mount /usr --->% mount /dev/rz0d  /mnt
   ___remove /mnt/etc/npt.drift
   ___make dir /mnt/usr/preserve
   ___replace all scripts made to be run by crontab
   ___move /bio/scratch3/mk-exports /mnt/usr/local/etc/mk-exports
   ___umount /mnt
   ___mount /   --->% mount /dev/rz0a /mnt
   ___replace rest of scripts to be used by crontab
   ___move /bio/scratch3/export.hosts /mnt/etc/export.hosts
   ___move /bio/scratch3/export.fs.[n] /mnt/etc/export.fs.[n]
   ___hostname
      ___/mnt/etc/hostname.le1
      ___/mnt/etc/exports        (or run /usr/local/etc/mk-exports)
      ___/mnt/etc/hosts  (change IP number too)
      ___/mnt/etc/myname
   ___/mnt/etc/rc   (maybe not if (flavor == vanilla))
   ___/mnt/etc/mygate
   ___/mnt/etc/passwd
      ___/usr/local/bin/tcsh (OpenBSD doesn't come with tcsh)
      ___reconfigure passwd file (for correct format)
          __ % mv /bio/scratch3/passwd.target /mnt/etc/passwd.orig
    same /   % nawk -F: ' { print $1 FS $2 FS $3 FS $4 "::0:0:" $5 FS \
    line \__ $6 FS $7 } ' /mnt/etc/passwd.orig >> /mnt/etc/passwd
             % pwd_mkdb -c /mnt/etc/passwd
             % pwd_mkdb -d /mnt/etc/ /mnt/etc/passwd
             % pwd_mkdb -d /mnt/etc/ -p /mnt/etc/passwd
             % chmod 600 /mnt/passwd.orig
   ___do you want permissive /mnt/root/.rhosts (bilbo root ; gimli root)
   ___how about cooperative /mnt/etc/ttys   (%s/network/network secure)
   ___if your source machine boots off disk 1 and target boots off
      disk 0, you need to make sure the correct kernal is at /mnt/bsd
   ___umount /mnt
___Power down
___Remove source drive
___Correct jumpers if nessary
___Power up
___Before starting OpenBSD at Boot Ram type:
        >> printenv
        >> setenv bootpath rz(0,0,0)/bsd
___Boot off of target disk
   ___restore user file system
      --->% cd /usr/target
          % rsh bilbo ls /usr/amanda/\*
       __    (now in order)
 same /   % rsh bilbo cat /usr/amanda/target.date.[0->(n-1)] \
 line \__   < /dev/null | resore -rf -
             (now when done with above loop (IN ORDER!!!!!))
          % rm restoresystable
   ___recreate crontab
      --->% crontab -e
___Checks
   ___ping source machine (to make sure not same IP addresses)
   ___run ntpq -p 
   ___finger @localhost
   ___finger @target
   ___cd into /bio/scratch3/
   ___run date
   ___telnet to target from another machine
   ___ftp one file from another machine
   ___cd to /bio/target from another machine
___Go home early

Nessary Tools:
===============
   Screwdrivers (if internal drives)
   Postit-notes (for keeping drives straight)
   One hell of a lot of coffee





From stewarts at ix.netcom.com  Wed Oct 15 23:56:54 1997
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Thu, 16 Oct 1997 14:56:54 +0800
Subject: Encyrption Program
In-Reply-To: <199710141958.MAA22050@k2.brigadoon.com>
Message-ID: <3.0.3.32.19971015185531.006aa87c@popd.ix.netcom.com>



At 12:58 PM 10/14/1997 PST, semprini at theschool.com wrote:
>This is in response to the several posts regarding the assumed 
>weakness in the program I wrote:
>    While it is true that PRNG's are not very good, because of the 

There are lots of kinds of random number generators.
Many of them are good for simulations and totally useless for crypto,
and not even very good for the intermediate problem of gambling.
It's worth getting a copy of PGP and reading the section in the
user documentation about Snake Oil - Phil Zimmermann describes
how he invented a cool new cryptosystem using PRNGs and was surprised
to find breaking it as a textbook exercise.  He's gotten better since then :-)

By far the most commonly used is the Linear Congruential Generator;
	x[n] = ( a * x[n-1] + c ) mod m
They're popular because they're fast, simple, and for well-chosen
values of a, c, and m, they produce reasonable-quality random numbers.
Another very popular class of random number generators is 
Linear Feedback Shift Registers, which look roughly like
	b[n] = a[0] + a[1]*b[n-1] + .... + a[k]*b[n-k]
where the a[] and b[] variables are bits and it's all modulo 2.

The definitions of "random" used here imply that the
value of x[n] is statistically well-distributed even if you know
	x[n-1], x[n-2] .... x[0].  
That doesn't mean that _you_ can't easily calculate them,
nor does it mean that you can't easily calculate 
	x[n-k], x[n-k-1], ... x[0]  given x[n] ... x[n-k+1].

For both LCG and LFSR, there's a lot of mathematical theory
about how to do this, and especially LCGs are pretty useless.
Among other things, if anybody knows the first N bits of your message,
for instance they know some plaintext -- knowing the first two 
characters is enough for a known LCG using 16-bit integers,
such as the "Fr" in "From: alice at acme.com", or the 
magic number in the first 2-4 bytes of a file that indicates
it's a GIF or EXE or a.out or whatever.  If you don't know
which 16-bit LCG it is, having the first 4 bytes helps a lot.
And if you don't know, there are only 65536 possibilities,
so just try them all and look for text.  Even if you're
using 32-bit LCG random numbers, that's not very many for a
Pentium to crunch on over the weekend.

>To work around the lattice problem, I used a systm of cubic arrays.
>The program first creates sixteen cubic arrays, and fills 
>them one space at a time with random characters. 
>When the stream of characters to be XORed with the plaintext is 
>generated, it picks a random cube and a random location with that cube. 

You're probably generating the set of random characters from the LCG,
which means if you know one, you know them all (or at least,
if you try it 65536 times you do, for a 16-bit LCG.
This _is_ more annoying for 32-bit LCGs, but not particularly
harder; maybe you need a lab-full of Pentia.)
Similarly, your "random" cube and "random" location are
probably chosen from the same stream.  So for each starting value,
we know the contents of the cubes, and which cube and byte are chosen, 
so we XOR them with "F", and if that works XOR them with "r",
and work our way down the line.

> you can download both the compiled version *and* the source
Providing source is important - thanks; at least there's some chance that
people can look at your algorithm and see if it's been done before.
A good description of what the algorithm is and why it's strong
are also helpful, especially for people who don't know the
syntax of whichever programming language you're using very well.

> "http://www.brigadoon.com/~semprini/3dmx". 
Only connect once every hundred years?  No thanks!  :-)

Also, is there any way to jump ahead in the LCG?  
	x1 = ( a*x0 + c ) mod m
	x2 = ( a*a*x0 + c*x0  + c ) mod m = ( (a*a+c)*x0 + c ) mod m
Is it easy to extend this to x2, x4, x8, x16, x32 ....?
This would make it much faster to calculate the "random" cube and cell,
and would let you only calculate the values you need in the cube
instead of calculating them all, so you only do about 
log(16*cubevolume) calculations instead of 16*cubevolume.
If that doesn't work, it still gives you a set of values 
	a[k] such that x[k] = ( a[k]*x0 + c ) mod m
which lets you calculate the coefficients for the cube _once_
(the same amount of work you needed to do to use the encryption),
and then for each value of x[0], calculate x[RandomCubeNumber]
and x[RandomCellNumber], then calculate the value of that
cell in that cube (which takes another lookup+multiply+add+mod).
That means you need to do a dozen or so operations per key,
so even if you're using the 32-bit LCG, that's about 50 billion ops,
which is a thousand or so Pentium-seconds.  If you're using the
16-bit LCG, setting up the cubes will take about as long as cracking,
which says you can crack this version of the algorithm in only
2-3 times as long as it would take to use it as a user....

LFSRs are probably harder.....  somewhat....

				Thanks!
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From colpi at purdue.edu  Thu Oct 16 15:33:21 1997
From: colpi at purdue.edu (daniel.t.colpi.1)
Date: Thu, 16 Oct 1997 15:33:21 -0700 (PDT)
Subject: Collisions
In-Reply-To: <199710162025.QAA15381@adk.gr>
Message-ID: 


On Thu, 16 Oct 1997, Angelos D. Keromytis wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> 
> 
> In message <199710161857.NAA24899 at biotest.bio.purdue.edu>, Daniel Colpi writes:
> >
> >Does anyone know of where I can get some sort of window to "catch"
> >all of the system mess. while xdm is running?  There are a lot of
> >collisions that happen, and they mess up the screen with error mess.
> >The people who use these computers assume the this is broke.
> 
> Just open a console window xterm.
> - -Angelos
> 

Won't that open a window logged in as root?

Daniel Colpi
colpi at purdue.edu
==================






From angelos at dsl.cis.upenn.edu  Thu Oct 16 15:33:24 1997
From: angelos at dsl.cis.upenn.edu (Angelos D. Keromytis)
Date: Thu, 16 Oct 1997 15:33:24 -0700 (PDT)
Subject: Collisions
In-Reply-To: <199710161857.NAA24899@biotest.bio.purdue.edu>
Message-ID: <199710162025.QAA15381@adk.gr>


-----BEGIN PGP SIGNED MESSAGE-----


In message <199710161857.NAA24899 at biotest.bio.purdue.edu>, Daniel Colpi writes:
>
>Does anyone know of where I can get some sort of window to "catch"
>all of the system mess. while xdm is running?  There are a lot of
>collisions that happen, and they mess up the screen with error mess.
>The people who use these computers assume the this is broke.

Just open a console window xterm.
- -Angelos

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface

iQCVAwUBNEZ4ML0pBjh2h1kFAQFkxgP+LRT0juiRdbvDCnzSO7g4OGHPOBUP9zKj
0HJe/N4vYxyj/8aKU/fSZbkSKO+WQW1UkA2lVCQsDO7b4RPcid0E7hXZUykxAktb
DV4WYko5uKzDhSZ3JaZuXUpWTX76mR1PpH58PQyS0yQnISEv3VUrikKLlNfx+hXD
juZ19HmsvGY=
=pdko
-----END PGP SIGNATURE-----





From angelos at dsl.cis.upenn.edu  Thu Oct 16 15:40:28 1997
From: angelos at dsl.cis.upenn.edu (Angelos D. Keromytis)
Date: Thu, 16 Oct 1997 15:40:28 -0700 (PDT)
Subject: Collisions
In-Reply-To: 
Message-ID: <199710162028.QAA29984@adk.gr>


-----BEGIN PGP SIGNED MESSAGE-----


In message , "da
niel.t.colpi.1" writes:
>
>Won't that open a window logged in as root?
>

Nope (unless you have some weird setup -- can't imagine how).
- -Angelos

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface

iQCVAwUBNEZ5C70pBjh2h1kFAQGjDAP/U8QkRDFCY/D/4Iiiydpf5puTUZuXmat8
cppHVsL3cdBwsou8pxNG0I5ms2IkNQkAofcNlqsJn2A14SjioDICMCRcZOFh5beI
UAmX6VWZkJhgWudk3x7iqKM0s0XBp6qtbojScQJ8X7ptJXWc2bQKIL1uJWmgUj4r
BFCby6/uhwo=
=ajka
-----END PGP SIGNATURE-----





From aba at dcs.ex.ac.uk  Thu Oct 16 00:43:42 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Thu, 16 Oct 1997 15:43:42 +0800
Subject: anti-GAK design principles: worked example #1
In-Reply-To: 
Message-ID: <199710160711.IAA00177@server.test.net>




Gene Hoffman  writes:
> On Wed, 15 Oct 1997, Adam Back wrote:
> 
> > 
> > - store a copy of the private half of the users PGP encryption key
> >   encrypted to the company data recovery key on the users disk.
> > 
> 
> You would rather have PGP implement private key escrow?

Yes.  

This is less GAK friendly than the way that PGP are implementing CMR.

In worked example #2 and I might do a #3 as well, I will as promised
show you how to apply the design principles to achieve greater
GAK-hostility than example #1 which you are objected to above.

However, in the mean time, I would like you and other PGPers to
re-read my post and answer the questions contained in it:

> - can you see ways that this could be perverted to implement GAK
>   (yes I can too, btw, but...)
> - are those ways logisitically harder for GAKkers to acheive than for CMR

You appear to claim that your answer to the second question is no.

I would like to see you explain your reasoning for why this is so.

You may find it constructive to re-read some of Tim May's recent posts
as he explains the logic of this fairly clearly.  Tim May does not
need the anti-GAK design principles to think in an critical
GAK-hostile way.

PGP Inc does appear to need them because their design principles are
currently at best GAK-neutral, and appear to be largely based on
wooly, ill thought-out pro-privacy / liberal thinking.

You have to think in a crypto-anarchist, saboteur mindset to maximise
your ability to prevent mandatory GAK becoming reality.  The anti-GAK
design principles are a codification of the crypto-anarchist GAK
saboteur's natural predilections to want to prevent the GAKkers.

I have in waiting some other design principles which codify more
general crypto-anarchist design principles.  I will not be adding
these to the anti-GAK design principles at this stage for fear of
confusing the first issue: how to best prevent GAK occuring in our and
other countries.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0


> >In the coming weekend, I'll be updating the newuser FAQ
> >(for things like PPP and 2.2). I'm sure a post-install checklist would be
> >a welcome addition.
> >
> >B U T . . . .
> >
> >Not everyone runs things like Kerberos or DNS. Keep in mind that many
> >people use OpenBSD for many things and in many environs. The OpenBSD setup
> >on my firewall at the office is much different than the Sparc, Alpha, and
> >P5/133 I run it on at home. The setup on my router machine at home is also
> >much different than the other machines in my house. There are ways people
> >have setup OpenBSD on embeded systems to do things like manage the
> >fuel/air mix ratio on their Corvettes (OK, one person I know of planned
> >that, but couldn't get the financing for the car...) I hope that draws the
> >picture.
> >
> >As for the verification after install, that is sort of "auto-manditory"--
> >if a filesystem isn't mounted right, /etc/fstab has to be checked out. If
> >the network doesn't work, the network files must be examined to "make it
> >go." As oopposed to attacking this as a checklist, how about it is
> >attacked as "If networking doesn't work, check hostname.(interface)"-- but
> >there is more to that then just files in /etc (boot -c in order to
> >reconfigure hardware addresses)
> 
> As a user of OpenBSD, and having tried to manage projects with it for
> implementation of added features for customers...I could not agree with
> the above position.
> 
> You see, if you are ALREADY familiar with OpenBSD then you will most likely
> know exactly what to do when installing and seting up a system. New User's
> Notes / Installation Checklist's will most likely be ignored by you.
> 
> However, if you are brand new to the system, then an Installation / Setup
> Checklist (a good one) will prove to be essential. Wouldn't it be great if
> just about every post to these groups from a new user was one like "..hey!
> This OpenBSD thingy works great! The installation was a snap!.." or something
> like that.  We all know that hardly happens now...but, it could.....
> 
> I, for one, believe strongly that a good 'Overview', 'Setup Notes' and 'Installation
> Checklist' must somehow find it's way into the distribution. It is also clear
> that the machine / arch specific differences will require unique versions
> for each.

I completly agree with you. Just anoze topic that i can add is installation 
procedure,especially disk partitoning. It's a very dungerous/important 
procedure but it's description ins INSTALL.i386 is a bit too short and 
need examples(espcially). Something like - "Imagine we have disk with 
such and such patitions and now we want to install OpenBSD here & there so 
we should... It would'be _very_ helpfull.

BTW, does anybody work on installation software ? Something like in FreeBSD/RedHat ?

Alexey Pialkin





From colpi at biotest.bio.purdue.edu  Thu Oct 16 16:24:46 1997
From: colpi at biotest.bio.purdue.edu (Daniel Colpi)
Date: Thu, 16 Oct 1997 16:24:46 -0700 (PDT)
Subject: Collisions
Message-ID: <199710161857.NAA24899@biotest.bio.purdue.edu>



Greetings and Salutations,

Does anyone know of where I can get some sort of window to "catch"
all of the system mess. while xdm is running?  There are a lot of
collisions that happen, and they mess up the screen with error mess.
The people who use these computers assume the this is broke.

Any ideas?

Thanks,
Daniel Colpi
colpi at purdue.edu






From tm at dev.null  Thu Oct 16 01:37:55 1997
From: tm at dev.null (TruthMonger)
Date: Thu, 16 Oct 1997 16:37:55 +0800
Subject: Security flaws introduced by "other readers" in CMR
In-Reply-To: <3.0.3.32.19971015183740.008cad00@mail.io.com>
Message-ID: <3445CF62.B84@dev.null>



Greg Broiled:
> As Jon Callas confirmed at the recent Cpunks physical meeting, the current
> CAK/CAM/whatever system has very weak code re policy enforcement - for
> example, it'll allow otherwise forbidden messages to pass through its
> filters if even the "--- BEGIN PGP MESSAGE ---" lines are altered or
> removed. It won't disassemble tar or zip or uuencode packages, or otherwise
> attempt to discover simple attempts to bypass the enforcement mechanisms.
> They're not trying to stop determined covert communicators - that's not
> their threat model.

  Yes, I am a lunatic, but I'm really not in that bad of shape when
compared to the 'normal' people.
  I once worked with a 'state of the art' alarm security company. They
had all the hi-tech toys, including a special 'goo' covering the
proprietary computer chip, so that it would be destroyed if anyone
messed with it.
  We installed 'the works' in a Royal Bank in Moose Jaw, Saskatchewan,
in my first week of employment, and I was with the head guy when he
finished off the job by taking me upstairs and showing me how to
tie into the phone line so the system could automatically notify
the local gendarmes when the alarms got tripped.
  As we 'finished the job,' I noticed that there was a door to the
outside, beside the power and phone boxes, which did not have a 'trip
plate' on it. I mentioned it to Mr. Head Guy, who looked at his
work order and said, "Not in the contract." We 'finished the job'
and left.
  If you are ever in Moose Jaw, Saskatchewan, drop by the Royal Bank,
climb the fire escape up to the roof, kick the fucking door down and
go grab yourself a handful of cash. (It is not *quite* that simple,
in case you are wondering.)

  I also know a man in Tucson, Arizona, who installed a $10,000 home
security system and then cut the wire to the alarm bell, because it
was too loud.

  I recognize the dangers inherent in PGP's move toward Corporate
Message Recovery, but I also recognize that there will be a thousand
Joe Schmoe's adversely affected by it for every CypherPunk who gets
backdoored as a result of misuse of the technology.
  I think that it is admirable that a number of CypherPunks are railing
loudly against something which is more likely to bring other people to
grief, rather than themselves.

  I truly believe that PGP has made some serious errors in their
current implementation of Corporate security software, but it is
something that is indeed coming, like it or not, and I have more
confidence that there may be better hope for proper changes in the 
package in the future, than I would in the 'Pretty Louis Freeh 
Privacy' software company was the first to develop the technology.

My advice? (Thanks for asking...)

1. Help to install/develop the package at companies which are run
 by decent humans, and truly have good intentions. Explain the pros
and cons to them, and what you feel are moral areas to consider 
before making changes in your suggested modus operandi.
   Oh yes...and put in a back door, or some such, so that you may
have a chance to make necessary changes if the situation changes 
in the future.

2. Help to install/develop the package at companies which need it
 and will get some such program in the future, regardless of the
 ethical functionality of the package. Explain your feelings in 
 regard to the ethics of control versus privacy and try to help
 them understand that basic human decency is in their long-term
 interest.
  Put in *several* back doors, so that you can route around any
damage they cause by putting profits ahead of ethics.

3. Help to install/develop the package at companies which have
 the worst of fascist, evil intentions. Don't bother explaining
 the ethical issues, as they will only use them as guidelines to
 do the opposite.
   Put a time-bomb in the son-of-a-bitch which will explode in
 a few months time and put them completely out of business.

  I have put some type of backdoor in *every* product I have
developed. I have used the backdoor *once*, in order to rescue
a company from their own stupidity.
  I did not inform them of my 'fix,' but let them believe that
the system 'fixed itself.' (Right...it happens all the time...)
If I *had* informed them that I had fixed their fuck-up via a
backdoor I had built in, I have no doubt they would have thanked
me profusely for my foresight, and then demanded that I remove
the backdoor.

  There was one application I developed that had the potential
to make me a very rich person if I chose to misuse a backdoor
in the future. I had to sit down, recognize the temptation and
my own weakness, and decide if it was still in my client's best
interest if I installed a back door in the product.
  The company out-and-out screwed me out of several thousand
dollars at the end of the project, and I am rather proud to
report that I considered and rejected the use of the backdoor
I installed in order to 'enforce' *justice* (and it took less
than a minute to decide it was not worth 'taking the chance' of
being wrong, and therefore a thief--or being 'right' and still
being a thief).

  I am proud of the CypherPunks who are speaking their mind, even
if it means aligning themselves against the Holy Grail of privacy
and security. 
  I believe that we should rail loud and long against those things
which we perceive to be against the interests of the privacy and
security of the individual cogs in the corporate machinery, but
should still promote the interests of a company which is probably
the best horse to back, even if there are no future guarantees.
  I also believe that we should search hard and long for ways to
throw a serious fuck into said program, just in case...

  I have already found one exploitable weakness in PGP's CMR
implementation, which shall remain my own secret.
  Any further exploitable weaknesses I find will be shared with
others, privately.

  I wish that Viacrypt had not tied their CMR software to PGP's
reputation, since it is a product based on a different concept,
but I also wish that I had picked different numbers for last
week's million dollar lottery.
  I am willing to give Viacrypt time to recognize whether or not
they have compromised ethics to a certain extent, in return for
convenience and market position. I try not to 'Nuke the bastards!'
on a whim, but I am always ready and willing to do so if it 
becomes undeniably clear that it is time to take a stand.

  I would like to thank those who have spoken out on both sides
of the issue involved, particularly in light of their willingness
to seek and listen to alternative viewpoints. I hate having to
sort through people's righteously held prejudices in order to
get to the fruits of their analytic labors.
  The issues involved in Viacrypt's choice of direction and their
chosen implementation of corporate security software is truly a
nadir point in encryption development. It is too important an
issue for any of us to take a predetermined stance in order to
defend our private points of view and predilections.

  'Schindler's List' provided an excellent viewpoint of things not
always being what they seem, or not ending up the way they started
out. At the same time, the film may be a bogus representation of 
the true facts of life involved in the situation.
  A different approach by Schindler may have resulted in a better 
or worse resolution to the events, and we shall never know, but I
do believe that the man did the best that he could.

  I plan on doing the best I can to further the spread of strong
encryption, regardless of whether or not any particular product
or implementation makes me nervous at a certain stage of its
development.
  However, I truly hope that, if I am in error, someone believing
and doing the exact opposite of myself will prevail. 

  Besides death and taxes, there is one other thing that I think
is undeniably certain...world events are changing at such an
increasingly fast pace that, regardless of the direction the 
future takes, it is *not* going to be boring.

TruthMonger






From tm at dev.null  Thu Oct 16 01:41:25 1997
From: tm at dev.null (TruthMonger)
Date: Thu, 16 Oct 1997 16:41:25 +0800
Subject: Rules of Engagement on Video
In-Reply-To: 
Message-ID: <3445BA44.68FB@dev.null>



Jim Burnes wrote:
> An award winning film, "Waco: the rules of engagement" is now
> available on video.  Previously running at Art Houses and Film
> Festivals it was produced by a few revolutionary media people.
> 
> Anyway its been lauded as a very well balanced work.  Not like those
> other people -- talking about evil, new world order conspiracies. ;-)

  I thought it was a great example of what the news really *is*, as
opposed to the 'version' of news that this-or-that segment of society
would like to hear.
  No matter what your natural prediliction for 'slanting' your world
view, the "Rules of Engagement" documentary will likely shame you
into looking at the Waco tragedy from a variety of points of view,
since it is difficult to bullshit yourself when someone else is being
so dang-blasted honest about the whole situation.

  The problem with honest people is that you see your own honesty
reflected in them, and it makes it hard to tell yourself the 'usual'
lies.
  "It wasnt' really murder, because he/she was black/communist/jewish/
republican/had bad breath...so it's not like they are really dead, and
*I* killed them."

  I would advise everyone to get a copy of "Waco:the rules of
engagement"
but not necessarily to watch it right away.
  If you have a point of view to 'defend'--if you 'need' to see one
'side'
as 'good' and the other 'side' as 'evil,' then just put the video in a
drawer somewhere until you reach the point where you get tired of all
the bullshit, including your own.
  I 'need' for Kent Crispin to be a government shill and part of the
worldwide plot against me, because I don't want to fully face everything
he has to say, just yet. There are certain things that I still want
to believe, right or wrong.
  When I get tired enough of my own bullshit in those areas, I will
fully listen to Kent's point of view and decide what logic and reason
tell me is *true*, in spite of what I *wish* to be true...
(Although I fully expect to discover, at that point in time, that Kent
 is right about *one* thing, and I am right about all of the rest.)

> Probably most noteworthy is the included FLIR FBI footage (Forward Looking
> InfraRed) which, under expert scrutiny, appears to show LEFs raining
> automatic fire down on citizen units trying to escape the final
> conflagration.  Here expert scrutiny is defined as the head of research
> for the army night vision development group.

  I was uncertain about the conclusions drawn by those making the video,
not having an adequate knowledge base to realistically make a judgement
one way or another (on the point made above), so I asked the opinion of
a friend who is 'Mr. Soldier.' (This guy would court-martial Patton for
an improper salute, quoting chapter and verse.)
  He gave me the 'standard speech' upon hearing my request (towing the
government line--defending Mom, apple-pie and the American Flag). After
having viewed the video, however, he was quite honest in telling me that
he felt that a grievous wrong had been done, by people who should have
held themselves to a higher standard, given their position of authority
and the level of ethical responsibility that comes with it.

> Its definitely the cure for those times when GAK starts looking like
> reasonable, sensible and prudent alternative.
> 
> I have absolutely no involvement or monetary connection to these
> people.  I just wish they would have put it on video first.

  I get a dollar for every video sold, so I may be a bit prejudiced.
(Just kidding!)

KiddingMonger
~~~~~~~~~~~~~
 
> "Is your religion BATF approved?"
> 
> ---------- Forwarded message ----------
> Date: Wed, 15 Oct 1997 12:34:04 -0700 (PDT)
> From: SomFord Entertainment 
> To: somford at worldnet.att.net
> Subject: "Waco: The Rules of Engagement" Video Order Form
> 
> Thanks for your interest in obtaining the video of  "Waco: The Rules of
> Engagement".
> We are pleased to announce that it is finally available!  Please check the
> website
> periodically for ongoing reviews, press, announcements and updates to the
> order form.
> 
> http://www.waco93.com/
> 
> "Waco: The Rules of Engagement"  Video Order Form
> 
> Print, Complete, And Mail This Form With Check Or Money Order To:
> SomFord Entertainment, 8778 Sunset Bl., Los Angeles, CA 90069
> 
> Questions: 310-289-3900
> 
>      1. E-Mail Address:...............................................
> 
>      2. First Name:...................................................
> 
>      3. Last Name:....................................................
> 
>      4. Street Address:...............................................
> 
>      5. Apt. No., Other Info:.........................................
> 
>      6. City:.........................................................
> 
>      7. State/Province:...............................................
> 
>      8. Country:......................................................
> 
>      9. Postal Code:..................................................
> 
>      10. Phone:.......................................................
> 
>      11. "Waco: The Rules of Engagement" Video.........Quantity:......
> 
>            $25.00 for 1 tape.
>            $22.50 each for 5 tapes.
>            $20.00 each for 10 tapes.
> 
>            Bookstores and Catalogues, Call for Bulk Order Info.
>            All Prices Include Domestic Shipping and Handling.
>            CA Residents Please Add 8.25% Sales Tax.
> 
>      12. Total:.......................................................
> 
>      Make Check or Money Order Payable to: SomFord Entertainment.
> 
>      Comments Or Special Delivery Instructions:.......................
> 
>      Please allow three weeks for delivery. Thank you for your order







From attila at hun.org  Thu Oct 16 02:14:36 1997
From: attila at hun.org (Attila T. Hun)
Date: Thu, 16 Oct 1997 17:14:36 +0800
Subject: consensus on pgp? can we consolidate for action?
Message-ID: <19971016.032545.attila@hun.org>



-----BEGIN PGP SIGNED MESSAGE-----

    two of the things I was trying to do in my rant "GET WITH
    IT" on the issues may not have been clear:

     1. as Tim says, let's make sure the OpenPGP standard (which
        in itself I did not address) is for PGP by itself, none
        of the peripheral issues or means of implementing
        GAK/CAK/CMR or the rest of the faloderol.  now, if PGP,
        under market pressure wishes to allow hooks for each of
        the sins from the necessary to the unpardonable GAK
        --that is a business decision.

     2. as far as the proposed SNMP "enforcer" --that is also a
        business consideration.  however, the more PGP is
        willing to listen to some of our voices of reason[1], 
        the more likely PGP is going to be in the rather 
        enviable position which at least permits companies to 
        make a choice.

            [1] by and large, despite the polarity of the
            arguments, this issue with PGP has been one of our
            memorably sane and polite debates with so many
            threads I may need to establish a separate text
            retrievable database!  and it involves one of our
            most emotional issues:  privacy.

    the second point is critical to our interests as well as for
    PGP's stand in the industry as a whole. if the SNMP enforcer 
    product is carefully designed, it can not only provide 
    warnings for each level of security but even more 
    importantly, it does not necessarily need to provide GAK
    functionally in the standard product:

        browsers use plugins --so why not security level 
        plugins for the "Bad Daddy" SNMP enforcer?

    essentially, the SNMP is a network connected, ie- 
    communication system, supervisor to one or more "clients"
    scattered anywhere in the network which recognizes Bad 
    Daddy. some of the PGP control functions are basic, but the
    rest should go on plugin, each relating to a different level
    of sin, forgivable to abominable.

    likewise, the local PGP crypto engine should be built around
    plugins. in this manner, anyone concerned with privacy can 
    easily check for the presence of the dirty little black 
    boxes, or hopefully PGP will display a panel of "features"
    (if you can ever call invasion of absolute privacy that).

    plugins today are a nobrainer.

    personally, I would not be willing to endorse a system which
    gives the SNMP Bad Daddy the ability to retrieve my secret
    keys and PGP should permit holding my secret keys on a flop
    of some type -in other words specify a separate location 
    for the secring which we can not do now unless we move the 
    rest of PGP environment (at least as far as I have read). 

    however, if I am stupid enough to put them in a network
    accessible position for the superuser to scarf -- that's my
    problem. for use on network machines, I have a c program 
    which is effectively a one time pad to make the ring 
    accessible for as short a time as possible. I was writing
    a c code supervisor which took care of this task rather 
    neatly with an out of place checksum passwd for the pad 
    keys but have been sidetracked.

    I think we have all pretty much agreed on the necessity of
    separate signature, communication, and storage keys; Adam
    Back convinced me rather quickly (I was using only a
    separate storage key). there is less agreement on the 
    effectiveness of GAKing the communications key since some
    form of DH session keys could be deployed and mail is
    transient; eg: GAK only serves the Fed in this case, which, 
    of course, is what they want.

    I have not seen any further discussion on my suggestion to
    create a sendmail type daemon which implements DH between
    mail clients. this, of course, is on the presumption that DH 
    is a wrapper for an already encrypted packet, 

    I also agree with Adam's design on isolating the recovery 
    aspect from possible GAK outreach. although I will cop a
    plea to sometimes in the back and forth Adam was grasping
    for something which was never going to be there 

    bottom line: I think the consensus has already formed that
    PGP is not going to be the pristine voice crying in the 
    wilderness we all hoped to hear; now the issue is, how can
    we shape the product to have a) the most flexibility, 
    realizing full well there will be brain dead organizations
    who will insist on ordering GAK; and b) have the fewest
    potholes unknowingly enabling some level of pseudoGAK, etc.]
    again, that means focusing the pressure on PGP to keep the
    basic crypto engine pristine, and do the dirty work in Bad 
    Daddy --and use "visible" plugins.

    I can only presume PGP 5.5 is a fair ways down the pipe to
    delivery, complete with its Big Daddy SNMP enforcer; this 
    will make it all the harder to influence changes as PGP, Inc.
    appears to have grown enough in size to contain too many
    non-caring v/v real privacy (I have nothing to hide type 
    ignorance), and even more disappointing, not only technically
    ignorant, but distrustful of technology bureaucrats that 
    arrive with corporate growth -focused on 

        a)  closing off the design cycle; 
        b)  stifling the debate over methods; 
        c)  shipping product (oh, hell, we can listen to their
            complaints and make changes later...); and,
        d)  recover the vulture capital investors money.  

    if the foregoing is true, I hope PRZ has the good sense to
    take a walk, selling his stock (to do otherwise would be
    complicit in the deception of PGP's reputation capital).

    regardless of the above, if we as a group, with reasonable
    consensus, are willing to make an assault on the powers that
    be at PGP, Inc. including whatever relevant public publicity
    to heat the fire, there may be action.  hell, if we could 
    afford it (or Tim feels _real_ generous ), buy a NYTimes 
    page and all of us sign the "selling out our the constitution"
    with cute little graphics of children being tortured for 
    their keys.

    another point to consider:  if a majority of cypherpunks as
    a group are willing to "endorse" the pgp product, that may 
    be an issue worth discussing with pgp.  the only problem
    may be the level of the outside managers and bean counters
    which hold down the front offices, totally ignorant of 
    anything but feeelthy money; or, more probable, some cp
    subset who have been the primary contributors historically
    on these issues, and I think most of us know who the primary
    thinkers are on this issue are.  obviously we must be fully
    informed and our opinions assessed --even with divergences.
    in the end, I would like to think decisions could be settled
    by consensus, rather than Supreme Court style. 

    if we (and I say this as: "who's this we...")....

    despite the cynical contempt with which the mass media often
    displays to our attitudes, even resorting to name calling,
    reputation capital is not necessarily gained from main line
    press popularity, and certainly not from government
    "popularity" in this issue [particularly cogent to those of
    us "fortunate" to have received the IRS spam].  FWIW

    of course, I may be presumptuous PGP would even want to hear
    from us, let alone have any form of "Cypherpunks Inside" 
    (yuk) label on the box! particularly with the round robin 
    multi-teaming of the sleepless Jon Callas.

        this has been an attila rant...

        attila, out, one more time....

    and: it aint over 'til the fat lady sings, vahalla burning!

 "attila" sig: 1024/C20B6905/23D0 FA7F 6A8F 6066 BCAF AE56 98C0 D7B0 

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1
Comment: No safety this side of the grave. Never was; never will be

iQCVAwUBNEXXkb04kQrCC2kFAQHD1wQAiAMt4qP+GX0SXpF9XSuWbJc38tBWFD+U
ErAn5iAhrWkzl1/HpkmxDb8qUS9fh1fTsUjTihTOCSU8RwvtkBuzkhMm02MXxxyK
eJndaYgdpt+pluGYfrDIj9Vd3QDQVlJ0gf+o+CQ+pwQUJxYjmI/oELb0jBDnOwek
EUl1MAszW90=
=EulT
-----END PGP SIGNATURE-----






From tm at dev.null  Thu Oct 16 02:54:15 1997
From: tm at dev.null (TruthMonger)
Date: Thu, 16 Oct 1997 17:54:15 +0800
Subject: Praise the Lord! / Re: anti-GAK design principles: worked example #1
In-Reply-To: 
Message-ID: <3445E0D9.6E50@dev.null>



Jon Callas wrote:
> At 11:45 PM 10/15/97 +0100, Adam Back wrote:
 
> Okay, Adam, I'll be civil here, but here's something I want to note:
> 
> You've ranted, raved, politicized, propagandized, given ad hominem attacks,
> and stated the opinion that anyone who disagrees with you is evil. You've
> sent flames to our internal development lists, which is at least impolite.
> Yet you say, "constructive criticism only." Sure. I'd like an apology from
> you, though. Deal?

  Praise the Lord!
  The CypherPunks mailing list dialogue re: CMR/PGP is CypherPissing at
its finest.

  As a cryptographer, I am pretty much a carpetbagging pretender, but,
up to now, I have managed to fool quite a number of people into thinking
that I may understand the issues involved in privacy, security and
encryption.

  Now that the shit has seriously hit the fan, however, I find that I
am completely clueless as to the true import of the latest developments
which will decide the future of encryption. (And I suspect that I am
not alone in this.)
  I believe that my philosophical viewpoints of encryption issues are
valid in many ways (and probably irrelevant in other ways), but the
current nadir point in encryption development is one in which there is
no possibility of many of us making sound decisions as to what position
we should ethically take, unless those who truly have a solid grounding
in the underlying technology manage to accurately explain the issues
involved to those of us who *don't* dream in algorithms.

  I am extremely pleased with Adam Back's in-your-face, "I'm from
Missouri...show me!" attitude, since I think that this issue is
important enough that no one should give an inch of ground until
their philosophical opponents have given them valid cause for doing
so. I am also pleased that Adam is honestly and openly asking for
those who *can* 'show' him, to do so.
  I am also every bit as interested in hearing and learning from the
position that Jon Callas is taking, based upon his own knowledge of
what CMR/PGP is, and is not.

  I honestly do not care in the least whether Adam and Jon are 'both
right', whether they are both 'half-right', or none of the above.
  What I *do* care about is that they both honestly state their case
to the extent that I have enough information to make my own decision
as to what future course of action I should take on these issues.

  My depth of concern in this matter springs from the following:
I care...and I act. As a result, my actions have effects, for which
I consider myself responsible.
  I truly believe that abortion results in the extinguishing/murder
of a divine spark of human/spiritual life energy. Yet I risked my
life and my freedom, helping my sister smuggle home-abortion 
literature into a predominantly Catholic country behind the Iron
Curtain. Why? Because it is not up to me to make the decisions
for *everyone*, and I do not believe that it is in the interest
of humanity to have *two* spirits die because those who choose
to do home abortions do not have access to information that will
preserve their life.
  The 'Right To Life' faction will publish *their* statistics and
opinions, as will the 'Pro Choice' faction, but I refuse to take
the easy way out and convince myself that I can flip a coin to
decide which faction will bear the responsibility for *my* own
decision in the matter.

  The coming developments in information technology will undoubtably
make George Orwell look like an optomist.
  We have to make our decisions without having the benefit of hindsight
that history affords us. If Hitler had indeed only wanted 'Austria', 
then the concessions that world leaders of the time made might have
proven to have saved many needless deaths. History has proven this to
be wrong, but those of us who did not live through that time would have
a difficult time divining who was 'honestly wrong' and who 'sold out.'

  How many guilty men should go free in order to guarantee that a single
innocent man is not imprisoned?
  My answer: "More than one, less than a million." (ymmv)

> Fair-warning. In my first missive, I talked about my own principles, and
> one of them is the "fair-warning" principle. It states that users should
> know what is going on. If you have a key that is used in this system, there
> is nothing in it that tells me that your company can read a message I send
> you. I see this as a flaw, and one that I consider to be a *very* big deal.
> Full disclosure is one of my hot buttons.

  I could be wrong, *but*:
  With PGP 5.0, I found that if someone sent me a message that
was encrypted to someone else, I would get a message telling me
that I didn't have the proper key, but would not tell me who the
message *was* encrypted to.
  I could drop into PGP 2.6.2 and get a message saying (paraphrased),
"Encrypted to John Doe , you don't have that key."
(OK, *badly* paraphrased.)

  With PGP 2.6.2, I routinely used a bogus password in my first pass at
decyphering messages, so that I could find out who all the message was
encrypted to. It makes me nervous that one has to 'make a mistake' in
order to get 'the rest of the story', rather than automatically be
informed when a message is also encrypted to others.

  Also, as a 'teaser', I would like to announce to one and all that
the quickly closing saga of 'InfoWar' will include an epilogue
chapter titled, "I Broke PGP," written by myself.
  Believe it or not, I speak the truth, although not in a way that
it direct and obvious.
  If you think I am bullshiting, then stop washing your asshole,
starting today, because if you can show me I am wrong, I will kiss
your ugly, hairy ass.

Love and Kisses,
TruthMangler






From hgweigand at wiesbaden.netsurf.de  Thu Oct 16 19:23:11 1997
From: hgweigand at wiesbaden.netsurf.de (Hans Guenter Weigand)
Date: Thu, 16 Oct 1997 19:23:11 -0700 (PDT)
Subject: New Mac68k snapshot available
Message-ID: 


The second snapshot for mac68k is available at the usual locations. This 
time the newest installation tools are included. The errata of the first 
snapshot have been fixed. Please report all errors, problems, failure, 
and (of course:) success to Theo de Raadt or at least to the appropriate 
mailing list.

Thanks to Allen, Rodney and Thomas for the last-minute-help!

hgw





From scannmann at nevwest.com  Thu Oct 16 19:30:36 1997
From: scannmann at nevwest.com (scannmann at nevwest.com)
Date: Thu, 16 Oct 1997 19:30:36 -0700 (PDT)
Subject: Information Security Policies
Message-ID: <199710170230.TAA20526@nevwest.nevwest.com>



Security Policies To Go!

Don't re-invent the wheel. Get the most comprehensive source of information
security policies available. Information Security Policies Made Easy
(version 6) is a collection of 840 already-written policies in book and
CD-ROM. ISPME is the fastest and most expedient way to write new and /or
revise existing information security policies. Use your favorite word
processing package and cut and paste from these ready-to-go policies,
justification statements, and other supporting materials. Generate a
complete policy statement in five minutes or less.

It Includes extensive instructions which provide practical advice about the
policy development process. Applicable to organizations throughout the
world, the book/CD-ROM provides policies covering a broad range of topics
including: Internet, intranets, firewalls, network security, contingency
planning, computer viruses, electronic payment systems, web surfing
activity monitoring, Java, macroviruses, data classification, push
information distribution, software development, intellectual property
rights, password management, and much more. The latest version also
includes ten skeleton policies which are ready-to-go complete policy
statements. These skeleton policies can be used as is or expand them with
other policies from the book. ISPME provides everything needed to write
standards and communicate them in a clear, concise manner.

Check out our web site for further details -- www.baselinesoft.com or
contact us via e-mail info at baselinesoft.com or call us today (800) 829-9955
(USA & Canada) (415) 332-7763.

Here are what people are saying about ISPME:

"It saved me thousands of hours and thousands of dollars." -- J. P.,
Capital Blue Cross

"An excellent source for policies on new technologies. Great to have it on
CD." -- B. S. F., CISSP, The Vanguard Group

"Excellent reference, I would recommend this book to all policy writers."
-- R. M., Atlantic Lottery Corporation.

"Wood has hit a home run with this one!" -- B. A., Rekam Graphics












From gnu at toad.com  Thu Oct 16 20:47:01 1997
From: gnu at toad.com (John Gilmore)
Date: Thu, 16 Oct 1997 20:47:01 -0700 (PDT)
Subject: Bernstein case update: Government appeal brief filed
Message-ID: <199710170305.UAA03381@toad.com>


The government has filed its 81-page "brief" with the Ninth Circuit
Court of Appeals in the Bernstein case.  They argue that the export
controls are "constitutionally permissible", that they are not a
facially unconstitutional prior restraint on publication, and that the
District Court gave Prof. Bernstein "too broad" relief by declaring
the law and regulations unconstitutional and partially enjoining their
enforcement.

The brief has been scanned in as page images, and is at:

	http://www.eff.org/pub/Legal/Cases/Bernstein_v_DoS/Legal/970116_appeal_brief.images/

Prof. Bernstein's legal team will file its reply by November 10, the
government will reply by November 17, the Court will hold a formal
hearing sometime during the week of December 8, then the Court will
issue its decision.

	John Gilmore
	Electronic Frontier Foundation





From cte at nevwest.com  Thu Oct 16 21:51:31 1997
From: cte at nevwest.com (cte at nevwest.com)
Date: Thu, 16 Oct 1997 21:51:31 -0700 (PDT)
Subject: Thursday $329
Message-ID: <>


Thanks for your email, here's something you can really use.....

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
               BULK E-MAIL FRIENDLY ACCOUNTS. 
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

       THE INTERNET IS EXPLODING!!! DON'T GET LEFT BEHIND.
   E-MAIL IS MORE RESPONSIVE THAN ANY OTHER FORM OF ADVERTISING. 

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

====================================================================
"INSTANT" BULK E-MAIL ACCOUNT. Includes 3 months service, setup, and
ONE MILLION E-mail addresses on CD-ROM. ONLY $350.00 COMPLETE!!!
        ORDER BY 1:00 PM, BE UP BY 4:00PM the SAME DAY
      Visit our web site "http://www.nevwest.com   
====================================================================

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

WHY DO I NEED A BULK EMAIL ACCOUNT? SO YOU CAN..
Fill YOUR Downline..sell YOUR Book..sell YOUR Service..sell YOUR products..
expose YOUR web site..whatever YOU want to advertise..FOR  FREE!!!!

UNLIMITED E-MAILING!
No limit to how many e-mails you can send. Imagine the possibilities. 
Be on a level playing field with the big boys. All accounts come with 
Email redirect to your own mailbox

FREE ACCESS WITH YOUR REGULAR ISP!
You access CTE simply by logging on to your regular ISP, then POP in 
with your present e-mail program. You are then automatically connected 
to CTE's servers with multi T-1 access. 

PROTECT YOUR PRIMARY ISP ... PERMANENTLY.
Cybertize-Email shelters your primary ISP address, and provides you 
with a 100% safe and permanent ISP, for a reliable, Bulk Email FRIENDLY, 
mailing point. Unlimited e-mails, bomb proof, non dial-up. 
Web Page hosting and e-mail addresses.

USER SUPPORT SERVICES.
Cybertize-Email can also provide you with Web Page hosting and FREE classified advertising on our website. Post your classified ad for FREE for 3 months at a 
time, renew every 3 months for FREE. 

GOT A WEB PAGE??? 
Great so do over 10 MILLION others, your Web Page probably

stands out like..

A GRAIN OF SAND ON THE BEACH

Send bulk email and direct them to your website on our servers. 
Watch your orders SOAR!!

Visit our web site "http://www.nevwest.com

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
"INSTANT" BULK E-MAIL ACCOUNT. Includes 3 months service, setup, and
ONE MILLION E-mail addresses on CD-ROM. ONLY $299.00 COMPLETE!!!
        ORDER BY 1:00 PM, BE UP BY 4:00PM the SAME DAY
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

OTHER ACCOUNTS

Basic Bulk Mail Account (NO MINIMUM)  Only $99.00* 1st month, $125 thereafter
Silver 3 month Bulk mail account ......  Only $99.00* per month ($297.00 Qtr)
Gold 6 month Bulk mail account  .......  Only $89.00* per month ($534.00 6 mo)
Platinum 12 month Bulk mail account ...  Only $79.00* per month ($948.00 Year)
*Set up charges $99.00 one time, includes domain registration, setup, etc.

WE HAVE UP TO 30 MILLION EMAIL ADDRESSES ON CD-ROM.  
         ONLY $99.00 PER MILLION

http://www.nevwest.com

or call 702-313-1100

-------------------- FREE CTE REGISTRATION -----------------
[  ] Yes, I'm in! I want a Nuke-Proof bulkmail friendly e-mail account.
Hit reply, complete your details below and send to: 
cte at nevwest.com or call 702-313-1100 M-F 9-5 PST

FULL NAME:__________________________________________
ADDRESS:____________________________________________
City:____________________ St.__________ Zip_________
Phone #_____________________________________________
E-MAIL:_____________________________________________

YOU CAN BE ONLINE NOW!!











From cte at nevwest.com  Thu Oct 16 21:51:31 1997
From: cte at nevwest.com (cte at nevwest.com)
Date: Thu, 16 Oct 1997 21:51:31 -0700 (PDT)
Subject: Thursday $329
Message-ID: <>


Thanks for your email, here's something you can really use.....

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
               BULK E-MAIL FRIENDLY ACCOUNTS. 
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

       THE INTERNET IS EXPLODING!!! DON'T GET LEFT BEHIND.
   E-MAIL IS MORE RESPONSIVE THAN ANY OTHER FORM OF ADVERTISING. 

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

====================================================================
"INSTANT" BULK E-MAIL ACCOUNT. Includes 3 months service, setup, and
ONE MILLION E-mail addresses on CD-ROM. ONLY $350.00 COMPLETE!!!
        ORDER BY 1:00 PM, BE UP BY 4:00PM the SAME DAY
      Visit our web site "http://www.nevwest.com   
====================================================================

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

WHY DO I NEED A BULK EMAIL ACCOUNT? SO YOU CAN..
Fill YOUR Downline..sell YOUR Book..sell YOUR Service..sell YOUR products..
expose YOUR web site..whatever YOU want to advertise..FOR  FREE!!!!

UNLIMITED E-MAILING!
No limit to how many e-mails you can send. Imagine the possibilities. 
Be on a level playing field with the big boys. All accounts come with 
Email redirect to your own mailbox

FREE ACCESS WITH YOUR REGULAR ISP!
You access CTE simply by logging on to your regular ISP, then POP in 
with your present e-mail program. You are then automatically connected 
to CTE's servers with multi T-1 access. 

PROTECT YOUR PRIMARY ISP ... PERMANENTLY.
Cybertize-Email shelters your primary ISP address, and provides you 
with a 100% safe and permanent ISP, for a reliable, Bulk Email FRIENDLY, 
mailing point. Unlimited e-mails, bomb proof, non dial-up. 
Web Page hosting and e-mail addresses.

USER SUPPORT SERVICES.
Cybertize-Email can also provide you with Web Page hosting and FREE classified advertising on our website. Post your classified ad for FREE for 3 months at a 
time, renew every 3 months for FREE. 

GOT A WEB PAGE??? 
Great so do over 10 MILLION others, your Web Page probably

stands out like..

A GRAIN OF SAND ON THE BEACH

Send bulk email and direct them to your website on our servers. 
Watch your orders SOAR!!

Visit our web site "http://www.nevwest.com

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
"INSTANT" BULK E-MAIL ACCOUNT. Includes 3 months service, setup, and
ONE MILLION E-mail addresses on CD-ROM. ONLY $299.00 COMPLETE!!!
        ORDER BY 1:00 PM, BE UP BY 4:00PM the SAME DAY
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

OTHER ACCOUNTS

Basic Bulk Mail Account (NO MINIMUM)  Only $99.00* 1st month, $125 thereafter
Silver 3 month Bulk mail account ......  Only $99.00* per month ($297.00 Qtr)
Gold 6 month Bulk mail account  .......  Only $89.00* per month ($534.00 6 mo)
Platinum 12 month Bulk mail account ...  Only $79.00* per month ($948.00 Year)
*Set up charges $99.00 one time, includes domain registration, setup, etc.

WE HAVE UP TO 30 MILLION EMAIL ADDRESSES ON CD-ROM.  
         ONLY $99.00 PER MILLION

http://www.nevwest.com

or call 702-313-1100

-------------------- FREE CTE REGISTRATION -----------------
[  ] Yes, I'm in! I want a Nuke-Proof bulkmail friendly e-mail account.
Hit reply, complete your details below and send to: 
cte at nevwest.com or call 702-313-1100 M-F 9-5 PST

FULL NAME:__________________________________________
ADDRESS:____________________________________________
City:____________________ St.__________ Zip_________
Phone #_____________________________________________
E-MAIL:_____________________________________________

YOU CAN BE ONLINE NOW!!











From aba at dcs.ex.ac.uk  Thu Oct 16 06:53:42 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Thu, 16 Oct 1997 21:53:42 +0800
Subject: re. GAK resistant design principles: worked example #1
In-Reply-To: <19971015203509.42369@bywater.songbird.com>
Message-ID: <199710161339.OAA00277@server.test.net>




Kent Crispin has a tenacious ability to continue to think logically
and critically, and not be drawn into emotional exchanges in the face
of jibes and hostilities (I am referring to previous unpleasantaries
on cypherpunks).  I think we all could take a leaf out of his book.  I
am going to attempt to myself from this point on in the CMR vs CDR
argument.  (I accept Jon Callas comments along similar lines.)

Kent Crispin  writes:
> On Wed, Oct 15, 1997 at 11:45:01PM +0100, Adam Back wrote:
> > 
> > 
> > Part of the problem in this debate I think is that I have proposed
> > many alternate designs, with varying degrees of GAK-hostility.
> > 
> > Also I have been accused of using "lots of anti GAK rhetoric, but
> > giving no proposals" by Kent.
> 
> Adam, you've tossed out half-baked ideas buried in several thousand
> lines of anti-GAK rant.  None of them were thought through in terms of
> infrastructure impact.  

I have resolved to repent my ways with regard to unconstructive
ranting and rudeness.  This should have the positive side effect of
reducing the length of my posts, and ensuring that more people read
them critically.

That the ideas seemed initially fuzzy is a reflection of the fact that
I have, as I presume others have also, been gradually improving my
understanding of these complex issues.

I found the exercise in attempting to codify what I consider to be
optimal design decisions from the point of view of maximising the GAK
resistance properties of protocol designs, software implementations
and communications standards useful in clarifying my thoughts.

I feel confident in my ability to demonstrate that my GR (GAK
resistant) design principles can be usefully applied to increase the
GAK resistance of the design of systems using confidentiality and
communicatons.

I will comment on your specific comments on this aspect below.

> The idea of reencrypting the data strikes me as half-baked, as well
> -- I sit and wonder about the pass-phrase handling for the transient
> encryption keys that are changing on a daily or weekly basis -- or
> is there no pass-phrase -- is the key just stored on disk with no
> protection

Your suggestion that the re-encryption construct is weak from a GAK
resistancy (GR) perspective is correct.  See my earlier comments on
realising the danger of that construct.

> > I reject that claim.  (I did use lots
> > of rhetoric, but this was to try to impress upon those arguing for CMR
> > of it's dangers.  They do not seem to acknowledge them.)
> 
> The evidence seems to suggest that the PGP folks agonized pretty 
> heavily over their design.  A stupid attack such as yours is far more 
> likely to cement resistance than it is likely to win cooperation.

I am forced to agree that emotional attacks are likely to hinder
cooperation.  Therefore emotional attacks on this topic are themselves
likely to be counter to global GR optimisation.  It is for this reason
that I will attempt from this point on in this discussion to swallow
my anger unless I can justify outbursts in terms of GR optimisation.
Readers are encouraged to remind me if I start slipping.

I can only offer as an excuse that it seems to me that PGP Inc could
be doing more to increase the GAK resistance of their product and
design within the financial and user requirement constraints they
face.  Emotional appeals are as you say is not likely to be the best
means to explain this belief.

I also offer as a mild excuse that in carrying out interactive list
discussions with people in the US who are on GMT-8 that my sleep
deprivation may have been showing through in irritability :-) I found
myself for instance going to bed at 8.30 am the other night.

> > I'll try in
> > this post to steer clear of anti-GAK rhetoric.  We'll instead take it
> > as a given that pgp5.5 and pgp5.0 are GAK compliant because of CMR and
> > that this is a bad thing.
> 
> Trying real hard...

Allow me to rephrase that in the light of my GR maximisation motivated
apparent character reform:

I believe that PGP Inc could make their design more resistant to GAK. 

The reason I believe that PGP Inc has thus far arrived at different
design conclusions than I, Bruce Schneier, Tim May, Ian Brown, and
others, is that PGP Inc have differently prioritised the multiple
desirable properties of a socially progressive crypto design.

Desirable properties are in prioritsed order of importance as I see
them:

1. preventing big brotherish governments enforcing GAK
2. discouraging little brotherish business practices
3. encouraging transparency of intent (marking keys with statements of
   intent on handling of plaintext)
4. application ergonomics

I think that PGP Inc has transposed criteria 1 and 2 in their
prioritisation.  I believe PGP Inc's design decisions and
recommendations to companies reflect honest attempts to discourage
little brother, and their use of statement of intent technology
demonstrates their commitment to preventing big brother.  But I fear
that their prioritisation reduces the big brother resistance of their
CMR system because this resistance has been traded off to attempt to 
provide little brother resistance.

If I understand correctly several PGP employees have claimed that you
should attempt to enforce the statement of intent principle with
protocol modifications.  Whilst statement of intent is useful, and a
good innovation which I applaud, criteria 1 and 2 should take
precedence where protocol modifications which are thought to
strengthen statement of intent have a side effect of reducing GAK
resistance.

Independently I think that it is not semantically useful to try to
enforce statement of intent at the protocol level with the CMR method.
This is because having an enforced second recipient in no way
guarantees that the second recipient will read the message, or is able
to read the message (the second recipient might not receive the
ciphertext, or he might have lost the company access key).

> > Will is correct on one point: at the begining I had not properly
> > thought one aspect through:
> 
> I suspect there are several other flaws you are now quite aware 
> of...too bad, I hoped you had something.

I believe that using the GAK resistant design principles allows one to
focus more clearly on the benefits of the various trade-offs possible
and to more acurately prioritise the multiple social criteria.

> > Design 1.
> > 
> > Instructions:
> > 
> > - scrap the CMR key extension
> > 
> > - store a copy of the private half of the users PGP encryption key
> >   encrypted to the company data recovery key on the users disk.
> 
> I work for a large organization, I have a unix workstation, an
> xterminal booting off a departmental server, and a Mac in my office. 
> As is typical in large organizations, a system admin team takes care
> of all routine administration of my systems.  They all have root, of
> course, and routinely do system upgrades and software installs on my
> Mac.

Sounds like a good example to base discussions upon: X-terminals,
multi user unix work stations and remotely configurable PCs.

> Your solution doesn't seem to fit this environment very well...

I would take your point there to be that you can't store the recovery
key on the local disk for the reason that the disk isn't local, and
that when the recovery key is stored on the local disk on remotely
administered or multi-user workstations that this is less secure.

I agree.  It is less secure.

(I have htmlized, and attempted to more clearly re-word the GR design
principles:

	http://www.dcs.ex.ac.uk/~aba/gakresis/

I have also added a fourth corollary which you might like to comment
on (it's not relevant to the above point).)

To return to your criticisms based on the mish-mash of shared user and
X-terminals typical of corporate environments, corollary 2 expresses
the best that can be done in this scenario:

> Corollary 2: where communications are transmitted in ways which
> violate principles 1, 2 or 3 it is in general more GAK resistant to
> enforce as far as possible that the recovery or escrow information
> remains in as close proximity to the data as possible, and as much
> under the control of the user as possible.

So if you are using an X-terminal, your passphrase will be going over
the ethernet, and all the files will be on a unix box.  About all you
can do about this to minimise security problems is to try to secure
your ethernet with IPSEC technology.  This is not currently very
widely deployed especially for intranet use.

Certainly if you are using your X-terminal to connect to machines over
the internet many companies have taken steps to reduce the dangers of
this.  VPN systems, and SSH achieve this kind of thing.  IPSEC and VPN
technology are typically fairly GAK resistant anyway, because use of
forward secrecy is common.

The overall system is _still_ more GAK resistant than CMR for the
sorts of logistical reasons that Tim May has been describing.  You may
like to comment on this claim which I am willing to defend.

> > Recovery method:
> > 
> > Custodian of recovery key inserts recovery floppy disk in machine,
> > decrypts copy of users private key, hands control back to user to
> > choose new passphrase.
> 
> Must be a very special boot floppy, of course, otherwise I just 
> subvert the floppy driver, feign forgetting my passphrase, and 
> collect the corporate crown jewels.  Or I hack into somebody else's 
> system and corrupt their key...

You can hack around it, and this is implicitly acknowledged.  The
point is that in trying to design the system so that it must be hacked
around before allowing easy use in a mandatory GAK setting you have
built in extra GAK resistance in the form of the deployment and
logistical problems the government will have in developing, and
deploying patches and making sure every one applies them.

> [...]
> > 
> > - what is stopping you implementing this
> 
> It's completely unrealistic.

It was stated in it's simplest possible form for clarity.

It is however possible to build resistance into the system in the form
of inertia of the deployed code base in not providing automated ways
to access the recovery information outside of the software package.

Bill Stewart came up with the very good suggestion for example that
you only keep some of the bits of the recovery key to ensure that
recovery appears is artificially made time consuming.  This means that
with out replacing your software base, the government has a much
harder time installing GAK.  This also has the social benefit of
discouraging companies from using what are intended to be data
recovery features as snooping features.  This is exactly the sort of
lateral thinking that I am hoping to encourage.

> > - are there any plug ins which can't cope with this
> > - are there user requirements which it can't meet
> > - is there some fundamental flaw you think I have missed
> > - can you see ways that this could be perverted to implement GAK
> >   (yes I can too, btw, but...)
> > - are those ways logisitically harder for GAKkers to acheive than for CMR
> > 
> > Please be specific, no general waffle about understanding the
> > complexities of balancing user ergonomics, user requirements etc.
> 
> Unfortunately, for real products you do have to consider these 
> factors. 

I fully agree that you have to acknowledge user ergonomics and user
requirements.  What I was asking was that people in criticising my GR
design principles explain which user requirements they think can not
be met, or which user ergonomics features are hindered.  I also
explicitly state in design principle 4 that you should balance these
considerations to maximise the global GAK resistance of the deployed
software and hardware in the target jurisdiction.

> > principle 3:
> >    communications should be encrypted to the minimum number of
> >    recipients (typically one), and those keys should have as short a
> >    life time as is practically possible
> 
> Key lifetime is a major issue.  Keys are either protected by 
> pass-phrase, or vulnerable.  Think about how you are going to 
> generate new keys every day, or every week...

Perhaps if I give some examples of how some one designing a protocol
according to these principles might proceed in this direction it would
be clearer how to minimise the impact on ergonomics without losing
security to the extent that it allows government access simply as a
property of the induced weakness.  (In otherwords I am willing to
trade security for extra GAK resistance if it comes to it, but
typically does not seem to be required as GR design principles 1, 2,
and 3 are independently sound security objectives).

Companies would protect all keys by password, or by smart card token,
or by secured facilities or just by the nature of it being sufficient
for their security requirements to rely on the same weak physical
security which protects their paper files.

So: the signature key does not have recovery information -- I think
this is agreed by all.  The storage key used in encrypting information
on your disk is has recovery information stored as described.  The
shorter lived forward secret keys could be also recovery protected
(during their lifetime).  PGP 5.x already has this feature.  Consider
the encryption keys to be your forward secret keys.  Give them shorter
than normal expiry dates.

Your next comment is very pertinent in demonstrating the sorts of
problems you must work around in attempting to maximise use of forward
secrecy.

> Think about off-line composition of email -- I have a laptop, download
> my mail from the pop server, compose email.  Now I can't store my
> friends public keys on my disk, because they expire every day.  So I
> have to go to the public keyserver for every correspondent's public
> key -- if the keyserver is unaccessible I'm out of luck.  This
> radically changes the expected semantics of email.

I have 2 comments on this problem:

Consider: a system which automatically adapts and is forward secret
when it is able but not when it is not possible is more GAK resistant
than one which never uses forward secrecy at all because of the
existance of some situations where it is difficult to use.

Consider also: a system which is relatively forward secret (perhaps
with key updates every week, or month) is more GAK resistant than one
which makes no frequent key recommendations and leaving people to
choose long expiries of 1 year or with user no comments made on the
dangers of not having expiries at all is more dangerous.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0


Dear MIS Subscriber,

MicroServe will be holding a basic Internet seminar on Tuesday, October
21st at teh Woodlands Inn and Resort in Wilkes-Barre, PA.  There will be
two sessions from which to choose, 1:00pm to 4:00pm or 6:00pm to 9:00pm.

We will be covering basic services such as email, ftp, world wide web, and
usenet news.  We will also provide information about the internet itself -  
how it started, where it's going, etc.  Everyone is welcome (whether an 
MIS customer or not), so tell your friends and family.

Again, this is a basic seminar.  We will not be covering advanced topics
such as web page creation or cgi programming.  So if you are an advanced
user already, this might not be the seminar for you.  We are considering 
advanced seminars in the not too distant future.

If you would like to register or if you have any questions, please call
Mike Siconolfi at 821-5964 x21.

Thank You,
Jeremy Rusnock

~-----------------------------------------------------------------------
Jeremy Rusnock                      MicroServe Information Systems, Inc.
Commercial Sales/CSM/Security          	100 North Wilkes-Barre Boulevard
jeremy at admin.microserve.net             Wilkes-Barre, Pennsylvania 18702
http://www.microserve.net/~jeremy    (800)380-INET x23 (717)821-5964 x23
------------------------------------------------------------------------
Free on Saturday? Play Ultimate. See http://www.microserve.net/~frisbee.








From aba at dcs.ex.ac.uk  Thu Oct 16 08:43:27 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Thu, 16 Oct 1997 23:43:27 +0800
Subject: Security flaws introduced by "other readers" in CMR
In-Reply-To: <3.0.3.32.19971015183740.008cad00@mail.io.com>
Message-ID: <199710161530.QAA22810@server.test.net>




Greg Broiles  writes:
> Tim May  wrote:
> 
> >Truly sensitive stuff--stuff about takeovers, foreign production plans, new
> >products, etc.--will be encrypted with channels having no nosy security
> >guards or Corporate Crypto Compliance Police silently listening in.
> >
> >Which means we're back to square one. So why does PGP, Inc. bother?
> 
> Because they've got customers who will pay for CAKware. 

I have tried to express this trade off, and to make suggestions of how
to work within this frame work to hinder GAK take up:

(from http://www.dcs.ex.ac.uk/~aba/grdesign/:)

Principle 4: deployment wins. Violating any of principles 1, 2 or 3
whilst still remaining better than GAK-neutral can be justified where
deployment is thereby increased to the extent that the reduced GAK
resistance of the product can be justified by the overall increase in
GAK resistancy in the target jurisdictions. This can be expressed
loosely as the equation: introduced resistancy = deployment x
resistancy rating

Corollary 4: Where a profit function outside the individuals control
interferes with GR maximisation of principle 4, continuing in this
environment may be justifiable where this tactic helps promote global
GAK resistance in the target jursidiction. Examples of novel ways of
making the best of this imposed profit function overlayed on the
solution space of designs may be: attempts to subvert standardisation
processes to make the standards GAK resistant even for GAK neutral
developers, or to code GAK resistant implementations for GR-neutral
employers without informing them of these coding decisions, or to
promote GR implementation and protocol design to contacts in the
cryptographic developer community, or to anonymously release useful
proprietary GR optimisation technology, or to sabotage ergonomics or
reliability functions in implementations of very low GR rated designs.

> Why will customers pay for it? Same reason the FBI wants GAK, even though
> motivated/well-informed crypto users will superencrypt or otherwise bypass
> the enforcement mechanisms. If you're the C in CAK or the G in GAK, access
> to some data is better than access to no data - and the possibility of
> enforcement radically alters the risk/benefit calculus of even intelligent
> actors who see their interests as contrary to those of the [C,G]. 

I agree.

> As Jon Callas confirmed at the recent Cpunks physical meeting, the current
> CAK/CAM/whatever system has very weak code re policy enforcement - for
> example, it'll allow otherwise forbidden messages to pass through its
> filters if even the "--- BEGIN PGP MESSAGE ---" lines are altered or
> removed. It won't disassemble tar or zip or uuencode packages, or otherwise
> attempt to discover simple attempts to bypass the enforcement mechanisms.
> They're not trying to stop determined covert communicators - that's not
> their threat model.

It is a property of fielded systems that the majority of users will
work within the functionality provided by it.  This property can be
used by all 3 sides of the debate.  It is a politically neutral
mechanism.

1. It can be used by PGP Inc (who evaluate the tradeoffs between
socially desirable properties and ergonomics and come up with the
belief that CMR optimal solution).  They point out (rightly) that the
fact it is possible to easily hack around demonstrates some GAK
resistance.  I would argue however that it is not a very great
addition.  I have been trying to persuade PGP Inc that it is possible
to implement more highly GAK resistant products within their profit
function and user requirement set using the CDR (corporate data
recovery).

2. It can be used by people such as us who consider different
tradeoffs to be optimal, in that we can field systems which make it so
that the system has to be hacked before it could be used for GAK.  The
obfuscation can always be hacked around, almost by definition, but a
large beaurocratic organisation such as a government will find it
difficult logisitically to organise the development of GAK enabling
patches, and deploy these, and to persuade people to apply the
patches.

3. It can be used by people such as perhaps TIS who have cost
functions highly sensitive to not upsetting the government, and
therefore field on behalf of government GAK enabled systems.  They can
make it as hard to hack around as they can.  The difficulty of hacking
around and the difficulty of widely deploying the cypherpunks
"anti-gak patch for TIS mandatory GAKware v1.0" means that they partly
succeed.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



You've got a lot of nerve accusing PGP, Inc. of being "sellouts" when
you're over on open-pgp pushing KEY ESCROW, of all things.  I can see it
now, the new product name, "PGP with Key Escrow".  Motto: "Lose your key?
Don't worry, we've got a copy."  Do you really think cypherpunks are
going to support key escrow?  Fat chance.






From hahansen at hotmail.com  Thu Oct 16 10:37:16 1997
From: hahansen at hotmail.com (Harry Hansen)
Date: Fri, 17 Oct 1997 01:37:16 +0800
Subject: finger
Message-ID: <19971016173653.12409.qmail@hotmail.com>




______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com





From nobody at REPLAY.COM  Thu Oct 16 10:39:41 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Fri, 17 Oct 1997 01:39:41 +0800
Subject: Security flaws introduced by "other readers" in CMR
Message-ID: <199710161715.TAA21716@basement.replay.com>



Let's look a little closer at the kinds of access and notice available in
the PGP system compared to alternatives.

As several people have pointed out, no encryption system can provide
protection against what is done with the message after it is decrypted.
The receiver could share it with whoever he wants to, or whoever he is
forced to.

Consider the following scenarios:

 - An encrypted message is sent to someone at his workplace using current
   systems like PGP 2.6.

 - An encrypted message is sent to someone at his workplace, who is using the
   message access features of PGP 5.5.  The corporation key is marked as
   "optional", and the message is not encrypted to that extra key.

 - An encrypted message is sent as before, but this time the message is
   encrypted to the corporate key.

 - An encrypted message is sent to someone at his workplace, who is using
   a different form of corporate access which relies on key escrow
   or automatic acquisition of cleartext.

We agree that none of these systems can provide complete protection
against third party access.  In any of them, the receiver could be forced
to turn over the encrypted message.  But there is still a difference.

In the first two scenarios, the expectation of privacy is the same.
You are encrypting to a personal key at a business address, but you
expect that you would know about it if the data were being provided to
a third party.  There is no widespread installed base of software which
provides secret access after the message is decrypted.

In fact, the second scenario arguably provides slightly more privacy
than the first, which is what we have now.  The reason is that in the
second scenario, the company provides an optional mechanism for business
mail to be recoverable, but also provides an explicit, sender-controlled
escape clause.  The company is granting an explicit expectation of privacy
by allowing the corporate key recipient to be removed.  With usage of
older versions of PGP, there was really no way for the company to even
inform the sender about whether it was going to be reading the mail.

In the third scenario, where you encrypt to the corporate key, there is
no expectation of privacy.  All parties, the sender, the receiver, and
the company, know that the data is being made available to the business.
There is not much privacy here; what you have is business security.  This
mode would be used for business documents and business communications.

In the fourth scenario, which some people are offering as a superior
approach, the expectation of privacy is much less clear.  Unlike in the
current PGP approach, where the design of the corporate access system
is oriented around notifying the sender and receiver, a key escrow or
plaintext recovery system inherently provides no such notice.

This is different from the status quo.  We are talking about a commercial
product which provides automatic corporate access to communications.
Widespread installation and use of this alternate version of PGP
inherently changes the assumptions and expectations that you will have
when you encrypt to someone at work.  Given the company's desire for
message access, this approach implies that you must conservatively assume
that most encryption to a business address will be read.

The PGP system is designed to avoid this.  It provides another method
for corporate access, a visible and explicit method.  It is intended as
an alternative to key escrow and other systems which recovery data after
the recipient gets it.  PGP's third party recipient feature is designed
to prevent the creation of an installed base of escrowed keys and after
the fact third party access software.

Even if the encryption system provides a way for the user to mark his
keys as being escrowed or otherwise providing third party access,
the system is not self-correcting in the way the PGP system is.
It would be much easier for a business owner to pervert a secretive
access system than one like PGP.  The company could install the access
features but not tell its employees that their keys were being escrowed,
or that their mail client was secretly storing a copy of all plaintexts.
This kind of change would be easy to make with the after-the-fact access
systems some people are proposing.  Yes, theoretically this can be done
with any encryption system (as all agree) but the point is to avoid the
widespread distribution of software which invites this kind of abuse.
The PGP system is designed to satisfy business needs without leading us
into this dangerous situation.

A world in which third party encryption by the sender is the normal and
widespread method for corporate access is one with increased privacy and
more visibility of access.  The alternatives which have been proposed are
prone to abuse and provide less visibility.  They lead us towards a world
in which there is no expectation of privacy even for encrypted messages,
by providing an installed base of snooping software.  The PGP approach
is explicitly designed to keep us out of that world, by removing the need
for that kind of software.






From jon at pgp.com  Thu Oct 16 11:04:16 1997
From: jon at pgp.com (Jon Callas)
Date: Fri, 17 Oct 1997 02:04:16 +0800
Subject: Praise the Lord! / Re: anti-GAK design principles: worked example #1
In-Reply-To: 
Message-ID: <3.0.3.32.19971016104056.00bd3d70@mail.pgp.com>



At 03:39 AM 10/16/97 -0600, TruthMonger wrote:

     I could be wrong, *but*:
     With PGP 5.0, I found that if someone sent me a message that
   was encrypted to someone else, I would get a message telling me
   that I didn't have the proper key, but would not tell me who the
   message *was* encrypted to.

You're right, that was in PGP 5.0. It sucked. It's fixed in 5.5. 5.5 shows
you a nice little box on every message showing you who it is encrypted to.

	Jon

   

-----
Jon Callas                                  jon at pgp.com
Chief Scientist                             555 Twin Dolphin Drive
Pretty Good Privacy, Inc.                   Suite 570
(415) 596-1960                              Redwood Shores, CA 94065
Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS)
              665B 797F 37D1 C240 53AC 6D87 3A60 4628           (RSA)






From ianacr at dev.null  Thu Oct 16 11:05:06 1997
From: ianacr at dev.null (I Am Not A Crook Remailer)
Date: Fri, 17 Oct 1997 02:05:06 +0800
Subject: InfoWar Epilogue 3 (Part III of 'The True Story of the InterNet')
Message-ID: <344652FF.2F9C@dev.null>

A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 8827 bytes
Desc: not available
URL: 

From ianacr at dev.null  Thu Oct 16 11:08:40 1997
From: ianacr at dev.null (I Am Not A Crook Remailer)
Date: Fri, 17 Oct 1997 02:08:40 +0800
Subject: InfoWar Epilogue 3 / TEXT
Message-ID: <3446532E.3F3C@dev.null>



----------------------------------------------------------------------------
----------------------------------------------------------------------------

                       The True Story of the InterNet
                                  Part III

                                   InfoWar

                  Final Frontier of the Digital Revolution

                     Behind the ElectroMagnetic Curtain

                        by TruthMonger 

Copyright 1997 Pearl Publishing
----------------------------------------------------------------------------
----------------------------------------------------------------------------

                          InfoWar Table of Contents

   * Epilogue
   * Gomez

----------------------------------------------------------------------------

                                  Epilogue
----------------------------------------------------------------------------

Subject: Nun Other
From: John Young 
To: cypherpunks at toad.com

On terrorists, one of the Four Horsemen.

IS THE ASSAULT ON NATIVE INTELLIGENCE &
GOOD WILL WE CALL THE EVENING NEWS
ANYTHING OTHER THAN AN ACT OF TERRIORISM?

What was the Gulf War but terrorism
wearing the death mask of order?--
One big car bomb it was
the guys who drove it
are dying now one by one--ignored!

Is acid rain a form of terrorism? (Think for yourself.)
Is GATT or NAFTA anything but a pact among brigands--the World Bank, the IMP
their backup men?
How long before they fight over the spoils?
Who'll do the fighting for them?"
----------------------------------------------------------------------------
----------------------------------------------------------------------------

                                    Gomez

Damn!

Will these contemptuous, plebeian subalterns never learn?

I will allow them to fight over the spoils! They will do the fighting for
ME! It is I who am at the right hand of the Evil One. It is I who will bring
the earth to submission under HIS dominion, with the Dark Allies by my side.

The future is written! It is written!
These foolish ants continue to struggle in vain, though the battle they
persist in fighting was lost centuries ago. They can do no more than
postpone the inevitable, at best�
----------------------------------------------------------------------------

The stage is set. My minions have their exits and their entrances, and I
have, in my time, played many parts.

The book-learners rail against sheep in wolves clothing, while I weave them
all into patterns of my own design, like a weaver spinning her wool and
intertwining it according to an already foreseen pattern.
Like the Big Bad Wolf in Grandmother's bed, I sit at the head of the table
from which they sup, laughing at the ragamuffin progeny of the human race as
they tell me, "My, Big Brother, what big eyes you have."

And what big teeth I have�but this Big Bad Wolf has already taken the axes
out of the hands of most of the woodcutters, and the rest of their weapons
shall be in my hands by the end of 1999.
The mortal fools who live in the InfoWar weald of my Grand Scheme cannot see
the forest for the trees as they fight their 'winning' battles one retreat
at a time. I have turned their words on their head with NewSpeak,
DoubleSpeak and SpinSpeak-I have turned their minds upside down by making
all forms of disagreement with my Puppet Masters CrimeThink and CrimeSpeak.

I have turned their world and their reality on its head, yet the simpletons
are not capable of turning 1999 on its head and realizing that at the end of
the millennial forest stands the Subtle Serpent which convinced Eve and Adam
to eat the fruit from the Tree of the Knowledge of Good and Evil-the
serpentine, autarchic Evil-1�and Armageddon.
----------------------------------------------------------------------------

"Please allow me to introduce myself�"

"I am An Evil FUD Disseminator To Be Named Later.
"I will be your host for the rest of this chapter of 'InfoWar,' because I
have the brass balls needed to tell you blatant lies about your future, and
the future of humanity, because I know that it is now too late for human
kind to save themselves, and that you desperately desire to hear, and
believe, the lies I am about to tell you.
"Now�back to our 'story.'"

It is becoming increasingly obvious, to even the deaf, dumb and blind, that
the Y2K (Year 2000) programming 'problem' has the potential to become a
worldwide disaster.

Is this an 'accident?' Is it the result of the laws of inertia, vis a vis
human nature?
Yes�now turn on the TV and go back to sleep.

That's right�the Y2K 'problem' has been known about for years, yet the
finest minds in the arena of computer finance have not understood the true
import of the problem until just recently. The major players of huge
financial empires have been sitting on their butts, completely unaware of
the possible scope of disaster that lies in wait at the turn of the century.
And all because they are so terribly, terribly stupid.

Yes, they are just now beginning to wake up and realize that their whole
world may come crashing down around them if the Y2K problem is not properly
dealt with.
Bill Gates has been sitting back, thinking, "Damn. I may be out a hundred
billion dollars before the fallout from this problem stops. Oh well, easy
come, easy go."

Financial institutions holding billions of dollars in hard assets have not
even remotely considered the possibility that, if computers worldwide lose
the ability to easily prove whom those assets truly belong to, well�"We'll
have this all sorted out soon, sir. If you will just take a place at the
back of the line, behind the other one hundred million people, our company
directors will be taking a look at everyone's claims just as soon as they
get back from their extended vacation on the French Riviera."

"After an intensive inquiry, we have come to the conclusion that we are an
honest, reputable financial institution which would never take advantage of
the Holocaust by profiting outrageously from the slaughter of millions of
our valued customers.
"There is just no way we can possibly trace who these assets should properly
belong to as a result of being slaughtered by some of our other valued
customers.
"On your way out, would you mind throwing these bookkeeping records in the
trash for me?"

The truth of the matter is, human nature is such that the operators of
funeral parlors in Asia have been found to be paying hospital employees to
surreptitiously murder patients whose family members are likely to use the
operators services when their relatives die.
However, people who can rule empires, perhaps even the world, by virtue of
being a Sumo Dog in a world of kittens, would never dream of using their
money, power and position to do so.

The three-letter agencies that regularly violate all manner of their own
country's laws, as well as the laws of other countries, and international
law-the secret agents who trade in weapons and drugs to support their
objectives, while imprisoning others who do so-the spooks who openly admit
that they use their secret access to worldwide financial systems to
manipulate and steal the Bad Guys � money and bring them to ruin�
Well, lets just say that they are people with high moral values, and would
never consider secretly preparing to take full advantage of the Y2K issue,
while assuring those outside the loop that it is bit of a 'problem' that
'someone' will get around to taking care of, sooner or later.

You can turn on the TV and see major financial institutions actively seeking
the business of deadbeats or fools with hard assets. You can see a smiling
man explaining that the company he represents loves you so gosh-darned much
that their standard contract contains two 'gimmes'-that they will give you
coupons which allow you to 'miss' two payments at your own convenience.
"Yes folks, we are trying to help people who are likely to default on their
loans because they believe the problems resulting from their bad financial
habits will be solved by planning ahead for getting in above their heads."
You can see ads telling you that Company B loves you so gosh-darned much
that they will loan you up to 125% of your equity in your home.
"We will even kiss you on the lips, to show our sincerity.
" When we call in your loan, you will be advised of where you can kiss us."

Trust me�these people are not involved in a mad scramble to gain possession
of as many hard assets as possible because they know something that you
don't know�

The IRS, the Rockerfellers, the shadowy world figures who own and operate
munitions factories in both, or all, countries involved in armed conflict,
the patriots who sell ball-bearings to keep the war machines that are
shooting at their sons and daughters operating�
Well, if there is great upheaval and disaster in the financial community, as
well as in society itself, then these people will probably come to ruin,
while your life just keeps getting better and better.

In conclusion, I would like to assure you that if worldwide disaster
suddenly looms as a result of a crisis caused by the Y2K 'problem,' that it
will undoubtedly be a result of the evil conspiracies of drug dealers,
pedophiles, terrorists, Saddam Hussein, and a Horseman to be named later.

The 'good' news is that our saviors are waiting in the wings to rush to our
rescue and save us from the Great Evil�as long as your name is not on 'The
List,' of course.

{Hang on a second, I'll check�}

Gee pal, I'm afraid I have some rather bad news for you�
----------------------------------------------------------------------------

                        "The Xenix Chainsaw Massacre"

                 "WebWorld & the Mythical Circle of Eunuchs"

           "InfoWar (Part III of 'The True Story of the InterNet')

                Soviet Union Sickle of Eunuchs Secret WebSite
----------------------------------------------------------------------------







From aba at dcs.ex.ac.uk  Thu Oct 16 11:10:28 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Fri, 17 Oct 1997 02:10:28 +0800
Subject: PGP Inc apology deal (was Re: anti-GAK design principles: worked example #1)
In-Reply-To: <3.0.3.32.19971015190021.00ae9730@mail.pgp.com>
Message-ID: <199710161758.SAA23468@server.test.net>




To reply to Jon Callas request for an apology for my rudeness, I'll
offer a deal:

- If I am unable to show you how to improve the GR (GAK resistance)
  property of a fully viable, implementable email security system within
  your choice of user requirement, ergonomic, and typical corporate
  environments restrictions, I will publically apologize for being
  rude, and for wasting your time.

- However, in return: if I am succesful in proving to PGP Inc that they
  can improve the GR property of an email security system within their
  requirements, I _don't_ want an apology.  

  I want something much more interesting: 

	I want PGP Inc to implement and deploy it.

- The group which will judge this process is PGP Inc.

Do we have a deal?

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0


ARE YOU SICK OF ALL THE SCAMS?!!

If you SERIOUSLY want to work at home, but you're sick of 
all the mlm "opportunities", then we have the PERFECT thing for you. You'll work 15 hours per week, and average $500-$900.  NO selling, NO catches, and NO SCAMS!!!  
For Info:

http://www4.c-flash.net/~kndpblsh

If this message has reached you in error, please accept 
our most sincere apologies.  Simply hit "reply", type "remove" in the subject area, and send.  You'll be removed from our list, promptly.
Thank you very much.  =)

Kim Skinner,
K & D Publishing
*********************************************************************
NO MLM, NO CATCHES, AND NO SCAMS!!!
For FREE Info On Our LEGITIMATE HOME BASED 
BUSINESSES, Visit Our Website At
http://www4.c-flash.net/~kndpblsh
Or, Click Here, kndpblsh at mail4.c-flash.net">mailto:kndpblsh at mail4.c-flash.net
And Send Us Your Snail Mail Address.
**********************************************************************
To Have Our FREE Report On SUCCESSFUL INTERNET
MARKETING Sent To You Immediately, Send A 
Blank E-Mail To Our Autoresponder At
mailto:kndpublishing at mail4.c-flash.net
**********************************************************************





From aba at atlas.ex.ac.uk  Thu Oct 16 11:25:36 1997
From: aba at atlas.ex.ac.uk (Adam Back)
Date: Fri, 17 Oct 1997 02:25:36 +0800
Subject: PGP Inc apology deal
Message-ID: <20316.9710161810@atlas.dcs.exeter.ac.uk>




To reply to Jon Callas request for an apology for my rudeness, I'll
offer a deal:

- If I am unable to show you how to improve the GR (GAK resistance)
  of a system with a similar set of recovery properties to the CMR
  system; which replacement design is vialble to use in a typical
  corporate environment I will publically apologize for being rude,
  and for wasting your time.

- If I am able to show you how to improve the GR (GAK resistance)
  of a system with a similar set of recovery properties to the CMR
  system which replacement design is vialble to use in a typical
  corporate environment, I _don't_ want an apology.

  I want something much more interesting: 

	I want PGP Inc to implement and deploy it.

- The group which will judge this process is PGP Inc.

Do we have a deal?

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710161803.TAA23821@server.test.net>




To reply to Jon Callas request for an apology for my rudeness, I'll
offer a deal:

- If I am unable to show you how to improve the GR (GAK resistance)
  property of a fully viable, implementable email security system within
  your choice of user requirement, ergonomic, and typical corporate
  environments restrictions, I will publically apologize for being
  rude, and for wasting your time.

- However, in return: if I am succesful in proving to PGP Inc that they
  can improve the GR property of an email security system within their
  requirements, I _don't_ want an apology.

  I want something much more interesting: 

	I want PGP Inc to implement and deploy it.

- The group which will judge this process is PGP Inc.

Do we have a deal?

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



-----BEGIN PGP SIGNED MESSAGE-----

    after I mailed the rant, I thought maybe the paragraph below
    was incomplete:

#   of course, I may be presumptuous PGP would even want to hear
#   from us, let alone have any form of "Cypherpunks Inside" 
#   (yuk) label on the box! particularly with the round robin 
#   multi-teaming of the sleepless Jon Callas.
#
    should have said
    
        ..."Cypherpunks Inside" label on the box: of course, 
        they might it consider it preferable to being labeled:

                "Big Brother Inside"
#
#
        this has been an addendum to an attila rant...

        attila, out, again, one more time....

  it aint over 'til the fat lady sings and vahalla is burning!

 "attila" sig: 1024/C20B6905/23D0 FA7F 6A8F 6066 BCAF AE56 98C0 D7B0 

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1
Comment: No safety this side of the grave. Never was; never will be

iQCVAwUBNEZc+L04kQrCC2kFAQE1AwP/W+BJ+a2rGhTh90lnMqt8RZCTOtmpWYrl
DMCQ+zojBnfRAkzZ/ethdnXYNgOlCRV/xWejMgOjLxlp3LDiAfzdgJM+u4ZCbZR3
Dvmkfs8uu8oK8E+3Ztb/H3XovXM6pxUtwoEaJKlOScBw2ypLFER3aZe1SVLnmDeb
P9vIBbx5j+4=
=NOox
-----END PGP SIGNATURE-----






From tcmay at got.net  Thu Oct 16 11:53:40 1997
From: tcmay at got.net (Tim May)
Date: Fri, 17 Oct 1997 02:53:40 +0800
Subject: Security flaws introduced by "other readers" in CMR
In-Reply-To: <199710161715.TAA21716@basement.replay.com>
Message-ID: 



At 10:15 AM -0700 10/16/97, Anonymous wrote:
...
> - An encrypted message is sent as before, but this time the message is
>   encrypted to the corporate key.
...
>In the third scenario, where you encrypt to the corporate key, there is
>no expectation of privacy.  All parties, the sender, the receiver, and
>the company, know that the data is being made available to the business.
>There is not much privacy here; what you have is business security.  This
>mode would be used for business documents and business communications.

However, this scenario may well represent a _step downward_ in real world
security for business users.

Whereas today their messages, encrypted or not, are not readily available
to spies within a company (save for sendmail logs, a serious liability, I
fully agree), implementation of the third scenario would potentially pool
all messages in a single very tempting target for snooping.

As I have noted, there are times when the CEO or other senior officer of a
company wants to communicate _truly securely_ with others inside or outside
his company. It is not acceptable to these companies to have a Corporate
Crypto Compliance Policeman (CCCP) able to peruse these messages.

Nor is it a very good idea to have an archive of pooled messages subject to
"discovery" in a lawsuit, FTC or SEC action, etc. There is a real risk that
PGP for Business with its archiving functions will decrease "plausible
deniability."

A solution is to have "override modes" on the CMR features, presumably
based on level within a company, permission, etc.

Another solution, which I presume PGP for Business could support, is to
have a series of levels, or even distributed pools. In other words, _many_
corporate keys.

(It would be impractical, obviously, for large companies with tens of
thousands of employees to all be feeding their dozens or hundreds of
messages a day into a single corporate key in box.)

The bottom line is that, while many companies may be clamoring for message
recovery, they may end up not liking the new risks imposed.


(And, should PGP's adoption of CMR hasten the onset of mandatory GMR or
GAK, as it may well be doing already, they may truly hate the whole thing.)

--Tim May



The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From declan at well.com  Thu Oct 16 11:59:35 1997
From: declan at well.com (Declan McCullagh)
Date: Fri, 17 Oct 1997 02:59:35 +0800
Subject: Anthrax Bombs
In-Reply-To: 
Message-ID: 



Buenos dias, folks. Just got back from Chile...

At 13:28 -0700 10/8/97, Tim May wrote:
>(As is well-known, or should be, folks survived Hiroshima and Nagasaki as
>close as 400 meters from ground zero. And they were both roughly 20 KT
>nukes. Inasmuch as the blast effects scale as the cube root of megatonnage,
>a 2 KT blast might be expected to be survivable as close as a few hundred
>meters or even less. Of course, some will die even out at a 1000 meters,
>but not many.)

I'm sitting here in my office between 17th and 18th streets just north of
the White House (which is at 16th and Pennsylvania) trying to calculate
blast radius. I suspect that if I'm in my office, I _could_ survive the
radiation -- if Tim's figures are correct.

It would help, of course, if anyone bombing the White House would do it
from the _Mall_ side of the building (the south side) rather than the north
side, which would be about four blocks closer to me.

But I'm more worried about the shock wave and firestorm that would follow
such a blast. I'm on the eighth floor of a large office building. I figure
I don't stand much of a chance.

>By comparison, anthrax bacillus is relatively easy to manufacture, and
>aerosol dispersion could kill hundreds of thousands or more before even
>being detected. Aerosolized dispersion in Washington or Manhattan could be
>a far worse human and infrastructure disaster than a suitcase nuke.

It might kill or harm more people, but it doesn't have the viceral,
psychological impact of a nuke. Let's hope the terrorists stay away from
biowar. At least until I move to West Virginia.

-Declan


-------------------------
Declan McCullagh
Time Inc.
The Netly News Network
Washington Correspondent
http://netlynews.com/







From mech at eff.org  Thu Oct 16 12:23:58 1997
From: mech at eff.org (Stanton McCandlish)
Date: Fri, 17 Oct 1997 03:23:58 +0800
Subject: pro-crypto govt. people
Message-ID: <199710161900.MAA15010@eff.org>



This year I recall seeing 1 former prosecutor saying that widespread
encryption was good and/or that GAK was bad, and 1 military or former
military person of fairly high status saying that GAK was bad. Circa
1994-5 I also recall a military or retired miltiary person of rank
reporting that very widespread crypto would be a boost to national
security.  We could really use these people's, and similar people's, words
in pro-crypto efforts. Unfortunately, disk problems a while back cost me
most of my old mail, including all of these saved items. If anyone has
them and/or knows who these people are, please let me know.

--
Stanton McCandlish                                           mech at eff.org
Electronic Frontier Foundation                           Program Director
http://www.eff.org/~mech    +1 415 436 9333 x105 (v), +1 415 436 9333 (f)
Are YOU an EFF member?                            http://www.eff.org/join






From declan at well.com  Thu Oct 16 12:37:50 1997
From: declan at well.com (Declan McCullagh)
Date: Fri, 17 Oct 1997 03:37:50 +0800
Subject: America as a Shake Down Extortion State
In-Reply-To: <800ba9b5ce70bcdb069766023ed9e797@anon.efga.org>
Message-ID: 



Certainly I trust the courts at least a little more than I do the
legislature. The current Supreme Court, for example in the _McIntyre_ case
and the CDA, has been quite good on traditional free speech cases.

But courts are much more deferential to the government on national security
issues, even trumped-up ones. While the right to speak privately is (I
believe) an important free speech issue, traditional jurists may be
reluctant to agree.

In other words: don't rely on the current Supreme Court to overturn a
mandatory-GAK law, especially if it has holes cut out of the escrow fabric
for corporations, etc.

-Declan



At 19:21 -0400 10/10/97, Ryan Anderson wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>
>At 01:32 PM 10/10/97 -0400, Anonymous wrote:
>>>Actually, I think it's a little more likely that they'll get disgusted with
>
>>>Congress, and collect some money for the ACLU to use to pay their lawyers
>in
>>>the instant filing of the consitutionality challenge.
>>>
>>>Seems to be a much more productive way to spend your money (long-term).
>>
>>Bullshit!  Fuck the lawyers!
>>
>>By wasting time and money in the courts bickering about the stupid laws that
>
>>buffoons in Congress pass in order to justify their existence, we are only
>>ignoring the real issue: you cannot use the system to change the system.
>
>That's the point - you ignore the legislation until it becomes a problem for
>you.  Then you challenge it and get a legal precedent to stop it from
>happening again.
>
>The judicial system is in *much* better shape than the legislative system
>(even though they are strongly related)
>
>This, however, is not to say that the judicial system is in good shape.
>-----BEGIN PGP SIGNATURE-----
>Version: PGP for Personal Privacy 5.0
>Charset: noconv
>
>iQCVAwUBND64fDc3ytqHnNyNAQFdUwP+NxJiiOfCxa8b6ONY0sLxFt8+NZBcf0fr
>WkYH4xA33a+Q1B81YL0CNQqxRpVue+CWh0Qp1JLKIHZjKrI/hMHmo/znCpJO6uDP
>4BRzq8LauWF8OTKT/r7Q2dJbqSs1ISb9FZE3FOYK0lb0By7w+TfiRXzUwTkYCH6E
>7vKvV/4PsuU=
>=5vpe
>-----END PGP SIGNATURE-----
>
>
>-----------------------------------------------------------------------
>Ryan Anderson -      "Who knows, even the horse might sing"
>Wayne State University - CULMA   "May you live in interesting times.."
>randerso at ece.eng.wayne.edu
>PGP Fingerprint - 7E 8E C6 54 96 AC D9 57  E4 F8 AE 9C 10 7E 78 C9
>-----------------------------------------------------------------------








From pk at dev.null  Thu Oct 16 12:59:49 1997
From: pk at dev.null (Psycho Killer)
Date: Fri, 17 Oct 1997 03:59:49 +0800
Subject: CFV: comp.org.cauce moderated -- support privacy and anonymity
In-Reply-To: <872169177.17960@isc.org>
Message-ID: <3446704A.F93@dev.null>



Igor Chudov @ home wrote:
> [This message has also been posted.]
> [I am objecting to a proposal that seeks to ban one-way anonymous
> remailers and other forms of unrepliable addresses such as spamblocked
> addresses].
 
> Mozena>>But, what do you have against anonymity?
> Mozena>
> Mozena>Nothing. What right do you have, though, to force me and others to
> Mozena>inconvenience ourselves so you can post anonymously or protect yourself
> Mozena>from spam?

  I agree with Mozena. I like to hunt down and slaughter people who
use the word 'reference' in their posts, and I'm getting damn tired
of wasting my valuable time because some assholes want to remain
anonymous.

> The average American spends a total of six (6) months in prison.

  I always knew I was above average, and now I have *proof*.

Psycho Killer
"Qu'est que c'est?"






From declan at well.com  Thu Oct 16 13:33:48 1997
From: declan at well.com (Declan McCullagh)
Date: Fri, 17 Oct 1997 04:33:48 +0800
Subject: pro-crypto govt. people
In-Reply-To: <199710161900.MAA15010@eff.org>
Message-ID: 



Andrew Grosso is the former prosecutor. I've also been chatting with Bruce
"I wrote the CDA" Taylor to see what his views are, but I suspect he'll
fall into line with his pals at the DoJ. Last week after a TV show I was
telling Donna Rice-Hughes about how crypto can protect against stalkers,
but I don't know if she understood my argument.

Others will be able to suggest many more people, I'm sure. I'm still
frazzled from my trip. Yesterday I was wandering around Chile's socialist
museum; the day before I was climbing an active volcano in the south.
//yawn//

-Declan


At 12:00 -0700 10/16/97, Stanton McCandlish wrote:
>This year I recall seeing 1 former prosecutor saying that widespread
>encryption was good and/or that GAK was bad, and 1 military or former
>military person of fairly high status saying that GAK was bad. Circa
>1994-5 I also recall a military or retired miltiary person of rank
>reporting that very widespread crypto would be a boost to national
>security.  We could really use these people's, and similar people's, words
>in pro-crypto efforts. Unfortunately, disk problems a while back cost me
>most of my old mail, including all of these saved items. If anyone has
>them and/or knows who these people are, please let me know.
>
>--
>Stanton McCandlish                                           mech at eff.org
>Electronic Frontier Foundation                           Program Director
>http://www.eff.org/~mech    +1 415 436 9333 x105 (v), +1 415 436 9333 (f)
>Are YOU an EFF member?                            http://www.eff.org/join



-------------------------
Declan McCullagh
Time Inc.
The Netly News Network
Washington Correspondent
http://netlynews.com/







From jf_avon at citenet.net  Thu Oct 16 13:34:10 1997
From: jf_avon at citenet.net (jf_avon at citenet.net)
Date: Fri, 17 Oct 1997 04:34:10 +0800
Subject: Liberal lawyer joke  from Cdn-Firearms Digest V2 #34
In-Reply-To: <199710161358.JAA06467@smtp2.sympatico.ca>
Message-ID: <199710162030.QAA07835@cti06.citenet.net>



On 16 Oct 97 at 9:58,somebody  wrote:

> Research labs are increasingly replacing rats with lawyers.
> 
> There are three reasons for this:
> 
> 1. The lawyers are in abundant supply
> 2. The lab workers do not develop any kind of emotional attachment to lawyers
> 3. There are things you just can't get a rat to do.






From declan at well.com  Thu Oct 16 13:39:52 1997
From: declan at well.com (Declan McCullagh)
Date: Fri, 17 Oct 1997 04:39:52 +0800
Subject: FBI allowed to keep file on New York man's lawful activities
Message-ID: 





	FBI allowed to keep file on New York man's lawful activities

By LAURIE ASSEO

Associated Press Writer

WASHINGTON (AP) - The Supreme Court today refused to order the FBI to purge its file on lawful activities by the former head of a charitable foundation. The court, without comment, turned away arguments that said the FBI is violating a federal privacy law by keeping a file about the man's years-ago meetings with foreign leaders and political dissidents. Lance E. Lindblom of Larchmont, N.Y., was president of the Chicago-based J. Roderick MacArthur Foundation from 1984 to 1994. The foundation supports civil liberties activities, and Lindblom's duties included meeting with foreign leaders and political dissidents. After filing a request with the FBI, Lindblom learned in 1989 that the bureau kept records that described his meetings with such people. Lindblom and the foundation sued the FBI in federal court in the District of Columbia, saying the 1974 federal Privacy Act required the bureau to purge those files. The law limits federal agencies' authority to keep records describing how people exercise their rights under the Constitution's First Amendment, including rights of free speech and association. Under the Privacy Act, agencies can keep such records only if it is authorized by another law or "within the scope of an authorized law enforcement activity." A federal judge ruled for the FBI, saying the files were compiled for legitimate law enforcement purposes. The investigations were not aimed at Lindblom or the foundation, but were aimed at the people with whom they met, the judge said. A federal appeals court agreed last December. Federal agencies can keep records they lawfully collected, the appeals court said, adding that a requirement to purge old files would be too burdensome. In the appeal acted on today, Lindblom's lawyers said agencies must separately justify the need to keep old records, even if they originally were lawfully collected. Keeping Lindblom's file increases the risk that it will be used illegally, his lawyers said, noting the 1996 controversy after it was found that the FBI files of 700 former White House employees had been sent to the White House. Justice Department lawyers said a requirement to purge old files would cause problems if the information later was needed for a new or reopened investigation. The case is Lindblom vs. FBI, 97-82. APTV-10-14-97 1020EDT From aba at dcs.ex.ac.uk Thu Oct 16 13:48:20 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Fri, 17 Oct 1997 04:48:20 +0800 Subject: PGP Inc apology deal In-Reply-To: <20316.9710161810@atlas.dcs.exeter.ac.uk> Message-ID: <199710162017.VAA24632@server.test.net> Whoops: dcs.ex mail system was misbehaving and appeared to be hanging on SMTP connects to mail hub. I was attempting modifying my sendmail.cf with different mail hubs to get mail back to functioning, and nothing appeared to work. I in the end I rlogged in to mail hub and cut and paste into emacs rmail. Clearly somethings went through while appearing to hang. Anyway, I thought it was a good post, but didn't intend to send 3 copies. I am most anxious for PGP Inc to accept challenge. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <3.0.1.32.19971016132333.00947830@dnai.com> At 04:08 PM 10/16/97 -0400, Declan McCullagh wrote: >Last week after a TV show I was >telling Donna Rice-Hughes about how crypto can protect against stalkers, >but I don't know if she understood my argument. Stick to words of one syllable. Hmmm... "If you make words hard to read, bad men will not find you." Try that. :) From trg at dev.null Thu Oct 16 14:31:00 1997 From: trg at dev.null (The Right Guy) Date: Fri, 17 Oct 1997 05:31:00 +0800 Subject: fallacy alert! In-Reply-To: <199710152321.AAA01692@server.test.net> Message-ID: <3446840B.6959@dev.null> Adam Back wrote: > Anonymous writes: > > I thought that was the whole point of the PGP design. It makes the > > presence of third parties clear and visible to all participants. This > > seems to be the fundamental principle. > I have noticed serveral PGPers use this fallacy also. ... > It matters not one whit what `statement of intent' you mark PGP CMR > extended public keys with. That statement is semantically meaningless > as a design principle because it is utterly unenforceable. Since I am always right, let me give you the benefit of my thoughts on a few things. (No need to bow at my feet, I'm always willing to help.) I have no doubt that the government's framing of the Escrow/Recovery debate has had an influence on those companies who wish to be compliant enough with emerging standards to remain in business. In a perfect world, those with 'good intentions' would have the time and resources to do things totally 'right,' both in a technological manner and in exercising the highest standards of principles and ethics. In reality, the industry is moving so fast that any company who dallys about, trying to make the perfect product, might well find that 'Pretty Freeh Privacy' has the encryption market locked up, and besides, they don't make Intel CPU's any more--that was _last_ week. PGP is being castigated for, by way of analogy, not producing a gun that can _only_ be used for self-defense, and _not_ for killing the (imaginary) innocent. Unfortunately, for PGP, this is not unreasonable, since PGP's reputation capital was built on a level of standards and integrity which go far beyond *only* business concerns. Phil Zimmermann, before he sold out his principles (just kidding!), wrote a documentation for PGP which did not contain a Madison Avenue pitch assuring the user that if they used PGP on their work machine, they could let rapists and murders use it, without fear of their encrypted home address being compromised. I truly believe that much of PGP's reputation is a result of people reading the documentation and having the program's author point out the _weaknesses_ and _vulnerabilties_ in his product, pointing out what it could and could _not_ do. I respected the points that Jon was making in his first long post defending PGP's new product, but I was also saying, "Bullshit!" as I read on. Why? Because while the benefit of the software lies in what it _does_ do, the danger lies in what it _doesn't_ do. How can Jon convince me that the PGP product is their best possible effort, to date, and that PGP will strive to improve the product's ability to resist misuse by fascists, while giving the individual user as much knowledge and control as possible in the product's use? He can do so by telling me that he wakes up at night, screaming, in fear of having helped to create the crytp equivalent of the atomic bomb, when the product is in the hands of the fascists. (Not that I expect him to be stupid enough to say this on the product packaging.) > There can be no enforcement of statement of intents. All you can do > is hope that companies are not lying; encourage them to behave in ways > which you consider ethical. Governments, corporations and crypto munitions don't kill people. People kill people. When death camps are computerized, the software used will be named, "I Am Just Following Orders." ("I don't put the in in the gas chambers, I just boot the computer.") I have to admit to being somewhat amused by Jon taking a Cypherpunk to task for being loud, rude, and ranting. Is this your first time on the list, Jon? The Right Guy ~~~~~~~~~~~~~ Tomorrow: The Solution to World Peace From eli at gs160.sp.cs.cmu.edu Thu Oct 16 15:37:51 1997 From: eli at gs160.sp.cs.cmu.edu (Eli Brandt) Date: Fri, 17 Oct 1997 06:37:51 +0800 Subject: FCPUNX:proposal: commercial data recovery In-Reply-To: <199710161410.KAA29078@beast.brainlink.com> Message-ID: <199710162154.OAA01432@toad.com> Will Price wrote: > In your model, the recipient automatically > decrypts and then re-encrypts to a data recovery key -- even though > end-user computers are likely to be insecure thus making this decrypt & > reencrypt step rather specious at best. The value of this security model escapes me -- if the receiver's machine is insecure, you lose, period. Please, let us assume that neither endpoint is controlled by an attacker. You are concerned that the recipient is re-encrypting with a key whose access characteristics are unknown to the sender. Now, for all the sender really knows, the recipient may be storing the message in the clear, or maybe putting it on a Times Square billboard. This is not a cryptographic failure. In your CMR system as well, the sender has no choice but to trust the recipient's integrity and data hygeine -- or to not send the message. The headers could contain a request as to the eventual disposition of the message, but there are never any guarantees. > As an actual data recovery system, it also fails fundamental tests. If I > encrypt critical data to a colleague wiping it from my system after > sending, then the colleague is incapacitated before receipt and processing > of the message, the data can never be retrieved. Forget bus-struck colleagues, think unreliable messaging -- if you do this and your e-mail is lost in transit, your "critical data" is lost. So don't do this. > A data recovery system > must solve this kind of issue -- data recovery here means that from > end-to-end the data is recoverable in case of emergency. One cannot ignore > message transit time in this -- it can take days for a message to travel > from AOL to the outside world. I'm not seeing how transit time figures in here. Are you proposing to bypass it by sending in an emergency team to acquire the in-transit message from the AOL machine room? If you find this practical, you can even retrieve an un-CMRed message by putting the recipient on this emergency team. But as I said, this situation should never be allowed to arise. Data recovery means you can get the data. It doesn't specify which copy you get decrypt. For reliable transmission over an unreliable medium, the sender must not destroy the original until receipt has been confirmed; for stored-data recovery, "receipt" involves appropriate re-encryption. (A reliable medium simply involves shoving all of this down into the messaging protocol.) So reliable transmission can support data recovery, from one end or the other, without message recovery. You might ask what happens if both endpoints are struck by meteorites. If the data is critically important, it will have been replicated off the sender's disk. The bottom line is that no such data can be trusted solely to an AOL mailserver (of all things). > If you don't need data recovery, don't use > it, but at least respect the people who do need it and need it to actually > work at all points. I'm no protocol designer, but I'd have more respect for this system if explanations for its necessity seemed to have been fully thought through. The issue of communications keys versus storage keys has been discussed before; I don't believe I'm raising any novel issues. Did PGP Inc. consider and reject stored-data recovery (if so, what were the good reasons?), or are we seeing a retroactive explanation here? -- Eli Brandt | eli+ at cs.cmu.edu | http://www.cs.cmu.edu/~eli/ (on FCPUNX, cc'ed replies appreciated) From declan at well.com Thu Oct 16 15:40:30 1997 From: declan at well.com (Declan McCullagh) Date: Fri, 17 Oct 1997 06:40:30 +0800 Subject: FC: FBI is allowed to keep file on civil rights leader (fwd) Message-ID: ---------- Forwarded message ---------- Date: Thu, 16 Oct 1997 18:01:46 -0400 From: Marc Rotenberg To: declan at well.com Subject: Re: FC: FBI is allowed to keep file on civil rights leader > > FBI allowed to keep file on New York man's lawful activities

> WASHINGTON (AP) - The Supreme Court today refused to order the FBI >to purge its file on lawful activities by the former head of a charitable >foundation. Classic error for a news report on the Supreme Court. The Supreme Court denied cert. Lance Lindblom v. FBI, 97-82, Oct. 14, 1997. It did not rule on the merits of the case. The Court did not order the FBI to purge the files. It did not tell the FBI to buy Mr. Lindblom a cup of coffee. It simply decided not to review the decision of the lower court. Welcome back. M. From japhy at enteract.com Thu Oct 16 16:45:09 1997 From: japhy at enteract.com (Japhy Ryder) Date: Fri, 17 Oct 1997 07:45:09 +0800 Subject: Internet Tools For Your Business (fwd) Message-ID: <199710162323.SAA00372@enteract.com> ----- Forwarded message from prectimes at mail2.c-flash.net ----- >From prectimes at mail2.c-flash.net Thu Oct 16 17:27:18 1997 From: prectimes at mail2.c-flash.net Message-Id: <199710162227.RAA18064 at enteract.com> Date: Thu, 16 Oct 1997 11:17:49 -0400 (EDT) Subject: Internet Tools For Your Business **************************************************************************** We sincerely apologize if this message has reached you in error. This is a one time mailing, you need not reply as you will not receive this message again. **************************************************************************** The Internet is the marketing opportunity of a lifetime, don't let it pass you by! I make thousands marketing my products with Bulk E-MAIL. Responsible E-MAILING WORKS, and regardless of any non-applicable ridiculous fax or phone law someone may quote you Bulk E-mail is a 100% legal and ethical way to make tons of money, I am living proof. If you are interested in making serious money and saving yourself all of the time and hasle of finding the right tools and Internet resources read on because what I have to offer you will save you hundreds of hours of research that you could be using to get down to business and make money with direct e-mail marketing. If you send me $15 bucks I will send you via e-mail a file containing the following information that will arm you with all the tools you will ever need to jump start a Internet marketing campaign. Just print and mail the order form at the bottom of this page with your payment and as soon as I receive it I will mail your file. Then you can be on your way to harvesting the gold mine I have found in direct E-mail marketing. I WILL PROVIDE YOU WITH! 1.) A list of top bulk e-mail servers and I.S.P.'s that you can mail from without losing your acounts. 2.) The U.R.L to two bulk mail marketing members- only forums and message boards, where you will find free e-mail marketing software, archives full of bulk mail marketing information, and have the opportunty to ask questions and get advise from from pros like myself who have battled and won the war with bulk mail marketing. 3.) A LIST OF 1500 U.R.L's where you can place FREE classified ads. 4.) The location of a site where you fill out one form with information about your Web Site and they will submit it to 200 search engines for FREE. 5.) A Internet address that will link you to almost 100 classified ad areas where you can submit your advertisements for FREE. 6.) A list of 25 newsgroups where advertiseing your products and services are acceptable. These are the newgroups I have been successful with for years. 7.) The U.R.L for eight sites who offer you free e-mail boxes where you can receive your mail or have it forwarded to any address you desire. 8.) A list of sites where you can obtain bulk e-mail software to fit any budget. Most of these sites even offer free demo versions for download, so you can try before you buy. 9.) A internet address location where they will not only set-up C.G.I. order scripts on your Web Site but maintain them for only ONE DOLLAR A MONTH. 10.) The U.R.L of a site where you can set up a completely annomous I.S.P account. 11.) A site address where you can obtain publicity for your products or services, and it's absolutely FREE. As if this wasn't enough If your order is postmarked before October 15, 1997 I will include the following FIVE Internet Marketing Information reports, that have made me thousands marketing on the Internet. These five reports usually sell seperately for $50, but they are all yours for the asking when you order this package. AND THAT'S NOT ALL, I am going to throw in 100,000 good net and com email addresses and the location of a site you can go to immediately and download a fully functional copy of bulk-mail software so you can get started NOW! Report #1) Direct Response Web Sites (How to Get Your Prospects To Buy Now) Report #2) Search Engine Rip Offs (How to Play Hardball And Get 600 Hits A Day In Less Than A Week) Report#3 "14 Reasons Why You Can 'Literally" Make A Million (right now) By Turning Other Peoples Fax Machines Into Your Own Personal Printers" Report #4) How to turn 1000's of prospects into buyers and die hard, loyal customers for life. Report #5) How To Increase your Profits 15 Times by knowing the secret of headlines and the role they play on the Internet. SPECIAL BONUS: all orders post marked by the October 30 will also receive a clean list of 100,000 e-mail addresses to kick start your new business. These are all good addresses that have been run through remove databases. Yes Send me a copy of your Bulk e-mail Information Kit. I understand that if I am not completely staisfied I will have the total purchase price of $15 refunded to me upon request within 30 days from purchase. Name_________________________________ Address_______________________________ City, State, Zip___________________________ Telephone# (______)____________________ E-mail Address__________________________ Check here if you would like to receive information about our other products ( ) Send your check or money order for $15 to: Precious Times Publications 18551 Chase Street Northridge, California 91324 If you have any questions, don't hesitate to contact us at Tel: (818)-885-1823 or Fax: (818)-885-8014 ----- End of forwarded message from prectimes at mail2.c-flash.net ----- From rah at shipwright.com Thu Oct 16 17:10:32 1997 From: rah at shipwright.com (Robert Hettinga) Date: Fri, 17 Oct 1997 08:10:32 +0800 Subject: pro-crypto govt. people In-Reply-To: Message-ID: At 4:23 pm -0400 on 10/16/97, Lizard wrote: > At 04:08 PM 10/16/97 -0400, Declan McCullagh wrote: > >Last week after a TV show I was > >telling Donna Rice-Hughes about how crypto can protect against stalkers, > >but I don't know if she understood my argument. > > Stick to words of one syllable. Hmmm... > "If you make words hard to read, bad men will not find you." It seems to help if she's sitting on your lap... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: From tcmay at got.net Thu Oct 16 18:38:09 1997 From: tcmay at got.net (Tim May) Date: Fri, 17 Oct 1997 09:38:09 +0800 Subject: Liberal lawyer joke from Cdn-Firearms Digest V2 #34 In-Reply-To: <199710161358.JAA06467@smtp2.sympatico.ca> Message-ID: At 2:26 PM -0700 10/16/97, jf_avon at citenet.net wrote: >On 16 Oct 97 at 9:58,somebody wrote: > >> Research labs are increasingly replacing rats with lawyers. >> >> There are three reasons for this: >> >> 1. The lawyers are in abundant supply >> 2. The lab workers do not develop any kind of emotional attachment to >>lawyers >> 3. There are things you just can't get a rat to do. Just a word: the "lawyer jokes" sent out recently are at least 10 years old. Calling them "liberal lawyer" jokes doesn't make them any fresher. I suggest original content, in the form of essays or analyses, is better than stale old lawyer jokes. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From ichudov at www.video-collage.com Thu Oct 16 22:55:55 1997 From: ichudov at www.video-collage.com (Igor Chudov @ home) Date: Fri, 17 Oct 1997 13:55:55 +0800 Subject: No Subject Message-ID: <199710170550.FAA00763@manifold.algebra.com> test From ravage at ssz.com Thu Oct 16 23:22:53 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 17 Oct 1997 14:22:53 +0800 Subject: index.html Message-ID: <199710170641.BAA12303@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Main banner rule SECRET SECURITY MESSAGES ON STAMPS CAN BE DECODED Postal Service Logo October 16, 1997 Web posted at: 3:39 p.m. EDT (1939 GMT) WASHINGTON (AP) -- The post office is preserving a bit of nostalgia from an era when children saved cereal box tops for the secret decoder rings. The new decoder isn't a ring, but it does the job by revealing secret messages hidden on some U.S. postage stamps. "It was done primarily as a anti-counterfeit measure, but we knew that collectors of all kinds would enjoy it as an interesting design element as well," said postal spokesman Barry Ziehl. You normally can't see the hidden image, but the post office is selling decoders to interested people. For $4.95 collectors can get a special lens that reveals the hidden message when placed over the stamp. The first hidden image was on a 32-cent U.S. Air Force stamp issued in September. With the decoder, viewers can see the letters USAF repeated over and over across the face of the stamp. The decoder has to be turned slightly from side to side to get the image to appear. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. rule Related sites: Note: Pages will open in a new browser window * US Postal Service External sites are not endorsed by CNN Interactive. Barnes and Noble Recommends Selected books on Postage Stamps Or find any book in print by keyword: ____________________ ______ _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Message Boards Sound off on our message boards You said it... [INLINE] rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From ravage at ssz.com Thu Oct 16 23:25:26 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 17 Oct 1997 14:25:26 +0800 Subject: http:--www.cnn.com-TECH-9710-16-internet.subpoena.ap- Message-ID: <199710170645.BAA12347@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Tech banner Tivoli systems and network management: The power to manage. Anything. Anywhere. Click here. rule SUBPOENA ISSUED FOR DATA BEHIND NEWSPAPER'S WEB SITE website October 16, 1997 Web posted at: 8:40 p.m. EDT (0040 GMT) VENTURA, California (AP) -- In what could be a legal first, the Ventura County Star has been subpoenaed by attorneys in a murder case for information about people who have used the newspaper's Internet site. The defense wants to determine whether the jury pool has been contaminated. The subpoena, which asks for unpublished e-mail and demographics of people who participated in an online survey about the case, explores new territory between legal protections for the media and a defendant's right to a fair trial, said Terry Francke, a media attorney with the California First Amendment Coalition. "This is very new, and I suspect the courts will be grappling with more and more of these types of requests from attorneys as the medium grows," Francke said Wednesday. The Internet site detailed the Diana Haun murder trial. Haun was convicted September 28 of conspiracy, kidnapping and murder in the slaying of Sherri Dally, her lover's wife -- an act prosecutors said was a human sacrifice birthday present. The penalty phase of Haun's trial is scheduled to begin Monday. The subpoena was served this week by James Farley, the attorney for Haun's lover and alleged co-conspirator Michael Dally. His trial is set to begin November 24. Jurors will be bused to Ventura from adjoining Santa Barbara County. The Internet site stretches beyond the newspaper's circulation area in Ventura County, possibly contaminating jury pools in Santa Barbara County, said Len Newcomb, an investigator for Farley. "The media decided to make this a high-profile case and decided they wanted to reach a vast number of people," Newcomb said. "And the worst-case scenario is that we won't be able to find jurors who don't already have strong biases." Newcomb has filed subpoenas on 56 news organizations from Los Angeles to San Luis Obispo, requesting unpublished reader, listener and viewer response to the Haun coverage. The latest subpoena unquestionably invades legally protected discourse between readers and their newspapers, said Timothy J. Gallagher, the Ventura newspaper's editor. "I don't have a problem providing information to defense attorneys that has already appeared in the newspaper, or in this case online, but beyond that there's a privileged relationship between newspapers and readers," Gallagher said. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. rule Related sites: Note: Pages will open in a new browser window * Ventura County Star + Subpoena covers new legal ground + Coverage of the Haun murder trial External sites are not endorsed by CNN Interactive. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Watch these shows on CNN for more sci-tech stories: CNN Computer Connection | Future Watch | Science & Technology Week rule Message Boards Sound off on our message boards You said it... [INLINE] Tivoli systems and network management: The power to manage. Anything. Anywhere. Click here. rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From japhy at enteract.com Fri Oct 17 00:41:45 1997 From: japhy at enteract.com (Japhy Ryder) Date: Fri, 17 Oct 1997 15:41:45 +0800 Subject: Internet Tools For Your Business (fwd) Message-ID: <199710170722.CAA26154@enteract.com> ----- Forwarded message from Graham-John Bullers ----- >From real at freenet.edmonton.ab.ca Thu Oct 16 21:11:54 1997 Date: Thu, 16 Oct 1997 20:11:33 -0600 (MDT) From: Graham-John Bullers To: Japhy Ryder Subject: Re: Internet Tools For Your Business (fwd) In-Reply-To: <199710162323.SAA00372 at enteract.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII On Thu, 16 Oct 1997, Japhy Ryder wrote: > ----- Forwarded message from prectimes at mail2.c-flash.net ----- > > >From prectimes at mail2.c-flash.net Thu Oct 16 17:27:18 1997 > From: prectimes at mail2.c-flash.net > Message-Id: <199710162227.RAA18064 at enteract.com> > Date: Thu, 16 Oct 1997 11:17:49 -0400 (EDT) > Subject: Internet Tools For Your Business > > **************************************************************************** > We sincerely apologize if this message has reached you > in error. This is a one time mailing, you need not reply as you will not receive this message again. > **************************************************************************** > The Internet is the marketing opportunity of a lifetime, > don't let it pass you by! > > I make thousands marketing my products with Bulk > E-MAIL. Responsible E-MAILING WORKS, and regardless > of any non-applicable ridiculous fax or phone law > someone may quote you Bulk E-mail is a 100% legal and > ethical way to make tons of money, I am living proof. > > If you are interested in making serious money and > saving yourself all of the time and hasle of finding > the right tools and Internet resources read on because > what I have to offer you will save you hundreds of > hours of research that you could be using to get > down to business and make money with direct > e-mail marketing. > > If you send me $15 bucks I will send you via e-mail > a file containing the following information that will > arm you with all the tools you will ever need to > jump start a Internet marketing campaign. > > Just print and mail the order form at the > bottom of this page with your payment and as > soon as I receive it I will mail your file. Then you > can be on your way to harvesting the gold mine > I have found in direct E-mail marketing. > > I WILL PROVIDE YOU WITH! > > 1.) A list of top bulk e-mail servers and I.S.P.'s > that you can mail from without losing your acounts. > > 2.) The U.R.L to two bulk mail marketing members- > only forums and message boards, where you will > find free e-mail marketing software, archives full of > bulk mail marketing information, and have the > opportunty to ask questions and get advise from > from pros like myself who have battled and won > the war with bulk mail marketing. > > 3.) A LIST OF 1500 U.R.L's where you can place FREE > classified ads. > > 4.) The location of a site where you fill out one form > with information about your Web Site and they will > submit it to 200 search engines for FREE. > > 5.) A Internet address that will link you to almost > 100 classified ad areas where you can submit your > advertisements for FREE. > > 6.) A list of 25 newsgroups where advertiseing your > products and services are acceptable. These are > the newgroups I have been successful with for years. > > 7.) The U.R.L for eight sites who offer you > free e-mail boxes where you can receive your mail or > have it forwarded to any address you desire. > > 8.) A list of sites where you can obtain bulk e-mail > software to fit any budget. Most of these sites even > offer free demo versions for download, so you can > try before you buy. > > 9.) A internet address location where they will not > only set-up C.G.I. order scripts on your Web Site > but maintain them for only ONE DOLLAR A MONTH. > > 10.) The U.R.L of a site where you can set up a > completely annomous I.S.P account. > > 11.) A site address where you can obtain publicity > for your products or services, and it's absolutely > FREE. > > As if this wasn't enough If your order is postmarked > before October 15, 1997 I will include the following > FIVE Internet Marketing Information reports, that have > made me thousands marketing on the Internet. These > five reports usually sell seperately for $50, but they > are all yours for the asking when you order this package. > > AND THAT'S NOT ALL, I am going to throw in 100,000 > good net and com email addresses and the location of > a site you can go to immediately and download a fully > functional copy of bulk-mail software so you can get > started NOW! > > Report #1) Direct Response Web Sites (How to Get > Your Prospects To Buy Now) > > Report #2) Search Engine Rip Offs (How to Play > Hardball And Get 600 Hits A Day In Less Than A Week) > > Report#3 "14 Reasons Why You Can 'Literally" > Make A Million (right now) By Turning Other Peoples > Fax Machines Into Your Own Personal Printers" > > Report #4) How to turn 1000's of prospects into > buyers and die hard, loyal customers for life. > > Report #5) How To Increase your Profits 15 Times > by knowing the secret of headlines and the role they > play on the Internet. > > SPECIAL BONUS: all orders post marked by the > October 30 will also receive a clean list > of 100,000 e-mail addresses to kick start your > new business. These are all good addresses that > have been run through remove databases. > > Yes Send me a copy of your Bulk e-mail Information > Kit. I understand that if I am not completely staisfied > I will have the total purchase price of $15 refunded > to me upon request within 30 days from purchase. > > Name_________________________________ > > Address_______________________________ > > City, State, Zip___________________________ > > Telephone# (______)____________________ > > E-mail Address__________________________ > > Check here if you would like to receive information > about our other products ( ) > > Send your check or money order for $15 to: > > Precious Times Publications > 18551 Chase Street > Northridge, California 91324 > > If you have any questions, don't hesitate > to contact us at Tel: (818)-885-1823 or > Fax: (818)-885-8014 > > > > > > > > ----- End of forwarded message from prectimes at mail2.c-flash.net ----- > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Graham-John Bullers Moderator of alt.2600.moderated ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ email : : ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.freenet.edmonton.ab.ca/~real/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ----- End of forwarded message from Graham-John Bullers ----- From japhy at enteract.com Fri Oct 17 00:41:45 1997 From: japhy at enteract.com (Japhy Ryder) Date: Fri, 17 Oct 1997 15:41:45 +0800 Subject: No Subject Message-ID: <199710170723.CAA26209@enteract.com> From stewarts at ix.netcom.com Fri Oct 17 00:58:08 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Fri, 17 Oct 1997 15:58:08 +0800 Subject: what can we do about PGP sell out and CMR? In-Reply-To: Message-ID: <3.0.3.32.19971016084223.006c0bf0@popd.ix.netcom.com> At 11:29 PM 10/15/1997 +0100, Adam Back wrote: >From Bill Stewart's report, given the apparent amount of effort PGP >have put into their CMR based enforcement policy functionality, I >predict they won't remove CMR whatever we, or Schneier, or anyone else >says or proves about more secure less GAK-friendly ways of They've got customers who wanted it; there's some room for making it less controllable within their current framework (e.g. making the behaviour for (as-yet unused) multiple CMRKs to be session-key-splitting rather than one-copy-per-CMRK, which is be the more obvious implementation and is far more GAK-friendly.) Also, the SMTP filter stuff won't go away - even if PGP Inc dropped the product and dropped the CMRK from PGP 5.5.1 and all future versions, once there's an API for PGP, it's a piece of cake to write one; you just don't get the visibility that some keys are CMRKers, and you've got the inconvenience of sending more bouncegrams to senders telling them "to send a copy of PGP-encrypted mail to Bob, you need to also encrypt it to Eve The PostMistress" or, less honestly, "... to the Exchange Gateway". And at least the PGP SMTP filter only checks for the KeyID and doesn't actually try to deccrypt the message. >I also suspect they won't >listen to Tim's earlier argument that they do nothing about recovery I thought Tim's point was directed to OpenPGP; Jon Callas and others said things like ~~If you've got features you want done, propose it to OpenPGP and get them to adopt it, and that'll give us a business reason that we ought to adopt it.~~ (I think the context of that was discussing Stealth, which they still don't have enough business demand for to take time on, and which by the way puts a major crimp in SMTP filters.) >This quote should give us clue as to why they will continue with CMR: > "we're a real company with accountants" That wasn't an exact quote, just a paraphrase from my memory of several conversations. >Similar arguments would presumably present them with "no choice" but >to fulfill the order for 100,000 GAK compliant units from the >government terrorizing the freedom fighters PRZ likes to tell us >about who are already using PGP GAK compliant software: pgp5.0. Even if they did that, it wouldn't change the power relationships; if the government can compel GAK keys by filtering SMTP or confiscating non-eavesdropping-compatible mail gateways, it doesn't matter if the Cc: Big Brother was added as a PGP5.5 CMRK or as a PGP2.6.2i multiple recipient - you can't tell from the message format (except for DH vs. RSA). >What can we do about this situation? Well we could build systems >which hack around the CMR system. Easy enough: just put dud >"recovery" info inside. We still have deployment problems. Unless I misunderstood the formats, CMRKs are just identified by KeyID, not by fingerprint, and it's easy to look through the public keyservers to find CMRKs (though companies may prefer to have their employees mail out keys to people who need them rather than making all their keys constantly visible on the outside servers.) So go find them all, send protest email to the postmasters and corporate officials at the companies that use CMRKs, crank up your deadbeef generator to make your own keys with the same KeyIDs as the CMRKs, and pre-load the public keyservers. A nice touch would be to burn your copies of the private keys for the CMRK imitators, but we'll never know if you did, will we? Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From bd1011 at hotmail.com Fri Oct 17 01:31:15 1997 From: bd1011 at hotmail.com (Nobuki Nakatuji) Date: Fri, 17 Oct 1997 16:31:15 +0800 Subject: OUBAKAYAROU!! Message-ID: <19971017080829.27590.qmail@hotmail.com> >Tim May (tcmay at got.net) >Wed, 15 Oct 1997 22:11:09 -0700 > >At 9:18 PM -0700 10/15/97, Nobuki Nakatuji wrote: >Where are another cypherpunk mailinglist ? > > >Am another cypherpunks mailinglist at cyperpunk at dev.null. >You go there, chop chop. >You not talk about Misty here anymore, OK? We am tired hering about >Misty and your fees. > >--Tim-san > > > Shine Shine!! Bakayarou!! Aho!! Manuke!! Anpontan!! ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com From stewarts at ix.netcom.com Fri Oct 17 02:11:04 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Fri, 17 Oct 1997 17:11:04 +0800 Subject: anti-GAK design principles: worked example #1 In-Reply-To: Message-ID: <3.0.3.32.19971017015110.006afc90@popd.ix.netcom.com> At 11:45 PM 10/15/1997 +0100, Adam Back wrote: >We'll instead take it as a given that >pgp5.5 and pgp5.0 are GAK compliant because of CMR and >that this is a bad thing. I'll duck the 5.5 argument for now, but you're incorrect on 5.0. The PGP 5.0 key format includes separate keys for signature and privacy, which is a mostly good thing, and includes the ability to associate a group of keyIDs and flag bits with each privacy key. (or each set of privacy key + signature key?? Jon?) What semantics are attached to this association are dependent on the computer program, and PGP 5.0 does nothing CMRish with them, much less GAKish. OpenPGP could do anything it wants with the field, such as use it for keyids (or IPv4 addresses, since it's 32 bits) of keyservers with copies of the keys, or whatever. PGP 5.6 could at least take the case of multiple keyids and secret-share the session key between them rather than allowing any single key to access it. >The rest of Will's post seems to miss the point, so it seems to me >that the best way to transfer understanding of how to use the anti-GAK >design principles to design less GAK friendly systems is to present a >worked example. Good - we'll attempt to nitpick it at least as thoroughly as we're nitpicking PGP 5.5 :-) >- store a copy of the private half of the users PGP encryption key > encrypted to the company data recovery key on the users disk. No. This is evil. Don't go there. Even with secret sharing, and especially without. >- (optional) design the software to make it hard to copy the data > recovery packet from the disk, hide the data, bury it in keyrings, > stego encode it, whatever, use your imagination. This is secutity by obscurity; not highly useful. >Possible objections: >objection #1. what if disk burns? >counter #1: backup your disk >objection #2: users don't back up disks Objection 3 - users _do_ back up disks - that means every backup tape or disk or server volume potentially contains your disk's encryption keys CAKked up with the Corporate Master Key, which is Bad, and wildly out of the user's control, violating one of your principles. Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From stewarts at ix.netcom.com Fri Oct 17 02:30:04 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Fri, 17 Oct 1997 17:30:04 +0800 Subject: consensus on pgp? can we consolidate for action? In-Reply-To: <19971016.032545.attila@hun.org> Message-ID: <3.0.3.32.19971017011816.00704ffc@popd.ix.netcom.com> At 08:40 AM 10/16/1997 +0000, Attila T. Hun wrote: > I have not seen any further discussion on my suggestion to > create a sendmail type daemon which implements DH between > mail clients. this, of course, is on the presumption that DH > is a wrapper for an already encrypted packet, DH between mail clients and servers is a really fine idea if you're starting from scratch, but sendmail is such a wretched hive of crime, corruption, and villainy that nobody in their right mind really wants to mess with it. You could implement it as a sendmail extension using the EHLO stuff, but you'd have to go get people to adopt it widely once you'd done it; I suppose if you could talk Netscape and Eudora into adding DH exchange to their client code and get it into a few popular servers, you'd have a large fraction of the Internet's email encrypted, which would be a Good Thing. It'd still have some major traffic analysis issues, and if you want to deal with the Man In The Middle problem, you need a key distribution infrastructure, which is much harder. An alternative approach is to encrypt everything using IPSEC, and you don't have to mess with Sendmail, but there are performance issues, and there's a lot of work getting it deployed also. Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From web-promotions at nevwest.com Fri Oct 17 17:35:41 1997 From: web-promotions at nevwest.com (web-promotions at nevwest.com) Date: Fri, 17 Oct 1997 17:35:41 -0700 (PDT) Subject: Make 6 cents per click!! Message-ID: <199710171700.KAA17835@tropicana.nevwest.com> /////////////////////////////////////////////////////////////////////////////// This message is intended for ADULT WEBMASTERS ONLY. If you would like to be removed from future mailings simply click REPLY and type the word REMOVE in the subject line. //////////////////////////////////////////////////////////////////////////////// Pure Hardcore is now paying 6 cents per unique click!! - Get paid weekly!! - Make up to 6 cents per unique click. - Sign-up automatically, start sending hits immediately. - Track raw and unique hits in real time. - Shows current pay rate in real time. - Shows total $$ made in real time. - High quality uncensored banners. - Track an unlimited number of banners. Go to this URL for all the details and to sign-up: http://www.purehardcore.com/webmasters We are now selling our click-thru system!! If you are a pay-site webmaster and you would like to have your very own click-thru program with very little money up front, visit our page for details. Sign-up tracking available!! --------------------------------------------- Other Great Services We Offer: - Free Phone Sex Numbers - Live Sex Commission Programs - Streaming Live Video for Pay Sites - Extremely High Quality Images for Pay Sites http://www.purehardcore.com/webmasters From proff at iq.org Fri Oct 17 05:56:52 1997 From: proff at iq.org (Julian Assange) Date: Fri, 17 Oct 1997 20:56:52 +0800 Subject: Marutukku - cryptographic filing system Message-ID: <19971017123313.25514.qmail@iq.org> Marutukku (my cryptographic file system/block device) is due for first beta sometime next week. Before release, I'd like some (strong!) criticism of the sub key generation / chaining techniques I'm using. But first, for those who haven't a frigging clue what Marutukku is, here is a hastily drawn non-cryptographic (more about that later) features list: o OS independent (excepting two files pertaining only to the kernel drivers) o Currently implemented as a 4.4bsd (Free/Net/OpenBSD) loadable kernel module, and client (I have someone working on the Linux port, but no promises). o The BSD implementation turns a file (even an NFS mounted file) into a device, on which any number of file systems types can be created in the regular manner (or even a swap partition ;) o Endian independent - Marutukku extents (the ciphertext regions) can be mailed around like .tar files o various backup/recovery/whole extent encryption/decrypt functions built into the client Marutukku supports a variety of ciphers, and the cipher used for the lattice (which is used to generate sub-keys for each file-system block) generation is independent from the cipher used for block functions. At the moment it only makes sense to talk of the lattice generator in terms of a stream cipher or a block cipher/hash algorithm in OFB. My design principles along the way have attempted as far as possible to cover as yet unknown vulnerabilities in the under-laying ciphers used with good management of IV's, salts, sub-keys, chaining etc. Some of these steps may pose no additional security in relation to certain attacks (i.e secret vs public IV's) on particular ciphers but most come at little cost compared to the encryption itself. Primary key/salt generation walk though: A pass-phrase of size (l) is requested from the user. max_keysize (256) public random key saltation bytes are generated and [saved]. (l) of these bytes then salt the key (XOR) (we don't use more than (l) to avoid any potential issues with key-correlation attacks as the salt is public). max_keysize cryptographically random bytes are produced to form the "master key". The salted pass-phrase is used to encrypt the master key, which is [saved]. The (unencrypted) master key is used to key a stream cipher (in this case that's rc4 or rc16) which is used for further key generation. Bytes [0] and [1] of the key stream output are saved for later use in creating a pass-phrase checksum (more about that later). Bytes [2] and [3] of the key stream are saved for later use in encrypting the number of stream-cipher key-generator iterations. The stream cipher is then set to stir its internal state for (t) seconds (a user supplied value). The number of iterations (i) is counted, the two LSBytes's from which are encrypted with [2] and [3] and [saved]. The reason we don't encrypt the MSB's is that they are are likely to be known-plain-text (all 0 bits to the left) which can be used for key-scanning checks. This has the annoying effect of reducing the uncertainty in the iteration count to 2^16, but I can't fathom a way around it without exposing bits of the stream output. Stream bytes [3+i] and [3+i+1] are XOR-ed with bytes [0] and [1] to provide a 16 bit key checksum and [saved]. The distance here serves to obfuscate any predictability in the key-stream generator and force the attacker though all (i) iterations to test each key (or if they are attacking directly on the internal state of the stream cipher at (i) to generate guesses at [0] as well). A public random key-salt for the two primary lattice keys are generated and [saved]. n * 2 (n=32 for a 4G file-system-block maru extent) public random sub-key lattice IV's are generated and [saved]. The public master block IV array salt is randomly generated and [saved]. Instance/Lattice generation: The saved maru saltation/IV header (above) is loaded, and the the pass-phrase is salted as before. The master key is decrypted and the key stream cipher is initialised, half the checksum is generated, the number of iterations decrypted, the generator stired, the other half of the checksum is generated and the checksum verified. The two primary lattice salts are encrypted with the key stream stream and form the primary lattice keys for the lattice fs-block sub-key generating block cipher. The n*2 lattice sub-key IV's are encrypted with the stream and form the lattice sub key array. The master block IV salt array is encrypted with the stream and forms the master block IV array. This ends the primary initialisation stage. Block key generation: The problem here is to turn a block number into a unique "sub-key" for each fs-block in such a way that frustrates possible key (or other) correlation attacks. i.e discovering the key for one block should not help the cryptanalyst in discovering the key for any other block. It is simple to generate a sub-key key-stream with a stream cipher or a block cipher operating in OFB, but storing such a construct is untenable and it is not efficient to generate on the fly (for instance, the first fs-block accessed might be the last in the maru extent, which would correlate to the last sub-key generated by the key-stream). The solution designed and employed is a binary tree based key generation approach, that can generate a cryptographically-unique block key in log2(max_blocks) steps. The author has thought of various variations on this scheme (e.g with two different cryptographic hashes, one moving left, one moving right), but see below for the variant used in Marutukku. It is simpler to visualise the sub-key generator tree "turned inside out" as a 2d lattice, two columns across and n rows down (this is also how it is implemented in Marutukku). i.e ______________________ |LEFT | RIGHT| |----------+----------| |L-SUBKEY 0|L-SUBKEY 1| |----------+----------| |L-SUBKEY 1|L-SUBKEY 2| |----------+----------| | .... | .... | |----------+----------| |L-SUBKEY n|L-SUBKEY n| |__________|__________| The journey from fs-block number to fs-block-key starts with the msb of the block number and the top of the lattice (we use the msb rather than the lsb for caching reasons. Using the lsb naively seems more secure but uncacheable, yet on closer examination, neither of theses claims are true (however the Marutukku lattice sub-key cache *performance* using lsb is poor due to the inverted clustering)). As each bit slides off the left of the block number, key material is picked up from the left or right of the lattice according to whether the bit is on or off. Each lattice sub-key chosen is encrypted with the next (CBC wise, but lattice sub-key size, rather than cipher block size) at the top of the lattice and twines it's way down to the end, collecting key-material as it goes. The result is a unique compressed (i.e its the CBC chaining performing the compression) "necklace" of key material which forms the appropriate fs-block key. FS block encryption: Each plain text block in the fs-block is XOR-ed with the corresponding entry in the master block IV array and then CBC encrypted. In effect, each cipher block has two IV's. The first block, which lacks any cipher text from previous blocks to chain with, uses the block number XOR-ed with its master block IV entry. The rational behind this is that we have the benefits of CBC's error-recovering abilities without it's major drawback (and it is certainly not alone here among major block cipher modes) - that is, find the key for (cipher) block 0 and the attacker can successfully decrypt every other block that (CBC wise) follows it. Comments? -- Prof. Julian Assange |If you want to build a ship, don't drum up people |together to collect wood and don't assign them tasks proff at iq.org |and work, but rather teach them to long for the endless proff at gnu.ai.mit.edu |immensity of the sea. -- Antoine de Saint Exupery From biqa at uspacmall.com Fri Oct 17 21:24:14 1997 From: biqa at uspacmall.com (USPACMALL) Date: Fri, 17 Oct 1997 21:24:14 -0700 (PDT) Subject: STOP Bad Breath Causing BACTERIA!!! Message-ID: <199710172348PAA49601@joe@young.com.planet.ch> ====================================================== We honor all remove requests; reply with REMOVE in the subject. ====================================================== EXPERIENCE!!! AN INCREDIBLY FRESH, CLEAN, SWEET AND ODOR FREE BREATH!!! ================================== KISS YOUR BAD BREATH GOODBYE NOW AND FOREVER!!! ================================== Also ELIMINATE the bitter taste and foul odor of MORNING BREATH!!! IMAGINE YOUR BREATH.....so CLEAN, FRESH, KISSING SWEET and ODOR FREE that you are EAGER to approach people anytime, anywhere with the FULLEST CONFIDENCE! AT LAST!!! An immediate, effective, tangible, economical and permanent SOLUTION for the CLEANEST, FRESHEST, SWEETEST AND ODOR-FREE BREATH you've ever experienced... ========================================== WHEN SWEET BREATH MEANS EVERYTHING!!! ========================================== For more about the causes and instant cures of bad breath, latest medical research, and the NEW and INCREDIBLY EFFECTIVE Oral Hygiene product, BAD BREATH TERMINATOR, visit our FULL-COLOR ANIMATED WEB SITE now at: http://www.uspacmall.com/breath ================================= If this site is busy, email us at uspac at uspacmall.com for the location of our other web site. OR SCROLL DOWN FOR MORE INFO... ======================= HOW IS YOUR BREATH? ======================= --> Do you shy away from meeting people because of your breath? --> Do you experience isolation and a diminished quality of life? --> Does bad breath still persist even after you've tried every known breath spray, breath mint, mouthwash or internal capsule on the market? Bad breath is no joke to those who have it. In fact, it can be a source of EMBARRASSMENT and SHAME. ================= THE GOOD NEWS ================= Doctors and Dentists used to believe the source of bad breath was the digestive system. Research has shown this is SIMPLY NOT TRUE! Actually, the good news about bad breath is that -- in 9 out of 10 cases -- it originates in the mouth, and this type of bad breath is CURABLE! AT LAST!!! One of life's more embarrassing problems has THE PERFECT SOLUTION!!! ========================================== INTRODUCING THE BAD BREATH TERMINATOR: THE PERFECT SOLUTION!!! ========================================== IMMEDIATE...cleans bad breath away completely STARTING FROM YOUR VERY FIRST USE! EFFECTIVE....completely different from any spray, mouthwash or capsule because it doesn't cover your breath, IT EFFECTIVELY ELIMINATES THE VERY SOURCE OF YOUR BAD BREATH!!! * It effectively SCRAPES AWAY and terminates the offensive FOUL ODOR generating EVIL BACTERIA, the coating of WHITE PLAQUE and DECAYING FOOD PARTICLES from the ridges and valleys on the back of the tongue. * YOU MAY NEVER HAVE BAD BREATH AGAIN!!! ECONOMICAL...use it over and over. Lasts for months. NOTHING MORE TO BUY! It COSTS you ONLY $9.98 per set of 2! PERMANENT...use daily as part of your regular oral care for CONTINUOUS FRESH, CLEAN BREATH ALL DAY! This NEW and INCREDIBLY EFFECTIVE Oral Hygiene Product, BAD BREATH TERMINATOR provides an Immediate, Effective, Tangible, Economical and Permanent SOLUTION for the CLEANEST, FRESHEST, SWEETEST breath you've ever experienced!!! ========================================================== For more about the causes and instant cures of bad breath, latest medical research, and the Incredible BAD BREATH TERMINATOR, visit our FULL-COLOR ANIMATED WEB SITE NOW at: http://www.uspacmall.com/breath ================================= If this site is busy, email us at uspac at uspacmall.com for the location of our other web site. Thank you for your time. Susan # From nobody at REPLAY.COM Fri Oct 17 08:13:11 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 17 Oct 1997 23:13:11 +0800 Subject: Non-conventional Message-ID: <199710171449.QAA09086@basement.replay.com> Tim May implied that Cpunx should develop non-conventional email. Crypto has been declared to be munitions. Nukes are non-conventional weapons. Should we be developing nuclear email? Should we 'email-nuke DC?" Prespiring minds want to know... From jrb at autoweb.net Fri Oct 17 08:22:07 1997 From: jrb at autoweb.net (Jerry R. Brady) Date: Fri, 17 Oct 1997 23:22:07 +0800 Subject: Import restrictions for crypto code Message-ID: <34477DE4.1F46@autoweb.net> First, I was at hip, met some of you, camped behind the cypherpunks tent and had a blast. I'm not on the list anymore (couldn't keep up) but have a quick question which I know someone can post a quick answer back to me directly. I'd appreciate it. We have an RC540/RSA512/MD5 crypto package our customers use for the secure exchange of CAD data files with some of the automotive industry OEMs - It is a very lucrative store-and-forward system. We have a customer in Italy and I need to know if there are any import restrictions for sending the software there. We already have a GSN exemption because the international code is whimpy. Perhaps there is also an on-line resource that covers what countries have import restrictions? Any help would be appreciated, please mail directly to me. Regards, Jerry ps. Lucky - what became of the "Brain"? -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Jerry R. Brady jrb at autoweb.net Technical Director (v) 248.967.3738 AutoWeb Communications, Inc. (f) 248.967.3739 -=- PGP5 key at pgpkeys.mit.edu or via e-mail -=- From attila at hun.org Fri Oct 17 08:51:34 1997 From: attila at hun.org (Attila T. Hun) Date: Fri, 17 Oct 1997 23:51:34 +0800 Subject: FCPUNX:PGP Key Escrow and Congress In-Reply-To: <3.0.3.32.19971015195247.006f448c@popd.ix.netcom.com> Message-ID: <19971017.153129.attila@hun.org> on or about 971015:1952 Bill Stewart was purported to have expostulated to perpetuate an opinion: #Multiple small points of failure mean that it's less likely #that the official who wants to rip off information has access #to the set of information he wants to rip off. You could argue #that there would be more officials with access, but probably not, since a big #pile of information is something that attracts officials far faster than #little boring piles. TRUER WORDS WERE NEVER SPOKEN! attila "attila" sig: 1024/C20B6905/23D0 FA7F 6A8F 6066 BCAF AE56 98C0 D7B0 From Selective.Marketing at eiu.edu Sat Oct 18 00:22:44 1997 From: Selective.Marketing at eiu.edu (Selective.Marketing at eiu.edu) Date: Sat, 18 Oct 1997 00:22:44 -0700 (PDT) Subject: Here It Is !! Message-ID: < > Selective Marketing has your answer for doing business on the Internet. You can improve your Internet business by as much as 150% in the next 48 hours. What you are about to read has never been done on the Internet before. We are actually giving away over $750.00 in Internet promotional software. Please read for details. For a limited time you can purchase over 37 million e-mail addresses on CD Rom for only $349.00. When you purchase this software you will receive over$750.00 in Internet Promotional Software. That's right, when you purchase our CD Rom with over 37 million e-mail addresses on it you will receive a mass mailing program for sending your e-mail messages and an e-mail extraction program that will extract targeted e-mail addresses while you sleep. The mailing program can send from 100,000 to 500,000 e-mails per hour. We can also submit your Web Site to over 250 of the top search engines for the unbelievable price of only $69.00. You pick the keywords and we do the rest. Instant submission. You will receive confirmation from the search engines webmaster confirming that your site was registered. If you would like we will even do the direct e-mail marketing for your Web Site, Multi-level program, product, or service for you. Please call for rates. If you would like more information concerning any of our services or products please call us at (904) 908-5444. From tcmay at got.net Fri Oct 17 09:37:47 1997 From: tcmay at got.net (Tim May) Date: Sat, 18 Oct 1997 00:37:47 +0800 Subject: what can we do about PGP sell out and CMR? In-Reply-To: <199710152229.XAA01119@server.test.net> Message-ID: At 8:42 AM -0700 10/16/97, Bill Stewart wrote: >At 11:29 PM 10/15/1997 +0100, Adam Back wrote: >>I also suspect they won't >>listen to Tim's earlier argument that they do nothing about recovery > >I thought Tim's point was directed to OpenPGP; Jon Callas and others >said things like ~~If you've got features you want done, >propose it to OpenPGP and get them to adopt it, and that'll >give us a business reason that we ought to adopt it.~~ >(I think the context of that was discussing Stealth, which they >still don't have enough business demand for to take time on, >and which by the way puts a major crimp in SMTP filters.) Yes, the thrust of my comments was about OpenPGP. The OpenPGPers were fretting about how to incorporate GAK and CAK and GMR and CMR into their "open," and (presumably) international, standard, and I said: Keep it Simple, Stupid. With luck, OpenPGP will displace PGP for Corporate Controllers and PGP, Inc. will have to back pedal to remain compliant. (Meaning no ill will toward PGP, Inc., but if they see their economic future lies in compromising key security by building in CAK and CMR....get my drift?) --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From alexlh at xs4all.nl Fri Oct 17 10:28:29 1997 From: alexlh at xs4all.nl (alexlh at xs4all.nl) Date: Sat, 18 Oct 1997 01:28:29 +0800 Subject: (fwd) Import restrictions for crypto code In-Reply-To: <199710171735.SAA01572@sarah.yc> Message-ID: On Fri, 17 Oct 1997, Alex Le Heux wrote: [snip] > ps. Lucky - what became of the "Brain"? Brian didn't come back to the US with Lucky as he wanted to develop strong crypto applications and did not want to have to contend with export restrictions. He currently has a desk in the offices of a major Dutch ISP, XS4ALL, so he is nice and close to the backbone and thus has great connectivity. Cheerio, Alex --- I dabble in techno-house and sometimes, I do that badass hip-hop thang... But the F U N K gets me every time! From aba at dcs.ex.ac.uk Fri Oct 17 10:46:57 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sat, 18 Oct 1997 01:46:57 +0800 Subject: anti-GAK design principles: worked example #1 In-Reply-To: <3.0.3.32.19971017015110.006afc90@popd.ix.netcom.com> Message-ID: <199710171727.SAA00990@server.test.net> Bill Stewart writes: > I'll duck the 5.5 argument for now, but you're > incorrect on 5.0. The PGP 5.0 key format includes > separate keys for signature and privacy, which is a mostly good thing, A very good thing. > and includes the ability to associate a group of > keyIDs and flag bits with each privacy key. So can you use pgp5.0 to construct a CMR key which would interoperate with pgp5.5 for business? > (or each set of privacy key + signature key?? Jon?) > What semantics are attached to this association are dependent > on the computer program, and PGP 5.0 does nothing CMRish with them, > much less GAKish. Clearly pgp5.0 does nothing with these flags on reciept, but does it understand them when sending? Scenario: I work for Mega Corp, and it is using pgp5.5, and is using CMR with companies key. Does pgp5.0 reply encrypting to just me as individual, or two crypto recipients me, and Mega Corp recovery key? I would be interested on clarification of this point. > OpenPGP could do anything it wants with the field, > such as use it for keyids (or IPv4 addresses, since it's 32 bits) > of keyservers with copies of the keys, or whatever. > PGP 5.6 could at least take the case of multiple keyids > and secret-share the session key between them rather than > allowing any single key to access it. Yes, I'm not so much arguing about the flexibility or the mechanism, as what it is being used for. I consider there are more secure and more GAK resistant ways to acheive same functionality. > >- store a copy of the private half of the users PGP encryption key > > encrypted to the company data recovery key on the users disk. > No. This is evil. Don't go there. Even with secret sharing, > and especially without. It is evil. But it is not _as_ evil. The reason for this is that government access to storage keys is not as evil as government access to communications keys, because the government has to come and capture the ciphertext (take your disk), whereas with communications they can grab them via an arrangement with your ISP. > >- (optional) design the software to make it hard to copy the data > > recovery packet from the disk, hide the data, bury it in keyrings, > > stego encode it, whatever, use your imagination. > This is secutity by obscurity; not highly useful. Indeed. It is of only marginal use. > >Possible objections: > >objection #1. what if disk burns? > >counter #1: backup your disk > >objection #2: users don't back up disks > > Objection 3 - users _do_ back up disks - > that means every backup tape or disk or server volume > potentially contains your disk's encryption keys > CAKked up with the Corporate Master Key, which is Bad, > and wildly out of the user's control, violating > one of your principles. See point above. This is not avoidable for storage ... if you are encrypting data on disk, and if you want recovery information, you have no choice but to allow company access. The recovery information should be as decentralised as much as possible. (Perhaps this should be the Stewart corollary). The point though is that storage recovery is a completely separable issue from communications "recovery" which is a euphamism for allowing companies to read, or snoop, employees email, unless it is being used soley for data recovery of mail stored in mail folders (which seems to be what PGP Inc means by CMR term), in which case it is not necessary functionality, and can be better acheived by encrypting the mail archive with a user symmetric key with company storage recovery on that key. I would be interested to hear novel ways to minimise the likelihood that the government could walk into your offices, grab the CD duke box, grab the single corporate recovery key and walk off. Decentralisation is one good way -- recovery keys are in hands of department and group heads -- secret splitting is another good way -- and (your suggestion) omitting some of recovery bits is a small addtional hinderance to intruders after plaintext. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710171706.SAA00972@server.test.net> Bill Stewart writes: > At 11:29 PM 10/15/1997 +0100, Adam Back wrote: > >From Bill Stewart's report, given the apparent amount of effort PGP > >have put into their CMR based enforcement policy functionality, I > >predict they won't remove CMR whatever we, or Schneier, or anyone else > >says or proves about more secure less GAK-friendly ways of > > They've got customers who wanted it; Whoa there Bill. They have customers who wanted data recovery. Data recovery does not require CMR. Did they admit to customers who wanted human based email screening? No on list discussions have suggested this is the case. I think I saw one PGP employee state that it was not the case. (I have perfectly good, more secure CDR based human screening designs, not that I encourage this you understand). > there's some room for making it less controllable within their > current framework (e.g. making the behaviour for (as-yet unused) > multiple CMRKs to be session-key-splitting rather than > one-copy-per-CMRK, which is be the more obvious implementation and > is far more GAK-friendly.) Small difference I think. > Also, the SMTP filter stuff won't go away - even if PGP Inc > dropped the product and dropped the CMRK from PGP 5.5.1 and > all future versions, once there's an API for PGP, > it's a piece of cake to write one; Nothing against SMTP filters, just against the CMR enforcement they put into theirs. > you just don't get the visibility that some keys are CMRKers, > and you've got the inconvenience of sending more bouncegrams to > senders telling them "to send a copy of PGP-encrypted mail to Bob, > you need to also encrypt it to Eve The PostMistress" or, > less honestly, "... to the Exchange Gateway". > And at least the PGP SMTP filter only checks for the KeyID and > doesn't actually try to deccrypt the message. You're using "you can hack around it" and "it is visible" arguments, these are valid arguments which mitigate the danger, but don't actually alter Tim and my points that storage recovery is less of a problem than message recovery. > >I also suspect they won't > >listen to Tim's earlier argument that they do nothing about recovery > > I thought Tim's point was directed to OpenPGP; He made the same point in both respects. I agree with his point about openPGP. I fully agree with Tim's points and Bill Frantz's example that old email messages come back to haunt people and are a nightmare waiting for a discovery process in a messy lawsuit for companies. I nearly got sucked into such a thing myself last year (some one gave back a laptop to a company they just quit on bad terms from, tried to wipe it but left some messages on it; the messages looked _bad_, the idiot who did that sent the _bad_ message to me, my response was to phone him up and say `what _are_ you talking about, I can't do that'.). This to me argues that PGP Inc should make email archives user controllable. So that users decide which emails to archive and which to just let naturally disappear, in the same way that phone calls, or chats in a restaurant aren't transcibed and digitally signed. Much harder to prove. I would also argue for "official statement" vs "chit chat" distinction on emails -- don't archive, and certainly don't have recovery of chit chat, use non-transferable sigs for chit chat, the only person who cares about authenticity is the recipient, not the legal system. So I think this aspect belongs in coding in ways which are beneficial to companies. > Jon Callas and others > said things like ~~If you've got features you want done, > propose it to OpenPGP and get them to adopt it, and that'll > give us a business reason that we ought to adopt it.~~ > (I think the context of that was discussing Stealth, which they > still don't have enough business demand for to take time on, > and which by the way puts a major crimp in SMTP filters.) I guess the smtp filters leave stuff alone if they can't figure out who it's to? ie do default email thang -- which is probably what you want if it's some privacy nut who is sending a "chit chat" class message to one of your set of sales people. don't do the explode to all feature. > >This quote should give us clue as to why they will continue with CMR: > > "we're a real company with accountants" > > That wasn't an exact quote, just a paraphrase from my memory of > several conversations. Sure. It's also completely understandable that they do have financial restrictions, my main argument was that they could build more GAK resistant systems within those restrictions. > >Similar arguments would presumably present them with "no choice" but > >to fulfill the order for 100,000 GAK compliant units from the > >government terrorizing the freedom fighters PRZ likes to tell us > >about who are already using PGP GAK compliant software: pgp5.0. > > Even if they did that, it wouldn't change the power relationships; > if the government can compel GAK keys by filtering SMTP or > confiscating non-eavesdropping-compatible mail gateways, > it doesn't matter if the Cc: Big Brother was added as a PGP5.5 CMRK > or as a PGP2.6.2i multiple recipient - you can't tell from > the message format (except for DH vs. RSA). Yes, but you are in the US. The recipient is in tinpotdictatorsville. With pgp5.0 your software will by default honour the military police's demand in tinpotdictatorsville. This is why I am arguing that the system as a whole be considered -- you are trying to build GAK resistance into the deployed code base you have to think long term and you have to think in terms of sabotaging the system to make it unuseful to governments. Consider also that software gets used in it's default configuration 95% of the time. Not everyone is a information architect :-) > >What can we do about this situation? Well we could build systems > >which hack around the CMR system. Easy enough: just put dud > >"recovery" info inside. We still have deployment problems. > > Unless I misunderstood the formats, > CMRKs are just identified by KeyID, not by fingerprint, > and it's easy to look through the public keyservers to find CMRKs > (though companies may prefer to have their employees mail out > keys to people who need them rather than making all their > keys constantly visible on the outside servers.) > So go find them all, send protest email to the postmasters > and corporate officials at the companies that use CMRKs, > crank up your deadbeef generator to make your own keys > with the same KeyIDs as the CMRKs, and pre-load the public keyservers. > A nice touch would be to burn your copies of the private keys > for the CMRK imitators, but we'll never know if you did, will we? OK, well that's some monkeywrenching, but I guess that could be prevented with some design reviews. I won't be helping with those design reviews -- any company who wants to improve enforcement of CMR type designs can figure them out for themselves. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <3.0.3.32.19971017111721.00b53d40@mail.pgp.com> At 01:18 AM 10/17/97 -0700, Bill Stewart wrote: At 08:40 AM 10/16/1997 +0000, Attila T. Hun wrote: > I have not seen any further discussion on my suggestion to > create a sendmail type daemon which implements DH between > mail clients. this, of course, is on the presumption that DH > is a wrapper for an already encrypted packet, DH between mail clients and servers is a really fine idea if you're starting from scratch, but sendmail is such a wretched hive of crime, corruption, and villainy that nobody in their right mind really wants to mess with it. You could implement it as a sendmail extension using the EHLO stuff, but you'd have to go get people to adopt it widely once you'd done it; I suppose if you could talk Netscape and Eudora into adding DH exchange to their client code and get it into a few popular servers, you'd have a large fraction of the Internet's email encrypted, which would be a Good Thing. It'd still have some major traffic analysis issues, and if you want to deal with the Man In The Middle problem, you need a key distribution infrastructure, which is much harder. An alternative approach is to encrypt everything using IPSEC, and you don't have to mess with Sendmail, but there are performance issues, and there's a lot of work getting it deployed also. There's another solution too -- make your mail servers talk with TLS (Transport Level Security, a.k.a. SSL). This solves some problems and not others. If your SMTP path includes any hops, then the message is in plaintext on that machine. Complicating it further, you cannot reliably enforce what the hops will be. This is one of the reasons that email keys are sometimes considered comm keys and sometimes storage keys. Jon ----- Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) From aba at dcs.ex.ac.uk Fri Oct 17 12:00:24 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sat, 18 Oct 1997 03:00:24 +0800 Subject: what can we do about PGP sell out and CMR? In-Reply-To: Message-ID: <199710171801.TAA01389@server.test.net> Tim May writes: > Yes, the thrust of my comments was about OpenPGP. > > The OpenPGPers were fretting about how to incorporate GAK and CAK and GMR > and CMR into their "open," and (presumably) international, standard, and I > said: Keep it Simple, Stupid. To be clear: my efforts in CDR (data recovery) design alternatives, and GAK resistant design principles are not because care one way or the other about CDR going into the OpenPGP standard at this point, they were soley to persuade PGP Inc that there are more GAK resistant ways to achieve same functionality, which then negates need for CMR extensions. The CDR proposal is about data recovery which means that it could be argued to be outside the scope of OpenPGP; it is about how to implement recovery within mail archives in a MUA, such as pgp5.x mail client. Also re. subject line, I now think that it is not a sell out, just a design mistake; they have good intentions, and have not sold those out, but have failed to optimally transfer those intentions into the protocol design. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 _________________________________________________ L E F T B R A I N / R I G H T B R A I N - QUESTIONAIRE _________________________________________________ My name is Gregory Raymond and I believe you are someone who is interested in a successful lifestyle. By this I mean a balance of physical, mental, spiritual and financial success. If we are of a like mind, I thought you might be interested in taking the following brief, revealing quiz. Simply [hit reply] then place an "X" in the appropriate boxes where applicable, and send it to us. I know and understand there are two parts to my mind, conscious and sub-conscious (aka unconscious) Yes [ ] - No [ ] - Maybe [ ] - Didn't Know [ ] I know the sub-conscious part of my mind labors 24 hours a day (without sleeping) for my success or failure, without making any moral judgements. Yes [ ] - No [ ] - Maybe [ ] - Didn't Know [ ] I realize that by taking control of my subconscious mind, it's energy can be harnessed to accomplish whatever I desire. Yes [ ] - No [ ] - Maybe [ ] - Didn't Know [ ] I might be interested learning more about using my subconscious mind to attain a successful balance of physical, mental, and financial success. Yes [ ] - No [ ] - Maybe [ ] [ ] You have piqued my curiosity, and without any obligation, I would like to learn more about achieving mental, physical and financial success. [ ] I'm not interested in this ridiculous survey, and with my CONSCIOUS MIND, I think that you're "Full Of It". Take me off your list and never darken my E-Door again. Thank you for your time. Regards, Gregory Raymond P.S. You may visit our site at: http://www.savoynet.com/carrmond/esoteric/master.htm to check on survey stats, they are updated after each mailing. From schlafly at mail.cruzio.com Fri Oct 17 13:02:04 1997 From: schlafly at mail.cruzio.com (Roger Schlafly) Date: Sat, 18 Oct 1997 04:02:04 +0800 Subject: Freeh letter to NYT Message-ID: <3.0.1.32.19971017124121.0069d8d0@mail.cruzio.com> [From www.nytimes.com, Oct. 16, 1997] To the Editor: "An Attack on Privacy Rights" (editorial, Oct. 3) argues that the approach to encryption that the law enforcement community is advocating has somehow "put the need to eavesdrop on criminals above the privacy rights of ordinary Americans." Nothing could be further from the truth. You fail to mention that the same court-ordered, judicially approved procedures that now apply to wiretaps and electronic data searches would also apply to our ability to obtain decryption keys or information. In fact, what we proposed requires two orders from a judge before we proceed, not just one as now required. There is another issue that, if unaddressed, will have public safety ramifications. Encryption that cannot be deciphered regardless of the number of court orders or new technologies obtained by the police will devastate our ability to fight crime and prevent terrorism. It will nullify the ability to carry out court-authorized searches and seizures of criminal communication and electronic evidence. Policy decisions about encryption should not be left solely to market forces. Congress, the computer industry and law enforcement can work together to craft legislation that balances the public safety with the commercial and private needs of law-abiding Americans. We are not wedded to any particular solution, but feel that some workable solution can be found to insure that law enforcement can gain immediate access to the plaintext of encrypted criminal communication or electronic data that we have lawfully seized. LOUIS J. FREEH Dir., Federal Bureau of Investigation Washington, Oct. 10, 1997 ---------------------------------------------------------------- How can he say this with a straight face? >In fact, what we proposed requires two orders from a judge >before we proceed, not just one as now required. The DOJ proposal, sect 302, says: (A) A Key Recovery Agent, whether or not registered by the Secretary under this Act, shall disclose recovery information stored by a person: (1) ...; or (2) to a law enforcement or national security government agency upon receipt of written authorization in a form to be specified by the Attorney General. It also contradicts his final sentence: >... some workable solution can be found to insure that law enforcement can >gain immediate access to the plaintext of encrypted criminal communication >or electronic data that we have lawfully seized. The term "immediate access" means without having to goto a judge. Roger From aba at dcs.ex.ac.uk Fri Oct 17 15:59:47 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sat, 18 Oct 1997 06:59:47 +0800 Subject: what can we do about PGP sell out and CMR? In-Reply-To: Message-ID: <199710172045.VAA02847@server.test.net> Anonymous writes: > You've got a lot of nerve accusing PGP, Inc. of being "sellouts" when > you're over on open-pgp pushing KEY ESCROW, of all things. I can see it > now, the new product name, "PGP with Key Escrow". Motto: "Lose your key? > Don't worry, we've got a copy." Do you really think cypherpunks are > going to support key escrow? Fat chance. I take your comments to be directed at my Corporate Data Recovery (CDR) proposal which I presented as a more GAK resistant alternative than PGP Inc's Corporate Message Recovery (CMR) proposal. Data recovery is less dangerous than communications recovery. Why? Scenario #1 (comms recovery): government mandates everyone gives them comms recovery key (CMR key). Government can key word scan all your messages in real time. If you are non-technical and don't know to hack around it you either comply or are caught out, and suffer penalty for breaking law. Scenario #2 (data recovery): government mandates everyone gives them data recovery key (CDR key). If government raids your offices or home, they can recover your plaintext. If they do not raid your home they can not. Raiding homes is expensive. They can't raid all homes because they do not have the money. Also, they can't check whether you are using GAK software -- until they raid you they won't know. When they raid you you are likely in trouble anyway, so you may as well not use GAK software if you figure you are likely to be raided. Therefore GAK on data doesn't work as well, and doesn't as much affect the balance of power between citizens and governments as GAK on communications does. Can you see flaws in this reasoning? Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710172246.XAA02901@server.test.net> High quality anonymous post, which I'll comment on below. I have my suspicions as to who this person is; I won't comment on who, but I do appreciate his thoughtful comments. Anonymous writes: > Let's look a little closer at the kinds of access and notice available in > the PGP system compared to alternatives. > > As several people have pointed out, no encryption system can provide > protection against what is done with the message after it is decrypted. > The receiver could share it with whoever he wants to, or whoever he is > forced to. > > Consider the following scenarios: > > - An encrypted message is sent to someone at his workplace using current > systems like PGP 2.6. > > - An encrypted message is sent to someone at his workplace, who is using the > message access features of PGP 5.5. The corporation key is marked as > "optional", and the message is not encrypted to that extra key. > > - An encrypted message is sent as before, but this time the message is > encrypted to the corporate key. You missed one scenario, which corporates are probably going to like better than you imagine. The reason they will like it better than you imagine is because you believe in privacy; they do not. You belief in privacy is making you unrealistically optimistic about companies respect for privacy. The missed scenario is: > - An encrypted message is sent to someone at his workplace, who is using the > message access features of PGP 5.5. The corporation key is marked as > "non-optional", and the message is encrypted to that extra key. If you are non-technical (which most people are not), you would then be forced to use this. This is because the SMTP policy enforcer will bounce the mail if you do not. Your expectation of privacy is respected, because you expect none. However if the system is used for other than anticipated purposes, such as perhaps as a GAK enforcement mechanism in tinpotdictatorsville, it is not just expectation of privacy concerns which will concern you. It is civil rights issues. You have a dual concern: you are trying to protect against big brother and against little brother. The way that your concerns about little brother have been transferred into the protocol resulting in the CMR mechanism has not added anything at all to protection against little brother; protection against little brother are largely statement of intent issues. However you do raise a fresh point in this debate below. > - An encrypted message is sent to someone at his workplace, who is using > a different form of corporate access which relies on key escrow > or automatic acquisition of cleartext. > > We agree that none of these systems can provide complete protection > against third party access. In any of them, the receiver could be forced > to turn over the encrypted message. But there is still a difference. > > In the first two scenarios, the expectation of privacy is the same. > You are encrypting to a personal key at a business address, but you > expect that you would know about it if the data were being provided to > a third party. There is no widespread installed base of software which > provides secret access after the message is decrypted. This is clever reasoning. I have not seen anyone raise this objection previously. However, you neglect that there is something which is incredibly highly deployed: hardly anyone is using disk encryption software. So the mostly widely installed user base already has the possibility for someone else in the company to decrypt it: the plaintext is an easier tarket than CDR recoverable data in my system. Your second distinction then resides in the claim that the email is still encrypted in the mail folder, and it has no recovery information. True enough, it doesn't. However what you are really saying is that the system has been purposefully designed to respect employees rights to receive private email. This design decision is implemented at a higher level than the protocol level. This design decision is independent of the use of CMR or CDR. You can easily implement private email with CDR. You can provide two keys: one for private use and one for company use. Or you can the email as private or not. Or you can give the user the ability to control independently for each email: is it archived (yes/no) is the archive recoverable (yes/no) I have been arguing for these features to be put in also, which demonstrates that I have just as much concern for privacy as you do. > In fact, the second scenario arguably provides slightly more privacy > than the first, which is what we have now. The reason is that in the > second scenario, the company provides an optional mechanism for business > mail to be recoverable, but also provides an explicit, sender-controlled > escape clause. The company is granting an explicit expectation of privacy > by allowing the corporate key recipient to be removed. With usage of > older versions of PGP, there was really no way for the company to even > inform the sender about whether it was going to be reading the mail. I like the statement intent of plaintext handling flag. It is independent of the protocol level, and can be used for either system. > In the third scenario, where you encrypt to the corporate key, there is > no expectation of privacy. All parties, the sender, the receiver, and > the company, know that the data is being made available to the business. > There is not much privacy here; what you have is business security. This > mode would be used for business documents and business communications. This is dangerous. Companies could lose lots of money over this when they are sued and a discovery process is used to recover all business communiations. Lawyers will be poring over those communications. Most of them will have been written with under 1 minutes thought. The lawyer will be able to find lots of things to pick legal nits in. He will build a case, and your company will lose a fortune. This is why you should give user control over what is archived. He can decide to archive things he thinks of import to keep for company records. The rest can be lost. It is also why you should do something somebody else suggested to me in email: have signatures which expire. > In the fourth scenario, which some people are offering as a superior > approach, the expectation of privacy is much less clear. Unlike in the > current PGP approach, where the design of the corporate access system > is oriented around notifying the sender and receiver, a key escrow or > plaintext recovery system inherently provides no such notice. The expectation of privacy is based on trust. It can not be enforced, as you acknowledged above. The statement of intent expectation of privacy can be encoded in the key independent of data recovery method. > This is different from the status quo. We are talking about a commercial > product which provides automatic corporate access to communications. > Widespread installation and use of this alternate version of PGP > inherently changes the assumptions and expectations that you will have > when you encrypt to someone at work. You can add as many privacy features as you want on top of CDR. Whether your implementation changes the status quo positively or negatively is your decision; you have full control in which features you provide. > Given the company's desire for message access, I thought that PGP stated that companies wanted to be able to recover stored archived email for employee performance benefits. > this approach implies that you must conservatively assume that most > encryption to a business address will be read. No. You can add the exact same framework for statement of intent, and of what is and what is not archived. This is a completely orthogonal issue. > The PGP system is designed to avoid this. It provides another method > for corporate access, a visible and explicit method. Visibility and explicitness are acheiveable with either system. > It is intended as an alternative to key escrow and other systems > which recovery data after the recipient gets it. PGP's third party > recipient feature is designed to prevent the creation of an > installed base of escrowed keys and after the fact third party > access software. What would you rather: - government recovery of those parts of the data which users voluntarily select to be stored in ways which can be recovered (after government raid of offices) - government key word scanning all email in transit without needing to raid offices. PGP Inc's CMR design is flawed because you have focused on privacy concerns which can be equally acheived with the CDR design; and you have done so at the expense of building a system which offers little resistance to being adopted by goverment to build a communications snooping, keyword scanning system. > Even if the encryption system provides a way for the user to mark his > keys as being escrowed or otherwise providing third party access, > the system is not self-correcting in the way the PGP system is. > It would be much easier for a business owner to pervert a secretive > access system than one like PGP. I didn't propose it as a secretive access system, I proposed it as a recovery system. Of course, it can be perverted to be one in the same way that CMR can be; both systems can be perverted. I argued that the software should be designed to make it as hard as possible to bypass. This won't be hard because software modifications can acheive it. My proposal is to allow users to selectively archive what they want to, and to selectively allow users to allow corporate recovery of what they want. The CMR system is not self correcting. The CMR system means that companies can snoop all of the email (that the sender hasn't taken steps to hack around CMR key). With my proposal in adition the recipient can delete things he would rather not keep around. > The company could install the access features but not tell its > employees that their keys were being escrowed, or that their mail > client was secretly storing a copy of all plaintexts. This kind of > change would be easy to make with the after-the-fact access systems > some people are proposing. Yes, theoretically this can be done with > any encryption system (as all agree) but the point is to avoid the > widespread distribution of software which invites this kind of > abuse. The PGP system is designed to satisfy business needs without > leading us into this dangerous situation. CMR invites even worse kinds of abuse. It invites wide scale government abuse of keyword scanning email. CMR is even worse because every last email can be recovered. > A world in which third party encryption by the sender is the normal > and widespread method for corporate access is one with increased > privacy and more visibility of access. disagree on both counts, as explained variously above. > The alternatives which have been proposed are prone to abuse and > provide less visibility. They are less prone to abuse as I have stated them above. But the proness to abuse depends on the functionality you are demanding of them in as far as that affects design, ultimately I think they can both be hacked with equivalent ease in either direction (more privacy, less privacy). > They lead us towards a world in which there is no expectation of > privacy even for encrypted messages, Disagree. Expectations of privacy are orthogonal issues. > by providing an installed base of snooping software. this charge applies to CMR software. Third party snooping of communications is infinitely more dangerous than snooping of stored information. In a company environment the company has control. He can install a keyboard sniffer when you are out of the office. He can replace your software. This applies to both systems. With CMR the company can all email without the receiver having any choice. With CDR the reciever can choose to archive or not to archive. He can choose to allow recovery or not. Next talk about government dangers. With CMR if this technology is adopted by governments, and the OpenPGP standard is allowed to include CMR technology we have keyword scanning. The CMR technology will allow government to know when the unskilled person is cheating. With CDR, if the government demands escrow of all storage keys the government has no way of knowing if you are cheating with out breaking into your building/house. If you consider the government will break in, you don't have much to lose by not using the key the government has escrowed. > The PGP approach is explicitly designed to keep us out of that > world, by removing the need for that kind of software. It is trying to do something useful, and the people who are proposing it have good privacy preserving intentions. I think it is failing to meet those intentions well, becuase the privacy preserving, statement of intent, and non-hackability for companies are all orthogonal issues to the choice between CDR and CMR. CDR offers significant extra protection against government perversion of the software authors intent. data recovery good, communications recovery bad. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 This is a question which I am unclear on about PGP Inc's design goals in using the CMR method. Is the CMR field to allow the company to recover from the user forgetting his password? (recover his mail folder full of encrypted email). or Is the CMR field to allow the company to read the email in transit This seems like a fairly important distinction. Adam From jon at pgp.com Fri Oct 17 17:07:57 1997 From: jon at pgp.com (Jon Callas) Date: Sat, 18 Oct 1997 08:07:57 +0800 Subject: what is purpose of CMR? In-Reply-To: <199710172354.AAA03957@server.test.net> Message-ID: <3.0.3.32.19971017165408.00be6900@mail.pgp.com> At 12:54 AM 10/18/97 +0100, Adam Back wrote: This is a question which I am unclear on about PGP Inc's design goals in using the CMR method. Is the CMR field to allow the company to recover from the user forgetting his password? (recover his mail folder full of encrypted email). or Is the CMR field to allow the company to read the email in transit This seems like a fairly important distinction. It's not for surveillance. It's for recovering from disaster. I think it would be a good thing to send a PGP message over an encrypted link (TLS or other). Jon ----- Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) From ravage at ssz.com Fri Oct 17 18:09:24 1997 From: ravage at ssz.com (Jim Choate) Date: Sat, 18 Oct 1997 09:09:24 +0800 Subject: SSZ Down hard today... (fwd) Message-ID: <199710180127.UAA00584@einstein.ssz.com> Forwarded message: >From ravage at ssz.com Fri Oct 17 20:10:35 1997 From: Jim Choate Message-Id: <199710180110.UAA00156 at einstein.ssz.com> Subject: SSZ Down hard today... To: users at ssz.com (SSZ User Mail List) Date: Fri, 17 Oct 1997 20:10:34 -0500 (CDT) X-Mailer: ELM [version 2.4 PL23] Content-Type: text Content-Length: 1389 Hi Folks, Not shure exactly why, doesn't seem to be related to the OS or hardware, but you obviously are aware that SSZ had some serious problems this afternoon. I suspect (wild guess at best) that it was power related in some way. Anyway, I'll be watching it all weekend. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From 74916810 at juno.com Sat Oct 18 10:40:01 1997 From: 74916810 at juno.com (74916810 at juno.com) Date: Sat, 18 Oct 1997 10:40:01 -0700 (PDT) Subject: Deliverable Mail Message-ID: <6789089932886.XCG91933@4021creditsuccess.com>


/////////////////////////////////////////////////////////////////
CREDIT CENTER***CREDIT CENTER***CREDIT CENTER***CREDIT CENTER
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
If you received this electronic mailing by mistake, please pardon the
intrusion.

Dear Friend;

Are you or somebody you know experiencing credit problems?  If the
answer is yes, our special offer might be just the cure you have been
looking for.  No longer will you have to live like a second class
citizen due to a bad credit report.  Bad credit can happen due to a
variety of reasons and can happen to anybody.  There is no profile of a
person with credit problems, it can happen to anybody.  In fact, one in
three Americans live with some form of bad credit.  Fortunately, the
United States Government has passed many laws under the Fair Credit
Reporting Act, all of which protect your rights as a consumer.  Our
manuals will show you how to use these Federal Laws to your advantage to
repair your credit, obtain a new credit report or add good credit to
your credit report!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
*****  'THE FRESH START PROGRAM II' (TM) *****

Have you recently been denied credit due to a bad credit report?  Have
you seen your credit report lately?  If your answered yes, then you need
to take advantage of the 'FRESH START PROGRAM II' (TM) NOW!  This manual
is unique in that it shows you how to obtain a brand new Social Security
number which will allow you to open a brand new, fresh credit report. 
Using guidelines set forth by the Social Security Administration, this
easy-to-follow manual will guide you through the steps necessary to
obtaining your new Social Security Number.  Regardless of your present
credit, you can open a new credit file free of ANY judgements,
charge-off's, foreclosures, bankruptcies, bad credit, tax liens's,
garnishments, late pays and inquiries.

////////////////////////////////////////////////////////////////

***** THE 'WorldCard' (TM) INSTANT CREDIT Credit Card *****

This program is very simple.  It extends to you a $5,000 instant line of
credit in the exclusive 'WorldCard' (TM) Wholesale Purchasing Club. 
This credit card comes to you with absolutely NO credit checks!

You will receive the 'WorldCard' (TM) Wholesale Purchasing Club catalogs
with over 5,000 items to choose from.  Jewelry, toys, tools, gift items,
housewares and much more are available.  After your first purchase, each
quarter you will receive updated catalogs with brand new items
available.

You will be required to make a small down-payment with your orders
and then make a monthly payment of 10% of the unpaid balance.  It's just
that simple!  Your good credit with WorldCard will be reported to the
credit bureau's, which will show your excellent credit!

As a special BONUS, if you take advantage of this offer within the next
24 hours, you will be given $200 in cash certificates!  $100 may be used
on the first $300 unpaid balance and the other $100 may be used after
you have charged $600 on your new account.

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

***** 'STOP COLLECTION AGENCIES COLD' (TM) *****

If you have ever experienced the humiliation of a collection agency
calling you at home or at work, then this hard-hitting manual will put
an IMMEDIATE stop to those calls!

Millions of collection agency telephone calls and letters are made or
sent each week to those who owe money.  Consumers have been helpless to
stop the harassment of these predators, UNTIL NOW!

This manual will show you how to put an end to these telephone calls and
letters, INSTANTLY!  At the same time, these collection agencies will be
forbidden to EVER call or write you again!!  This manual has the inside
secrets the credit world does not want you to have!

Gain back your self-esteem and piece-of-mind by ordering 'Stop
Collection Agencies Cold' (TM) TODAY!!!

/////////////////////////////////////////////////////////////////

***** 'THE COMPLETE CREDIT REPAIR KIT' (TM) *****

Good credit empowers you to qualify for personal loans, automobile
loans, business loans, credit cards, home loans and other types of
credit you may apply for at the very best interest rate.  As you know,
if you don't have excellent credit, lenders will NOT extend credit to
you!  The Fair Credit Reporting Act will allow you to legally and
permanently ERASE the negative information on your credit bureau file.

Anything damaging to your credit, such as bankruptcies, judgements, tax
liens, slow pays, repossessions, charge off's, foreclosures, late
payments, student loans and inquiries may be permanently and legally
REMOVED from your credit report!

If bad credit on your credit file is standing in the way of your
achieving the American dream, then order 'The Complete Credit Repair
Kit'(TM) NOW!!!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

IMS
5201 Kingston Pike, Suite 6-216
Knoxville, Tennessee 37919

YES, please rush the manuals checked below:

_____   'The Fresh Start Program II' (TM)         	$34.95

_____   'WorldCard' (TM) Credit Card            	$34.95

_____   'Stop Collection Agencies Cold' (TM)   	 $34.95

_____   'The Complete Credit repair Kit' (TM)   	$34.95

_____   TAKE ALL FOUR (SAVE over $39)   	$99.95


$____________  Sub-Total

$4.95    Shipping & Handling for each manual ordered
$15.00   RUSH Delivery (Optional)

$____________  TOTAL ENCLOSED

I Have Enclosed (Check One):
_____   Cashiers Check
_____   Money Order
_____   Personal Check
_____   FAX ORDER


SHIPPING INFORMATION:

Name:__________________________________________________
Address:________________________________________________
City:_______________________State:________Zip Code:_________
Telephone Number:___________________

Your E-Mail Address (For order confirmation):___________________

////////////////////////////////////////////////////////////////

FREE  -  FREE  -  FREE  -  FREE  -  FREE  -  FREE  -  FREE  -  FREE  

Fax your order within 24 hours and receive a special Kodak film book
entitling you to
100 rolls of Kodak film as well as five 6X10 and ten 4X5 enlargements
FREE!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

Please tape your signed personal check in the space below and fax to
IMS.  The 24 hour facsimile number is 1-423-681-6520.

******************************************************

FAX 1-423-681-6520

Please TAPE Your Check Here

Please SIGN Your Check

******************************************************

THANK YOU For Your Order!!!











From nobody at REPLAY.COM  Fri Oct 17 19:44:57 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Sat, 18 Oct 1997 10:44:57 +0800
Subject: MonkeyWrenching Monitoring
Message-ID: <199710180231.EAA25132@basement.replay.com>




I share and/or swap my email accounts with others on a 
regular basis, particularly at times when I can verify
I was somewhere other than where the account was logged
onto.
I do the same with non-essential crypto keys, etc.

This sharing, in many legal jurisdictions, turns your
accounts into a 'public street', so to speak, meaning
that any 'tracks' left behind don't necessarily lead 
to your own doorstep in a legalistic sense.

A word of caution: If you don't have access to *good*
legal services, the above methods may work against you,
if push comes to shove.

MonkeyMonger







From attila at hun.org  Fri Oct 17 19:47:26 1997
From: attila at hun.org (Attila T. Hun)
Date: Sat, 18 Oct 1997 10:47:26 +0800
Subject: consensus on pgp? can we consolidate for action?
In-Reply-To: <19971016.032545.attila@hun.org>
Message-ID: <34482161.4AD6@hun.org>



-----BEGIN PGP SIGNED MESSAGE-----

    alas, I must have been less than clear with the 
    statement "sendmail type" daemon.

    as Bill Stewart so aptly stated:

>   sendmail is such a wretched hive of
>   crime, corruption, and villainy that nobody in their right mind
>   really wants to mess with it. 

    is an abomination; in fact, about 1980/1 or such, I had a
    reason to carefully exam a few of the internals;
    subsequently, Eric Allman had good reason to be very
    circumspect where he crossed the street.  that
    and the rules set of the M4 macro processor --an even worse 
    abomination. speaking of Eric, I have not seen or heard for
    many years...?

    as Bill also pointed out, somethings could be done via the
    EHLO extensions, but the limitations would be to great.

    secondly, as Jon Callas points out, there is the option of
    TLS via SSL. however, that takes the wrapper off in a store 
    and forward situation and you can not control the hops.

    ** what I had in mind: **

    literally a point to point, port to port daemon pair 
    --operating in a trusted pair mode. 

    if store and forward was necessary, there would be a
    requirement for a dynamically maintained table similar
    to DNS, and a means of securing the data.  in order to
    implement store and forward, a web of trust would be
    essential, otherwise only point to point is feasible.

    in other words, a system similar in function to MixMaster
    except that it is fully end to end secure --well, as secure 
    as one can be using the IP carriers, SSL or not. 

    the are many nuances: for instance, provisions for key 
    lookup. 

    in all honesty, I have not been as concerned with all the 
    possibilities, just the design of and easily installable and
    maintainable daemon to satisfy the basic requirement, and 
    sufficient hooks to implement functionality without 
    compromising security.

    meanwhile, our hands are full with the PGP sell-out to the
    man, willing, or kicking and screaming, or even sold out by 
    the vultures and beancounters with an agenda: money. even 
    without presuming a current sellout, I suspect the whole
    affair was compromised from the gate --money talks, shit
    walks; and, there are many other unanswered questions, 
    some which I floated a year ago; regardless, someone is 
    schilling for uncle.

    in any event, all feedback is sincerely appreciated; none of
    us, weathered and scratched old grizzlies like me, or 
    cheetahs new to the veldt, have a corner on ideas. to 
    survive, the old just get meaner, and trade on their 
    experience. 

        attila


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1
Comment: No safety this side of the grave. Never was; never will be

iQCVAwUBNEggyL04kQrCC2kFAQGI0wP+JPI1v675+hdVRpXGr9dnI/XBqPHbPIMk
v4PA4eIqFEVbH2j5jWXsG9pEK1DrGdFwJl26DSeV7dgkQAqOWNUdsNML2w+L8tiw
Vr+VFGBznv+1BmxoyPskWAddTtXxqKO9i6kHbNcwE2nKBG1SoxLWF6uCZdQClwME
VS5RC3jRTTQ=
=uOdC
-----END PGP SIGNATURE-----

Jon Callas wrote:
> 
> At 01:18 AM 10/17/97 -0700, Bill Stewart wrote:
>    At 08:40 AM 10/16/1997 +0000, Attila T. Hun wrote:
>    >    I have not seen any further discussion on my suggestion to
>    >    create a sendmail type daemon which implements DH between
>    >    mail clients. this, of course, is on the presumption that DH
>    >    is a wrapper for an already encrypted packet,
> 
>    DH between mail clients and servers is a really fine idea if you're
>    starting from scratch, but sendmail is such a wretched hive of
>    crime, corruption, and villainy that nobody in their right mind
>    really wants to mess with it.  You could implement it as a sendmail
>    extension using the EHLO stuff, but you'd have to go get people
>    to adopt it widely once you'd done it; I suppose if you could talk
>    Netscape and Eudora into adding DH exchange to their client code
>    and get it into a few popular servers, you'd have a large fraction
>    of the Internet's email encrypted, which would be a Good Thing.
>    It'd still have some major traffic analysis issues,
>    and if you want to deal with the Man In The Middle problem,
>    you need a key distribution infrastructure, which is much harder.
> 
>    An alternative approach is to encrypt everything using IPSEC,
>    and you don't have to mess with Sendmail, but there are
>    performance issues, and there's a lot of work getting it deployed also.
> 
> There's another solution too -- make your mail servers talk with TLS
> (Transport Level Security, a.k.a. SSL).
> 
> This solves some problems and not others. If your SMTP path includes any
> hops, then the message is in plaintext on that machine. Complicating it
> further, you cannot reliably enforce what the hops will be.
> 
> This is one of the reasons that email keys are sometimes considered comm
> keys and sometimes storage keys.
> 
>         Jon
> 
> -----
> Jon Callas                                  jon at pgp.com
> Chief Scientist                             555 Twin Dolphin Drive
> Pretty Good Privacy, Inc.                   Suite 570
> (415) 596-1960                              Redwood Shores, CA 94065
> Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS)
>               665B 797F 37D1 C240 53AC 6D87 3A60 4628           (RSA)






From anon at anon.efga.org  Fri Oct 17 20:28:28 1997
From: anon at anon.efga.org (Anonymous)
Date: Sat, 18 Oct 1997 11:28:28 +0800
Subject: CMR Monkeywrenching Itself
Message-ID: <072072fd628719e4b0d427834ec87b4c@anon.efga.org>



a0a1a2a3a4a5a6a7a8a9
b0b1b2b3b4b5b6b7b8b9
...
z0z1z2z3z4z5z6z7z8z9

If you send the above message repeatedly, changing a single character
at a time, in increments (X0a1a2.../aXa1a2...) some interesting things
happen to messages encrypted to two keys, especially if they share a
one-time pad.
These 'interesting things' are wonderful tools for prying open the 
secrets of a foreign key, using what you already know about the key
you are in possession of.

If you happen to be working with an encryption program that unwitting
allows you to access the one-time pad it is using (or to *supply* the
one-time pad it uses), then you can crack secret keys during your lunch
breaks and still have time to complete a level of Doom before it is
time to get back to work.







From IP-Administrator at sexlink.net  Fri Oct 17 20:38:10 1997
From: IP-Administrator at sexlink.net (IP-Administrator at sexlink.net)
Date: Sat, 18 Oct 1997 11:38:10 +0800
Subject: Free Adult Content For Your Web Site!
Message-ID: <199710180320.XAA03001@zmail.firstcounter.com>



Pardon our intrusion, this is a message for adult webmasters.
 to be removed from this list send a blank e-mail to mailto:remove at sexlink.net
 *****************************************************************************
 
 
 ----------ADD FREE CONTENT TO YOUR ADULT WEBSITE TODAY----------
 
 Sex Link Network has just turned on the FREE web content site!
 
 You now have the opportunity to add new and exciting content to your adult website.
 
 Offer your visitors the following FREE services:     
 
           Digital Postcards  - Both Straight & Gay Available
           Personals On-line - Both Straight & Gay Available
           Chatterbox Hotel "The best Chat on the net" - Both Straight & Gay Available
 
 Just register with us and you can provide your visitors with new dynamic content.
 
 All content programs are served from Sex Link Networks fast computers on T3 
 dedicated backbones. There is no bandwidth usage on your side.
 
 
 Check out our content and register today! http://services.sexlink.net
 
 
 






From ravage at ssz.com  Fri Oct 17 20:42:08 1997
From: ravage at ssz.com (Jim Choate)
Date: Sat, 18 Oct 1997 11:42:08 +0800
Subject: index.html
Message-ID: <199710180402.XAA01164@einstein.ssz.com>



    CNN logo 
   Navigation 
   
   Infoseek/Big Yellow 
   
   
   Pathfinder/Warner Bros 
   
   
   
   
   Tech banner IBM Reinventing Education rule
   
           GOVERNORS WARN COLLECTING INTERNET TAXES WOULDN'T BE EASY
                                       
     Internet taxes October 17, 1997
     Web posted at: 11:12 p.m. EDT (0312 GMT)
     
     WASHINGTON (AP) -- The nation's governors and local officials,
     already having difficulty collecting taxes on catalog sales, said
     Friday a bill aimed at restricting new taxes on the Internet would
     worsen their problems.
     
     "It's very similar," Republican Gov. George V. Voinovich of Ohio
     said at a press briefing. "We've had an ongoing problem in terms of
     how to handle that. We've been continuing to try and work that out
     with those businesses in the states that have the large mail-order
     catalogs."
     
     The National Governors' Association estimates states lose $4 billion
     in sales taxes annually from catalog sales. That's because states,
     cities and counties generally lack the authority to capture sales
     taxes on such sales if the catalog business is headquartered out of
     state.
     
     That problem could only intensify based on the projected growth of
     electronic commerce. Voinovich cited one estimate of $1.5 trillion
     in sales on the Internet by 2002.
     
     "I don't think this is the time for the federal Congress to rush
     into something that will have such a huge impact on state and local
     government," he said.
     
     Joining Voinovich to oppose the Internet tax bill were leaders from
     the National Association of Counties, National League of Cities and
     U.S. Conference of Mayors.
     
     Rep. Chris Cox, a Republican from California, and Sen. Ron Wyden, an
     Oregon Democrat, have sponsored similar bills that would bar any new
     taxes on computer transactions -- such as taxes on Internet access
     or online services -- for an unspecified time while Congress studies
     the whole issue.
     
     The bill would make an exception to the moratorium for income earned
     through an Internet service; local business license taxes, if the
     Internet provider is located within the appropriate jurisdiction;
     and sales or use taxes, so long as they are the same as charged for
     mail or telephone orders.
     
     "We would love to have the bill say what the sponsors say it says,"
     said Brian J. O'Neill, a Philadelphia city councilman, representing
     the National League of Cities. But O'Neill and others say the
     technical language of the bill contains a broad pre-emption of state
     and local taxes.
     
     Wyden spokesman David Seldin strongly disagrees.
     
     "We have bent over backwards to clarify language of the bill so
     there can be no questions" that local governments retain authority
     to levy the same taxes on the Internet that are assessed on catalog
     sales, Seldin said. The bill seeks to halt new local taxes aimed
     specifically at Internet businesses.
     
     One National Governors' Association official said the bill's wording
     would worsen the states' problem of collecting sales taxes on
     catalog sales.
     
     "We know that we have to sit down with the industry and make the
     sales tax work on Main Street, on catalogs and on Internet, in some
     simplified, clear and technologically neutral way," said Tim Masanz
     of the association's economic development group.
     
     "If Congress goes on record and says that Internet sales are the
     equivalent of catalog mail-order sales, those talks are doomed," he
     added.
     
     "I can understand their desire to fight that battle but it would
     certainly not do much good to create a situation where you are
     favoring one at-home purchase over another," said Seldin.
     
     Copyright 1997   The Associated Press. All rights reserved. This
     material may not be published, broadcast, rewritten, or
     redistributed.
     
    
   rule
   
  Related story:
     * House panels back Internet taxation bill - October 9, 1997
       
  Related sites:
  
     Note: Pages will open in a new browser window
     * THOMAS - Legislative Information on the Internet
          + HR 1054 - Internet Tax Freedom Act
     * U.S. House of Representatives
          + Commerce Committee
          + Judiciary Committee
     * National Governors' Association
     * National League of Cities
       
     
     
     External sites are not endorsed by CNN Interactive.
     
   
     _________________________________________________________________
   
   Infoseek search ____________________ ____  ____
   
     _________________________________________________________________
   
   
   rule
   
   Watch these shows on CNN for more sci-tech stories:
   
   CNN Computer Connection | Future Watch | Science & Technology Week
   rule Message Boards Sound off on our
   message boards
   
   You said it... [INLINE] IBM Reinventing Education rule
   To the top 
   
   � 1997 Cable News Network, Inc.
   All Rights Reserved.
   
        Terms under which this service is provided to you.






From ravage at ssz.com  Fri Oct 17 21:13:04 1997
From: ravage at ssz.com (Jim Choate)
Date: Sat, 18 Oct 1997 12:13:04 +0800
Subject: A quote...
Message-ID: <199710180431.XAA01256@einstein.ssz.com>




The politics of those whose goal is beyond time are always pacific; it is
the idolaters of past and future, of reactionary memory and utopian dream,
who do the persecuting and make the wars.

                                              Perennial Philosophy
                                                 Aldous Huxley


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http:// www.ssz.com/  |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From ualdv8 at sk.sympatico.ca  Fri Oct 17 21:59:49 1997
From: ualdv8 at sk.sympatico.ca (Six)
Date: Sat, 18 Oct 1997 12:59:49 +0800
Subject: LJFLJF
In-Reply-To: <34482501.6789@sk.sympatico.ca>
Message-ID: <344835C2.534@sk.sympatico.ca>



Lying Nazi Fuck Freeh wrote:
> Subject: Freeh letter to NYT
> [From www.nytimes.com, Oct. 16, 1997]
> 
> To the Editor:
> 
> "An Attack on Privacy Rights"
> (editorial, Oct. 3)
> argues that the approach to encryption that the law enforcement
> community is advocating has somehow "put the need to eavesdrop
> on criminals above the privacy rights of ordinary Americans."
> Nothing could be further from the truth.

  How about the fact that you are the director of an organization
that actively sought to sabatoge the civil rights movement by,
among other things, encouraging Martin Luther King to commit
suicide?
Is that close enough to the truth for you?

> You fail to mention that the same court-ordered, judicially
> approved procedures that now apply to wiretaps and electronic
> data searches would also apply to our ability to obtain
> decryption keys or information.

No they wouldn't you lying, scumbag, Nazi piece of shit.
You are *already* doing these things without *any* type of legal
authority to justify your criminal actions, and will continue
to do so? 

> Encryption that cannot be deciphered
> regardless of the number of court orders or new technologies
> obtained by the police will devastate our ability to fight crime
> and prevent terrorism.

Right. You can't find airplanes containing tons of drugs, you can't
keep drugs from being sold on the streets and in schoolyards, you
claim to have a list of all of these *known* pedophiles, but yet
they are all running free, even though you know about them.
This, despite all of the fascist, unconstitutional powers you have
stolen from the citizen's right to freedom and privacy.
Yet you have the fucking nerve to suggest that giving LEA's the
ability to monitor all of our private communications, at will,
is going to stop crime.

Buy a fucking clue, shit for brains.
All of the parts of the Constituion you have trampled underfoot,
claiming you needed this to fight drug dealers, has resulted in
the lowest street prices for heroin in decades.
I'll make you a deal. If you can get the street price of a gram
of cocaine up to $300.00 a gram, using your current fascist,
unconstitutional powers, I'll support you getting the rest of
the citizens' rights under your jackboots.

> It will nullify the ability to carry out
> court-authorized searches and seizures of criminal communication
> and electronic evidence.

  No. It will nullify the ability to carry out UN-authorized searches
and seizures of non-criminal communications.
 
> We are not wedded to any particular
> solution, but feel that some workable solution can be found to
> insure that law enforcement can gain immediate access to the
> plaintext of encrypted criminal communication or electronic data
> that we have lawfully seized.

Are the keys to the privacy of every living being on earth going to
be kept on the FBI computer system that was hacked, the CIA computer
system that was hacked, the DOJ computer system that was hacked...?

So that corporations know whether to support your plans for Government
Access to Korporate bungholes, would you please publicize a list of
*which* corporations you have defrauded and brought to financial ruin
by accessing and manipulating their financial data and assets because
you disagree with their actions?
How about a list of the corporations that you plan to do this to in the
future? Oh...never mind. I forgot that today's allies are tomorrow's
enemies, and vice-versa, so I guess that *any* corporation could be
a future target of government attack.

How do you brazen, Nazi cocksuckers find the audacity to announce to
God and everybody that you are fucking over people and nations around
the world by inserting bad mechanical parts into the supply system,
trashing the finances of individuals and companies around the world
that you have a hard-on for (today), that Swinestein has put the vote
on encryption issues that the citizens gave her, into *your* hands,
and then tell the citizens they can expect to be more 'secure' if they
give you dictatorial powers over all of their communications and data?

Who will be in control of access to the whole world's communications
and data?
Will it be the FBI guy who just went to jail for destroying evidence
and perverting justice?
Will it be the DOJ people who ruined the INSLAW corporation in order
to STEAL their software? Or the DOJ people who subverted justice by
defying our elected leaders in Congress during their investigation?

Tell us, Lying Jackoff Fuck Louis J. Freeh...
*Which* of the LEA officials who commit criminal acts and subvert
justice in the US will be in charge of access to the citizen's right
to privacy and freedom from fascist search and seizure.

Bonus Question:
"How many bodies does it take to spell, 'I *TOLD* you I was crazy!"
Bonus Prize:
1 Freeh Bullet

6ualdv8
~~~~~~~

> LOUIS J. FREEH
> Dir., Federal Bureau of Investigation
> Washington, Oct. 10, 1997
> 
> ----------------------------------------------------------------
> 
> How can he say this with a straight face?
> 
> >In fact, what we proposed requires two orders from a judge
> >before we proceed, not just one as now required.
> 
> The DOJ proposal, sect 302, says:
> 
>   (A)  A Key Recovery Agent, whether or not registered by the Secretary
>   under this Act, shall disclose recovery information stored by a person:
>      (1)  ...; or
>      (2)  to a law enforcement or national security government agency
>      upon receipt of written authorization in a form to be specified by
>      the Attorney General.
> 
> It also contradicts his final sentence:
> 
> >... some workable solution can be found to insure that law enforcement can
> >gain immediate access to the plaintext of encrypted criminal communication
> >or electronic data that we have lawfully seized.
> 
> The term "immediate access" means without having to goto a judge.
> 
> Roger






From anon_troll at hotmail.com  Fri Oct 17 22:42:18 1997
From: anon_troll at hotmail.com (Andrew Wiggin)
Date: Sat, 18 Oct 1997 13:42:18 +0800
Subject: Been tried before?
Message-ID: <19971018052525.20913.qmail@hotmail.com>



I had an idea for a key system using graphics files. Has that been tried 
before? The basic idea was to use a graphics file with a color depth of 
24-bit or higher. Then, using the rgb values of, say, every prime pixel 
(i.e. the first pixel, then the second....then the seventh, then the 
eleventh) or something like that to create a stream of numbers the feed 
into the cipher which would be highly erratic. A similar looking picture 
would not work, as the rgb values would be (I assume) hard to guess, and 
even if you came close, you would have to get the right order. If you 
used a graphics file format similar to PNG, for instance, you could even 
include alpha channels.
    Am I just shooting my mouth off, or does this sound like something 
that would work? I'm wondering if this has been tried before and if it 
would be worth programming out.

--Drew

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com






From hauman at bb.com  Fri Oct 17 23:14:58 1997
From: hauman at bb.com (Glenn Hauman)
Date: Sat, 18 Oct 1997 14:14:58 +0800
Subject: pro-crypto govt. people
In-Reply-To: 
Message-ID: 



At 4:23 PM -0400 10/16/97, Lizard wrote:
>At 04:08 PM 10/16/97 -0400, Declan McCullagh wrote:
>>Last week after a TV show I was
>>telling Donna Rice-Hughes about how crypto can protect against stalkers,
>>but I don't know if she understood my argument.
>
>Stick to words of one syllable. Hmmm...
>"If you make words hard to read, bad men will not find you."
>
>Try that. :)

No, put it in terms she understands:

"If you make embarassing words impossible to read, no one will be able to
read them on the front page of national newspapers."


Best-- Glenn Hauman, BiblioBytes
       http://www.bb.com/







From stewarts at ix.netcom.com  Sat Oct 18 00:59:05 1997
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sat, 18 Oct 1997 15:59:05 +0800
Subject: OUBAKAYAROU!!
In-Reply-To: <19971017080829.27590.qmail@hotmail.com>
Message-ID: <3.0.3.32.19971017182539.006ad1e8@popd.ix.netcom.com>



At 01:08 AM 10/17/1997 PDT, Nobuki Nakatuji wrote:
>>Tim May (tcmay at got.net)
>>Wed, 15 Oct 1997 22:11:09 -0700 
>>At 9:18 PM -0700 10/15/97, Nobuki Nakatuji wrote:
>>Where are another cypherpunk mailinglist ?
>>
>>Am another cypherpunks mailinglist at cyperpunk at dev.null.
>>You go there, chop chop.
>>You not talk about Misty here anymore, OK? We am tired hering about 
>>Misty and your fees.
>>
>>--Tim-san

Tim, was that you writing, or was that TotoMonger forging you again?
I agree that there are problems with Misty, but it's
no more annoying than some of the other flaming on the list,
and certainly less so that Dmitri Vulis and his tentacles.

Meanwhile, there is a cypherpunks-j at htp.org, in Japanese,
and there's probably still a cypherpunks-e at htp.org in English, 
though the last time I checked it, it had been 
mostly a mirror for the cypherpunks list with almost no independent content,
and its mail gateway broke badly and splattered all over its subscribers.
				Thanks!
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From stewarts at ix.netcom.com  Sat Oct 18 01:58:04 1997
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sat, 18 Oct 1997 16:58:04 +0800
Subject: anti-GAK design principles: worked example #1
In-Reply-To: <3.0.3.32.19971017015110.006afc90@popd.ix.netcom.com>
Message-ID: <3.0.3.32.19971018014919.006c9538@popd.ix.netcom.com>



At 06:27 PM 10/17/1997 +0100, Adam Back wrote:
>Bill Stewart  writes:
>> I'll duck the 5.5 argument for now, but you're 
>> incorrect on 5.0.  The PGP 5.0 key format includes
>> separate keys for signature and privacy, which is a mostly good thing,
>A very good thing.

It's very good, but it does have its own risks.
If you use the same keys for signature and encrypting to you,
and the government wants to GAK your encryption keys,
they have to steal your signature keys also, 
which just about everybody agrees is Bad, and it's
simply unacceptable in a business environment.
On the other hand, if the keys are separate, Louis Freeh
can tell the Congress that it's not a big problem,
he'd NEVER dream of GAKing your signature keys,
he only wants emergency access to your privacy keys --
this may give the GAK folks a better chance of getting it.
Similarly, your corporate security bureaucrats can understand
the concept that if they CAK your privacy keys,
they're risking having official company signatures get forged,
and they'll often do the right thing and desist,
but with separate keys that won't stop them.


> The PGP 5.0 key format [....]
>> and includes the ability to associate a group of
>> keyIDs and flag bits with each privacy key.
>So can you use pgp5.0 to construct a CMR key which would
>interoperate with pgp5.5 for business?

No.  As far as I know (without reading 7000 pages of code :-),
pgp5.0 won't construct CMR key fields, and won't use them,
it just isn't supposed to die if it receives a key containing them.

>Clearly pgp5.0 does nothing with these flags on reciept, 
>but does it understand them when sending?

If it receives a key containing CMRKs, it doesn't choke on the CMRKs,
and when you encrypt a message to the key, it ignores the CMRKs.
If it receives a message encrypted to both real people and CMRKers,
there's no way to tell which are which (though if you don't have
CMRKs in your key, they're obviously not your CMRKs.)

>Does pgp5.0 reply encrypting to just me as individual, or two crypto
>recipients me, and Mega Corp recovery key?
Just you.

>> >- store a copy of the private half of the users PGP encryption key
>> >  encrypted to the company data recovery key on the users disk.
>> No.  This is evil.  Don't go there.  Even with secret sharing,
>> and especially without.
>
>It is evil.  But it is not _as_ evil.
>
>The reason for this is that government access to storage keys is not
>as evil as government access to communications keys, because the
>government has to come and capture the ciphertext (take your disk),
>whereas with communications they can grab them via an arrangement with
>your ISP.

First of all, the only reason for having a CMRK attached to your key
is that either your mail service will reject mail to you that doesn't
contain it, or your employer insists on it.  In either case,
it can be done without a special CMRK field on your key --
PGP multiple recipients are enough to do that, and the sender
just has to remember to include the (no longer automagically attached) CMRK.
So leaving out the CMRK doesn't protect you.

Second, if the government is coming to get your disk anyway,
they can get themselves a court order to have you reveal the key,
and you can argue with the judge about whether you should be
compelled to reveal it, and at least in the US there's a 
Fifth Amendment backing up your arguments (though like the
other amendments, it's weakened by the "except for drugs" clause...)
GAK asserts that the government has the right to your keys
before you get to court.  Corporate access to storage keys,
on the other hand, is concerned with protecting the company's
information on the company's computers, and you can reasonably
negotiate how much of that you want to live with and comply with.
Some companies want to protect their information in case you
get hit by a bus, or a lawsuit; other companies don't even
have the sense to provide decent automated network-based backup
to protect their information from head crashes.

On yet another hand, while it may be obvious when the
government steals your disk and uses Storage-GAK,
companies using Storage-CAK or Storage-CMR can use it 
just as well on the backup tapes without your notice
as on your disk drive.  Furthermore, you can think of
the data backup process as communications from you
to the backupmeister, so Storage-CAK _is_ Message-CAK,
and Storage-CMR is Message-CMR.

But CAKing the disk doesn't protect the company's information,
and there's therefore no excuse for using it.  Superencryption
is always possible, in messages as well as files, but with
message encryption the eavesdropping-prone corporation can
detect superencrypted messages going by (though not stego'd),
while PGP-encrypted files on your disk only show up _after_
you've been hit by the bus on your way to the headhunter's.

BTW, PGP5.5 CMR _is_ CMR'd storage encryption.  
It's not as convenient as encrypted file systems 
like PGPdisk and Secdev, 
but people are using it to encrypt stored data,
including email and non-email files.

On a technical note, GAK for storage can be made less dangerous,
though not less offensive, by adding a layer of indirection -
use your public key to encrypt a symmetric key, store the encrypted
symmetric key on your disk, and then use the symmetric key for
encrypting the storage (or as a master key for encrypting the
per-file or per-block storage keys, if you're doing that, 
which you probably should.)  This means that a search warrant
which is required to itemize the things it's looking for can be
more effectively restricted to specific files rather than
cracking the whole disk and every other disk that uses the
same encryption keys.

>This is not avoidable for storage ... if you are encrypting data on
>disk, and if you want recovery information, you have no choice but to
>allow company access.    The recovery information should be 
as decentralised as much as possible.  

>The point though is that storage recovery is a completely separable
>issue from communications "recovery" which is a euphamism for allowing
>companies to read, or snoop, employees email, unless it is being used
>soley for data recovery of mail stored in mail folders (which seems to
>be what PGP Inc means by CMR term), in which case it is not necessary
>functionality, and can be better acheived by encrypting the mail
>archive with a user symmetric key with company storage recovery on
>that key.

Trust me - you _really_ don't want mailboxes encrypted,
recovery key or no recovery key, unless it's implemented very very well.
Microsoft Mail, and as near as I can tell Microsoft Exchange,
puts the user's entire mailbox, stored message folders and all,
in one big ugly cheaply-encrypted file.  The encryption isn't
strong enough to keep the NSA out, but it's strong enough to keep
you from repairing the file if part of it gets damaged,
and enough to keep you from extracting the undamaged parts,
or accessing it with sorting tools not built into MSMail.
Combined with the Microslush Mail Mindset of never sending text
when a Microsoft Word file could do, and never sending Word
when an even-more-bloated PowerPoint Presentation can fit,
your mailbox easily expands to over 100MB, too big to fit
on a ZIP drive.  Eventually, something always gets corrupted,
and you end up with Corporate Message Non-Recoverability.


				Thanks!
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From stewarts at ix.netcom.com  Sat Oct 18 02:43:21 1997
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sat, 18 Oct 1997 17:43:21 +0800
Subject: consensus on pgp? can we consolidate for action?
In-Reply-To: <19971016.032545.attila@hun.org>
Message-ID: <3.0.3.32.19971018020526.006cbe38@popd.ix.netcom.com>



At 02:39 AM 10/18/1997 +0000, Attila T. Hun wrote:
>    as Bill also pointed out, somethings could be done via the
>    EHLO extensions, but the limitations would be to great.
>    secondly, as Jon Callas points out, there is the option of
>    TLS via SSL. however, that takes the wrapper off in a store 
>    and forward situation and you can not control the hops.

>    ** what I had in mind: **
>    literally a point to point, port to port daemon pair 
>    --operating in a trusted pair mode. 

Besides doing things at the SMTP, IPSEC, or SSL layers,
another approach is SSH.  You could build an application-specific
relay (e.g. something sitting on your machine receiving SMTP
and something sitting on your mailhost relaying it to sendmail),
but SSH does close enough to that that it may be the way to go,
except for occasional annoyances about who can use Port 25.

Also, there are two mail protocols to address - 
smtp for sending, but pop3 (or imap4) for mailbox-retrieval.
Using either SSH or IPSEC or something SSL-based
can help you cover the POP3 end as well.

On the other hand, you can also use Hotmail or a Hotmail clone
with SSL and bypass the whole process.  Or you can use a
PGP-equipped remailer.
				Thanks!
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From aba at dcs.ex.ac.uk  Sat Oct 18 02:49:24 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sat, 18 Oct 1997 17:49:24 +0800
Subject: what is purpose of CMR?
In-Reply-To: <3.0.3.32.19971017165408.00be6900@mail.pgp.com>
Message-ID: <199710180723.IAA00783@server.test.net>




Jon Callas  writes:
> At 12:54 AM 10/18/97 +0100, Adam Back wrote:
>    
> > [what is CMR key for surveillance/ or disaster recovery]
> 
> It's not for surveillance. It's for recovering from disaster. 

In that case recovery can be much more simply and securely achieved
locally to the recipient.  Escrow or use locally stored recovery
information.  The CMR key is not needed for this functionality.

> I think it would be a good thing to send a PGP message over an
> encrypted link (TLS or other).

This is an independently good idea and would mitigate some of the
possibilites of CMR functionality being used for purposes other than
it's designers intended.

However it is hard to do; and the keys have different security focus
becuase it is hard to use user <-> user end to end TLS because of the
store and forward nature of email.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <3.0.2.32.19971018025454.03e23124@pop.sirius.com>



Adam Back writes:
>You have a dual concern: you are trying to protect against big brother
>and against little brother.

At the technical level, is there a meaningful difference between the
brothers? Aren't we really talking about third-party access to
communications, and second-party access to stored data ... with the
"brother" distinction being one made at a social/political level, as a
judgement about the legitimacy of the access or the size of the actor,
rather than the character of the access?


--
Greg Broiles                | US crypto export control policy in a nutshell:
gbroiles at netbox.com         | Export jobs, not crypto.
http://www.io.com/~gbroiles | http://www.parrhesia.com






From mixmaster at remail.obscura.com  Sat Oct 18 04:12:02 1997
From: mixmaster at remail.obscura.com (Mix)
Date: Sat, 18 Oct 1997 19:12:02 +0800
Subject: No Subject
Message-ID: <199710181050.DAA15965@sirius.infonex.com>



Timmy C. Mayonnaise carries a turd in his 
wallet for identification purposes.

      n  ___  n
      H /. .\ H Timmy C. Mayonnaise
     nHnn . nnHn
    
    /  /\___/\  \






From ravage at ssz.com  Sat Oct 18 06:46:04 1997
From: ravage at ssz.com (Jim Choate)
Date: Sat, 18 Oct 1997 21:46:04 +0800
Subject: OUBAKAYAROU!! (fwd)
Message-ID: <199710181407.JAA02154@einstein.ssz.com>



Forwarded message:

> Date: Fri, 17 Oct 1997 18:25:39 -0700
> From: Bill Stewart 
> Subject: Re: OUBAKAYAROU!!
> 
> Meanwhile, there is a cypherpunks-j at htp.org, in Japanese,
> and there's probably still a cypherpunks-e at htp.org in English, 
> though the last time I checked it, it had been 
> mostly a mirror for the cypherpunks list with almost no independent content,
> and its mail gateway broke badly and splattered all over its subscribers.

What is your problem Bill regarding cypherpunks-e you've made accussatory
comments regarding that list a couple of times now? It is simply another
member of the CDR just like SSZ or algebra.com - is your claim that each of
these has their own indipendant content? If so, catch a clue and realize
they don't unless their broke somehow and quit forwarding. If somebody on
cypherpunks-e submits something it gets gatewayed through SSZ (and hopefuly
others by now) just like traffic from one of the other member remailers. I
wanted to gateway cypherpunks-j as well but we decided folks might get
confused if there were something other than english on here. And
considering both the -e and -j are in Japan, new, and relatively
unadvertised does it really suprise you that they don't have a lot of English
based traffic from that end?

You must be the one(s) who keeps subscribing and unsubscribing to the 3 US
remailers from a variety of (forged?) aliases in the hopes of carrying on the
'moderation experiment' meme. Or perhaps your hope is to catch one of us
down and claim we're filtering because the traffic didn't show up from three
different sources. I can't speak for the other CDR operators but I can say
that SSZ cache's all mail originating on this end and sends it out to the
other remailer sites as soon as we come back online. So nothing gets missed
from SSZ. My internet provider is supposed to be cache'ing incoming mail
to SSZ if we go down and I hope the other remailers also cache their mail
as well. If not, oh well, I 'm not going to miss any sleep over it.

Just in case you missed it the other day, I believe Igor has started
gatewaying a new remailer as well because I saw a 'Test' message from a
cypherpunks mailing list I didn't recognize as one of the known remailer
hosts. If so that means we're at 5 remailers in the network. One of them in
Japan, which meets at least one of our goals to get a remailer node outside
the US. This is a GOOD thing.

My offer to gateway the CDR to any site that requests the subscription
stands. So, if you are operating a remailer with only a single feed point
and that point is not currently SSZ please send me email and I'll add your
site to my re-send list. As to cypherpunks-e, one of the other CDR sites
should consider adding them to their re-send/subscription list.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http:// www.ssz.com/  |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|


ps Regarding SSZ's downtime yesterday, at this point don't have a clue
   why the system crashed without warning and then cored when it came
   back up. Once I got home and did a hard reboot it has worked without
   a glitch. Though we still have intermittent droppages of the ISDN
   link lasting 1-5 minutes. I have turned in another trouble call to
   SWBT in the hopes of them fixing it. That makes the 5th ISDN
   trouble ticket in 4 weeks. I think SWBT gets lonely if I don't call
   them at least once a week or else their field folks really have
   forgotten how to write...






From emailing at tnlb.com  Sat Oct 18 22:33:02 1997
From: emailing at tnlb.com (emailing at tnlb.com)
Date: Sat, 18 Oct 1997 22:33:02 -0700 (PDT)
Subject: $1,000,000 For Christmas
Message-ID: <199710190532.WAA12728@toad.com>


Just in Time For Christmas -

$1-Million Dollar Bills - Look Like The Real McCoy

Super Gift For the Hard-To-Shop-For on Your Christmas Shopping List 

Great Stocking Stuffer

Only $5.00 each - Three For $10.00 

To Order, Call 317-885-1357

Visa & MC Accepted.


*Dealer Inquiries Welcome


 If you wish to be removed from future mailings, please reply 
with the subject "Remove".





From ravage at ssz.com  Sat Oct 18 07:34:09 1997
From: ravage at ssz.com (Jim Choate)
Date: Sat, 18 Oct 1997 22:34:09 +0800
Subject: ISDN status - Intermittent (fwd)
Message-ID: <199710181457.JAA02272@einstein.ssz.com>



Forwarded message:
>From ravage at ssz.com Sat Oct 18 09:57:09 1997
From: Jim Choate 
Message-Id: <199710181457.JAA02252 at einstein.ssz.com>
Subject: ISDN status - Intermittent
To: users at ssz.com (SSZ User Mail List)
Date: Sat, 18 Oct 1997 09:57:08 -0500 (CDT)
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Content-Length: 1548      


Hi,

Just talked to SWBT and they apparently show the ISDN line as disconnected.
Upon further digging at my request they determined that indeed there had
been some sort of cable throw yesterday. They issued me a trouble ticket
number and will check the line. Considering the intermittent nature of the
drop my suspicion is a bad punch-down. If this is so we should see the line
stabalize sometime this afternoon.

More as I learn it.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http:// www.ssz.com/  |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From newsglob at tnlb.com  Sat Oct 18 23:33:42 1997
From: newsglob at tnlb.com (newsglob at tnlb.com)
Date: Sat, 18 Oct 1997 23:33:42 -0700 (PDT)
Subject: Very important ! global minutes?
Message-ID: <199710190633.XAA13009@toad.com>


     MAKE SURE YOU ARE GETTING ALL THE MINUTES BEING
                       GENERATED TO YOUR NUMBERS
                           NOT JUST U.S. TRAFFIC!!   

 CHAT LINES FOR YOUR SITE OR ADVERTISE IN NEWSPRINT

Best customer service for your audiotext advertising needs.
Fill out the form here:   http://www.stsim.com/mdc/info/home.html
 Don't just stick with one service bureau ! you might not be getting 
 paid for all your global minutes ,most service bureaus are paying
you just for your U.S. traffic and keeping the rest this is how 
service providers make the most of their profit.

                  

PAYOUTS ARE ON THE 1st  AND ON THE 15th OF  EVERY MONTH.....

NUMBERS MUST BE DISPLAYED ON YOUR FRONT PAGE FOR BEST
RESULTS!!!!


      Top rates for 011- 592 / 1- 664 / 1- 809 / the international
      pay-per-call industry is bringing in millions upon millions each
      year.   Get in on the the 1+ dialing prefixes and watch your
     revenue increase.   Advertise by mass emailing, tv, web site,
     newsprint, magazine in any country!!!!  You the advertiser will
     get a flat rate paid to you for every minute generated on your
     line(s).  Your ad could look something like this.

           --------------------------------------------------------------------------------------------------------------
           The internet's all new interactive date line talk to people live
           or just listen in call now!  1-664-410-3348  Regular Long Distance Only.
          ---------------------------------------------------------------------------------------------------------------
          Talk to Hot Ladies Now!  1-644-410-3349.
          ---------------------------------------------------------------------------------------------------------------
          People looking to meet people call now  1-664-410-3350.
          ---------------------------------------------------------------------------------------------------------------





From kent at bywater.songbird.com  Sat Oct 18 09:35:32 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Sun, 19 Oct 1997 00:35:32 +0800
Subject: Is PGP still private?
In-Reply-To: <3.0.3.32.19971017170704.009de630@mail.pgp.com>
Message-ID: <19971018092636.45297@bywater.songbird.com>



On Sat, Oct 18, 1997 at 08:48:56AM +0100, Adam Back wrote:
> 
> Jon Callas  writes:
[...]
> 
> My reasoning is this: as PGP Inc can not justify expense on such
> developments, my CDR proposal would be much safer for them to
> implement because it requires no steganography support, or other
> privacy patches to provide protection against abuse of the software
> for uses other than PGP Inc's designers intentions.

You keep talking as if your CDR proposal is other than vaporware.  So 
far as I have seen you don't have a proposal, you have a wish.

[...]

> > You are in error. The only time that you are forced to use CMR is when (1)
> > you share the CMRK with the other party AND (2) the strict flag is set. In
> > all other cases, you can opt-out, on a message-by-message basis.
[...]
> However I simply posit that if you live in a scenario where everyone
> you would like to communicate is forced to operate under your
> combination: for example the local laws state all businesses and ISPs
> insisting that they use pgp5.5 policy enforcer and turn on strict
> flag.
> 
> This possibility seems to be being discounted as unrealistic, or at
> least as being optional, because you can by pass it.

It does seem rather unrealistic.  It would essentially involve
replacing the entire email infrastructure, at a significant cost, and
a rather sweeping suite of further laws that restrict the use of
encryption to only PGP, forbid me running sendmail on my linux box,
etc, etc

> I can not see that being able to by pass it helps you in my scenario
> if a) you will be detected when you do bypass it because the law
> enforcers will discover they can't recover plaintext;

This implies a law against using any other form of crypto, period.  
If such a law is passable the exemption for PGP's protocol will 
really be immaterial.  That is, Yes, under an extremely draconian 
regieme, extremely draconian things are possible.

"Tinpotdictatorsville" is not a useful counterexample, because the 
TPD can mandate anything, including no use of crypto at all.

> and b) you have
> a "choice" of not being able to communicate with anyone, because in
> practical terms you have a need to communicate. 

Implies that *all* other forms of communication have been outlawed.  
Completely unrealistic.

Adam, it is a complete and utter waste of time to debate this. 

What would *not* be a waste of time would be more concrete proposals.  
Whether PGP implements something is a separate question -- I would 
like to get back to the question of designing a better email 
encryption system.

Your reencryption scheme fails because of the management of the short
term encryption keys, among other things.  Here's another approach I
will toss out, without thinking through:

How about formalizing superencryption, or tunneling? That is, treat
CMR traffic as a transport medium for messages that are themselves
already encrypted.  The "key" idea here is to allow layering of non
CMR traffic over CMR traffic.  All the code for both is obviously
already in PGP, with a little glue and perhaps some minor protocol
mods...

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From tcmay at got.net  Sat Oct 18 10:08:54 1997
From: tcmay at got.net (Tim May)
Date: Sun, 19 Oct 1997 01:08:54 +0800
Subject: OUBAKAYAROU!!
In-Reply-To: <19971017080829.27590.qmail@hotmail.com>
Message-ID: 



At 6:25 PM -0700 10/17/97, Bill Stewart wrote:
>At 01:08 AM 10/17/1997 PDT, Nobuki Nakatuji wrote:
>>>Tim May (tcmay at got.net)
>>>Wed, 15 Oct 1997 22:11:09 -0700
>>>At 9:18 PM -0700 10/15/97, Nobuki Nakatuji wrote:
>>>Where are another cypherpunk mailinglist ?
>>>
>>>Am another cypherpunks mailinglist at cyperpunk at dev.null.
>>>You go there, chop chop.
>>>You not talk about Misty here anymore, OK? We am tired hering about
>>>Misty and your fees.
>>>
>>>--Tim-san
>
>Tim, was that you writing, or was that TotoMonger forging you again?
>I agree that there are problems with Misty, but it's
>no more annoying than some of the other flaming on the list,
>and certainly less so that Dmitri Vulis and his tentacles.

My ire at "Nobuki Nakatuji" comes less from his broken English (which is no
doubt several orders of magnitude better than my broken Japanese) than from
his repeated trollings of the list to send him money for more details.

Also, he has never engaged in any discussion, broken English or not. I have
begun to surmise a 'bot is at work.

He or she or it may not even be Japanese, of course. The hotmail account is
well-known for throwaway accounts (even remailers).

(Searches on his name reveal no Usenet posts under his name, "Nobuki
Nakatuji," and no presence on the Web save for Cypherpunks archives. The
"hotmail" domain name, and the "bd1011" adds to my suspicion that this
person is trolling. If people send him money, all the better for him. I say
burn him.)

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From whgiii at invweb.net  Sat Oct 18 11:20:00 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Sun, 19 Oct 1997 02:20:00 +0800
Subject: Freeh letter to NYT
In-Reply-To: <3.0.1.32.19971017124121.0069d8d0@mail.cruzio.com>
Message-ID: <199710181814.OAA26563@users.invweb.net>



In <3.0.1.32.19971017124121.0069d8d0 at mail.cruzio.com>, on 10/17/97 
   at 12, Roger Schlafly  said:



>How can he say this with a straight face?

>>In fact, what we proposed requires two orders from a judge
>>before we proceed, not just one as now required.

>The DOJ proposal, sect 302, says:

>  (A)  A Key Recovery Agent, whether or not registered by the Secretary 
>  under this Act, shall disclose recovery information stored by a person:
>     (1)  ...; or
>     (2)  to a law enforcement or national security government agency
>     upon receipt of written authorization in a form to be specified by
>     the Attorney General.

>It also contradicts his final sentence:

>>... some workable solution can be found to insure that law enforcement can
>>gain immediate access to the plaintext of encrypted criminal communication
>>or electronic data that we have lawfully seized.

>The term "immediate access" means without having to goto a judge.

I find the term "encrypted criminal communication" rather intresting.
Exactly how does on know if a certian communication is crimminal unless
one decrypts it and reads it?? Or is this yet another example of "guilty
until we are forced to admit that you are not" type of logic followed by
the LEA's in this country.

Quote of the Day: "Happiness is seeing Louis Freeh's picture on a milk
carton"

-- 
---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
---------------------------------------------------------------






From whgiii at invweb.net  Sat Oct 18 11:37:58 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Sun, 19 Oct 1997 02:37:58 +0800
Subject: Non-conventional
In-Reply-To: <199710171449.QAA09086@basement.replay.com>
Message-ID: <199710181814.OAA26560@users.invweb.net>



In <199710171449.QAA09086 at basement.replay.com>, on 10/17/97 
   at 04, nobody at REPLAY.COM (Anonymous) said:

>Tim May implied that Cpunx should develop non-conventional email. Crypto
>has been declared to be munitions.
>Nukes are non-conventional weapons.
>Should we be developing nuclear email?
>Should we 'email-nuke DC?"

I'm not fussy, standard nuke of DC will work just fine. :)

-- 
---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
---------------------------------------------------------------






From jya at pipeline.com  Sat Oct 18 11:44:49 1997
From: jya at pipeline.com (John Young)
Date: Sun, 19 Oct 1997 02:44:49 +0800
Subject: Junger Motion and Brief
Message-ID: <1.5.4.32.19971018182339.00c2fad0@pop.pipeline.com>



Thanks to Peter Junger et al we offer his latest Motion
for Summary Judgment and Supporting Brief outlined
in the Thursday press release:

  http://jya.com/pdj4.htm  (88K)







From aba at dcs.ex.ac.uk  Sat Oct 18 14:29:21 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sun, 19 Oct 1997 05:29:21 +0800
Subject: Security flaws introduced by "other readers" in CMR
In-Reply-To: <3.0.2.32.19971018025454.03e23124@pop.sirius.com>
Message-ID: <199710181953.UAA00908@server.test.net>




Greg Broiles  writes:
> Adam Back writes:
> >You have a dual concern: you are trying to protect against big brother
> >and against little brother.
> 
> At the technical level, is there a meaningful difference between the
> brothers? 

I think so yes.  I think I am able to demonstrate situations where
there is a trade-off: you can trade government resistance against
little brother resistance.

PGP Inc's CMR I believe is a form of this; they have nice
recommendations for companies, statement of intents for plaintext
handling, and transparent statements of when email is a company
recoverable email address.

But way that they have implemented this functionality I believe could
be perverted for uses other than their intentions by governments.

I think this means that the resulting system has traded off weaker
government resistance to acheive marginally stronger little brother
resistance.  (I may even say no stronger little brother resistance, I
think CDR can acheive same functionality).

The best example I can think of is France.  Other governments (US/UK)
people say: it'll never happen; tin pot dictator scenarios people are
less worried about because they feel the dictator will do unreasonable
things in any case.

The situation in France is: currently (or recently) you could not use
encryption at all without a license.  The enforcement rate is low to
zero.  (Jerome Thorel interviewed the head of SCSSI (NSA equivalent),
and they said that if you asked for a license for personal use they
would say "no", but if you didn't bother asking and used PGP2.x
anyway, they wouldn't do anything about it typically).

Now I understand the French have switched position: you can use
encryption without a license *provided* that it has master key access
for the government.

Lets say then that our aim is to design the OpenPGP standard and the
pgp5.5 implementation to be as resistant to use by the French
government as possibe.

With the pgp standard as is french government could insist that people
use pgp5.x.  pgp5.x provides a reasonablly useful framework for the
french government to adapt to be used as a master access system.

Because this will then be explicitly allowed, more people are likely
to use it.  (Current people using pgp2.x illegally are one suspects
the french cypherpunks subset of the population).  This means that the
french government can start to ramp up enforcement as there are less
objections (you _can_ protect confidentiality for business and privacy
uses, use this: pgp5.x).

If on the other hand pgp5.x were to use only single recipients for
confidentiality, and to base company recovery of encrypted mail
folders on key recovery information stored locally alongside the
mailbox the system would be less useful to the french government.

> Aren't we really talking about third-party access to communications,
> and second-party access to stored data ... with the "brother"
> distinction being one made at a social/political level, as a
> judgement about the legitimacy of the access or the size of the
> actor, rather than the character of the access?

It is more than that I think.

This is because many people acknowledge legitimacy of companies to a)
encrypt data b) to recover data in case employee forgets keys, or dies
unexpectedly.

Second party access to stored data is much less scary.  Little brother
can ultimately read _everything_ you do at work.  If he gets
suspicious he can install keyboard logger, keyboard password sniffer,
or concealed videocam whilst you are out of the office.  The best we
can do is discourage little brother from abusing systems designed for
data recovery as mass communications snooping.  The best suggestion I
have seen for this so far was Bill Stewart's suggestion to only store
recovery info for some of the bits.  Make the recovery process
artificially slow: say 40 bits.  Worth it for recovering main
developers design notes made in email when he dies unexpectedly.  Some
hinderance to little brother unless he is determined.  As long as this
hinderance is similar scale to other similar things little brother
could do to check up on suspicious user, you have achieved your goal
of hindering little brother.

Big brother is hindered very significantly if you do recovery locally,
rather than on the communications link as PGP Inc CMR does.  This is
because big brother does not have access to the ciphertext on disks.
He must come and take them.  Whereas for communications he can
practically acheive access to your email ciphertext at push button
convenience.

Your email communications are already secret split with the NSA: the
data is split into to unequally sized halves: the _key_ and the
_ciphertext_.  For this reason you really don't want the NSA to get
that key.

For data storage recovery, your data is again in two halves: you have
one, the _key_, your employee/you have the other, the _ciphertext_ on
disk.  Your employee can recover that info anyway.  The NSA can't
easily.  It is much more logistically expensive to collect or randomly
sample disk contents.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710182117.WAA01016@server.test.net>




Bill Stewart  writes:
> > [separate signing and encryption keys]
> 
> On the other hand, if the keys are separate, Louis Freeh
> can tell the Congress that it's not a big problem,
> he'd NEVER dream of GAKing your signature keys,

Valid argument with some value yes.  Actually now that you bring it up
I dimly remember this aspect being raised on cypherpunks some time
back.  Perhaps it was you who raised it even.  Or perhaps it was Phil
Karn, or someone.

> Similarly, your corporate security bureaucrats can understand
> the concept that if they CAK your privacy keys,
> they're risking having official company signatures get forged,
> and they'll often do the right thing and desist,
> but with separate keys that won't stop them.

Hmmm.  I think that if companies start encrypting anything, they're
going to need recovery of some sort.  Else they just won't use it at
all.

Most of them aren't using storage encryption right now anyway, which
is why Tim May's suggestion to store emails after decrypt in the clear
makes a lot of sense as a simple interim way out of this problem until
the issues have been explored more.

This largely avoids company requirement to recover emails.

One valid objection to this approach is that if the employee forgets
their password whilst there are lots of emails queued up to receive
that those emails will be lost.  Or if the employee gets hit by a
truck.

However I'm not so sure this is a big deal for a number of reasons:

1. how often do employees get hit by trucks?
2. how often do employees forget passwords? (all the time unfortunately)
3. things which are important the sender is likely able to resend because
   he has in clear on disk
4. senders using the same software can have archives of what they have sent
   and easily able to resend.

> >Does pgp5.0 reply encrypting to just me as individual, or two crypto
> >recipients me, and Mega Corp recovery key?
> Just you.

If you are right, it will bounce when it hits an enforcer with the
strict setting turned on.

Is this what will happen?

This will mean that the users will have to manually figure out how to
solve (get enforcer key, multiple encrypt to that key, possibly by
cc'ing to enforcer email address/userID even if this bounces).

> >It is evil.  But it is not _as_ evil.
> >
> >The reason for this is that government access to storage keys is not
> >as evil as government access to communications keys, because the
> >government has to come and capture the ciphertext (take your disk),
> >whereas with communications they can grab them via an arrangement with
> >your ISP.
> 
> First of all, the only reason for having a CMRK attached to your key
> is that either your mail service will reject mail to you that doesn't
> contain it, or your employer insists on it.  In either case,
> it can be done without a special CMRK field on your key --
> PGP multiple recipients are enough to do that, and the sender
> just has to remember to include the (no longer automagically attached) CMRK.
> So leaving out the CMRK doesn't protect you.

Lack of automation is some weak protection.  What are users to do?
Send Cc: .  What if they forget?  Much more
plausible to forget.  Makes strict penalties for forgetting difficult
in western countries.  5 years jail time for forgetting?  Don't think
so.

What about the traffic?  If you make it an invalid address, just to
pick up the key it'll flood email systems with bounces; every single
encrypted mail will get a bounce.

Not an overwhelming protection, but may mean more people will more
resist it, and more people will forget often with the current email
MUA deployed base.

With many people using CMR based pgp5.5, forgetting will be much less
plausible.

Putting in CMR encourages adoption of this kind of filtering/bouncing
approach.

I am interested in analysis and discussion of the level of
significance this difference makes to user uptake of GAK in say the US
as an example (say some time in 1998 when many more businesses and
individuals have upgraded to pgp5.x).  What differences are there in
resistance between a pgp5.5 using CMR and with a pgp5.6 using CDR (or
storage-CAK as Bill terms the approach)?

> Second, if the government is coming to get your disk anyway,
> they can get themselves a court order to have you reveal the key,
> and you can argue with the judge about whether you should be
> compelled to reveal it, and at least in the US there's a 
> Fifth Amendment backing up your arguments (though like the
> other amendments, it's weakened by the "except for drugs" clause...)

Yes.  This is the kind of reason I argue that storage recovery is less
dangerous than communications recovery.  They've got to get the disk
first.  And they can't tell if you have used GAK until they get it;
when they get it if you're suspecting they will try this, you will
ensure there is no GAK access, you will use other software, as you
have nothing to lose.

> GAK asserts that the government has the right to your keys
> before you get to court.  

Well that is the scenario that Freeh is arguing for yes.  Faced with a
choice of giving him your comms keys or your storage keys, I'd go for
storage keys anyday.  I can lie to him, and give him some random
numbers and he'll never know.  The point at which he will know will be
after the dawn raid; if it gets to dawn raids you are indendently in
trouble anyway.

> On yet another hand, while it may be obvious when the government
> steals your disk and uses Storage-GAK, companies using Storage-CAK
> or Storage-CMR can use it just as well on the backup tapes without
> your notice as on your disk drive.  Furthermore, you can think of
> the data backup process as communications from you to the
> backupmeister, so Storage-CAK _is_ Message-CAK, and Storage-CMR is
> Message-CMR.

Technically yes.  Practically no, there is a large difference.  The
extra protection of Storage-CAK method is the extra GAK resistance due
to the fact that availability of access to communications is patchy,
and more expensive for the government to achieve, and enforcement is
patchy, even detection is patchy.  This patchiness is good.  Mass
keyword scanning is impossible on a wide scale.  The government can
keyword scan some of you, but they can do that already at similar cost
levels: they can plant bugs, have undercover federal investigator
inflitrate your company in guise of employee etc.  The aim of the game
is to make the cost higher than existing physical attacks, or at least
as high as possible.

> But CAKing the disk doesn't protect the company's information,
> and there's therefore no excuse for using it.  

Surely it does?

If you are in ACME Corp and they want all disks encrypted as a
security policy.  They provide smart cards to employees, and
workstations data is inaccessible until correct smart card is
inserted.  Employee lets dog chew on smart card.  No recovery implies
that this data is irretrievably lost.

> Superencryption is always possible, in messages as well as files,
> but with message encryption the eavesdropping-prone corporation can
> detect superencrypted messages going by (though not stego'd), while
> PGP-encrypted files on your disk only show up _after_ you've been
> hit by the bus on your way to the headhunter's.

This is good.  Both systems are hackable from all three directions.
(individuals can hack around system to increase privacy; corporations
can hack around to decrease privacy (keyboard sniffer); governments
can too by walking in and taking disks and threatening people fail
time for not handing over keys.)  Many aspects of this are better with
storage data recovery than they are with communications recovery.
Especially government aspects.  Company aspects are almost neutral
non-issue in my mind due to ease with which company can remove your
privacy as they own machines, and can do all sorts of things to your
software, hardware, video cam, bug phone, keyboard sniffer, keyboard
log, etc.,etc.

> BTW, PGP5.5 CMR _is_ CMR'd storage encryption.  
> It's not as convenient as encrypted file systems 
> like PGPdisk and Secdev, 
> but people are using it to encrypt stored data,
> including email and non-email files.

Yes.  pgp5.0 which I looked at windows version (available on
ftp://ftp.replay.com/ (netherlands) somewhere for other non-US
people), does file and email encryption.  As does linux version.

> On a technical note, GAK for storage can be made less dangerous,
> though not less offensive, by adding a layer of indirection -
> use your public key to encrypt a symmetric key, store the encrypted
> symmetric key on your disk, and then use the symmetric key for
> encrypting the storage (or as a master key for encrypting the
> per-file or per-block storage keys, if you're doing that, 
> which you probably should.)  This means that a search warrant
> which is required to itemize the things it's looking for can be
> more effectively restricted to specific files rather than
> cracking the whole disk and every other disk that uses the
> same encryption keys.

Good point.

> >The point though is that storage recovery is a completely separable
> >issue from communications "recovery" which is a euphamism for allowing
> >companies to read, or snoop, employees email, unless it is being used
> >soley for data recovery of mail stored in mail folders (which seems to
> >be what PGP Inc means by CMR term), in which case it is not necessary
> >functionality, and can be better acheived by encrypting the mail
> >archive with a user symmetric key with company storage recovery on
> >that key.
> 
> Trust me - you _really_ don't want mailboxes encrypted,
> recovery key or no recovery key, unless it's implemented very very well.

PGP Inc does use this otherwise there would be no argument about need
for recovery information -- you don't need recovery information for
plaintext.

> [100Mb mail folder corruption nightmares]

Your example of corruption problems with large mail boxes is one
argument against this practice.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



   CNN logo 
   Navigation 
   
   Infoseek/Big Yellow 
   
   
   Pathfinder/Warner Bros 
   
   
   
   
   Main banner Barnes & Noble. Win a Trip! Click here to enter. rule
   
                 FBI HIRES NUCLEAR PHYSICIST TO HEAD CRIME LAB
                                       
     FBI crime lab October 18, 1997
     Web posted at: 2:27 p.m. EDT (1827 GMT)
     
     From Correspondent Terry Frieden
     
     WASHINGTON (CNN) -- The FBI hired the former head of a government
     nuclear weapons laboratory to direct its troubled crime lab, even
     though he has no background in forensic science.
     
     The FBI had promised to seek an experienced crime lab scientist from
     outside the government following a stinging Justice Department
     report on the lab last spring.
     
     But the man chosen for the post is Donald M. Kerr Jr., 58, a
     physicist-engineer who from 1979 to 1985 headed the government's Los
     Alamos National Laboratory, where nuclear weapons are designed.
     
     The FBI acknowledged that Kerr's selection after the National
     Whistleblowers Center disclosed his name at a news conference
     Friday.
     
     "It just seems dumbfounding and implausible that they would not hire
     a world-class forensic scientist to take over the crime lab," center
     Director Stephen Kohn said.
     
     The selection also was criticized by the National Association of
     Criminal Defense Lawyers.
     
     "Once again, the FBI has dealt with Congress and the public with
     incredible arrogance," said the group's vice president, William
     Moffitt.
     
     Federal Bureau of Investigation officials defended the hiring of
     Kerr, saying he is the renowned scientist the agency was looking for
     to beef up its crime lab.
     
     "He has vast experience in managing large lab operations and a long
     track-record of successfully revitalizing labs," an FBI source told
     CNN.
     
     A formal announcement of Kerr's hiring is expected Tuesday.
     
  'This is not somebody from the outside'
  
     FBI building
     
     Kris Kolesnik, senior counselor to Sen. Charles Grassley, R-Iowa,
     one of the harshest critics of the FBI, said Kerr's work at Los
     Alamos and more recently for a major defense contractor make him a
     "real government insider."
     
     "This is not somebody from the outside who's going to bring a fresh
     breath of air," Kolesnik said.
     
     Justice Department Inspector General Michael Bromwich blasted the
     world-renowned crime lab in April for flawed scientific work and
     inaccurate testimony in major cases, including the Oklahoma City
     bombing. Bromwich called for a new lab director with a scientific
     background "preferably in forensic science."
     
     Meanwhile, another flap over the crime lab erupted Friday when chief
     lab whistleblower Frederic Whitehurst said that in examining FBI lab
     reports recently released under the Freedom of Information Act, he
     found that five more FBI examiners had altered lab reports.
     
     "In the last week, I have found five more people that have been
     altering cases -- five more that the inspector general didn't find,"
     Whitehurst said.
     
    
   rule
   
  Related stories:
     * Official: FBI lab criticism will prompt case challenges - April
       16, 1997
     * Judge may force agency to uncloak FBI lab report - March 7, 1997
     * Top official admits 'serious' problems at FBI lab - January 30,
       1997
       
  Related sites:
  
     Note: Pages will open in a new browser window
     * Federal Bureau of Investigation
          + FBI Lab
     * Los Alamos National Laboratory
     * US Dept. of Justice - Office of Inspector General Report on FBI
       Labs - April 1997
       
     
     
     External sites are not endorsed by CNN Interactive.
     
   
     _________________________________________________________________
   
   Infoseek search ____________________ ____  ____
   
     _________________________________________________________________
   
   
   rule Message Boards Sound off on our
   message boards
   
   You said it... [INLINE] Barnes & Noble. Win a Trip! Click here to
   enter. rule
   To the top 
   
   � 1997 Cable News Network, Inc.
   All Rights Reserved.
   
        Terms under which this service is provided to you.






From bromage at cs.mu.oz.au  Sat Oct 18 14:32:40 1997
From: bromage at cs.mu.oz.au (Andrew Bromage)
Date: Sun, 19 Oct 1997 05:32:40 +0800
Subject: Is PGP still private?
In-Reply-To: <19971018092636.45297@bywater.songbird.com>
Message-ID: <199710182122.HAA24989@mundook.cs.mu.OZ.AU>



G'day all.

Kent Crispin wrote:

> Your reencryption scheme fails because of the management of the short
> term encryption keys, among other things.  Here's another approach I
> will toss out, without thinking through:
> 
> How about formalizing superencryption, or tunneling? That is, treat
> CMR traffic as a transport medium for messages that are themselves
> already encrypted.  The "key" idea here is to allow layering of non
> CMR traffic over CMR traffic.  All the code for both is obviously
> already in PGP, with a little glue and perhaps some minor protocol
> mods...

If we start considering that, could I suggest making the system
_completely_ flexible?

The sort of things I'm thinking of include:  Allow any object to be
encrypted using conventional encryption (including conventional
encryption keys) or signed, allow any conventional encryption key to
be public-key encrypted or split, conjunction/disjunction of two
conventional keys, etc.

Disadvantages:

	- Greatly complicates the decryption process.  In particular,
	  decrypted streams must be fed back into PGP.

	- Difficult for an end-user to specify what combination of
	  features they want.

	- This working group would be around for years arguing about
	  details. :-)

Advantages:

	- Allows PGP to be used for lots of things that we haven't
	  thought of yet.

	- File format could be considerably simplified, if we could
	  scrap the old format.  (Unrealistic, but what the hell.)

Cheers,
Andrew Bromage






From tm at dev.null  Sat Oct 18 14:37:58 1997
From: tm at dev.null (TluthMonglel)
Date: Sun, 19 Oct 1997 05:37:58 +0800
Subject: CPUNK Thread from the East / (Was: The Yarrow Man Ass) / (Was: You Go Away! Bother ROUND EYE CypherPunks. Chop, chop!) / (Was: TORA! TORA! TORA!...DC) / (Was: OUBAKAYAROU!!)
In-Reply-To: <199710181407.JAA02154@einstein.ssz.com>
Message-ID: <34492697.DEB@dev.null>



Jim Choate wrote:
> > From: Bill Stewart 
> > Subject: Re: OUBAKAYAROU!!
> >
> > Meanwhile, there is a cypherpunks-j at htp.org, in Japanese,
> > and there's probably still a cypherpunks-e at htp.org in English,
> > though the last time I checked it, it had been
> > mostly a mirror for the cypherpunks list with almost no independent content,
> > and its mail gateway broke badly and splattered all over its subscribers.
 
> What is your problem Bill regarding cypherpunks-e you've made accussatory
> comments regarding that list a couple of times now? It is simply another
> member of the CDR just like SSZ or algebra.com - is your claim that each of
> these has their own indipendant content? If so, catch a clue and realize
> they don't unless their broke somehow and quit forwarding. If somebody on
> cypherpunks-e submits something it gets gatewayed through SSZ (and hopefuly
> others by now) just like traffic from one of the other member remailers. I
> wanted to gateway cypherpunks-j as well but we decided folks might get
> confused if there were something other than english on here. And
> considering both the -e and -j are in Japan, new, and relatively
> unadvertised does it really suprise you that they don't have a lot of English
> based traffic from that end?

Jim,
  Bill merely recognizes that the creation of both an English and a
Japanese CPUNKZ Distributed Mailing List is a sly trick of devious
oriental minds.
  I am somewhat of an expert in International & Foreign Affairs, 
particularly in terms of the Orient, since I eat at a lot of Chinese
restaurants, in Canada. (I am not certain if Chinese and Japanese eyes
slant in the same direction, but I'm sure that the basic principles
apply to both, nonetheless.)

  For starters, have you ever noticed that Chinese people usually take
your food order in broken English, and then go into the kitchen and
give the cook orders in Chinese?
  This is because they are plotting to poison you, Jim.

  Most Canadians know this, and we eat a piece of the fortune cookie
supplied at the end of the meal, since it contains an antidote to the
poison that enables Chinese people to lure their Round Eyed friends
into the restaurant by eating with them, and then take the antidote
by eating part of their fortune cookie.
  The Chinese mask the true nature of this deception by putting some
meaningless Confucian tripe-message inside, such as "Patience comes
to those who wait." The unsuspecting read the message and discard the
cookie containing the antidote to the poison.
  This is why we see so many American tourists go into our Chinese 
restaurants, and so few come out. (Except maybe inside the stomachs 
of Canadians.)

> You must be the one(s) who keeps subscribing and unsubscribing to the 3 US
> remailers from a variety of (forged?) aliases in the hopes of carrying on the
> 'moderation experiment' meme.

  You are correct about this, and Bill reports that he has noticed 
nothing suspicious, proving what a sly bunch of devils you really are.
  Every paranoic knows that, when you look out the window and don't see
anybody out there watching you...you are up against pros.

> Just in case you missed it the other day, I believe Igor has started
> gatewaying a new remailer as well because I saw a 'Test' message from a
> cypherpunks mailing list I didn't recognize as one of the known remailer
> hosts. If so that means we're at 5 remailers in the network. One of them in
> Japan, which meets at least one of our goals to get a remailer node outside
> the US. This is a GOOD thing.

  Sure. We got the Commies on one side of us, the Japs on the other 
side.
                 WAKE UP CPUNX AMERICA!
  The Yarrow Man-Ass is massing remailers along the Japanese-US border.
(The Pacific Ocean) They have the Tokyo Rose (cypherpunks-e) list in
place, to spread their propaganda among our troops.
  The Commies have infiltrated the CPUNDITS Distributed Remailer system.
Igor's secret agenda is to translate 'Distributed' into "From each, as
he is able...to each, according to his need."
  Do you think that Commie-ratfucker, Igor Chewed-Off is filtering out
the duplicate messages for OUR benifit? It's the same-old-same-old, with
those at the top hoarding the messages and letting a few trickle down
to the subscribing masses, to keep us from being revolting.
  The CDR Czars keep all of the good messages for themselves, and let 
the rest of us have just enough messages to survive. Ever try to get
a message from the list at 4 a.m.? They are few and far between. Even
when you create your own message and send it to the list, the CDR List
Masters force you to share it with everyone else.
("Who will help me write the message, said the Little Red Hen?")

> My offer to gateway the CDR to any site that requests the subscription
> stands. So, if you are operating a remailer with only a single feed point
> and that point is not currently SSZ please send me email and I'll add your
> site to my re-send list. As to cypherpunks-e, one of the other CDR sites
> should consider adding them to their re-send/subscription list.

  Sure, Jim, add a few Mexican sites, why don't you?
  Have you 'forgotten' the Alamo, Jim? Shame. Shame.
 
TluthMonglel
"I eat dogs."






From aba at dcs.ex.ac.uk  Sat Oct 18 14:39:22 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sun, 19 Oct 1997 05:39:22 +0800
Subject: jurisdictional interactions (Re: Is PGP still private?)
In-Reply-To: <19971018092636.45297@bywater.songbird.com>
Message-ID: <199710181905.UAA00883@server.test.net>




Kent Crispin  writes:
> On Sat, Oct 18, 1997 at 08:48:56AM +0100, Adam Back wrote:
> > 
> > Jon Callas  writes:
> [...]
> > 
> > My reasoning is this: as PGP Inc can not justify expense on such
> > developments, my CDR proposal would be much safer for them to
> > implement because it requires no steganography support, or other
> > privacy patches to provide protection against abuse of the software
> > for uses other than PGP Inc's designers intentions.
> 
> You keep talking as if your CDR proposal is other than vaporware.  So 
> far as I have seen you don't have a proposal, you have a wish.

I have described the CDR proposal in some detail, and have been able
to counter all arguments raised against it.

It is vaporware, but there are people who are offering to implement it
as an extension to systemics PGP capable library as a demonstrator for
the OpenPGP standardisation process to show how it would work in
practice.

You do have a point in that I should collect my arguments and write a
paper describing the tradeoffs.  I am in the process of doing this,
and will be interested in yours and others comments on this proposal.

> > However I simply posit that if you live in a scenario where everyone
> > you would like to communicate is forced to operate under your
> > combination: for example the local laws state all businesses and ISPs
> > insisting that they use pgp5.5 policy enforcer and turn on strict
> > flag.
> > 
> > This possibility seems to be being discounted as unrealistic, or at
> > least as being optional, because you can by pass it.
> 
> It does seem rather unrealistic.  It would essentially involve
> replacing the entire email infrastructure, at a significant cost, and
> a rather sweeping suite of further laws that restrict the use of
> encryption to only PGP, forbid me running sendmail on my linux box,
> etc, etc

I fail to follow your argument.  Could you explain further?  I am very
interested in discussion of the realism of scenarios for ways that GAK
might be enforced in various types of regimes examples being perhaps:

- Singapore hi-tech, but somewhat authoritarian government

- US, UK hi-tech, government interested in installing GAK (with
  euphamisms being used such as TTP (UK), "Key recovery"/"key escrow"
  (US)).

- Muslim countries, some oil rich, largely I think currently

- France with current position of no use of crypto without license
  (not typically availble), low enforcement rate (individuals use crypto
  with very low likelihood of prosecution), but more recent moves to
  allow unlicensed crypto which has mandatory access.

In what way does replacing the sendmail infrastructure have relevance?
You can always communicate in the clear so I am not claiming you can
not commmunicate, just that there are interesting interactions between
deployed software bases and different jurisdictions with different
legal restrictions on cryptography (ranging from none to weakly
enforced mandatory access, to heavily enforced mandatory access to ban
on cryptography).  If you consider this legal framework, the dynamics
of the ways that you can best estimate GAK will be introduced, and the
likelihood for each jurisidction, the enforcement rate, severity of
penalty for failure to comply, you have a very complex system. 

I would be interested to see comments on these issues, and what issues
this raises for protocol designers and software implementors.

My GAK resistant design principles attempt to provide useful rules of
thumb in making individual software systems, international standards,
and the distributed system formed of the deployed user base, and
enforcement rates, severities maximally resistant to GAK.

http://www.dcs.ex.ac.uk/~aba/grdesign/

My claim is that software implementations, and messaging standards
such as OpenPGP are not neutral in this process.  I think this is a
relatively obvious statement, which most would agree with.  I know
that PGP Inc has spent a lot of time considering alternatives on these
kinds of issues, and on privacy issues.

> > I can not see that being able to by pass it helps you in my scenario
> > if a) you will be detected when you do bypass it because the law
> > enforcers will discover they can't recover plaintext;
> 
> This implies a law against using any other form of crypto, period.  
> If such a law is passable the exemption for PGP's protocol will 
> really be immaterial.  That is, Yes, under an extremely draconian 
> regieme, extremely draconian things are possible.

There are regimes which would like to allow the government to read all
communications where it would not be practical to outlaw encryption
because many people can demonstrate a business case for it.

You live in one such regime: the US.  I live in another such regine:
the UK.

> > and b) you have
> > a "choice" of not being able to communicate with anyone, because in
> > practical terms you have a need to communicate. 
> 
> Implies that *all* other forms of communication have been outlawed.  
> Completely unrealistic.

It does not imply that at all.  If you presume that you wish to
communicate securely, faced with the above scenario, you are faced
with the choice I described: don't communicate at all, or communicate
insecurely.

> Adam, it is a complete and utter waste of time to debate this. 

Why?

I shall continue simply because I consider I have no moral
alternative, than to try to explore more GAK resistant variants of
CMR, or additions to CMR. Or to explore the CDR alternative approach
as a plausible alternative more resistant to GAK take over.

If you have any specific objections to my technical points, or
strategic analysis of usefulness of the two proposals in frustrating
government mass email snooping I would be interested to have you
discuss them.

> What would *not* be a waste of time would be more concrete proposals.  
> Whether PGP implements something is a separate question -- I would 
> like to get back to the question of designing a better email 
> encryption system.

That is a worth while endeavour independently.  However PGP Inc has
financial and implementational constraints (such as plugin APIs, and
so forth) which it naturally must work within.  Asking more than this
is not reasonable; these are the laws of gravity in the problem space.

To produce something which meets PGP Inc's design constraints seems
much more valuable to me than independent freeware or payware attempts
to explore alternative approaches simply because PGP is likely to have
the largest deployed base.  Increasing the resistance of PGP Inc's
systems by even a marginal amount is therefore automatically valuable.

> Your reencryption scheme fails because of the management of the short
> term encryption keys, among other things.  

I presume you are here referring to my suggestion that forward secrecy
would make the system more resistant to GAK take over.

PGP already has a mechanism to deal with short term encryption keys:
the expiry mechanism which has been available starting with pgp5.0.

The only novel suggestion relating to this is to reduce the expiry
period, to reduce exposure of keys.  This does not seem a radical
proposal.  It is independently a good security improvement.

Tim May has suggested that the simplest way to deal with the problems
of recovery is just to store the received email in clear text.

If PGP would like to enhance security of email archives by storing
them in encrypted then CDR is one practical way to do that.

> Here's another approach I will toss out, without thinking through:
> 
> How about formalizing superencryption, or tunneling? That is, treat
> CMR traffic as a transport medium for messages that are themselves
> already encrypted.  The "key" idea here is to allow layering of non
> CMR traffic over CMR traffic.  All the code for both is obviously
> already in PGP, with a little glue and perhaps some minor protocol
> mods...

This is a good suggestion.  It would be an improvement over allowing
CMR traffic to appear in the outer layer.  Jon Callas, Attila T Hun,
and Bill Stewart were discussing variations of this.  My suggestion
for forward secrecy could also be used in this way, and has similar
motivation, but is not necessarily end-to-end, as I gave specific
examples in my previous reply to you attempted to show.

A hybrid approach like this would be somewhere between the two systems
in resistance to government abuse.  It is a definate improvement.

Please don't give up on the debate as threatened above Kent;
constructive ideas like this are useful as they explore a wider
spectrum of properties in the proposed system variants.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <3449311A.1F0E@sk.sympatico.ca>



Kent Crispin wrote:

> On Sat, Oct 18, 1997 at 08:48:56AM +0100, Adam Back wrote:
> > My reasoning is this: as PGP Inc can not justify expense on such
> > developments, my CDR proposal would be much safer for them to
> > implement because it requires no steganography support, or other
> > privacy patches to provide protection against abuse of the software
> > for uses other than PGP Inc's designers intentions.
 
> You keep talking as if your CDR proposal is other than vaporware.  So
> far as I have seen you don't have a proposal, you have a wish.

  Given Adam's many accomplishments in the arena of CypherPunks issues,
I find it hard to make a case for his discussion in this area to be
mere mental masturbation.
  'Democracy in America' is also vaporware--always has been, always 
will be--but I see no reason we should not go on discussing it and 
hoping that we will not having to keep pushing the release date of the
finished product back, time and time again.
 
> [...]
> 
> > > You are in error. The only time that you are forced to use CMR is when (1)
> > > you share the CMRK with the other party AND (2) the strict flag is set. In
> > > all other cases, you can opt-out, on a message-by-message basis.

> Adam, it is a complete and utter waste of time to debate this.

  I agree. I think that we should just wait until someone comes out
with an actual product, and then castigate them for their ideas being
"ill-thought out." 

> What would *not* be a waste of time would be more concrete proposals.
> Whether PGP implements something is a separate question -- I would
> like to get back to the question of designing a better email
> encryption system.
> 
> Your reencryption scheme fails because of the management of the short
> term encryption keys, among other things.  Here's another approach I
> will toss out, without thinking through:
> 
> How about formalizing superencryption, or tunneling? That is, treat
> CMR traffic as a transport medium for messages that are themselves
> already encrypted.  The "key" idea here is to allow layering of non
> CMR traffic over CMR traffic.  All the code for both is obviously
> already in PGP, with a little glue and perhaps some minor protocol
> mods...

  In return for your positive suggestions, the CDR Board of Dirctors
has voted to allow you two posts containg cheap shots at the list
member of your choice, without including any points of redeeming,
on-topic, list value.

Toto
~~~~
"The Xenix Chainsaw Massacre"
http://bureau42.base.org/public/xenix
"WebWorld & the Mythical Circle of Eunuchs"
http://bureau42.base.org/public/webworld
"InfoWar"
http://bureau42.base.org/public/infowar3
"The Final Frontier"
http://www3.sk.sympatico.ca/carljohn






From frantz at netcom.com  Sat Oct 18 16:30:56 1997
From: frantz at netcom.com (Bill Frantz)
Date: Sun, 19 Oct 1997 07:30:56 +0800
Subject: CPUNK Thread from the East / (Was: The Yarrow Man Ass) / (Was: You Go Away! Bother ROUND EYE CypherPunks. Chop, chop!) / (Was: TORA! TORA! TORA!...DC) / (Was: OUBAKAYAROU!!)
In-Reply-To: <199710181407.JAA02154@einstein.ssz.com>
Message-ID: <34494344.335F@netcom.com>



TluthMonglel wrote:
>                  WAKE UP CPUNX AMERICA!
>   The Commies have infiltrated the CPUNDITS Distributed Remailer system.
> Igor's secret agenda is to translate 'Distributed' into "From each, as
> he is able...to each, according to his need."
...
>   Ever try to get
> a message from the list at 4 a.m.? They are few and far between. Even
> when you create your own message and send it to the list, the CDR List
> Masters force you to share it with everyone else.
> ("Who will help me write the message, said the Little Red Hen?")

 I agree. Next thing you know, we will be receiving our messages from
the socialist CDDR list.
  I put a lot of thought, time and effort into my posts, and I resent
having to share them with the lurkers who add nothing to the list.
  From now on I will be sending my posts to the list only to myself.

God Bless America
-------------------------------------------------------------------------
Bill Frantz       | The Internet was designed  | Periwinkle --
Consulting
(408)356-8506     | to protect the free world  | 16345 Englewood Ave.
frantz at netcom.com | from hostile governments.  | Los Gatos, CA 95032,
USA






From pam at message4U.com  Sun Oct 19 10:14:36 1997
From: pam at message4U.com (pam at message4U.com)
Date: Sun, 19 Oct 1997 10:14:36 -0700 (PDT)
Subject: You Have The Right To Know...
Message-ID: <199710191656.JAA05642@nevwest.nevwest.com>


Now Available...
___________________________________

The New Clinton Chronicles Video - $ 20.00

An Investigation Into The Alledged
Crimminal Activities Of Bill Clinton &
His Circle Of Friends/Associates...
____________________________________

The Death Of Vince Foster Video - $ 20.00

A Video On What Really Happened 
To Vince Foster...
____________________________________

Cover-Up In Oklahoma Video - $ 15.00

Live TV Coverage On This Video Proves
Government & Mainstream Media Did
Collaborate To Hide Info Murrah Building
Was Bombed From Within...By People
With Free Access Inside It...
____________________________________

Shipping & Handling - $ 3.00 Per Tape

SPECIAL - ALL 3 TAPES - $ 50.00

International Orders - Add $ 3.00 Per Tape
____________________________________


To Order By MasterCard/Visa:

Call (812) 949-2205 Mon-Fri
Noon - 8pm Eastern


To Order By Mail:

Send Check Or Money Order To:

" Tapes "
c/o Eli Stoltzfus
P. O. Box 2851
Clarksville, IN  47131


ALL ORDERS SHIPPED OUT
WITHIN 48 HOURS !


To Be Removed From Future Mailings
Reply To This Message - And Type
The Word Remove in Subject Area.





From nobody at REPLAY.COM  Sat Oct 18 19:15:33 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 19 Oct 1997 10:15:33 +0800
Subject: Is PGP still private?
Message-ID: <199710190155.DAA10077@basement.replay.com>



> Your reencryption scheme fails because of the management of the short
> term encryption keys, among other things.

Wait a minute.  Didn't Adam abandon the reencryption idea and switch to
key escrow?  Or did that one turn out to be a non-starter too?






From nobody at bureau42.ml.org  Sat Oct 18 19:45:34 1997
From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer)
Date: Sun, 19 Oct 1997 10:45:34 +0800
Subject: Underground Reptilian Nazis Infiltrate FBI
Message-ID: 



Jim Choate wrote:
>    CNN logo
>    Pathfinder/Warner Bros
>                  FBI HIRES NUCLEAR PHYSICIST TO HEAD CRIME LAB
>      Web posted at: 2:27 p.m. EDT (1827 GMT)
>      From Correspondent Terry Frieden
> 
>      WASHINGTON (CNN) -- The FBI hired the former head of a government
>      nuclear weapons laboratory to direct its troubled crime lab, even
>      though he has no background in forensic science.
...
>      the man chosen for the post is Donald M. Kerr Jr., 58, a
>      physicist-engineer who from 1979 to 1985 headed the government's Los
>      Alamos National Laboratory, where nuclear weapons are designed.

Of course, this comes as no surprise to those who follow the 'Chronicles
of InfoWar,' since we have long been aware that the secret government 
long ago declared 'information' to be 'munitions.'
How long until we hear the official announcement that *all* information
will need to be 'registered,' in the interests of National Security, and
to protect the citizens from the 2,000,000 Horses of the Apocalypse?
(Including, no doubt, terroists with 'suitcases' full of 'information.')

>      "It just seems dumbfounding and implausible that they would not hire
>      a world-class forensic scientist to take over the crime lab," center
>      Director Stephen Kohn said.
> 
>      The selection also was criticized by the National Association of
>      Criminal Defense Lawyers.
> 
>      "Once again, the FBI has dealt with Congress and the public with
>      incredible arrogance," said the group's vice president, William
>      Moffitt.

  Is this supposed to come as a 'surprise'?

>      Kris Kolesnik, senior counselor to Sen. Charles Grassley, R-Iowa,
>      one of the harshest critics of the FBI, said Kerr's work at Los
>      Alamos and more recently for a major defense contractor make him a
>      "real government insider."

  His experience and track-record also make him a perfect choice for
revitalizing the FBI's ability to cover up their mistakes, keeping
their dirty little secrets out of the hands of the public.

>      Meanwhile, another flap over the crime lab erupted Friday when chief
>      lab whistleblower Frederic Whitehurst said that in examining FBI lab
>      reports recently released under the Freedom of Information Act, he
>      found that five more FBI examiners had altered lab reports.
> 
>      "In the last week, I have found five more people that have been
>      altering cases -- five more that the inspector general didn't find,"
>      Whitehurst said.

  Whitehust, who will die in a tragic car-accident later this year,
will soon be exposed as a drug-addicted, godless-commie pedophile.

TruthMonger






From ghio at temp0119.myriad.ml.org  Sat Oct 18 20:31:39 1997
From: ghio at temp0119.myriad.ml.org (Matthew Ghio)
Date: Sun, 19 Oct 1997 11:31:39 +0800
Subject: InfoWar Epilogue 4 (Part III of 'The True Story of the InterNet')
Message-ID: <344976F5.5889@temp0119.myriad.ml.org>

A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 9769 bytes
Desc: not available
URL: 

From ghio at temp0119.myriad.ml.org  Sat Oct 18 20:44:47 1997
From: ghio at temp0119.myriad.ml.org (Matthew Ghio)
Date: Sun, 19 Oct 1997 11:44:47 +0800
Subject: InfoWar Epilogue 4 / TEXT
Message-ID: <34497767.9AD@temp0119.myriad.ml.org>



----------------------------------------------------------------------------
----------------------------------------------------------------------------

                       The True Story of the InterNet
                                  Part III

                                   InfoWar

                  Final Frontier of the Digital Revolution

                     Behind the ElectroMagnetic Curtain

                        by TruthMonger 

Copyright 1997 Pearl Publishing
----------------------------------------------------------------------------
----------------------------------------------------------------------------

                          InfoWar Table of Contents

   * Epilogue
   * gomez

----------------------------------------------------------------------------

                                  Epilogue
----------------------------------------------------------------------------

Subject: Re: Just say "No" to key recovery concerns...keep OpenPGP pure
From: Adam Back 
To: tcmay at got.net
CC: shamrock at cypherpunks.to, cypherpunks at cyberpass.net, eric at sac.net

Tim May  writes:
> I'll try a different way of making my points...

> At 9:12 PM -0700 10/14/97, Lucky Green wrote:
> >I can't help but see a difference between enforcing to encrypt to a
> >default key and storing the user's key outright. IMHO, the former entails
> >less potential for abuse.
>
> All other things being equal, maybe the former is slightly less intrusive
> than the latter. But maybe not even this, as the two give the same
results.
> After all, what's the real difference between "all mail, incoming and
> outgoing, must also be encrypted to a CMR key" and "you must deposit a
copy
> of your key with us"?

CMR keys are the root of all evil in pgp5.5. Without them almost any
permutation of recovery care to construct would be less useful to the
GAK'ers, for all the organizational, and inconvenience reasons Tim
describes. Governments have problems handling complexity.

So make their job complex. If you were one of the people writing the
IRS tax software back in the 60s, and you were in deep cover, a
proto-cypherpunk, and were bright enough to see the future
possibilities you would have done all you could to fuck up the IRS
system. You would have obfuscated the code. You would have put logic
bombs in it. You would have destroyed the source code
surreptitiously. (Destroying source code has analogies to destroying
keys at earliest opportunity, you are destroying something which your
enemy needs).

Any bets as to if any of this actually happened on purpose? I reckon
so.

So, do you all reckon we can make task of fielding GAK impossibly
complex for such a big disorganized government?

Adam
--
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
"Last one seen fixing it, gets the blame."
----------------------------------------------------------------------------

                        "The Xenix Chainsaw Massacre"

                 "WebWorld & the Mythical Circle of Eunuchs"

           "InfoWar (Part III of 'The True Story of the InterNet')

                Soviet Union Sickle of Eunuchs Secret WebSite
----------------------------------------------------------------------------







From nobody at REPLAY.COM  Sat Oct 18 20:53:57 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 19 Oct 1997 11:53:57 +0800
Subject: More Government Bullshit
Message-ID: <199710190331.FAA22847@basement.replay.com>



>From News of the Weird:

* In July, the Nova Scotia Gaming Control Commission formally
banned the popular charity fundraiser, "cow-patty bingo," in which
a promoter marks a field into squares, takes bets, and then releases
a recently-fed cow to "select" a winning square.  The Commission
believed the game could be rigged by training a cow to use a
particular spot in the field.  The next day, incoming Nova Scotia
Premier Russell MacLellan said the ban could be ignored.  That
same week, the district attorney's office in Santa Clara County 
announced that a similar fundraiser for the imminent Gilroy, Calif.,
garlic festival, based on the famous Clydesdale horses' two-mile
march through town, could not be held because it violated the state
gambling law.







From nobody at REPLAY.COM  Sat Oct 18 21:00:49 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 19 Oct 1997 12:00:49 +0800
Subject: The reason terrorists carry fly-swatters
Message-ID: <199710190331.FAA22872@basement.replay.com>



>From News of the Weird:
* The San Jose Mercury News reported in March on some working
models of the Defense Department's tiny flying machines ("micro
air vehicles"), no larger than birds, including one helicopter that
could fit inside a peanut shell, that are suited for tasks such as
locating hostages in occupied buildings, sniffing out poisonous
chemicals, and finding enemy snipers.  Each micro air vehicle
carries cameras, sensors, transmitters, and antennas.







From ravage at ssz.com  Sat Oct 18 21:01:31 1997
From: ravage at ssz.com (Jim Choate)
Date: Sun, 19 Oct 1997 12:01:31 +0800
Subject: The reason terrorists carry fly-swatters (fwd)
Message-ID: <199710190423.XAA04010@einstein.ssz.com>



Forwarded message:

> Date: Sun, 19 Oct 1997 05:31:34 +0200 (MET DST)
> Subject: The reason terrorists carry fly-swatters
> From: nobody at REPLAY.COM (Anonymous)

> * The San Jose Mercury News reported in March on some working
> models of the Defense Department's tiny flying machines ("micro
> air vehicles"), no larger than birds, including one helicopter that
> could fit inside a peanut shell, that are suited for tasks such as
> locating hostages in occupied buildings, sniffing out poisonous
> chemicals, and finding enemy snipers.  Each micro air vehicle
> carries cameras, sensors, transmitters, and antennas.

Actualy there was a show on The Discovery Channel last week that discussed
these as well as many other robotics projects being pursued by various
groups currently.



    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From bd1011 at hotmail.com  Sat Oct 18 21:12:16 1997
From: bd1011 at hotmail.com (Nobuki Nakatuji)
Date: Sun, 19 Oct 1997 12:12:16 +0800
Subject: about MISTY encryption algorithm
Message-ID: <19971019035058.12956.qmail@hotmail.com>



itsubishi Electric Corp. has developed new secret-key cryptosystem 
MISTY1 and MISTY2, which are ciphers with
128-bit key and 64-bit data block. They are provably secure against 
differential and linear cryptanalysis,
and also fast on software implementations as well as on hardware 
platforms. Using ciphers on wide-area
networks requires a method to maintain security as long as its 
encryption key (password commonly shared by a
sender and a receiver) is kept secret, even if the mechanism of the 
encryption is made public. However,
possibilities of unauthorized access will increase when the encryption 
mechanism is made public. In fact,
several encryption algorithms, whose specifications were made public, 
have been compelled to make
specification changes, and to sacrifice their encryption speed in return 
for an increased cipher strength to
protect against recent decoding methods. This is why an encryption 
system whose security against these
decoding method is strictly evaluated at the design stage has become 
necessary. Since announcing its linear
cryptanalysis, Mitsubishi Electric has been making efforts to develop 
encryption technology backed by
adequate security. In January 1994, Mitsubishi Electric performed the 
first successful experiment to decode
the Data Encryption Standard (DES), an American standard commercial 
encryption system, to quantitatively
evaluate its strength using this linear cryptanalysis. Using this 
evaluation technology, Mitsubishi Electric
has developed an encryption algorithm that provides sufficient security 
and achieves high speed encryption. 

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com






From pipai at big.or.jp  Sun Oct 19 12:16:36 1997
From: pipai at big.or.jp (pipai at big.or.jp)
Date: Sun, 19 Oct 1997 12:16:36 -0700 (PDT)
Subject: ATTENTION GOLFERS! PLAY GOLF AND GET PAID FOR IT!
Message-ID: <199710191926QAA16740@big.org>


Hello,  I work with a golf and travel company and we are looking for people that  would be interested in earning money playing golf while enjoying some incredible benefits.  While working (or playing)  with this business you  will  enjoy the  following:

� Deducting  greens  fees, cart  fees, equipment, and club dues  from your income taxes,
� Working   from  the comfort of  your own  home over  the  telephone or on  the course,
� Accessing  discount  golf  trips  to  fantastic  golf  destinations  throughout   the  world,
� Purchasing   top - of - the - line  golf  equipment  at  below  discount   retailer   prices,
� Receiving  over 50  percent  off  greens  fees at  over 3000 courses across  the country,
� Having  access  to our outstanding  training  and  support system that insures success,
� Earning  an immediate   primary  or  secondary  income  doing   something   you  love,

As part of our Team, there are two primary ways to build your golf business.  You can either make a point to play a lot  more golf and talk with others about tremendous discounts on golf equipment,  golf travel packages, and our business, or I can teach you to build your entire business over the telephone from the comfort of your home via direct mail or mass Email.  The choice is yours.

The startup cost is between $500 to $800 depending on how you choose to operate your business and includes:  a small business tax package,  The Lifelinks Select Program,  an Antigua golf shirt with corporate logo,  The Fran Tarkenton Small Business Package, instructional golf video, The Golfers Travel Benefit Package,  product catalogs, audio tapes, golf hat, golf balls, an advertizing kit and many other collateral materials.   Our startup  and training packages were designed to give you everything you need to  operate a legitimate home-based golf business.

Think about it, you can play more golf for less money , take it off of your income taxes, purchase brand name equipment at rep prices, and make money  while having fun on the course.   This is a serious venture and many of us are making thousands of dollars a month and you can to if you are willing to play more golf and plug into our very simple training system.  Whether part or full-time, if you  feel  you  have  a  legitimate  interest  in  making money with your passion for golf please call 1-904-634-8057 for a two minute recorded overview then leave your name, state,  and both work and home phone numbers.  We  will  be  glad  to  rush  you a free comprehensive information package.  Please, serious inquiries only. I apologize for any inconvenience and hope to hear from you soon. Thank you for your time.  


Best regards,


Wally Ludviksson


PS: Call 1-904-634-8057 now for  the  two minute overview and to receive your free comprehensive information package.  









p�@big.o From bd1011 at hotmail.com Sat Oct 18 21:43:00 1997 From: bd1011 at hotmail.com (Nobuki Nakatuji) Date: Sun, 19 Oct 1997 12:43:00 +0800 Subject: about MISTY encryption algorithm Message-ID: <19971019042835.2501.qmail@hotmail.com> Mitsubishi Electric Corp. has developed new secret-key cryptosystem MISTY1 and MISTY2, which are ciphers with 128-bit key and 64-bit data block. They are provably secure against differential and linear cryptanalysis,and also fast on software implementations as well as on hardware platforms. Using ciphers on wide-area networks requires a method to maintain security as long as its encryption key (password commonly shared by a sender and a receiver) is kept secret, even if the mechanism of the encryption is made public. However,possibilities of unauthorized access will increase when the encryption mechanism is made public. In fact,several encryption algorithms, whose specifications were made public,have been compelled to make specification changes, and to sacrifice their encryption speed in return for an increased cipher strength to protect against recent decoding methods. This is why an encryption system whose security against these decoding method is strictly evaluated at the design stage has become necessary. Since announcing its linear cryptanalysis,Mitsubishi Electric has been making efforts to develop encryption technology backed by adequate security. In January 1994, Mitsubishi Electric performed the first successful experiment to decode the Data Encryption Standard (DES), an American standard commercial encryption system, to quantitatively evaluate its strength using this linear cryptanalysis. Using this evaluation technology, Mitsubishi Electric has developed an encryption algorithm that provides sufficient security and achieves high speed encryption. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com From fabrice at math.Princeton.EDU Sat Oct 18 22:51:13 1997 From: fabrice at math.Princeton.EDU (Fabrice Planchon) Date: Sun, 19 Oct 1997 13:51:13 +0800 Subject: Security flaws introduced by "other readers" in CMR In-Reply-To: <3.0.2.32.19971018025454.03e23124@pop.sirius.com> Message-ID: <19971019014419.47580@math.princeton.edu> On Sat, Oct 18, 1997 at 08:53:14PM +0100, Adam Back wrote: > > The situation in France is: currently (or recently) you could not use > encryption at all without a license. The enforcement rate is low to > zero. (Jerome Thorel interviewed the head of SCSSI (NSA equivalent), I am not sure you can really say they are the NSA equivalent. I would rather say they are the equivalent of, say, the office in the dpt of commerce which gives the export authorizations in the US. What I mean is that I doubt they are listening to anybody. Other french agencies do that (and each agency, wether its depends on the police, like DST, RG, or the army, DGSE, DSM, has its own group of people listening to anybody they like). A normal police department could do it too, but then they will need a warrant of some kind. None of the agencies above probably bothers with things like that, as they will usually say "secret d�fense" if they are asked questions (some french equivalent of "national security"). > Now I understand the French have switched position: you can use > encryption without a license *provided* that it has master key access > for the government. I would say people who wrote the current law 2 years ago didn't have a clue on the technical issues, anyway. That's why we are still waiting for the "decrets d'application", which are the set of rules on how the law will be enforced. Somehow I would bet they are waiting to see where the wind blow at the international level. > With the pgp standard as is french government could insist that people > use pgp5.x. pgp5.x provides a reasonablly useful framework for the > french government to adapt to be used as a master access system. http://www.lemonde.fr/multimedia/sem4297/textes/act42972.html It's in french, so I won't quote. The article has a very neutral position, but they point out exactly the same thing as you. > Because this will then be explicitly allowed, more people are likely > to use it. (Current people using pgp2.x illegally are one suspects I know at least one academic site where system administrator were prevented from switching to ssh because of the legal issue. Seems the campus administration folks wanted to protect their asses... > If on the other hand pgp5.x were to use only single recipients for > confidentiality, and to base company recovery of encrypted mail > folders on key recovery information stored locally alongside the > mailbox the system would be less useful to the french government. I don't have the technical expertise to discuss your proposal, so I won't (seems less snoop friendly to me than the PGP5.5 solution, still). But what I certainly fail to understand is why PGP inc (and people who support them) is focusing on a solution which allows to intercept and read e-mail in transit. That inherently evil, no matter you put it. And the "hit by a truck" hypothesis doesn't stand a minute in real life (Yah, shit happens, so what ?). The (legitimate) needs of a company can be achieved via an agreement with its employees, on how data are stored, backed, duplicated, whatever, and it has merely nothing to do with cryptography. Or am I missing something obvious ? And as far as the "legitimate needs of the law enforcement agencies", well, if they want to read e-mail sent by an employee from his company account because he is a potential drug dealer, they can obtain the proper authorization from the court and snoop on the guy from within the company. As usual, the weakest link is the guy typing on his keyboard, as I doubt anybody speaks IDEA fluently...(even rot13 I am skeptical. Crime organizations in Paris at the beginning of the century were using "Javanais", which was a very basic code, but sufficient to confuse the police) So why isn't everybody focusing on being sure the transport layer is secure, and leave to social interaction at both end of the communication process the problem of recovery of whatever was transmitted ? (which, I feel dumb for saying it, was in clear at some point before being sent, and will be when it will be read...) > Second party access to stored data is much less scary. Little brother > can ultimately read _everything_ you do at work. If he gets > suspicious he can install keyboard logger, keyboard password sniffer, > or concealed videocam whilst you are out of the office. The best we > can do is discourage little brother from abusing systems designed for > data recovery as mass communications snooping. The best suggestion I > have seen for this so far was Bill Stewart's suggestion to only store > recovery info for some of the bits. Make the recovery process > artificially slow: say 40 bits. Worth it for recovering main > developers design notes made in email when he dies unexpectedly. Some > hinderance to little brother unless he is determined. As long as this > hinderance is similar scale to other similar things little brother > could do to check up on suspicious user, you have achieved your goal > of hindering little brother. Sounds fair to me. > Big brother is hindered very significantly if you do recovery locally, > rather than on the communications link as PGP Inc CMR does. This is > because big brother does not have access to the ciphertext on disks. > He must come and take them. Whereas for communications he can And he needs proper authorization before coming. And yes, it takes time but that's the price to pay in a system with separation of powers. > For data storage recovery, your data is again in two halves: you have > one, the _key_, your employee/you have the other, the _ciphertext_ on > disk. Your employee can recover that info anyway. The NSA can't > easily. It is much more logistically expensive to collect or randomly > sample disk contents. Yes, yes, yes. And still I am sure that we will hear objections to that... sigh.... F. -- Fabrice Planchon (ph) 609/258-6495 Applied Math Program, 210 Fine Hall (fax) 609/258-1735 From aba at dcs.ex.ac.uk Sun Oct 19 00:24:52 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sun, 19 Oct 1997 15:24:52 +0800 Subject: Non-conventional In-Reply-To: <199710181814.OAA26560@users.invweb.net> Message-ID: <199710182123.WAA01536@server.test.net> > Anonymous writes: > >Tim May implied that Cpunx should develop non-conventional email. Crypto > >has been declared to be munitions. > >Nukes are non-conventional weapons. > >Should we be developing nuclear email? > >Should we 'email-nuke DC?" Just email them "nuke.fab" :-) (Readers won't understand that unless they read my contribution to the true story of the internet). Adam From aba at dcs.ex.ac.uk Sun Oct 19 02:32:41 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sun, 19 Oct 1997 17:32:41 +0800 Subject: why we are arguing for more resistant variants (Re: Is PGP still private?) In-Reply-To: <3449311A.1F0E@sk.sympatico.ca> Message-ID: <199710190925.KAA00865@server.test.net> Toto writes: > Kent Crispin wrote: > > You keep talking as if your CDR proposal is other than vaporware. So > > far as I have seen you don't have a proposal, you have a wish. > > Given Adam's many accomplishments in the arena of CypherPunks issues, > I find it hard to make a case for his discussion in this area to be > mere mental masturbation. Thanks for the vote of confidence Toto. Also I must raise the point that it is not a lone stand. Other people are arguing against PGP Inc's CMR proposal, and are arguing for more GAK resistant variants, and alternatives. Several amongst those who have so argued are higher reputation than myself: Bruce Schneier, (plus some others with similar crypto credentials I have asked for comments from off list which I can not reveal due to ethics of email confidentiality). I have some small about of credibility myself I think also. In addition I consider myself, Tim May, Peter Trei, Attila T Hun, and the many others arguing for more resistant variants to have some reputation, and it seems unlikely to me that we would all burn our reputations over an insignifcant point. We are collectively arguing because (and I think the others will agree) we think that there are more resistant variants than the CMR proposal used in pgp5.5. These variants are also practical within the constraints imposed by the plug-in APIs, and user requirements PGP must work within, I believe. Even Kent Crispin who seemed to dismiss the first round as an insignificant difference, is offering more resistant variants. PGP Inc's Jon Callas together with cypherpunks Bill Stewart, Attila T Hun, and myself were also arguing that even TLS (transport level security), or in other words an extra encryption envelope over the recovery information is an improvement. (Particularly if you do as I argue for and try to make the TLS keys user owned where possible, and try to make the system as forward secrect as possible). However the biggest point of all is that: communications keys are more valuable to any attacker (government, unscrupulous little brother, or industrial spy) than storage keys. I would be interested to see any one willing to burn their reputational capital refuting that simple point. That point is the simple central starting point for all arguments about the dangers of allowing recovery information to be transmitted with the communication. Recovery information should be local whereever possible. Bruce Schneier had harsh words to say about violating this principle in one of his recent cypherpunks posts. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710190757.IAA00747@server.test.net> Anonymous writes: > Kent Crispin writes: > > Your reencryption scheme fails because of the management of the short > > term encryption keys, among other things. > > Wait a minute. Didn't Adam abandon the reencryption idea and switch to > key escrow? I didn't abandon it as such, but more recognised some dangers in a system involving re-encryption and sending messages to backup servers being twisted for government purposes. But even re-encryption is more resistant to GAK than PGP Inc's CMR. The danger with re-encryption is that the person the mail is being re-encrypted and sent to could be changed to be the government. However this presents more logistic problems for the government than does the PGP Inc CMR method. I switched to storage key recovery (not quite key escrow btw), because I realised this was yet more resistant to being abused by governments. The CDR (Corporate Data Recovery) proposal is that communications keys would not be escrowed, and that messages would be only encrypted to one key (the recipients key). Those emails which were archived, and which the user consider important could be encrypted with the recovered key. The recovery information would be stored locally and the software would attempt were possible to make it difficult to move the recovery information off the machine. > Or did that one turn out to be a non-starter too? No. I think it is practical. I also think that it is more resistant to government abuse (where the worst form of government abuse is mass keyword scanning of all messages.) I haven't seen anyone able to argue against these two claims. I encourage anyone who can see technical objections, or objections to the claim that this design is more resistant to abuse to speak up. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710190903.KAA00780@server.test.net> Fabrice Planchon writes: > Adam Back writes: > > (Jerome Thorel interviewed the head of SCSSI (NSA equivalent), > > [clarification of SCSSI functionality, and french government organisations > who would tap communications.] > > > Now I understand the French have switched position: you can use > > encryption without a license *provided* that it has master key access > > for the government. > > I would say people who wrote the current law 2 years ago didn't have a > clue on the technical issues, anyway. That's why we are still waiting > for the "decrets d'application", which are the set of rules on how the > law will be enforced. Somehow I would bet they are waiting to see where > the wind blow at the international level. I talked to some people at CESG (Communications Electronics Security Group) (they are part of GCHQ, UK NSA equivalent) in a business setting. It was they who said that France was changing position to going over to "key escrow" or TTPs (Trusted Third Parties). From their point of view they seemed to view this as a good development, because they could use France as an example of a progressive, socially responsible government which the UK government should follow the example of. They were very happy with this because they could use it in their arguments to attempt to persuade the UK government and people. Perhaps the CESG are exaggerating because they would like this to be the case because it suits their argument. But on the other hand, it seems likely that CESG have had talks with DGSE and SCSSI and it seems probable this really is what these French government organisations really are planning for. Probably there are opposing elements in the French government also. But CESG/GCHQ are vying for those elements which are in favour of "TTPs" to win. You can see how each new government that takes the TTP or key escrow stance allows the secret services and governments in other countries to clamour for their countries to follow suit. People can also see I hope how PGP Inc in influencing an international standard (IETF OpenPGP) to include explicit support for third party access to communications traffic is dangerous. However this is not the biggest danger, the biggest danger is that PGP Inc are implementing software solutions (pgp5.5) which as far as I can see, in all honesty, could literally be useful to the French government and others like it. If the French government adopt it, or a system implemented by a European company with the same functionality (that pgp5.5 has this functionality means others must follow for financial reasons in being compatible), then pro-GAK government agencies will point to this as a success story. Already Bruce Schneier quoted from the US congressional record where some GAKkers were praising pgp5.5 functionality in demonstrating their case that GAKware is possible. > > With the pgp standard as is french government could insist that people > > use pgp5.x. pgp5.x provides a reasonablly useful framework for the > > french government to adapt to be used as a master access system. > > http://www.lemonde.fr/multimedia/sem4297/textes/act42972.html > > It's in french, so I won't quote. The article has a very neutral > position, but they point out exactly the same thing as you. Do they actually mention PGP software, or OpenPGP standard? Or just the general principle? It is reasurring to hear that my analysis is supported by others. I am trying to think through what a GAKker would want and predict what they will be interested in seeing in standards and in off the shelf products. From that I am interested to use this estimate as a basis to design systems which resist the GAKkers desires, by denying any functionality which supports their requirements where this can be done within the normal user requirement constraint. It is difficult with arguments against a company such as PGP Inc which has a very high reputation capital due to Phil Zimmermann and large privacy following, because some people will oppose what you are saying just on principle without listening to the logic, they will say "you must be wrong, because PGP would never do that." But, the simple fact is that I think PGP Inc have not evaluated these indirect implications for GAK politics. This means I think that they have pure intentions. Unfortunately these pure intentions do not help us if the effect is as I fear: that the result helps the GAKkers to some significant amount. > > Because this will then be explicitly allowed, more people are likely > > to use it. (Current people using pgp2.x illegally are one suspects > > I know at least one academic site where system administrator were > prevented from switching to ssh because of the legal issue. Seems the > campus administration folks wanted to protect their asses... You confirm my suspicions. I have several people I know in France who use encryption illegally. Not least of these is Jerome Thorel himself :-) (He who interviewed the SCSSI and had it spelt out to him that it was illegal, but they wouldn't bother you if you didn't ask permission). However those that I know are effectively anti-GAK activists, or cypherpunk type individuals. > I don't have the technical expertise to discuss your proposal, so I > won't (seems less snoop friendly to me than the PGP5.5 solution, > still). It is not really that technical an idea. The idea is simply that communications keys are more valuable to government than storage keys. Keyword scanning is what governments want; they probably don't care too much about storage keys, they are much more expensive to collect ciphertext for (dawn raids for disks), and are much more difficult to enforce (who knows what keys are really being used to encrypt data on your disk, until the point of the dawn raid). > But what I certainly fail to understand is why PGP inc (and people > who support them) is focusing on a solution which allows to > intercept and read e-mail in transit. That inherently evil, no > matter you put it. The reason is that they consider it purely a recovery mechanism for stored emails. That it has this side effect of making a product which could be used for other purposes is currently considered an insignificant risk by them, I think. I think their analysis in this regard is flawed. > And the "hit by a truck" hypothesis doesn't stand a minute > in real life (Yah, shit happens, so what ?). The (legitimate) needs of a > company can be achieved via an agreement with its employees, on how data > are stored, backed, duplicated, whatever, and it has merely nothing to > do with cryptography. There you have the Tim May proposal. Do not recover, just store in clear. Most data on disks already is, so why bother. If you want to encrypt work out those problems when you come to them, as a separable issue. This is a very compelling argument to me. > Or am I missing something obvious ? Not that I can see. I think it really is that obvious. > So why isn't everybody focusing on being sure the transport layer is > secure, and leave to social interaction at both end of the communication > process the problem of recovery of whatever was transmitted ? (which, I > feel dumb for saying it, was in clear at some point before being sent, > and will be when it will be read...) I agree, my confusion also: why do people not understand this. There are some very bright people at PGP Inc, why do they not see it in these terms. > > Big brother is hindered very significantly if you do recovery locally, > > rather than on the communications link as PGP Inc CMR does. This is > > because big brother does not have access to the ciphertext on disks. > > He must come and take them. Whereas for communications he can > > And he needs proper authorization before coming. And yes, it takes time > but that's the price to pay in a system with separation of powers. He may not need authorization. I'm not sure MI5 (UK military intelligence branch) asked authorization before sending an SAS swat team into BBC head-quarters to confiscate tapes of a secret service documentary. Still that one failed because the BBC had hidden backups :-) (Smart cookies:-) They aired the film later. No one knows I suppose whether it was edited before airing. Also this is the status quo. Already the police, or terrorist prevention investigators can inflitrate, perform dawn raids, etc. and this is as it should be. > > For data storage recovery, your data is again in two halves: you have > > one, the _key_, your employee/you have the other, the _ciphertext_ on > > disk. Your employee can recover that info anyway. The NSA can't > > easily. It is much more logistically expensive to collect or randomly > > sample disk contents. > > Yes, yes, yes. And still I am sure that we will hear objections to > that... sigh.... I can't believe anyone who understands cryptography even remotely could possibly argue against the fact that communications keys are more valuable to an attacker. This seems very obvious. Readers may note Bruce Schneier's remark earlier in this discussion that he too couldn't believe someone would not separate storage keys from communications keys. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: Either release the full bloody source code, or shut the hell up. I'm sick of hearing about bloody MISTY. Warpy --------------------------------------------------------------------- | http://www.sekurity.org/~warpy | | Key Fingerprint: 85 17 4A E3 0C C5 BB 24 36 22 BB A6 E8 41 D5 95 | | Email: warpy at sekurity.org | --------------------------------------------------------------------- On Sat, 18 Oct 1997, Nobuki Nakatuji wrote: > itsubishi Electric Corp. has developed new secret-key cryptosystem > MISTY1 and MISTY2, which are ciphers with > 128-bit key and 64-bit data block. They are provably secure against > differential and linear cryptanalysis, > and also fast on software implementations as well as on hardware > platforms. Using ciphers on wide-area > networks requires a method to maintain security as long as its > encryption key (password commonly shared by a > sender and a receiver) is kept secret, even if the mechanism of the > encryption is made public. However, > possibilities of unauthorized access will increase when the encryption > mechanism is made public. In fact, > several encryption algorithms, whose specifications were made public, > have been compelled to make > specification changes, and to sacrifice their encryption speed in return > for an increased cipher strength to > protect against recent decoding methods. This is why an encryption > system whose security against these > decoding method is strictly evaluated at the design stage has become > necessary. Since announcing its linear > cryptanalysis, Mitsubishi Electric has been making efforts to develop > encryption technology backed by > adequate security. In January 1994, Mitsubishi Electric performed the > first successful experiment to decode > the Data Encryption Standard (DES), an American standard commercial > encryption system, to quantitatively > evaluate its strength using this linear cryptanalysis. Using this > evaluation technology, Mitsubishi Electric > has developed an encryption algorithm that provides sufficient security > and achieves high speed encryption. > > ______________________________________________________ > Get Your Private, Free Email at http://www.hotmail.com > From ravage at ssz.com Sun Oct 19 06:49:30 1997 From: ravage at ssz.com (Jim Choate) Date: Sun, 19 Oct 1997 21:49:30 +0800 Subject: OUBAKAYAROU!! (fwd) Message-ID: <199710191409.JAA04804@einstein.ssz.com> Forwarded message: > Date: Sat, 18 Oct 1997 23:02:36 -0700 > From: Bill Stewart > Subject: Re: OUBAKAYAROU!! (fwd) > At the time the list was created, and I subscribed to it, > the announcement indicated that cypherpunks-j and cypherpunks-e > were independent lists, rather than mirrors, No, Bill, the cypherpunks-e list was announced by me and it was announced as a *specific* member of the existing CDR started at my specific request. Only the cypherpunks-j was ever announced as the indipendant list, which I intended to change. I further sent out a note requesting feedback on non-English traffic and it's acceptance on the existing CDR. I received nothing but smart-ass replies so we decided not to gateway that traffic but leave the cypherpunks-j traffic fully indipendantly. That lack of responce is what motivated the cypherpunks-e list. It was nearly a week after the -j list that the -e came online because I had to work that weekend and the -j operator was going to Australia. > Well, for a while, -e was badly broken. However, if the purpose > of the list is to be yet another mirror, fine, getting list mirrors > working is a trickier job than getting an independent list up and working. It is still 'broken' in that the mailer software they use doesn't accept submissions with blank subject: lines. As a consequence I get several bounces a day, usualy from anonymous accounts, that I simply /dev/null. Whether this is a bug or a feature is up to your own interpretation. I am looking into putting something in place so that SSZ puts something like: Subject: [unknown subject] on the traffic that is subject: blank since the -j and -e remailer software can't have this behaviour turned off. > Yeah; you've been getting flaked a lot lately. I remember back > in the old days having to get New Jersey Bell to deal with > bad data quality on my home voice line About the only good thing I can say is that I got a $150 credit and the phone bill is $70/month for the 3 analog lines so I get to ride free dial-in's on SWBT's dollar for two months. The ISDN seems to be relatively stable since turning in the trouble call and doing the testing, which showed 100% reliability (right). ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From grafolog at netcom.com Sun Oct 19 08:14:51 1997 From: grafolog at netcom.com (jonathon) Date: Sun, 19 Oct 1997 23:14:51 +0800 Subject: about MISTY encryption algorithm In-Reply-To: <19971019042835.2501.qmail@hotmail.com> Message-ID: On Sat, 18 Oct 1997, Nobuki Nakatuji wrote: > method to maintain security as long as its encryption key (password > commonly shared by a sender and a receiver) is kept secret, Translation: The system is secure, only if you have a third route that is secure. > However,possibilities of > unauthorized access will increase when the encryption mechanism is made > public. Translation: our super secret algorithm is so pathetically weak, that anybody reading it, could break it, without using a computer. > specification changes, and to sacrifice their encryption speed in return > for an increased cipher strength to protect against recent decoding > methods. Translation: We decided to go for speed, rather than real security. > encryption technology backed by adequate security. In January 1994, > Mitsubishi Electric performed the first successful experiment to decode Translation: In January 1994, Mitsubishu bought the DES Breaking Algorithm, on the black market. Snake Oil Sales people: Please apply at Mistubishi Electronic for a job as a drummer. Mistubishi Electronic is currently offering fantastic oportunities to fleece sheeple of their money, with little to no risk to you. xan jonathon grafolog at netcom.com The FBI doesn't want to read encrypted documents, they want to read YOUR encrypted documents. From whgiii at invweb.net Sun Oct 19 09:58:10 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Mon, 20 Oct 1997 00:58:10 +0800 Subject: Security flaws introduced by "other readers" in CMR In-Reply-To: <199710190903.KAA00780@server.test.net> Message-ID: <199710191653.MAA06075@users.invweb.net> In <199710190903.KAA00780 at server.test.net>, on 10/19/97 at 10, Adam Back said: >I talked to some people at CESG (Communications Electronics Security >Group) (they are part of GCHQ, UK NSA equivalent) in a business setting. >It was they who said that France was changing position to going over to >"key escrow" or TTPs (Trusted Third Parties). From their point of view >they seemed to view this as a good development, because they could use >France as an example of a progressive, socially responsible government >which the UK government should follow the example of. They were very >happy with this because they could use it in their arguments to attempt >to persuade the UK government and people. France as a model?!? ROTFLMAO!!!! I wouldn't recomend Russia or China to follow the French model on anything, let alone a country like the UK who's government every now and then remembers what democracy and freedom are. -- --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html --------------------------------------------------------------- From tm at dev.null Sun Oct 19 10:01:34 1997 From: tm at dev.null (TruthMonger) Date: Mon, 20 Oct 1997 01:01:34 +0800 Subject: Quantum Leaps in PGP In-Reply-To: <3.0.2.32.19971018025454.03e23124@pop.sirius.com> Message-ID: <344A3933.823@dev.null> Fabrice Planchon wrote: > On Sat, Oct 18, 1997 at 08:53:14PM +0100, Adam Back wrote: > > Now I understand the French have switched position: you can use > > encryption without a license *provided* that it has master key access > > for the government. ... > > With the pgp standard as is french government could insist that people > > use pgp5.x. pgp5.x provides a reasonablly useful framework for the > > french government to adapt to be used as a master access system. > http://www.lemonde.fr/multimedia/sem4297/textes/act42972.html > > It's in french, so I won't quote. The article has a very neutral > position, but they point out exactly the same thing as you. From Privacy Protection for the Individual to the Government Choice in SnoopWare. Is it possible to do that while keeping your panties on? Perverted minds want to know... > > If on the other hand pgp5.x were to use only single recipients for > > confidentiality, and to base company recovery of encrypted mail > > folders on key recovery information stored locally alongside the > > mailbox the system would be less useful to the french government. True. This is why it seems all the more odd that PGP leapt over the obvious to introduce *exactly* what Lying Jackoff Fuck Louis J. Freeh is asking for--***___IMMEDIATE___*** access to communications. Corporate Message Recovery amounts to a _Real-Time_Wiretap_ on email communications. Bonus Question: "Why would a government agency bother with getting a court order to _use_ a key they are already in possession of, and how would we know if they use it, if they don't have to go to an outside source to get possession of it?" Bonus Prize: One freeh bomb. Bonus Stupid Question: "Why don't you give me your life savings, to hold for you, and I will only spend it after getting permission from someone who won't know whether I am spending it, or not, anyway." Bonus Stupid Prize: One freeh-dumb. The government is quite simply trying to poke enough holes in a variety of privacy/security areas, so that they can shine 'a thousand points of light' into our private affairs and communications. In order to spy on everyone in a corporation, would you rather have to break a thousand keys, or just one key? Hmmm...tough question... TruthMonger From tm at dev.null Sun Oct 19 10:10:56 1997 From: tm at dev.null (TruthMonger) Date: Mon, 20 Oct 1997 01:10:56 +0800 Subject: GAT & GAB In-Reply-To: <199710190925.KAA00865@server.test.net> Message-ID: <344A3C23.6F66@dev.null> Adam Back wrote: > However the biggest point of all is that: communications keys are more > valuable to any attacker (government, unscrupulous little brother, or > industrial spy) than storage keys. > > I would be interested to see any one willing to burn their > reputational capital refuting that simple point. > > That point is the simple central starting point for all arguments > about the dangers of allowing recovery information to be transmitted > with the communication. Recovery information should be local > whereever possible. Bruce Schneier had harsh words to say about > violating this principle in one of his recent cypherpunks posts. Anyone notice the court ruling in regard to the company that sued to retrieve information that was inside an employee's head, claiming that his employment agreement made *all* of his ideas the property of the company. Anyone notice that the Thought Judge ruled that the Thought Laws required the individual to divulge said ideas, or be imprisoned by the Thought Police? Real-Time Message Recovery = Real-Time Thought Recovery PGP/CMR = Digital Brain Implants Government Access to Thoughts = Government Access to Brains TruthMonger From kent at bywater.songbird.com Sun Oct 19 10:15:38 1997 From: kent at bywater.songbird.com (Kent Crispin) Date: Mon, 20 Oct 1997 01:15:38 +0800 Subject: why we are arguing for more resistant variants (Re: Is PGP still private?) In-Reply-To: <3449311A.1F0E@sk.sympatico.ca> Message-ID: <19971019100620.06593@bywater.songbird.com> On Sun, Oct 19, 1997 at 10:25:08AM +0100, Adam Back wrote: > > Toto writes: > > Kent Crispin wrote: > > > You keep talking as if your CDR proposal is other than vaporware. So > > > far as I have seen you don't have a proposal, you have a wish. > > > > Given Adam's many accomplishments in the arena of CypherPunks issues, > > I find it hard to make a case for his discussion in this area to be > > mere mental masturbation. > > Thanks for the vote of confidence Toto. > > Also I must raise the point that it is not a lone stand. Other people > are arguing against PGP Inc's CMR proposal, and are arguing for more > GAK resistant variants, and alternatives. Apparently for some internal reason you must raise the point, but it is irrelevant. I said your *proposals* were vaporware, not your motivations. It is, as I have said, a waste of time (and yes, mental masturbation) to argue about motivations. [. citations of famous cryptographers and Kent Crispin snipped .] > However the biggest point of all is that: communications keys are more > valuable to any attacker (government, unscrupulous little brother, or > industrial spy) than storage keys. > > I would be interested to see any one willing to burn their > reputational capital refuting that simple point. *Long term* communication keys. Nobody is going to burn reputation capital on that point because it's obvious, and really doesn't need to be argued. Furthermore the point applies just as well to current PGP keys. The *only* additional vulnerabilities of CMR come from 1) the volume of data makes it a more interesting target and 2) the management of the CMR key(s) may be problematic. However, in a large organization the management of *user* keys is problematic, as well, and management of the CMR key(s), on balance, will probably be better. So the additional vulnerability of CMR comes from the fact that it makes a lot of data accessible from one key. This vulnerability could be reduced by having multiple CMR keys -- the accounting dept has one, the CEO has one, and it is the same as his private key that is not escrowed anywhere, etc etc etc. [Is it true that the private key associated with a CMR public key could simply be discarded, rather than escrowed, and everything would still work? -- except that you couldn't recover anything, of course...] A more interesting argument is as follows: what is the real level of security needed for the business communications that will be covered by CMR? It seems obvious that the level of security required, on average, is really quite low. Note that businesses send all kinds of important documents through regular mail, only protected *gasp* by PAPER ENVELOPES. Anyway, Adam, I anxiously await the paper you are working on that gives the real details of your proposals. I'm sure it's readability will be vastly improved if you religiously avoid the use of the word GAK :-) -- Kent Crispin "No reason to get excited", kent at songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html From ravage at ssz.com Sun Oct 19 10:29:55 1997 From: ravage at ssz.com (Jim Choate) Date: Mon, 20 Oct 1997 01:29:55 +0800 Subject: Contractual ownership of ideas and products Message-ID: <199710191749.MAA05252@einstein.ssz.com> Forwarded message: > Date: Sun, 19 Oct 1997 10:58:11 -0600 > From: TruthMonger > Subject: GAT & GAB > Anyone notice the court ruling in regard to the company that sued > to retrieve information that was inside an employee's head, claiming > that his employment agreement made *all* of his ideas the property > of the company. > Anyone notice that the Thought Judge ruled that the Thought Laws > required the individual to divulge said ideas, or be imprisoned by > the Thought Police? IBM has such a non-disclosure agreement that apparently signs over to them any and all work I may do while employeed by them. Fortunately I had other pre-existing agreements and when I signed the paper as a function of employment I added a proviso that I had a consultancy as well as pre-existing non-disclosures that limited their rights to my work to only that performed while on-the-clock. Two years later they have never contacted me regarding this so I assume they accepted it. I know of another engineer here who said that such proviso's didn't apply to him because he was under pre-existing contracts with the government (in various ways) that prevented that sort of contract with him. They didn't refuse him employment either... Contracts are contracts, if you don't like a part of it then mark it out and put your own proviso's in their. If they accept it, by paying you wages for work, then you are pretty much done with such broad intellectual property issues. That's the nice thing about contracts, as a signatory you have a right to review and modify the contract. Use that right. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From tcmay at got.net Sun Oct 19 11:04:00 1997 From: tcmay at got.net (Tim May) Date: Mon, 20 Oct 1997 02:04:00 +0800 Subject: "First do no harm" In-Reply-To: <199710181953.UAA00908@server.test.net> Message-ID: At 10:44 PM -0700 10/18/97, Fabrice Planchon wrote: >I would say people who wrote the current law 2 years ago didn't have a >clue on the technical issues, anyway. That's why we are still waiting >for the "decrets d'application", which are the set of rules on how the >law will be enforced. Somehow I would bet they are waiting to see where >the wind blow at the international level. I'm not sure the people who wrote the U.S. laws had a clue, either. (Check out Dan Bernstein's report in sci.crypt on the latest appeal arguments of the government side in his case...the Feds are arguing that the First Amendment (to the U.S. Constitution) does not protect speech that may be read and acted upon by computers!). >I know at least one academic site where system administrator were >prevented from switching to ssh because of the legal issue. Seems the >campus administration folks wanted to protect their asses... This is an important point. Covering their asses. I think much of the "corporate demand" for CMR and CAK has been coming from medium-level bureaucrats, the mid-level "security staff" who make recommendations on corporate and institutional purchases. It's not too surprising that the security staff at Random Corporation and at the University of Middle America want access to all communications...if it were up to them alone they'd have video cameras scattered everywhere. But I predict serious downstream (future) objections to CMR and CAK will arise. Once the higher-ups at Random Corporation realize that all e-mail will now be logged in perpetuity for easy perusal in lawsuits, FTC actions, etc. (*), they'll no doubt have second thoughts. (* It may be argued that all corporate e-mail is already archived, on the machine backups for the corporate mail servers, SMTP, etc. Possibly, but such e-mail is often hard to get. Some sites may choose to not keep mail server backups, etc. Certainly ISPs have the same machine backups, and yet it has proven difficult for investigators and whatnot to get complete e-mail archives on targets. A CMR or CAK system would formalize the archiving and make obtaining such records much easier. A very tempting target indeed for "discovery" procedures. Or for law enforcement.) And as for the University of Middle America, wait until professors and students discover that UMA bought PGP 5.5 Snoopware for Sysadmins and that communications with other professors, other employers, etc. will be subject to snooping by some low-level security employees. ... >still). But what I certainly fail to understand is why PGP inc (and >people who support them) is focusing on a solution which allows to >intercept and read e-mail in transit. That inherently evil, no matter I agree. It makes the job of snoopers much easier. And while I don't dispute the property right of a business owner to state the terms of encryption use on his property, the practical situation is that few businesses tape-record all telephone calls, open all incoming and outgoing physical mail, etc. Even though this is in some sense their "right," they realize the morale effects this would have on employees, the trust issues, and the sheer impracticality. (I am reminded of the issue of "personal use" of telephones in companies. Companies which forbid personal use find decreased productivity as employees leave the premises to find payphones, or queue up at the payphones in the cafeteria, etc. Most companies have decided to let employees--especially their professionals--use their phones for personal uses, within reason. (My company, Intel, had this policy, though a printout of calls to long-distance locations was kept, of course, and occasionally there were inquiries made about the purposes of calls, etc.)) What I expect will happen with CMR and CAK is that employees or professors or whatever who really need confidentiality--and their are many valid reasons for this--will use either their own products (probably freeware, to boot), or will use non-company accounts. The professor at UMA who doesn't want administrations snoops monitoring his e-mail will use his AOL or Netcom account. As we are already seeing today. If his institution has a firewall preventing such services from being connected to (itself a hardship), he'll just wait until he gets home and send his sensitive mail then. PGP could actually lose business this way. >you put it. And the "hit by a truck" hypothesis doesn't stand a minute >in real life (Yah, shit happens, so what ?). The (legitimate) needs of a >company can be achieved via an agreement with its employees, on how data >are stored, backed, duplicated, whatever, and it has merely nothing to >do with cryptography. Or am I missing something obvious ? No, you're not missing anything. The claimed need that PGP for Business fills is that of recovery of important information. In fact, it fails miserably at that. (For reasons several of us have outlined. First, truly confidential information will be sent in other ways, as noted above. Second, very little of the important stuff ever travels by e-mail, for obvious reasons. Third, the important files in the "hit by a truck" scenario are the gigabytes of local storage on user machines...the circuit files, the process descriptions, the work in progress, the source code, etc. These are the files a company wants to protect against unrecoverable encryption. And these files have very little to do with mail encryption.) What PGP for Business appears to do, the market it appears to satisfy, is the desire for some companies and institutions to be able to monitor what their employees are saying to each other, to detect banned language, to cover their asses for lawsuits, etc. (In fact, it fails at most of these uses, too. For obvious reasons. And it introduces new risks for lawsuits, as noted above.) >And as far as the "legitimate needs of the law enforcement agencies", >well, if they want to read e-mail sent by an employee from his company >account because he is a potential drug dealer, they can obtain the >proper authorization from the court and snoop on the guy from within the >company. As usual, the weakest link is the guy typing on his keyboard, >as I doubt anybody speaks IDEA fluently...(even rot13 I am >skeptical. Crime organizations in Paris at the beginning of the century >were using "Javanais", which was a very basic code, but sufficient to >confuse the police) Exactly so. I believe governments will _like_ PGP for Business because it simplifies the monitoring process for them. If they get a court order telling Random Corporation to turn over their keys, or convince Random Corporation to voluntarily cooperate, they now have easy access to _all_ of the traffic. I believe it's a slam dunk certainty that corporations in many countries will be required on a pro forma basis to give their keys to the law enforcement agencies. This does not even seem debatable. Of _course_ these will be turned over. (By focussing on the United States we, and PGP, Inc., is missing the obvious reality that most of the world's nations have no constitutional protections sufficient to stop this from happening. And even the U.S. may be able to get these keys easily...invocation of "commerce" and FTC/SEC sorts of issues may be sufficient.) >So why isn't everybody focusing on being sure the transport layer is >secure, and leave to social interaction at both end of the communication >process the problem of recovery of whatever was transmitted ? (which, I >feel dumb for saying it, was in clear at some point before being sent, >and will be when it will be read...) This is what some of us have been saying for a long time. I advocate KISS, "Keep it Simple, Stupid," for the OpenPGP effort. Let PGP, Inc. go off on quixotic crusade to provide snoopware for corporations and universitites, and let the market decide. PGP, Inc. should remind themselves of the moral promise doctors make: "First do no harm." --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From irdial at irdialsys.win-uk.net Sun Oct 19 11:38:12 1997 From: irdial at irdialsys.win-uk.net (Irdial-Discs) Date: Mon, 20 Oct 1997 02:38:12 +0800 Subject: Numbers Stations Message-ID: <3.0.3.32.19971019192709.007d5210@pop3.ibmpcug.co.uk> -----BEGIN PGP SIGNED MESSAGE----- Numbers Stations: One Time Pad crypto in use over shortwave for at least 30 years. See: http://www.ibmpcug.co.uk/~irdial/conet.htm and http://www.ibmpcug.co.uk/~irdial/crackhome.htm All comments/feedback welcome; we also need some qualified judges for the second URL, so email us if you want to have some fun. thanks Akin Fernandez Irdial-Discs -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNEpQ+4BwiB5FzDvpAQFdlQP/YsOVevse7fUUgSU+DKI5nWLQrirbNrsE SVjnZzJDKYxgmIcuov2bJ95vcamPrrJduiuJMlA3/YARb56NlroFhqgSaa9KQ+S3 EMXxYbrv9qaDcIou6CalFsgYL+4qWtPwwskCgGENWMtRw9+OpXVoIOG+fV0N40rW V2bA/jzLxz4= =S+4s -----END PGP SIGNATURE----- From nobody at bureau42.ml.org Sun Oct 19 11:49:02 1997 From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer) Date: Mon, 20 Oct 1997 02:49:02 +0800 Subject: No Subject Message-ID: Throw Misty From The Train From fabrice at math.Princeton.EDU Sun Oct 19 11:51:28 1997 From: fabrice at math.Princeton.EDU (Fabrice Planchon) Date: Mon, 20 Oct 1997 02:51:28 +0800 Subject: Security flaws introduced by "other readers" in CMR In-Reply-To: <19971019014419.47580@math.princeton.edu> Message-ID: <19971019143216.59535@math.princeton.edu> On Sun, Oct 19, 1997 at 10:03:24AM +0100, Adam Back wrote: > I talked to some people at CESG (Communications Electronics Security > Group) (they are part of GCHQ, UK NSA equivalent) in a business > setting. It was they who said that France was changing position to > going over to "key escrow" or TTPs (Trusted Third Parties). From I think what caused me to answer was in part your words "changing position": let's say that up to recently, the french govt position was no crypto at all (except for authorized entities, and only weak, ie breakable, crypto). Given the trend on that issue, related to on-line commerce and so on (the reader has to keep in mind that in France I seriously doubt the average politician has an idea of what this means. At best they know the french minitel, which is completely different), they felt some pressure to change the law in order to permit the use of crypto. So the move was, well, let's authorize strong crypto but let's keep the keys. Understandable point of vue, I would say. They want that because they feel it means statu quo for them, and that's all. All political issues aside, the technical issues are ignored, because the guys who decide have no clue, and they probably don't listen to their own experts who would say that TTP, GAK, key recovery, whatever, are not that easy to design, implement, and maintain on a everyday basis. And for that matter, I don't think the situation is that much different in other western countries, US included. > Perhaps the CESG are exaggerating because they would like this to be > the case because it suits their argument. Yeah, probably. But there is another problem, anyway: some countries within the EC won't pass any legislation restricting cryto, I think. So any country within the EC having such a legislation is likely to have trouble with its partners at some point. Somehow it's like Chirac who decided to maintain customs with Belgium because people go to Amsterdam to buy drugs. But in the meanwhile, the border with Germany no longer has customs, so you drive through Germany to Holland and that's it. So, it's utterly inefficient, but on the domestic political scene, he can appear as been strong on drugs. > > > With the pgp standard as is french government could insist that people > > > use pgp5.x. pgp5.x provides a reasonablly useful framework for the > > > french government to adapt to be used as a master access system. > > > > http://www.lemonde.fr/multimedia/sem4297/textes/act42972.html > > > Do they actually mention PGP software, or OpenPGP standard? Or just > the general principle? They do: the title is "Le programme PGP se range", which I unfortunatly have know idea of how to translate. And then, they say (I loosely translate, my english is better than our MISTY friend's, but not perfect ;-) The last version, aimed at compagnies, of this crypto software (still banned from use in France) includes the highly controversial feature known as key escrow. [...] Of course this system has advantages: when an employee is sick or away, you can access his files. But, it's reasonnable to think that such a system could be used for spying purposes. Within the governement, the key escrow proposal is seriously challenged. Some, in charge of national security, favor it as necessary to decrypt terrorists or drug dealer messages, and others, more concerned by privacy, are against it. In France, the governement chose this option of TTP. [Note: somehow this last sentence is in contradiction with the previous one. It's *not* a side effect of my translation...] Then, the article recalls that the situation was different in the US, and that the FBI would like to have something like key escrow, but that a recent proposal was defeated in congress. They finally recall how PGP is widely available all over the world, and how the last version was exported as a book to defeat the export controls. So, I certainly agree with you that the proGAK have won, or will. As long as they don't enforce the current laws, as an individual I don't care. But I fear, as you do, that as soon as you have things like pgp 5.5 which are available, they will start saying "use this or go to jail". > But, the simple fact is that I think PGP Inc have not evaluated these > indirect implications for GAK politics. This means I think that they > have pure intentions. Unfortunately these pure intentions do not help > us if the effect is as I fear: that the result helps the GAKkers to > some significant amount. I think, but I might be wrong, that they have at least to reasons, which have already be given: -first, what they did was somehow "easy" (don't jump on me, I don't write code !!) to implement within the existing code. This is reflected by what W.Geiger said, that anything pgp5.5 does he could do with scripts in the old version. Or at least a good part of it. -second, they don't know what will happen in 12 months, so they cover their asses. I hope this isn't true, but it's a matter of personnal opinion more than anything else. > You confirm my suspicions. I have several people I know in France who > use encryption illegally. Not least of these is Jerome Thorel himself > :-) (He who interviewed the SCSSI and had it spelt out to him that it > was illegal, but they wouldn't bother you if you didn't ask > permission). However those that I know are effectively anti-GAK > activists, or cypherpunk type individuals. A quick search on the MIT key server tells you that there are 538 valid keys registered with an *.fr address. If you remove all keys registered in 97, you are left with 232. Remove 96, it goes down to 132, 95 -> 39 and then I know a fair number of them ;-) So, it seems to me that the number of illegal users is growing up, anyway. Interesly enough, most of the registered users are registered with personnal e-mail addresses, not compagnies e-mail addresses, if you except academic sites. > It is not really that technical an idea. The idea is simply that > communications keys are more valuable to government than storage keys. >[...] > The reason is that they consider it purely a recovery mechanism for > stored emails. That it has this side effect of making a product which As I said before, I guess they did it this way by lazyness more than anything else. I think your solution requires more thinking, new code, and all that sort of things. More brain demanding, in some sense (and time consuming, whereas their solution is ready, works, can be sold, makes the compagny make profits, and so on). So, arguing with political arguments doesn't stand a chance against a market driven compagny, be it PGP with all its reputation capital. Everybody should concentrate on technical issues, and several of these have been pointed out, by you and others. > There you have the Tim May proposal. Do not recover, just store in > clear. Most data on disks already is, so why bother. If you want to > encrypt work out those problems when you come to them, as a separable > issue. This is a very compelling argument to me. Well, facts are that it is the current situation, and IIRC what TM what saying. Once again, in term of costs, it's the easiest solution. And within a compagny, in a trusted environment, it doesn't matter wether your hard drive is encrypted. Things which need protection from inside snooping are usually protected via other more traditionnal mechanisms. Safe, locks, and so on. If you think to locks, which are often compared to crypto, most people fail to see that locks are not made to prevent somebody to break in: they are designed to make the break-in difficult. Your house door lock is probably pickable in a matter of minutes (standard locks seem to be really easy to pick in the US, but I digress...). Locks in a bank are not. So, as for crypto, difficult is replaced by virtually impossible, you have to think twice before encrypting something: it's the reverse argument, it is so valuable that I might stand a chance to be unable to recover it ? This is, of course, purely a storage issue. And I like the idea (Bill Stewart's ?) of implementing a mechanism which would simply "weaken" the storage key, so that if it's lost, you can recover the missing part by brute force. I think it's Jon Callas who made a related analogy with a car and what happens if you have the lost your key: bad example. Suppose you want to buy a car, and the dealer tells you, I have this new security feature, unbreakable. Only drawback, if the (unique) key is lost, you can tow away the car. Well, I won't buy it. Nobody will. (while we are on car locks, car makers use the same lock on several cars, so if you have an honda accord, you have a non zero probability of opening a random other honda accord, albeit very low). Anyway, the car problem is like a storage problem, and has to be adressed as such. Nothing to do with securing a (temporary) channel. Somehow, if I was to rent such a car, I would take it, provided I am no liable if the key is lost ;-). This because on a short period of time, I won't likely make anything stupid with that key, and I like the idea that nobody will steal the car while I am havin dinner. So different situations, different answers. > Also this is the status quo. Already the police, or terrorist > prevention investigators can inflitrate, perform dawn raids, etc. and > this is as it should be. Statu quo is fine with me in that respect. Insert the usual quote on technology and the police state. I tend to think that technologies lead to brave new world anyway, but at least in brave new world people are "happier" than in 1984. F. -- Fabrice Planchon (ph) 609/258-6495 Applied Math Program, 210 Fine Hall (fax) 609/258-1735 From ravage at ssz.com Sun Oct 19 12:02:10 1997 From: ravage at ssz.com (Jim Choate) Date: Mon, 20 Oct 1997 03:02:10 +0800 Subject: WebX?13@@.ee7b0a7 Message-ID: <199710191918.OAA05623@einstein.ssz.com> [LINK] Navigation [LINK] Community News Chat Message Boards CNN Insider Consumer Food Health Parenting Software News Plus Plus Mail Week In Review Resources Media Search CNN In-Depth Newsmakers Video Almanac Web Kit Transcripts Games! Daily Crossword Head Games Get the Picture? Now Ear This! FEEDBACK HELP! Infoseek BigYellow [INLINE] [LINK] [INLINE] [LINK] Message Boards Home Sci-Tech Message Board Topic: Internet taxation The nation's governors and local officials, already having difficulty collecting taxes on catalog sales, said Friday, October 17, a bill aimed at restricting new taxes on the Internet would worsen their problems. Full Story Should states collect taxes on the net? _______________________________________________________________ Dan Grawe - 10:49am Oct 19, 1997 ET (#1 of 7) Nothing says "GREED" like a politician with too much idle time. When will there be an end to oppressive taxation. I'm not apposed to paying taxes, but good Lord, do they have to tax everything. I think we need to get the air conditioning taken out of the government buildings, so they don't sit around thinking up new and better ways to put the screws to the people who already pay their way. _________________________________________________________________ joseph herr - 01:15pm Oct 19, 1997 ET (#2 of 7) ...the internet is uniting the whole planet together in a smarter, more organic , more honest way, its improving everything and giving all of us easier, more logical alternative solutions in energy , education, food , work and communications ...how can politicians destroy something this good and free ? one way is with taxes....lets stand united against the politicians corrupt tricks to start manipulating this wonderful new tool for growth and democracy...lets leave taxes, obsolete religion manipulators, crime and absurd greedy politics out from this wonderful new peaceful way....global peace.... _________________________________________________________________ Matthew Snyders - 01:28pm Oct 19, 1997 ET (#3 of 7) I am not at all surprised that some brain-dead politicians who would sell their daughters into slavery for a little cold cash would attempt to tax the Internet. Joseph Herr: If we were to stand united against this, how could we? What would we do? _________________________________________________________________ Michael Mendenhall - 01:34pm Oct 19, 1997 ET (#4 of 7) No article I've yet to review has provided a coherent argument for the public-policy which would be satisfied by Internet taxation. Nothing concerns me more than politic automatons who cannot resist the urge of government interference in commerce for the sake of government control. Few realize that the technology industry of the past decade is primarily responsible for our comparative advantage over foreign markets. Taxing Internet activity will be the foothold which turns this tide. _________________________________________________________________ David Lefavour - 01:45pm Oct 19, 1997 ET (#5 of 7) The Internet is already taxed through the existing telephone tax collections. Special taxes for the Internet is simply another example of double taxation. Most of us are fully aware of the objectives behind such efforts and we have had it up to our noses with this nonsense. The time to put a halt to this is already past due. _________________________________________________________________ William V. Beshlian - 02:03pm Oct 19, 1997 ET (#6 of 7) Doesn't local government already collect taxes from our local phone and cable companies that most of us use to get to our Internet Service Providers? That being the case, we are already being taxed once. This appears to be an attempt at taxing us twice for the same service. Think about it...... _________________________________________________________________ Michael Benezra - 02:37pm Oct 19, 1997 ET (#7 of 7) Any government that would dare tax the Internet will find Internet businesses fleeing that country and operating from a different local. After all, on the Internet it does not matter where you are, but what you provide to your customers. If you operate from the US or Hong Kong does not make a difference to anyone. Prefs Subscribe Suggest Check Boards Search Unsubscribe _______________________________________________________________ To post a message, compose your text in the box below, then click on Post My Message (below) to send the message. A blank line starts a new paragraph. A line starting with 'b ', 'i ', 'c ', '* ', '] ', or '> ' provides simple formatting. You may use HTML and links to previous messages. See the quick-edit help for more information. _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _________________ _______________________________________________________________ You cannot rewrite history, but you will have 30 minutes to make any changes or fixes after you post a message. Just click on the Edit button which follows your message after you post it. © 1997 Cable News Network, Inc. A Time Warner Company All Rights Reserved. Terms under which this service is provided to you. External sites are not endorsed by CNN Interactive From ravage at ssz.com Sun Oct 19 12:06:59 1997 From: ravage at ssz.com (Jim Choate) Date: Mon, 20 Oct 1997 03:06:59 +0800 Subject: index.html Message-ID: <199710191918.OAA05602@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Tech banner IBM Active Channel for Microsoft Internet Explorer. Find out about your chance to win a computer click here for official rules and information. rule GOVERNORS WARN COLLECTING INTERNET TAXES WOULDN'T BE EASY Internet taxes October 17, 1997 Web posted at: 11:12 p.m. EDT (0312 GMT) WASHINGTON (AP) -- The nation's governors and local officials, already having difficulty collecting taxes on catalog sales, said Friday a bill aimed at restricting new taxes on the Internet would worsen their problems. "It's very similar," Republican Gov. George V. Voinovich of Ohio said at a press briefing. "We've had an ongoing problem in terms of how to handle that. We've been continuing to try and work that out with those businesses in the states that have the large mail-order catalogs." The National Governors' Association estimates states lose $4 billion in sales taxes annually from catalog sales. That's because states, cities and counties generally lack the authority to capture sales taxes on such sales if the catalog business is headquartered out of state. That problem could only intensify based on the projected growth of electronic commerce. Voinovich cited one estimate of $1.5 trillion in sales on the Internet by 2002. "I don't think this is the time for the federal Congress to rush into something that will have such a huge impact on state and local government," he said. Joining Voinovich to oppose the Internet tax bill were leaders from the National Association of Counties, National League of Cities and U.S. Conference of Mayors. Rep. Chris Cox, a Republican from California, and Sen. Ron Wyden, an Oregon Democrat, have sponsored similar bills that would bar any new taxes on computer transactions -- such as taxes on Internet access or online services -- for an unspecified time while Congress studies the whole issue. The bill would make an exception to the moratorium for income earned through an Internet service; local business license taxes, if the Internet provider is located within the appropriate jurisdiction; and sales or use taxes, so long as they are the same as charged for mail or telephone orders. "We would love to have the bill say what the sponsors say it says," said Brian J. O'Neill, a Philadelphia city councilman, representing the National League of Cities. But O'Neill and others say the technical language of the bill contains a broad pre-emption of state and local taxes. Wyden spokesman David Seldin strongly disagrees. "We have bent over backwards to clarify language of the bill so there can be no questions" that local governments retain authority to levy the same taxes on the Internet that are assessed on catalog sales, Seldin said. The bill seeks to halt new local taxes aimed specifically at Internet businesses. One National Governors' Association official said the bill's wording would worsen the states' problem of collecting sales taxes on catalog sales. "We know that we have to sit down with the industry and make the sales tax work on Main Street, on catalogs and on Internet, in some simplified, clear and technologically neutral way," said Tim Masanz of the association's economic development group. "If Congress goes on record and says that Internet sales are the equivalent of catalog mail-order sales, those talks are doomed," he added. "I can understand their desire to fight that battle but it would certainly not do much good to create a situation where you are favoring one at-home purchase over another," said Seldin. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. rule Related story: * House panels back Internet taxation bill - October 9, 1997 Related sites: Note: Pages will open in a new browser window * THOMAS - Legislative Information on the Internet + HR 1054 - Internet Tax Freedom Act * U.S. House of Representatives + Commerce Committee + Judiciary Committee * National Governors' Association * National League of Cities External sites are not endorsed by CNN Interactive. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Watch these shows on CNN for more sci-tech stories: CNN Computer Connection | Future Watch | Science & Technology Week rule Message Boards Sound off on our message boards You said it... [INLINE] IBM Active Channel for Microsoft Internet Explorer. Find out about your chance to win a computer click here for official rules and information. rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From aba at dcs.ex.ac.uk Sun Oct 19 12:19:22 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Mon, 20 Oct 1997 03:19:22 +0800 Subject: why we are arguing for more resistant variants (Re: Is PGP still private?) In-Reply-To: <19971019100620.06593@bywater.songbird.com> Message-ID: <199710191815.TAA04506@server.test.net> Kent Crispin writes: > On Sun, Oct 19, 1997 at 10:25:08AM +0100, Adam Back wrote: > > Also I must raise the point that it is not a lone stand. Other people > > are arguing against PGP Inc's CMR proposal, and are arguing for more > > GAK resistant variants, and alternatives. > > Apparently for some internal reason you must raise the point, but it > is irrelevant. I said your *proposals* were vaporware, not your > motivations. It is, as I have said, a waste of time (and yes, mental > masturbation) to argue about motivations. Motivation is irrelevant. The road to hell is paved with good intentions. All the sides in the argument (except for Freeh and the USG/NSA) have good intentions (and perhaps even Freeh from his perspective). Fooh on good intentions. Let's keep this discussion focussed on: The design of systems which are hard for governments to abuse in introducing GACK You made one contribution in this area in your last post. Keep up the technical contributions, and scenario likelihood evaluations. > > However the biggest point of all is that: communications keys are more > > valuable to any attacker (government, unscrupulous little brother, or > > industrial spy) than storage keys. > > > > I would be interested to see any one willing to burn their > > reputational capital refuting that simple point. > > *Long term* communication keys. Nobody is going to burn reputation > capital on that point because it's obvious, and really doesn't need to > be argued. If it doesn't need to be argued, why does pgp2.x and pgp5.x use long term communication keys? Why does pgp5.x then go exacerbate this problem encouraging use of not one but two long term communications keys. Why does it provide recovery methods for long term communications keys when the stated user requirement is to recover stored email archives? ie. the discussion just took this form: Adam: X is a bad security idea. X is used in pgp2.x and pgp5.x Kent: modification Y to pgp5.x doesn't make it any worse Adam: So? It's still a bad idea, and here are ways to make it more secure, and harder for governments to abuse to boot Kent: ? (we're waiting) Surely the most straight forward way to provide recovery for email archives is to archive the emails encrypted to a storage-only key, with this key escrowed in some way? You then don't need to recover email in transit -- you don't even have a copy of it. This is clearly more resistant to government abuse. Do you disagree? (The above paragraph is basically all my CDR proposal is .. it seems straight forward, intuitive, more secure; I went through and countered your previous objections to worked example #1, you did not reply to those counter-points). > Furthermore the point applies just as well to current PGP keys. The > *only* additional vulnerabilities of CMR come from 1) the volume of > data makes it a more interesting target and 2) the management of the > CMR key(s) may be problematic. You missed a couple: 3) the goverment will love to get come ask for your CMR key because it protects all past emailed ciphertext 4) some governments (eg France) will probably ask for one of the CMR keys to be theirs > However, in a large organization the management of *user* keys is > problematic, as well, and management of the CMR key(s), on balance, > will probably be better. So the additional vulnerability of CMR comes > from the fact that it makes a lot of data accessible from one key. > This vulnerability could be reduced by having multiple CMR keys -- the > accounting dept has one, the CEO has one, and it is the same as his > private key that is not escrowed anywhere, etc etc etc. Yes. Several people have suggested this. Also secret sharing is being considered by PGP Inc for the next version I think. > [Is it true that the private key associated with a CMR public key > could simply be discarded, rather than escrowed, and everything would > still work? -- except that you couldn't recover anything, of course...] I would think so. This would argue for updating the CMR communications key as frequency as is practicable to minimise danger. (Same argument as update requirements for user communications keys). Hal Finney discussed this requirement of matching expiry frequency on comms keys & corresponding CMR keys a few messages back. > A more interesting argument is as follows: what is the real level of > security needed for the business communications that will be covered > by CMR? It seems obvious that the level of security required, on > average, is really quite low. Note that businesses send all kinds of > important documents through regular mail, only protected *gasp* by > PAPER ENVELOPES. This suggests that Tim May is right, and the simplest solution is to store the decrypted received emails in clear on the disk. Most of the companies are in fact storing on disk. > Anyway, Adam, I anxiously await the paper you are working on that > gives the real details of your proposals. I'm sure it's readability > will be vastly improved if you religiously avoid the use of the word > GAK :-) Could you provide a less emotive suitable alternative word which I can use as a replacement to describe government communications key grabbing attempts? GACK is what Carl Ellison proposed as a more accurate way to express "Goverment Access to Communications Keys" than terms such as "key escrow", "key recovery", which are government coined terms. PGP Inc themselves being mostly cypherpunks and pro-privacy people use the term GACK also. GACK seems a pretty good acronym to me, accurate, descriptive. Are we getting goverment-correct now as well (as politically-correct)? So that we must not use terms which are offensive to governments? (I will attempt to avoid negative political comments about PGP Inc's implementation, and phrase in terms of constructive criticisms though, and perhaps this was your point given my earlier outbursts in this regard; perhaps you can help proof read for this). Cheers, Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <19971019151704.25165@math.princeton.edu> On Sun, Oct 19, 1997 at 10:54:18AM -0700, Tim May wrote: > I'm not sure the people who wrote the U.S. laws had a clue, either. (Check > out Dan Bernstein's report in sci.crypt on the latest appeal arguments of > the government side in his case...the Feds are arguing that the First > Amendment (to the U.S. Constitution) does not protect speech that may be > read and acted upon by computers!). Ohoh. How interesting. But they have to define what they mean by acted upon computers, and we are back to a technical issue they don't understand. But does the judge understand this issue better ? If I recall correctly my CS classes, translating plain english to computer code is doable, and depending on what rules you use for lexical and syntaxical issues you would get different codes. Wether you can do something with it is another issues, of course... Somehow if they follow this heuristic, they will have to ban speech recognizion software (which would be bad for me as my research has potential applications exactly there). > corporate and institutional purchases. It's not too surprising that the > security staff at Random Corporation and at the University of Middle > America want access to all communications...if it were up to them alone > they'd have video cameras scattered everywhere. eheh, I had an argument with my local (PU) system administrator, and at some point he said "and what are all mails coming from cypherpunks anyway ?" (I hope he reads this one...). So, they are already snooping, by fear, or because in a moment of boredom, they look at the mail log (the same way phone operators in the old days were listening to calls, I guess. Part of human nature) > And as for the University of Middle America, wait until professors and > students discover that UMA bought PGP 5.5 Snoopware for Sysadmins and that > communications with other professors, other employers, etc. will be subject > to snooping by some low-level security employees. Somehow, I can play the devil advocate and argue that it would be better than the current situation where: 1) people don't use encryption at all 2) networks are weakly secured and snooping is easy 3) people use e-mail without thinking it can be snooped, archived, and reused later, unlike, say, a phone call. If you tell a professor that any student can easily read his e-mail but that with this nice pgp5.5 software it will be no longer the case, he might embrace it readily, even if on the long run and on second thoughts it might not be a good idea. > What I expect will happen with CMR and CAK is that employees or professors > or whatever who really need confidentiality--and their are many valid > reasons for this--will use either their own products (probably freeware, to > boot), or will use non-company accounts. The professor at UMA who doesn't > want administrations snoops monitoring his e-mail will use his AOL or > Netcom account. As we are already seeing today. If his institution has a > firewall preventing such services from being connected to (itself a > hardship), he'll just wait until he gets home and send his sensitive mail > then. Somehow, and even if I perfectly agree with you, you forget to see that while this may be true for professors from, say, CS, Engineering, Math, it won't be true for others which don't have the technical background to understand the problems and their solutions. I guess what I am saying is what seems obvious to you, me, and probably most of the readers is not the the general public. And the group of all professors at UMA probably reflects this. Unfortunatly I don't have any solution to the advertising crypto problem. My best hope is that within a generation people will understand the technical issues and the underlying social implications of the way you make implementations. I fear it might be to late then... > I advocate KISS, "Keep it Simple, Stupid," for the OpenPGP effort. Let PGP, > Inc. go off on quixotic crusade to provide snoopware for corporations and > universitites, and let the market decide. Yes and no, as I said before it's not clear what the market will decide, if people who make key buying decisions don't do the right thing. Once every single university is equipped with pgp5.5, it's not that easy to go back. And because of their reputation capital, people are more likely to buy the product blindly. Sounds scary ? I don't believe in conspiration theory, usually stupidity, ignorance and such are enough to make bad things happen. And we see it now. F. -- Fabrice Planchon (ph) 609/258-6495 Applied Math Program, 210 Fine Hall (fax) 609/258-1735 From tcmay at got.net Sun Oct 19 13:05:59 1997 From: tcmay at got.net (Tim May) Date: Mon, 20 Oct 1997 04:05:59 +0800 Subject: "First do no harm" In-Reply-To: Message-ID: At 12:17 PM -0700 10/19/97, Fabrice Planchon wrote: >On Sun, Oct 19, 1997 at 10:54:18AM -0700, Tim May wrote: >> I'm not sure the people who wrote the U.S. laws had a clue, either. (Check >> out Dan Bernstein's report in sci.crypt on the latest appeal arguments of >> the government side in his case...the Feds are arguing that the First >> Amendment (to the U.S. Constitution) does not protect speech that may be >> read and acted upon by computers!). > >Ohoh. How interesting. But they have to define what they mean by acted >upon computers, and we are back to a technical issue they don't >understand. But does the judge understand this issue better ? If I By the way, the main discussion for this Bernstein point is on misc.legal.computing, where followups have been redirected. He asked for examples, modern and old, of where the government's position could be used for prior restraint and censorship. I suggested JPEGs and GIFs, which are clearly machine-readable instructions telling a computer how to write a pattern of pixels in a display window. Are we to presume that such JPEGs and GIFs (and WAVs and MOVs and...) have lost their First Amendment protection? If upheld, the CDA would not even be needed. Oh, folks, don't submit your own examples _here_. Do it in the appropriate thread in misc.legal.computing, so Bernstein can get a lot of examples collected. >> corporate and institutional purchases. It's not too surprising that the >> security staff at Random Corporation and at the University of Middle >> America want access to all communications...if it were up to them alone >> they'd have video cameras scattered everywhere. > >eheh, I had an argument with my local (PU) system administrator, and at >some point he said "and what are all mails coming from cypherpunks >anyway ?" (I hope he reads this one...). So, they are already snooping, >by fear, or because in a moment of boredom, they look at the mail log >(the same way phone operators in the old days were listening to calls, I >guess. Part of human nature) Yes, they snoop. Out of boredom, out of instructions from Administration, whatever. Encryption will help, but not if the same snoopers can continue to snoop. >> And as for the University of Middle America, wait until professors and >> students discover that UMA bought PGP 5.5 Snoopware for Sysadmins and that >> communications with other professors, other employers, etc. will be subject >> to snooping by some low-level security employees. > >Somehow, I can play the devil advocate and argue that it would be better >than the current situation where: >1) people don't use encryption at all >2) networks are weakly secured and snooping is easy >3) people use e-mail without thinking it can be snooped, archived, and >reused later, unlike, say, a phone call. I disagree. Snoopware will tend to centralize the files to a point where snooping is easier. Those using PGP 5.0 and earlier will likely be told to switch to the snoopware version. While many may not encrypt now, this is changing. Snoopware rolls back the clock. To be clear: we should be advocating the wider use of strong encryption, not arguing that snoopware is better than nothing. Nothing is not really the proper alternative to weigh snoopware against. >If you tell a professor that any student can easily read his e-mail but >that with this nice pgp5.5 software it will be no longer the case, he >might embrace it readily, even if on the long run and on second thoughts >it might not be a good idea. Why does this professor not have the option of PGP 5.0? That's the real alternative to consider. (Some of us have fears that development of the "free" version of PGP will not be supported or developed. While PGP may _hope_ that many buy the PGP 5.0 they plan to sell to individuals, the fact is that most individuals won't pay money for what they can get for free. This is presumably a motivation for the development of PGP for Business, with Netscape-like incentives for corporate buys.) >> I advocate KISS, "Keep it Simple, Stupid," for the OpenPGP effort. Let PGP, >> Inc. go off on quixotic crusade to provide snoopware for corporations and >> universitites, and let the market decide. > >Yes and no, as I said before it's not clear what the market will decide, >if people who make key buying decisions don't do the right thing. Once >every single university is equipped with pgp5.5, it's not that easy to >go back. And because of their reputation capital, people are more likely >to buy the product blindly. Sounds scary ? I don't believe in >conspiration theory, usually stupidity, ignorance and such are enough to >make bad things happen. And we see it now. We all agree that widespread adoption of PGP 5.5 could be scary. Hence our concerns. (Even more scary are the many ways various governments could gain easy access to the CMR keys. Whereas enforcement of key escrow is difficult with millions of diverse, anarchic users and approaches, CMR essentially centralizes the target nicely.) --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From stewarts at ix.netcom.com Sun Oct 19 13:17:50 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Mon, 20 Oct 1997 04:17:50 +0800 Subject: Revealing individual messages. In-Reply-To: <199710180748.IAA00798@server.test.net> Message-ID: <3.0.3.32.19971019130323.006dbf48@popd.ix.netcom.com> At 02:34 PM 10/18/1997 +0100, Ian Miller wrote, to ietf-open-pgp at imc.org >One thing sadly lacking from all current PGP implementations is the ability >to reveal the contents of _some_ messages encrypted to you, without handing >over the secret key. This is most important as damage limitation when >ordered by a court of law to reveal certain messages. [The most >pathological case is where Mallory has generated those messages himself, >merely to persuade the courts to force you to hand over your privacy key.] The easy approach is to decrypt the message, but there's of course no way for the Court to validate that your decryption was correct. But if you want more than that, it's not hard to write, either by finding where in the 7000 pages of PGP source (:-) to add a few print statements, or by using the APIs when they come out. Perhaps it's even there today, by setting -debug=42 or whatever. The decryption needs to show 1) The public key that was used to encrypt the message 2) The PK-encrypted session key, including the random padding 3) The decryption of the PK-encrypted session key, including the random padding, (and including the algorithm indicator, if it's encrypted) 3.1) Indication of which bits are the session key itself, for the slow-witted 4) The decrypted compressed plaintext (optional) 5) The decrypted raw plaintext And it would be nice to have a tool that also provides a mechanism to encrypt a random-padded session key to a public key to verify the output. Perhaps Adam Back (et al.)'s 2-line perl code, with some pretty output formatting. > Accordingly for RSA encryption at least I propose a >modification to the DEK plaintext that contains the session key. Currently >this is largely random containing over a hundred bytes of nonce >(for a 1024bit-key). If part of this nonce was replaced by sender-Id, >timestamp and similar data, then Alice would at least learn who had sent >the message (Bob) and when. They might then have to opportunity to contact >the Bob to ask for retransmission and warn of the interception. No way. This is bad. You don't want traceability built into PGP. If the sender _wants_ to be traceable, he can sign the message. If the sender wants convenient but repudiable identification, he can put his name and any other information he wants in the plaintext. Besides, PGP doesn't know who the sender _is_ except by signature; you can set a default key if you like, but otherwise there's no way for PGP to decide whether to use the "Bob " key in Bob's secret key ring, or the "Louis Freeh " key, and for that matter PGP will work fine with no secret-key file at all. If you're concerned about Bad Cops planting forged messages on people, this won't help - it's easy for them to forge unsigned information also. After all, the PGP source code is open, so Bad Cops can add code to set the timestamp/sender/etc themselves. Or they can ignore code, and just set their system clock appropriately. Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From nobody at REPLAY.COM Sun Oct 19 14:42:27 1997 From: nobody at REPLAY.COM (Anonymous) Date: Mon, 20 Oct 1997 05:42:27 +0800 Subject: Revealing individual messages. Message-ID: <199710192127.XAA23564@basement.replay.com> Bill Stewart wrote: > If you're concerned about Bad Cops planting forged messages on people, > this won't help - it's easy for them to forge unsigned information also. > After all, the PGP source code is open, so Bad Cops can add code to > set the timestamp/sender/etc themselves. Or they can ignore code, > and just set their system clock appropriately. BC's can also plant secret keys on your machine, along with messages forged using those keys. It is a good idea to keep badly forged messages on your machine, as well as badly forged keys. There are many ways to manipulate files and emails so that discrepancies exist. e.g. - messages with a time-stamp later than the file date; replies with an earlier time-stamp than the original message; changing fingerprint on the same key. From aba at dcs.ex.ac.uk Sun Oct 19 14:58:35 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Mon, 20 Oct 1997 05:58:35 +0800 Subject: Security flaws introduced by "other readers" in CMR In-Reply-To: <19971019143216.59535@math.princeton.edu> Message-ID: <199710191954.UAA05161@server.test.net> Fabrice Planchon writes: > > > > > > http://www.lemonde.fr/multimedia/sem4297/textes/act42972.html > > > > > Do they actually mention PGP software, or OpenPGP standard? Or just > > the general principle? > > They do: the title is "Le programme PGP se range", which I unfortunatly > have know idea of how to translate. And then, they say (I loosely > translate, my english is better than our MISTY friend's, but not perfect > ;-) > > [translation of discussion of pgp5.5] > > So, I certainly agree with you that the proGAK have won, or will. As > long as they don't enforce the current laws, as an individual I don't > care. But I fear, as you do, that as soon as you have things like pgp > 5.5 which are available, they will start saying "use this or go to jail". There is a precedent for this of sorts in France. You probably recall that prior to the netscape 40 bit breaks, there were 3 versions of netscape: - 128 bit US only non-exportable - 40 bit exportable - no SSL at all -- French version After Damien Doligez hit the headlines with his first break of 40 bit SSL, and the other breaks had similar headlines, the French authorities noticed -- "oh," they thought, "if those cypherpunks can break it, so can DGSE" -- I understood that from that point on they allowed 40 bit SSL netscape browsers in France. (At least someone reported about this on list). That Damien himself is French and was working at a researcher at INRIA(?) of all places only adds to the irony. (That Damien had a his PGP key at the bottom of his web page which must have attracted 100,000s of hits after that also is somewhat amusing, illegal PGP usage, and no one said a word). Anyway, my perhaps rude jibe to Jonathan Seybold, PGP Inc's chairman a few days back that PGP should "make a sales pitch to French DGSE" was not so far off after all. Course there is still the export problem. Perhaps eventually the NSA and DGSE/SCSSI, CESG/GCHQ will come to some kind of reciprocal agreement, and then there will be another export exemption in the US following on from the 56 bit DES exemption for companies which can demonstrate they are working to a 2 year schedule to have key escrow built in. Or perhaps some european competitor will provide pgp5.5 compatible software to them (with support for multiple CMR keys, something not yet in pgp5.5, but already accepted without problem, and planned I gather for the next major release). > > But, the simple fact is that I think PGP Inc have not evaluated these > > indirect implications for GAK politics. This means I think that they > > have pure intentions. Unfortunately these pure intentions do not help > > us if the effect is as I fear: that the result helps the GAKkers to > > some significant amount. > > I think, but I might be wrong, that they have at least to reasons, which > have already be given: > -first, what they did was somehow "easy" (don't jump on me, I don't > write code !!) to implement within the existing code. This is reflected > by what W.Geiger said, that anything pgp5.5 does he could do with > scripts in the old version. Or at least a good part of it. This is true, it could be done largely with multiple recipient feature in 2.x. Bill Stewart and William Geiger and I think PGP's Jon Callas pointed this out. However I think that: a) this is no excuse to actually _implement_ it! b) PGP implementing this kind of thing encourages others to do so also as they could become the defacto standards setter (particularly with this almost certainly going in OpenPGP standard, and PGP defining the semantics of the CMR either in or outside the standard to be what they have done in pgp5.5) c) it sets out the design work for other companies less scrupulous companies such as TIS, etc. to interoperate marginally more smoothly with pgp installed base when they implement something even worse compatible with OpenPGP. d) the alternative I proposed, or especially Tims alternative are even simpler if anything to implement > -second, they don't know what will happen in 12 months, so they cover > their asses. I hope this isn't true, but it's a matter of personnal > opinion more than anything else. Monty Cantsin said this. I said similar things also, and got shouted out by PGP Inc people for being rude. I don't think so, I hope not anyway. > As I said before, I guess they did it this way by lazyness more than > anything else. I think your solution requires more thinking, new code, > and all that sort of things. More brain demanding, in some sense (and > time consuming, whereas their solution is ready, works, can be sold, > makes the compagny make profits, and so on). It seems somewhat fair enough if it was much more difficult to do that this might be difficult to acheive within their budget and user delivery date demands, etc. But, Tim's proposal to store in clear seems easy enough. My alternative on top of that is merely to encrypt the mail folder with pgp -c; they've got all the technology sitting there. It is only a simple scripting task. If I was William Geiger I would say that you could knock that up over the week end in a few scripts. I expect I could too :-) (eg. if I knew emacs elisp, I reckon it would be easy enough to decrypt the mailbox prior to use, and re-encrypt after use. Or to do the same on a per message basis after decryption, or for all messages encrypted or not. Perhaps I'll have a go at getting Pat Lopresti to add this for mailcrypt.el v3.5). The task isn't any harder for them. It is not a technical objection, or at least I have seen no technical objections so far. I think it is purely a privacy objection: they have worked out some privacy preserving principles, and to enforce them they have come up with this approach. The message snooping dangers seem to have been overlooked, or considered unavoidable trade-offs to achieve their privacy objectives. They are simply wrong in this regard. > So, arguing with political > arguments doesn't stand a chance against a market driven compagny, be it > PGP with all its reputation capital. Everybody should concentrate on > technical issues, and several of these have been pointed out, by you and > others. Political arguments stand a better chance with PGP Inc than with most any other company ... but of course there are limits. > This is, of course, purely a storage issue. And I like the idea (Bill > Stewart's ?) of implementing a mechanism which would simply "weaken" the > storage key, so that if it's lost, you can recover the missing part by > brute force. I think Bill's point was more that you would make recovery harder. That is you have two ways into the messages: your passphrase, and some recovery information (a second copy of your private key). He suggested that you miss off some bits, to discourage companies from abusing what was meant to be a disaster recovery system being used as a storage recovery system. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 I have been working on some math and C++ code to implement it. The problem relates to a possible new means of factoring. However, I have run into a problem which I cannot solve. Indeed it maybe impossible. The problem is this: Find and equation using only multiplication, division, GCD, LCM and powers (not addition or subtraction) in terms of a and b which is equal to a+b for all Integers. If so desired it can be assumed that a and b are relative primes with a>b. Note that equivalent problems include but aren't limited to finding a similar equation for a+1. If other functions such as logs are required they may be allowed but I would have to look into it. To encourage people to answer I am offering $20 for a solution and $10 for a proof that it is impossible. I will judge all answers as to the validity both in terms of actually being correct (or in the case of a proof a valid argument) and in that they do not use functions such as addition or subtraction which are not allowed. Thanks, Jeff P.S. I am very interested in joining the coderpunks list as I do program and am interested in cryptography as related to programming. If someone would be kind enough to recommend me I thank you. +____________________________+ | Jeffery Walker | | E-mail: jeff at beol.net | | http://web.beol.net/jeff | +____________________________+ From micron at accessone.com Sun Oct 19 15:51:40 1997 From: micron at accessone.com (Mike Ronn) Date: Mon, 20 Oct 1997 06:51:40 +0800 Subject: No Subject Message-ID: <01bcdcdf$5dc1f020$05373737@igor.im.hou.compaq.com> � From aba at dcs.ex.ac.uk Sun Oct 19 16:11:21 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Mon, 20 Oct 1997 07:11:21 +0800 Subject: encryption key expiry in pgp5.x Message-ID: <199710192239.XAA05744@server.test.net> What happens in this scenario with pgp5.0, or pgp5.5: - You have a signature key which you'll keep for say 2 years before creating a new one. - You have a policy of generating new encryption keys every 6 months. - Your email archives are stored as received still encrypted to your public encryption key (I think you have no choice but to do this with some of the pgp5.x plugins). - You expire the key, and securely wipe the private half of the key. (An advantage of rekeying in this way is to gain forward secrecy: messages gathered by an attacker can no longer be decrypted with information you have, but to get the forward secrecy you must literally securely wipe the private key). If you do this, you won't be able to read your old mail folder, because you no longer have the key it was encrypted to. Does this imply that you must keep the private key for perpetuity? (Or at least as long as you want to read old mail archives). One presumes the same problem applies to CMR recovery keys, they must also be kept as long as recovery is required, if the user forgets the password. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 From: Fabrice Planchon To: Adam Back Cc: cypherpunks at cyberpass.net Subject: Re: Security flaws introduced by "other readers" in CMR >They do: the title is "Le programme PGP se range", which I unfortunatly > have know idea of how to translate. It can be translated by "PGP gets into the groove" it "behave itself". It finally obtemperate (wether prompted or not). It grow's up and become reasonable. "se ranger" is what you do with your car when a cop car pulls you on the side. it gets in line There is an ambiguity in this expression. "Se ranger" is usually used for a transition to an unusual or not approved behaviour to a accepted or acceptable behaviour. It entails a "higher" authority or standard. This is why I use a much more americanized language when I speak in french about civil liberties and related subjects. The french language almost equate government intentions with fatherly love... :-) Over the years, I found that most French peoples have a feodal attitude with a tendency to almost blind veneration of hierarchy. (flames to dev at nul.con). I suppose it comes from their History. In general, if a govt said it, it *has* to be good. It is as if they were trained since young age to surrender their capacity for independent judgment and reason. And quite distressingly, it happens even with extremely intelligent individuals. OTOH, the uncommon ones that do not exhibit such psycho-epistemological trait tend to be real hot shots, independent type. I am not French, but Canadian (french) and we often have scrapes with French on this topic. They tend to trust their govt, unless somethings warrant otherwise. Here in french Canada, we are much more American in that sense. Notwithstanding what trumped-up polls say, we have a much more american-styled opinion. Ciao JFA From nobody at REPLAY.COM Sun Oct 19 18:19:29 1997 From: nobody at REPLAY.COM (Anonymous) Date: Mon, 20 Oct 1997 09:19:29 +0800 Subject: Security flaws introduced by "other readers" in CMR Message-ID: <199710200104.DAA23696@basement.replay.com> Jean-Francois Avon wrote: > From: Fabrice Planchon > >They do: the title is "Le programme PGP se range", which I unfortunatly > > have know idea of how to translate. > > It can be translated by > "PGP gets into the groove" "falls in line" > it "behave itself". "obeys" > It finally obtemperate (wether prompted or not). "self-restrained" > It grow's up and become reasonable. "matures" and "conforms" > "se ranger" is what you do with your car when a cop car pulls > you on the side. it gets in line "Habeus Automobileus Recovery" > There is an ambiguity in this expression. "Se ranger" is > usually used for a transition to an unusual or not approved > behaviour to a accepted or acceptable behaviour. > It entails a "higher" authority or standard. Such as Hitler, or Freeh, or DeGaulle. There is a lot of truth to the "loose shoes, tight pussy, and a warm place to shit" school of dictatorship. As long as your butt is warm, do you really care whether 'they' are burning Jews or Jesuits to supply you with heat? Has PGP scored Joe 'White Shoes' Jackson as their SpokesPerson? VeriteMonger From helpdesk at admin.microserve.net Mon Oct 20 10:54:05 1997 From: helpdesk at admin.microserve.net (MicroServe's HELPDESK) Date: Mon, 20 Oct 1997 10:54:05 -0700 (PDT) Subject: your MIS email address (cosmos) may be deleted if you do not respond Message-ID: <199710201754.NAA22343@mail.microserve.net> Dear MicroServe Subscriber, The MIS accounting department is in the process of upgrading it's software. Unfortunately, they found some information missing from your account. So, we're going to need your help. Please go to the following URL (web address) with your WWW browser (Netscape, Internet Explorer, etc) and follow the online instructions. You should not have to anything except click CONTINUE once you arrive at the page. WEB URL: http://2009263:cosmos at mismail.microserve.net:235/ ACCOUNT ID: 2009263 MAILBOX: cosmos Login name: cosmos In real life: Daniel Leeds Directory: /usr5/accts/c/cosmos Shell: /usr/bin/ksh Last login Fri Jun 20 12:46 on pts001 from unknown-2-66.ra New mail received Wed Oct 15 17:05:23 1997; unread since Thu Oct 16 19:27:50 1997 PLEASE NOTE: This must be done from YOUR ppp (dial-up) account. The system will not work if you try to do this from a friend's (or any other) dial-up account. UNIX Shell customers should call (717)821-5964 extension 3 to speak with a technical support representative. Any account which still has info missing as of November 1, 1997 will be suspended (and will be deleted on November 8, 1997), as we will have to assume that the email box belongs to no one. If you have any questions, please email helpdesk at microserve.net. Thank You, MicroServe Engineering Department ------------------------------------------------------------------------ MicroServe Information Systems 100 North Wilkes Barre Blvd Wilkes-Barre, PA 18702 From ravage at ssz.com Sun Oct 19 20:35:35 1997 From: ravage at ssz.com (Jim Choate) Date: Mon, 20 Oct 1997 11:35:35 +0800 Subject: index.html Message-ID: <199710200353.WAA06844@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Tech banner IBM AS/400 rule WILL HEADLESS HUMAN CLONES GROW ORGANS IN 10 YEARS? 'Human Cloning' graphic October 19, 1997 Web posted at: 8:39 p.m. EDT (0039 GMT) LONDON (AP) -- Headless human clones will be used to grow organs and tissues for transplant surgery in the next five to 10 years, a leading authority on the ethics of human cloning predicted Sunday. Dr. Patrick Dixon, author of "The Genetic Revolution," which forecast the cloning of animals, made the prediction after The Sunday Times reported that British scientists have created a frog embryo without a head. Scientists believe the technique used to create the headless frogs could be adapted to grow human organs such as hearts, kidneys, livers and pancreases in an embryonic sac living in an artificial womb, the paper said. Many scientists believe human cloning is inevitable following the July 1996 birth of Dolly, the world's first cloned mammal. She was created at the Roslin Institute in Edinburgh using cells from a sheep's udder. "I predict that there will be great pressure to combine cloning technology with the creation of partial fetuses, missing heads, arms or legs as organ factories for tomorrow's people," Dixon told the British news agency, Press Association. "These will be developed on an experimental level somewhere in the world in countries where there is little or no gene legislation within the next 5-10 years because of the overwhelming demand," he said. "The demand is there, the technology is almost there as well," he said. Dixon called for an urgent global biotechnology summit to examine every aspect of genetics, and provide the foundations for international agreements. International inconsistencies on various aspects of genetic engineering, including human cloning, urgently need to be ironed out, he said. "Genetic engineering is a very exciting technology, it has the power to feed the world, cure disease but you do have to ask fundamental questions before it is too late," Dixon said. "The headless frog embryo is another example of the way the technology is racing far ahead of public understanding," he said. "We must get the thinking in place which looks over the horizon beyond today's headlines to what tomorrow will bring," Dixon said. "Scientists have been making up the rules as they go along." Genes manipulated to suppress frog's head Jonathan Slack, professor of developmental biology at Bath University, told The Sunday Times that he created headless frog embryos by manipulating certain genes -- and used the same technique to suppress development of a tadpole's trunk and tail as well. The headless frog embryos have not been allowed to live longer than a week because under British government rules, embryos are not considered animals until they are a week old, the paper said. Slack believes the breakthrough could be applied to human embryos because the same genes perform similar functions in both frogs and humans, The Sunday Times said. The newspaper said the lamb and frog techniques could be combined so that people needing transplants could have organs "grown to order" from their own cloned cells. These organs would exactly match the patient and there would therefore be no danger of rejection. It would also ease the shortage of organs for transplant, The Sunday Times said. Slack told the paper that using intact human embryos would not be possible because they would have to be killed. "It occurred to me a half-way house could be reached," he was quoted as saying. "Instead of growing an intact embryo, you could genetically reprogram the embryo to suppress growth in all the parts of the body except the bits you want, plus a heart and blood circulation." Growing parts of human embryos to cultivate organs could bypass many legal restrictions and ethical concerns, because without a brain or central nervous system the organisms may not technically qualify as embryos. Professor: 'No ethical issues' Lewis Wolpert, professor of biology as applied to medicine at University College London, called Slack's suggestions sensible and feasible. "There are no ethical issues because you are not doing any harm to anyone," The Sunday Times quoted him as saying. But Oxford University animal ethicist Professor Andrew Linzey told the newspaper: "It is morally regressive to create a mutant form of life." "It's scientific fascism because we would be creating other beings whose very existence would be to serve the dominant group," he was quoted as saying. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. rule CNN Plus * Message Board: Cloning Health Special: Cloning Related stories: * Report: Cloned sheep has human gene - July 24, 1997 * Embryo splitting caught in cloning controversy - June 25, 1997 * Scientists grow monkeys from cloned embryos - March 2, 1997 * Firms team up to make cloned cattle with special milk - October 7, 1997 Related sites: Note: Pages will open in a new browser window * Genzyme Transgenics * Genetics and Ethics - Biomedical Ethics Unit, McGill University * Institute for Philosophy and Public Policy - Animals as Inventions: Biotechnology and Intellectual Property Rights * Genetic Engineering Home Page External sites are not endorsed by CNN Interactive. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Watch these shows on CNN for more sci-tech stories: CNN Computer Connection | Future Watch | Science & Technology Week rule Message Boards Sound off on our message boards You said it... [INLINE] IBM AS/400 rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From martian at rt66.com Mon Oct 20 11:38:45 1997 From: martian at rt66.com (martian at rt66.com) Date: Mon, 20 Oct 1997 11:38:45 -0700 (PDT) Subject: Save Water... ask me how! Message-ID: <> Ask me how to save water. http://www.rt66.com/martian From martian at rt66.com Mon Oct 20 11:38:45 1997 From: martian at rt66.com (martian at rt66.com) Date: Mon, 20 Oct 1997 11:38:45 -0700 (PDT) Subject: Save Water... ask me how! Message-ID: <> Ask me how to save water. http://www.rt66.com/martian From attila at hun.org Sun Oct 19 20:59:59 1997 From: attila at hun.org (Attila T. Hun) Date: Mon, 20 Oct 1997 11:59:59 +0800 Subject: pro-crypto govt. people [find] In-Reply-To: <199710161900.MAA15010@eff.org> Message-ID: <19971020.032653.attila@hun.org> -----BEGIN PGP SIGNED MESSAGE----- regarding ranking military personnel and/or prosecuters who were in favour of encryption and anti-GAK, the key issue is former -while in rank or in the DOJ they follow the party line --and they _know_ what the abuses are. I know more than a few, but they a) wont talk about it, b) are ex-spooks (if there is such a thing), and c) item 'b' makes them not good testimonials anyway. just get a list of generals retiring in the last 5 years from the Congressional record since there is a rank pension retirement requirement --survey. likewise, Bill Clinton fired every single on of the U.S. prosecuting attorneys when he took office in 1993; same thing: survey 'em. some career DOJ types who were pretty pissed and not likely to view anything Bubba and F{ree,uck} are pushing with approval. bet you come up with some positive answers. if nothing else you might get some quotes; and some the retired generals were pretty crusty. check the man who retired as head of the army 160th deep black spec ops group --swore in public, his troops never wore regulation, beards, etc. and I think General George S. Patton IV retired a couple years ago with at least 2, maybe 3 stars. they're out there; get a grunt to get on with the research. on or about 971016:1200 Stanton McCandlish was purported to have expostulated to perpetuate an opinion: #This year I recall seeing 1 former prosecutor saying that widespread #encryption was good and/or that GAK was bad, and 1 military or former military #person of fairly high status saying that GAK was bad. Circa 1994-5 I also #recall a military or retired miltiary person of rank reporting that very #widespread crypto would be a boost to national security. We could really use #these people's, and similar people's, words in pro-crypto efforts. #Unfortunately, disk problems a while back cost me most of my old mail, #including all of these saved items. If anyone has them and/or knows who these #people are, please let me know. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQBVAwUBNErSurR8UA6T6u61AQGkNQH6AlxB6oJ9OJa2dtSB07jCXVZZdUIvdntR plzqvee5RGCtjZaqrc8VksmunVaMh3FOHpHGJW+rcwSoMK0Qs9ASnQ== =OAtn -----END PGP SIGNATURE----- From jf_avon at citenet.net Sun Oct 19 21:21:28 1997 From: jf_avon at citenet.net (Jean-Francois Avon) Date: Mon, 20 Oct 1997 12:21:28 +0800 Subject: "First do no harm" Message-ID: <199710200420.AAA03892@cti06.citenet.net> On Sun, 19 Oct 1997 16:31:10 -0700, Tim May wrote: >At 5:23 PM -0700 10/19/97, Jean-Francois Avon wrote: >First, are you reading Cypherpunks? No. I don't have time to even read all of e$ and e$pam. I am not yet retired... :-) >If so, post there. If not, please >forward my reply to the "e$" Done. >If I operated a small company, I would have no policy on this at all. Just >as I wouldn't routinely tape-record employees, I wouldn't monitor their >mail. >Do most small businesses steam open all of the incoming and outgoing paper >mail? Let me describe a scenario: one key employee isn't there because... ...he is somewhere else [ :-) ] Then, comes an urgent message forcing the company to make a split-second decision before the employee gets back. It happens _all_the_time_ in small businesses where they do not have the ressource of the big companies. You, the boss, want to re-read some critical documents before making a move. Of course, your employee was the most consciencious and trustworthy employee on this side of Andromeda, only, your memory fails as what was the *exact* wording of the critical documents. It furthermore happens that the said faithfull employee is, unknown to you and in his mind not-company-detrimental, getting intronized to the mile-high club between L.A and Tokyo in the plane lavatory, therefore not reacheable by any modern means. Wouldn't you wish you had his corporate private key? In the old days, you used to scramble through his mountain of paper on his desk. In more recent days, you frantically scanned his exemplary organized data structure and found the documents. Today, the said data structure is still exceptionally orderly, but only to reveal several very describing filenames with a dot-asc or dot-pgp extension. Any comments? >If a small business owner doesn't trust his employees, all is lost anyway. >(Employees can post stuff from home, can take diskettes out of the >building, etc., so what is gained by monitoring their mail?) I thought that this was so self-evident that I did not even thought usefull to explain. I was not talking about having employees giving copies of their personnal private key but of their corporate private key. The one they use to transact business over unsecured lines, not the one they use to send raunchy messages to their lover. >And if an employer is known to monitor employee mail, this actually >increases his liability for certain things. (If an employer does not, then >he has a better defense of claiming that some employee was acting on his >own, etc.) I never talked of monitoring e-mail, only of making sure the business retains access to employee-generated documents. I used to have a private key for the company at a previous work location. The first thing I did was to give my boss my passphrase for being afraid of what could happens if ever they needed a critical document during my absence. He did not even know how to use PGP, but I made sure that somebody did. This is why I said that a "secret" copy would be given to the boss. He could encrypt the employees keys, print it on a micro-dot and hide it under his gold tooth cap. And that way, there is always deniability since there is official company policy. Or better, all the boss has to do is to generate the employee's keys himself. He could forever deny having made a copy and nobody could prove that he did. Personnally, I would make sure that all keys to be used to transact business be generated by the boss, to be handed on a diskette in person. As far as trying to prevent malicious action, I agree that there is no way an employer can do that. Anybody really intent on screwing up things can. Ciao jfa -- Jean-Francois Avon, Pierrefonds(Montreal) QC Canada DePompadour, Societe d'Importation Ltee Finest of Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing. PGP encryption keys at: http://w3.citenet.net/users/jf_avon http://bs.mit.edu:8001/pks-toplev.html ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C From kent at bywater.songbird.com Sun Oct 19 23:55:37 1997 From: kent at bywater.songbird.com (Kent Crispin) Date: Mon, 20 Oct 1997 14:55:37 +0800 Subject: why we are arguing for more resistant variants In-Reply-To: <19971019100620.06593@bywater.songbird.com> Message-ID: <19971019234203.23585@bywater.songbird.com> On Sun, Oct 19, 1997 at 07:15:00PM +0100, Adam Back wrote: > > Kent Crispin writes: > > On Sun, Oct 19, 1997 at 10:25:08AM +0100, Adam Back wrote: > > > Also I must raise the point that it is not a lone stand. Other people > > > are arguing against PGP Inc's CMR proposal, and are arguing for more > > > GAK resistant variants, and alternatives. > > > > Apparently for some internal reason you must raise the point, but it > > is irrelevant. I said your *proposals* were vaporware, not your > > motivations. It is, as I have said, a waste of time (and yes, mental > > masturbation) to argue about motivations. > > Motivation is irrelevant. Good. We agree, and can therefore move on. > You made one contribution in this area in your last post. Keep up the > technical contributions, and scenario likelihood evaluations. > > > > However the biggest point of all is that: communications keys are more > > > valuable to any attacker (government, unscrupulous little brother, or > > > industrial spy) than storage keys. > > > > > > I would be interested to see any one willing to burn their > > > reputational capital refuting that simple point. > > > > *Long term* communication keys. Nobody is going to burn reputation > > capital on that point because it's obvious, and really doesn't need to > > be argued. > > If it doesn't need to be argued, why does pgp2.x and pgp5.x use long > term communication keys? History. Backward compatibility. Time pressures. And a design for short term communication keys for email does not yet exist -- not from you, not from anyone. [Your CDR proposal uses *long term* communication keys.] These seem pretty compelling reasons to me. Just because something is desirable doesn't mean it is practical, or even possible. [...] > > Surely the most straight forward way to provide recovery for email > archives is to archive the emails encrypted to a storage-only key, > with this key escrowed in some way? You then don't need to recover > email in transit -- you don't even have a copy of it. > > This is clearly more resistant to government abuse. Do you disagree? > > (The above paragraph is basically all my CDR proposal is .. it seems > straight forward, intuitive, more secure; I went through and countered > your previous objections to worked example #1, you did not reply to > those counter-points). I did not because you presented it as a throwaway, with statements to the effect that you already knew it was defective but you were presenting it anyway. Besides, in all honesty I did not find your counterarguments very compelling, and I was content to wait until I saw a "real" proposal. If I have a chance, though, I will go back and address that... BTW, perhaps you remember a fairly long thread sometime back where I discussed the pros and cons of a "keysafe" model for data recovery keys? > > Furthermore the point applies just as well to current PGP keys. The > > *only* additional vulnerabilities of CMR come from 1) the volume of > > data makes it a more interesting target and 2) the management of the > > CMR key(s) may be problematic. > > You missed a couple: > > 3) the goverment will love to get come ask for your CMR key because it > protects all past emailed ciphertext > > 4) some governments (eg France) will probably ask for one of the CMR > keys to be theirs I include both of those under my number 1. > > However, in a large organization the management of *user* keys is > > problematic, as well, and management of the CMR key(s), on balance, > > will probably be better. So the additional vulnerability of CMR comes > > from the fact that it makes a lot of data accessible from one key. > > This vulnerability could be reduced by having multiple CMR keys -- the > > accounting dept has one, the CEO has one, and it is the same as his > > private key that is not escrowed anywhere, etc etc etc. > > Yes. Several people have suggested this. Also secret sharing is > being considered by PGP Inc for the next version I think. > > > [Is it true that the private key associated with a CMR public key > > could simply be discarded, rather than escrowed, and everything would > > still work? -- except that you couldn't recover anything, of course...] > > I would think so. This would argue for updating the CMR > communications key as frequency as is practicable to minimise danger. ^^^^^^^^^frequently? ?I don't see the connection. My point was that you can generate a key pair, throw away the private key, and use the public key as the CMR key. Perhaps you could just use random bits in the correct format for the public key, and never generate a key pair at all. This would meet external requirement of having a CMR key, but it would be meaningless, since the missing private key could never be used to decrypt anything. Thus, though externally an organization (say an ISP) would be complying with a regulation, in fact it would be impossible to recover any email anyway... In any case, I presume the "danger" you refer to is the danger that someone will snarf the CMR key. Changing it frequently will reduce the number of compromised messages if any given key is compromised. (Of course, the CMR keys will have to be preserved forever in a little database of some sort -- if you change them often, that database will be large...) > (Same argument as update requirements for user communications keys). > Hal Finney discussed this requirement of matching expiry frequency on > comms keys & corresponding CMR keys a few messages back. > > > A more interesting argument is as follows: what is the real level of > > security needed for the business communications that will be covered > > by CMR? It seems obvious that the level of security required, on > > average, is really quite low. Note that businesses send all kinds of > > important documents through regular mail, only protected *gasp* by > > PAPER ENVELOPES. > > This suggests that Tim May is right, and the simplest solution is to > store the decrypted received emails in clear on the disk. Most of the > companies are in fact storing on disk. It is the MUA that uses PGP (Eudora, Mutt, whatever) that decides how to store the decrypted files, not PGP. PGP decrypts the files and gives them to the MUA, which displays them to the user. The MUA has the option of storing it encrypted or not, as delivered, or with another key. PGP isn't in control, it's the MUA, isn't it? > > Anyway, Adam, I anxiously await the paper you are working on that > > gives the real details of your proposals. I'm sure it's readability > > will be vastly improved if you religiously avoid the use of the word > > GAK :-) > > Could you provide a less emotive suitable alternative word which I can > use as a replacement to describe government communications key > grabbing attempts? GACK is what Carl Ellison proposed as a more > accurate way to express "Goverment Access to Communications Keys" than > terms such as "key escrow", "key recovery", which are government > coined terms. PGP Inc themselves being mostly cypherpunks and > pro-privacy people use the term GACK also. > > GACK seems a pretty good acronym to me, accurate, descriptive. Are we > getting goverment-correct now as well (as politically-correct)? So > that we must not use terms which are offensive to governments? > > (I will attempt to avoid negative political comments about PGP Inc's > implementation, and phrase in terms of constructive criticisms though, > and perhaps this was your point given my earlier outbursts in this > regard; perhaps you can help proof read for this). Whatever. It does strike me that you seem to have difficulty in maintaining composure whenever the term comes up, your prose gets hasty, with missing words and odd syntax, and I suspect that your usually razor-sharp edge suffers as well.... :-) -- Kent Crispin "No reason to get excited", kent at songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html From semprini at theschool.com Mon Oct 20 00:19:31 1997 From: semprini at theschool.com (semprini at theschool.com) Date: Mon, 20 Oct 1997 15:19:31 +0800 Subject: One-Way Functions Message-ID: <199710200704.AAA15823@k2.brigadoon.com> I've read tons about how DES, PGP, and all of those programs use a one-way function involves the difficulty of factoring out numbers. Are there other one-way functions? --Dylan From kent at bywater.songbird.com Mon Oct 20 00:19:31 1997 From: kent at bywater.songbird.com (Kent Crispin) Date: Mon, 20 Oct 1997 15:19:31 +0800 Subject: Is PGP still private? In-Reply-To: <19971018092636.45297@bywater.songbird.com> Message-ID: <19971020000916.31377@bywater.songbird.com> On Sun, Oct 19, 1997 at 07:22:37AM +1000, Andrew Bromage wrote: > G'day all. > > Kent Crispin wrote: > > > Your reencryption scheme fails because of the management of the short > > term encryption keys, among other things. Here's another approach I > > will toss out, without thinking through: > > > > How about formalizing superencryption, or tunneling? That is, treat > > CMR traffic as a transport medium for messages that are themselves > > already encrypted. The "key" idea here is to allow layering of non > > CMR traffic over CMR traffic. All the code for both is obviously > > already in PGP, with a little glue and perhaps some minor protocol > > mods... > > If we start considering that, could I suggest making the system > _completely_ flexible? > > The sort of things I'm thinking of include: Allow any object to be > encrypted using conventional encryption (including conventional > encryption keys) or signed, allow any conventional encryption key to > be public-key encrypted or split, conjunction/disjunction of two > conventional keys, etc. > > Disadvantages: > > - Greatly complicates the decryption process. In particular, > decrypted streams must be fed back into PGP. My impression from a talk by ???, perhaps at the San Jose IETF, is that the new version of PGP is actually coded to facilitate this kind of interaction internally -- that is, it is designed around a general interface philosophy of connecting filter modules via a stream abstraction. > - Difficult for an end-user to specify what combination of > features they want. I think it would be a relatively straightforward, fun project to develop a simple scripting language that could specify this. Not knowing that much, I toss this out just to give the flavor of something that could be in a .pgprc file: message-to:private_joe at bigco.com encrypt(joes_private_private_stego_key)-> stegosaurous.gif-> encrypt(joes_bigco_cmr_key,bigco_cmr_key) address-to:joe at bigco.com message-to:joe at bigco.com encrypt(joes_bigco_cmr_key,bigco_cmr_key) address-to:joe at bigco.com message-from:joe at bigco.com decrypt(*)->encrypt(my_private_storage_key) > - This working group would be around for years arguing about > details. :-) Definitely not for version 1 of the standard. > Advantages: > > - Allows PGP to be used for lots of things that we haven't > thought of yet. - GAK would be impossible to enforce. > - File format could be considerably simplified, if we could > scrap the old format. (Unrealistic, but what the hell.) -- Kent Crispin "No reason to get excited", kent at songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html From phelix at vallnet.com Mon Oct 20 00:54:40 1997 From: phelix at vallnet.com (phelix at vallnet.com) Date: Mon, 20 Oct 1997 15:54:40 +0800 Subject: A Math problem related to cryptography Message-ID: <3454d05d.32951635@128.2.84.191> On 19 Oct 1997 18:36:26 -0500, Jeffery Walker wrote: > > I have been working on some math and C++ code to implement it. The >problem relates to a possible new means of factoring. However, I have run >into a problem which I cannot solve. Indeed it maybe impossible. The >problem is this: > > Find and equation using only multiplication, division, GCD, LCM and >powers (not addition or subtraction) in terms of a and b which is equal to >a+b for all Integers. If so desired it can be assumed that a and b are >relative primes with a>b. Note that equivalent problems include but aren't >limited to finding a similar equation for a+1. If other functions such as >logs are required they may be allowed but I would have to look into it. > > To encourage people to answer I am offering $20 for a solution and >$10 for a proof that it is impossible. I will judge all answers as to the >validity both in terms of actually being correct (or in the case of a proof >a valid argument) and in that they do not use functions such as addition or >subtraction which are not allowed. > (why do I get the feeling that I'm doing somebody's homework assignment) Claim: In the realm of Integers, There does not exist a formula using only multplication,division,GCD,LCM,and powers such that f(a,b)=a+b for all integers a,b Proof (by contradiction): I assume that a,b are primes > 2. Lets also define x,y,z,w,m,n and any integer >=0 and C,D,E as any integer > 0. Now let's look at the operations available to us: multiplication and powers: C=C*(a^0)*(b^0) CD=E(a^0)*(b^0) where E=CD a=1*(a^1)*(b^0) a^2=1(a^2)*(b^0) Cab^2=C*(a^1)*(b^2) well , all results can be expressed in the following form: C*(a^x)*(b*y) division: a !| b and b !| a (here !| means "does not divide") (From here on out, lets assume that a !| C,D,E and b !| C,D,E. it makes things simpler) Ca/a=C*(a^0)*(b*0) Ca/D=E*(a^1)*(b^0) assuming that E | C I won't go through all this. It should be obvious that for all allowed divisions, the result can be expressed as C*(a^x)*(b*y) GCD: gcd(a,b)=1 gcd(a,C)=1 gcd(Ca,Da)=max(a,gcd(C,D)) gcd(Ca,Db)=gcd(C,D) gcd(C(a^x),C(a^y))=C(a^(min(x,y))) gcd(C(a^x)*(b^y),D(a^z)*(b^w))=gcd(C,D)*(a^(min(x,y)))*(b^(min(z,w)))) =E(a^m)*(b^n) for E=gcd(C,D) m=min(x,z) and n=min(y,w) so, all results of GCD can be expressed in the form: C(a^x)(b^y) LCM: LCM(C,D)=CD/gcd(C,D) LCM(C(a^x)*(b^y),D(a^z)*(b^w)) =CD*(a^(x+z))*(b^(y+w))/gcd(C(a^x)*(b^y),D(a^z)*(b^w)) =( CD/gcd(C,D) * (a^(|x+z-min(xz)|)) * (b^(y+w-min(yw)) = E(a^m)*(b^n) where E=CD/gcd(C,D)=lcm(C,D), m=x+z-min(x,z) , n=y+w-min(y,w) so, all results of LCM can be expressed in the form: C(a^x)(b^y) Now, as you can probably tell by now, I don't remember a damn thing about groups, rings, and fields. If i did, I could have done all of the above in one paragraph. SO, what I'm trying to say is that all the numbers you can operate on here will be of the form C(a^x)(b^y). SO you really have to prove at least the following C(a^x)(b^y)=a+b for some C>0, x,y>=0 integers Now, you could probably say that C=a+b, x,y=0, but that's a cop out and is probably not allowed. Now, watch while I cop out and provide an easy counterexample: assume some formula exists such that f(a,b)=a+b with f only using *,/,gcd,lcm,^ operators let a=5, b=7 Since I know that ultimately anything I do with constants and the operators 8,/,gcd,lcm,^ will result in something in the form of C(a^x)(b^y), I won't even mess with the formula there must exist some C>0, x,y>=0 that makes: C(5^x)(7^y)=5+7=12 of x>=1 and y>=1 then C(5^x)(7^y)>12 for all C>0 if x=0 and y=0, C=12 (this works) if x=1,y=0 then 5C=12. there is no C which satisfies this. if x=0,y=1 then 7C=12. there is no C which satisfies this. so, the only solution is C=12, or more generally, C=a+b oops, that can't be the formula since we're not allowed to do that. QED. Well, that was pretty sloppy, so lets be more general about this: C(a^x)(b^y)=a+b Now, I'm sure that somewhere in the history of mathematics somebody has proven that for primes a and b where a,b>2 that a*b>a+b. So, for any x,y,C>0, C(a^x)(b^y)>a+b. C, of course, cannot be negative, or zero, so all were left with is x or y being zero. Let y=0. we have: C*a^x=a+b C*a^x - a = b a*(C*a^(x-1) - 1 ) = b a*E=b Now, a and b are primes and a!=b. From the fundamental theorem of algebra, every number can be represented by a series of primes such as: p1^a1 * p2^a2 * p3^a3 * ... In a*E=b, if we factor each side down to its primes, we find that the right hand side does not contain the prime 'a' which is on the left hand side, so a*E != b. A similar argument can be used for the case x=0. This leaves the only solution to C(a^x)(b^y)=a+b being x=0,y=0 C(a^0)(b^0)=C=a+b which isn't allowed. QED Now, If you're like me, you've probably read the above and don't have a f*cking clue what I meant (I sure wouldn't if I read all that crap). So here's the executive summary. With the operators you've defined on the number set you want to work with, no matter how complicated or crazy your formula is, I can express the result at C(a^x)(b^y). And hopefully, I've shown that C(a^x)(b^y) cannot equal a+b except in the trivial case of C=a+b (with x,y=0) which is what you don't want. >Thanks, >Jeff >P.S. I am very interested in joining the coderpunks list as I do program >and am interested in cryptography as related to programming. If someone >would be kind enough to recommend me I thank you. > I wasn't aware that you had to be invited to the coderpunks list. Just send a message to majordomo at toad.com with the following in the body: subscribe coderpunks -- Phelix, who really should have been able to give a better proof (especially since one of my degrees has the word 'Mathematics' on it) From stewarts at ix.netcom.com Mon Oct 20 01:05:08 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Mon, 20 Oct 1997 16:05:08 +0800 Subject: Been tried before? In-Reply-To: <19971018052525.20913.qmail@hotmail.com> Message-ID: <3.0.3.32.19971020004751.006c4c04@popd.ix.netcom.com> At 10:25 PM 10/17/1997 PDT, Andrew Wiggin wrote: >I had an idea for a key system using graphics files. Has that been tried >before? The basic idea was to use a graphics file with a color depth of >24-bit or higher. Then, using the rgb values of, say, every prime pixel What are you trying to accomplish? Having a non-obvious place to store passwords? After all, your suggestion is really equivalent to a bunch of numbers stored in a file. What has usefully been done is to take numbers and hide them as low-order bits in a graphic file, with various implementations getting fancy about either just sticking them there or looking at the palette values from the picture and finding something visually better matching. Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From stewarts at ix.netcom.com Mon Oct 20 01:05:31 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Mon, 20 Oct 1997 16:05:31 +0800 Subject: Fwd: list of keyservers Message-ID: <3.0.3.32.19971020001741.006c636c@popd.ix.netcom.com> Attila sent the following list of keyservers ---------------------------------------------------------- the following is a collection of key servers; and there are more. bal keyserver at MT pgp corporate keyserver reiter PathServer at research.att Matrix Key Server (an oddball, down on 19/10/97) the rest are clones of MIT Universitat Polit�cnica de Catalunya, Barcelona Cambridge University University of Troms Tilburg University University of Paderborn Tung-Nan Junior college, Taiwan University of Mainz Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From tm at dev.null Mon Oct 20 02:09:10 1997 From: tm at dev.null (TruthMonger) Date: Mon, 20 Oct 1997 17:09:10 +0800 Subject: InfoWar Epilogue 5 / TEXT Message-ID: <344B1AFE.7232@dev.null> ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * Epilogue * Cowboy ---------------------------------------------------------------------------- Epilogue ---------------------------------------------------------------------------- 11 May 1905 Walking on the Marktgasse, one sees a wondrous sight. The cherries in the fruit stalls sit aligned in rows, the hats in the millinery shop are neatly stacked, the flowers on the balconies are arranged in perfect symmetries, no crumbs lie on the bakery floor, no milk is spilled on the cobblestones of the buttery. No thing is out of place. When a gay party leaves a restaurant, the tables are more tidy than before. When a wind blows gently through the street, the street is swept clean, the dirt and dust transported to the edge of town. When waves of water splash against the shore, the shore rebuilds itself. When leaves fall from the trees, the leaves line up like birds in V-formation. When clouds form faces, the faces stay. When a pipe lets smoke into a room, the soot drifts toward a corner of the room, leaving clear air. Painted balconies exposed to wind and rain become brighter in time. The sound of thunder makes a broken vase reform itself, makes the fractured shards leap up to the precise positions where they fit and bind. The fragrant odor of a passing cinnamon cart intensifies, not dissipates, with time. Do these happenings seem strange? In this world, the passage of time brings increasing order. Order is the law of nature, the universal trend, the cosmic direction. If time is an arrow, that arrow points toward order. The future is pattern, organization, union, intensification; the past, randomness, confusion, disintegration, dissipation. Philosophers have argued that without a trend toward order, time would lack meaning. The future would be indistinguishable from the past. Sequences of events would be just so many random scenes from a thousand novels. History would be indistinct, like the mist slowly gathered by treetops in the evening. In such a world, people with untidy houses lie in their beds and wait for the forces of nature to jostle the dust from their windowsills and straighten the shoes in their closets. People with untidy affairs may picnic while their calendars become organized, their appointments arranged, their accounts balanced. Lipsticks and brushes and letters may be tossed into purses with the satisfaction that they will sort themselves out automatically. Gardens need never be pruned, weeds never uprooted. Desks become neat by the end of the day. Clothes on the floor in the evening lie on chairs in the morning. Missing socks reappear. If one visits a city in the spring, one sees another wondrous sight. For in springtime the populace becomes sick of the order in their lives. In spring, people furiously lay waste to their houses. They sweep in dirt, smash chairs, break windows. On Aarbergergasse, or any residential avenue in sprint, one hears the sounds of broken glass, shouting, howling, laughter. In spring, people meet at unarranged times, burn their appointment books, throw away their watches, drink through the night. This hysterical abandon continues until summer, when people regain their senses and return to order. {Excerpt from "Einstein's Dreams" by Alan Lightman} ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- Cowboy "All My Lies Are True, And everything I do, I really Am." - Carroll In other words, if it looks like a duck, walks like a duck and quacks like a duck�it's probably a duck. Reality is a Freudian slip. InfoWar has been around since Adam and Eve gobbled down on the fruit from the Tree of the Knowledge of Good and Evil. The fig leaf was the first cover-up. "Sorry, God, but what's under there is Top Secret." Adam blamed Eve, Eve blamed the Serpent, and the Serpent blamed his publicity department, fired six people, replaced them with Spin Doctors, and went on to become President. Figuratively speaking, of course. Now all of the CypherPunks are sitting around slapping their foreheads and saying: Old Farts: "I should have listened to Lenny Bruce." Middle Aged Farts: "I should have listened to Bob Dylan." Young Farts: "I should have listened to Marilyn Manson." Stupid Farts: "I should have listened to TruthMonger." People you should have lynched, and now it's too late: The person who named a nuclear missile, 'The PeaceKeeper.' The President who let slip the words, 'New World Order.' The first person to utter, "What the President meant to say, was�" Everyone who said, "I'm from the government, and I'm here to help you." �ad infinitum� How many Nazi intelligence agents and rocket scientist were brought into the US after World War II to work with the government and large corporations? Sorry, Top Secret. How much biological and germ warfare research is being done with your tax money? Sorry, Top Secret. How many foreign leaders, politicians, diplomats and business men have been assassinated using your tax dollars? Sorry, Top Secret. Of course, now 'National Security' is the 'magic word.' (Or is that 'magic sword?') "Intelligence reports indicate that terrorists breathe�" {Go ahead and extrapolate the preceding government statement to its final conclusion. Don't forget the breathing tax that will be necessary to cover the costs of the digital nose implants.} Your education wasn't 'free,' was it? You had to pay for it by Pledging Allegiance every morning. You had to pay for it by sitting up straight at your desk. You had to pay for it by asking permission to pee. You had to pay for it by making sure your desk was lined up straight with the others. You had to pay for it by shutting the fuck up when you had a creative thought, and hypnotically repeating back the lessons you were taught. Who discovered America? And what the fuck were all of those goddamn Indians doing there when it was 'discovered?' Fucking troublemakers� Interactive. Doesn't that sound better than Corporate Message Recovery? Better than Government Access to God-and-Everything? The cynics make it all sound so dark and damning. All the Fascists really want is to make certain that everyone is sitting up straight in their seats�that the seats are lined up properly�that no one forgets to pledge allegiance�that you ask permission before you pee� "THERE IS NO SECRET PLOT AGAINST THE CYPHERPUNKS LIST!!!" We are here to help you� Tim, sit up straight in your chair. Lucky, sit down, you can go to the bathroom when I'm finished talking. Bill, Bill and William, no more back-talk. Adam, apologize to PGP. Duncan, quit fidgeting. Peter, have you been passing notes to TruthMonger, again? Blanc, Mr. Gates will not be allowed to pick you up after class unless he brings a note from your parents. Matthew and Phil, from now on we will be using 3.0 as the value of pi, as per the new legislation. Toto! Pull up your pants and leave that puppy alone. Thank you for the apple, Kent. Would you like to lead the class in pledging allegiance to PGP for Corporations? When a US Armed Forces trained killer attacked a Federal Government Building, who got the blame? Citizens. Citizens with guns. Citizens with non-government guns. The Paramilitary. When a US Secret Intelligence Agency trained cryptographer attacks a Federal Government Computer System, who will get the blame? Citizens. Citizens with crypto-munitions. Citizens with non-government crypto-munitions. The CypherPunks. Have you figured out what 'InfoWar' is, yet? Cryptography is merely a battleground. Encryption is merely one of the most dangerous weapons against the goals of InfoWar. The War is over who will control Information. The War is over who will control Words. The War is over who will control Thoughts. The War is over who will control Attention. The War is over who will control Virtual Reality. The War is over who will control WebWorld. World War III is InfoWar! Whoever controls Information, controls the Past. Oswald acted alone.. Whoever controls Information, controls the Present. Gilmore acted alone. Whoever controls Information, controls the Future. Tim C. May acted alone� Repeat after me: "Department of Defense secret agencies created the InterNet, but they do not control and/or monitor all activity and communications that take place on it." "The government has shifted the focus of their engineers, physicists and secret intelligence agencies from nuclear warfare to information warfare, but they would not manipulate, destroy and murder those who present a threat to their preeminence in this arena of warfare." "When the government's secret underground laboratories reveal and share the technology of radar that can see through solid walls, satellite cameras that can read the newspaper over your shoulder, and tiny helicopters that can fit inside a peanut shell, they are not in possession of even greater forms of clandestine technology." Reality Check: Why is strong encryption such a dangerous threat to the secret and semi-secret agencies, committees and non-government bodies who rule us from the shadows? It is because they already have the ability to monitor all of our activities and communications. Widespread use of strong encryption threatens that ability. People who control technology and standards are on the inside. People who make the chips that go into the computers and peripherals are on the inside. People who supply the physical routes that information travels over are on the inside. People who use the above, are on the outside. Arms for drugs, drugs for money-arms, drugs and money for favors and information. Our secret intelligence agencies tell our legislators that use of strong crypto will interfere with their manipulation of the electronic funds of the 'bad' individuals, corporations, and governments. Why did Colonel Olive North trade weapons and drugs to have the hostages held until Ronnie RayGuns election and then released on the day of his inauguration? Because weapons were what the Iranians wanted. What if the Iranians had wanted Sun Microsystems financially ruined in return for the timed release of the hostages? Or Intel? Or Tim C. May? (Who knows? Maybe the Tim C. Mayonnaise ASCII Art is part of the Iran-Contra deal.) Did the US Secret Intelligence Agencies support the development and release of cryptography that they couldn't break, or didn't have a backdoor to? If so, then why was PGP such a threat to 'National Security?' If the Men in Black don't already have ready access to information hidden within current forms of encryption, then why would widespread use of strong encryption be a threat? Try this: Go to a command line: type 'cd \PGP262' ; type 'pgp -kxa "My KeyID" secring.pgp' Send the output file to Louis J. Freeh, and ask him to please not read your encrypted files. Now: Do the same thing, only dialing in to your machine from a friend's machine. Now: Write a browser Java script that gets the secring.pgp file from your machine via a web site. Now: Go home, kick your fucking door in, place a disk in the floppy drive, and type 'pgp -kxa "My KeyID" a:\secring.asc secring.pgp'. Mail the disk to Louis J. Freeh Does your copy of PGP ask for a password before spitting out the KeyID to any one of a thousand monkeys who sits at your keyboard and randomly types in the above? My copy doesn't. Below is a copy of a key pulled off of my computer by 19 different people. It was pulled off of my hard drive by the first individual, who proceeded to inform a second individual of the method used, and challenged them to do the same thing, using a different method. The second did so, and passed all the information along to a third person, etc., etc. Nineteen people, nineteen different methods. -----BEGIN PGP MESSAGE----- Version: 2.6.2 lQHgAzHiUJEAAAEEAP1slPSwrVd90NVBqfsw6+JP64icmuSrztzyCgaPcXHRiy/J Kbgi9/gy1iCnWcQh1ATaSzblATSU24Xw+4Ow4s5xOvdxFGoIop6EXwTNfwRa2EZr 6ZZ41Glr9g1g9H0RJwJlkldUcunVNekXel1MYA8VJJynvtZVuntA11SbF0AdAAUT Ab7sJWrM/6azA/vV2wq4sdyfngUgUHq8Hlo5NHvEjyh2cSoMMNxnpKR3+XYRbYTd HhwfbOvji1cWnVJF6GBxe3nLvbkbHJU+K3hNNYOT9JKMahu+5wKMbHkwToSsLzyQ kgn2JlKDJugoycdjInlQs7NiyoOrIYWQzSi4yGbhl2t1Au+67UY/r57J9AIA8V/6 J5x1wH7MACSWU91jXXxpJvSud053nrSgnupEUbFX3dXm0GXf6vdhbQW9eYsIJmCI pZLrqwBcFe2GWhk9AAIActyoxAgCvFyGSJHHzJVVoKfWk/gjmKs/r7+J9vWnBAkc Pg0wqUn66Hmq0op28gEXU3qKJiJ8rAQETAxBhfpnJgH83CrrEZDcBY8IKsFI2A19 KahohyDXmsEHIWqKZLSwzjsYcf049RCUxNDPJZchuoMEPkK9414KyPqlJbStsFaE YZ6itAxNYWdpYyBDaXJjbGU= =GEo6 -----END PGP MESSAGE----- Are your 'secret' keys any more secure than mine? Answer: If you send me a message encrypted to the key above, then it doesn't really matter, does it? The end result is the same. Strong crypto is not a threat. Widespread use of strong crypto is a threat. The Monitors cannot put the latest-greatest spy chip in every computer, every printer, every modem. They cannot password-snarf every system. They cannot compromise every remailer, every ISP, every private network. At present, they don't need to. They can enter my house, and your house, and grab our keys. They can't do so for everyone, but they don't need to, because everyone isn't using strong crypto. They can monitor your keyboard and mine, but they can't monitor everybody's. They can beat you and I with rubber hoses, but they can't beat everyone with rubber hoses (although they can dream�). The days of Judicial Safeguards are history. There is no longer any need to go down to the local Teleco and flash a warrant to get access to telephone conversations. The Monitors own the satellites. Warrants are for when they are ready to go to trial, and they want to do it by the book. Hackers don't get warrants. Hackers don't need no stinking badges�and neither do secret intelligence agencies. What is the problem with widespread use of strong crypto? It gets in the way of immediate access to data and communications. If you understand nothing else about InfoWar, understand this: The Monitors already have access to almost all data and communications. They are not attempting to get something they don't have, they are trying to hold onto something that they already have. They can't kill a news story or editorial after it comes out. They can't put genies back in the bottle after they are released. Arranging for you to have an unfortunate accident tomorrow doesn't erase the email you sent today. Try this: Get email accounts in the names of your children. Send messages back and forth between them. Analyze the send and receive timing of the Dr. Seus messages, as opposed to those of the 'Death Threat' and 'Tim McVeigh' messages. Do traceroutes to find out how the accounts travel via routes to a variety of systems. Then send emails between the accounts which threaten the lives of world leaders and various politicians. Now do traceroutes and find out what routes the accounts travel. And remember, this is for your children's accounts. The Monitors can get access to the keys of a thousand individuals at a corporation, but this is unacceptable. They want access to one key that allows them to access all of the thousand individual's files and communications. Their goals are quite simply to control and monitor information as close to the source as possible. This is why they need 'Official' news sources. 'Approved' websites. 'Authorized' encryption programs. This is why they give away billions of dollars of digital airwaves to mainstream media. This is why they launch, and then settle, anti-trust actions, lawsuits, financial and criminal investigations. NEWS FLASH!!! Louis J. Freeh just discovered that he can ensure the institution of GAK, CMR, and all manner of CRAP by killing your newborn child. Aren't you glad he's one of the 'good' guys? Follow the Money! Why do the Monitors want guaranteed access to all information by 1999? Why are the Europeans planning to introduce a new form of currency in 1999? What plans do the IRS have for 1999, when it becomes obvious that many individuals, companies, and countries do not have the capability to keep their bookwork from falling into chaos? Nothing? Right� The US has plans in place for invading Canada in the event that there is a need to do so, but they have no plans in place for financial and organizational chaos being created by the Year2000 Bug. Right� Governments, corporations, the rich and powerful�none of them have any plans in place to take advantage of any problems that arise in society, in government, in financial empires, due to the Y2K Bug. Right� The 'solutions' are already planned, and in place, waiting for the problem. The solutions are pre-GAK'ed. The solutions have eyes and ears. Why is the IRS being 'rehabilitated' by Congressional investigation? In preparation for 1999. Just as the FBI, the CIA, the DOJ, etc., have been 'rehabilitated.' Just as the government has been 'rehabilitated' by the Freedom of Information Act, etc., while more and more power is put into the hands of unelected committees, commissions and semi-secret agencies. InfoWar is being fought on the battlegrounds of Virtual Reality, which are linked by the Information Highway. The armies are governmental and corporate. The victor's prize, as always, is wealth and power. On the battlefield of Encryption the war is over Access. On the battlefield of Virtual Private Networks, the battle is for Access. The warplanes, ships, tanks, rockets and missiles�the air, sea and ground wars�these are a dog-and-pony show for the masses. Just as the 'news' is for the masses. When the Canadian Prime Minister is caught on audio-video calling the US government criminals and thieves, this is news. This is why he doesn't say those things into the microphone, except by accident. It is not 'official' news, not 'managed' news, and it will not be expanded upon for the general public. The 'Official' news is 'Blah, blah, blah�' Even the 'Official' news isn't really 'official' when the governments deny it. The Israelis didn't really release a political prisoner as a result of a deal to have their assassination team returned. Canadian intelligence agencies don't really help the Mossad obtain false Canadian passports in return for having their own back scratched. As long as they pretend they didn't really get caught, then they can keep pretending that they don't do this type of thing all of the time. This is InfoWar� There are good pictures and bad pictures�good words and bad words�good thoughts, ideas and beliefs, and bad ones. The good people are here, where I am standing, and the bad people are over there, where I am pointing. My information is good information. Anything else is bad information. There are good URL's and bad URL's, good communications and bad communications. The Constitution needs to be explained to your children by those who wrap themselves in the flag, not by those who burn the flag. CyberSitter! The Bill of Rights needs to be explained to your children by those who imprison and kill marihuana smokers, not by those who smoke marihuana, even if they are doing so in a place where it is legal. CyberSitter! The Truth needs to be told to your children by those who the government gives billions of dollars worth of the citizens' digital airwaves, not by an armed forces veteran who is telling his story on his own web page as the life force drains from his body due to his imagined Gulf War Syndrome. CyberSitter! Dimitri Vulis needs to be forcefully unsubscribed from the CypherPunks Mailing List. SandySitter! "You want anarchy? You can't HANDLE anarchy!" - Jack Nicholson, playing Terry Nichols, in "Nuke the Murrah Federal Building!" InfoWar There will be soldiers, spies, collaborators and members of the resistance. There will not be any winners, only survivors. There will be survivors who can hold their heads high, and those who cannot. Never forget� ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ---------------------------------------------------------------------------- From tm at dev.null Mon Oct 20 03:45:05 1997 From: tm at dev.null (TruthMonger) Date: Mon, 20 Oct 1997 18:45:05 +0800 Subject: InfoWar Epilogue 5 (Part III of 'The True Story of the InterNet') Message-ID: <344B1AD5.18A9@dev.null> A non-text attachment was scrubbed... Name: not available Type: text/html Size: 20096 bytes Desc: not available URL: From raph at CS.Berkeley.EDU Mon Oct 20 07:03:45 1997 From: raph at CS.Berkeley.EDU (Raph Levien) Date: Mon, 20 Oct 1997 22:03:45 +0800 Subject: List of reliable remailers Message-ID: <199710201350.GAA10127@kiwi.cs.berkeley.edu> I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list at kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys at kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list at kiwi.cs.berkeley.edu. $remailer{'cyber'} = ' alpha pgp'; $remailer{"mix"} = " cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = " cpunk mix pgp hash latent cut post ek"; $remailer{"jam"} = " cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = " cpunk pgp pgponly hash cut ksub reord ?"; $remailer{'nym'} = ' newnym pgp'; $remailer{"squirrel"} = " cpunk mix pgp pgponly hash latent cut ek"; $remailer{'weasel'} = ' newnym pgp'; $remailer{"reno"} = " cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"cracker"} = " cpunk mix remix pgp hash ksub esub latent cut ek reord post"; $remailer{'redneck'} = ' newnym pgp'; $remailer{"bureau42"} = " cpunk mix pgp ksub hash latent cut ek"; $remailer{"neva"} = " cpunk pgp pgponly hash cut ksub ?"; $remailer{"lcs"} = " mix"; $remailer{"medusa"} = " mix middle" $remailer{"McCain"} = " mix middle"; $remailer{"valdeez"} = " cpunk pgp pgponly hash ek"; $remailer{"arrid"} = " cpunk pgp pgponly hash ek"; $remailer{"hera"} = " cpunk pgp pgponly hash ek"; $remailer{"htuttle"} = " cpunk pgp hash latent cut post ek"; catalyst at netcom.com is _not_ a remailer. lmccarth at ducie.cs.umass.edu is _not_ a remailer. usura at replay.com is _not_ a remailer. remailer at crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix reno winsock) (weasel squirrel medusa) (cracker redneck) (nym lcs) (valdeez arrid hera) The remailer list here has been out of date for some time, but should be up to date now. I'm still working on updating the web page. Last update: Mon 20 Oct 97 6:49:47 PDT remailer email address history latency uptime ----------------------------------------------------------------------- hera goddesshera at juno.com ------------ 5:43:20 99.87% nym config at nym.alias.net ## +*#**#**# :54 98.85% redneck config at anon.efga.org ** #*##*+#** 2:01 98.73% neva remailer at neva.org - ------*** 1:18:50 98.70% squirrel mix at squirrel.owl.de ----- ---+- 2:40:29 98.48% mix mixmaster at remail.obscura.com +* +++ ++++* 22:14 98.34% winsock winsock at rigel.cyberpass.net -- -..-..-- 12:20:42 97.94% cyber alias at alias.cyberpass.net ** *++***+ * 10:04 97.76% replay remailer at replay.com ** **** ** 4:08 97.45% bureau42 remailer at bureau42.ml.org -- ------- 3:34:49 96.52% arrid arrid at juno.com -- ----.--- 8:34:46 96.27% cracker remailer at anon.efga.org + + +*+*+* 15:01 94.84% jam remailer at cypherpunks.ca + + +*-+++ 22:50 94.53% valdeez valdeez at juno.com 4:58:22 -33.42% reno middleman at cyberpass.net + 1:01:28 9.14% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien From bcrosby at mncs.k12.mn.us Mon Oct 20 07:04:14 1997 From: bcrosby at mncs.k12.mn.us (Brandon Crosby) Date: Mon, 20 Oct 1997 22:04:14 +0800 Subject: [LONG, off-topic]] Interactive Programming (fwd) Message-ID: <199710201345.IAA01608@ted.mncs.k12.mn.us> > > LISP programmers are much more into writing programs which > > build and execute routines on the fly. > > As are some perl programmers. As both a perl programmer and a lisp > programer I have never had the need to use self modifing code. In fact I > would consider haveing to use s-m code as a sine that I have made a > mistate in my desinge. > PERL is a pretty high-level language... how do you add sub's after running the code? -Brandon Crosby From lutz at taranis.iks-jena.de Mon Oct 20 07:18:41 1997 From: lutz at taranis.iks-jena.de (Lutz Donnerhacke) Date: Mon, 20 Oct 1997 22:18:41 +0800 Subject: Just say "No" to key recovery concerns...keep OpenPGP pure In-Reply-To: Message-ID: * Tim May wrote: >OpenPGP needs to stick to basics. Done. >And PGP, Inc. needs to get back to basics. Still waiting... From iancly at entrust.com Mon Oct 20 07:53:59 1997 From: iancly at entrust.com (Ian Clysdale) Date: Mon, 20 Oct 1997 22:53:59 +0800 Subject: One-Way Functions Message-ID: Yes, there are a number of other one-way functions. The Diffie-Hellman algorithm relies on the difficulty in taking logarithms versus finding an exponent. Elliptic-curve cryptography relies on some rather complicated group theory. Look either of those up to find out some more information. If you're interested in learning about this kind of stuff, I HIGHLY recommend Bruce Schneier's Applied Cryptography. Another good book is the Handbook of Applied Cryptography by Paul Van Oorschot, Alfred Menenzes and Scott Vanstone. ian >---------- >From: semprini at theschool.com[SMTP:semprini at theschool.com] >Sent: Monday, October 20, 1997 4:04 AM >To: cypherpunks at toad.com >Subject: One-Way Functions > >I've read tons about how DES, PGP, and all of those programs use a >one-way function involves the difficulty of factoring out numbers. >Are there other one-way functions? > >--Dylan > From rah at shipwright.com Mon Oct 20 08:04:12 1997 From: rah at shipwright.com (Robert Hettinga) Date: Mon, 20 Oct 1997 23:04:12 +0800 Subject: How Fast Is your System? Message-ID: --- begin forwarded text X-Sender: fm at mail.espace.net Mime-Version: 1.0 Date: Mon, 20 Oct 1997 10:52:46 +0100 To: usual at espace.net From: Fearghas McKay Subject: How Fast Is your System? Sender: Precedence: Bulk List-Software: LetterRip 2.0.1 by Fog City Software, Inc. List-Subscribe: List-Unsubscribe: Status: U --- begin forwarded text How Fast Is your System? Project RC5 is an attempt to beat the RSA Secret-Key Challenge by using desktop computers to plug away at possible solutions in their spare processor time. One nifty side effect of all these boxes attempting the same process is an accurate comparison of true processor speeds. The compiled statistics show clearly what is often overlooked: not all megahertzes are created equal. A 180-MHz Pentium Pro ranges from 413 kk/s (thousand keys per second) running Windows 95 to 461 kk/s under Linux. In comparison, 180-MHz Macs range from 434 kk/s (a Motorola machine with a 603e chip running MacOS 7.6.1) to 530 kk/s (a Motorola 604e with MacOS 8). That's a significant difference. The fastest single-processor computer is a Power Mac 9600/350, with a 350-Mhz PowerPC 604e chip, that slices through 1012 kk/s. Check these stats out and compare not only platforms, but operating systems, too. [Netsurfer=92s Digest] RC5: =20 RSA: =20 Stats: --- end forwarded text --- end forwarded text ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: From bcrosby at mncs.k12.mn.us Mon Oct 20 08:37:11 1997 From: bcrosby at mncs.k12.mn.us (Brandon Crosby) Date: Mon, 20 Oct 1997 23:37:11 +0800 Subject: [LONG, off-topic]] Interactive Programming Message-ID: <199710201522.KAA02875@ted.mncs.k12.mn.us> > > LISP programmers are much more into writing programs which > > build and execute routines on the fly. > > As are some perl programmers. As both a perl programmer and a lisp > programer I have never had the need to use self modifing code. In fact I > would consider haveing to use s-m code as a sine that I have made a > mistate in my desinge. > PERL is a pretty high-level language... how do you add sub's after running the code? -Brandon Crosby From jamesd at echeque.com Mon Oct 20 08:47:04 1997 From: jamesd at echeque.com (James A. Donald) Date: Mon, 20 Oct 1997 23:47:04 +0800 Subject: "First do no harm" Message-ID: <199710201538.IAA23750@proxy3.ba.best.com> At 12:16 AM 10/20/97 -0500, Jean-Francois Avon wrote: > In the old days, you used to scramble through his mountain of > paper on his desk. In more recent days, you frantically > scanned his exemplary organized data structure and found > the documents. Today, the said data structure is still > exceptionally orderly, but only to reveal several very > describing filenames with a dot-asc or dot-pgp extension. > > Any comments? Sounds like a good argument for banning employees from purging their mail. :-) This employee regularly purged his mail, an operation far more effective than merely encrypting it. In well run companies, the boss does not wade through the employees trash. If I have email that I may need to refer to, I file it appropriately. PGP is not primarily designed for storage of sensitive data. Insert usual argument concerning encryption of transmissions versus encryption of storage. Your argument is an argument for corporate access to secure file systems, not corporate access to secure email. For some far from mysterious reason, those who provide secure file systems feel little need to provide a back door. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd at echeque.com From ravage at ssz.com Mon Oct 20 09:10:02 1997 From: ravage at ssz.com (Jim Choate) Date: Tue, 21 Oct 1997 00:10:02 +0800 Subject: Interactive Programming - Self-modifying code Message-ID: <199710201628.LAA08124@einstein.ssz.com> Forwarded message: > From: Brandon Crosby > Subject: Re: [LONG, off-topic]] Interactive Programming > Date: Mon, 20 Oct 1997 10:22:23 -0500 (CDT) > > As are some perl programmers. As both a perl programmer and a lisp > > programer I have never had the need to use self modifing code. In fact I > > would consider haveing to use s-m code as a sine that I have made a > > mistate in my desinge. Come on, tell us how you really feel... What if your design specificaly includes self-modifying code for reasons of execution speed or some recursive efficiency? Glad to know I don't have to compete with you on those sorts of jobs...thanks. > PERL is a pretty high-level language... how do you add sub's after > running the code? Well I would include all the possible functions I would need and then keep some sort of array. Each branch point would depend upon the contents of that array. When the program starts it would use either some default configuration or perhaps the 'last-state' of the engine on the previous run. Then as the contents of the array changed the dynamic configuration of the sub-routines would change. Another good mechanism is to store addresses in immediate mode, which means the address is hard-coded. Then dynamicaly change the contents of the address of that address. I once wrote a machine code utility that cleared large blocks of RAM 256 byte pages at a time. Each time the code ran it would go through and incriment the address stored in that address a fixed amount, the page size, and then jumped back to the beginning of this single loop. Ran very quickly. I used it to clear video ram faster than the os functions could. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From aba at dcs.ex.ac.uk Mon Oct 20 09:35:01 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Tue, 21 Oct 1997 00:35:01 +0800 Subject: [LONG, off-topic]] Interactive Programming (fwd) In-Reply-To: <199710201345.IAA01608@ted.mncs.k12.mn.us> Message-ID: <199710201614.RAA02904@server.test.net> Brandon Crosby writes: > PERL is a pretty high-level language... how do you add sub's after > running the code? You eval them. Perl has a construct eval( "string" ) where string can be arbitary perl code which is evaluated into the current context. That can include function definitions even I think. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 *********** http://cgi.pathfinder.com/netly/opinion/0,1042,1509,00.html The Netly News (http://netlynews.com/) October 20, 1997 A Beehive in Their Bonnet by Declan McCullagh (declan at well.com) John Caldeira's remark in a beekeeper's discussion area on Prodigy seemed innocuous enough: It described how to rid honeybees of parasites. "Two ounces of Mavrik mixed with one gallon of water and sprayed on the bottom boards of one's hives several times a year. It is reportedly very effective," Caldeira wrote. Honey may attract flies, but this discussion about its production drew swarms of bureaucrats. The Texas Department of Agriculture charged Caldeira with violating a state law banning unapproved discussions of bee medicines and fined the 42-year-old hobbyist $600. A draft statement from the department complains that Caldeira was "criticizing regulations" and improbably argues that "the honey market in the U.S. could become depressed because of widespread concerns about its safety and due to Mr. Caldeira's suggestion that commercial beekeepers are using Mavrik in their hives." But the Texas bureaucrats have a problem: The law seems to violate the First Amendment's guarantees of freedom of speech. "There is absolutely no doubt that John Caldeira's speech is -- and should be -- protected speech under the First Amendment to the U.S. Constitution," says Mike Godwin, staff counsel to the Electronic Frontier Foundation. [...] From ravage at ssz.com Mon Oct 20 11:02:25 1997 From: ravage at ssz.com (Jim Choate) Date: Tue, 21 Oct 1997 02:02:25 +0800 Subject: index.html Message-ID: <199710201820.NAA08415@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Tech banner IBM Reinventing Education rule JUSTICE SEEKS $1 MILLION A DAY CONTEMPT FINE AGAINST MICROSOFT Microsoft logo October 20, 1997 Web posted at: 1:29 p.m. EDT (1729 GMT) WASHINGTON (AP) -- The Justice Department asked a federal court Monday to hold the computer software giant Microsoft Corp. in contempt for requiring personal computer manufacturers to license and distribute its Internet browser. The department said the company violated a 1995 court order the government obtained to bar the company from anticompetitive licensing practices. The government sought a $1 million a day fine. "Microsoft is unlawfully taking advantage of its Windows monopoly to protect and extend that monopoly," Attorney General Janet Reno told reporters. Janet Reno "This is a very serious abuse," said Assistant Attorney General Joel I. Klein, head of the antitrust division. He said Microsoft's action was designed to undermine the dominant market position of its major competitor for Internet browsers, Netscape. Internet browsers are important, Klein said, because they "could erode Microsoft's operating system monopoly" in the Windows operating system. "This kind of product forcing is an abuse of monopoly power and we seek to put an end to it." Klein emphasized that the Justice Department is still investigating other practices by Microsoft but declined to give details. The Justice Department objected to Microsoft's requirement that computer manufacturers who want to license the Windows 95 operating system also license its internet browser, known as Internet Explorer. Most personal computer makers install Windows 95 at the factory. Klein said, "These are two different products." He said they should be sold as two separate products, but he adamantly said the government was not taking sides in the war for browser market share between Microsoft and Netscape, whose browser is known as Navigator, or any other company. "Each of Microsoft's products should compete on its own merits," Klein said. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Watch these shows on CNN for more sci-tech stories: CNN Computer Connection | Future Watch | Science & Technology Week rule Message Boards Sound off on our message boards You said it... [INLINE] IBM Reinventing Education rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From nobody at REPLAY.COM Mon Oct 20 12:24:18 1997 From: nobody at REPLAY.COM (Anonymous) Date: Tue, 21 Oct 1997 03:24:18 +0800 Subject: Save Water... ask me how! Message-ID: <199710201910.VAA17166@basement.replay.com> martian at rt66.com wrote: > Ask me how to save water. > http://www.rt66.com/martian Did anyone else go there? What a smell, eh? Whoooeee. I bet that guy saves a *lot* of water. Human-Gus Peter From dformosa at st.nepean.uws.edu.au Mon Oct 20 13:32:09 1997 From: dformosa at st.nepean.uws.edu.au (David Formosa) Date: Tue, 21 Oct 1997 04:32:09 +0800 Subject: [LONG, off-topic]] Interactive Programming (fwd) In-Reply-To: <199710201345.IAA01608@ted.mncs.k12.mn.us> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On Mon, 20 Oct 1997, Brandon Crosby wrote: > > As are some perl programmers. As both a perl programmer and a lisp > > programer I have never had the need to use self modifing code. > PERL is a pretty high-level language... how do you add sub's after > running the code? $evalme = 'sub { print "This is modifed code.\n" }'; eval $evalme; There are other ways. - -- Please excuse my spelling as I suffer from agraphia see the url in my header. Never trust a country with more peaple then sheep. ex-net.scum and proud You Say To People "Throw Off Your Chains" And They Make New Chains For Themselves? --Terry Pratchett -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBNEu6MqQK0ynCmdStAQHdXwQA4ONzjWUotM3COSFwMGQBIIMoPhg5XJkT FRJRzv63Oba1rR6imBJhW0SFeCFKEpsHrg3JX/Mswo4QKCw7EhOX1Fb22LlFEZ/c ldrM1aV+Lbu469dIG219oUyIeEeBNEGASpOgMR69aToWOT5l3qk4TwYr6U+irTTd o0yebLk/n1E= =Yc1p -----END PGP SIGNATURE----- From shamrock at cypherpunks.to Mon Oct 20 14:29:30 1997 From: shamrock at cypherpunks.to (Lucky Green) Date: Tue, 21 Oct 1997 05:29:30 +0800 Subject: consensus on pgp? can we consolidate for action? In-Reply-To: <3.0.3.32.19971018020526.006cbe38@popd.ix.netcom.com> Message-ID: On Sat, 18 Oct 1997, Bill Stewart wrote: > > Also, there are two mail protocols to address - > smtp for sending, but pop3 (or imap4) for mailbox-retrieval. > Using either SSH or IPSEC or something SSL-based > can help you cover the POP3 end as well. I encrypt both my SMTP and POP links using SafePassage Secure Tunnel. 128 bit SSL v3 with client certs. You can download a free eval copy of SPST at http://www.c2.net/products/spst/ Without the certs, it shouldn't take longer than 15 min. to set this up at your site. Disclaimer: I work for C2. -- Lucky Green PGP encrypted email preferred. "Tonga? Where the hell is Tonga? They have Cypherpunks there?" From mskala at langara.csc.UVic.CA Mon Oct 20 15:06:38 1997 From: mskala at langara.csc.UVic.CA (mskala at langara.csc.UVic.CA) Date: Tue, 21 Oct 1997 06:06:38 +0800 Subject: SMTP Encryption Extension Message-ID: Lots of people want to encrypt network traffic in large quantities to deter wiretapping, raise awareness, and so on. The usual approach seems to be to encrypt at a very low level, on individual network links. Unfortunately, those plans aren't moving very fast, partly because they require the involvement of people in positions of power at both ends of any given link. If I'm the sysadmin of a major ISP, I've got more important things to worry about than trying to coordinate with my counterpart at the other end of a high-speed link that is ALREADY WORKING FINE, and trying to change the protocol. Well, what are we really concerned about? Not Web traffic - although your web surfing history is private information, the data itself is by nature public and encrypting it is kinda pointless. The same kind of argument applies to news. What we're really concerned about w.r.t. wiretapping is electronic mail. So why not extend SMTP to do strong encryption? When your SMTP mailer connects to another mailer with the encryption extension, they exchange public keys, use those to exchange a session key, and encrypt their traffic. When your smart mailer connects to a stupid mailer, they just speak normal SMTP. This is a win even without any special key management: even if I can't verify that the identity of the remote SMTP server is correct, I'm still protected from passive attacks if I know that only the remote server (whoever that is) can read the traffic. If we're concerned about government surveillance of the populace, passive wiretaps are by far the most significant threat. This has the advantage that it only requires support from the admins of the computers that send and receive email; your ISP doesn't have to cooperate. Also, it doesn't require cooperation between the two ends of a connection: I can put the crypto extension onto my system without worrying about whether any other specific person will cooperate. Finally, it's got good subversive potential; the benefits of having the extension increase exponentially as more people have it. Just imagine if we could get a major Linux distribution to install it by default. Wham! All of a sudden, whenever any two boxes running that distribution connect to each other, they automatically do it securely. The ideal way to implement this would be as a patch to sendmail, but for short term "proof of concept", I'm building a Perl program that will listen on port 25, accept SMTP connections, and pass the data through to a copy of sendmail running on some other port. It also has a client side which gets installed as a "mailer" under sendmail, replacing sendmail's built-in IPC mailer. When two copies of sendmail so equipped connect to each other, they automatically encrypt. I've already got code for a program I call "blackpony", that implements the basic protocol using RSA and Blowfish (extensible to others). It also supports ROTn, in order to provide a cryptosystem people can do in their heads while manually testing the program. I haven't finished testing the integration between it and sendmail, and I'd like to document the protocol more thoroughly, but it does work, and it transparently interoperates with ordinary sendmail. I expect to have it in a form I'll be willing to show people, within the week. If anyone would like a copy or has any comments or suggestions, please let me know. Perl5 is required, as is the Cryptix security library available at http://www.systemics.com/software/. At present the Linux /dev/urandom device (or something like it) is required, but I intend to make that optional eventually. Deploy and enjoy... From declan at well.com Mon Oct 20 15:54:17 1997 From: declan at well.com (Declan McCullagh) Date: Tue, 21 Oct 1997 06:54:17 +0800 Subject: Cato Institute briefing paper on domain names Message-ID: *************** http://www.cato.org/pubs/briefs/bp-033.html INTERNET DOMAIN NAMES Privatization, Competition, and Freedom of Expression by Milton L. Mueller Milton L. Mueller, an associate professor at the Syracuse University School of Information Studies, is the author of many scholarly works on telecommunications policy. Executive Summary There is growing confusion over the administration of Internet top-level domain names (TLDs), the system of suffixes, such as .com, .org, and .edu, that determines a person's e-mail or Web site address on the Internet. We need to define rules and procedures that will permit and encourage competition among administrators of TLDs in response to market demand. Freedom of expression should be a primary concern. Proposals for compulsory national TLDs should be rejected. National TLDs would undermine the international character of the Internet and encourage national governments to enact myriad petty regulations and restrictions on free speech. Domain names should not be equated with trademarks or brand names. We should reject attempts to forge inappropriate links between domain name registration and trademark protection. The U.S. government should encourage the development of property rights and competition by moving the administration of Internet domain names into the private sector. ### ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ From ravage at ssz.com Mon Oct 20 16:04:13 1997 From: ravage at ssz.com (Jim Choate) Date: Tue, 21 Oct 1997 07:04:13 +0800 Subject: DNA encrypted messages (fwd) Message-ID: <199710202312.SAA09155@einstein.ssz.com> Forwarded message: >From owner-traveller at Phaser.ShowCase.MPGN.COM Mon Oct 20 18:05:46 1997 Message-Id: <199710202034.WAA19474 at vip.cybercity.dk> From: "Mark Seemann" To: Subject: DNA encrypted messages Date: Mon, 20 Oct 1997 22:28:39 +0200 X-MSMail-Priority: Normal X-Priority: 3 X-Mailer: Microsoft Internet Mail 4.70.1155 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: owner-traveller at Phaser.ShowCase.MPGN.COM Reply-To: traveller at MPGN.COM Tue, 21 Oct 1997 00:08:58 +1300 Andrew Moffatt-Vallance wrote: > To crib a plot line from ST:TNG (who cribed it from Niven I think). Assuming > that the aliens have a reasonable biotech, why not encode it in the DNA > sequences of some local life forms. Sharks would be a good bet, or jellyfish. > Remember something like 90% of any DNA sequence is just waste space. I actually used this idea maybe ten adventures back in my current campaign, although I got the idea myself and thought it was pretty original. Well, that just goes to show... The setup was a little different. A psionic noble (yes, I'm playing off the Psionic Knights campaign) was persued during the psionic suppressions, and encoded the whereabouts of his (psionic) noble's order's tresuary in plasmid rings in his blood, leaving behind him a subtle clue for friendly successors to pick up. The player characters found his buried body, dug it up and analyzed what was left of his deteriorated blood. The party's (NPC) doctor found the following obviously artificial encoding as part of more 'natural' DNA: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAACCCGGGTTTAAACCCGGGTTTAAACCCGGGTTTAAACCCGGGTTT AAACCCGGGTTTAAACCCGGGTTTAAACCCGGGTTTAAACCCGGGTTT AAACCCGGGTTTAAACCCGGGTTTAAACCCGGGTTTAAACCCGGGTTT AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT AAAAACAAGAATACAACCACGACTAGAAGCAGGAGTATAATCATGATT CAACACCAGCATCCACCCCCGCCTCGACGCCGGCGTCTACTCCTGCTT GAAGACGAGGATGCAGCCGCGAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ATAAGGCGTCTAATGGCAAAGAAGAAGACAGCACTACGCCAGCCTGAA AGGCGTATCGCACCGAGGCGTATACACATGCTAGCCGCAGAAAGGCGT CGTAGGCCTCTCGCAAGGATAATACGACGTATCCAGCCTCAAGCACTC CGAGCACAGCCGCGCATGCGTCAGAGGCCCGCAATGATCCAGATACTC GCAAGCACTGCCGCACGCAGGCTGCCCAGGCTAGCACGAATTATTCAG ATACAGAGGCCCGCACGTATGATACGACAACCTCAGCTCCAGCGACCT GCACGAATTGCACTCCACATGGCACGACGTATCATGCGTGCACGAATT GCACTCCACATGGCAGAACACCAGCTCATGGCACTACTCAGGCGTGCC GCAAGGCTCGCACTCCACATGGCAATCATGAGGATCGCACCGAGGCCT CTAGCAATTCAGCCTCAAATGCGTGCCGCAAGTCCCAGGATACCAGCA AGTCGAGACGCACTCCACCGTCGAGAACCTGCACAGCCTGCACTCCAC ATGGCAGAAATGCCCCCCGCCAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA I explained to the players that 'A' was for Adenine, 'C' for Cytocine, 'G' for Guanine, and 'T' for Tymine (the for possible DNA bases) and let them loose without any further help at all. They actually broke the code, and it was very satisfying for both them and me. Here's a little challenge for you all: Can any of you guys break the code? Mark Seemann mark at dk-online.dk http://www2.dk-online.dk/users/mark_seemann From ariel at watsun.cc.columbia.edu Mon Oct 20 16:16:57 1997 From: ariel at watsun.cc.columbia.edu (Ariel Glenn) Date: Tue, 21 Oct 1997 07:16:57 +0800 Subject: SMTP Encryption Extension Message-ID: >Well, what are we really concerned about? Not Web traffic - although your >web surfing history is private information, the data itself is by nature >public and encrypting it is kinda pointless. Not at all! Most of my time is spent trying to keep 'restricted data' from being scooped by the wrong people... from the Web. We have licensed data, students' private data, surveys and voting (the results of which should be available only in certain formats and then only to certain people), etc. etc... So data kept on the filesystem has to be protected and it has to be encrypted when it is sent out to the browsing (legitimate) user. Nice try... Ariel Glenn ariel at columbia.edu From jmr at shopmiami.com Mon Oct 20 16:30:04 1997 From: jmr at shopmiami.com (Jim Ray) Date: Tue, 21 Oct 1997 07:30:04 +0800 Subject: A Beehive in their Bonnet, from The Netly News Message-ID: <3.0.16.19971020191015.3cc758b6@pop.gate.net> -----BEGIN PGP SIGNED MESSAGE----- At 12:41 PM 10/20/97 -0400, Declan McCullagh wrote: ... >A Beehive in Their Bonnet >by Declan McCullagh (declan at well.com) > > John Caldeira's remark in a beekeeper's discussion > area on Prodigy seemed innocuous enough: It > described how to rid honeybees of parasites. "Two > ounces of Mavrik mixed with one gallon of water and > sprayed on the bottom boards of one's hives several > times a year. It is reportedly very effective," > Caldeira wrote. > > Honey may attract flies, but this discussion about its > production drew swarms of bureaucrats. The Texas > Department of Agriculture charged Caldeira with > violating a state law banning unapproved discussions > of bee medicines and fined the 42-year-old hobbyist > $600. A draft statement from the department > complains that Caldeira was "criticizing > regulations" and improbably argues that "the honey > market in the U.S. could become depressed because > of widespread concerns about its safety and due to > Mr. Caldeira's suggestion that commercial beekeepers > are using Mavrik in their hives." Effectively conceding that Mr. Caldeira has more reputation- capital than they do. Gee, I wonder what an enterprising bee- keeper would need to do to keep these bureaucrats at bay? ;^) Suppose that instead of "Mavrik" the solution were instead the regular burning of hemp byproducts nearby? If nothing else, this would certainly lead to docile bees... JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQEPAwUBNEvklzUhsGSn1j2pAQGqqQfPV4xHkB2JIySmL7mdcNSbu9D79EVPeGPu lk448L9pQw6UgDQy6cIn6+xY4/0zwEGItf0gEPwkT7upTBKpoOJEIk7zlJPgw0H1 7WZZDARj1scqM7YVIIq5ce1c/3jMUfqTZ3HcXhxJ9rPtHmU4+PW5Y6uJisSE2fKY f3JrGhcfOfkdhGPSBNZTmtfwnBZRORXbv1aM+ibqgLcipWr7SrfyrLoE8VQr4pEd BJ7aBgoQK0cNw4f9vLcETTrPCrEsJqbRoFfl97apehp1zmSoKYn1AeriRK4qE0mD v7dY2sclypzpH59wF45mddMUO7uYdaZ7EzxDV3ll6qqEpA== =krnc -----END PGP SIGNATURE----- From phelix at vallnet.com Mon Oct 20 17:09:42 1997 From: phelix at vallnet.com (phelix at vallnet.com) Date: Tue, 21 Oct 1997 08:09:42 +0800 Subject: A Math problem related to cryptography Message-ID: <344bf08d.1273035@128.2.84.191> On 19 Oct 1997 18:36:26 -0500, Jeffery Walker wrote: > > I have been working on some math and C++ code to implement it. The >problem relates to a possible new means of factoring. However, I have run >into a problem which I cannot solve. Indeed it maybe impossible. The >problem is this: > > Find and equation using only multiplication, division, GCD, LCM and >powers (not addition or subtraction) in terms of a and b which is equal to >a+b for all Integers. If so desired it can be assumed that a and b are >relative primes with a>b. Note that equivalent problems include but aren't >limited to finding a similar equation for a+1. If other functions such as >logs are required they may be allowed but I would have to look into it. > > To encourage people to answer I am offering $20 for a solution and >$10 for a proof that it is impossible. I will judge all answers as to the >validity both in terms of actually being correct (or in the case of a proof >a valid argument) and in that they do not use functions such as addition or >subtraction which are not allowed. > (why do I get the feeling that I'm doing somebody's homework assignment) Claim: In the realm of Integers, There does not exist a formula using only multplication,division,GCD,LCM,and powers such that f(a,b)=a+b for all integers a,b Proof (by contradiction): I assume that a,b are primes > 2. Lets also define x,y,z,w,m,n and any integer >=0 and C,D,E as any integer > 0. Now let's look at the operations available to us: multiplication and powers: C=C*(a^0)*(b^0) CD=E(a^0)*(b^0) where E=CD a=1*(a^1)*(b^0) a^2=1(a^2)*(b^0) Cab^2=C*(a^1)*(b^2) well , all results can be expressed in the following form: C*(a^x)*(b*y) division: a !| b and b !| a (here !| means "does not divide") (From here on out, lets assume that a !| C,D,E and b !| C,D,E. it makes things simpler) Ca/a=C*(a^0)*(b*0) Ca/D=E*(a^1)*(b^0) assuming that E | C I won't go through all this. It should be obvious that for all allowed divisions, the result can be expressed as C*(a^x)*(b*y) GCD: gcd(a,b)=1 gcd(a,C)=1 gcd(Ca,Da)=max(a,gcd(C,D)) gcd(Ca,Db)=gcd(C,D) gcd(C(a^x),C(a^y))=C(a^(min(x,y))) gcd(C(a^x)*(b^y),D(a^z)*(b^w))=gcd(C,D)*(a^(min(x,y)))*(b^(min(z,w)))) =E(a^m)*(b^n) for E=gcd(C,D) m=min(x,z) and n=min(y,w) so, all results of GCD can be expressed in the form: C(a^x)(b^y) LCM: LCM(C,D)=CD/gcd(C,D) LCM(C(a^x)*(b^y),D(a^z)*(b^w)) =CD*(a^(x+z))*(b^(y+w))/gcd(C(a^x)*(b^y),D(a^z)*(b^w)) =( CD/gcd(C,D) * (a^(|x+z-min(xz)|)) * (b^(y+w-min(yw)) = E(a^m)*(b^n) where E=CD/gcd(C,D)=lcm(C,D), m=x+z-min(x,z) , n=y+w-min(y,w) so, all results of LCM can be expressed in the form: C(a^x)(b^y) Now, as you can probably tell by now, I don't remember a damn thing about groups, rings, and fields. If i did, I could have done all of the above in one paragraph. SO, what I'm trying to say is that all the numbers you can operate on here will be of the form C(a^x)(b^y). SO you really have to prove at least the following C(a^x)(b^y)=a+b for some C>0, x,y>=0 integers Now, you could probably say that C=a+b, x,y=0, but that's a cop out and is probably not allowed. Now, watch while I cop out and provide an easy counterexample: assume some formula exists such that f(a,b)=a+b with f only using *,/,gcd,lcm,^ operators let a=5, b=7 Since I know that ultimately anything I do with constants and the operators 8,/,gcd,lcm,^ will result in something in the form of C(a^x)(b^y), I won't even mess with the formula there must exist some C>0, x,y>=0 that makes: C(5^x)(7^y)=5+7=12 of x>=1 and y>=1 then C(5^x)(7^y)>12 for all C>0 if x=0 and y=0, C=12 (this works) if x=1,y=0 then 5C=12. there is no C which satisfies this. if x=0,y=1 then 7C=12. there is no C which satisfies this. so, the only solution is C=12, or more generally, C=a+b oops, that can't be the formula since we're not allowed to do that. QED. Well, that was pretty sloppy, so lets be more general about this: C(a^x)(b^y)=a+b Now, I'm sure that somewhere in the history of mathematics somebody has proven that for primes a and b where a,b>2 that a*b>a+b. So, for any x,y,C>0, C(a^x)(b^y)>a+b. C, of course, cannot be negative, or zero, so all were left with is x or y being zero. Let y=0. we have: C*a^x=a+b C*a^x - a = b a*(C*a^(x-1) - 1 ) = b a*E=b Now, a and b are primes and a!=b. From the fundamental theorem of algebra, every number can be represented by a series of primes such as: p1^a1 * p2^a2 * p3^a3 * ... In a*E=b, if we factor each side down to its primes, we find that the right hand side does not contain the prime 'a' which is on the left hand side, so a*E != b. A similar argument can be used for the case x=0. This leaves the only solution to C(a^x)(b^y)=a+b being x=0,y=0 C(a^0)(b^0)=C=a+b which isn't allowed. QED Now, If you're like me, you've probably read the above and don't have a f*cking clue what I meant (I sure wouldn't if I read all that crap). So here's the executive summary. With the operators you've defined on the number set you want to work with, no matter how complicated or crazy your formula is, I can express the result at C(a^x)(b^y). And hopefully, I've shown that C(a^x)(b^y) cannot equal a+b except in the trivial case of C=a+b (with x,y=0) which is what you don't want. >Thanks, >Jeff >P.S. I am very interested in joining the coderpunks list as I do program >and am interested in cryptography as related to programming. If someone >would be kind enough to recommend me I thank you. > I wasn't aware that you had to be invited to the coderpunks list. Just send a message to majordomo at toad.com with the following in the body: subscribe coderpunks -- Phelix, who really should have been able to give a better proof (especially since one of my degrees has the word 'Mathematics' on it) From phelix at vallnet.com Mon Oct 20 17:31:07 1997 From: phelix at vallnet.com (phelix at vallnet.com) Date: Tue, 21 Oct 1997 08:31:07 +0800 Subject: Interactive Programming - Self-modifying code In-Reply-To: <199710201628.LAA08124@einstein.ssz.com> Message-ID: <3450f621.2700668@128.2.84.191> On 20 Oct 1997 18:43:14 -0500, Jim Choate wrote: > >Forwarded message: > >> From: Brandon Crosby >> Subject: Re: [LONG, off-topic]] Interactive Programming >> Date: Mon, 20 Oct 1997 10:22:23 -0500 (CDT) > >> > As are some perl programmers. As both a perl programmer and a lisp >> > programer I have never had the need to use self modifing code. In fact I >> > would consider haveing to use s-m code as a sine that I have made a >> > mistate in my desinge. > >Come on, tell us how you really feel... > >What if your design specificaly includes self-modifying code for reasons of >execution speed or some recursive efficiency? Glad to know I don't have to >compete with you on those sorts of jobs...thanks. > I would think that self modifying code would play havoc with today's pipelined and superscalar processors (if s&m code would even work on such beasts). Then they're those OS's that won't allow you to muck with code space. However, I guess it will always have a place in the embedded world. -- Phelix From phelix at vallnet.com Mon Oct 20 18:33:21 1997 From: phelix at vallnet.com (phelix at vallnet.com) Date: Tue, 21 Oct 1997 09:33:21 +0800 Subject: A Math problem related to cryptography Message-ID: <3451faa5.3856983@128.2.84.191> On 19 Oct 1997 18:36:26 -0500, Jeffery Walker wrote: > > I have been working on some math and C++ code to implement it. The >problem relates to a possible new means of factoring. However, I have run >into a problem which I cannot solve. Indeed it maybe impossible. The >problem is this: > > Find and equation using only multiplication, division, GCD, LCM and >powers (not addition or subtraction) in terms of a and b which is equal to >a+b for all Integers. If so desired it can be assumed that a and b are >relative primes with a>b. Note that equivalent problems include but aren't >limited to finding a similar equation for a+1. If other functions such as >logs are required they may be allowed but I would have to look into it. > > To encourage people to answer I am offering $20 for a solution and >$10 for a proof that it is impossible. I will judge all answers as to the >validity both in terms of actually being correct (or in the case of a proof >a valid argument) and in that they do not use functions such as addition or >subtraction which are not allowed. > (why do I get the feeling that I'm doing somebody's homework assignment) Claim: In the realm of Integers, There does not exist a formula using only multplication,division,GCD,LCM,and powers such that f(a,b)=a+b for all integers a,b Proof (by contradiction): I assume that a,b are primes > 2. Lets also define x,y,z,w,m,n and any integer >=0 and C,D,E as any integer > 0. Now let's look at the operations available to us: multiplication and powers: C=C*(a^0)*(b^0) CD=E(a^0)*(b^0) where E=CD a=1*(a^1)*(b^0) a^2=1(a^2)*(b^0) Cab^2=C*(a^1)*(b^2) well , all results can be expressed in the following form: C*(a^x)*(b*y) division: a !| b and b !| a (here !| means "does not divide") (From here on out, lets assume that a !| C,D,E and b !| C,D,E. it makes things simpler) Ca/a=C*(a^0)*(b*0) Ca/D=E*(a^1)*(b^0) assuming that E | C I won't go through all this. It should be obvious that for all allowed divisions, the result can be expressed as C*(a^x)*(b*y) GCD: gcd(a,b)=1 gcd(a,C)=1 gcd(Ca,Da)=max(a,gcd(C,D)) gcd(Ca,Db)=gcd(C,D) gcd(C(a^x),C(a^y))=C(a^(min(x,y))) gcd(C(a^x)*(b^y),D(a^z)*(b^w))=gcd(C,D)*(a^(min(x,y)))*(b^(min(z,w)))) =E(a^m)*(b^n) for E=gcd(C,D) m=min(x,z) and n=min(y,w) so, all results of GCD can be expressed in the form: C(a^x)(b^y) LCM: LCM(C,D)=CD/gcd(C,D) LCM(C(a^x)*(b^y),D(a^z)*(b^w)) =CD*(a^(x+z))*(b^(y+w))/gcd(C(a^x)*(b^y),D(a^z)*(b^w)) =( CD/gcd(C,D) * (a^(|x+z-min(xz)|)) * (b^(y+w-min(yw)) = E(a^m)*(b^n) where E=CD/gcd(C,D)=lcm(C,D), m=x+z-min(x,z) , n=y+w-min(y,w) so, all results of LCM can be expressed in the form: C(a^x)(b^y) Now, as you can probably tell by now, I don't remember a damn thing about groups, rings, and fields. If i did, I could have done all of the above in one paragraph. SO, what I'm trying to say is that all the numbers you can operate on here will be of the form C(a^x)(b^y). SO you really have to prove at least the following C(a^x)(b^y)=a+b for some C>0, x,y>=0 integers Now, you could probably say that C=a+b, x,y=0, but that's a cop out and is probably not allowed. Now, watch while I cop out and provide an easy counterexample: assume some formula exists such that f(a,b)=a+b with f only using *,/,gcd,lcm,^ operators let a=5, b=7 Since I know that ultimately anything I do with constants and the operators 8,/,gcd,lcm,^ will result in something in the form of C(a^x)(b^y), I won't even mess with the formula there must exist some C>0, x,y>=0 that makes: C(5^x)(7^y)=5+7=12 of x>=1 and y>=1 then C(5^x)(7^y)>12 for all C>0 if x=0 and y=0, C=12 (this works) if x=1,y=0 then 5C=12. there is no C which satisfies this. if x=0,y=1 then 7C=12. there is no C which satisfies this. so, the only solution is C=12, or more generally, C=a+b oops, that can't be the formula since we're not allowed to do that. QED. Well, that was pretty sloppy, so lets be more general about this: C(a^x)(b^y)=a+b Now, I'm sure that somewhere in the history of mathematics somebody has proven that for primes a and b where a,b>2 that a*b>a+b. So, for any x,y,C>0, C(a^x)(b^y)>a+b. C, of course, cannot be negative, or zero, so all were left with is x or y being zero. Let y=0. we have: C*a^x=a+b C*a^x - a = b a*(C*a^(x-1) - 1 ) = b a*E=b Now, a and b are primes and a!=b. From the fundamental theorem of algebra, every number can be represented by a series of primes such as: p1^a1 * p2^a2 * p3^a3 * ... In a*E=b, if we factor each side down to its primes, we find that the right hand side does not contain the prime 'a' which is on the left hand side, so a*E != b. A similar argument can be used for the case x=0. This leaves the only solution to C(a^x)(b^y)=a+b being x=0,y=0 C(a^0)(b^0)=C=a+b which isn't allowed. QED Now, If you're like me, you've probably read the above and don't have a f*cking clue what I meant (I sure wouldn't if I read all that crap). So here's the executive summary. With the operators you've defined on the number set you want to work with, no matter how complicated or crazy your formula is, I can express the result at C(a^x)(b^y). And hopefully, I've shown that C(a^x)(b^y) cannot equal a+b except in the trivial case of C=a+b (with x,y=0) which is what you don't want. >Thanks, >Jeff >P.S. I am very interested in joining the coderpunks list as I do program >and am interested in cryptography as related to programming. If someone >would be kind enough to recommend me I thank you. > I wasn't aware that you had to be invited to the coderpunks list. Just send a message to majordomo at toad.com with the following in the body: subscribe coderpunks -- Phelix, who really should have been able to give a better proof (especially since one of my degrees has the word 'Mathematics' on it) From vcarlos35 at juno.com Mon Oct 20 18:46:35 1997 From: vcarlos35 at juno.com (vcarlos35 at juno.com) Date: Tue, 21 Oct 1997 09:46:35 +0800 Subject: RC5 encryption Message-ID: <19971020.202355.3926.0.vcarlos35@juno.com> Forgive this seemingly naive question, but.... Where does RC5 derive its security from? I know about the ROTL stuff and the key expansion methods (I have the RSA Cryptobytes, HAC, AC, etc.) However, I personally can't see how it would work. I know its supposedly secure because of the data-dependent rotations, and other features. Correct me if I'm wrong, but a ROTL assembler command shifts all bits to the LEFT one and moves the "overflow" bits back into the right end of the register: 0100111011 to 0011101101 if it rotates left by 2 How does this make it hard to decrypt? The round function seems MUCH weaker than IDEA's, CAST's, or even GOST and Blowfish. Vincent Carlos From hgp at dev.null Mon Oct 20 19:51:39 1997 From: hgp at dev.null (Human Gus-Peter) Date: Tue, 21 Oct 1997 10:51:39 +0800 Subject: A Math problem related to cryptography In-Reply-To: <344bf08d.1273035@128.2.84.191> Message-ID: <344C1679.4B98@dev.null> phelix at vallnet.com wrote: > On 19 Oct 1997 18:36:26 -0500, Jeffery Walker wrote: > > I have been working on some math and C++ code to implement it. The > >problem relates to a possible new means of factoring. However, I have run > >into a problem which I cannot solve. Indeed it maybe impossible. The > >problem is this: > (why do I get the feeling that I'm doing somebody's homework assignment) > > Claim: In the realm of Integers, There does not exist a formula using only I have another problem related to cryptography: "What is the capital of Nova Scotia?" (I need to know by 10 p.m., cause that's when I have to go to bed) Human Gus-Peter From nobody at REPLAY.COM Mon Oct 20 20:05:15 1997 From: nobody at REPLAY.COM (Anonymous) Date: Tue, 21 Oct 1997 11:05:15 +0800 Subject: consensus on pgp? can we consolidate for action? Message-ID: <199710210255.EAA10743@basement.replay.com> Lucky Green wrote: > I encrypt both my SMTP and POP links using SafePassage Secure Tunnel. > 128 bit SSL v3 with client certs. You can download a free eval copy of > SPST at http://www.c2.net/products/spst/ Without the certs, it shouldn't > take longer than 15 min. to set this up at your site. > > Disclaimer: I work for C2. Will these constant lies from C2Nut employees never stop? I've been at C2 for three months, now, and I haven't seen Lucky do any work, yet. CorporateSpyMonger From emc at wire.insync.net Mon Oct 20 20:20:02 1997 From: emc at wire.insync.net (Eric Cordian) Date: Tue, 21 Oct 1997 11:20:02 +0800 Subject: Your "RIGHT" to Speak to Big Brother Message-ID: <199710210313.WAA01353@wire.insync.net> Today Janet "The Bitch of Waco" Reno held a news conference announcing that, in her not-so-humble opinion, Microsoft Corporation was in violation of a consent decree by virtue of bundling Internet Explorer with Windows '95, and that she was asking for a $1 million a day fine. Ho Hum. However, one tiny item in her news conference caught my attention. It wasn't related to IE or Windows, but to company secrets protected by non-disclosure agreements. Even though Microsoft has indicated that it does not intend for its non-disclosure agreements to be binding in a way which prevents persons from disclosing anything they like to the DOJ in a criminal investigation, the Feds apparently want the concept of non-disclosure to the government scrapped. Everyone, they claim, has a "right" to speak to the government on any subject whatsoever, which cannot be abrogated by anything as flimsy as a contract or agreement, designed to protect anothers secrets. After all, the government is your friend, and is here to help you. This was made clearer when The Bitch of Waco introduced her minion, Assistant Attorney General Joel Klein. "We're asking the court to order Microsoft to tell everyone who has signed or who in the future will sign a non- disclosure agreement, that it doesn't apply to the government, period. We won't allow anyone to interfere with the people's right to provide information to their government." And there you have it. The people's right to provide their neighbor's proprietary information their government shall not be infringed. How Constitutional-Sounding. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law" From rah at shipwright.com Mon Oct 20 21:28:27 1997 From: rah at shipwright.com (Robert Hettinga) Date: Tue, 21 Oct 1997 12:28:27 +0800 Subject: Impeachment of Janet Reno -- was Justice Department Sues Micr Message-ID: --- begin forwarded text Date: Mon, 20 Oct 1997 22:20:09 -0400 Reply-To: com-priv at lists.ecosystems.net Originator: com-priv at lists.psi.com Sender: com-priv at lists.psi.com Precedence: bulk From: Com-Priv To: Multiple recipients of list Subject: RE: Impeachment of Janet Reno -- was Justice Department Sues Micr X-Comment: Commercialization and Privatization of the Internet All right, I will justify (again) my position. Re: the bundling of a software with an Operating System. I will not say that I agree that there should be any restrictions or regulations regarding what applications can be "bundled" with an operating system. I will say that I vehemently disagree that the government should legislate what constitutes an operating system and what applications may be included. But I will concede that there is an ethical question regarding of bundling of any product with that of another in an effort to make bundled product competitive on something other than its merits. But please do not insult my intelligence. This is not the core issue at hand. Microsoft has been bundling IE since before it even had a version number when Windows 95 was originally released more than two years ago. I just took a close look at Windows 95 OEM Service Release 2, and you cannot not install IE -- that was released last summer. So I ask, why is this coming up now? The answer was given in the letter to the DOJ that Ralph Nadar's organization posted to this very list not more than one month ago. "Microsoft should not be permitted to...integrate the MSE with the operating system in ways that are unavailable to other firms." This is not the consumer public via DOJ against Microsoft, this is Netscape via DOJ against Microsoft. This is not about Windows 95 and IE 3.0, this is about Windows 98 and NT 5.0. Windows 98 and NT 5.0 have evolved the core operating system interface and functionality to be seamlessly integrated with and based upon Internet standards CIFS, LDAP, HTTP, HTML/XML, etc. This is what Netscape is attacking. There is a natural progression and market pressure to natively integrate Internet-based standards into both OS's and applications -- to legislatively prevent that is absolutely ridiculous and harmful to consumers. It would be the equivalent in my mind if the Australian maker of the Trumpet Winsocket (the most popular TCP/IP stack for Windows 3.1) had sued Microsoft for bundling TCP/IP with Windows 95/NT. All I can say about Netscape is the ability to successfully build and market software that complements or enhances another software package is dependent on a good relationship with that software vendor -- this is self-evident in the market. To self-proclaim yourself the destroyer of that vendor and then except that vendor to support you is utterly moronic -- they get what they deserve. For our mercenary government to pull out their guns in service of Netscape and force Microsoft to permit their existence is criminal. To proclaim Microsoft a monopoly and use that as justification to completely disregard reason, objectivity and rights of property, and disrupt the free market with subjective law and reason of guns is repulsive. I have trouble calling myself an American. Matt "You'd better get it straight that it's not a bunch of boy scouts you're up against -- then you'll know that this is not the age for beautiful gestures. We're after power and we mean it. Your fellows were pikers, but we know the real trick, and you'd better get wise to it. There's no way to rule innocent men. The only power any government has is the power to crack down on criminals. Well, when there aren't enough criminals, one makes them. Once declares so many things to be a crime that it becomes impossible for men to live without breaking laws. Who wants a nation of law-abiding citizens? What's there in that for anyone? But just pass the kind of laws that can neither be observed nor enforced nor objectively interpreted -- and you create a nation of law-breakers---and then you cash in on guilt. Now that's the system...that's the game, and once you understand it, you'll be easier to deal with." _Atlas Shrugged_ --- end forwarded text ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: From brian at firstgear.com Tue Oct 21 13:50:36 1997 From: brian at firstgear.com (brian at firstgear.com) Date: Tue, 21 Oct 1997 13:50:36 -0700 (PDT) Subject: YOUR LISTING ON YAHOO! Message-ID: <199610210131.VAA05690@mail.firstgear.com> engines, it is becoming more and more difficult to be found among the MILLIONS of listings. If you"re like the rest of us you have found it extremely frustrating. You spend lots of time and money developing your site and then you're listed number 30, or 80, or even 200th. You're NEVER FOUND. *************************** GOOD NEWS The good news is we have found a SOLUTION. After months of fighting the search engine battle we got LUCKY. A programmer recently became associated with our firm who had done some CONSULTING WORK for six months with one of the major search engines. With his help we developed a REPORT on the major search engines and how they really work. ***************************** REPORT His report is excellent. We have been using the material in the report for over five months. IT WORKS! With it, our sites are in the top TEN listings on all major search engines and we have experienced a virtual stampede of people to the web sites. HITS ARE UP, SALES ARE UP, and most importantly, everyone is HAPPY. *************************** YOUR COPY Now, YOU CAN HAVE A COPY of his report. In it you will find: How to vault in the TOP TEN on any search engine using any keyword. Strategies that put you ahead of 95% of the other sites online. How to STAY in that TOP TEN. How to improve your chances of being found in about 10 MINUTES. How the search engines calculate CONFIDENCE ratings (and what that means to you). Killer META TAGS that totally blow away your competitors. Which search engines are the very BEST FOR YOU. How to get your site REGISTERED for FREE at over 200 locations, in one easy step (it takes 10 minutes). How to BLOCK out part of your site from the search engines (and why you should do it). The effect of REPEATING KEY WORDS. (good or bad?) What happens when you repeat them too many times? LATEST FORMS for developing the best meta tags. Meta Tag strategies that can broaden your audience and build high volume web traffic for you. We tell you exactly what to do and show you SPECIFIC EXAMPLES. And it's SIMPLE and EASY to understand. So you can put the principles to immediate use. The benefits of site UPDATING. How often? What NOT to do! Avoid making those errors which can cost you. and even How to legally "steal" your competitor's web traffic and send it to your site. Type in your competitor's name and YOUR NAME will appear FIRST! *************************** WHAT DOES IT COST? The material is only $15, and is unconditionally guaranteed to work for you. Just follow the instructions and you will find your site in the top ten too. Ordering is SAFE and EASY. For more information, or to RECEIVE this 18 page report by email just go to our INSTANT-DELIVERY SECURE order form at: http://www.lr-publishing.com/SES2/ (Order on line and you will receive your report in JUST 60 SECONDS.) Now that your site is up shouldn't you take this MOST IMPORTANT LAST STEP so people can find it. ****************************** UNCONDITIONAL GUARANTEE Remember, we UNCONDITIONALLY GUARANTEE IT WORKS. You can't lose. ******************************** SPECIAL FREE BONUS Order within 48 hours, we and will include, AS A FREE BONUS, information on over 500 SEARCH ENGINES and directories where you can list your site for free. (Some are very specialized and targeted). SPECIAL NOTE: If you are busy and don't have time to go to our web site INSTANT-DELIVERY SECURE ORDER FORM, you can order by FAX. (The unconditional guarantee still applies!) Just fill in the FAX FORM AT THE BOTTOM OF THIS PAGE. Then FAX it to us at: 1-305-289-1884 If you order by FAX your copy of the report will be sent to you by email within 24 hrs. Or, if you prefer, you can send your order with a CHECK by snail mail to the address below. (Be sure to include your email address for delivery.) Whichever method you choose to order, YOU'LL BE GLAD YOU DID! Best of luck with your web site! Leeds Publishing 5800 Overseas Hwy., St. 35-154 Marathon Key, Fl. 33050 Fax 305-289-1884 http://www.lr-publishing.com/SES2/ ________________________________________________________________________ ________________________________________________________________________ FAX ORDER FORM (Please print clearly) FAX TO: Leeds Publishing FAX NUMBER: 1-305-289-1884 Hi: Here is my order for Search Engine Secrets at $15 only. I understand it is unconditionally guaranteed. Include my FREE BONUS of 500 search engines. Send by email ASAP. Date:__________________ NAME:_______________________________________________ E-MAIL ADDRESS:______________________________________________________________ (PLEASE be accurate. One small error and we can't send your order). CARD TYPE:_________________ CARD NUMBER:_________________________________________________ EXPIRATION DATE:______________ NAME ON CARD:________________________________________________ Thanks for ordering. Your copy of the report will be sent to you by email ASAP. ____________________________________________________________ ____________________________________________________________ Copyright 1997 Leeds and Rousseau Publishing. All rights reserved. Form 10-16 GD-Yahoo From tcmay at got.net Mon Oct 20 22:54:44 1997 From: tcmay at got.net (Tim May) Date: Tue, 21 Oct 1997 13:54:44 +0800 Subject: Your "RIGHT" to Speak to Big Brother In-Reply-To: <199710210313.WAA01353@wire.insync.net> Message-ID: At 8:13 PM -0700 10/20/97, Eric Cordian wrote: >This was made clearer when The Bitch of Waco introduced her >minion, Assistant Attorney General Joel Klein. > > "We're asking the court to order Microsoft to tell > everyone who has signed or who in the future will sign > a non- disclosure agreement, that it doesn't apply to > the government, period. We won't allow anyone to > interfere with the people's right to provide > information to their government." You left out the Really Interesting paragraph: "We're also asking loyal Americans within companies to send us the CMR secret keys. Companies have no right to keep secrets from government. We won't allow a company to have policies which prevent loyal Americans from providing information to their government." (He didn't say this, but he may as well have. What the Justice Department is arguing is that it wants spies within companies. It wants narcs. It wants people to funnel information to them.) By the way, I think the notion that the government will go to great lengths to get CMR secret keys is not far-fetched. Until PGP for Business supports a richer system of snoopware keys--and my understanding is that PGP 5.5 does _not_--then the CMR secret key of, say, Microsoft, would be a prize indeed. This is of course a security weakness of the whole CMR approach, exactly as with the key escrow database. It is a too-tempting target. Anyone within a company with access to the CMR secret key will be incentivized to sell it. I am offering $25,000 for the CMR key for Microsoft. (As a loyal American, I plan to then send it to Janet Reno and Louis Freeh.) Of course, Microsoft won't be using PGP for Business. Recall that they may have their own "software key escrow" program cooking, based on my discussion a few years ago with Tom Albertson (sp?) of Microsoft. Bill Gates has issued strongly anti-GAK statements, so maybe this is on hold. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From Michael.Johnson at mejl.com Mon Oct 20 23:52:25 1997 From: Michael.Johnson at mejl.com (Mike) Date: Tue, 21 Oct 1997 14:52:25 +0800 Subject: SMTP Encryption Extension In-Reply-To: Message-ID: <3.0.3.32.19971021082737.00928b20@localhost> Ariel Glenn wrote: >So data kept on the filesystem has to be protected and it has to be encrypted when it is sent out to the browsing (legitimate) user. But you can do that already with standard software. Just encrypt the disk with CFS and the web server with SSL. Nothing needs to be invented to solve your problem. All the popular browsers already have SSL running. Which leads to another idea, couldn't we encrypt SMTP by running it over SSL as a web server cgi? If 99% of Internet traffic is web browsing and we are trying to hide our email, then why not make the email look like web browsing? Just make your mailer try a "POST https" command before falling back to plain SMTP. The problem with including crypto in a popular Linux distribution is that all popular Linux distributions are from the USA. Maybe suse (www.suse.de) can change that... Mike. From frantz at netcom.com Tue Oct 21 00:08:56 1997 From: frantz at netcom.com (Bill Frantz) Date: Tue, 21 Oct 1997 15:08:56 +0800 Subject: CPUNK Thread from the East / (Was: The Yarrow Man Ass) /(Was: You Go Away! Bother ROUND EYE CypherPunks. Chop, chop!) / (Was:TORA! TORA! TORA!...DC) / (Was: OUBAKAYAROU!!) In-Reply-To: <199710181407.JAA02154@einstein.ssz.com> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Wow! I've, come up in the world. Someone is forging headers with my name. I bask in the social acceptance of it all. At 4:16 PM -0700 10/18/97, Bill Frantz wrote: >TluthMonglel wrote: >> WAKE UP CPUNX AMERICA! >> The Commies have infiltrated the CPUNDITS Distributed Remailer system. >> Igor's secret agenda is to translate 'Distributed' into "From each, as >> he is able...to each, according to his need." >... >> Ever try to get >> a message from the list at 4 a.m.? They are few and far between. Even >> when you create your own message and send it to the list, the CDR List >> Masters force you to share it with everyone else. >> ("Who will help me write the message, said the Little Red Hen?") > > I agree. Next thing you know, we will be receiving our messages from >the socialist CDDR list. > I put a lot of thought, time and effort into my posts, and I resent >having to share them with the lurkers who add nothing to the list. > From now on I will be sending my posts to the list only to myself. > >God Bless America >------------------------------------------------------------------------- >Bill Frantz | The Internet was designed | Periwinkle -- >Consulting >(408)356-8506 | to protect the free world | 16345 Englewood Ave. >frantz at netcom.com | from hostile governments. | Los Gatos, CA 95032, >USA -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQB1AwUBNExUqNQgMXPCzT+1AQG+sAL+Oh8mx7o+5CMASPwuMA01ieQ8JtOx1Tm2 nfclzvbkIPcx78yZbyW8RK5ROUgGiQOWyqf+ANIALzqYaIbzWMNV2lLI+Kdac96S B3eyiEW6ixDTelKq2rD055uXbbwHg9Ng =S4kv -----END PGP SIGNATURE----- From frantz at netcom.com Tue Oct 21 00:11:53 1997 From: frantz at netcom.com (Bill Frantz) Date: Tue, 21 Oct 1997 15:11:53 +0800 Subject: Interactive Programming - Self-modifying code In-Reply-To: <199710201628.LAA08124@einstein.ssz.com> Message-ID: At 5:24 PM -0700 10/20/97, phelix at vallnet.com wrote: >I would think that self modifying code would play havoc with today's >pipelined and superscalar processors (if s&m code would even work on such >beasts). Then they're those OS's that won't allow you to muck with code >space. However, I guess it will always have a place in the embedded world. All OSes have a form of self modifying code which fetches programs (as data) from disk and then executes them (as programs) in memory. They need a way to flush the data cache so the instruction cache can read it. The place where it becomes expensive in modern processors is when the processor has seen a word as an instruction, and then you want to change it and have the new value again interpreted as an instruction. The way to "legitimately" do this varies by processor. IBM mainframes detect it automagically and "do the right thing". SPARCs require a special "flush" instruction to clean out the processor I-cache/pipeline. ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz at netcom.com | nation it is today. | Los Gatos, CA 95032, USA From mskala at meares.csc.UVic.CA Tue Oct 21 00:55:37 1997 From: mskala at meares.csc.UVic.CA (mskala at meares.csc.UVic.CA) Date: Tue, 21 Oct 1997 15:55:37 +0800 Subject: SMTP Encryption Extension In-Reply-To: Message-ID: On Mon, 20 Oct 1997, Ariel Glenn wrote: > >Well, what are we really concerned about? Not Web traffic - although your > > Not at all! Most of my time is spent trying to keep 'restricted data' > from being scooped by the wrong people... from the Web. We have Well, whatever. *I'm* more concerned about email. Of course the same argument could be used to support encrypted HTTP, but there's already plenty of work being done on that and the main problems seem to be political rather than technical. From broncbusterisgay at hotmail.com Tue Oct 21 02:41:28 1997 From: broncbusterisgay at hotmail.com (Bronc Buster) Date: Tue, 21 Oct 1997 17:41:28 +0800 Subject: I am a homosexual!@#$!@#@!! Message-ID: <19971021093307.19041.qmail@hotmail.com> Hi, my name is Bronc Buster and you all know me. but what you donot know is that I AM A HOMOFAGGOT who likes lil' boys cocks and stuff. you all have to email me here cuz some body email bombed my other adress and then my new one. i also want to see pics of your cocks but please wtrie my name on your dick before you mail them to me so i know You love me. off to spank my small monkey, Bronc Buster ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com From nobody at REPLAY.COM Tue Oct 21 03:36:21 1997 From: nobody at REPLAY.COM (Anonymous) Date: Tue, 21 Oct 1997 18:36:21 +0800 Subject: French GAK Message-ID: <199710211025.MAA26531@basement.replay.com> Wall Street Journal, October 20, 1997: French Proposal For Encryption Is Worrying EC By Jennifer L. Schenker A proposed French law ensuring government access to corporate electronic communications is setting off alarm bells in the business community and on the European Commission. France, presenting the law as a liberalization of its current policy, is the only Western country that bans any domestic use of cryptography - technology that encodes data for protection against prying eyes. France also places strict controls on the export of encryption tools, a restriction imposed by certain other countries, including the U.S. The new rules, submitted to the European Commission on Thursday, allow businesses operating in France to encode their corporate secrets but require that keys to unlock the code be given to a French government-approved entity in which the majority of the capital or votes is retained by French nationals. Microsoft Corp., Netscape Communications Corp. and the Business Software Association have raised objections to the French proposal. The BSA represents major international software publishers and high-tech companies, including Novell Inc., Compaq Computer Corp., Apple Computer Inc. and Lotus, a unit of International Business Machines Corp. The proposal also requires companies selling products with embedded encryption software in France to reveal "source code" - the rough equivalent of asking Coke to reveal its secret formula. Some believe that such a key-recovery system would make it easier for competitors to gain access to a company's secrets. The BSA's European chapter is expected to release a public statement this week supporting the European Commission's decision earlier this month to reject the key-recovery approach to encryption, which is championed by both the U.S. and France. The commission, which will formally comment on the French proposal by month's end, is concerned partly because the French ownership requirements may violate internal market rules. "I do not say this is the best system. It is the least bad in trying to find a balance between national-security interests, economic interests and the protection of personal privacy," said Gen. Jean-Louis Desvegnes, chief of France's Central Service for the Security of Information Systems, a civilian agency that reports directly to the French prime minister's office. He indicated that France might be flexible on the ownership requirements. ----- From vipul at best.com Tue Oct 21 04:01:13 1997 From: vipul at best.com (Vipul Ved Prakash) Date: Tue, 21 Oct 1997 19:01:13 +0800 Subject: [news] U.S. urged to do more to fight computer threats Message-ID: <199710211604.QAA00254@fountainhead.net> *** U.S. urged to do more to fight computer threats A presidential panel is urging the government to increase its efforts to combat computer terrorism, including doubling current spending of $250 million by fiscal year 1999, the Washington Post said Tuesday. The panel said annual federal spending to prevent hackers from using computer networks to sabotage U.S. infrastructure and ensure computer safety should reach $1 billion by 2004. The President's Commission on Critical Infrastructure Protection, established a year ago after a Justice Department review of vulnerability to terrorism, delivered a classified 269-page report to the White House Monday, the Post said. For story http://www.infobeat.com/stories/cgi/story.cgi?id=5535558-766 -- Powell lingered. "How's Earth?" It was a conventional enough question and Muller gave the conventional answer, "Still spinning." -- "Reason", Asimov. ================================================================== Vipul Ved Prakash | - Electronic Security & Crypto vipul at best.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Virtual Spaces From zooko at xs4all.nl Tue Oct 21 04:29:25 1997 From: zooko at xs4all.nl (Zooko Journeyman) Date: Tue, 21 Oct 1997 19:29:25 +0800 Subject: everybody wants a piece of Microsoft's monopoly Message-ID: <199710211120.NAA06784@xs2.xs4all.nl> If you thought Microsoft and Bill Gates were bad for the evolution of our precious technology, you'll _love_ the new "Guvsoft", lead by everyone's favorite businesswoman Janet Reno. The race to see who can play "Little Mister Gates" best and earn a cut of the action is accelerating. Pundits are already taking bets on Scott "Now Selling Licenses For 100% Pure Anything-Non-Microsoft" McNealy, Steve "Competition Is Great As Long It Doesn't Actually Affect Us" Jobs, and Janet "I've Already Demonstrated My Grasp Of Tactics And Tact" Reno. I mean, _sure_ Microsoft is an oppressive monopoly, but then what the hell is the USG? Zooko From pgut001 at cs.auckland.ac.nz Tue Oct 21 05:23:51 1997 From: pgut001 at cs.auckland.ac.nz (Peter Gutmann) Date: Tue, 21 Oct 1997 20:23:51 +0800 Subject: EC refutes GAK Message-ID: <87743538523871@cs26.cs.auckland.ac.nz> [I originally posted this to the c2.net crypto list but apparently it never appeared, I've reposted it here in case anyone finds it useful] >The report also notes a new (to me, anyway) method of bypassing GAK while >maintaining full compliance with the law: > >"Users could encrypt a relatively large number of session keys in a way that >the previous key encrypts the next one, always using one or several official >escrow/recovery systems. Only the last key would be used to encrypt the >message. There's another way to foil GAK which I don't think has been mentioned before, using what is often referred to as "malicious obedience" in the military (or "you asked for it, you got it" elsewhere): Since I don't trust any cryptosystem based on mathematical principles, I encrypt all my communications using a one-time pad communicated on CDROM (700+MB if you push it). To limit the exposure of each pad, I change it once a month at a cost of ~$1 per CDR blank. If I communicate with around 100 people that's 100 x 12 x 700+MB or (rounding things up a bit) a terabyte of keying material a year. Since they use their own pads to communicate back to me, anyone wanting to intercept a years worth of traffic to/from me would need to archive 100 terabytes of keying material (I'd make sure I spread out the bits of pad I used so they couldn't just keep the useful bits and discard the rest). In any case since this will only be used for court-authorised intercepts (just keep repeating that until you believe it), everything would have to be archived without any changes so it could be used as evidence. At a cost of $100/month in CDR's this should comply with any GAK law (instant access to keys, etc), but will also do a reasonable job of overwhelming any centralised repository charged with storing the data. Of course since I don't trust the government any more than I trust those nasty cryptosystems based on mathematical principles, I'd use triple DES underneath the OTP just to be sure. Peter. From bcrosby at mncs.k12.mn.us Tue Oct 21 06:31:55 1997 From: bcrosby at mncs.k12.mn.us (Brandon Crosby) Date: Tue, 21 Oct 1997 21:31:55 +0800 Subject: everybody wants a piece of Microsoft's monopoly Message-ID: <199710211311.IAA08583@ted.mncs.k12.mn.us> > > If you thought Microsoft and Bill Gates were bad for the > evolution of our precious technology, you'll _love_ the > new "Guvsoft", lead by everyone's favorite businesswoman > Janet Reno. > > > The race to see who can play "Little Mister Gates" best > and earn a cut of the action is accelerating. Pundits > are already taking bets on Scott "Now Selling Licenses > For 100% Pure Anything-Non-Microsoft" McNealy, Steve > "Competition Is Great As Long It Doesn't Actually Affect Us" > Jobs, and Janet "I've Already Demonstrated My Grasp Of Tactics > And Tact" Reno. > > > > I mean, _sure_ Microsoft is an oppressive monopoly, but then > what the hell is the USG? > > The Dept of Justice pulled an Antitrust on Microsoft (sourced, the morning news)... $1 mil/day fine. Based on Internet Explorer. -Brandon Crosby From adrimacedo at rocketmail.com Tue Oct 21 06:32:43 1997 From: adrimacedo at rocketmail.com (adri) Date: Tue, 21 Oct 1997 21:32:43 +0800 Subject: tell me more... Message-ID: <344D14F2.3EAC@rocketmail.com> Hi! I just loved +The Plot, Thickening;, it4s great! I4m from Portugal and I4m very concerned about these kind of problems nowadays. I think we4re coming to state of apocalyptic brainstorm, I think it4s also simtomatic. Please send news because I became curious about cyberstuff. Email me to adrimacedo at rocketmail.com Thank you. From ravage at ssz.com Tue Oct 21 06:48:14 1997 From: ravage at ssz.com (Jim Choate) Date: Tue, 21 Oct 1997 21:48:14 +0800 Subject: index.html Message-ID: <199710211326.IAA10864@einstein.ssz.com> CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Tech banner IBM Active Channel for Microsoft Internet Explorer. Find out about your chance to win a computer click here for official rules and information. rule U.S. SAID VULNERABLE TO COMPUTER ATTACK cyberwarfare October 21, 1997 Web posted at: 5:02 a.m. EDT (0902 GMT) WASHINGTON (AP) -- A report concluding the nation is vulnerable to electronic warfare was delivered to the White House Monday by a presidential commission. The classified findings and recommendations of the Commission on Critical Infrastructure Protection say the danger of computer attacks that could shut down communications and power grids is real and requires early action. "Today, the right command sent over the Internet to a power generating station's control computer could be just as effective as a backpack full of explosives and the perpetrator would be harder to identify and apprehend," the panel wrote in its executive summary to the report. The report recommends stepping up research and establishing a nationwide program to educate people on the scope of the problem. It also recommends revising existing laws to ensure protection against electronic attacks through the Internet. "Law has failed to keep pace with technology. Some laws capable of promoting assurance are not as clear or effective as they could be," the panel wrote. Because revamping laws would be a "lengthy and massive undertaking," the commission offered several suggestions to jump-start the process. "We identified existing laws that could help the government take the lead and serve as a model of standards and practices for the private sector," it wrote. "We identified other areas of law that can enable infrastructure owners and operators to take precautions proportionate to the threat." P.J. Crowley, a White House spokesman, said a task force composed of representatives from several government agencies will review the report and come up with recommendations, which is likely to take the rest of the year. In addition, an advisory committee headed by former Sen. Sam Nunn, D-Ga., and former Deputy Attorney General Jamie Gorelick will work with the private sector on ways to protect against cyber attacks. At a conference on computer security two weeks ago, commission Chairman Robert T. Marsh said the ability to do serious harm over the Internet is real. "While a catastrophic cyber attack has not occurred, we have enough isolated incidents to know that the potential for disaster is real and the time to act is now," he said. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. rule Related stories: * Threat of 'techno' terrorism being explored - March 18, 1997 * Military sees high-tech future - March 8, 1997 Related sites: Note: Pages will open in a new browser window * Argonne National Laboratory Decision and Information Sciences - Presidential Commission on Critical Infrastructure Protection Survey Form * Naval Research Laboratory Information Technology Division - Clinton creates Commission on Critical Infrastructure Protection * U.S. Business Advisor - Survey -- Presidential Commission on Critical Infrastructure Protection * The Whitehouse - Executive order on Critical Infrastructure Protection External sites are not endorsed by CNN Interactive. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Watch these shows on CNN for more sci-tech stories: CNN Computer Connection | Future Watch | Science & Technology Week rule Message Boards Sound off on our message boards You said it... [INLINE] IBM Active Channel for Microsoft Internet Explorer. Find out about your chance to win a computer click here for official rules and information. rule To the top � 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you. From ichudov at Algebra.COM Tue Oct 21 07:48:26 1997 From: ichudov at Algebra.COM (Igor Chudov @ home) Date: Tue, 21 Oct 1997 22:48:26 +0800 Subject: CPUNK Thread from the East / (Was: The Yarrow Man Ass) / In-Reply-To: Message-ID: <199710211439.OAA03185@manifold.algebra.com> Everybody is invited to join CCCP -- Committee of Concerned Computer Programmers. igor ill Frantz wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > Wow! I've, come up in the world. Someone is forging headers with my name. > I bask in the social acceptance of it all. > > At 4:16 PM -0700 10/18/97, Bill Frantz wrote: > >TluthMonglel wrote: > >> WAKE UP CPUNX AMERICA! > >> The Commies have infiltrated the CPUNDITS Distributed Remailer system. > >> Igor's secret agenda is to translate 'Distributed' into "From each, as > >> he is able...to each, according to his need." > >... > >> Ever try to get > >> a message from the list at 4 a.m.? They are few and far between. Even > >> when you create your own message and send it to the list, the CDR List > >> Masters force you to share it with everyone else. > >> ("Who will help me write the message, said the Little Red Hen?") > > > > I agree. Next thing you know, we will be receiving our messages from > >the socialist CDDR list. > > I put a lot of thought, time and effort into my posts, and I resent > >having to share them with the lurkers who add nothing to the list. > > From now on I will be sending my posts to the list only to myself. > > > >God Bless America > >------------------------------------------------------------------------- > >Bill Frantz | The Internet was designed | Periwinkle -- > >Consulting > >(408)356-8506 | to protect the free world | 16345 Englewood Ave. > >frantz at netcom.com | from hostile governments. | Los Gatos, CA 95032, > >USA > > > > -----BEGIN PGP SIGNATURE----- > Version: PGP for Personal Privacy 5.0 > Charset: noconv > > iQB1AwUBNExUqNQgMXPCzT+1AQG+sAL+Oh8mx7o+5CMASPwuMA01ieQ8JtOx1Tm2 > nfclzvbkIPcx78yZbyW8RK5ROUgGiQOWyqf+ANIALzqYaIbzWMNV2lLI+Kdac96S > B3eyiEW6ixDTelKq2rD055uXbbwHg9Ng > =S4kv > -----END PGP SIGNATURE----- > - Igor. From frissell at panix.com Tue Oct 21 07:49:58 1997 From: frissell at panix.com (Duncan Frissell) Date: Tue, 21 Oct 1997 22:49:58 +0800 Subject: everybody wants a piece of Microsoft's monopoly In-Reply-To: <199710211120.NAA06784@xs2.xs4all.nl> Message-ID: <3.0.2.32.19971021102457.035d2f8c@panix.com> At 01:20 PM 10/21/97 +0200, Zooko Journeyman wrote: > >I mean, _sure_ Microsoft is an oppressive monopoly, but then >what the hell is the USG? > > >Zooko True enough. In addition, look at the business press in the last few days for stories on other "Monopolies" of the past. IBM is suing someone for dissing their stock value. AT&T can't figure out how to pick a new CEO or figure out what to do with their business once they get one. ITT arranged a friendly sale of its hotels to avoid a Hilton hostile takeower. Harold Geneen's "Conglomerate" (remember that word?) now consists of a company whose sole business is the publication of foreign telephone directories. Remember when economic experts said that AT&T, IBM, ITT, GM, etc. were too big and powerful to ever be defeated. That Capitalism was over. DCF ---- The Maid Marion - "You speak treason!" Sir Robin of Locksley - "Fluently!" -- From the politically incorrect movie version From nobody at REPLAY.COM Tue Oct 21 07:58:22 1997 From: nobody at REPLAY.COM (Anonymous) Date: Tue, 21 Oct 1997 22:58:22 +0800 Subject: Dark is faster than Light Message-ID: <199710211444.QAA23779@basement.replay.com> Bell Labs Proves Existence of Dark Suckers For years it has been believed that electric bulbs emitted light. However, recent information from Bell Labs has proven otherwise. Electric bulbs don't emit light, they suck dark. Thus they now call these bulbs dark suckers. The dark sucker theory, according to a Bell Labs spokesperson, proves the existence of dark, that dark has mass heavier than that of light, and that dark is faster than light. The basis of the dark sucker theory is that electric bulbs suck dark. Take for example, the dark suckers in the room where you are. There is less dark right next to them than there is elsewhere. The larger the dark sucker, the greater its capacity to suck dark. Dark suckers in a parking lot have a much greater capacity than the ones in this room. As with all things, dark suckers don't last forever. Once they are full of dark, they can no longer suck. This is proven by the black spot on a full dark sucker. A candle is a primitive dark sucker. A new candle has a white wick. You will notice that after the first use, the wick turns black, representing all the dark which has been sucked into it. If you hold a pencil next to the wick of an operating candle, the tip will turn black because it got in the path of the dark flowing into the candle. Unfortunately, these primitive dark suckers have a very limited range. There are also portable dark suckers. The bulbs in these can't handle all of the dark by themselves, and must be aided by a dark storage unit. When the dark storage unit is full, it must be either emptied or replaced before the portable dark sucker can operate again. Dark has mass. When dark goes into a dark sucker, friction from this mass generates heat. Thus it is not wise to touch an operating dark sucker. Candles present a special problem, as the dark must travel in the solid wick instead of through glass. This generates a great amount of heat. Thus it can be very dangerous to touch an operating candle. Dark is also heavier than light. If you swim deeper and deeper, you notice it gets slowly darker and darker. When you reach a depth of approximately fifty feet, you are in total darkness. This is because the heavier dark sinks to the bottom of the lake and the lighter light floats to the top. The immense power of dark can be utilized to mans advantage. We can collect the dark that has settled to the bottom of lakes and push it through turbines, which generate electricity and help push it to the ocean where it may be safely stored. Prior to turbines, it was much more difficult to get dark from the rivers and lakes to the ocean. The Indians recognized this problem, and tried to solve it. When on a river in a canoe travelling in the same direction as the flow of the dark, they paddled slowly, so as not to stop the flow of dark, but when they traveled against the flow of dark, they paddled quickly so as to help push the dark along its way. Finally, we must prove that dark is faster than light. If you were to stand in an illuminated room in front of a closed, dark closet, then slowly open the closet door, you would see the light slowly enter the closet, but since the dark is so fast, you would not be able to see the dark leave the closet. In conclusion, Bell Labs stated that dark suckers make all our lives much easier. So the next time you look at an electric bulb remember that it is indeed a dark sucker. From whgiii at invweb.net Tue Oct 21 08:37:48 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Tue, 21 Oct 1997 23:37:48 +0800 Subject: everybody wants a piece of Microsoft's monopoly In-Reply-To: <3.0.2.32.19971021102457.035d2f8c@panix.com> Message-ID: <199710211524.LAA31327@users.invweb.net> In <3.0.2.32.19971021102457.035d2f8c at panix.com>, on 10/21/97 at 10, Duncan Frissell said: >At 01:20 PM 10/21/97 +0200, Zooko Journeyman wrote: >> >>I mean, _sure_ Microsoft is an oppressive monopoly, but then >>what the hell is the USG? >> >> >>Zooko >True enough. In addition, look at the business press in the last few >days for stories on other "Monopolies" of the past. IBM is suing someone >for dissing their stock value. AT&T can't figure out how to pick a new >CEO or figure out what to do with their business once they get one. ITT >arranged a friendly sale of its hotels to avoid a Hilton hostile >takeower. Harold Geneen's "Conglomerate" (remember that word?) now >consists of a company whose sole business is the publication of foreign >telephone directories. >Remember when economic experts said that AT&T, IBM, ITT, GM, etc. were >too big and powerful to ever be defeated. That Capitalism was over. This is just another shakedown. I would imagine that the Gore/2000 slush fund is getting low or perhapse the Clinton Defence Fund. -- --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html --------------------------------------------------------------- From nobody at REPLAY.COM Tue Oct 21 08:42:35 1997 From: nobody at REPLAY.COM (Anonymous) Date: Tue, 21 Oct 1997 23:42:35 +0800 Subject: Cypherpunks Related (?) or merely about DC in general? Message-ID: <199710211532.RAA28678@basement.replay.com> Q. How did Sir Alexander Fleming change Spain's bullfighting? A. Before he invented penicillin, countless toreros died of infected wounds. After, even the smallest arenas were equipped with penicillin syringes. And the performances became much more exhilarating. Said one cape artist: "Now I can stand closer to the bull." http://www.LMBoyd.com/postscript.htm From ericm at lne.com Tue Oct 21 08:49:10 1997 From: ericm at lne.com (Eric Murray) Date: Tue, 21 Oct 1997 23:49:10 +0800 Subject: SMTP Encryption Extension In-Reply-To: <3.0.3.32.19971021082737.00928b20@localhost> Message-ID: <199710211535.IAA01241@slack.lne.com> Mike writes: > > Ariel Glenn wrote: > >So data kept on the filesystem has to be protected and it has to be > encrypted when it is sent out to the browsing (legitimate) user. > > But you can do that already with standard software. Just encrypt the disk > with CFS and the web server with SSL. Nothing needs to be invented to solve > your problem. All the popular browsers already have SSL running. > > Which leads to another idea, couldn't we encrypt SMTP by running it over > SSL as a web server cgi? If 99% of Internet traffic is web browsing and we > are trying to hide our email, then why not make the email look like web > browsing? You don't need to run it through a CGI. There's a port defined for SMTP-over-SSL: ssmtp 465/tcp ssmtp (from the IANA assigned port numbers document of feb '97) The problem with SSL is that it only protects the pipe, not the mail that's being transported. Mail is a store-and-forward scheme. It's stored on the local disk and forwarded to the next hop. Often that's not the recipient, but is a mail exchange or a firewall gateway. Then the MX or firewall forwards the mail on to the next hop, etc. (note that a CFS partition, in order to be used by a mail transport, would need to be mounted at all times, and therefore would be available to an attacker who gained root on the mail transport host) If your mail goes to an intermediate MX site, it'll sit in the clear on the disk there until its sent to its final destination. Even if all mailers supported ssmtp, the mail would not be secure. Email really needs to be individually encrypted instead of using encrypted pipes. If you want to protect all email (an excellent idea), build a mail transport which automatically encrypts each outgoing mail in the key of the recipient (or recipients's mail transport). It's not that hard to do, I build a 'pgpsendmail' for a former employer. Most of the effort was in figuring out where in sendmail to put the hooks to pgp. -- Eric Murray Chief Security Scientist N*Able Technologies www.nabletech.com (email: ericm at lne.com or nabletech.com) PGP keyid:E03F65E5 From FisherM at exch1.indy.tce.com Tue Oct 21 10:52:21 1997 From: FisherM at exch1.indy.tce.com (Fisher Mark) Date: Wed, 22 Oct 1997 01:52:21 +0800 Subject: PGP, CMR, and OpenPGP Message-ID: <2328C77FF9F2D011AE970000F84104A74933C1@indyexch_fddi.indy.tce.com> As a Corporate Security Officer, I personally would prefer a solution like Adam Back's CDR that leaves the copy of the corporate data on the user's hard drive to the current PGP CMR. As long as the email data didn't need to be encrypted during local storage (i.e. encrypted against the possibility of industrial espionage), I wouldn't care whether the copy of the corporate data was encrypted -- actually it would be a lot easier to leave it in plain text (as I think Tim May suggested). (A single file in Unix mail(1) file format would make a nice auditing/reporting tool, so you could remember what you had sent to whom all in one place.) Corporate keys as in PGP CMR just means another key to manage that provides a single point of weakness in the company's security architecture. Without forcing everyone to run on a secure OS on hardware they can't directly access (i.e. no desktop computers), any additional security provided by a CMR system (as in providing unalterable records of encrypted email that was sent) can be easily bypassed. OpenPGP, meanwhile, should work on non-GAK/CAK solutions, while PGP Inc. should come up with a new product name (like 'BizSecure' only less whimsical) for its line of corporate encryption programs. (It might even be better business for PGP to set up a wholly-owned subsidiary, whose name does not even incorporate the term 'PGP' or its derivatives, for marketing such products, as those products would not be tainted by personal privacy reputation of the name 'PGP'.) 'BizSecure' and its kindred would then interoperate with OpenPGP standards only to the extent of the common non-GAK/CAK functionality of the two systems. ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm at indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'" From FisherM at exch1.indy.tce.com Tue Oct 21 11:01:52 1997 From: FisherM at exch1.indy.tce.com (Fisher Mark) Date: Wed, 22 Oct 1997 02:01:52 +0800 Subject: Remailers and ecash (fwd) Message-ID: <2328C77FF9F2D011AE970000F84104A74933C2@indyexch_fddi.indy.tce.com> Picking up a thread of a few weeks ago (sometimes life intervenes)... What I propose is: employee -> encryptor -> email -> remailer -> delivermail -> recipient -> decrypt which forces the opponent to both monitor traffic much more closely (to get around the traffic analysis-resistance of remailers) and to decrypt the actual messages. The point being to force the opponent to employ other, less safe (more chance of discovery) techniques, like bribing your employees or sending in agents as employees of the cleaning company, etc., etc. This use of remailers I think could be worth money to corporations. Unless you are a truly huge corporation, you are not going to be in a position to set up private email links with everyone you need a private email link to. Using the Internet, while deploying security measures appropriate to the application, is just too cost-effective. My proposal is just that using encryption and remailers together gives you more security than either technique will alone, perhaps enough that commercial remailers could flourish. ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm at indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'" From aba at dcs.ex.ac.uk Tue Oct 21 11:13:51 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Wed, 22 Oct 1997 02:13:51 +0800 Subject: the migration path (was Re: Your "RIGHT" to Speak to Big Brother) In-Reply-To: Message-ID: <199702211603.QAA02220@server.test.net> Tim May writes: > "We're also asking loyal Americans within companies to send us the CMR > secret keys. Companies have no right to keep secrets from government. We > won't allow a company to have policies which prevent loyal Americans from > providing information to their government." > > By the way, I think the notion that the government will go to great lengths > to get CMR secret keys is not far-fetched. Until PGP for Business supports > a richer system of snoopware keys--and my understanding is that PGP 5.5 > does _not_--then the CMR secret key of, say, Microsoft, would be a prize > indeed. I think the CMR public key extension is not limited to one CMR extra recipient per key. Closely following discussions on ietf-open-pgp, and the notes Bill Stewart kindly posted to this list (taken from the description PGP Inc gave at a meeting in the US) it sounded to me that there is a migration path like this: pgp5.0: accepts keys with multiple CMR key requests attached but doesn't honour CMR requests (? I hope!), and can't generate keys with CMR requests pgp5.5: generates keys with single CMR requests, can accept and handle keys with multiple CMR requests pgp6.x: will generate keys with multiple CMR requests (and of course honour them too) This suggests that the yet to be released pgp6.x (or whatever version number is chosen) will be able to cater to such government demands merely by the company generating their keys with two CMR requests: recovery at acme.com thoughtpolice at nsa.gov The NSA can publish their public key on http://www.nsa.gov/ tomorrow, and the law by presidential decree the day after. This is the balanced Sword of Damocles over privacy for real now: this is the switch waiting to be flicked. This is why I am upset with PGP Inc for using the CMR approach. It is not CMR per se as a neutral mechanism, but it is the approach of building tools which allow third party access, or "recovery" of communications traffic which has enabled all of this. This despite their stated corporate user requirement being storage recovery. > This is of course a security weakness of the whole CMR approach, exactly as > with the key escrow database. It is a too-tempting target. Anyone within a > company with access to the CMR secret key will be incentivized to sell it. I agree, it is a centralised security risk. PGP Inc are talking about adding secret splitting perhaps, but still it is a security risk. The whole technique of sending recovery information over the wire is a security risk. Recovery information if there is any should be kept on local disks and thereby be protected by the companies normal physical security in the same way that papers in filing cabinets are. This is the status quo. (Well actually no encryption at all locally is largely the status quo, but pgp5.0 (and I presume pgp5.5) is also able to encrypt files, and PGP Inc argues more reasonably that their corporate clients have a requirement of being able to recover stored encrypted files also). Regardless it is trivial to have local storage recovery without sending recovery information over the wire. I'll be posting (web and list) a security analysis of CMR vs CDR presently; I think CMR loses badly from even a purely security oriented standpoint. (I have made my feelings about the political demerits of CMR as a storage recovery mechanism known already). > Of course, Microsoft won't be using PGP for Business. Recall that they may > have their own "software key escrow" program cooking, based on my > discussion a few years ago with Tom Albertson (sp?) of Microsoft. Bill > Gates has issued strongly anti-GAK statements, so maybe this is on hold. Perhaps this is what they are busy building at their top-sikrit crypto software development/research center at Cambridge, UK under the guidance of new head of research cryptographer Roger Needham. Looks like an export embargo end-run by Bill Gates. Maybe Bill Gates is a cypherpunk after all, well we can live in hope, anyway. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199702211611.QAA02229@server.test.net> Peter Gutmann writes: > [multiple terabyte CDrom based keying material] Reckon they'll twig, and charge you per megabyte to offer you the "service" of allowing them to "recover" your communications in real time. At the same time they'll sell the package as "helping businesses to recover data stored on disks". (I never did quite work out how this government mandated and managed "communications key recovery service" helps you recover stuff stored on your disk encrypted with storage keys you haven't given them (you don't give them your real keys do you?)). Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: * Fisher Mark wrote: >OpenPGP, meanwhile, should work on non-GAK/CAK solutions, while PGP Inc. Done. Read ftp://ftp.iks-jena.de/pub/mitarb/lutz/crypt/software/pgp/ draft-ietf-pgp-formats.current.txt From pgut001 at cs.auckland.ac.nz Tue Oct 21 11:45:42 1997 From: pgut001 at cs.auckland.ac.nz (Peter Gutmann) Date: Wed, 22 Oct 1997 02:45:42 +0800 Subject: GAK "service" charges (Re: EC refutes GAK) Message-ID: <87745892226677@cs26.cs.auckland.ac.nz> Adam Back writes: >Peter Gutmann writes: >>[multiple terabyte CDrom based keying material] >Reckon they'll twig, and charge you per megabyte to offer you the "service" >of allowing them to "recover" your communications in real time. Yes, but how will they phrase the requirements? A CD is a single key (in fact 1,000 CD's are all part of a single key)... this leads to the same problem I heard of here a few years ago w.r.t. outlawing gangs: "It would be impossible to word any comprehensive anti-gang legislation in a manner which didn't also outlaw the police". The same goes for certain aspects of escrowing, any escrow rules which are in any way practical and useable will also be open to all sorts of creative interpretation ("You must deposit a copy of your encryption key with the government" -> "Here's the key. Where can I park the forklift that moves the container of CD's?"). Peter. From tcmay at got.net Tue Oct 21 12:30:17 1997 From: tcmay at got.net (Tim May) Date: Wed, 22 Oct 1997 03:30:17 +0800 Subject: GAK "service" charges (Re: EC refutes GAK) In-Reply-To: <87745892226677@cs26.cs.auckland.ac.nz> Message-ID: At 12:35 AM -0700 10/22/97, Peter Gutmann wrote: >Adam Back writes: >>Peter Gutmann writes: >>>[multiple terabyte CDrom based keying material] >>Reckon they'll twig, and charge you per megabyte to offer you the "service" >>of allowing them to "recover" your communications in real time. > >Yes, but how will they phrase the requirements? A CD is a single key (in >fact >1,000 CD's are all part of a single key)... this leads to the same problem I >heard of here a few years ago w.r.t. outlawing gangs: "It would be impossible >to word any comprehensive anti-gang legislation in a manner which didn't also >outlaw the police". The same goes for certain aspects of escrowing, any >escrow rules which are in any way practical and useable will also be open to >all sorts of creative interpretation ("You must deposit a copy of your >encryption key with the government" -> "Here's the key. Where can I park the >forklift that moves the container of CD's?"). I fully agree with Adam that GAK/GMR will not be free. (This is, in fact, one of my biggest objections to GAK/GMR, that it interferes with the transient and frequent generation of keys for varied purposes.) Nothing involving the government is free. TANSTAAFL--there ain't no such thing as a free license. As to "how will they phrase the requirements?," they'll do it as they do it so many areas. The _form_ of the allowable crypto will be specified...the GAK/GMR requirement is a lot more than just a nebulous statement that "real-time access to keys must be possible." (Else one could say, "Hey, but my keys _are_ available on a real-time basis...provided you guys know how to dock with the satellite up in orbit that carries them--yuk yuk yuk.") Parallels exist in many areas. A tax form must be filled out in certain ways, a building permit must conform to certain specifications, and various licenses are in certain required forms. A fee, probably on the order of $50/year, with the usual subsidies for poor people, etc., will stop the "flooding attacks" (which Peter's is a variant of). Limits on the sizes of the keys will fall out of the actual form GAK/GMR must take. I expect GAK will require something like a driver's license, a gun license, or fishing license. A form to be filled out, a fee to be paid, and spot checks to ensure compliance (as when a Fish and Game boat pulls alongside to do a random check of one's catch--note that no search warrant is needed, at least not in the U.S.). Whether random checks of e-mail will be admissable under the U.S. First Amendment, and Fourth, is debatable...this will likely be a core part of the court challenges to GAK/GMR when it is put into law. Whereas there is at least some slight amount of plausibility to the claim that "driving is a privilege, not a right," which is the justification for otherwise-intrusive inspections of automobiles on the roads, there is no such plausible argument for saying speech is a privilege and not a right. Not so long as the First Amendment remains in effect. (Notwithstanding various chippings-away of it.) The situation in Australia, New Zealand, Europe, Asia, etc. is probably different. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From harka at nycmetro.com Tue Oct 21 13:43:06 1997 From: harka at nycmetro.com (harka at nycmetro.com) Date: Wed, 22 Oct 1997 04:43:06 +0800 Subject: SMTP Encryption Exten Message-ID: <199710212104.QAA11860@einstein.ssz.com> -----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:ericm at lne.com to Harka <=- In> If your mail goes to an intermediate MX site, it'll sit in the In> clear on the disk there until its sent to its final In> destination. Even if all mailers supported ssmtp, the mail In> would not be secure. True, but an encrypted tunnel to fetch your e-mail will at least render wiretaps on your phone-line useless. While that doesn't really matter if all your e-mail is PGP-encrypted, the truth is that a lot of e-mail is still in the clear. That at least would be protected to a degree... Btw., does anybody know if there's an crypto-enhanced direct-dial-up program such as minicom out there? Ciao Harka ... "Use a Cipher - Be Free!" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBNE0TyjltEBIEF0MBAQEsawf/SyzCJ5vHC9gvn9aX4Efuxt9rNe6UqXoh 78ZpKba5X0QvkvPyG+4TAopLZUXL5Qjs5TKQmEhBcCnw4+bHv36T4nzaDPNKsD39 RFtCddWgpF1pIUQ7GIdY/mMTh5UGMibXgqU9Z1kZKP0j8pJJPn4aK1uSas+Yne69 /OdDX3PBBgbw66DxOqjdE6+pC0v5LS1janXUuEMXo8nV1MfpBnStI9ORAcyNeCtu H8KlnQcLwUhuEnTn/VeEwRZJIFPf3hUFcuxVdcooHgqDbY9d+zbSsFiqVE3EyMji bSiBTMK9N/jQ7VFllhkqLihJbA/Q27KP4M6hV4NMqDdh3Sfv6Bd7iw== =jbpL -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption... From declan at well.com Tue Oct 21 14:33:37 1997 From: declan at well.com (Declan McCullagh) Date: Wed, 22 Oct 1997 05:33:37 +0800 Subject: Bill Gates, the Bully Savior, from The Netly News Message-ID: ***************** http://cgi.pathfinder.com/netly/opinion/0,1042,1517,00.html The Netly News Network (http://netlynews.com/) October 21, 1997 Bill Gates, the Bully Savior by Declan McCullagh (declan at well.com) When the Justice Department yesterday accused Microsoft of using its operating system near-monopoly to violate the law, the government did more than attack the world's largest software company. It also handed Microsoft's chief competitor, Netscape, a major business -- and political -- victory. Netscape has long been urging the Clinton administration to rein in Bill Gates. For years its lobbyists have bent the ears of powerful Washington policymakers. And, unlike many other Silicon Valley chiefs, Netscape's Jim Barksdale -- a veteran of such highly regulated companies as Federal Express and McCaw Cellular -- appears to truly understand how Washington works. So was Janet Reno motivated by politics, or law? "Fundamentally, I think it's a legal issue," says Ed Black, president of the Computer and Communications Industry Association. "But to say whenever the wealthiest man in America and one of the most powerful companies in America is challenged by a cabinet official, you can't say there's no political impact. You're in a political world at that level." When asked to name the most pressing issues Netscape faces in Washington, company lobbyists rattle off a long list of topics from encryption to copyright and education. But antitrust has always topped the list. This, after all, is the company's primary policy goal: to stop what it considers to be Microsoft's predatory practices. "This is not a Netscape-Microsoft issue," says Netscape's public policy counsel Peter Harter. "This is not a browser war. This is about obeying the law." Perhaps. But clearly Netscape has been complaining to the government about Internet Explorer since the Microsoft browser first hit the Net. Naturally, the company cheered Janet Reno's suggestion that Microsoft be punished with a fine of up to $1 million a day. "We're very supportive of the actions the Department of Justice has taken," Roberta Katz, Netscape's chief counsel, told the Netly News last night. "This lawsuit is about preserving competition as we move to the era of digital commerce." It is, of course, also an efficient way for Netscape to protect its commanding share of the browser market. "Bill Gates is a successful rival who makes it difficult for others to do business. Rather than compete against him head to head in the market, competitors turn to antitrust laws," says Don Boudreaux, a professor of law and economics at Clemson University. "What people at Netscape probably don't like is the fact that Internet Explorer is a good product." Netscape has slowly been emerging as the grand marshal in the Everyone But Microsoft parade. Last year Netscape hired the heavyweight Silicon Valley law firm of Wilson, Sonsini, Goodrich & Rosati, whose partner Gary Reback is a veteran anti-Microsoft campaigner. In November 1994 Reback prepared -- after a request from the Department of Justice, which was investigating Microsoft -- a 100-page white paper on behalf of three anonymous high tech clients. The theme: Microsoft's apparent anticompetitive behavior. [...] ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ From aba at dcs.ex.ac.uk Tue Oct 21 15:06:55 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Wed, 22 Oct 1997 06:06:55 +0800 Subject: CDR design document Message-ID: <199702212255.WAA01213@server.test.net> Here is a proposal for consideration for inclusion in the OpenPGP standard: http://www.dcs.ex.ac.uk/~aba/cdr/ (Also attached text version below [1]) It describes a mechanism for commercial data recovery which attempts to minimise the security risks inherent in allowing disaster recovery of stored encrypted documents. The CDR design also avoids the security risks in building systems which send recovery information over open communications networks, as the CMR proposal currently does. The CDR design offers the option of more ergonomic recovery from forgotten passphrase. CDR allows for more secure use to be made of the existing pgp5.0 key expiry functionality when applied to communications-only keys because they can be deleted with out loss of data-availability, providing a form of PFS which is backwards compatible with pgp5.0 and pgp5.5 clients. Comments? The only change addition to the standard required is to create a distinction between a storage only key and a communications only key. This distinction could be made via the use of an extra flag, ideally so that keyrings can remain standardised and interchangeable between different implementations. The document can also be viewed as a recommendation to implementors of how to avoid security risks (and related government abuse risks) in implementing data recovery systems. I would like to see the OpenPGP standard accomodate both the CMR and CDR design so that each can fly on it's technical merits. (And political merits, cryptography being a highly political field, a politically unpopular design may suffer for other than technical reasons). Adam [1] http://www.dcs.ex.ac.uk/~aba/cdr/ ==============================8<============================== Commercial Data Recovery This document describes a mechanism, Commercial Data Recovery (CDR), to allow companies to recover stored encrypted information as part of a disaster recovery plan. Introduction This document is centered around the OpenPGP standard, and therefore explores first what is possible within the existing standard. Several of the CDR variants presented can be achieved entirely within the pgp5.0 standard without adding any new functionality. Commercial disaster recovery requirement PGP is commonly used for two purposes: file encryption, and encryption of email communications. The situation arises in a commercial setting that individuals are protecting information which the company would like to be able to recover in the event of disaster: in the event of the user forgetting his passphrase, or in the event of the unexpected death of the employee. Stored files which the company may require the ability to recover include encrypted files stored in the files system, on backup tapes, or on floppy disks; and encrypted sent and recieved emails stored in mail client folders. Security vs Availability There is a security risk in adding data recovery mechanisms: the additional risk that recovery procedure is used by other than the owners of the data to recover plaintext. A central goal of the CDR design described in this document is to minimise this security risk. Keys used to encrypt email which is transmitted over the Internet are more valuable to an attacker than keys used to encrypt stored files because of the relative ease with which an attacker can obtain copies of emailed ciphertext. Stored encrypted files in contrast are protected by all the physical security systems the company is relying on to protect it's paper files, plaintext data stored on disks, and backup tapes. For this reason the CDR approach treats communications keys as more sensitive than keys used to encrypt locally stored information. Separate Signature and Encryption Keys added in pgp5.0 This section describes a feature added to PGP with the pgp5.0 release: separate signature and encryption keys. Readers familiar with pgp5.0 functionality may like to skip this section. pgp2.x RSA keys pgp2.x (and pgp1.x) only had direct support for one type of public key: the RSA public key. RSA public keys were used both as signature keys, and as encryption keys to transfer session keys. The ability to generate RSA keys, and to interoperate with pgp2.x is retained in pgp5.x. pgp5.x El Gamal (DH) encryption and DSA signature keys One reason for the introduction of separate key functionalities is the addition, starting with pgp5.0, of the DSA digital signature algorithm which can only function as a signature system. In addition the El Gamal (EG) public key system which was also added with pgp5.0 is used only as a public key encryption system. (There are some El Gamal variants which can be used to produce digital signatures, but these are not used in pgp5.0). (El Gamal is a Diffie-Hellman (DH) variant which is sometimes also referred to confusingly as DH.) The DSA is itself a DH signature variant. Patent issues Another significant reason for the adoption of EG and DSA in particular is the freedom from patent encumbrances these algorithms now enjoy. RSA by contrast is patented, and unpatented algorithms are generally preferred for internet standards. Key expiry feature added in pgp5.0 One general security principle is that keys used to protect communications should be replaced periodically to reduce the value to an attacker of an individual key. Migration path The pgp5.0 standard provides support for this functionality in terms of the ability to attach expiry dates to signature and encryption keys. (In the pgp5.0 and pgp5.5 clients the signature and encryption keys are treated as a pair, and are given the same expiry information, but both the pgp5.0 and pgp5.5 clients can already cope with signature-only keys and encryption-only keys with different expiry information.) Web of Trust In pgp5.0 with the EG public keys, the Web of Trust (WoT) is based on the signature keys only. The users signature key is authenticated in the web of trust. The user signs his own encryption key thereby transferring trust to it. This ensures that encryption keys can be expired and replaced without affecting the web of trust. Limited Perfect Forward Secrecy Perfect Forward Secrecy (PFS) refers the technique of destroying old communications keys to ensure that past traffic can not be compromised after the point of re-keying. One way to use the pgp5.0 key expiry facilities is to have signature and encryption keys with very different expiry periods. For example a signature key could be given no expiry period (the pgp5.0 standard supports expiry periods of `forever'), and encryption keys could be given an expiry period of 6 months. To obtain PFS, a more secure way of dealing with expired encryption keys is to actually irretrievably delete them. This then simulates PFS: an attacker is unable to decrypt traffic encrypted with old communications keys even if he is able to coerce co-operation from the recipient. No one can be coerced because the key has been deleted. It seems reasonable that some users may want to use key expiry for this purpose, and this does not require any modifications to the existing pgp5.0 standard. Key expiry problems for stored encrypted data One problem introduced by key expiry is that any stored data encrypted to the expired key becomes less available. For security reasons the expired key should ideally be deleted, and in this case access to the data is lost. Alternatives are to attempt to store the old keys more securely, this then presents the problem that some stored data is harder to access than other data, and presents additional key management problems for old keys which will be confusing for users. Re-encrypting after key expiry One method to solve this problem is to re-encrypt all of the encrypted files at the point of re-keying. However this method has disadvantages in that not all of the encrypted data may be easily available. Some of the encrypted data may be on backup tapes, on floppy disks, or stored inside `zip' or `tar' archives on the disk and hence may be missed. Separate storage keys The simplest solution to this problem seems to be to encrypt to a separate storage key. Within the pgp5.0 standard this storage key would be a separate El Gamal key with a long expiry date. With this system we then have three types of keys: signature-only keys, communications-only keys and storage-only keys. This could require minimal or even no modifications to the pgp5.0 standard, storage and encryption keys could be differentiated between by: * location storage-only key is stored in (for example a separate keyring) * application being configured to use a chosen encryption key as the storage-only key by giving a keyID * convention on expiry dates (expiry date `forever' could be storage key, other values could be communications keys) * extra flag to indicate a storage-only key Once the separation of key types is made, the security benefits of re-keying can be more fully obtained. Sent and recieved email folders To maintain availability after re-keying of encrypted sent and received emails archived in mail folders, the email plaintext would be encrypted with the storage-only key. This then means that data availability for encrypted files on disk, floppy disk, and backup tape is maintained; and that availability for archived sent and received emails is maintained. Storage Recovery If the system is being used in a commercial setting, disaster recovery can be provided by storing recovery information to allow recovery of the storage-only key. There is still some additional danger over the case where there is no recovery procedure: the risk that an attacker may be able to compromise the recovery information. However because the encrypted data is all protected by the companies existing physical security mechanisms the security risk is minimised. Another form of storage recovery would be to include recovery information with each file, and this would be a valid combination achieved by placing CMR-style requests for additional crypto-recipients on the CDR storage-only key. However this practice makes recovery from forgotten passphrase more problematic: to restore user access to the data after forgotten passphrase, the recovery agent would have to decrypt all stored files (be they on hard disk, backup tape, floppy disk, or stored inside `zip' or other archives), then the user would have to generate a new storage-only key, and re-encrypt all of the files. Given the frequency with which users are prone to forgetting passphrases implementors may decide to avoid this option for ergonomics reasons. CDR vs CMR PGP Inc has an alternative data recovery proposal called Commercial Message Recovery (CMR). The CMR proposal involves sending recovery information with the message in the form of a second crypto recipient. In addition mechanisms are provided in the form of a proposed CMR public key extension to the IETF OpenPGP standard which indicates a request to the sender to include this recovery information. In addition facilities are provided in the form of PGP Inc's SMTP policy enforcer to partially enforce the inclusion of this recovery information by bouncing mail which does not include it. Security comparison PGP Inc's CMR proposal makes re-keying problematic because data is archived in email folders still encrypted to the encryption key. This tends to encourage the practice of having very long term communication encryption keys. Indeed the beta pgp5.0 implementation the author tried makes the recommendation that most users would give keys an expiry period of `forever'. In addition a security risk with the CMR proposal is that an attacker is able to obtain via coercion, bribery or burglary the CMR key used to encrypt the traffic for this key. With a purloined CMR recovery key, and given the long life time encouraged for such keys the previously passive attacker may be able to recover years worth of old traffic. Another risk is that companies may for simplicity have only one CMR key, thereby putting at risk the entire companies secured communications over periods of years. This is naturally a bad practice, and one which is discouraged by PGP Inc also, but the author remains cynically confident that some corporate users will ignore such advice. Privacy Comparison PGP Inc proposese the CMR communications recovery mechanism as a privacy respecting method of achieving data recovery. The privacy features of the CMR proposal are that there are proposed flags which are attached to a public key to indicate statement of intent about plaintext handling to the sender who is about to use the public key. Three statements of intent are possible with the current CMR proposal: * personal key (no flags set) * company use key, company may read message, please encrypt to listed company CMR recovery key(s) (recovery flag set) * company may read message, encrypt to listed CMR recovery key(s) or the message will be bounced (strict recovery flag set) PGP Inc's statement of intent in plaintext handling is a useful concept, in that it explains explicitly to the sender who will be able to read the message, and how the plaintext will be handled. Statement of intents are always advisory, in that they are impossible to enforce; however they are useful in encouraging ethical behaviour in this regard. Statement of intent messages are independent of recovery mechanism, and apply equally to the CDR mechanism described in this document. In fact the author would like to encourage a fuller set of statement of intent flags for both sender and recipient, allowing keys to be marked with intents: * personal key, messages not archived * personal key, messages archived * key used for company business, messages not archived * key used for company business, messages archived * key used for company business, messages archived and recoverable And, in addition a similar privacy argument could be made to allow the sender to express his preferences with regard to plaintext handling on a per message basis. This could generalise the -m function of pgp2.x which instructs the recipient not to save to a file. (The -m flag is the sort of electronic version of `please burn this document after reading', this flag is mildly enforced by the pgp2.x command line application). These set of flags would allow a sender to send a `normal communication message', or a `official statement, please archive with recovery if available', or `sensitive do not archive' and so on. A privacy respecting implementation could provide support for these functionalities. Whilst obviously easy to over-ride, this is felt to be a useful exercise in encouraging respect for privacy. In addition the recipient should have ability where company policy allows to choose which messages to archive, and which to archive with company recovery information. >From a privacy perspective the CDR and CMR proposals are approximately equivalent; the statement of intent flags, and the social value of encouraging companies to respect privacy are useful in both. Government access to communication key politics Another aspect of the whole data recovery area is that the US government, French government, and UK government (as well as other governments) have expressed an unhealthy interest in obtaining private individuals, and companies communications keys. Many privacy advocates view this development with fear, as it seems to many a particularly Orwellian development. Usually the Government Access to Communication Key (GACK) attempts try to deflect criticism by focussing on unrelated issues as a vehicle to introducing GACK: * Terrorist attacks and requirement for emergency government access to communications traffic * Government assistance for companies to recover stored plaintext via key escrow infrastructure. * Assisting electronic commerce by helping put in place Certification Authorities and digital signature laws However readers who have followed GACK politics will recognise the above for what they are: attempts to put in place GACK via indirect routes (respectively: the four horsemen of the infocalypse argument (the fallacy that terrorists will obey laws and use encryption systems which have government backdoors), the Clipper I, II and III attemps (various attempts by the US government to bribe and bully companies into building a GACK architecture), and the UK TTP (Trusted Third Party) proposal where `TTPs' are a euphamism for a Certification Authority (CA) which has been coerced by law to keep individuals private keys). Scenarios governments might shortly try this to request master keys for communications might be France, where the government is changing from a position of no encryption software without license, to a position of unlicensed encryption software being allowed provided that the governments has a back door into the communications. Other examples being perhaps the UK (with it's highly controversial TTP licensing proposals), or the US with the administration and law enforcement community pushing hard for access to communications keys. It is likely, particularly in the UK, and US in the authors opinion, that government backdoors would be demanded in carefully orchestrated stages, designed to minimise public opposition. There might be trials where the traditionally more regulated financial organisations were required to comply, next perhaps government funded research labs, and business organisations accustomed to large amounts of government regulation Only towards the end would people using government funded networks (academics), Internet services providers (ISPs) and individuals be regulated. The final phases may use a terrorist activity, or national emergency, or other scandal as justification for increasing the requirements. It is likely also that the justification will be in terms of wholesome sounding public safety safeguards. Political Comparison PGP Inc's CMR proposal loses heavily in the political argument in the author's opinion because the protocol design supports the practice of allowing third and fourth party access to communications traffic. Particularly with the multiple CMR key requests per key which are rumored to be coming in the next version of PGP, it will be easy technically for a government to request that one of the recovery keys belong to the government. Governments already have the political will to have access to communications; the barriers are technical, and individual's resistance to the notion. The danger with the CMR proposal is that it could become the enabling technology for push button suveillance, the enabling technology for wide scale secret service signals intelligence keyword scanning. This probably not what it's proposers intend, however the danger is there in building the technology. The CDR proposal on the other hand focusses on recovery information of stored information only, and as a design principle avoids sending recovery information over open networks. Whislt governments may be interested to obtain storage keys, they have much less value, because the ciphertext is much harder to obtain. Also non-compliance is much harder to detect: a government law enforcement agency would not know if an individual was actually using storage software with government backdoor key access without physically obtaining the storage media. For most individuals the point at which governments executes a dawn raid is a point at which the individual is already in trouble. The CDR proposal is much closer to the status quo in political terms. From anon at anon.efga.org Tue Oct 21 16:10:34 1997 From: anon at anon.efga.org (Anonymous) Date: Wed, 22 Oct 1997 07:10:34 +0800 Subject: index.html Message-ID: > U.S. SAID VULNERABLE TO COMPUTER ATTACK > > "Today, the right command sent over the Internet to a power > generating station's control computer could be just as effective as > a backpack full of explosives and the perpetrator would be harder to > identify and apprehend," the panel wrote in its executive summary to > the report. "Today, we decided to hook up the computer that controls the power supply of several states to the most hostile WAN in history. OMIGOD, THERE'S AN INSECURE POWER GENERATION CONTROL COMPUTER HOOKED UP TO THE INTERNET! Everyone in the US, $2 please, so we can fix it." > > The report recommends stepping up research and establishing a > nationwide program to educate people on the scope of the problem. It > also recommends revising existing laws to ensure protection against > electronic attacks through the Internet. > This sounds like a bad cyberpunk novel. Two crackers in some hotel room in a hyper-crowded city in Japan, hacking the "power control network". Suddenly, one of them stops and says, "Shit." The other looks up, startled. The first says, "I forgot. This is against the law." A pause. Then they both start rolling around a floor covered with anti- static bags, polystyrene, and fast-food cartons laughing until they turn blue. > > "Law has failed to keep pace with technology. Some laws capable of > promoting assurance are not as clear or effective as they could be," > the panel wrote. > When I hear the "Law has failed to keep pace with technology" mantra, I get the feeling that lawmakers want license to pretend that Moore's Law applies to them, as well. Double the amount of criminal laws and regs every 18-24 months. > "We identified existing laws that could help the government take the > lead and serve as a model of standards and practices for the private > sector," it wrote. "We identified other areas of law that can enable > infrastructure owners and operators to take precautions > proportionate to the threat." "We think we can do what we want with what we already have. Give us the money anyway." Nuke them from orbit. It's the only way to be sure. Golem From brianbr at together.net Tue Oct 21 16:49:31 1997 From: brianbr at together.net (Brian B. Riley) Date: Wed, 22 Oct 1997 07:49:31 +0800 Subject: Your "RIGHT" to Speak to Big Brother Message-ID: <199710212341.TAA15468@mx02.together.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/20/97 11:13 PM, Eric Cordian (emc at wire.insync.net) passed this wisdom: >And there you have it. The people's right to provide their >neighbor's proprietary information their government shall not be >infringed. How Constitutional-Sounding. can you say INSLAW ????? they are sooooo trustworthy! -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNE08NcdZgC62U/gIEQJ2/wCaAwcjQLogUeAp7eBQk8n73OhmCjYAoON9 Z3FYtXeYgUYXlChaGYXu1IBk =Rho8 -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys "Civilization is the progress toward a society of privacy. The savage's whole existence is public, ruled by the laws of his tribe. Civilization is the process of setting man free from men." -- Ayn Rand - The Fountainhead (1943) From aba at dcs.ex.ac.uk Tue Oct 21 17:07:42 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Wed, 22 Oct 1997 08:07:42 +0800 Subject: wanted dead or alive: pgp5.5 key pair Message-ID: <199710212334.AAA02249@server.test.net> Could some kind soul who has downloaded pgp5.5 for business (I think it is available in the US from www.pgp.com) create a key with a CMR key extension. I guess this means generating two keys: XYZ Corp recovery key and then: XYZ Corp Sales with the sales person's key set up to have a strict requirement to encrypt to the XYZ "message recovery" key. Could this kind soul then mail me, (or post here I guess would be even more useful) both the private and public keys of both of them. Enciphering minds want to find out how pgp5.0 reacts to this key :-) (The question is really does pgp5.0 encrypt to the CMR key). (btw for the curious as to why my previous message was had a date of 22nd Feb ... I had to set my clock back to get pgp5.0 beta to function as the one I have had expired, and I forgot to set the clock forward again). Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Everyone has a "right" to speak to the government on any subject whatsoever, which cannot be abrogated by contracts, agreements or willful desire. A populace that holds no secrets is a safe populace. This is why we are officially announcing the formation of a federal agency, the Government Agency of Knowledge. Its role will be to obtain - by whatever means necessary - any and all knowledge of all actions, desires, means and ways of everything transpiring on US soil. Duties will include holding cryptographic keys in escrow, monitoring and assuring the wholesomeness of private and encrypted data traffic, and analyzing all available "knowledge patterns" of US citizens. Since honest, good citizens have nothing to hide, GAK will be a major advance toward protecting American citizenry from crime, terrorism and other human-meditated harm. After all, your government has a right and duty to protect you. From rka2 at hotmail.com Tue Oct 21 17:47:57 1997 From: rka2 at hotmail.com (Rka2@hotmail.com) Date: Wed, 22 Oct 1997 08:47:57 +0800 Subject: No Subject Message-ID: <78751968@ccw.net> To: rka2 at hotmail.com From: rka2 at hotmail.com Subject: Simple Reply-to:rka2 at hotmail.com Comments: Authenticated sender is Received: from hotmail.com (hotmail.com [000.000.000.000]) by hotmail.com (0.0.0./0.0.0.) with SMTP id AAA000000 for ; Tue, 30 Sep 1997 23:37:27 -0500 (EST) Message-Id: 0000000000.AAA000 at hotmail.com X-UIDL: 54956195511931597781388792848969 This may be the most important message of your life! You're not going to believe what you hear when you call this Toll Free number: 1-800-811-2141 (CODE 45434). We realize that almost everyone hates selling so we decided to solve that problem! Let our team of over 250 professional telemarketers work the phones, mail out brochures on your behalf, and most importantly "Close The Sale For You." This is a truly simple business that anyone can do which is why it works so well. You just give out the 800 number and your code and that's it. Everything else is done for you. No meetings, no presentations, no selling! Many are making over $8000/month! Call Today! You'll Be Glad You Did!! Toll Free: 1-800-811-2141 (CODE 45434) ============================================================== For name removal information please visit http://www.iemmc.org/remove.htm or send an email to globalremove at iemmc.org and you will be permanently removed from our mailing list as well as many others at the same time. Thank you very much. From tcmay at got.net Tue Oct 21 18:12:34 1997 From: tcmay at got.net (Tim May) Date: Wed, 22 Oct 1997 09:12:34 +0800 Subject: wanted dead or alive: pgp5.5 key pair In-Reply-To: <199710212334.AAA02249@server.test.net> Message-ID: At 4:34 PM -0700 10/21/97, Adam Back wrote: >Could some kind soul who has downloaded pgp5.5 for business (I think >it is available in the US from www.pgp.com) create a key with a CMR >key extension. ... >Enciphering minds want to find out how pgp5.0 reacts to this key :-) > >(The question is really does pgp5.0 encrypt to the CMR key). Why not just try to send a message to "phil at pgp.com"? Surely PGP, Inc. is itself using its own product? (I know if I were Jon Seybold and I had a radical"No nukes" nut like Phil on my staff, :-), I'd want to monitor what he was saying to people and what they were saying to him.) --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From gbroiles at netbox.com Tue Oct 21 18:13:29 1997 From: gbroiles at netbox.com (Greg Broiles) Date: Wed, 22 Oct 1997 09:13:29 +0800 Subject: PGP 5.5 CMR key examples, mini-review Message-ID: <199710220101.SAA21646@ideath.parrhesia.com> An acqaintance of mine received an evaluation copy of the new PGP For Business Security 5.5 suite, and I was able to generate some test keys to play with the message recovery features. I've uploaded them to the cert servers so folks with the 5.0 client software can experiment with them for interoperability, etc. The recovery key is "Little Brother ", fingerprint 26A5 667A 97D4 7018 1B18 2B15 D631 4776 B670 E1D0; a test user whose incoming and outgoing mail is forced to include the recovery key is "CMR User , fingerprint EC79 A170 8BAE 60A1 3CAC C517 34A4 6056 EE42 30E3. Both keys are 768-bit DH keys, as I don't expect that anyone will use them for anything other than testing. Installation of the package involves multiple steps - there's an "administrator install package" (my term, not theirs), which installs a version 5.5 of PGP, including the PGPTools, PGPKeys and PGPTray apps, as well as a PGPAdmin program. To implement CMR, the ordinary PGPKeys app is used to create an otherwise ordinary PGP key pair; the administrator then runs the PGPAdmin app, which asks questions about security/recovery policy. The admin can force incoming messages to use a recovery key, can force outgoing messages to use a recovery key, can enable/disable conventional encryption, can enable/disable key generation (and RSA key generation), can force a key to be trusted and to act as a trusted meta-introducer. The admin can also force the user to use a strong passphrase. (PGP 5.5 includes a neat passphrase-strength-meter which changes depending on the length and apparent alphabet-space used in the passphrase for user keys.) Finally, the admin can force the user to sign/trust a designated Corporate Signing Key. After the administrator sets those policy choices, the PGPAdmin tool can be used to generate a customized installer application for distribution to users. That installer creates a local copy of PGP, which will enforce the policy choices made by the administrator. The user is warned upon key generation that a message recovery key will be used (if the app is thus configured) and that the behavior isn't optional. The recovery key ID is displayed but not modifiable. The user interface for 5.5 is much improved over that in 5.0, which was a big improvement over the command line. There's an indicator (initially preferenced to OFF, along with other information) in the PGPKeys application which marks CMR'd keys with a red button; the interface between PGPKeys and the key server is much improved. It's now possible to mark & retrieve many unknown keys, then approve adding them to the local keyring in one step, instead of approving the addition of each additional key. The icons & screen design have been updated and are now more colorful and easier to decipher. When a user with CMR-only client software encrypts data, the ID of the recovery key appears in the "encrypt to" box, and cannot be dragged out. A CMR-client will (apparently) still do conventional encryption with no recovery key if the admin allows this. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles at netbox.com | Export jobs, not crypto. http://www.io.com/~gbroiles | http://www.parrhesia.com From casinomarket at correy.com Tue Oct 21 18:37:44 1997 From: casinomarket at correy.com (casinomarket at correy.com) Date: Wed, 22 Oct 1997 09:37:44 +0800 Subject: Searching_for_representatives Message-ID: Dear Friend! We are offering an exclusive, unprecedented opportunity to earn money, and even start your own marketing business in the field of online gambling. We are a legitimate highly regarded firm, which has now developed a technologically advanced web product that is a completely unique and new introduction to the Internet - the first 3D multi-player on line casino. We are searching for representatives, who are well connected and have proven marketing abilities, to cooperate with us in marketing our unique product. Get more information at : http://www.casino-on.net/market Best Regards, Casino On Net Marketing Department CASSAVA ENTERPRISES LTD. ----------------------------------------------------- This email is for adults only! It concerns you only if the Internet qambling is legal in your country. ----------------------------------------------------- From announce at lists.zdnet.com Tue Oct 21 20:57:05 1997 From: announce at lists.zdnet.com (announce at lists.zdnet.com) Date: Wed, 22 Oct 1997 11:57:05 +0800 Subject: See the Seasons's Hottest Video Games on VideoGameSpot! Message-ID: ----------------------------------------------------------------- ZDNET ANNOUNCEMENT 10/22/97 ----------------------------------------------------------------- Video games are going to be on everyone's Christmas list this year, and there are so many hot titles coming out, it'll make your head spin. If you need help finding something for yourself or the right gift for someone special, there is one site that will be your guide to the best games of the season - VideoGameSpot: http://www.zdnet.com/chkpt/zdna971022001/www.videogamespot.com/ VideoGameSpot is the leading video game information site on the Web. With the largest editorial staff in the business, you'll find everything you need to be in the know this holiday season. VideoGameSpot gives you: * Hard-hitting, critical reviews of the latest games played on the Sony PlayStation, Nintendo 64 and Sega Saturn console systems * Previews of games you've been waiting for and other new releases * Hints and strategy guides to help you play better and win * Custom Quick Time trailers so you can see games before you buy them * Monthly contests and promotions with thousands of dollars in prizes given out each month If you like video games (or know someone that does) and want to buy smarter and play better, then click on the URL listed below (or enter it into your browser): http://www.zdnet.com/chkpt/zdna971022002/www.videogamespot.com/ You'll also find us on the Games Channel at ZD Net: http://www.zdnet.com/chkpt/zdna971022003/www.zdnet.com/games _________________________________________________________________ ZDNet Announcements are periodic notices of new features, special events and free offers available to members of ZDNet. --To subscribe to ZDNet Announcements, please send mail to: announce-on at lists.zdnet.com You can leave the subject and body blank. --To unsubscribe to ZDNet Announcements, please send mail to: announce-off at lists.zdnet.com You can leave the subject and body blank. _________________________________________________________________ Powered by InfoBeat: http://www.infobeat.com From blancw at cnw.com Tue Oct 21 22:33:14 1997 From: blancw at cnw.com (Blanc) Date: Wed, 22 Oct 1997 13:33:14 +0800 Subject: the migration path (was Re: Your "RIGHT" to Speak to Big Brother) Message-ID: <3.0.32.19971021223134.006a3300@cnw.com> Adam Back wrote: >Perhaps this is what they are busy building at their top-sikrit crypto >software development/research center at Cambridge, UK under the >guidance of new head of research cryptographer Roger Needham. >Looks like an export embargo end-run by Bill Gates. > >Maybe Bill Gates is a cypherpunk after all, well we can live in hope, >anyway. ................................................................. He's no anarcho-cypherpunk: he and his father just contributed a great amount of money to support a gun-law initiative which would place all sorts of requirements on gun-owners (mandatory licensing, mandatory training, mandatory gun-locks, and many privacy-intrusive reductions of personal authority, etc.) in Washington state. I don't precisely know where he stands regarding crypto, but I know that he puts business requirements and customer acceptance above the arguments of GAK advocates, as do the VIPs who work in encryption and who totally reject the idea of Big Brother. .. Blanc From blancw at cnw.com Tue Oct 21 22:34:53 1997 From: blancw at cnw.com (Blanc) Date: Wed, 22 Oct 1997 13:34:53 +0800 Subject: everybody wants a piece of Microsoft's monopoly Message-ID: <3.0.32.19971021221731.006a80f4@cnw.com> It is intruiging to observe how alarmed certain companies get about Microsoft's methods (as though sellers of bundled MS software couldn't themselves just say "no" to such business proposals, without the government's assistance), and how Billg (and his legal advisors) deal with the govmt as they get further and more precisely investigated. It should be instructive and inspiring for everyone else, when MS wins, to see how (if) they do it. I would sympathize, but Billg is a great believer in "lawful" ways of doing things, often cooperating in regard of hiring practices and monopoly watch-dogs, among other things, so it is of great interest to me to see how he deals with these "lawful" types who believe they have cause to stick it to him. 'Tis a fine line he walks, between supporting the methods of The Law, using its services, and also being highly successful in beyond the limits set forth in the Official U.S. Rules for Success, Section 0.123, p. 26.930. Anyway, it's all "for the customer", you know. .. Blanc From Michael.Johnson at mejl.com Tue Oct 21 22:58:07 1997 From: Michael.Johnson at mejl.com (Mike) Date: Wed, 22 Oct 1997 13:58:07 +0800 Subject: SMTP Encryption Extension In-Reply-To: <3.0.3.32.19971021082737.00928b20@localhost> Message-ID: <3.0.3.32.19971022073807.0099dcb0@localhost> Eric Murray wrote: >Mike writes: >> Which leads to another idea, couldn't we encrypt SMTP by running it over >> SSL as a web server cgi? If 99% of Internet traffic is web browsing and we >> are trying to hide our email, then why not make the email look like web >> browsing? >You don't need to run it through a CGI. There's a port defined for >SMTP-over-SSL: Sure, but the idea here was hiding email to defeat traffic analysis. Ssmtp would raise alarms in any snopper but https would seem like business as usual, probably just another gif. And https is available through a lot of firewalls where you can't run ssmtp. >If you want to protect all email (an excellent idea), build a mail transport which automatically encrypts each outgoing mail in the key of the recipient Eudora/PGP already does that, but you are still quite vulnerable to traffic analysis unless you add remailers to the pot, which makes it a lot more complicated and error prone. A significant threat to online privacy comes from passive attackers, because you can't do anything about them. If you have an active attacker, you can analyze his moves and fix the bugs he uses to break root, but a passive attack is difficult to even detect before it's too late and your romantic conversations are headline news. Mike. From security at microserve.net Wed Oct 22 15:23:08 1997 From: security at microserve.net (MIS Security) Date: Wed, 22 Oct 1997 15:23:08 -0700 (PDT) Subject: No Subject Message-ID: Dan, You have a .forward file here at mis that points to toad.com. Do you have a .forward there? I received several compalints from people who are getting your mail at cosmos at microserve.net. -Jeremy ~---------------------------------------------------------------------------- Abuse & Security Department MicroServe Information Systems, Inc. security at admin.microserve.net 100 North Wilkes-Barre Boulevard abuse at admin.microserve.net Wilkes-Barre, Pennsylvania 18702 http://www.naISPa.org (717)821-5964 FAX (717)821-5968 ----------------------------------------------------------------------------- From brian at firstgear.com Wed Oct 22 15:42:43 1997 From: brian at firstgear.com (brian at firstgear.com) Date: Wed, 22 Oct 1997 15:42:43 -0700 (PDT) Subject: 30¢ a click, paid weekly! Message-ID: <199610221041.GAA26178@mail.firstgear.com> Send More, Convert More & Earn More! Want to get paid what your traffic is really worth? Sign up and we'll show you how! http://www.More4Clicks.com This message is intended for Webmasters, we want to help you make your site profitable. We apologise for any intrusion. mailto:emissary at lostvegas.com?subject:remove From security at microserve.net Wed Oct 22 16:18:20 1997 From: security at microserve.net (MIS Security) Date: Wed, 22 Oct 1997 16:18:20 -0700 (PDT) Subject: Complaints In-Reply-To: <344E8863.7B5@microserve.net> Message-ID: Dan, If this was my personal box and we were bullshitting, that would be funny. On the other hand, I have to address this matter. Do you have a .forward file in your other box? How else are they getting your mail? -Jeremy On Wed, 22 Oct 1997, Daniel Leeds wrote: > MIS Security wrote: > > Dan, > > You have a .forward file here at mis that points to toad.com. Do you have > > a .forward there? I received several compalints from people who are > > getting your mail at cosmos at microserve.net. > > Jeremy, > Don't pay any attention to the complaints. They are probably just > from people I have defrauded in business dealings, or parents who > object to the sexual liberties I have taken with their children. > Just tell those whiners to go fuck themselves. > > Dan > ~---------------------------------------------------------------------------- > Abuse & Security Department MicroServe Information Systems, > Inc. > security at admin.microserve.net 100 North Wilkes-Barre > Boulevard > abuse at admin.microserve.net Wilkes-Barre, Pennsylvania > 18702 > http://www.naISPa.org (717)821-5964 FAX > (717)821-5968 > ----------------------------------------------------------------------------- > > ~---------------------------------------------------------------------------- Abuse & Security Department MicroServe Information Systems, Inc. security at admin.microserve.net 100 North Wilkes-Barre Boulevard abuse at admin.microserve.net Wilkes-Barre, Pennsylvania 18702 http://www.naISPa.org (717)821-5964 FAX (717)821-5968 ----------------------------------------------------------------------------- From mark at unicorn.com Wed Oct 22 03:10:30 1997 From: mark at unicorn.com (mark at unicorn.com) Date: Wed, 22 Oct 1997 18:10:30 +0800 Subject: PGP 5.5 CMR/GAK: a possible solution Message-ID: <877514566.20581.193.133.230.33@unicorn.com> [Posted to cypherpunks, cc:-ed to Jon Callas] You know, in the last few days I've read a lot of messages on both sides of this debate, and I've umm-ed and ahh-ed and slowly gone from thinking that what PGP are doing is evil to thinking that it's just bad. While I believe that Adam Back's suggestions for alternate systems are good and neccesary ideas for the long-term, I'm coming to the conclusion that PGP are heading in the right direction for the short-term, but have things backwards. The current system sends out a user's personal key, with a tag to say that if I don't encrypt to the company as well, my mail will bounce. But think about this: how often do I want to send email to a particular person in a company, and ensure that only they see it? And how often do I want to send mail to a particular group inside a company? All I want is to ensure that I get a response from the company, I usually don't care who I talk to in the process. So PGP's "everything private unless you choose to make it public" system seems backwards. Surely what we really need to meet these customer demands is an "everything public (within the company) unless you choose to make it private" system? That is, all mail to my department inside the company should be encrypted to a department key, shared by all members, *unless* it is confidential, in which case it should *only* be encrypted to me. Here's how I see this working: when Joe Blow joins Foo-Bah Cryptosystems, he creates his own personal PGP key. He also gets a copy of the department key, which he can use to decrypt any mail which is encrypted to his department; or this decryption could be handled automatically by a department email server to ensure that individuals never have access to the department's private key. PGP then creates a public key for 'Joe Blow ', which would be the department key with a signed tag linking it to his personal public key. This is the tagged corporate public key which he would give out to any customers. When a customer wishes to send email to Joe, he would use this public key. When encrypting, PGP would detect the tag and put up a dialog box pointing out that this is a corporate key and if they click on the 'confidential' button it will be encrypted to the user's personal key prior to encrypting to the corporate key (by which I mean superencryption, to avoid traffic analysis). The default would be not to superencrypt; and as a side effect this system would be compatible with any version of PGP for non-confidential mail (assuming that version understands the encryption algorithms in use). The effect of this is that if someone wants to send email about an urgent bug and I'm out at lunch, any of my co-workers can read that mail. But if they want to send *me* mail about confidential inter-company negotiations, the co-workers could decrypt the outer layer of the message, but would be blocked by the inner layer encryption to my personal key. As I see it, this system is simple, solves the problems which PGP claim they need to solve without creating the snooping problems Tim and others have discussed, cannot easily be adapted to GAK ('This message is to be encrypted to the FBI public key. If it is confidential, click here to superencrypt to the recipient's personal key'), and won't require a massive change to the PGP source code. There are some obvious security issues with having the department key shared amongst the members of the department, but I don't see that they are any worse than PGP's current CMR implementation, which has already discussed the use of department keys; it's certainly better than using plaintext. There are also problems with encrypting confidential mail to multiple recipients, but they're surmountable; an easy solution, if you don't care about traffic analysis, is to only encrypt confidential mail to the personal key rather than superencrypt with the corporate key. In most cases such mail wouldn't be sent to multiple recipients anyway. So here's how I'd see the simple system working: A PGP CMR key would consist of 1. A corporate key; this might be company-wide, department-wide, or an individual escrowed key; this choice is a seperate key-management issue for the corporation. 2. Optionally a personal key, which could only be decrypted by the individual. 3. A signature from the corporate key linking the personal key to it and the specified User Id. 4. Optional flag to indicate which key to encrypt to by default. 5. User Id, signatures, etc When PGP was asked to encrypt to such a key, it would check for the optional personal key. If it wasn't there, it would put up a warning box to tell the user that the message can be read by people other than the recipient. If it is, then it would put up a dialog box allowing the user to choose whether to encrypt to the corporate key or the individual key, normally defaulting to the corporate key. This system could not easily become GAK because it will only encrypt to one of the keys and not both; the FBI could create FBI CMR keys from all our public keys, but then PGP would either encrypt to the FBI and I wouldn't be able to read it, or encrypt to me and the FBI wouldn't be able to read it. Anyone care to pick any holes? Mark |-----------------------------------------------------------------------| |Mark Grant M.A., U.L.C. EMAIL: mark at unicorn.com | |WWW: http://www.unicorn.com/ MAILBOT: bot at unicorn.com | |-----------------------------------------------------------------------| From lutz at taranis.iks-jena.de Wed Oct 22 03:45:24 1997 From: lutz at taranis.iks-jena.de (Lutz Donnerhacke) Date: Wed, 22 Oct 1997 18:45:24 +0800 Subject: wanted dead or alive: pgp5.5 key pair In-Reply-To: <199710212334.AAA02249@server.test.net> Message-ID: * Adam Back wrote: >Enciphering minds want to find out how pgp5.0 reacts to this key :-) >(The question is really does pgp5.0 encrypt to the CMR key). Just returned from the source ... PGP 5.0 does encrypt to every so called 'message recovery key' mentioned in the public key self certificate option if it is marked required or optional. If a key is missing, it fails encryting. IIRC it does work on unhashed uncritical signature packets, too. From anon at anon.efga.org Wed Oct 22 03:53:08 1997 From: anon at anon.efga.org (Anonymous) Date: Wed, 22 Oct 1997 18:53:08 +0800 Subject: Digital signatures Message-ID: Tim Maytag carries a turd in his wallet for identification purposes. _______c___c / /_ _\ | ((6)(6)) Tim Maytag ( )_ __\\ //__ o___n) (nn)\o/(nn) From amp at pobox.com Wed Oct 22 04:57:44 1997 From: amp at pobox.com (amp at pobox.com) Date: Wed, 22 Oct 1997 19:57:44 +0800 Subject: PGP 5.5 CMR/GAK: a possible solution In-Reply-To: <877514566.20581.193.133.230.33@unicorn.com> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- mark at unicorn.com was heard to whisper to several hundred people: =snip= > The effect of this is that if someone wants to send email about an urgent > bug and I'm out at lunch, any of my co-workers can read that mail. But if > they want to send *me* mail about confidential inter-company negotiations, > the co-workers could decrypt the outer layer of the message, but would be > blocked by the inner layer encryption to my personal key. > As I see it, this system is simple, solves the problems which PGP claim > they need to solve without creating the snooping problems Tim and others > have discussed, cannot easily be adapted to GAK ('This message is to be > encrypted to the FBI public key. If it is confidential, click here to > superencrypt to the recipient's personal key'), and won't require a > massive change to the PGP source code. > There are some obvious security issues with having the department key > shared amongst the members of the department, but I don't see that they > are any worse than PGP's current CMR implementation, which has already > discussed the use of department keys; it's certainly better than using > plaintext. There are also problems with encrypting confidential mail to > multiple recipients, but they're surmountable; an easy solution, if you > don't care about traffic analysis, is to only encrypt confidential mail > to the personal key rather than superencrypt with the corporate key. In most > cases such mail wouldn't be sent to multiple recipients anyway. This isn't quite as bad as the current setup with pgp5.5. We've set up something almost like this within my department. We have a shared key for the department, and private keys individually. I'm pretty leery of the concept of a shared group key, but for certain types of messages, it is not too terrible a solution. Of course, you have problems when someone leaves the group, as you now have to change the master key for the group. I'd actually prefer to be able to use conventional crypto for when we need to distribute new passwords amongst my group, as it is easier to deal with ftmp (for the group where i work anyway) without the difficulties of having to revoke/reissue the dept key. One thing that I think PGP needs more than anything else, is to make it easy to build lists of keys to encrypt to. Version 4.5 has this feature, which is why I'm using it. I would hope that 5.5 does, and will also let the user create whatever type of keys he wants and use conventional crypto as well. I'm expecting a copy here soon, so will get to play with it then. I can't say I really like version 5.0 much. - ------------------------ Name: amp E-mail: amp at pobox.com Date: 10/22/97 Time: 05:37:49 Visit me at http://www.pobox.com/~amp == -export-a-crypto-system-sig -RSA-3-lines-PERL #!/bin/perl -sp0777i amp at pobox.com wrote: > One thing that I think PGP needs more than anything else, is to make it easy > to build lists of keys to encrypt to. I'm not sure that it's quite what you're suggesting, but I was thinking that this idea could be extended to an arbitrary hierachy; for example, company key, department key, individual escrowed key, individual-only key. The sender could then choose which of these keys to encrypt to based on the sensitivity of the message. Again, this couldn't be extended to GAK because if the FBI were to put themselves at the top of the hierachy we wouldn't be able to read any mail which was encrypted to their key! Mark From amp at pobox.com Wed Oct 22 05:24:52 1997 From: amp at pobox.com (amp at pobox.com) Date: Wed, 22 Oct 1997 20:24:52 +0800 Subject: PGP 5.5 CMR/GAK: a possible solution In-Reply-To: <877521655.28888.193.133.230.33@unicorn.com> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- >> One thing that I think PGP needs more than anything else, is to make it easy > > to build lists of keys to encrypt to. > I'm not sure that it's quite what you're suggesting, but I was thinking > that this idea could be extended to an arbitrary hierachy; for example, > company key, department key, individual escrowed key, individual-only > key. The sender could then choose which of these keys to encrypt to based > on the sensitivity of the message. Again, this couldn't be extended to > GAK because if the FBI were to put themselves at the top of the hierachy > we wouldn't be able to read any mail which was encrypted to their key! Actually, what I had in mind is just the ability to create your own list of recipients and use a single group name be what you select to encrypt to that list, rather than having to select each individual every time you encrypt. kinda like the stuff I've had in my email program for ages. Nothing formal about the heirarchy, just a way to click on one 'name' and have the keys I've previously assigned to that name be used. - ------------------------ Name: amp E-mail: amp at pobox.com Date: 10/22/97 Time: 07:05:56 Visit me at http://www.pobox.com/~amp == -export-a-crypto-system-sig -RSA-3-lines-PERL #!/bin/perl -sp0777i Forwarded message: > Date: Wed, 22 Oct 1997 07:38:07 +0200 > From: Mike > Subject: Re: SMTP Encryption Extension > Sure, but the idea here was hiding email to defeat traffic analysis. Ssmtp > would raise alarms in any snopper but https would seem like business as > usual, probably just another gif. And https is available through a lot of > firewalls where you can't run ssmtp. Your base assumption is that Mallet is stupid. Bad assumption. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From aba at dcs.ex.ac.uk Wed Oct 22 05:58:57 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Wed, 22 Oct 1997 20:58:57 +0800 Subject: PGP Inc isn't using CMR (Re: wanted dead or alive: pgp5.5 key pair)Tue, 21 Oct 1997 18:06:04 -0700) Message-ID: <199710221149.MAA00868@server.test.net> Tim May writes: > At 4:34 PM -0700 10/21/97, Adam Back wrote: > >Enciphering minds want to find out how pgp5.0 reacts to this key :-) > > > >(The question is really does pgp5.0 encrypt to the CMR key). > > Why not just try to send a message to "phil at pgp.com"? > > Surely PGP, Inc. is itself using its own product? Strangely not. Tom Zerucha asked this question over on open-pgp, and Jon Callas replied: Jon Callas wrote: : Tom Zerucha <@spam-resistant-email-address> wrote: : : But let me ask a question about PGP, Inc. - Do they use the PGP 5.5 : version with corporate key recovery internally? : : No, we don't. We have no need to. It would be inappropriate for our : environment. Guess that answers that one then. > (I know if I were Jon Seybold and I had a radical"No nukes" nut like Phil > on my staff, :-), I'd want to monitor what he was saying to people and what > they were saying to him.) Some fairly hot things by all accounts: all about resistance fighters, and terrorists. Really ought to watch that guy :-) He has a laptop which he carries everywhere too -- probably with his non-CMR old prz at acm.org key on it -- reckon he'll be fiercely hanging on to that one :-) Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710221246.NAA00906@server.test.net> Mark Grant writes: > The current system sends out a user's personal key, with a tag to say that > if I don't encrypt to the company as well, my mail will bounce. But think > about this: how often do I want to send email to a particular person in a > company, and ensure that only they see it? And how often do I want to send > mail to a particular group inside a company? All I want is to ensure that > I get a response from the company, I usually don't care who I talk to in the > process. The CMR feature in pgp5.5 isn't so far intented to cope with this scenario I think. That's because pgp5.5 I understand can only generate keys with one CMR request field. What you're describing is an alternate use for CMR: to allow sales at acme.com to have attached to it the request that messages to that address be encrypted for all the sales people. Well that seems reasonable in a way. Still potentially dangerous in that the NSA will soon enough be asking to be on every one's CMR list. (As far as I can tell the next version (pgp6.0 or whatever) will include capability to create keys with multiple CMR requests. The capability to handle them is already in pgp5.5 by all accounts.) The other alternative is as you say: to have group keys which are shared amongst the sales people. There are problems with this in managing the secure distribution of the shared key: sales manager creates it, and emails securely to all sales team members? Plausible I suppose. Problem for both approaches is re-keying: what happens when Fred leaves the sales team to work for a competitor. Revoke the shared key and start over? Or with the CMR method, revoke just the CMR request for Fred, and allow key servers to remove CMR requests when presented with a suitable CMR request revocation cert? (How often will senders check key servers for revocation certs?) Or have short expiries on encryption-only keys (one per day?), so that they key update happens soon enough anyway. (pgp5.x allows for short lived encryption keys directly because of the separation of signature and encryption keys, the WoT applies to the signature key). Really it seems to me that actually having half a dozen sales droids sharing a key, or being able to decrypt a message because they are all CMR enforced multiple crypto recipients is a security nightmare either way :-) Reckon it would be arguably more secure to have the SMTP policy enforcer decrypt it for them, even. Another option would be Matt Blaze's proxy encryption. That allows the owner of the sales at acme.com key (perhaps the sales manager) to create proxy keys which can convert messages addressed to sales at acme.com into messages addressed to fred at acme.com, jane at acme.com, and the rest of the sales droids. (I thought Dave Wagner came up with an example of a public key proxy function for an RSA or El Gamal variant or something). With proxy encryption you still have to have the proxy keys somewhere, but you could keep them out of Fred's hands by putting them on the SMTP policy server for it to convert incoming traffic. This seems to be more secure than either approach. And avoids the security risk of having multiple long term encryption keys used to allow access to communications traffic. That way at least messages aren't coming over the wire addressed to 101 people. And also you don't have to worry so much about quick propogation of revocation certs. And when someone leaves you can remove their proxy key from the SMTP server. The whole problem is really quite complex, and there are no easy solutions to group secured mail access where people are leaving and joining the group at short notice. Proxy cryptography seems to add something quite useful to this mix. Some form of transport level security adds something to the mix also, because then if you are using CMR keys, or even normal pgp2.x multiple recipients, or you are using long term encryption keys (as PGP Inc seems to be currently recommending with pgp5.x (recommended validity setting of `forever')) at least old traffic isn't directly vulnerable. Several people commented on using a forward secret TLS between SMTP servers opportunisitically (if the SMTP server supports the extension, then use it; if not fall back to current situation). Even without any authentication, this is a win because the main threat from government is massive eavesdropping and key word scanning, or saving of targetted users mails for later key compromise. Unauthenticated TLS still forces the attacker to use active attacks. Authentication can be added later as part of IPSEC/IPv6 key infrastructure. Another method of authenticating TLS is to base the authentication on the user's PGP WoT. Include authentication information to the delivery agent which is capable of TLS, which is also exchanged inside the encryption envelope. (Eg. transfer an authentication symmetric key k1 inside the encryption envelope; send the local TLS capable SMTP hub / SMTP policy enforcer the key k1. The TLS forward secret key negotiation can then be authenticated using this key. The remote TLS system can tack the authentication information on to the delivered message, in a header, or otherwise, and the recipient can check the authentication). > So PGP's "everything private unless you choose to make it public" system > seems backwards. Surely what we really need to meet these customer demands > is an "everything public (within the company) unless you choose to make it > private" system? That is, all mail to my department inside the company > should be encrypted to a department key, shared by all members, *unless* > it is confidential, in which case it should *only* be encrypted to me. I think what PGP are arguing for is ability to recover stored messages even if they are intended for one recipient only. As I think has been established this can be acheived by storage recovery, without exposing communications traffic to the associated risks. It is possible that there is an unstated perceived user requirement, that the messaging standard be able to allow third party access to the communications traffic directly. Your description is another plausible permutation also, I think, which has it's own merits and security/privacy/political abuse trade-offs. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 THE MALEBOX THE MALEBOX is an awesome new GAY live voice phone system..{currently absolutely FREE with Sprint's Free Monday} ! Otherwise, only REGULAR U.S. phone charges apply (NY free)...the computer is in New York with a normal phone number. There are no setup costs and NO FEES...call from anywhere anytime (use your own best rate...Dime Deal...MCI 5ct Sunday,etc). Why be shy? Call THE MALEBOX at # 315-233-1693 and press 7 for the LOBBY, then press... #1...LIVE ROOMS > chat for up to 8 people per room; a great way to meet and (press 7 to skip to next room) Gay Guys seem to prefer the virtual chat aspect found on One-on-One #2...BULLETIN BOARD > post messages or ads, or listen #3...ONE-ON-ONE > private talk; good place to meet and chat without giving your home phone number...check out NEW INSTANT VIRTUAL CHAT !! #4...PERSONALS > super place to meet your dream mate #5...VOICEMAIL > get your own private mailbox or leave a message. #9....DIRECTORY > other special numbers and services #0...to return to the LOBBY The system is very simple, just follow the easy directions or use the menu above...try it you'll like it! Please SAVE THIS MESSAGE for the future. Call THE MALEBOX at # 315-233-1693...if busy just try again press 7 to slip in to the LOBBY ...... ( for straight folk try a similar system at THE HOTEL CALIFORNIA at 315-233-1690 ) ( from the U.K. try 268-404-7489 ) for FREE TAROT READINGS try # 1-268-404-4772 From declan at well.com Wed Oct 22 07:27:25 1997 From: declan at well.com (Declan McCullagh) Date: Wed, 22 Oct 1997 22:27:25 +0800 Subject: Singapore TOILET ALERT Message-ID: [Apologies to my friends in Singapore, but I am NOT making this up. --Declan] And the top five toilets are... SINGAPORE (Reuters) - A drive to keep public toilets clean and dry is meeting with overwhelming success, the Ministry of Environment said in a "toilet alert" Tuesday. The statement said that in the first week "5,000 Singaporans have called the Clean Public Toilets hotline to identify Singapore's model toilets and to vote for their top five favorite toilets." The ministry launched a poster competition earlier in the month featuring three model toilets and inviting the public to identify their locations, as well as to nominate their favorite public toilets in five categories of locations. Various prizes are involved, including a return trip to Hong Kong to be won in a draw. Singapore is known for public campaigns promoting causes ranging from discouraging littering to encouraging people to have more children. ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ From aba at dcs.ex.ac.uk Wed Oct 22 07:57:21 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Wed, 22 Oct 1997 22:57:21 +0800 Subject: shared keys, proxy encryption (was Re: PGP 5.5 CMR/GAK: a possible solution) Message-ID: <199710221450.PAA03056@server.test.net> Forwarded with permission, Mark's response: ------- Start of forwarded message ------- Date: Wed, 22 Oct 1997 06:41:49 -0700 (PDT) From: mark at unicorn.com To: aba at dcs.exeter.ac.uk Cc: mab at research.att.com Subject: Re: shared keys, proxy encryption (was Re: PGP 5.5 CMR/GAK: a possible solution) aba at dcs.ex.ac.uk wrote: [Did you intend to send this to the list, or Bcc it? If so, please forward a copy of this reply as well] > What you're describing is an alternate use for CMR: to allow > sales at acme.com to have attached to it the request that messages to > that address be encrypted for all the sales people. > > Well that seems reasonable in a way. Still potentially dangerous in > that the NSA will soon enough be asking to be on every one's CMR list. But that's *precisely* what I set out to avoid. The intention is to eliminate the multiple-recipient encryption which is the real problem with PGP 5.5's CMR. The NSA can easily put themselves at the top of the encryption hierachy, but then all mail will *only* be encrypted to the NSA, and the recipient will not be able to read it. Rather than encrypting to multiple recipients, you would encrypt to a single key which is available to all those recipients. > The other alternative is as you say: to have group keys which are > shared amongst the sales people. There are problems with this in > managing the secure distribution of the shared key: sales manager > creates it, and emails securely to all sales team members? > Plausible I suppose. Exactly. Or the individual sales-people create personal 'corporate use keys' and escrow them, or the key is retained in a secure 'black box' which takes incoming email encrypted to the sales department and outputs plaintext. The point is that mail sent to that key can be recovered somehow, but confidential mail sent to their private, personal key cannot. > Problem for both approaches is re-keying: what happens when Fred > leaves the sales team to work for a competitor. I agree. But that can be solved in some fashion; the 'black box' approach, for example. > Really it seems to me that actually having half a dozen sales droids > sharing a key, or being able to decrypt a message because they are all > CMR enforced multiple crypto recipients is a security nightmare either > way :-) Sure, but better than a security nightmare *and* GAK. > Reckon it would be arguably more secure to have the SMTP policy > enforcer decrypt it for them, even. Yep, that was one of the options I listed; the 'black box' above. > I think what PGP are arguing for is ability to recover stored messages > even if they are intended for one recipient only. But this is the one thing they don't seem to have a business case for. In my system, if the mail was encrypted to that recipient's personal key rather than a group key or an individual escrowed key, then the sender had a good reason to do so. In that case, the only reason a company could want to read the mail is for snooping on their employees. I don't believe that PGP or anyone else should be encouraging that. The proxy key stuff seemed interesting, but not something that can be implemented in the next few months. I'm thinking of this as a short-term solution, not long-term. Mark ------- End of forwarded message ------- From aba at dcs.ex.ac.uk Wed Oct 22 08:10:14 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Wed, 22 Oct 1997 23:10:14 +0800 Subject: puff pieces vs tough crypto issues (Re: Singapore TOILET ALERT) In-Reply-To: Message-ID: <199710221356.OAA02611@server.test.net> Declan McCullagh writes: > > [puff piece on toilets] > No offense Declan, but what has this got to do with cypherpunks, cryptography, crypto politics etc? (This is not a perrygram, this is a message saying I found that particular article uninteresting). I think we'd be more interested to see an analysis piece of the political merits/demerits of the pgp5.5 CMR corporate message recovery technique than of _toilets_. Where do you stand on the CMR argument? Or are you staying away from the hot potato :-) Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710221543.XAA11390@ganymede.contact.com.sg> Declan - > [Apologies to my friends in Singapore, but I am NOT making this up. --Declan] No apologies needed. You don't have to make things up - we have lobotomized civil servants and ministers to do that. On the other hand, some of the users of public toilets themselves are or need to be lobotomized! Another issue: The Singapore Broadcasting Authority has issued "clarifications" to their own lobotomized Internet Code of Practise (issued July 1996). Check www.sba.gov.sg for more info. > And the top five toilets are... > SINGAPORE (Reuters) - A drive to keep public toilets clean > and dry is meeting with overwhelming success, the Ministry of > Environment said in a "toilet alert" Tuesday. > The statement said that in the first week "5,000 > Singaporans have called the Clean Public Toilets hotline to > identify Singapore's model toilets and to vote for their top > five favorite toilets." > The ministry launched a poster competition earlier in the > month featuring three model toilets and inviting the public to > identify their locations, as well as to nominate their favorite > public toilets in five categories of locations. > Various prizes are involved, including a return trip to Hong > Kong to be won in a draw. > Singapore is known for public campaigns promoting causes > ranging from discouraging littering to encouraging people to > have more children. And for banning the sale of chewing gum, purchase of guns, jaywalking, speeding, armed robberies, rapes, defamations suits, murders etc. Damn, we are beginning to sound (smell??) like New York City. *shivers* Enjoy. -- Harish Pillay h.pillay at ieee.org Singapore *** Ask me about Linux *** http://home.pacific.net.sg/~harish From nobody at REPLAY.COM Wed Oct 22 09:05:21 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 23 Oct 1997 00:05:21 +0800 Subject: PGP 5.5 CMR/GAK: a possible solution Message-ID: <199710221555.RAA01080@basement.replay.com> mark at unicorn.com writes: > When a customer wishes to send email to Joe, he would use this public key. > When encrypting, PGP would detect the tag and put up a dialog box pointing > out that this is a corporate key and if they click on the 'confidential' > button it will be encrypted to the user's personal key prior to encrypting > to the corporate key (by which I mean superencryption, to avoid traffic > analysis). The default would be not to superencrypt; and as a side effect > this system would be compatible with any version of PGP for > non-confidential mail (assuming that version understands the encryption > algorithms in use). Neat, automatic superencryption. Could the same idea work with the Pgp method with the CMR key? You would encrypt to the user first, then reencrypt to the combination of user and CMR key. Would this prevent GAK? From declan at well.com Wed Oct 22 09:31:37 1997 From: declan at well.com (Declan McCullagh) Date: Thu, 23 Oct 1997 00:31:37 +0800 Subject: puff pieces vs tough crypto issues (Re: Singapore TOILETALERT) In-Reply-To: Message-ID: Adam, Sometimes it's useful to inject a bit of humor in every serious discussion. The relevance? Another example of Singapore's loony politics. Strict social controls and relative economic freedom. I find it fascinating in light of Net-filtering and other attempts at restricting information flow; if you don't, well, you can always delete it. :) As for CMR... I was travelling when the discussion started on cypherpunks so I haven't been following it very closely. My position is something along these lines: corporations have a right to go down the CMR path; it is unwise to restrict them through the coercive power of the state. At the same time, we need to speak out against crypto-foolish practices. If corporations start building CMR products, the political consequences could be devestating. It's like building a gallows for your own hanging. >From my perch in Washington, I see PGP 5.5/CMR as an existence proof that key recovery can be done. So far the crypto-advocates have been able to wave around the Blaze et al white paper that says we don't know how to do it. Even Dorothy Denning agreed. But now when a mandatory GAK bill goes to the House floor, all Rep. Solomon etc. have to do is wave around a shrinkwrapped copy of PGP and say: "I bought this for $19 at the Egghead shop at 21st and L." Details will be lost in the fearmongering. I suspect that there's not that substantial a market for CMR. The apparent market demand now is an artificial one created by the Clinton administration. -Declan From tcmay at got.net Wed Oct 22 11:06:19 1997 From: tcmay at got.net (Tim May) Date: Thu, 23 Oct 1997 02:06:19 +0800 Subject: PGP, Inc.--What were they thinking? In-Reply-To: <199710221356.OAA02611@server.test.net> Message-ID: At 9:17 AM -0700 10/22/97, Declan McCullagh wrote: >As for CMR... I was travelling when the discussion started on cypherpunks >so I haven't been following it very closely. > >My position is something along these lines: corporations have a right to go >down the CMR path; it is unwise to restrict them through the coercive power >of the state. At the same time, we need to speak out against crypto-foolish >practices. If corporations start building CMR products, the political >consequences could be devestating. It's like building a gallows for your >own hanging. Just to make things clear, none of us is arguing for any restrictions on a corporation's adoption of CMR, nor of PGP, Inc.'s right to manufacture and distribute CMR software. Many of us think it is a foolish thing for PGP, Inc., especially, to be building. Both because it helps Big Brother make his arguments (as he has already, pace the testimony before Congress about key recovery being practical because PGP, Inc. is now selling similar software), and because of how it squanders the reputation capital of Phil Zimmermann and PGP, Inc. Further, CMR addresses the wrong problems. For reasons I and Adam Back and several others have discussed at length in the past couple of weeks. > >>From my perch in Washington, I see PGP 5.5/CMR as an existence proof that >key recovery can be done. So far the crypto-advocates have been able to >wave around the Blaze et al white paper that says we don't know how to do >it. Even Dorothy Denning agreed. But now when a mandatory GAK bill goes to >the House floor, all Rep. Solomon etc. have to do is wave around a >shrinkwrapped copy of PGP and say: "I bought this for $19 at the Egghead >shop at 21st and L." Details will be lost in the fearmongering. Yep, they're already doing this. This was reported a week or so ago, somewhere here in Cypherpunks. > >I suspect that there's not that substantial a market for CMR. The apparent >market demand now is an artificial one created by the Clinton >administration. Agreed. What amazes me is how PGP, Inc. would decide this should be a core part of their company. "PGP for Business," indeed. What were they thinking? --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From mktg at inet.com Thu Oct 23 02:10:14 1997 From: mktg at inet.com (mktg at inet.com) Date: Thu, 23 Oct 1997 02:10:14 -0700 (PDT) Subject: We Do All The Work And You Collect All The Cash Message-ID: <7738339201724@inet.com> If you're NOT currently looking for an income opportunity, then just delete this message. If you ARE looking for an income opportunity, then... WELCOME TO THE HOTTEST CASH GENERATING PROGRAM ON THE INTERNET! I'm sure that this is not the first opportunity that you have ever run across that claims that you can make a lot of cash, very quickly. But, this just might be the only program you'll ever run across, that can actually make that happen. Every other cash generating program that you've ever run across was probably doomed from the start, for 3 simple reasons. 1) You needed to dedicate a lot more time and effort into the marketing of your program, than you originally planned. 2) You needed to invest a lot more money into the marketing of your program, than you originally expected. 3) Your success depended solely on you. And, unless you're a marketing expert, your expected level of success just wasn't going to be achieved. Well, that's where our expertise comes in. We here at Internet Marketing Services, have been asked to develop an effective marketing system that would require virtually no effort and very little capital. We are proud to tell you, that our experience in this industry has enabled us to create a very low cost, high response, marketing program, that blows away traditional methods of network marketing and advertising. The secret to becoming successful in any business is to get your message to as many people as possible, in a cost effective manner. Through our creative advertising program were able to greatly reduce our costs and we are simply passing the savings on to you. IT'S REALLY AMAZING HOW EASY THIS IS AND HOW BEAUTIFULLY IT WORKS! By compounding our efforts and combining your advertising along with other income opportunity seekers wanting to participate in this highly profitable program, Internet Marketing Services is now able to offer you the best Internet marketing rates available anywhere. HERE'S HOW IT WORKS. Multi-level marketing is still used by some of the largest companies in the world today; Amway, Excel and Avon, just to name a few. This highly effective, multi-level business provides you the same type of opportunity. A business that offers a proven cash generating program, complete with a low cost internet marketing service. THIS IS THE SECRET TO YOUR SUCCESS! If a new customer decides to participate in your program, they simply send you a $5.00 commission. And the best part is, we do all the hard work for you, you just collect your cash. As with all multi-level businesses, your income is generated by recruiting new customers that have the same interest as you. The desire to create a large cash income. And, every state in the USA allows us to legally recruit for you, via the Internet. For an extremely low fee of only $35.00, we will market this highly profitable opportunity to 750,000 people with your name and address inserted into the mailing. Then you just go to your mailbox and collect your cash. That's all there is to it. HERE'S HOW YOUR ADVERTISING DOLLARS COMPOUND. In each mailing your name will be included with 2 other distributors. We will then advertise your opportunity to 250,000 people, in 3 seperate mailings. So your opportunity will be offered to 750,000 different people. EXAMPLE: Mailing #1: 250,000 People Mailing #2: 250,000 People Mailing #3: 250,000 People FOR A TOTAL OF: 750,000 People NOW, LET'S COMPARE COSTS. If you were to send your offer through the postal service, it would cost you $240,000.00, in postage alone. The typical e-mail company charges 1-2 dollars per 1000 addresses mailed to. That would be a minimum of $750.00. Other methods could be even more expensive than using the postal service. As you now can see, by compounding your advertising dollars with other income opportunity seekers, it allows us to offer you a cost effective way to cash in on a proven income generating program. And remember, we do all the work for you. You just go to the mailbox and collect your cash. THIS IS A LEGITIMATE MONEY MAKING OPPORTUNITY. It does not require you to come into contact with people, do any hard work, and best of all you never have to leave the house except to get the mail. This multi-level, e-mail order, marketing program works perfectly, every time. E-mail is the ultimate sales tool of the future, and the future is now! If you ever wanted "THE EASY WAY" to make a lot of money... just follow these 3 easy steps using this sure fire system! STEP 1: Send $5.00 in cash to each of the 3 distributors below. Just like new customers will be sending to you, once your name has been placed onto the mailing. Also, include a seperate sheet of paper with your name as it is to appear on this mailing, along with the words, " I WOULD LIKE TO SUBSCRIBE TO YOUR INCOME OPPORTUNITY NETWORKING SERVICE." Once the 3 distributors receive your $5.00 payment, they will each e-mail us your name, verifying that you have paid them their commission. This service also eliminates the possibility of anyone replacing any existing names on the mailing. #1: Venture Inds. 2308 E. Broadmor Tempe,AZ 85282 #2: P.S.B.Wayne PO Box 572772 Tarzana,CA 91357-2772 #3: Classic Communications 1912 California St. Berkeley,CA 94703 STEP 2: Send $35.00, along with your name and address as you want it to appear on this mailing. (You can use your full name, your initials, a business name or what ever you prefer) Once we receive your payment and verification via e-mail that you paid each distributor their commission; we will automatically position your name and address through all 3 mailings until this offer has been e-mailed to 750,000 people. Be sure to include your e-mail address. Once we receive your payment, we will e-mail you our priority e-mail address. This is how you will notify us that you received your payment from customers that want to paticipate in your program. This is a fool-proof system that eliminates anyone from using your service without paying you your $5.00 commission. You can use this program as many times, and as often as you like. By doing this, it is possilbe to create a perpetual cash income. And yes, we accept personal checks. Make check payable to and send to: Internet Marketing Sevices Dept-L23 2375 E.Tropicana #135 Las Vegas, NV 89119 Please note, Internet Marketing Services does not participate in your offer, nor do we share in your income in any way. Internet Marketing Services is a low cost, internet marketing provider only. STEP 3: Go to your mailbox daily and collect your cash. MAKING MONEY JUST DOESN'T GET ANY EASIER THAN THIS! By now your probably asking yourself, "how much money can I really make?" Below are the results of an Internet survey conducted by www.survey.net: 50% of the people on the Internet have made purchases, 40% have made several purchases, 80% like the idea of shopping on the Internet, 50% of those purchases are computer information related, 50% think of e-mail as their second most important application, 20% have made purchases because "I came across it and I liked it, so i bought it." POSSIBLE EARNINGS PER 750,000 E-MAILS 2% Response @ 15,000 X $5.00 = $75,000 1% Response @ 7,500 X $5.00 = $37,500 1/2% Response @ 3,750 X $5.00 = $18,750 1/4% Response @ 1,875 X $5.00 = $ 9,375 HOW MANY RESPONSES DO YOU THINK YOU WILL RECEIVE? As more and more people look for ways to create wealth and financial security, the need for a successful income opportunity is constantly in demand. This higly effective marketing program has only recently been made available. There are millions and millions of people who haven't yet received this offer. THIS IS STILL VERY MUCH A GROUNDFLOOR OPPORTUNITY! BUT IT WON'T BE FOR LONG! If your fed up with the high cost of marketing and advertising then why not take advantage of this powerful opportunity and start creating wealth for you and your family. We hope that you are one of those unique individuals that does more than just dream about creating wealth and has the foresight to see what an incredible money making opportunity that this really is, requiring no effort and a very small investment. JUST IMAGINE WHAT YOU AND YOUR FAMILY CAN DO WITH ALL THAT CASH! FREE WEBSITE: Would you like to create your own website for business or personal use? Just go to www.freeyellow.com and follow the prompts. From declan at well.com Wed Oct 22 11:21:33 1997 From: declan at well.com (Declan McCullagh) Date: Thu, 23 Oct 1997 02:21:33 +0800 Subject: Bill Gates, the Bully Savior In-Reply-To: Message-ID: There was a good op-ed in the WSJ on Monday. The Politics of Envy, basically. Why everyone in Silicon Valley hates Microsoft... But some of the complaints about Microsoft come down to personal taste. The masses offend refined sensibilities when they buy Windows 95 in droves. Rein them in! Stop them from buying what they want! Don't let them get free copies of Internet Explorer. I share Lizard's distaste for Microsoft products. My Unix workstation at home has not one MSFT application on it. I have only Microsoft Word on my Duo at work, and I could get by with WordPerfect. But our dislike for their products doesn't mean that we are morally justified in restricting what the company can do. -Declan At 10:42 -0700 10/22/97, Lizard wrote: >Uhm...how do 'we all' benefit from having the same Justice Department which >defended the CDA (and which is pushing for GAK) decide for us all what is, >and is not, part of an operating system? > >These people are not qualified to make ANY judgements about computers -- I >have to assume the 'experts' they got to tell them about OS software are no >more qualified than the 'experts' they got to testify about the CDA (L-18, >anyone?). > >I have no great love for Microsoft (I don't think anyone forced to use >their crappy software does), and, emotionally, I'd like to see them get >taken down a peg -- but legally and ethically, they are not doing anything >wrong. They're just being tough competitors. Microsoft has prospered not >due to any technical brilliance on their part, but due to sheer >incompetance on the part of the rest of the industry, who have made a hobby >of underestimating Bill Gates and overestimating their own customers loyalty. > >It's a pity I'm a mind-flaying victim. If I wasn't, I could forget >principles and ideals and just say, "Microsoft Big. Microsoft Nasty. Uncle >Sam stomp Microsoft. Yay, Uncle Sam." But because I work from principle >FIRST, I have to grant Microsoft the same rights I would grant Sam's Deli >or Joe's Shoe Store, and that includes the right to offer any combination >of products or services they wish, and let the market decide to buy or not. ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ From jseiger at cdt.org Wed Oct 22 11:24:11 1997 From: jseiger at cdt.org (Jonah Seiger) Date: Thu, 23 Oct 1997 02:24:11 +0800 Subject: puff pieces vs tough crypto issues (Re: Singapore TOILET ALERT) In-Reply-To: <199710221356.OAA02611@server.test.net> Message-ID: At 12:17 PM -0400 10/22/97, Declan McCullagh wrote: >>From my perch in Washington, I see PGP 5.5/CMR as an existence proof that >key recovery can be done. So far the crypto-advocates have been able to >wave around the Blaze et al white paper that says we don't know how to do >it. Even Dorothy Denning agreed. But now when a mandatory GAK bill goes to >the House floor, all Rep. Solomon etc. have to do is wave around a >shrinkwrapped copy of PGP and say: "I bought this for $19 at the Egghead >shop at 21st and L." Details will be lost in the fearmongering. While I suspect that new key recovery or CMR products may create some new traction for supporters of mandatory GAK, PGP 5.5 is not the first example of such a product (TIS has been marketing key recovery products for a while). More importantly though, the Blaze et al study (http://www.crypto.com/key_study) did not say that key recovery/key escrow systems can't be built. It said that such systems designed to meet law enforcement specifications (24/7 real time access, the infrastructure for key exchanges, and security considerations necessary for such a system to function) are beyond the scope of the field and would create significant vulnerabilities in the network. This is an important distinction. So far, Soloman, the FBI, nor other mandatory GAK supporters have said that PGP 5.5 or other key recovery products on the market today solve their so-called 'problems'. I don't really expect them to. They seem to want much much more. Jonah * Value Your Privacy? The Government Doesn't. Say 'No' to Key Escrow! * Adopt Your Legislator - http://www.crypto.com/adopt -- Jonah Seiger, Communications Director (v) +1.202.637.9800 Center for Democracy and Technology pager +1.202.859.2151 PGP Key via finger http://www.cdt.org http://www.cdt.org/homes/jseiger From declan at well.com Wed Oct 22 11:41:58 1997 From: declan at well.com (Declan McCullagh) Date: Thu, 23 Oct 1997 02:41:58 +0800 Subject: puff pieces vs tough crypto issues (Re: Singapore TOILET ALERT) In-Reply-To: Message-ID: At 14:06 -0400 10/22/97, Jonah Seiger wrote: >While I suspect that new key recovery or CMR products may create some new >traction for supporters of mandatory GAK, PGP 5.5 is not the first example >of such a product (TIS has been marketing key recovery products for a >while). Of course TIS has been doing this forever. But TIS, a shop staffed by former NSA spooks, is not the PGP that Phil Zimmermann founded. For PGP to release such a product changes the political dynamic in important ways. >More importantly though, the Blaze et al study >(http://www.crypto.com/key_study) did not say that key recovery/key escrow >systems can't be built. In fact it said: "Building the secure infrastructure of the breathtaking scale and complexity that would be required for such a scheme is beyond the experience and current competency of the field." Sounds like "can't be built" to me. >So far, Soloman, the FBI, nor other mandatory GAK supporters have said that >PGP 5.5 or other key recovery products on the market today solve their >so-called 'problems'. I don't really expect them to. They seem to want >much much more. I agree that PGP 5.5 doesn't meet the FBI's demand for realtime access. But it can be used as a waving-around-on-the-House-floor prop to pass a law that requires mandatory key escrow. -Declan From jon at pgp.com Wed Oct 22 11:58:27 1997 From: jon at pgp.com (Jon Callas) Date: Thu, 23 Oct 1997 02:58:27 +0800 Subject: PGP 5.5 CMR/GAK: a possible solution In-Reply-To: <877514566.20581.193.133.230.33@unicorn.com> Message-ID: <3.0.3.32.19971022113904.00bca690@mail.pgp.com> At 03:02 AM 10/22/97 -0700, mark at unicorn.com wrote: Thanks. I want to add that what's in 5.5 is hardly what we think is perfect. The system is designed simply to be preferable to key escrow. We have some improvements we're planning for it in the future. So you're right -- it's a short-term solution. The current system sends out a user's personal key, with a tag to say that if I don't encrypt to the company as well, my mail will bounce. But think about this: how often do I want to send email to a particular person in a company, and ensure that only they see it? And how often do I want to send mail to a particular group inside a company? All I want is to ensure that I get a response from the company, I usually don't care who I talk to in the process. You have it mostly right. There's a tag in a self-signature that says, "please encrypt to this other key, too." The only time you are required to encrypt to Alice's other key is if you and Alice share the same additional key (and not always even then). So PGP's "everything private unless you choose to make it public" system seems backwards. Surely what we really need to meet these customer demands is an "everything public (within the company) unless you choose to make it private" system? That is, all mail to my department inside the company should be encrypted to a department key, shared by all members, *unless* it is confidential, in which case it should *only* be encrypted to me. This is certainly possible with the system, and in fact easier to implement than anything else. Here's how I see this working: when Joe Blow joins Foo-Bah Cryptosystems, he creates his own personal PGP key. He also gets a copy of the department key, which he can use to decrypt any mail which is encrypted to his department; or this decryption could be handled automatically by a department email server to ensure that individuals never have access to the department's private key. PGP then creates a public key for 'Joe Blow ', which would be the department key with a signed tag linking it to his personal public key. This is the tagged corporate public key which he would give out to any customers. When a customer wishes to send email to Joe, he would use this public key. When encrypting, PGP would detect the tag and put up a dialog box pointing out that this is a corporate key and if they click on the 'confidential' button it will be encrypted to the user's personal key prior to encrypting to the corporate key (by which I mean superencryption, to avoid traffic analysis). The default would be not to superencrypt; and as a side effect this system would be compatible with any version of PGP for non-confidential mail (assuming that version understands the encryption algorithms in use). The effect of this is that if someone wants to send email about an urgent bug and I'm out at lunch, any of my co-workers can read that mail. But if they want to send *me* mail about confidential inter-company negotiations, the co-workers could decrypt the outer layer of the message, but would be blocked by the inner layer encryption to my personal key. As I see it, this system is simple, solves the problems which PGP claim they need to solve without creating the snooping problems Tim and others have discussed, cannot easily be adapted to GAK ('This message is to be encrypted to the FBI public key. If it is confidential, click here to superencrypt to the recipient's personal key'), and won't require a massive change to the PGP source code. This is exactly CMR. The only thing that Business 5.5 does is automatically add the department for you, and put up the recipient dialog so it can be taken off. Congrats. There are some obvious security issues with having the department key shared amongst the members of the department, but I don't see that they are any worse than PGP's current CMR implementation, which has already discussed the use of department keys; it's certainly better than using plaintext. There are also problems with encrypting confidential mail to multiple recipients, but they're surmountable; an easy solution, if you don't care about traffic analysis, is to only encrypt confidential mail to the personal key rather than superencrypt with the corporate key. In most cases such mail wouldn't be sent to multiple recipients anyway. So here's how I'd see the simple system working: A PGP CMR key would consist of 1. A corporate key; this might be company-wide, department-wide, or an individual escrowed key; this choice is a seperate key-management issue for the corporation. 2. Optionally a personal key, which could only be decrypted by the individual. 3. A signature from the corporate key linking the personal key to it and the specified User Id. 4. Optional flag to indicate which key to encrypt to by default. 5. User Id, signatures, etc When PGP was asked to encrypt to such a key, it would check for the optional personal key. If it wasn't there, it would put up a warning box to tell the user that the message can be read by people other than the recipient. If it is, then it would put up a dialog box allowing the user to choose whether to encrypt to the corporate key or the individual key, normally defaulting to the corporate key. This system could not easily become GAK because it will only encrypt to one of the keys and not both; the FBI could create FBI CMR keys from all our public keys, but then PGP would either encrypt to the FBI and I wouldn't be able to read it, or encrypt to me and the FBI wouldn't be able to read it. Anyone care to pick any holes? Looks good from here. You've redesigned PGP 5.5. Thanks. Jon ----- Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) From aba at dcs.ex.ac.uk Wed Oct 22 12:01:36 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Thu, 23 Oct 1997 03:01:36 +0800 Subject: PGP 5.5 CMR/GAK: a possible solution In-Reply-To: <199710221555.RAA01080@basement.replay.com> Message-ID: <199710221847.TAA04530@server.test.net> Anonymous writes: > mark at unicorn.com writes: > > > > [super encrypt instead of CMR] > > Neat, automatic superencryption. > > Could the same idea work with the Pgp method with the CMR key? You > would encrypt to the user first, then reencrypt to the combination > of user and CMR key. I think that is redundant -- if only the user can decrypt to get the actual plaintext -- you'd just as well send encrypted to the user alone. Super encrypting with a non-CMRed company key is perhaps what you are thinking, and then encrypting internally to user and CMR key. This would be a definate improvement over straight forward CMR because it is effectively a poor-mans Transport Level Security (TLS), and therefore denies access to the ciphertext (and attached CMR recovery info) to governments and other intruders. Still I think better yet not to send recovery information over the wire at all, unless there is a user requirement for message screening. The stated corporate user requirement for CMR by PGP Inc is recovery of stored files. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710221838.TAA04516@server.test.net> Declan McCullagh writes: > The relevance? Another example of Singapore's loony politics. Strict social > controls and relative economic freedom. I find it fascinating in light of > Net-filtering and other attempts at restricting information flow; if you > don't, well, you can always delete it. :) The net-filtering and social control aspects of Singapore are very interesting. Seems that somewhere like Singapore might be an earlier adopter of mandatory GAK -- social ills have hugely disproportionate treatment over there. I hear (and our Singaporean contributer confirms) that chewing gum is illegal, jay walking too. (Hey you have the jay walking laws in the US too don't you?) (I missed the social control aspect of the vote for kewlest public toilet story). We all suffer this kind of mind numbing stupidity on part of our governments to some extent. Outlawing of `rambo' knives, laws defining pi = 3, etc., etc. > [CMR topic:] My position is something along these lines: > corporations have a right to go down the CMR path; it is unwise to > restrict them through the coercive power of the state. The question is really what _is_ the CMR path? PGP Inc are arguing that it is merely a recovery procedure to recover stored data in event of disaster (stored emails in mail folders, and files encrypted to yourself). However the design seems itself much more suited to message screening, or message snooping. I have yet to see any PGP Inc representative admit to the message screening design motivation. In fact they have fairly clearly denied this. Either you believe that, or you figure they are being careful not to admit to this. I don't know what to believe. The CDR approach (http://www.dcs.ex.ac.uk/~aba/cdr/) is more secure, less politically dangerous, and equally privacy respecting. > At the same time, we need to speak out against crypto-foolish > practices. If corporations start building CMR products, the > political consequences could be devestating. It's like building a > gallows for your own hanging. Yes, I think it is potentially dangerous. > >From my perch in Washington, I see PGP 5.5/CMR as an existence proof that > key recovery can be done. So far the crypto-advocates have been able to > wave around the Blaze et al white paper that says we don't know how to do > it. Even Dorothy Denning agreed. But now when a mandatory GAK bill goes to > the House floor, all Rep. Solomon etc. have to do is wave around a > shrinkwrapped copy of PGP and say: "I bought this for $19 at the Egghead > shop at 21st and L." Details will be lost in the fearmongering. This is one example of why CMR may be dangerous. Another is the danger that we have a couple of years of mass CMR enabled software deployed. Tim has been using the acronym GMR, which nicely says what a well deployed CMR software base can be converted to with an over night presidential decree. Lethal. > I suspect that there's not that substantial a market for CMR. The apparent > market demand now is an artificial one created by the Clinton > administration. Again, what _is_ CMR? I do think companies if they are storing lots of data in encrypted form will want to assure themselves that they can get it back. Sort of like unix/windows NT passwords; if every time users forgot their password, you had to start over with an empty account, people would get annoyed. The problem is that pgp5.x is both an email encryption system and a file encryption system. So PGP Inc argue that they need the recovery features for files. Well OK, but for emails in transit? The way to treat emails in transit is to encrypt with recovery info after receipt, if the employee feels that particular email is worthy of saving for company records. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <3.0.3.32.19971022120251.00bf7b30@mail.pgp.com> At 01:46 PM 10/22/97 +0100, Adam Back wrote: Mark Grant writes: > The current system sends out a user's personal key, with a tag to say that > if I don't encrypt to the company as well, my mail will bounce. But think > about this: how often do I want to send email to a particular person in a > company, and ensure that only they see it? And how often do I want to send > mail to a particular group inside a company? All I want is to ensure that > I get a response from the company, I usually don't care who I talk to in the > process. The CMR feature in pgp5.5 isn't so far intented to cope with this scenario I think. That's because pgp5.5 I understand can only generate keys with one CMR request field. Well, Adam, you are yet again describing it wrong. You can put in N of them. You are right that the 5.5 UI isn't general. Something had to slip. Also, there's another thing you're not describing correctly. This is not a feature of the key -- it's a feature of the user name, and included in a user name's self signature. It can be changed at any time, and you can even have an ambivalent key that has a username with the CMR packet (salesdweeb at foobar.com) and a without it (jblow at foobar.com). Problem for both approaches is re-keying: what happens when Fred leaves the sales team to work for a competitor. Revoke the shared key and start over? Or with the CMR method, revoke just the CMR request for Fred, and allow key servers to remove CMR requests when presented with a suitable CMR request revocation cert? (How often will senders check key servers for revocation certs?) Or have short expiries on encryption-only keys (one per day?), so that they key update happens soon enough anyway. (pgp5.x allows for short lived encryption keys directly because of the separation of signature and encryption keys, the WoT applies to the signature key). This is why any sort of shared or escrowed keys suck. But in most cases it's good enough, because when Fred leaves sales, he loses access to the sales computers. In most of these cases, when someone decrypts something with the sales key, it ends up going into the order system in plaintext anyway. However, one of the features of the new PGP key format is that you can change encryption keys easily. If you Really it seems to me that actually having half a dozen sales droids sharing a key, or being able to decrypt a message because they are all CMR enforced multiple crypto recipients is a security nightmare either way :-) Reckon it would be arguably more secure to have the SMTP policy enforcer decrypt it for them, even. Really? You think the SMTP agent should be decrypting? Wow. I don't. I think that's *really* intrusive, and worse than what we did. Interestingly enough, there are a number of people (like Bruce Schneier) who have no problem with the additional encryption part, but think that the SMTP agent is the work of the devil. Expect pushback. Another method of authenticating TLS is to base the authentication on the user's PGP WoT. Include authentication information to the delivery agent which is capable of TLS, which is also exchanged inside the encryption envelope. (Eg. transfer an authentication symmetric key k1 inside the encryption envelope; send the local TLS capable SMTP hub / SMTP policy enforcer the key k1. The TLS forward secret key negotiation can then be authenticated using this key. The remote TLS system can tack the authentication information on to the delivered message, in a header, or otherwise, and the recipient can check the authentication). Note that the user's WoT is stored in the user's keyring. There's an operational problem here. This means that the MTA has to have access to all users' pubrings. This is not a good thing, to my mind. > So PGP's "everything private unless you choose to make it public" system > seems backwards. Surely what we really need to meet these customer demands > is an "everything public (within the company) unless you choose to make it > private" system? That is, all mail to my department inside the company > should be encrypted to a department key, shared by all members, *unless* > it is confidential, in which case it should *only* be encrypted to me. I think what PGP are arguing for is ability to recover stored messages even if they are intended for one recipient only. As I think has been established this can be acheived by storage recovery, without exposing communications traffic to the associated risks. It is possible that there is an unstated perceived user requirement, that the messaging standard be able to allow third party access to the communications traffic directly. Nope, that's not what we're arguing for. What we're arguing for is an alternative to key escrow -- the kind where your employer keeps your secret key just in case they need it. Jon ----- Jon Callas jon at pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) From aba at dcs.ex.ac.uk Wed Oct 22 12:31:57 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Thu, 23 Oct 1997 03:31:57 +0800 Subject: PGP, Inc.--What were they thinking? In-Reply-To: Message-ID: <199710221921.UAA05327@server.test.net> Tim May writes: > Declan writes: > >[...]all Rep. Solomon etc. have to do is wave around a > >shrinkwrapped copy of PGP and say: "I bought this for $19 at the Egghead > >shop at 21st and L." Details will be lost in the fearmongering. > > Yep, they're already doing this. This was reported a week or so ago, > somewhere here in Cypherpunks. Another interesting thing was that the French picked up on it too -- very interesting for them because they are just switching from crypto-ban to mandatory GAK. I suspect if PGP Inc could get an export license they would buy in to it heavily. (Fabrice Planchon , and Jean-Francois Avon kindly translated a French document on the web "pgp tows the line" or something like that I think was the consensus they arrived at on correct translation of the title of the document). The indirect other danger is that in going the CMR route, PGP Inc may be standards setters either through the OpenPGP standard, or outside of it (in a similar way to the way netscape extensions are supported by many vendors long before they are part of HTML 3.x or whatever). If CMR becomes the standard, this greatly simplifies the task of TIS, or TIS europe, or anyone else in building a much more GAK friendly product which can interoperate with OpenPGP. I think I saw a tis.com address on ietf-open-pgp discussions list and wouldn't be surprised if they are busy building TIS OpenPGP compliant GAKware right now. A second indirect danger is that by taking this approach PGP Inc damages itself by isolating itself from the large cypherpunk and pro-privacy community, and that an even less friendly crypto email standard wins by default. How much protection do we have in S/MIME vendors. We were relying on PGP Inc to set the pro-privacy, anti-GAK line, and then we all would have been behind them in pushing the OpenPGP standard ahead of other standards because of it's GAK resistance. As it is various cypherpunks are scrambling trying to keep the OpenPGP standard a CMR free-zone, at least as a temporary measure for this version of the standard. As to what PGP Inc were thinking, I'm not sure I understand what they were thinking ... Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: At 11:38 AM -0700 10/22/97, Adam Back wrote: >This is one example of why CMR may be dangerous. Another is the >danger that we have a couple of years of mass CMR enabled software >deployed. Tim has been using the acronym GMR, which nicely says what >a well deployed CMR software base can be converted to with an over >night presidential decree. Lethal. About "GMR," I use it only because it's a direct parallel to CMR, with "Government" replacing "Corporate." In fact, as others also suspect, I anticipate some countries will mandate the precise form CMR is taking in PGP 5.5, with a requirement that the corporate keys be given ("escrowed" in the older terminology) to government agencies. This would actually take very little in the way of additional regulation in many countries--the same departments of corporations which file various reports with the government would be compelled to provide keys. GMR is CMR with the government being one of the keyholders. And the users need not even be involved in this...all that is needed is an order, or finding, by the SEC, FTC, IRS, etc., that CMR keys be deposited with the government. (When the Justice Department was suing IBM and AT&T and demanding every scrap of paper they could get, including thousands of boxes of documents, wouldn't they have surely demanded the CMR keys, had they existed back then? Were Microsoft to be using CMR, don't you expect these keys will be demanded by Janet Reno? This, by the way, ought to be reason enough for MS to abandon its internal programs on message recovery. But I wouldn't be surprised if failure to adopt CMR is itself seen as part of a conspiracy to thwart government investigations...speculating wildly, this may be a reason many companies adopt CMR, and why many other companies eschew CMR.) In the U.S., there may be various challenges to the constitutionality of this. Certainly some organizations--hospitals, psychiatric facilities, newspapers, etc.--will have First and Fourth Amendment claims, e.g., protection of confidential sources, protection of medical privacy, etc.. Will XYZ Corporation have such protections? Unclear to me. (Recall the Jim Choate mantra that "only individuals have rights.") I don't mean for GMR to replace GAK, which has served us so well for several years (since being coined by Carl Ellison, of course). But the Newspeak everyone is using is "message recovery," with a disaster planning spin on it (however incorrectly), so maybe we should change with the times, too. "GMR" serves to deconstruct and monkeywrench the CMR term. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From tcmay at got.net Wed Oct 22 13:25:05 1997 From: tcmay at got.net (Tim May) Date: Thu, 23 Oct 1997 04:25:05 +0800 Subject: PGP 5.5 CMR/GAK: a possible solution In-Reply-To: <877514566.20581.193.133.230.33@unicorn.com> Message-ID: At 3:02 AM -0700 10/22/97, mark at unicorn.com wrote: >The current system sends out a user's personal key, with a tag to say that >if I don't encrypt to the company as well, my mail will bounce. But think >about this: how often do I want to send email to a particular person in a >company, and ensure that only they see it? And how often do I want to send >mail to a particular group inside a company? All I want is to ensure that >I get a response from the company, I usually don't care who I talk to in the >process. Our mileages apparently vary. When _I_ send a message to, say, Jon Callas at PGP, Inc., it is to Jon Callas, not to others. It might be a job offer, it might be an invitationf for him to help monkeywrench CMR, it might be a stock tip, it might be a comment about a conversation we had a party, it might be a lot of things. If I was sending it to "Jon's coworkers in Department Z," I probably either wouldn't encrypt it at all, or would (if the option existed) encrypt to some departmental or group key. In fact, addressing your "how often do I want to send email to a particular person in a company, and ensure that only they see it?" point, I'd say that virtually all I've sent is of this "to one person and not to others" sort. Sure, sometimes I send bug reports to software vendors and to my ISP, and then I don't know, or care, who reads it. But if I send mail to Vinnie, or to Phil, or to Dave, or to Jon, I expect it'll go to them and to them alone. Who they show it to afterwards is, obviously, beyond my control and outside the scope of cryptography. I don't dispute the "right" of a business owner to enforce use of CMR on his employees, or to bounce my mail for failing to properly CMR the message I send. I expect those who adopt CMR will find an awful lot of folks will just give up on trying to communicate with those living in a CMR regime. A lot of folks will be using older, non-CMR, versions of PGP for many years to come. (Even if older versions support the additional CMR keys, which I'm sure they could do by adding the CMR key to the appropriate keyring, a lot of folks will just skip the additional complexity...when they want to send a message to someone, they won't want to bother with additional keys, bounced messages, etc.) Now what Phil, Vinnie, Dave, and Jon will likely do if CMR is enforced within PGP, Inc. is to tell those who want to send them job offers, personal messages, etc. to use back channels, e.g., prz at acm.org, AOL accounts, hotmail accounts, etc. So much for Corporate Message Recovery. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From declan at well.com Wed Oct 22 13:25:42 1997 From: declan at well.com (Declan McCullagh) Date: Thu, 23 Oct 1997 04:25:42 +0800 Subject: Unlocking crypto-secrets Wired article -- request for help Message-ID: I'm working on a Netizen article for Wired Magazine on secret crypto-briefings and thought I'd ask the list for help. You know the briefings I'm talking about -- classified sessions where the FBI director, the Commerce Dept, NSA, and occasionally anti-drug officials pressure Congressmen to place restrictions on encryption. Sometimes it works, and our elected representatives vote to put strict limits on encryption technologies. (The secret briefings certainly seemed to work on the House Commerce committee.) I'd like to unlock those closed doors. If anyone has insights into what happens during these sessions, I'd be very interested in learning more. Pointers to open sources would be great. I will keep your identity confidential. I'd also be interested in learning more about the secret briefing practices of other countries. Please feel free to recirculate this message. I've attached my PGP key below. Please use it sparingly; I keep my private key on a non-networked machine and it's laborious to move data back and forth. If you want to send a tip through an anonymous remailer, a web-based one is at: http://www.replay.com/remailer/anon_no_ssl.html Thanks, Declan ****************** http://www.well.com/user/declan/.pgpkey PGP Key fingerprint = F4 0A 36 1F 7F B1 4B CB 5C 38 2C 13 FE 1E 4D 80 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzF5mVcAAAEEALKyL4tjF7t4h+hmbY+q0b0FdSZy3dx8LuUwkTmAY6Ib/YX7 WhZR22+T1Tts/JaC7iAhr/zfxI9IrHqT1C7NV/aqdEVAuI+pjYKpcRKOU7i0ccAx db/jddUvzX4bjqKQQLLcOihcle6BD2+7vEXxaaMOA5nTU5i/Sn7vt7V2BpKxAAUT tCJEZWNsYW4gTWNDdWxsYWdoIDxkZWNsYW5Ad2VsbC5jb20+iQCVAwUQMXmajn7v t7V2BpKxAQG6NAP/RUEBrnFfR6vbIdoAeyt2jXsuPPcH944mnyp4fNLH3OEzQlj6 tXee9eYaqazUgkLNCyWXDDGQJxsok58hqIEOHoTgilAcomMW3mIoqN7uMIevyvmo NH170+a6drNwY4kNXNUsDDx6qfgQz5wTxaVyxbZuyslX1k3kDID8vPSyxbs= =dofB -----END PGP PUBLIC KEY BLOCK----- ****************** From aba at dcs.ex.ac.uk Wed Oct 22 13:42:37 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Thu, 23 Oct 1997 04:42:37 +0800 Subject: PGP 5.5 CMR/GAK: a possible solution In-Reply-To: <3.0.3.32.19971022113904.00bca690@mail.pgp.com> Message-ID: <199710221948.UAA05752@server.test.net> Jon Callas writes: > At 03:02 AM 10/22/97 -0700, mark at unicorn.com wrote: > [CMR tagged keys description] > > You have it mostly right. There's a tag in a self-signature that says, > "please encrypt to this other key, too." The only time you are required to > encrypt to Alice's other key is if you and Alice share the same additional > key (and not always even then). "Not required to encrypt to CMR key" but "mail will bounce which doesn't encrypt to CMR key" seems like a fairly small distinction to me. So you don't have to encrypt to the CMR key, but if you don't the message won't get there? (Of course only when strict flag is set on policy enforcer, and user id on key you are sending to has CMR request tag). Sort of like: you can dial the phone number wrongly if you want, it's your choice (to avoid phone tap). And yes you can bypass it, if you're technical, but most people aren't. And the bypass can be detected if anyone is checking. > So PGP's "everything private unless you choose to make it public" system > seems backwards. Surely what we really need to meet these customer demands > is an "everything public (within the company) unless you choose to make it > private" system? That is, all mail to my department inside the company > should be encrypted to a department key, shared by all members, *unless* > it is confidential, in which case it should *only* be encrypted to me. > > This is certainly possible with the system, and in fact easier to implement > than anything else. Sounds like a simpler interim solution, if that's what CMR reportedly is? > The effect of this is that if someone wants to send email about an urgent > bug and I'm out at lunch, any of my co-workers can read that mail. But if > they want to send *me* mail about confidential inter-company negotiations, > the co-workers could decrypt the outer layer of the message, but would be > blocked by the inner layer encryption to my personal key. > > As I see it, this system is simple, solves the problems which PGP claim > they need to solve without creating the snooping problems Tim and others > have discussed, cannot easily be adapted to GAK ('This message is to be > encrypted to the FBI public key. If it is confidential, click here to > superencrypt to the recipient's personal key'), and won't require a > massive change to the PGP source code. > > This is exactly CMR. The only thing that Business 5.5 does is automatically > add the department for you, and put up the recipient dialog so it can be > taken off. Congrats. It's close, but not quite the same. The major distinction is that Mark wasn't proposing leaving recovery information sticking out on email traffic going over the Internet in the form of CMR extra recipients. (Also Mark wasn't proposing bouncing mail which didn't meet requirements) I you have a policy enforcer set to allow all mails through (no strict setting), then what Mark described does sound similar at first glance, but there is actually a very significant difference: there is no message recovery concept: just emails are encrypted to who they're meant to be sent to. (In one case the individual, in the other case the department). The outer encryption layer I don't think actually adds anything in this case (other than potentially extra security if the individual's passphrase is poor). Given that, couldn't the same be achieved with 0 modifications? Have different keys, some shared, some not. sales at acme.com fred at acme.com jane at acme.com with sales at acme.com key shared between sales manager and sales persons? Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710222033.VAA05775@server.test.net> Jon Callas writes: > The CMR feature in pgp5.5 isn't so far intented to cope with this > scenario I think. That's because pgp5.5 I understand can only > generate keys with one CMR request field. > > Well, Adam, you are yet again describing it wrong. You can put in N of > them. You are right that the 5.5 UI isn't general. I did understand that even pgp5.0 standard allows multiple CMR keys, but I thought that the pgp5.5 UI doesn't allow generation of keys with more than CMR packet per userid... so sounds like we agree? One thing I never did get clear is: does pgp5.0 know how to reply to the CMR denoted extra recipients? > Also, there's another thing you're not describing correctly. This is not a > feature of the key -- it's a feature of the user name, and included in a > user name's self signature. It can be changed at any time, and you can even > have an ambivalent key that has a username with the CMR packet > (salesdweeb at foobar.com) and a without it (jblow at foobar.com). Excuse me, yes, I have been tending to talk about the CMR being attached to the key, while it is actually attached to the userid, of which there can be many. I tended to view this as a valid simplification, because, if I understood correctly, the pgp5.5 business suite allows an administrator to configure the pgp5.5 client which employees will be using to enforce that there _will_ be a CMR packet on all userids? And also most users are likely to have just one userid. In other words, I am not denying any of the functionality that it does have, in being able to be used in privacy respecting ways, but rather I am describing the most strict settings that the software attempts to enforce if so configured. This is still interesting because one suspects some companies will use it this way, otherwise the functionality wouldn't have been provided. > [...] > > This is why any sort of shared or escrowed keys suck. But in most cases > it's good enough, because when Fred leaves sales, he loses access to the > sales computers. It's not that good because even though he loses access to the computers, if he retains a copy of the private key, he (or the competitor he has left to join) can fairly easily obtain the ciphertext of emails. Proxy encryption is a good solution to this, if it works for the EG keys you are using. Or super encryption or TLS to protect the company internal multiple crypto recipients. I am not so much against CMR crypto recipients per se, as I am against allowing these to show outside the LAN -- too tempting for governments. > Really it seems to me that actually having half a dozen sales droids > sharing a key, or being able to decrypt a message because they are all > CMR enforced multiple crypto recipients is a security nightmare either > way :-) > > Reckon it would be arguably more secure to have the SMTP policy > enforcer decrypt it for them, even. > > Really? You think the SMTP agent should be decrypting? Wow. I don't. It clearly could be more secure in some environments, with crypto illiterate users who can't remember good passwords, or who have tendency to write them down. If they're all sharing keys because they're all part of the same sales team, and the traffic is fairly low security, I wouldn't discount it out of hand. > I think that's *really* intrusive, and worse than what we did. I think that is where we differ ... you focus on privacy principles, and end up having less security and less resistance to government abuse. The above is merely an ergonomics trade off for some environments. It doesn't overly help governments snoop, and can be used where appropriate. You can still have individual personal use keys, or any other privacy respecting architecture. If we were to argue about how systems could be abused (either government or company abuse) CMR could be abused with an enforced CMR key on all company keys, and some software to read all mail before delivery, and approve all mail on the way out. CMR could also be potentially be abused by governments in passing laws saying communications keys must have government as a CMR recipient, and in being able to enforce this by spot checking emails in transit, and/or via deputised ISPs with binding cryptography used to allow untrusted fourth parties to check session keys match. > Interestingly enough, there are a number of people (like Bruce > Schneier) who have no problem with the additional encryption part, > but think that the SMTP agent is the work of the devil. The enforcement part of it is :-) Multiple encryption over done with too many long term keys also tends to be a security risk. Basing recovery procedures on storage recovery avoids this trend, and avoids the need to have recovery of communications keys at all for the defined corporate user requirement. > Another method of authenticating TLS is to base the authentication on > the user's PGP WoT. Include authentication information to the > delivery agent which is capable of TLS, which is also exchanged inside > the encryption envelope. (Eg. transfer an authentication symmetric > key k1 inside the encryption envelope; send the local TLS capable SMTP > hub / SMTP policy enforcer the key k1. The TLS forward secret key > negotiation can then be authenticated using this key. The remote TLS > system can tack the authentication information on to the delivered > message, in a header, or otherwise, and the recipient can check the > authentication). > > Note that the user's WoT is stored in the user's keyring. There's an > operational problem here. This means that the MTA has to have access to all > users' pubrings. This is not a good thing, to my mind. No, I think you misunderstood the above. MUA sends X-MTA-authentication only if the MTA is TLS aware, then it sends: To: fred at acme.com X-MTA-auth: 12345678 -----BEGIN PGP MESSAGE----- blah blah -----END PGP MESSAGE----- the local MTA strips out X-MTA-auth info. Local MTA does a DH key exchange with the remote MTA. Local MTA encrypts with symmetric cipher (say IDEA or something) the hash of DH parameters and negotiated DH key with X-MTA-auth key, and puts back in header: X-MTA-auth: abcd1234abcd1234abcd1324abcd The receiving MTA leaves that alone, but adds a line telling the MUA the DH key hash: X-MTA-key: 567856785678 The MUA hands the X-MTA-auth line to the pgp implementation, together with the encrypted message. You have another packet inside the pgp encryption layer which tells the receiving MUA the sending client's info... and PGP can check the authenticate the DH key exchange after the fact. If there is a MITM you will know about it. Neat because it doesn't require separate key infrastructure which always ends up having less meaning to the user being down at the mail hub level. And yet you have real interactive perfect forward secrecy. > It is possible that > there is an unstated perceived user requirement, that the messaging > standard be able to allow third party access to the communications > traffic directly. > > Nope, that's not what we're arguing for. OK, thanks. I'll stop speculating on that one then. > What we're arguing for is an alternative to key escrow -- the kind > where your employer keeps your secret key just in case they need it. Please read: http://www.dcs.ex.ac.uk/~aba/cdr/ It also avoids key escrow for communication keys, and allows separate personal and company use storage keys, makes recommendations for sender and receiver statement of intent about plaintext handling, has more ergonomic recovery options, and allows more secure more frequent communication key updates. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: On Wed, 22 Oct 1997, Mike wrote: > >> Which leads to another idea, couldn't we encrypt SMTP by running it over > >> SSL as a web server cgi? If 99% of Internet traffic is web browsing and we > >You don't need to run it through a CGI. There's a port defined for > >SMTP-over-SSL: > > Sure, but the idea here was hiding email to defeat traffic analysis. Ssmtp > would raise alarms in any snopper but https would seem like business as Well, that wasn't *my* idea. My idea was to hide the contents of mail from totally passive attackers, and to do it with NO participation or training from the end users, MINIMAL participation and effort from the sysadmin, and transparent compatibility (minus security, of course) with standard mail systems. I claim that this combination of goals is worth pursuing; I recognize that there are systems which provide better security, but it's at the cost of some of my other goals. You want to defeat traffic analysis, use remailers. You want security against active attacks, use PGP (or equivalent). If you want these things to be really easy, you'll be stuck with talking only to systems you know support whatever application you're using. A significant advantage of an encryption extension to SMTP is that it requires no prior coordination between the two ends of a link. I don't have to know whether the destination system supports encrypted SMTP, and I don't need to try connecting to the "secure mail" port and then fall back to regular mail every time I connect to a system I haven't been introduced to. I just have to watch for the encryption extension in the list of extensions that current SMTP mailers already exchange when they connect to each other. My threat model is that the NSA is tapping thousands of people's lines; what can we do to make that impractical? > A significant threat to online privacy comes from passive attackers, > because you can't do anything about them. If you have an active attacker, > you can analyze his moves and fix the bugs he uses to break root, but a > passive attack is difficult to even detect before it's too late and your > romantic conversations are headline news. Solutions like PGP won't see much use beyond people who care about privacy, and at the moment there aren't enough of those. But if encrypted SMTP is installed on *systems*, then all mail between such systems becomes protected from purely passive wiretapping. Yes, it can still be traffic-analysed, but only on the level of "this system sent this much mail to that system", not "this user sent this much mail to that user". It can still be intercepted by an active attack - if the NSA can fool my TCP into thinking it's talking to mail.aol.com, then all my mail to mail.aol.com is readable by NSA (unless the protocol gets elaborated to do more sophisticated key management than just exchanging public keys at the start of the session, but that quickly requires user involvement and I want to avoid that). However, can the NSA afford to do DNS spoofing on a grand scale? They might do it for one system if they want to get that system's mail in particular, but if you've got the NSA singling you out, you had better be using PGP anyway. I'm sure they can't do an active attack on thousands of ordinary people at a time, just in case we might be doing something interesting. I'm also not sure that traffic analysis on ordinary people is really going to produce any particularly damaging information. They *can* afford simple passive wiretaps on a large scale. (Substitute your favorite scary organization for "NSA" if you prefer...) From nobody at REPLAY.COM Wed Oct 22 14:09:20 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 23 Oct 1997 05:09:20 +0800 Subject: PGP, Inc.--What were they thinking? Message-ID: <199710222045.WAA03143@basement.replay.com> >Agreed. What amazes me is how PGP, Inc. would decide this should be a core >part of their company. "PGP for Business," indeed. What were they thinking? Um, maybe that they wanted to stay in business? From rah at shipwright.com Wed Oct 22 14:25:07 1997 From: rah at shipwright.com (Robert Hettinga) Date: Thu, 23 Oct 1997 05:25:07 +0800 Subject: Federal Key Recovery Demonstration Project ?! Message-ID: --- begin forwarded text Date: 20 Oct 1997 14:29:39 -0400 From: Mark Atwood (by way of rah at shipwright.com (rah-news)) To: rah at shipwright.com Subject: Federal Key Recovery Demonstration Project ?! Mime-Version: 1.0 Path: thing1.leftbank.com!thing2.leftbank.com!cam-news-feed2.bbnplanet.com!cam-news-hu b1.bbnplanet.com!cam-news-feed5.bbnplanet.com!news.bbnplanet.com!ftp.ampersand.c om!not-for-mail Newsgroups: talk.politics.crypto Organization: Ampersand, Inc. Lines: 62 NNTP-Posting-Host: colon.ampersand.com X-Newsreader: Gnus v5.2.40/Emacs 19.31 Xref: thing1.leftbank.com talk.politics.crypto:23766 X-Newsreader: Yet Another NewsWatcher 2.3.0 -----BEGIN PGP SIGNED MESSAGE----- Just saw the fallowing ad on pg 42 of Federal Computer Week, Vol 11, Num 33, Oct 20, 1997. If I was closer, I would go, just to see what the "enemy" has to demonstrate. ================================================== The Government Information Technology Services Board Federal Key Recovery Demonstration Project invites you to attend A TECHNOLOGY CONFERENCE Wednesday, November 15, 1997, Omni Shoreham Hotel, Washington DC 7.30 a. m. - 8: 00 a. m. Conference with exhibit demonstrations following from 8:00 a.m. - 5:30p.m. For details, visit out Web site: http://gits-sec.treas.gov or contact Lisa McGrady Pellegrin at (202) 293-3835 or Terry Painter at (202) 986-0200 Registration fee: $100.00 (includes breakfast, lunch) To register, please call and mail check by October 24, 1997 payable to: McPell Communications Company 1140 Connecticut Avenue, N.W. Suit 606, Washington, D.C. 20036 ================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAwUBNEui9jecHWvdAD3dAQF2uAP+OJMD/t7wFl1YiHqS+P/Dor0D5lDXOk6S 0b4fkVqeBih/gRwM0UYOxqlpxh7uyHjXyQQIsaLRUtMD3f+Rg3vPkBHubGwPq513 98upODawMD5znT/xUT5TZHeWWxlnisBrmcH308jG1zLYh4Ls1qJat75n2ldj+HWI RhdMsNvIn/Y= =VJyz -----END PGP SIGNATURE----- -- Mark Atwood | Thank you gentlemen, you are everything we have come to zot at ampersand.com | expect from years of government training. -- MIB Zed --- end forwarded text ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: From nugget at slacker.com Wed Oct 22 14:34:34 1997 From: nugget at slacker.com (David McNett) Date: Thu, 23 Oct 1997 05:34:34 +0800 Subject: [rc5] The unknown message is... Message-ID: <3.0.3.32.19971022161452.009824f0@slacker.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It is a great privilege and we are excited to announce that at 13:25 GMT on 19-Oct-1997, we found the correct solution for RSA Labs� RC5- 32/12/7 56-bit secret-key challenge. Confirmed by RSA Labs, the key 0x532B744CC20999 presented us with the plaintext message for which we have been searching these past 250 days. The unknown message is: It�s time to move to a longer key length In undeniably the largest distributed-computing effort ever, the Bovine RC5 Cooperative (http://www.distributed.net/), under the leadership of distributed.net, managed to evaluate 47% of the keyspace, or 34 quadrillion keys, before finding the winning key. At the close of this contest our 4000 active teams were processing over 7 billion keys each second at an aggregate computing power equivalent to more than 26 thousand Pentium 200�s or over 11 thousand PowerPC 604e/200�s. Over the course of the project, we received block submissions from over 500 thousand unique IP addresses. The winning key was found by Peter Stuer with an Intel Pentium Pro 200 running Windows NT Workstation, working for the STARLab Bovine Team coordinated by Jo Hermans and centered in the Computer Science Department (DINF) of the Vrije Universiteit (VUB) in Brussels, Belgium. (http://dinf.vub.ac.be/bovine.html/). Jo�s only comments were that "$1000 will buy a lot of beer" and that he wished that the solution had been found by a Macintosh, the platform that represented the largest portion of his team�s cracking power. Congratulations Peter and Jo! Of the US$10000 prize from RSA Labs, they will receive US$1000 and plan to host an unforgettable party in celebration of our collective victory. If you�re anywhere near Brussels, you might want to find out when the party will be held. US$8000, of course, is being donated to Project Gutenberg (http://www.promo.net/pg/) to assist them in their continuing efforts in converting literature into electronic format for the public use. The remaining US$1000 is being retained by distributed.net to assist in funding future projects. Equally important are the thanks, accolades, and congratulations due to all who participated and contributed to the Bovine RC5-56 Effort! The thousands of teams and tens of thousands of individuals who have diligently tested key after key are the reason we are so successful. The thrill of finding the key more than compensates for the sleep, food, and free time that we�ve sacrificed! Special thanks go to all the coders and developers, especially Tim Charron, who has graciously given his time and expertise since the earliest days of the Bovine effort. Thanks to all the coordinators and keyserver operators: Chris Chiapusio, Paul Chvostek, Peter Denitto, Peter Doubt, Mishari Muqbil, Steve Sether, and Chris Yarnell. Thanks to Andrew Meggs, Roderick Mann, and Kevyn Shortell for showing us the true power of the Macintosh and the strength of its users. We�d also like to thank Dave Avery for attempting to bridge the gap between Bovine and the other RC5 efforts. Once again, a heartfelt clap on the back goes out to all of us who have run the client. Celebrations are in order. I�d like to invite any and all to join us on the EFNet IRC network channel #rc5 for celebrations as we regroup and set our sights on the next task. Now that we�ve proven the limitations of a 56-bit key length, let�s go one further and demonstrate the power of distributed computing! We are, all of us, the future of computing. Join the excitement as the world is forced to take notice of the power we�ve harnessed. Moo and a good hearty laugh. Adam L. Beberg - Client design and overall visionary Jeff Lawson - keymaster/server network design and morale booster David McNett - stats development and general busybody -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNE5sy7N5xKXkPF/DEQLBMwCfadBDxP97DhosT7ILs9vdYRha9nIAnRCl ydiRYhdAplj25nDSZNbXYILS =4dNQ -----END PGP SIGNATURE----- -/\/ugget ________________________________________________________________________ |David McNett |To ensure privacy and data integrity this message has| |nugget at slacker.com|been encrypted using dual rounds of ROT-13 encryption| |Birmingham, AL USA|Please encrypt all important correspondence with PGP!| ---- To unsubscribe, send email to majordomo at llamas.net with 'unsubscribe rc5' in the body. From 0002595870 at MCIMAIL.COM Wed Oct 22 14:39:21 1997 From: 0002595870 at MCIMAIL.COM (Jeffrey Gold) Date: Thu, 23 Oct 1997 05:39:21 +0800 Subject: World-wide GAK Message-ID: <01IP4EPU8GYMANBQBB@DGN0IG.mcimail.com> For those who thought GAK was merely a local political issue, isolated to those barbarians in the USA, one that they could afford to ignore and morally refuse to address -- Quelle surprise! It's spreading: FRANCE PROPOSES KEY ENCRYPTION LAW The French government has proposed a law that would mandate a key-recovery system for all encrypted electronic documents, a move that is opposed by the business community and the European Commission. Earlier this month, the European Commission rejected the key-recovery approach to encryption, which some believe would make it easier for competitors to gain access to a company's business secrets. "I do not say this is the best system," says the chief of France's Central Service for the Security of Information Systems. "It is the least bad in trying to find a balance between national-security interests, economic interests and the protection of personal privacy." (Wall Street Journal 20 Oct 97) From tcmay at got.net Wed Oct 22 14:51:17 1997 From: tcmay at got.net (Tim May) Date: Thu, 23 Oct 1997 05:51:17 +0800 Subject: PGP, Inc.--What were they thinking? In-Reply-To: <199710222045.WAA03143@basement.replay.com> Message-ID: At 1:45 PM -0700 10/22/97, Anonymous wrote: >>Agreed. What amazes me is how PGP, Inc. would decide this should be a core >>part of their company. "PGP for Business," indeed. What were they thinking? > >Um, maybe that they wanted to stay in business? This is a truism, that businesses want to stay in business. (And thrive, etc.) The interesting question is whether this action will help them. Why it may not is what we're talking about. For example, if PGP loses its "little guy fighting the system" image, and the company is seen as a major supplier of snoopware and GMR systems, it will have squandered the good will which led many of us to support PGP. And it's by no means clear that corporations will pay enough for PGP for Business if this good will has been squandered. The free status of most versions of PGP is indeed an impediment to PGP making a profit. That's an unchangeable situation. Lots of copies of PGP are already out there, and lots more are available from many sites. The "commercial use" vs. "personal use" dichotomy is largely unenforceable. If Joe Employee uses PGP 2.6 or even 5.0 for his messages, PGP, Inc. will have a very hard time proving in court that Joe or his employer can be held liable for this use (at most, maybe Joe will have to pay $50 or so...and probably not even that, as PGP 5.0 is not serialized (so far as I can find) and records aren't kept...Joe can just claim he did in fact buy it, blah blah). This means PGP, Inc. faces a Netscape-like battle in finding revenue sources. Will they succeed? Will people like us continue to give PGP, Inc. the good will it has enjoyed? Stay tuned. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From tcmay at got.net Wed Oct 22 15:20:32 1997 From: tcmay at got.net (Tim May) Date: Thu, 23 Oct 1997 06:20:32 +0800 Subject: World-wide GAK In-Reply-To: <01IP4EPU8GYMANBQBB@DGN0IG.mcimail.com> Message-ID: At 2:31 PM -0700 10/22/97, Jeffrey Gold wrote: >For those who thought GAK was merely a local political issue, >isolated to those barbarians in the USA, one that they could >afford to ignore and morally refuse to address -- Quelle surprise! >It's spreading: Yes, this was reported earlier by others. Fabrice Planchon, a native of France (I believe), discussed it at length. And it is not surprising to any of us who have been following developments, vis-a-vis the OECD, Wasenaar Agreement, and New World Order in general. Nor is it by any stretch the first non-US GAK measures proposed. Cf. the Trusted Third Parties plan in the U.K., the Australian developments, and various measures in the Phillipines, Singapore, Germany, Sweden, and, of course, the People's Republic of China. --Tim May >FRANCE PROPOSES KEY ENCRYPTION LAW > >The French government has proposed a law that would mandate a >key-recovery system for all encrypted electronic documents, a >move that is opposed by the business community and the European >Commission. Earlier this month, the European Commission rejected >the key-recovery approach to encryption, which some believe would >make it easier for competitors to gain access to a company's >business secrets. "I do not say this is the best system," >says the chief of France's Central Service for the Security of >Information Systems. "It is the least bad in trying to find a >balance between national-security interests, economic interests >and the protection of personal privacy." > >(Wall Street Journal 20 Oct 97) The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From spencer_ante at webmagazine.com Wed Oct 22 15:21:00 1997 From: spencer_ante at webmagazine.com (spencer_ante at webmagazine.com) Date: Thu, 23 Oct 1997 06:21:00 +0800 Subject: PGP, Inc.--What were they thinking? Message-ID: <88256538.00787D24.00@pcwhub.pcworld.com> With all due respect to Tim May: As a person whose been at work on a very long feature about PGP Inc. for Wired, I can tell you that businesses really don't care that much about PGP's civil liberties advocacy. In fact, its rep could hurt as much as help them. The Fortune 500 is much more pragmatic: They want solutions that work, that help them maintain security for their intellectual property and capital. To that extent, PGP 5.5--which enables IS directors to manage a public key infrastructure and enforce company-wide security policies-- is a step in the right direction. But with this new product, I agree that they run the risk of alienating their core user group of cypherpunks and hackers. Encryption is a very complicated topic that doesn't lend itself well to sloganeering and histrionics. And one major thing that needs to be pointed out: PGP's key recovery system is *voluntary and private*--not mandatory and gov. controlled, which is what the Feds and Louis Freeh have been pushing for. One potential positive side effect of PGP 5.5 is that it could realign the crypto debate and force people to consider this question: Whose back door should netizens be more worried about: Big Brother or The Boss? Spencer E. Ante Associate Editor THE WEB Magazine To: cypherpunks at toad.com, fight-censorship at vorlon.mit.edu cc: (bcc: Spencer Ante/PCWORLD) Subject: Re: PGP, Inc.--What were they thinking? At 1:45 PM -0700 10/22/97, Anonymous wrote: >>Agreed. What amazes me is how PGP, Inc. would decide this should be a core >>part of their company. "PGP for Business," indeed. What were they thinking? > >Um, maybe that they wanted to stay in business? This is a truism, that businesses want to stay in business. (And thrive, etc.) The interesting question is whether this action will help them. Why it may not is what we're talking about. For example, if PGP loses its "little guy fighting the system" image, and the company is seen as a major supplier of snoopware and GMR systems, it will have squandered the good will which led many of us to support PGP. And it's by no means clear that corporations will pay enough for PGP for Business if this good will has been squandered. The free status of most versions of PGP is indeed an impediment to PGP making a profit. That's an unchangeable situation. Lots of copies of PGP are already out there, and lots more are available from many sites. The "commercial use" vs. "personal use" dichotomy is largely unenforceable. If Joe Employee uses PGP 2.6 or even 5.0 for his messages, PGP, Inc. will have a very hard time proving in court that Joe or his employer can be held liable for this use (at most, maybe Joe will have to pay $50 or so...and probably not even that, as PGP 5.0 is not serialized (so far as I can find) and records aren't kept...Joe can just claim he did in fact buy it, blah blah). This means PGP, Inc. faces a Netscape-like battle in finding revenue sources. Will they succeed? Will people like us continue to give PGP, Inc. the good will it has enjoyed? Stay tuned. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From tcmay at got.net Wed Oct 22 15:29:10 1997 From: tcmay at got.net (Tim May) Date: Thu, 23 Oct 1997 06:29:10 +0800 Subject: PGP, Inc.--What were they thinking? In-Reply-To: <88256538.00787D24.00@pcwhub.pcworld.com> Message-ID: At 3:08 PM -0700 10/22/97, spencer_ante at webmagazine.com wrote: >With all due respect to Tim May: > >As a person whose been at work on a very long feature about PGP Inc. for >Wired, I can tell you that businesses really don't care that much about >PGP's civil liberties advocacy. In fact, its rep could hurt as much as help >them. The Fortune 500 is much more pragmatic: They want solutions that I agree that the civil liberties side of PGP is of no interest to corporations...in fact, it scare them a great deal. Talking about how Hamas is using PGP to communicate so that the Zionist entity government cannot successfully wiretap the freedom fighters is not something IS managers like to hear about. I agree that PGP, Inc. is apparently recasting itself as a supplier to IS departments and bean counters. >work, that help them maintain security for their intellectual property and >capital. To that extent, PGP 5.5--which enables IS directors to manage a >public key infrastructure and enforce company-wide security policies-- is a >step in the right direction. > >But with this new product, I agree that they run the risk of alienating >their core user group of cypherpunks and hackers. Encryption is a very >complicated topic that doesn't lend itself well to sloganeering and >histrionics. And one major thing that needs to be pointed out: PGP's key If you are implying that my words are "sloganeering and histrionics," I think you're way off-base. I suggest you start reading the points being debated in more detail, and think about the deeper issues. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From declan at well.com Wed Oct 22 15:33:21 1997 From: declan at well.com (Declan McCullagh) Date: Thu, 23 Oct 1997 06:33:21 +0800 Subject: Federal Key Recovery Demonstration Project ?! In-Reply-To: Message-ID: Yep, I'm planning to go. Should be amusing if nothing else. --Declan From tcmay at got.net Wed Oct 22 15:37:33 1997 From: tcmay at got.net (Tim May) Date: Thu, 23 Oct 1997 06:37:33 +0800 Subject: Freeh-style Encryption needed to fight infowar threat Message-ID: I just saw the principle author of the recently released report of the "Commission on Critical Infrastructure Protection," interviewed on CNBC, a business program. Robert Marsh called for increased use of encyption to proect the nation's computer networks against hackers and crackers and info-terrorists. The catch? It's the FBI proposal he wants to see adopted. Personally, I think this issue, and Marsh in particular, are sleep-inducers to most people, so I don't see this as a driving force for GAK the way a building being blown up, or a child porn ring, will be. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From klockstone at cix.compulink.co.uk Wed Oct 22 15:40:21 1997 From: klockstone at cix.compulink.co.uk (Keith Lockstone) Date: Thu, 23 Oct 1997 06:40:21 +0800 Subject: A5 Message-ID: The A5 code in the back of Schneier's 'Applied Cryptography' seems to have some errors in it - has anybody else had a serious play with it? Keith. From 71073979 at cyberbundle.net Thu Oct 23 06:40:32 1997 From: 71073979 at cyberbundle.net (71073979 at cyberbundle.net) Date: Thu, 23 Oct 1997 06:40:32 -0700 (PDT) Subject: Free Cash Grants... Message-ID: To be removed from this mailing list e-mail remove at cyberbundle.net $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ We Have Over 150 Private Foundations In Our Program All Over the United States... WE ARE A FINANCIAL FINDER & MATCHING SERVICE .."INTEREST - FREE CASH GRANTS!! - NEVER PAY BACK!!!"... FOUNDATIONS CAN BE A BETTER SOURCE FOR FINANCE, THAN BANKS! ___________________________________________________________ Foundations give away billions of dollars every year to individuals. Most are non-profit organizations dedicated to the betterment of society. A foundation is excempt from income tax because it�s non-profit status. Private foundations have been giving out cash-grants to people for over 100 years. You can check with your attorney or local chamber of commerce. ARE YOU BEING REJECTED FOR THE MONEY YOU NEED SO BADLY? _________________________________________________________ Then Why Not Try A Private Foundation? Interest Free Cash Grants From $500.00 & Up to $50,000.00. No Collateral. No Cosigners, No Security Deposit, No Mortgages. No Credit Check. No Pay Back. ANYONE CAN GET AN INTEREST FREE CASH GRANT! ____________________________________________ As long as they have a genuine reason for needing money, & as long as the foundation guidelines are met. Dear Applicant, This letter tells you HOW YOU CAN GET AN INTEREST-FREE CASH GRANT. Take a few minutes to read it. You�ll be suprised to see how easy it is to get a Cash-Grant, by mail. From time to time, everyone needs to borrow. The problem is that for most people making a loan is a big hassle. Going to banks or finance companies in person takes a lot of time. In most cases, thereis endless paperwork. And Unfortunately, in many cases all that you end up with is a rejection notice. ABSOLUTELY NO CREDIT CHECK ________________________ People are getting CASH GRANTS BY MAIL, that are Interest -Free & do not have to be paid back, in any way. Getting a Grant by mail is probably a lot easier than you think. In your area, there are usually only a small number of places that will provide you with the money, that you need. On the other hand, there are literally hundreds of private foundations who are anxious to donate money by mail, to people who have genuine reasons for needing the money. While it is not possible for anyone to guarantee that you will receive a CASH GRANT BY MAIL, the fact is that right now, someone just like you is getting your grant. Chances are that most banks in your area have very stringent loan requirements. On the other hand, most foundations who give GRANTS BY MAIL are much more lenient. Persons who have poor credit, no credit or even those who have gone through bankruptcy are able to get the money that they need BY MAIL sent to them by check payable to them, because foundations are NOT interested in CREDIT RATINGS. GETTING A GRANT BY MAIL IS CONFIDENTIAL ____________________________________ There are no embarrassing interviews. Neither collateral nor cosigners are required. The main requirement is that you have a legitimate need for the money and are willing to use it for whatever reason that the foundation agrees to. Everything is handled by mail. We are not associated with any of the foundations in our program, therefore all money will go directly to you, payable to you. As a Financial Finder & Matching Service, we know where the money is and which private foundations may be most likely to approver your grant. There are actually hundreds of foundations with money that they are anxious to donate. It is our job to put you in touch with them. PLEASE REMEMBER: CASH-GRANTS are FREE of any interest, & they DO NOT NEED TO BE PAID BACK! ________________________________________________ Foundations give out money for a wide variety of needs as long as it is something LEGAL & this means that you obtain the money to pay off old bills, go on vacation, meet emergency needs or to buy anything that you might need, as long as the foundation agrees to it. Everything is handled by mail. YOU DECIDE HOW MUCH MONEY YOU WANT TO OBTAIN. ________________________________________________ The amount can be as little as $500.00 and up to $50,000.00, possible. And remember, there is NO CREDIT CHECK. Interest-Free Cash Grants are ideal for people who have bad credit or bankruptcy. If you had trouble in the past dealing with banks, then these private foundations, are a better source for finances, because they don�t care about bad credit or bankruptcies. (Foundations do not do a credit check on a client..) As a Financial Finder & Matching Service, we�ll review your service application form and determine which foundations may be most likely to provide you with the money that you need. Keep in mind that we have only reputable foundations in our program. You are protected by the fact that these foundations are regulated by the laws of the United States. No matter how much you want to obtain, no matter what you want to use the money for-we feel confident that we can help you to get it! With the service we are offering you. WE GUARANTEE THAT UNLESS WE HELP YOU WITH OUR SERVICE, TO GET THE MONEY THAT YOU NEED, OUR APPLICATION FEE OF $19.95 WILL BE REFUNDED! ____________________________________________________________________ Our Application fee is $19.95 for personal & Business Grants. There are absolutely no other fees to pay. All that you will have to do is complete the service application form, below, and mail it with payment with as indicated on the form. We will process your service application within 10-12 days. We will match your FINANCIAL NEEDS & REQUIREMENTS with the most suitable Private Foundations, in our program. 100% FULL MONEY BACK GUARANTEE, OF APPLICATION FEE, AT ANY TIME. ______________________________________________________________________ Remember-unless your grant is approved, your application fee of $19.95 will be refunded in full, promptly. The sooner you apply the sooner you�re likely to have the money you need! Mail the APPLICATION TODAY! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ APLLY WITHIN 5 Days & GET 70 FREE MONEY MAKING REPORTS WITH RESELL AND RE-PRINT RIGHTS. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Service Application Form Please Find: (circle one) Money Order Check Credit Card (Circle One: VISA, M/C, AMEX, Discover) Credit card # ________________________________________ Expiration Date____________________ Signature_________________________________________ Guaranteed Fee $19.95. I need you to RUSH processing. Please add $10.00 Total $________ ______ I have applied within 5 Days. Please Include the 70 MONEY MAKING REPORTS W/ RE-PRINT RIGHTS. TO EXPEDITE, FAX TO 540-723-8699 We also accept checks by fax! Simply tape your checks on the bottom and fax!! It's that easy!! (For check payments, tape check to the bottom and fax) PLEASE MAKE CHECKS PAYABLE TO: McConville Enterprises, LLC or MAIL TO: McConville Enterprises, LLC Creators of... "Internet Business In A Bundle" (tm) 117 W. Boscawen Street Suite # 203 Winchester, Virginia 22601 (540) 723-8699 Fax Checks Take 5 Days to clear at the bank. Please Print Clearly For Our Office Staff ** Please write very clearly** Grant Purpose:____________________________________________________ Amount Needed $___________.00 Yearly Income $___________.00 Name_____________________________ Occupation __________________ Address___________________ City ___________ State _____Zip __________ Signature______________________________ Phone #(___)____ -________ E-Mail Address (very important)____________________________ Please match my financial needs & requirements with the most suitable private foundations in your program. I understand that the fee I enclosed will be refunded if I don't receive my grant. The Entirety of this Material and all Packages are Protected by Copyright Law. Copyright October 1996-97 By McConville Enterprises, LLC . All Rights Reserved. From nobody at REPLAY.COM Wed Oct 22 15:48:06 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 23 Oct 1997 06:48:06 +0800 Subject: We have to keep our keys for HOW long??? Message-ID: <199710222235.AAA18715@basement.replay.com> * The Wall Street Journal reported in July that the Environmental Protection Agency has ordered 71 mining companies in Idaho to submit copies of all of the paperwork they have produced in the last 117 years. EPA says it needs the information to help determine who is responsible for lead pollution in Idaho's Silver Valley. According to the president of one firm, the order was so crazy that the EPA investigators "must not live on this planet." Another pointed out that there are not enough copy machines in the region to handle the work. To read these News of the Weird newspaper columns from the past six months, go to http://www.nine.org/notw/notw.html (That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it.) From declan at well.com Wed Oct 22 15:49:17 1997 From: declan at well.com (Declan McCullagh) Date: Thu, 23 Oct 1997 06:49:17 +0800 Subject: PGP, Inc.--What were they thinking? In-Reply-To: <88256538.00787D24.00@pcwhub.pcworld.com> Message-ID: At 15:08 -0700 10/22/97, spencer_ante at webmagazine.com wrote: >But with this new product, I agree that they run the risk of alienating >their core user group of cypherpunks and hackers. Encryption is a very >complicated topic that doesn't lend itself well to sloganeering and >histrionics. And one major thing that needs to be pointed out: PGP's key >recovery system is *voluntary and private*--not mandatory and gov. >controlled, which is what the Feds and Louis Freeh have been pushing for. >One potential positive side effect of PGP 5.5 is that it could realign the >crypto debate and force people to consider this question: Whose back door >should netizens be more worried about: Big Brother or The Boss? Spencer, the folks on the cypherpunks list know better than perhaps anyone else that encryption is a complicated topic. I know it's tempting to search for New Things to Say about the crypto debate. I try it myself sometimes. But the question you posed about "whose backdoor should netizens be more worried about" has been debated for years and is hardly new. The short answer to it is: when Big Brother is my Boss, I have remedies. I can leave the company or pressure it to change policies. I can file a union grievance. If all else fails, I can leave the company and start my own. This is not the case when Big Brother is Louis Freeh or Janet Reno. When worldwide GAK is the rule, where else can I go? Also: governments have guns; governments have jails. They have unique coercive powers, which the law and western philosophical traditions recognize -- and try to limit. -Declan (posting this before a soccer game somewhere in virginia) From nobody at REPLAY.COM Wed Oct 22 15:56:59 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 23 Oct 1997 06:56:59 +0800 Subject: puff pieces vs tough crypto issues (Re: Singapore TOILET ALERT) Message-ID: <199710222235.AAA18712@basement.replay.com> Adam Back wrote: > No offense Declan, but what has this got to do with cypherpunks, > cryptography, crypto politics etc? (This is not a perrygram, this is > a message saying I found that particular article uninteresting). Adam, I believe that Declan may be trying to keep things in perspective, by reminding us who the actual users of "widespread crypto" will be, GAK or no GAK. As a matter of fact, Declan and I are counting on you to explain the issues involved to our good friend and neighbor, Debbie (details below), and get back to us with her thoughts on the crypto issues which are relevant, from her perspective. * At a celebrity auction in May, Debbie Dacoba of Paw Paw, Mich., bid $8,625 for a pair of Mr. Ed's horseshoes and was so overcome with joy when she won that she had to retreat to the ladies' room for 20 minutes until she stopped crying. Later she told a reporter that she would keep the horseshoes in plastic because specks of brown residue in the nail holes "could be manure, which I hope it is because then I have a piece of him." ManureMonger ~~~~~~~~~~~~ To read these News of the Weird newspaper columns from the past six months, go to http://www.nine.org/notw/notw.html (That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it.) From spencer_ante at webmagazine.com Wed Oct 22 16:21:28 1997 From: spencer_ante at webmagazine.com (spencer_ante at webmagazine.com) Date: Thu, 23 Oct 1997 07:21:28 +0800 Subject: PGP, Inc.--What were they thinking? Message-ID: <88256538.007CF786.00@pcwhub.pcworld.com> Declan, perhaps the Big Brother vs. The Boss debate has been talked about for years in the crypto community but, as far as I can tell, it hasn't crossed over into the mainstream mediasphere. And that's partly due to the rhetoric of cyberlibertarians, who have consistently pointed their finger (justifiably most of the time) at the evil government, at the expense of seriously analyzing surveillance in the private sector. For example, how many people know what their company's security policy is? Do they read your email? How often and with what cause? I think any type of surveillance system is cause for concern--whether it originates from the government or IBM. Lastly, I think you overestimate the amount of wiggle room folks have in the labor market, which is never perfect. What happens when most of the Fortune 500 starts eavesdropping on company email? (Incidentally, I think that most working people--unlike the digerati--are not in a position to launch their own company.) It reminds me of the drug testing issue. Sure, it sucks and may even be unconstitutional, but that hasn't stopped a lot of companies from doing it. -Spencer (posting this from my the computer in my corporate cubicle) At 15:08 -0700 10/22/97, spencer_ante at webmagazine.com wrote: >But with this new product, I agree that they run the risk of alienating >their core user group of cypherpunks and hackers. Encryption is a very >complicated topic that doesn't lend itself well to sloganeering and >histrionics. And one major thing that needs to be pointed out: PGP's key >recovery system is *voluntary and private*--not mandatory and gov. >controlled, which is what the Feds and Louis Freeh have been pushing for. >One potential positive side effect of PGP 5.5 is that it could realign the >crypto debate and force people to consider this question: Whose back door >should netizens be more worried about: Big Brother or The Boss? Spencer, the folks on the cypherpunks list know better than perhaps anyone else that encryption is a complicated topic. I know it's tempting to search for New Things to Say about the crypto debate. I try it myself sometimes. But the question you posed about "whose backdoor should netizens be more worried about" has been debated for years and is hardly new. The short answer to it is: when Big Brother is my Boss, I have remedies. I can leave the company or pressure it to change policies. I can file a union grievance. If all else fails, I can leave the company and start my own. This is not the case when Big Brother is Louis Freeh or Janet Reno. When worldwide GAK is the rule, where else can I go? Also: governments have guns; governments have jails. They have unique coercive powers, which the law and western philosophical traditions recognize -- and try to limit. -Declan (posting this before a soccer game somewhere in virginia) From cosmos at microserve.net Wed Oct 22 16:27:16 1997 From: cosmos at microserve.net (Daniel Leeds) Date: Thu, 23 Oct 1997 07:27:16 +0800 Subject: Complaints In-Reply-To: Message-ID: <344E8863.7B5@microserve.net> MIS Security wrote: > Dan, > You have a .forward file here at mis that points to toad.com. Do you have > a .forward there? I received several compalints from people who are > getting your mail at cosmos at microserve.net. Jeremy, Don't pay any attention to the complaints. They are probably just from people I have defrauded in business dealings, or parents who object to the sexual liberties I have taken with their children. Just tell those whiners to go fuck themselves. Dan ~---------------------------------------------------------------------------- Abuse & Security Department MicroServe Information Systems, Inc. security at admin.microserve.net 100 North Wilkes-Barre Boulevard abuse at admin.microserve.net Wilkes-Barre, Pennsylvania 18702 http://www.naISPa.org (717)821-5964 FAX (717)821-5968 ----------------------------------------------------------------------------- From whgiii at invweb.net Wed Oct 22 16:33:49 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 23 Oct 1997 07:33:49 +0800 Subject: Adam Back: Guardian of CP purity? (Re: puff pieces vs tough crypto issues) In-Reply-To: <199710221356.OAA02611@server.test.net> Message-ID: <199710222322.TAA16450@users.invweb.net> In <199710221356.OAA02611 at server.test.net>, on 10/22/97 at 02, Adam Back said: >Declan McCullagh writes: >> >> [puff piece on toilets] >> >No offense Declan, but what has this got to do with cypherpunks, >cryptography, crypto politics etc? (This is not a perrygram, this is a >message saying I found that particular article uninteresting). >I think we'd be more interested to see an analysis piece of the political >merits/demerits of the pgp5.5 CMR corporate message recovery technique >than of _toilets_. >Where do you stand on the CMR argument? Or are you staying away from the >hot potato :-) Exactly who died and made you the guardian of Truth, Justice, and the Cypherpunk Way??? Sometimes I think you take yourself way too seriously Adam. -- --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html --------------------------------------------------------------- From lizard at mrlizard.com Wed Oct 22 16:37:11 1997 From: lizard at mrlizard.com (Lizard) Date: Thu, 23 Oct 1997 07:37:11 +0800 Subject: PGP, Inc.--What were they thinking? In-Reply-To: <88256538.007CF786.00@pcwhub.pcworld.com> Message-ID: <3.0.1.32.19971022162041.00909360@dnai.com> At 04:05 PM 10/22/97 -0700, spencer_ante at webmagazine.com wrote: > >Declan, perhaps the Big Brother vs. The Boss debate has been talked about >for years in the crypto community but, as far as I can tell, it hasn't >crossed over into the mainstream mediasphere. And that's partly due to the >rhetoric of cyberlibertarians, who have consistently pointed their finger >(justifiably most of the time) at the evil government, at the expense of >seriously analyzing surveillance in the private sector. For example, how >many people know what their company's security policy is? Do they read your >email? How often and with what cause? My companies security policy is great -- I'm the only one who understands the network. But it's a significant concern for most other people, I grant you. One of the main differences between corporate and private crypto is that, fundementally, your boss owns your work PC -- he's given it to you so that you can do your job, not play Doom, or exchange sexy email with the gals in the secretary pool (do they still have those?). I think most workers are more productive and more loyal when they are NOT being spied on, but that's an issue of ethics and efficiency, not of rights. But your home computer...that's a very different story. That one is YOURS, bought by you for your purposes, and no one -- not Uncle Sam, not Mr. Dithers -- has a right to go prodding around in it. From jmayorga at netscape.com Wed Oct 22 17:07:27 1997 From: jmayorga at netscape.com (John Mayorga) Date: Thu, 23 Oct 1997 08:07:27 +0800 Subject: PGP 5.5 CMR/GAK: a possible solution In-Reply-To: <3.0.3.32.19971022113904.00bca690@mail.pgp.com> Message-ID: <344E929C.EED741BF@netscape.com> This whole "company key", "department key", and "personal key" business seems strangely similar to the hierarchical structure of an LDAP server. I wonder where we could store that information... :-) Just my 2�. John E. Mayorga Jon Callas wrote: > At 03:02 AM 10/22/97 -0700, mark at unicorn.com wrote: > > Thanks. I want to add that what's in 5.5 is hardly what we think is > perfect. The system is designed simply to be preferable to key escrow. We > have some improvements we're planning for it in the future. So you're right > -- it's a short-term solution. > > The current system sends out a user's personal key, with a tag to say that > if I don't encrypt to the company as well, my mail will bounce. But think > about this: how often do I want to send email to a particular person in a > company, and ensure that only they see it? And how often do I want to send > mail to a particular group inside a company? All I want is to ensure that > I get a response from the company, I usually don't care who I talk to in > the > process. > > You have it mostly right. There's a tag in a self-signature that says, > "please encrypt to this other key, too." The only time you are required to > encrypt to Alice's other key is if you and Alice share the same additional > key (and not always even then). > > So PGP's "everything private unless you choose to make it public" system > seems backwards. Surely what we really need to meet these customer demands > is an "everything public (within the company) unless you choose to make it > private" system? That is, all mail to my department inside the company > should be encrypted to a department key, shared by all members, *unless* > it is confidential, in which case it should *only* be encrypted to me. > > This is certainly possible with the system, and in fact easier to implement > than anything else. > > Here's how I see this working: when Joe Blow joins Foo-Bah Cryptosystems, > he creates his own personal PGP key. He also gets a copy of the department > key, which he can use to decrypt any mail which is encrypted to his > department; or this decryption could be handled automatically by a > department email server to ensure that individuals never have access to the > department's private key. PGP then creates a public key for 'Joe Blow > ', which would be the department key with a signed > tag > linking it to his personal public key. This is the tagged corporate public > key which he would give out to any customers. > > When a customer wishes to send email to Joe, he would use this public key. > When encrypting, PGP would detect the tag and put up a dialog box pointing > out that this is a corporate key and if they click on the 'confidential' > button it will be encrypted to the user's personal key prior to encrypting > to the corporate key (by which I mean superencryption, to avoid traffic > analysis). The default would be not to superencrypt; and as a side effect > this system would be compatible with any version of PGP for > non-confidential mail (assuming that version understands the encryption > algorithms in use). > > The effect of this is that if someone wants to send email about an urgent > bug and I'm out at lunch, any of my co-workers can read that mail. But if > they want to send *me* mail about confidential inter-company negotiations, > the co-workers could decrypt the outer layer of the message, but would be > blocked by the inner layer encryption to my personal key. > > As I see it, this system is simple, solves the problems which PGP claim > they need to solve without creating the snooping problems Tim and others > have discussed, cannot easily be adapted to GAK ('This message is to be > encrypted to the FBI public key. If it is confidential, click here to > superencrypt to the recipient's personal key'), and won't require a > massive change to the PGP source code. > > This is exactly CMR. The only thing that Business 5.5 does is automatically > add the department for you, and put up the recipient dialog so it can be > taken off. Congrats. > > There are some obvious security issues with having the department key > shared amongst the members of the department, but I don't see that they > are any worse than PGP's current CMR implementation, which has already > discussed the use of department keys; it's certainly better than using > plaintext. There are also problems with encrypting confidential mail to > multiple recipients, but they're surmountable; an easy solution, if you > don't care about traffic analysis, is to only encrypt confidential mail > to the personal key rather than superencrypt with the corporate key. In > most > cases such mail wouldn't be sent to multiple recipients anyway. > > So here's how I'd see the simple system working: > > A PGP CMR key would consist of > > 1. A corporate key; this might be company-wide, department-wide, or > an individual escrowed key; this choice is a seperate key-management > issue for the corporation. > 2. Optionally a personal key, which could only be decrypted by the > individual. > 3. A signature from the corporate key linking the personal key to it > and the specified User Id. > 4. Optional flag to indicate which key to encrypt to by default. > 5. User Id, signatures, etc > > When PGP was asked to encrypt to such a key, it would check for the > optional personal key. If it wasn't there, it would put up a warning > box to tell the user that the message can be read by people other than > the recipient. If it is, then it would put up a dialog box allowing the > user to choose whether to encrypt to the corporate key or the individual > key, normally defaulting to the corporate key. This system could not easily > become GAK because it will only encrypt to one of the keys and not both; > the FBI could create FBI CMR keys from all our public keys, but then PGP > would either encrypt to the FBI and I wouldn't be able to read it, or > encrypt to me and the FBI wouldn't be able to read it. > > Anyone care to pick any holes? > > Looks good from here. You've redesigned PGP 5.5. Thanks. > > Jon > > ----- > Jon Callas jon at pgp.com > Chief Scientist 555 Twin Dolphin Drive > Pretty Good Privacy, Inc. Suite 570 > (415) 596-1960 Redwood Shores, CA 94065 > Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) > 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) begin: vcard fn: John Mayorga n: Mayorga;John org: Netscape Communications Corp. adr;dom: ;;501 E. Middlefield Road, Mountain View, CA 94043, USA;9;;; email;internet: jmayorga at netscape.com tel;work: 4556 x-mozilla-cpt: ;0 x-mozilla-html: FALSE version: 2.1 end: vcard From berezina at qed.net Wed Oct 22 17:26:58 1997 From: berezina at qed.net (Paul Spirito) Date: Thu, 23 Oct 1997 08:26:58 +0800 Subject: Bill Gates, the Bully Savior In-Reply-To: Message-ID: <3.0.3.32.19971022201255.007ba6a0@207.198.253.29> At 01:34 PM 10/22/97 -0700, Declan McCullagh wrote: >Or it's like buying a Ford Mustang that comes with brown carpets. Auto >manufacturers "bundle" lots of things with their cars... Where's the DoJ >when we need them?!? Not sure where I stand on this. An OS is more like a highway than a car. Or, better, a rail track -- since it imposes severe compatibility requirements on those who want to utilize it. Imagine that someone owned the rail track standard & had the exclusive IP-rights to manufacture it. Non-standard tracks exist, but they don't go nearly as many places. Then the company uses its position as owner of the tracks to demand... Oh screw it. I don't feel like going down analogy road any further. Detail is the enemy of ideology, & the significant detail re: Microsoft is the rare & happy (for Bill Gates) character of its business that it is more important to have a standard OS than to have a quality OS. Therein lies his billions, & it seems to me reasonable to scrutinize attempts to parlay that counter-ordinary-market reality into dominance in other areas. Perhaps this could be settled as the online service spat was: bundle Netscape with Win98 (& Opera, Arachne &c). Or perhaps the US could nationalize Windows. Whoo-hoo! Therein lies a Plan... Paul Her name was Julie, she wore Batman sneakers, And she laughed when she sang, "Money can't buy me love!" North of Petaluma where the 1 meets the 101 -- Oh man, we took a lot of drugs... From kent at bywater.songbird.com Wed Oct 22 18:00:09 1997 From: kent at bywater.songbird.com (Kent Crispin) Date: Thu, 23 Oct 1997 09:00:09 +0800 Subject: puff pieces vs tough crypto issues (Re: Singapore TOILET ALERT) In-Reply-To: Message-ID: <19971022174848.58494@bywater.songbird.com> On Wed, Oct 22, 1997 at 02:23:29PM -0400, Declan McCullagh wrote: > At 14:06 -0400 10/22/97, Jonah Seiger wrote: > >While I suspect that new key recovery or CMR products may create some new > >traction for supporters of mandatory GAK, PGP 5.5 is not the first example > >of such a product (TIS has been marketing key recovery products for a > >while). > > Of course TIS has been doing this forever. But TIS, a shop staffed by > former NSA spooks, is not the PGP that Phil Zimmermann founded. For PGP to > release such a product changes the political dynamic in important ways. > > >More importantly though, the Blaze et al study > >(http://www.crypto.com/key_study) did not say that key recovery/key escrow > >systems can't be built. > > In fact it said: "Building the secure infrastructure of the breathtaking > scale and complexity that would be required for such a scheme is beyond the > experience and current competency of the field." Sounds like "can't be > built" to me. In that case, it is completely inaccurate to call PGP5.5 an existence proof. In any case, the Blaze et al paper explicitely acknowledges that there is a "business case" for corporate level key recovery, and clearly distinguishes the LEA infrastructure model from more limited cases. > I agree that PGP 5.5 doesn't meet the FBI's demand for realtime access. But > it can be used as a waving-around-on-the-House-floor prop to pass a law > that requires mandatory key escrow. They could wave around TIS's products (designed by noted cypherpunk Carl Ellison, I believe), or NorTel's Entrust, just as well. Hell, in a few months they may be able to wave around Adam Backs CDR product, which also facilitates GAK -- access to communications is worse than access to data, by some measure, but the LEA's will certainly be grateful to Adam for his legitimization of Key Escrow... -- Kent Crispin "No reason to get excited", kent at songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html From kent at bywater.songbird.com Wed Oct 22 18:04:19 1997 From: kent at bywater.songbird.com (Kent Crispin) Date: Thu, 23 Oct 1997 09:04:19 +0800 Subject: PGP, Inc.--What were they thinking? In-Reply-To: <88256538.00787D24.00@pcwhub.pcworld.com> Message-ID: <19971022174359.10769@bywater.songbird.com> On Wed, Oct 22, 1997 at 03:08:07PM -0700, spencer_ante at webmagazine.com wrote: > With all due respect to Tim May: > > As a person whose been at work on a very long feature about PGP Inc. for > Wired, I can tell you that businesses really don't care that much about > PGP's civil liberties advocacy. In fact, its rep could hurt as much as help > them. The Fortune 500 is much more pragmatic: They want solutions that > work, that help them maintain security for their intellectual property and > capital. To that extent, PGP 5.5--which enables IS directors to manage a > public key infrastructure and enforce company-wide security policies-- is a > step in the right direction. > > But with this new product, I agree that they run the risk of alienating > their core user group of cypherpunks and hackers. Alienate some, for sure. It doesn't really matter, though. Cypherpunks and hackers don't have a monopoly on intelligence -- there are plenty of people who will hack crypto for food. PGP can't make a go of it on free software, and they can't live forever on investor financing. > Encryption is a very > complicated topic that doesn't lend itself well to sloganeering and > histrionics. Eh? GAK, GAKWare, Big Brother Inside, Four Horsemen of the Infoclypse, etc, etc,etc Sloganeering and histrionics are the very lifeblood of this list. It would die in days if it were limited to rational discussion... And of course, sloganeering and histrionics are just as prevalent in the crypto debates in DC. > And one major thing that needs to be pointed out: PGP's key > recovery system is *voluntary and private*--not mandatory and gov. > controlled, which is what the Feds and Louis Freeh have been pushing for. > One potential positive side effect of PGP 5.5 is that it could realign the > crypto debate and force people to consider this question: Whose back door > should netizens be more worried about: Big Brother or The Boss? Nobody denies that your boss has the right to control his equipment and software as he sees fit, and everybody debating on these lists agrees that the government does not need access. It is also incontrovertable that PGP's CMR implementation is a response to real demand. It may be less obvious, but despite what PGP claims, a significant fraction of this demand is for the ability to SNOOP, and not just data recovery. *All* the debate on this list implicitly takes the employee's side, not the management's side, and that is a serious lack. The unpleasant fact is that managers NEED TO BE ABLE TO SNOOP. It is terrible to work for an employer who will snoop, but it is just as terrible to have dishonest employees. It doesn't take a genius to realize that the existence of dishonest employees is a primary motive for management snooping. Clearly, there are some organizations for which this is more important than others -- financial services companies are only the most obvious example. -- Kent Crispin "No reason to get excited", kent at songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html From ariel at watsun.cc.columbia.edu Wed Oct 22 18:54:02 1997 From: ariel at watsun.cc.columbia.edu (Ariel Glenn) Date: Thu, 23 Oct 1997 09:54:02 +0800 Subject: puff pieces vs tough crypto issues (Re: Singapore TOILET ALERT) Message-ID: Kent Crispin writes: >They could wave around TIS's products (designed by noted cypherpunk >Carl Ellison, I believe), or NorTel's Entrust, just as well. Hell, in >a few months they may be able to wave around Adam Backs CDR product, >which also facilitates GAK...[deleted] sure, but PGP has a certain name recognition that appears to extend beyond the computing business community; ask your average cs student what PGP is and they'll have heard of it *and* its reputation. Ask them about Entrust and see if you get the same result. (I could do that here with my managers as a demo. :-) Now figure out what your representatives in Congress know: even less. So, PGP gets cited by Congress as an example, and the other corporations building in GAK or who have signed on to get that good export license for DES don't. Ariel Glenn ariel at columbia.edu From tm at dev.null Wed Oct 22 19:19:45 1997 From: tm at dev.null (TruthMonger) Date: Thu, 23 Oct 1997 10:19:45 +0800 Subject: PGP, Inc.--What were they thinking? In-Reply-To: <88256538.007CF786.00@pcwhub.pcworld.com> Message-ID: <344EAF27.474F@dev.null> spencer_ante at webmagazine.com wrote: > > I think any type of surveillance system is cause for concern--whether it > originates from the government or IBM. Lastly, I think you overestimate the > amount of wiggle room folks have in the labor market, which is never > perfect. I remember standing beside a farmer in Buttfuck, North Dakota, as we watched an antique roadster cruise by. He said, "They don't make 'em like that, anymore.", to which I replied, "Yeah, and they probably never did." I have nothing against the 'standard phrases' being dug out of the back of the closet and thrown in the general direction of 'the usual suspects', every now and again, for the purposes of verifying that this or that list member has done his or her Cpunx 'required reading. {Ayn Rand, Snow Crash, Applied Cryptology, Tales from the Crypt...) However, I sometimes wonder if some of the 'freeh-market' advocates on the list, after reading '1984', didn't say to themselves, "Gee, I think Winston should have just moved somewhere else." ~~~~~~~~~~~~~~~~~~~ FROM MOUNTAIN MEDIA THE LIBERTARIAN, By Vin Suprynowicz Your license, please? Debra Nutall of Memphis, Tenn. thought she was an American success story when she turned her hair-braiding skills into a business and got off welfare two years ago. But now the Tennessee state cosmetology board is trying to close down her Memphis shop in a licensing dispute. "They call us bootleg braiders in the papers and it hurts," Nutall told reporter Paul Shepard of the Associated Press. "We pay our taxes and make this as professional as we can. Would they rather have me back on welfare?" ~~~~~~~~~~~~~~~~~~~ Allow me to point out that there is no longer anywhere 'to go' in order to avoid Big Brother, Little Brother, Invisible Brother... You can move to Mars, but you're still responsible for paying US taxes, so God help you if you ever come back (or if 'they' come and get you). > What happens when most of the Fortune 500 starts eavesdropping on > company email? (Incidentally, I think that most working people--unlike the > digerati--are not in a position to launch their own company.) It reminds me > of the drug testing issue. Sure, it sucks and may even be unconstitutional, > but that hasn't stopped a lot of companies from doing it. *Starts* eavesdropping? Where you been, Bubba? When a Company has the 'right' to wiretap you, search you, and make you piss in a jar, as well as having their own armed forces monitoring you and patrolling your workplace, the main difference between them and the government is that the corporation usually doesn't pretend to allow you to vote. Like the ads for the Pizza chain, 'Brother' doesn't come in the 'small' size, anymore. We have Big Brother, Bigger Brother, and All That Can Eat You Brother. TruthMonger From lutz at taranis.iks-jena.de Wed Oct 22 19:52:21 1997 From: lutz at taranis.iks-jena.de (Lutz Donnerhacke) Date: Thu, 23 Oct 1997 10:52:21 +0800 Subject: [rc5] The unknown message is... In-Reply-To: <3.0.3.32.19971022161452.009824f0@slacker.com> Message-ID: <344EB673.6FC6@taranis.iks-jena.de> David McNett wrote: > It is a great privilege and we are excited to announce that at 13:25 > GMT on 19-Oct-1997, we found the correct solution for RSA Labs� RC5- > 32/12/7 56-bit secret-key challenge. Confirmed by RSA Labs, the key > 0x532B744CC20999 presented us with the plaintext message for which we > have been searching these past 250 days. > > The unknown message is: It�s time to move to a longer key length By coincidence, I happened to be surfing through some old CPUNX archives today, and came across the following: > From: Tim May > Date: Wed, 22 Jan 1990 16:14:52 -0500 > To: cypherpunks at toad.com > > I bet if there was ever an RC5-32/12/7 56-bit secret key challenge, > that the unknown message would be: "It's time to move to a longer > key length." > > Tim May > "The Cypherpunks have shown their hand: They are going to start > a mailing list." How does he _do_ that? From hallam at ai.mit.edu Wed Oct 22 19:54:36 1997 From: hallam at ai.mit.edu (Phillip M. Hallam-Baker) Date: Thu, 23 Oct 1997 10:54:36 +0800 Subject: PGP, Inc.--What were they thinking? Message-ID: <01bcdf5a$4a2d3a60$06060606@russell> I should point out before starting that I now work for Verisign. This following personal opinion however and may not reflect any corporate policy that may or may not exist. I can understand the pressures on PGP to support key escrow. When I designed the Shen trust system for the Web I allowed for an escrow facility for much the same reasons that have been cited. If it was not for the unrelenting pressure from the US government to support GAK I am sure that commercial escrow would be a checkbox item. The problem is that as long as the pressure is there any step towards commercial escrow is also a step towards GAK. The problem with PGP's move is that it is the first significant break by the Internet software provider community. This will make it much easier for Netscape or Microsoft to cave in. It will also build the pressure on them. I wonder what would happen to Bills problem with the DoJ if he had a sudden change of heart. Somehow I don't see Netscape and Microsoft holding the line on GAK if PGP are happily exporting their product and grabbing market share. I really did not expect Phil Zimmerman to be the first to blink. I also don't understand it from the corporate perspective. PGP may be picking up some business in the corporate market but at the cost of alienating a significant part of the hacker community which has been his best supporter up till now. I would think his best strategy would have been to build on this customer base rather than sell it out at the first opportunity. If Phil Z. wants to get into the Enterprise market he is going to have to start speaking their language. Most companies today are looking for open standards. PGP may have been the de facto security solution three years ago but the reality today is several million copies of Comminicator and Explorer with S/MIME built in. If you are prepared to load certs manually for each person you communicate with you can even use the Web of trust model with S/MIME. Its easier if you can rely on a CA. I probably don't have to remind many people on this list that few people make security a priority although they are prepared to do so if it has little impact on them personally. I really don't want to get into a standards flamewar, the point I'm making is that this is a bigger issue in the Enterprise market than key escrow at this point. Phil claims to have an RSA license, if he wants to go after the enterprise market he can support S/MIME. Phill From mnorton at cavern.uark.edu Wed Oct 22 20:24:47 1997 From: mnorton at cavern.uark.edu (Mac Norton) Date: Thu, 23 Oct 1997 11:24:47 +0800 Subject: Bill Gates, the Bully Savior In-Reply-To: Message-ID: Well, nobody is purporting to decide for anybody, as I understand the case, what is an "operating system" in general. DOJ only seeks to enforce what MS agreed to, in the Decree. If those two parties chose to define OS for that pupose, and only for that purpose, as blanketyblank, why do we care? Because that's all their litigation is about. MacN On Wed, 22 Oct 1997, Declan McCullagh wrote: > There was a good op-ed in the WSJ on Monday. The Politics of Envy, > basically. Why everyone in Silicon Valley hates Microsoft... > > But some of the complaints about Microsoft come down to personal taste. The > masses offend refined sensibilities when they buy Windows 95 in droves. > Rein them in! Stop them from buying what they want! Don't let them get free > copies of Internet Explorer. > > I share Lizard's distaste for Microsoft products. My Unix workstation at > home has not one MSFT application on it. I have only Microsoft Word on my > Duo at work, and I could get by with WordPerfect. But our dislike for their > products doesn't mean that we are morally justified in restricting what the > company can do. > > -Declan > > > > At 10:42 -0700 10/22/97, Lizard wrote: > >Uhm...how do 'we all' benefit from having the same Justice Department which > >defended the CDA (and which is pushing for GAK) decide for us all what is, > >and is not, part of an operating system? > > > >These people are not qualified to make ANY judgements about computers -- I > >have to assume the 'experts' they got to tell them about OS software are no > >more qualified than the 'experts' they got to testify about the CDA (L-18, > >anyone?). > > > >I have no great love for Microsoft (I don't think anyone forced to use > >their crappy software does), and, emotionally, I'd like to see them get > >taken down a peg -- but legally and ethically, they are not doing anything > >wrong. They're just being tough competitors. Microsoft has prospered not > >due to any technical brilliance on their part, but due to sheer > >incompetance on the part of the rest of the industry, who have made a hobby > >of underestimating Bill Gates and overestimating their own customers loyalty. > > > >It's a pity I'm a mind-flaying victim. If I wasn't, I could forget > >principles and ideals and just say, "Microsoft Big. Microsoft Nasty. Uncle > >Sam stomp Microsoft. Yay, Uncle Sam." But because I work from principle > >FIRST, I have to grant Microsoft the same rights I would grant Sam's Deli > >or Joe's Shoe Store, and that includes the right to offer any combination > >of products or services they wish, and let the market decide to buy or not. > > > > ------------------------- > Declan McCullagh > Time Inc. > The Netly News Network > Washington Correspondent > http://netlynews.com/ > > > From whgiii at invweb.net Wed Oct 22 20:26:03 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 23 Oct 1997 11:26:03 +0800 Subject: PGP, Inc.--What were they thinking? In-Reply-To: <01bcdf5a$4a2d3a60$06060606@russell> Message-ID: <199710230254.WAA18427@users.invweb.net> In <01bcdf5a$4a2d3a60$06060606 at russell>, on 10/22/97 at 10:20 PM, "Phillip M. Hallam-Baker" said: >I really don't want to get into a standards flamewar, the point I'm >making is that this is a bigger issue in the Enterprise market than key >escrow at this point. Phil claims to have an RSA license, if he wants to >go after the enterprise market he can support S/MIME. Nothing personal Phil but that is the most brain dead sugestion I have seen on this list in a long time. Well I can see that getting a paycheck from Verisign hasn't tanted your viwes in favor of an inferior standard. -- --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html --------------------------------------------------------------- From security at microserve.net Wed Oct 22 21:05:01 1997 From: security at microserve.net (MIS Security) Date: Thu, 23 Oct 1997 12:05:01 +0800 Subject: Complaints In-Reply-To: Message-ID: <344EBAC6.62FD@microserve.net> MIS Security wrote: > Dan, > If this was my personal box and we were bullshitting, that would be funny. > On the other hand, I have to address this matter. Do you have a .forward > file in your other box? How else are they getting your mail? > > -Jeremy Dan, I just read the headers on the previous message, and boy, do I feel like a fucking idiot. It was a forgery! Boy, sometimes I'm just dumber than a sackful of hammers. Hold on, while I check the headers on _this_ message. Damn! This one's a forgery, too. Now I feel really, really, stupid..._writing_ a forged message. I'm going to go sit in a corner, and hit my dick with a hammer. Jeremy > On Wed, 22 Oct 1997, Daniel Leeds wrote: > > > MIS Security wrote: > > > Dan, > > > You have a .forward file here at mis that points to toad.com. Do you have > > > a .forward there? I received several compalints from people who are > > > getting your mail at cosmos at microserve.net. > > > > Jeremy, > > Don't pay any attention to the complaints. They are probably just > > from people I have defrauded in business dealings, or parents who > > object to the sexual liberties I have taken with their children. > > Just tell those whiners to go fuck themselves. > > > > Dan > > ~---------------------------------------------------------------------------- > > Abuse & Security Department MicroServe Information Systems, > > Inc. > > security at admin.microserve.net 100 North Wilkes-Barre > > Boulevard > > abuse at admin.microserve.net Wilkes-Barre, Pennsylvania > > 18702 > > http://www.naISPa.org (717)821-5964 FAX > > (717)821-5968 > > ----------------------------------------------------------------------------- > > > > > ~---------------------------------------------------------------------------- Abuse Security Department MicroServe Information Systems, Inc. security_abuse at admin.microserve.net 100 North Wilkes-Barre Boulevard abuse_security at admin.microserve.net Wilkes-Barre, Pennsylvania 18702 http://www.naISPa.orgy (717)821-5964 FAX (717)821-5968 ----------------------------------------------------------------------------- From ravage at ssz.com Wed Oct 22 21:21:50 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 23 Oct 1997 12:21:50 +0800 Subject: PGP, Inc.--What were they thinking? (fwd) Message-ID: <199710230436.XAA17097@einstein.ssz.com> Forwarded message: > Date: Wed, 22 Oct 1997 19:57:59 -0600 > From: TruthMonger > Subject: Re: PGP, Inc.--What were they thinking? > *Starts* eavesdropping? Where you been, Bubba? > When a Company has the 'right' to wiretap you, search you, and make > you piss in a jar, as well as having their own armed forces monitoring > you and patrolling your workplace, the main difference between them > and the government is that the corporation usually doesn't pretend > to allow you to vote. This is plain and simple bullshit. There are a variety of differences between a government and what they can do by general charter in a democracy and a company which operates on specific contracts. > TruthMonger ParanoiaMonger is more like it. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From bromage at cs.mu.oz.au Wed Oct 22 21:25:26 1997 From: bromage at cs.mu.oz.au (Andrew Bromage) Date: Thu, 23 Oct 1997 12:25:26 +0800 Subject: World-wide GAK In-Reply-To: Message-ID: <199710230249.MAA24007@mundook.cs.mu.OZ.AU> G'day all. Tim May wrote: > Nor is it by any stretch the first non-US GAK measures proposed. Cf. the > Trusted Third Parties plan in the U.K., the Australian developments, and > various measures in the Phillipines, Singapore, Germany, Sweden, and, of > course, the People's Republic of China. Just in case anyone is interested in the Australian developments, the EFA (Australian counterpart to the EFF) has published the Australian government's "Review of policy relating to encryption technologies", usually referred to as the Walsh Report. It's available online: http://www.efa.org.au/Issues/Crypto/Walsh/ BTW, the author of this report, Gerard Walsh, is a former deputy director-general of ASIO, the Australian Security and Intelligence Organisation. They're the ones responsible for national security. Other organisations which you should know about before reading are: - Australian Federal Police (AFP) - National Crime Authority (NCA) - Australian Transaction Reports and Analysis Centre (AUSTRAC) - Commonwealth Law Enforcement Board (CLEB) - Defense Signals Directorate (DSD) Now that I've set the NSA line eater buzzing with excitement, we now return you to your scheduled technical discussion. Cheers, Andrew Bromage From declan at well.com Wed Oct 22 21:27:11 1997 From: declan at well.com (Declan McCullagh) Date: Thu, 23 Oct 1997 12:27:11 +0800 Subject: Trip to SF/Bay Area around November 24, cypherpunk meeting? Message-ID: I'm thinking of spending a few days in the Bay Area in about a month, maybe the week of Thanksgiving. My S.O., a cypherpunkish Net and telecommunications lawyer here in DC, seems likely to join me. I'd love to come to a Bay Area cypherpunk meeting if there are any then, and spend some time with folks out there. Any plans to have one around Nov 24-27? This is more of a pleasure than a business trip, though I'll write an article if there are any interesting developments on the crypto-front. (Any suggestions on places to stay?) -Declan From love at cptech.org Wed Oct 22 22:00:21 1997 From: love at cptech.org (James Love) Date: Thu, 23 Oct 1997 13:00:21 +0800 Subject: Proof IE4 not an OS, was Re: Bill Gates, the Bully Savior In-Reply-To: Message-ID: <344EC65C.68D2370@cptech.org> Nifty comment by Michael McMain on JavaLobbyCafe at iceworld.org list: -------------------------- A friend at work made an interesting point about MS's claim that IE4 is simply an OS extension and not an application. All the DA has to do is turn on a Power Mac, start IE4, turn to MS and say "So what other parts of your OS run on the Macintosh exactly?". From declan at well.com Wed Oct 22 22:03:50 1997 From: declan at well.com (Declan McCullagh) Date: Thu, 23 Oct 1997 13:03:50 +0800 Subject: DC cypherpunks party on Sunday, November 2 Message-ID: A DC cypherpunk working meeting and party is tentatively scheduled for Sunday, November 2. The party is open to all, including non-cypherpunks and even (especially?) NSA spooks. (I somehow got suckered into organizing this portion.) Folks who showed up to my party and the cypherpunk meeting before it last month remember that Marc Rotenberg and his wife at that time volunteered to host the next one. Their home is near the National Cathedral in NW Washington, DC. About a 20 minute walk from the Woodley Park Metro, lots of parking. Special guests likely will include Peter Neumann and Simon Davies. Details forthcoming. -Declan From declan at well.com Wed Oct 22 22:07:38 1997 From: declan at well.com (Declan McCullagh) Date: Thu, 23 Oct 1997 13:07:38 +0800 Subject: (Fwd from f-c) Note from PGP employee on MRK Message-ID: >X-POP3-Rcpt: declan at relay.pathfinder.com >Subject: Re: PGP, Inc.--What were they thinking? >Date: Wed, 22 Oct 97 20:38:14 -0400 >x-sender: Jamie-McCarthy.org at mm.mailbank.com >From: Jamie McCarthy >To: >cc: "Jason Bobier" >Mime-Version: 1.0 >Sender: owner-fight-censorship at vorlon.mit.edu >X-Loop: fight-censorship at vorlon.mit.edu >X-FC-URL: Fight-Censorship is at http://www.eff.org/~declan/fc/ >X-FC-URL: To join send "subscribe" to fight-censorship-request at vorlon.mit.edu > >A friend of mine by the name of Jason Bobier happens >to work at PGP, Inc. I'll preface his comments by pointing out that >I'm sure he doesn't speak for the company in any way. > >> Unfortunately these people just don't get it. Corporations refused >> to buy 5.0 because it did not have any way for the corps to get at >> email encrypted to their employees. There are some very legitimate >> uses of this, such as when an employee dies and someone else has >> to take over for them. >> >> Without corps buying the product, there is no PGP, Inc., and thus >> no dedication of resources to the production of PGP. This leads us >> back to the floundering state of development that PGP was in >> before 5.0. >> >> They also don't seem to realize that you always have the ability >> to remove the MRK from your list of recipients. >> >> Sometimes I really feel like screaming at these people. _All_ of >> the developers at PGP are personal privacy zealots and no one >> likes the idea of the MRK. That is why we refuse to make them >> required. It is also why there still are freeware and personal >> versions of the product. I wish they would just realize that we >> aren't some evil group of people that are solely plotting how to >> make the most money off of this. Most everyone at PGP has >> internalized personal privacy as a cause (actually most had it >> before they joined PGP). >> >> *sigh* OK, enough ranting. Feel free to quote various parts of >> this if you feel like responding to the list. >> >> Jason > > >-- > Jamie McCarthy new email => jamie at mccarthy.org > homepage: http://www.absence.prismatix.com/jamie/ > fan of: http://www.nizkor.org/ > From newsglob at tnlb.com Thu Oct 23 14:56:59 1997 From: newsglob at tnlb.com (newsglob at tnlb.com) Date: Thu, 23 Oct 1997 14:56:59 -0700 (PDT) Subject: Very important ! global minutes? Message-ID: <199710232155.OAA02732@toad.com> MAKE SURE YOU ARE GETTING ALL THE MINUTES BEING GENERATED TO YOUR NUMBERS NOT JUST U.S. TRAFFIC!! CHAT LINES FOR YOUR SITE OR ADVERTISE IN NEWSPRINT Best customer service for your audiotext advertising needs. Fill out the form here: http://www.stsim.com/info/ Don't just stick with one service bureau ! you might not be getting paid for all your global minutes ,most service bureaus are paying you just for your U.S. traffic and keeping the rest this is how service providers make the most of their profit. PAYOUTS ARE ON THE 1st AND ON THE 15th OF EVERY MONTH..... NUMBERS MUST BE DISPLAYED ON YOUR FRONT PAGE FOR BEST RESULTS!!!! YOUR ACCOUNT WILL BE SETUP WITHIN HOURS !!! Top rates for 011- 592 / 1- 664 / 1- 809 / the international pay-per-call industry is bringing in millions upon millions each year. Get in on the the 1+ dialing prefixes and watch your revenue increase. Advertise by mass emailing, tv, web site, newsprint, magazine in any country!!!! You the advertiser will get a flat rate paid to you for every minute generated on your line(s). Your ad could look something like this. -------------------------------------------------------------------------------------------------------------- The internet's all new interactive date line talk to people live or just listen in call now! 1-664-410-3348 Regular Long Distance Only. --------------------------------------------------------------------------------------------------------------- Talk to Hot Ladies Now! 1-644-410-3349. --------------------------------------------------------------------------------------------------------------- People looking to meet people call now 1-664-410-3350. --------------------------------------------------------------------------------------------------------------- From shamrock at netcom.com Wed Oct 22 23:58:30 1997 From: shamrock at netcom.com (Lucky Green) Date: Thu, 23 Oct 1997 14:58:30 +0800 Subject: Technical Description of PGP 5.5 In-Reply-To: <3.0.3.32.19971015004322.0068ca64@popd.ix.netcom.com> Message-ID: <3.0.2.32.19971022210316.00727944@netcom10.netcom.com> At 07:12 AM 10/15/97 -0700, Kent Crispin wrote: >Correct me if I'm wrong, but this seems to imply that the CMR fields >in the key structure are really just a convenience -- if PGP, Inc. >didn't write an smtp filter that enforced a CMR key, someone else >(say a firewall vendor) could do so easily, defining whatever >relationship between keys they wanted. Anybody with half a brain, a copy of perl, and the PGP 5.0 source from http://www.pgpi.com/ could write a similar filter in a matter of hours. I am going to install PGP's SMTP filter on my box. To make it impossible to accidentally send unencrypted mail to certain people. :-) >To make that a bit stronger, it seems like *any* model that uses >persistent encryption keys essentially enables CMR-like functionality >in a smtp filter -- it could be done using pgp 2.6. Correct. But this isn't going to stop people from complaining. PGP 5.5 is considerably better than PGP 5.0. The LDAP support alone is reason to upgrade. The UI is improved and if you don't want to use message recovery, just don't turn it on. --Lucky Green PGP encrypted mail preferred. DES is dead! Please join in breaking RC5-56. http://rc5.distributed.net/ From whgiii at invweb.net Thu Oct 23 00:41:44 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 23 Oct 1997 15:41:44 +0800 Subject: Technical Description of PGP 5.5 Message-ID: <199710230735.DAA21516@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <3.0.2.32.19971022210316.00727944 at netcom10.netcom.com>, on 10/22/97 at 09:03 PM, Lucky Green said: >At 07:12 AM 10/15/97 -0700, Kent Crispin wrote: >>Correct me if I'm wrong, but this seems to imply that the CMR fields >>in the key structure are really just a convenience -- if PGP, Inc. >>didn't write an smtp filter that enforced a CMR key, someone else >>(say a firewall vendor) could do so easily, defining whatever >>relationship between keys they wanted. >Anybody with half a brain, a copy of perl, and the PGP 5.0 source from >http://www.pgpi.com/ could write a similar filter in a matter of hours. I made this point at the very begining. Source code is not even needed, all one needs to know is the encryption & signature packet formats to be able to pull the keyID's. >I am going to install PGP's SMTP filter on my box. To make it impossible >to accidentally send unencrypted mail to certain people. :-) I already have this inplace as a Rexx script on my E-Mail client. :)) >>To make that a bit stronger, it seems like *any* model that uses >>persistent encryption keys essentially enables CMR-like functionality >>in a smtp filter -- it could be done using pgp 2.6. My set-up works with 2.6->5.0. It's just not persistent keys but the ability to encrypt to multiple recipiants. Of cource even without these features this functionality can implemented by moveing encryption to the server. Only signing & decryption need to be on the client machines. It may even be more efficent in a corporate enviroment to do so. There are performance questions in a high volumn enviroment but I have developed techniques that greatly enhance the perfomance of PGP when working with large keyrings. I know C2-Net has done work with their Stronghold product for supporting hardware based encryption to improve performance on high volumn servers, it would be intresting to see how well these cards would lend themselves to PGP. >Correct. But this isn't going to stop people from complaining. >PGP 5.5 is considerably better than PGP 5.0. The LDAP support alone is >reason to upgrade. The UI is improved and if you don't want to use >message recovery, just don't turn it on. I will agree that 5.5 is an improvement but to be honest I am not that crazy about it. Not that all of it is PGP's fault alot has to do with the OS it runs on. NT just isn't ready for prime time. I have my own GUI I designed for PGP on the OS/2 platform so I am a little biased in that area. :) - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNE7+aY9Co1n+aLhhAQFhwgP/SdJSeNgbG/SRgR15gwtb22QFOF/VBEL6 K047yXYEwJ/2Vd/zEwJ8AU/6ycVawtGMFpIGyLQHG91ATVear7CSHmsa6KMPH7EC dtK2bbEQlpJsgGbQpXNt6gHOuKYRZIXp65XIlEvu8qW3CJLUGz+RTNnKOAIFkUe2 JWWYRj7N5Wc= =xwCN -----END PGP SIGNATURE----- From lutz at taranis.iks-jena.de Thu Oct 23 01:33:18 1997 From: lutz at taranis.iks-jena.de (Lutz Donnerhacke) Date: Thu, 23 Oct 1997 16:33:18 +0800 Subject: [rc5] The unknown message is... In-Reply-To: <3.0.3.32.19971022161452.009824f0@slacker.com> Message-ID: * Lutz Donnerhacke wrote: > You should not fake User IDs. From whgiii at invweb.net Thu Oct 23 01:56:48 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 23 Oct 1997 16:56:48 +0800 Subject: What RSA & Netscape have to offer Message-ID: <199710230817.EAA21914@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- Hi, While the list is busy knocking PGP for not doing the "right thing" or being the "first ones to blink" I though I would share with the list what some of the "big boys" are doing for the spread of "Strong Crypto to the Masses". Below is from the most current S/MIME draft "draft-dusse-smime-msg-05" dated 19-Oct-1997: 2.6 ContentEncryptionAlgorithmIdentifier Receiving agents MUST support decryption using the RC2 [RC2] or a compatible algorithm at a key size of 40 bits, hereinafter called "RC2/40". Receiving agents SHOULD support decryption using DES EDE3 CBC, hereinafter called "tripleDES" [3DES] [DES]. Sending agents SHOULD support encryption with RC2/40 and tripleDES. I think that when taking pot-shots at PGP, Inc. and Phil Zimmerman one should look at what the alternatives are and who are really are friends here. IMNSHO companies like RSA, Netscape, Microsoft, Verisign, et al, who would sell us all out if it improved their bottom lines do not qualify. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNE8Iqo9Co1n+aLhhAQGWswP+MnvOCL1EoURWpEPt23I/UIuRWBovby8d AxZS3N8/exnI2M3kDCC2mTUWmvaKdsUnwErnXCQ9nQTDa9B+2VUBlijtkC+nsTV8 Vuv484AU51havdyttE87YMDXx8LSkdWnGXLs8TpjrRXiDZlxPJWIif3haK1hC5kg I3VmdwaZc/4= =7Fan -----END PGP SIGNATURE----- From whgiii at invweb.net Thu Oct 23 02:02:05 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 23 Oct 1997 17:02:05 +0800 Subject: [rc5] The unknown message is... In-Reply-To: Message-ID: <199710230856.EAA22265@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In , on 10/23/97 at 08:30 AM, lutz at taranis.iks-jena.de (Lutz Donnerhacke) said: >* Lutz Donnerhacke wrote: >> >You should not fake User IDs. You should sign your messages. :P - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNE8RyY9Co1n+aLhhAQGttAQAlVWw4j47eobNp43WULVUTC5DEnjEa3pp 7fKXGwxzlivbCfuB39dlFcLvbog+OPYnWi2JjkpsNMsrTZ6LbeKbeEyApjo5cc5B w4Z6+aGBZMy5SyLmVKiCHsWqMS2si7prJD5YUGvopeP7+CDoO+1/9NJxUzYnr2dD lLCgNsyaOCM= =ajoB -----END PGP SIGNATURE----- From phb at dev.null Thu Oct 23 02:54:19 1997 From: phb at dev.null (Phillip Half-Baked) Date: Thu, 23 Oct 1997 17:54:19 +0800 Subject: PGP, Inc.--What were they thinking? In-Reply-To: <01bcdf5a$4a2d3a60$06060606@russell> Message-ID: <344F1C80.6E0F@dev.null> Phillip M. Hallam-Baker wrote: > > I should point out before starting that I now work for Verisign. This > following personal opinion however and may not reflect any corporate policy > that may or may not exist. Knowing who is pulling Verisign's strings, I sincerely doubt that a thinly-veiled character assassination of Phil Zimmermann is out of line with their corporate policy. It's a little early to start cumming in your pants over PGP's loss of reputation capital, P[s]hill. When the dust is finished settling in the battle deciding whether we will live in a total surveillance state, or not, Verisign is likely to end up at the bottom of the dust-bin (unless, of course, you accomplish your aims at the company very, very quickly--which is highly unlikely). Phill Half-Baked "Stick a knife in me, I'm half-done." From mark at unicorn.com Thu Oct 23 03:26:59 1997 From: mark at unicorn.com (mark at unicorn.com) Date: Thu, 23 Oct 1997 18:26:59 +0800 Subject: PGP 5.5 CMR/GAK: a possible solution Message-ID: <877599242.19194.193.133.230.33@unicorn.com> jon at pgp.com wrote: > This is exactly CMR. The only thing that Business 5.5 does is automatically > add the department for you, and put up the recipient dialog so it can be > taken off. Congrats. On the contrary, it is *not* CMR. CMR encrypts to multiple keys for a single recipient. This system only ever encrypts to one key per recipient. PGP 5.5's ability to force people to encrypt to multiple keys for one recipient is the evil aspect of the design, because it's the one which allows it to be used to enforce GAK. PGP's CMR can be used to force everyone to encrypt to the FBI as well as the NSA. My system can't. I tried very hard to make this distinction clear in my description. I'm amazed that so many people seemed to miss it. Mark From mark at unicorn.com Thu Oct 23 04:53:00 1997 From: mark at unicorn.com (mark at unicorn.com) Date: Thu, 23 Oct 1997 19:53:00 +0800 Subject: PGP Employee on MKR Message-ID: <877607187.26935.193.133.230.33@unicorn.com> A PGP Employee wrote: >> Unfortunately these people just don't get it. Corporations refused >> to buy 5.0 because it did not have any way for the corps to get at >> email encrypted to their employees. There are some very legitimate >> uses of this, such as when an employee dies and someone else has >> to take over for them. No, PGP Inc 'just don't get it'. I'm sure that there are plenty of people out there who disagree with the entire concept of CMR, and I'm not very happy with it myself. But that's not the most important issue here. Since this point just doesn't seem to get through to PGP Inc employees, I'm going to shout. FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP AWAY FROM GAK. FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP AWAY FROM GAK! FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP AWAY FROM GAK!! FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP AWAY FROM GAK!! !!!*FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP AWAY FROM GAK*!!! Is that clear enough? Do you understand what I (and, apparently, Adam Back and others) am saying now? The problem is not so much with the fact that you're supporting company needs, but with the way you're doing so. >> They also don't seem to realize that you always have the ability >> to remove the MRK from your list of recipients. Just as government-supported rating schemes are purely voluntary and will be so for, oh, I don't know, a couple of years? Once the infrastructure is there, we need only an executive order to make it mandatory. If this software ships in its current form and becomes the dominant player in the market, in four or five years all keys will be GMR keys with the FBI or NSA as one mandatory recipient. You 'privacy zealots' will have created the government's surveillance infrastructure. I hope you'll feel proud. >> Sometimes I really feel like screaming at these people. _All_ of >> the developers at PGP are personal privacy zealots and no one >> likes the idea of the MRK. Good. Then reimplement it to avoid giving the government a GAK/GMR infrastructure. Yesterday I posted a modified version of PGP's CMR to the cypherpunks list which can't be used for GAK because it only encrypts to one key; Jon Callas just told me I'd 'redesigned PGP 5.5'. Cool. I've redesigned PGP 5.5 so that it can't support GAK; in that case, please implement it, or accept that you're deliberately choosing to support the thugs in governments around the world and have become part of the problem. >> That is why we refuse to make them >> required. Just 'mandatory voluntary' for companies which have your SMTP enforcer enabled. What's the difference? >> Most everyone at PGP has >> internalized personal privacy as a cause (actually most had it >> before they joined PGP). So prove it. Stop working on creating a GMR/GAK infrastructure. The current PGP CMR system has numerous problems which many people have pointed out on the cypherpunks list, and you'd do better to solve those problems rather than see them in a major New York Times article about '101 Ways PGP 5.5 Harms Company Security'. How long will PGP Inc last when it's reputation for providing secure products is in tatters, because it chose to release a product which deliberately reduced company security and opened them to new threats, rather than redesign their CMR to remove these problems? The current CMR implementation is bad for us, bad for PGP Inc's commercial customers, and bad for PGP Inc. Why is this so hard for you to accept? Why ship a bad product when you can fix the problems? Mark From mark at unicorn.com Thu Oct 23 04:57:04 1997 From: mark at unicorn.com (mark at unicorn.com) Date: Thu, 23 Oct 1997 19:57:04 +0800 Subject: PGP Employee on MKR Message-ID: <877607579.27586.193.133.230.33@unicorn.com> [Resent because god-damned Netscape screwed up the line-breaks] A PGP Employee wrote: >> Unfortunately these people just don't get it. Corporations refused >> to buy 5.0 because it did not have any way for the corps to get at >> email encrypted to their employees. There are some very legitimate >> uses of this, such as when an employee dies and someone else has >> to take over for them. No, PGP Inc 'just don't get it'. I'm sure that there are plenty of people out there who disagree with the entire concept of CMR, and I'm not very happy with it myself. But that's not the most important issue here. Since this point just doesn't seem to get through to PGP Inc employees, I'm going to shout. FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP AWAY FROM GAK. FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP AWAY FROM GAK! FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP AWAY FROM GAK!! FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP AWAY FROM GAK!! !!!*FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP AWAY FROM GAK*!!! Is that clear enough? Do you understand what I (and, apparently, Adam Back and others) am saying now? The problem is not so much with the fact that you're supporting company needs, but with the way you're doing so. >> They also don't seem to realize that you always have the ability >> to remove the MRK from your list of recipients. Just as government-supported rating schemes are purely voluntary and will be so for, oh, I don't know, a couple of years? Once the infrastructure is there, we need only an executive order to make it mandatory. If this software ships in its current form and becomes the dominant player in the market, in four or five years all keys will be GMR keys with the FBI or NSA as one mandatory recipient. You 'privacy zealots' will have created the government's surveillance infrastructure. I hope you'll feel proud. >> Sometimes I really feel like screaming at these people. _All_ of >> the developers at PGP are personal privacy zealots and no one >> likes the idea of the MRK. Good. Then reimplement it to avoid giving the government a GAK/GMR infrastructure. Yesterday I posted a modified version of PGP's CMR to the cypherpunks list which can't be used for GAK because it only encrypts to one key; Jon Callas just told me I'd 'redesigned PGP 5.5'. Cool. I've redesigned PGP 5.5 so that it can't support GAK; in that case, please implement it, or accept that you're deliberately choosing to support the thugs in governments around the world and have become part of the problem. >> That is why we refuse to make them >> required. Just 'mandatory voluntary' for companies which have your SMTP enforcer enabled. What's the difference? >> Most everyone at PGP has >> internalized personal privacy as a cause (actually most had it >> before they joined PGP). So prove it. Stop working on creating a GMR/GAK infrastructure. The current PGP CMR system has numerous problems which many people have pointed out on the cypherpunks list, and you'd do better to solve those problems rather than see them in a major New York Times article about '101 Ways PGP 5.5 Harms Company Security'. How long will PGP Inc last when it's reputation for providing secure products is in tatters, because it chose to release a product which deliberately reduced company security and opened them to new threats, rather than redesign their CMR to remove these problems? The current CMR implementation is bad for us, bad for PGP Inc's commercial customers, and bad for PGP Inc. Why is this so hard for you to accept? Why ship a bad product when you can fix the problems? Mark From ravage at ssz.com Thu Oct 23 05:54:48 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 23 Oct 1997 20:54:48 +0800 Subject: ADMIN: lost messages (fwd) Message-ID: <199710231312.IAA17874@einstein.ssz.com> Forwarded message: > From: Jeff Barber > Subject: ADMIN: lost messages > Date: Thu, 23 Oct 1997 08:22:06 -0400 (EDT) > CPunks list administrators, > > There appears to be an occasional breakdown in the list > distribution/reflection. I am sometimes seeing responses to articles > that I haven't received. For example, a message from > spencer_ante at webmagazine.com has been the subject of several > follow-ups (according to their In-reply-to fields, it is message > ID <88256538.00787D24.00 at pcwhub.pcworld.com>). Yes, there are occassional breakdowns in the communications between the list remailers. The reason that there are several of them is if one goes down for more than a few minutes the whole lists doesn't go down which would occur if we were still on a single remailer. In cases such as this I would suggest checking the archives provided by a couple of sites (I thought since I don't check the archives). > Any clues? Things get lost on occassion? ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From cyber at ibpinc.com Thu Oct 23 06:22:40 1997 From: cyber at ibpinc.com (Roger J Jones) Date: Thu, 23 Oct 1997 21:22:40 +0800 Subject: PGP 5.5 and the corporate environment Message-ID: <01BCDF8A.ABE713E0@PC1901> Just a small aside. Our help desk handles about 50 to 75 "I forgot my password" requests per day. This might be one small motivating factor why corporations desire an alternative method to recover encrypted files. From vince at offshore.com.ai Thu Oct 23 06:29:12 1997 From: vince at offshore.com.ai (Vincent Cate) Date: Thu, 23 Oct 1997 21:29:12 +0800 Subject: Laws recognizing digital signatures Message-ID: I have talked to people in government and the offshore private sector here and think Anguilla has a very good chance of passing a law making digital signatures legally recognized, at least for corporations. I think we would be the first taxhaven to do so. Currently companies use corporate seals. I mentioned that there were a few other jurisdictions that had passed some laws like this and they would like me to try to pin down which and, if possible, get copies of the laws. I remember some talk about this on cypherpunks, so I am hoping someone here can tell me which places (think there was some state) have such laws, and if possible tell me where I can get a copy. Thanks, -- Vince ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vincent Cate Offshore Information Services Vince at Offshore.com.ai http://www.offshore.com.ai/ Anguilla, BWI http://www.offshore.com.ai/vince ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From ravage at ssz.com Thu Oct 23 06:32:26 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 23 Oct 1997 21:32:26 +0800 Subject: SSZ - ISDN repairs today... Message-ID: <199710231357.IAA18015@einstein.ssz.com> Hi, As most of you are aware SSZ has been experiencing a great deal of ISDN stability issues the last 4-6 weeks (since the move to the new location). To date we have been through a cable throw from one trunk line to another which involved switching CO's. Since that throw we have seen intermittent outages lasting from a minute or so up to 15 minutes (perhaps longer but I didn't see them since logging is not always turned on). Well I get up this morning and find the ISDN exhibiting the exact same sort of intermittetent outages from last weekend, except now they ain't so intermittent. Seems the cool weather and light rain have exacerbated the issue such that we are in a nearly continous connect-disconnect cycle. We are still passing packets with no loss, beit slowly. I called SWBT and they are sending a installer out to put the line on another distinct pair as well as putting in a repeater to boost the pair-gain. Expect there to be intermittent outages of an hour or more today. If the fixes work we should be rock-solid again. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From pgut001 at cs.auckland.ac.nz Thu Oct 23 06:32:48 1997 From: pgut001 at cs.auckland.ac.nz (Peter Gutmann) Date: Thu, 23 Oct 1997 21:32:48 +0800 Subject: Use crypto, face a death squad Message-ID: <87761312106967@cs26.cs.auckland.ac.nz> There have been various rumours and comments over the past few years that the use of crypto in certain countries (Syria, Iraq, possibly China) is very dangerous for the end user, but very little actual evidence to substantiate this. About a week ago I got some evidence (well, something better than the usual rumours) on the situation with using crypto in Iraq which people might find interesting. I was talking to someone who worked for a large multinational corporation which maintains a comprehensive directory of who to contact in each country they operate in (basically every country on earth, this was before the gulf war so Iraq was included) for any kind of emergency. This consists of a huge file of data intended to cover every imaginable type of situation. Included in the information on Iraq was a comment to the effect that you should never, ever use any form of encryption when sending messages to the contact people there. He can't remember the exact details any more, but the implication was that any encrypted messages sent to them would result in them quietly disappearing. Since this was a very big company with a lot of sensitive information which it would go to great lengths to protect, I would assume they had very good reasons for advising against the use of crypto in this instance. Peter. From lutz at taranis.iks-jena.de Thu Oct 23 06:41:58 1997 From: lutz at taranis.iks-jena.de (Lutz Donnerhacke) Date: Thu, 23 Oct 1997 21:41:58 +0800 Subject: shared keys, proxy encryption (was Re: PGP 5.5 CMR/GAK: a In-Reply-To: <877514566.20581.193.133.230.33@unicorn.com> Message-ID: * Jon Callas wrote: >This is why any sort of shared or escrowed keys suck. But in most cases ... especially recoverable (escrowed) message keys. From lutz at taranis.iks-jena.de Thu Oct 23 06:42:02 1997 From: lutz at taranis.iks-jena.de (Lutz Donnerhacke) Date: Thu, 23 Oct 1997 21:42:02 +0800 Subject: shared keys, proxy encryption (was Re: PGP 5.5 CMR/GAK: a In-Reply-To: <199710222033.VAA05775@server.test.net> Message-ID: * Adam Back wrote: >One thing I never did get clear is: does pgp5.0 know how to reply to >the CMR denoted extra recipients? Yes. (AFAI read the source). It uses ALL these keys optional or required to encrypt an answer to. I a keys is missing encryption fails. >It also avoids key escrow for communication keys, and allows separate >personal and company use storage keys, makes recommendations for Included in the current Open PGP draft. From 0002595870 at MCIMAIL.COM Thu Oct 23 06:48:32 1997 From: 0002595870 at MCIMAIL.COM (Jeffrey Gold) Date: Thu, 23 Oct 1997 21:48:32 +0800 Subject: Fwd: 56-bit RSA/RC5 Cracked Message-ID: <01IP5CLUNFGQANBQN6@DGN0IG.mcimail.com> Apologies if this already seen - JG =================================== Date: Wed, 22 Oct 1997 18:26:52 -0400 To: mac crypto list From: Vinnie Moscaritolo Subject: RC5 cracked Press Release and Background Sheet FORMAL PRESS RELEASE For Immediate Release Contact: David McNett October 22,1997 205-458-8208 SECURE ENCRYPTION CHALLENGED BY INTERNET-LINKED COMPUTERS CHICAGO, IL (October 22, 1997) In what could be called the largest distributed-computing effort ever, tens of thousands of computers linked across the Internet, under the leadership of distributed.net, decrypted a message encoded with RSA Labs' 56-bit RC5 encryption algorithm. Considered by many experts to be a sufficient level of encryption, this feat has cast grave doubts in the minds of analysts as to the level of encryption required to keep private data secure. "Our effort has shown that it is dangerous to consider any 56-bit key secure", says David McNett, one of the primary coordinators of this distributed supercomputing project. The distributed.net effort to decrypt the encoded message required massive computing power, harnessed by utilizing the idle, or otherwise unused computing power from ordinary office and home computers. Combined, these machines managed to evaluate 47% of the keyspace, or 34 quadrillion keys, before finding the winning key. At the close of the contest there were over 4000 active teams processing over 7 billion keys each second at a combined computing power equivalent to more than 26 thousand high-end personal computers. The work was performed entirely using consumer PCs during off-hours or otherwise idle time. Add them all together, however, and you have the world's largest computer. The winning key was found by Peter Stuer, working for the STARLab Bovine Team coordinated by Jo Hermans and centered in the Computer Science Department (DINF) of the Vrije Universiteit in Brussels, Belgium. Of the US$10000 prize from RSA Labs, Mr. Stuer will receive US$1000. US$8000 is being donated to Project Gutenberg, a non-profit organization created for the purpose of converting the classics of literature into electronic format for the unlimited public use. The remaining US$1000 is being retained by distributed.net to assist in funding future projects. Distributed.net is the brainchild of Adam L. Beberg. It is the largest non-profit venture focused on developing the full potential of distributed computing. Its purpose is to utilize the Internet, allowing home and office computer users to join forces in tackling great and seemingly insurmountable computational challenges. The net result is computing power sufficient to challenge the dominance of even the most expensive mainframes and research computers. Information about distributed.net is available from the official distributed.net web site at: http://www.distributed.net/ MEDIA CONTACTS: David McNett, Voice: (205) 458-8208, Fax: (205) 458-8206 nugget at distributed.net ALTERNATE: Adam L. Beberg, (708) 396-9532, beberg at distributed.net ------------------------------------------------------------------ SECURE ENCRYPTION CHALLENGED BY INTERNET-LINKED COMPUTERS Background for release dated October 22, 1997 distributed.net data sheet distributed.net web site: http://www.distributed.net/ Related sites: Project Gutenberg: http://www.promo.net/pg/ RSA Labs: http://www.rsa.com/rsalabs/ RSA Secret Key Challenge: http://www.rsa.com/rsalabs/97challenge/ Principal organizers: Adam L. Beberg, Software Engineer, Chicago, Illinois Jeff Lawson, Junior Computer Science Major, Harvey Mudd College, Claremont, California David McNett, Computer Programmer/Network Administrator, Birmingham, Alabama Project statistics: Start of contest: January 28, 1997 Start of distributed.net effort: March 20, 1997 End of contest: October 19, 1997 Size of keyspace: 72,057,594,037,927,936 Number of "blocks":268,435,456 Number of keys in one "block": 268,435,456 Peak keys/day: 600,246,644,113,408 Peak keys/second: 7,200,000,000 (estimated) The unencrypted message: "It's time to move to a longer key length" Computing equivalents: Distributed.net is equivalent in processing power to: 14,685 Intel Pentium Pro 200 processors 13,362 Motorola PowerPC 604e/200 processors 116,326 Intel 486DX2/66 processors 58,163 Intel Pentium 133 processors Perspective: distributed.net could compromise 46-bit RC5 in under one hour. If you printed a single page to represent each key block as it was checked and placed those pages in a stack, it would grow 6.24 inches taller every minute. If keys were drops of water, the flow rate would be 464428 litres per second. If Keys were dollars, we could pay off the U.S. National Debt in 12.44 minutes. If keys were bytes, we could fill 290268 3 1/2" floppy diskettes every minute If keys were drops of water, the flow rate would be 122609 gallons per second. If Key Blocks were hamburgers, we could feed the entire city of Phoenix, AZ lunch each day The computer that found the key: CPU: Intel Pentium Pro 200 RAM: 128 megabytes Operating System: Microsoft Windows NT Workstation 4.0 Owner: Vrije Universiteit, Brussels, Belgium Operator: Peter Stuer More information: http://dinf.vub.ac.be/bovine.html/ MEDIA CONTACTS: David McNett, Voice: (205) 458-8208, Fax: (205) 458-8206 nugget at distributed.net ALTERNATE: Adam L. Beberg, (708) 396-9532, beberg at distributed.net --Brian Bechtel, blob at ricochet.net Vinnie Moscaritolo http://www.vmeng.com/vinnie/ Fingerprint: 3F903472C3AF622D5D918D9BD8B100090B3EF042 "You can get a lot more with a smile and a gun then a smile, alone." - Al Capone -- Robert Guerra - PGP public key available on PGP key servers Email-> mailto:az096 at freenet.toronto.on.ca Home Page-> http://www.geocities.com/CapitolHill/3378 From lutz at taranis.iks-jena.de Thu Oct 23 06:59:48 1997 From: lutz at taranis.iks-jena.de (Lutz Donnerhacke) Date: Thu, 23 Oct 1997 21:59:48 +0800 Subject: [rc5] The unknown message is... In-Reply-To: <199710230856.EAA22265@users.invweb.net> Message-ID: * William H. Geiger III wrote: >>* Lutz Donnerhacke wrote: >>You should not fake User IDs. > >You should sign your messages. :P I should work... From mark at unicorn.com Thu Oct 23 07:03:32 1997 From: mark at unicorn.com (mark at unicorn.com) Date: Thu, 23 Oct 1997 22:03:32 +0800 Subject: PGP 5.5 CMR/GAK: a possible solution Message-ID: <877615176.6781.193.133.230.33@unicorn.com> tcmay at got.net wrote: > Our mileages apparently vary. When _I_ send a message to, say, Jon Callas > at PGP, Inc., it is to Jon Callas, not to others. It might be a job offer, > it might be an invitationf for him to help monkeywrench CMR, it might be a > stock tip, it might be a comment about a conversation we had a party, it > might be a lot of things. Hmm, as usual, you make a good point. The uses I was thinking of were the kind of uses that people have suggested as reasons for CMR; emailing orders, etc to companies. Today I rarely do that because telephoning companies is much easier, and in the future I'd expect to be sending most of them over the Web rather than by email. I presume these *are* the kind of uses that PGP Inc are expecting, since their system seems to have no other value except as snoopware. > If I was sending it to "Jon's coworkers in Department Z," I probably either > wouldn't encrypt it at all, or would (if the option existed) encrypt to > some departmental or group key. Yep, which is basically what I was suggesting. The user chooses which key to use based on their perception of the sensitivity of the message, not the enforced company policy. If it's confidential, it's confidential; if the company think I'm up to no good they can come around and force me to decrypt a particular message, or sack me if I refuse. Their call. > I expect those who adopt CMR will find an awful lot of folks will just give > up on trying to communicate with those living in a CMR regime. Ditto, at least if it's PGP's current 'mandatory voluntary' snoopware design. I won't be running any version of PGP which includes this 'feature' in its current form; I would also suggest that we boycott any scanning and proofreading efforts for future versions of PGP which include this code, or remove it from the source before release. If PGP's commercial customers lose business as a result, that's their choice. Mark From T.G.Griffiths at exeter.ac.uk Thu Oct 23 07:30:00 1997 From: T.G.Griffiths at exeter.ac.uk (Tim Griffiths) Date: Thu, 23 Oct 1997 22:30:00 +0800 Subject: Use crypto, face a death squad In-Reply-To: <87761312106967@cs26.cs.auckland.ac.nz> Message-ID: <7c7e99dd47%Tim@tim01.ex.ac.uk> In message <87761312106967 at cs26.cs.auckland.ac.nz> Peter wrote: > > There have been various rumours and comments over the past few years that > the > use of crypto in certain countries (Syria, Iraq, possibly China) is very > dangerous for the end user, but very little actual evidence to substantiate > this. > [snip, with reference to Iraq] > He can't remember the exact details any more, but the implication was > that any encrypted messages sent to them would result in them quietly > dissapearing. So a possible consequence of someone from Iraq being obnoxious on a mailing list, to someone in the know, could be several PGP-encrypted mails dumped in their inbox... A little extreme, for us gentles, but the threat should be effective. Of course, spamming every Iraqui email address you could find with encoded mail could cause a _lot_ of trouble. Tim G. From JonWienk at ix.netcom.com Thu Oct 23 07:55:59 1997 From: JonWienk at ix.netcom.com (Jonathan Wienke) Date: Thu, 23 Oct 1997 22:55:59 +0800 Subject: CDR design document In-Reply-To: <199702212255.WAA01213@server.test.net> Message-ID: <3.0.3.32.19971023073713.031381e0@popd.netcruiser> At 10:55 PM 2/21/97 GMT, Adam Back wrote: > >Here is a proposal for consideration for inclusion in the OpenPGP >standard: > > http://www.dcs.ex.ac.uk/~aba/cdr/ Great work, Adam! Pursuant to some of the recent rants on cypherpunks, I would like to see a proposal for a secret sharing mechanism that would allow the recovery of a storage-only key with m of n shares in the event that the passphrase to the storage key is unavailable, with the following attributes: 1. Secret-sharing should be strongly discouraged for signature and communication keys, for obvious anti-GAK/GACK reasons. 2. The values of m and n should be definable by the generator of (or anyone who knows the passphrase to) the storage key. 3. The sharing algorithm and format of the share packets should be standardised, so that any open-pgp compliant application can recover the storage key without a passphrase, given the key and a sufficient number of valid shares. Jonathan Wienke What part of "the right of the people to keep and bear Arms, shall not be infringed" is too hard to understand? (From 2nd Amendment, U.S. Constitution) PGP 2.6.2 RSA Key Fingerprint: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 DSS/D-H Key Fingerprint: 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC Public keys available at pgpkeys.mit.edu. PGP encrypted e-mail preferred. US/Canadian Windows 95/NT or Mac users: Get Eudora Light + PGP 5.0 for free at http://www.eudora.com/eudoralight/ Get PGP 5.0 for free at http://bs.mit.edu:8001/pgp-form.html Non-US PGP 5.0 sources: http://www.ifi.uio.no/pgp/ http://www.heise.de/ct/pgpCA/download.shtml ftp://ftp.pca.dfn.de/pub/pgp/V5.0/ ftp://ftp.fu-berlin.de/pub/pc/win95/pgp ftp://ftp.fu-berlin.de/pub/mac/pgp http://www.shopmiami.com/utopia.hacktic.nl/pub/replay/pub/pgp/pgp50/win/ RSA export-o-matic: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 From ariel at watsun.cc.columbia.edu Thu Oct 23 08:06:50 1997 From: ariel at watsun.cc.columbia.edu (Ariel Glenn) Date: Thu, 23 Oct 1997 23:06:50 +0800 Subject: Cyberterrorism report according to the NYT Message-ID: Day before yesterday I actually saw Ian Goldberg and David Wagner on CNN Headline news, second billing after some auto fuel cell thing, talking about weak encryption etc. in the context of the White House report on cyberterrorism. In any case here's the NYT take on it... Ariel Glenn ariel at columbia.edu ----- [beginning irrelevance deleted] The use of encryption by United States residents has been a hotly debated security issue in the White House, in Congress and on the Internet. Louis J. Freeh, the director of the Federal Bureau of Investigation, has testified repeatedly that allowing private citizens to use unbreakable encryption would enable criminals to mask their activities unless the police are allowed keys to all scrambled communications. Even so, the commission's report appears to suggest that widespread use of encryption is the nation's first line of defense against attacks by terrorists or spies who want to steal information or eavesdrop. Sophisticated systems like digital signatures can prevent terrorists from shutting down networks, crashing individual computers or erasing databases. Several people familiar with the commission's work, all of whom asked that they not be named, said that the panel had come under intense pressure to support the FBI's plan to build in trap doors known as "key recovery systems" into encryption schemes to make scrambled data easily accessible to the police. In the end, the commission did endorse key recovery, but only because such systems would allow people and companies to recover data if their own keys were lost. It stopped short of recommending easy access for law enforcement. In the interview on Tuesday, Marsh avoided commenting directly on the FBI's assertion that it needs "instant access" to all communications in the nation, saying only that the commission did not "probe into that in great depth." "Exactly how that is done," Marsh said of key recovery systems, "the commission is not expert at that." Some security analysts have argued that a widespread key recovery system could turn out to be a major vulnerability because if it was ever infiltrated or compromised, it would offer cyber-terrorists a database full of keys that could unlock significant portions of communications and computer systems in the United States. In addition to terrorists, any insider could easily reveal secret or proprietary data, either accidentally or maliciously. In recent months, for example, the FBI has been criticized for releasing the background files of Republican leaders to the White House, apparently because of a clerical error. [more irrelevance deleted] Peter Neumann, author of Computer-Related Risks, said of the report: "I think the Commission has made a very important first step toward recognizing the vulnerabilities, threats, and risks." Even so, Neumann said: "They could have gone much further in addressing the risks of the inherently weak computer-communication infrastructures that underlie our critical infrastructures. Also, they almost completely ducked the importance of nonsubvertible cryptography, and issues relating to the intrinsic risks of key-recovery schemes. But the real question is: Where does the government go from here?" From trader at airmail.net Thu Oct 23 09:05:15 1997 From: trader at airmail.net (Scott L. Haire) Date: Fri, 24 Oct 1997 00:05:15 +0800 Subject: (no subject) Message-ID: <344F89D6.7125@airmail.net> Whats the deal on checking out DL info. on the web? I'd like to know what available info is on the web concerning my DL. From harish at ganymede.contact.com.sg Thu Oct 23 09:09:44 1997 From: harish at ganymede.contact.com.sg (Harish Pillay) Date: Fri, 24 Oct 1997 00:09:44 +0800 Subject: Singaporean control freaks & CMR (Re: puff pieces vs tough crypto issues) In-Reply-To: <199710221838.TAA04516@server.test.net> Message-ID: <199710231543.XAA02822@ganymede.contact.com.sg> Hi. For the sake of sanity and completeness, the following has to be corrected. > Declan McCullagh writes: > > The relevance? Another example of Singapore's loony politics. Strict social > > controls and relative economic freedom. I find it fascinating in light of > > Net-filtering and other attempts at restricting information flow; if you > > don't, well, you can always delete it. :) > > The net-filtering and social control aspects of Singapore are very > interesting. Seems that somewhere like Singapore might be an earlier > adopter of mandatory GAK -- social ills have hugely disproportionate > treatment over there. I hear (and our Singaporean contributer > confirms) that chewing gum is illegal, jay walking too. (Hey you have > the jay walking laws in the US too don't you?) (I missed the social > control aspect of the vote for kewlest public toilet story). Chewing gum per se is not illegal. I just cannot buy them from any store in Singapore. I can chew to my heart's content. I can go up north to Malaysia, buy a whole month's supply of gum (name your flavour) and bring it back into Singapore. So, what is moronically illegal is that I cannot sell that pack of gum. Regards. -- Harish Pillay h.pillay at ieee.org Singapore *** Ask me about Linux *** http://home.pacific.net.sg/~harish From agrapa at banamex.com Thu Oct 23 09:18:15 1997 From: agrapa at banamex.com (Arturo Grapa Ysunza) Date: Fri, 24 Oct 1997 00:18:15 +0800 Subject: Bill Gates, the Bully Savior Message-ID: I too have my doubts about Microsoft software. Yes, they clearly >dominate a very lucrative market largely due to, as you mention, "sheer incompetance on the part of the rest of the industry" but another important reason is better marketing. Netscape, for example, could have beaten out MS if they had had better marketing and strategy (incompetance?). I believe the point of the Justice Dept. investigations is anti-trust issues more than it is a witch hunt. We all know that monopolies can, but not necesarily do, produce inferior products. Anti-trust laws are meant to facilitate competition on even ground and that can lead to better products for us the consumers. MS can�t be blamed for the incompetence of the rest of the industry. If MS wins anti-trust litigation then so be it but someone has to keep them in check. We elect the people who appoint others to review these matters. If no one does it then soon we�ll see "Microsoft Compatible" stickers on the dashboards of our cars, toasters, beepers, etc. And what will happen to Unix then when we live in a Microsoft compatible world? BTW, my beef with MS is primarily quality. If they want to dominate the market then they better give me quality or I�ll spend my money elsewhere. Would you buy a Ford if you knew the tires would fall off if you don�t install the **latest-and-greatest Service Pack**? I, for one, will keep bugging MS to produce better products. In the meantime, I�ll keep buying from the Unix side (which is also lagging). Arturo Grapa Ysunza agrapa at banamex.com Ing. de Comunicaciones Banco Nacional de M�xico, S.A. http://www.banamex.com/ >---------- >Desde: Declan McCullagh[SMTP:declan at well.com] >Enviado el: Mi�rcoles 22 de Octubre de 1997 1:07 PM >Para: Lizard >Cc: Jennifer S. Granick >Asunto: Re: Bill Gates, the Bully Savior > >There was a good op-ed in the WSJ on Monday. The Politics of Envy, >basically. Why everyone in Silicon Valley hates Microsoft... > >But some of the complaints about Microsoft come down to personal taste. The >masses offend refined sensibilities when they buy Windows 95 in droves. >Rein them in! Stop them from buying what they want! Don't let them get free >copies of Internet Explorer. > >I share Lizard's distaste for Microsoft products. My Unix workstation at >home has not one MSFT application on it. I have only Microsoft Word on my >Duo at work, and I could get by with WordPerfect. But our dislike for their >products doesn't mean that we are morally justified in restricting what the >company can do. > >-Declan > > > >At 10:42 -0700 10/22/97, Lizard wrote: >>Uhm...how do 'we all' benefit from having the same Justice Department which >>defended the CDA (and which is pushing for GAK) decide for us all what is, >>and is not, part of an operating system? >> >>These people are not qualified to make ANY judgements about computers -- I >>have to assume the 'experts' they got to tell them about OS software are no >>more qualified than the 'experts' they got to testify about the CDA (L-18, >>anyone?). >> >>I have no great love for Microsoft (I don't think anyone forced to use >>their crappy software does), and, emotionally, I'd like to see them get >>taken down a peg -- but legally and ethically, they are not doing anything >>wrong. They're just being tough competitors. Microsoft has prospered not >>due to any technical brilliance on their part, but due to sheer >>incompetance on the part of the rest of the industry, who have made a hobby >>of underestimating Bill Gates and overestimating their own customers >>loyalty. >> >>It's a pity I'm a mind-flaying victim. If I wasn't, I could forget >>principles and ideals and just say, "Microsoft Big. Microsoft Nasty. Uncle >>Sam stomp Microsoft. Yay, Uncle Sam." But because I work from principle >>FIRST, I have to grant Microsoft the same rights I would grant Sam's Deli >>or Joe's Shoe Store, and that includes the right to offer any combination >>of products or services they wish, and let the market decide to buy or not. > > > >------------------------- >Declan McCullagh >Time Inc. >The Netly News Network >Washington Correspondent >http://netlynews.com/ > > > From whgiii at invweb.net Thu Oct 23 09:30:45 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Fri, 24 Oct 1997 00:30:45 +0800 Subject: What RSA & Netscape have to offer Message-ID: <199710231619.MAA26362@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- Hi, While the list is busy knocking PGP for not doing the "right thing" or being the "first ones to blink" I though I would share with the list what some of the "big boys" are doing for the spread of "Strong Crypto to the Masses". Below is from the most current S/MIME draft "draft-dusse-smime-msg-05" dated 19-Oct-1997: 2.6 ContentEncryptionAlgorithmIdentifier Receiving agents MUST support decryption using the RC2 [RC2] or a compatible algorithm at a key size of 40 bits, hereinafter called "RC2/40". Receiving agents SHOULD support decryption using DES EDE3 CBC, hereinafter called "tripleDES" [3DES] [DES]. Sending agents SHOULD support encryption with RC2/40 and tripleDES. I think that when taking pot-shots at PGP, Inc. and Phil Zimmerman one should look at what the alternatives are and who are really are friends here. IMNSHO companies like RSA, Netscape, Microsoft, Verisign, et al, who would sell us all out if it improved their bottom lines do not qualify. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNE8Iqo9Co1n+aLhhAQGWswP+MnvOCL1EoURWpEPt23I/UIuRWBovby8d AxZS3N8/exnI2M3kDCC2mTUWmvaKdsUnwErnXCQ9nQTDa9B+2VUBlijtkC+nsTV8 Vuv484AU51havdyttE87YMDXx8LSkdWnGXLs8TpjrRXiDZlxPJWIif3haK1hC5kg I3VmdwaZc/4= =7Fan -----END PGP SIGNATURE----- From tcmay at got.net Thu Oct 23 09:56:49 1997 From: tcmay at got.net (Tim May) Date: Fri, 24 Oct 1997 00:56:49 +0800 Subject: Use crypto, face a death squad In-Reply-To: <87761312106967@cs26.cs.auckland.ac.nz> Message-ID: At 7:25 PM -0700 10/23/97, Peter Gutmann wrote: >There have been various rumours and comments over the past few years that the >use of crypto in certain countries (Syria, Iraq, possibly China) is very >dangerous for the end user, but very little actual evidence to substantiate >this. About a week ago I got some evidence (well, something better than the >usual rumours) on the situation with using crypto in Iraq which people might >find interesting. ... > He can't remember the exact details any more, but the implication was >that any encrypted messages sent to them would result in them quietly >disappearing. Sounds like an easy way to get rid of business competitors, enemies, etc. Just send them an encrypted message. If paranoid, use a remailer. As soon as some of those Islamic fundamentalists get on the Net, look out! By the way, when PGP Snoopware becomes more widespread, and companies start bouncing e-mail messages not properly encrypted to the Security Department's CMR key, I plan to start lobbing encrypted messages to random employees, marked "URGENT." Be interesting to then send them followups, "But didn't you get the message I marked "URGENT" for you? Well, it's too late now...." Monkeywrenching Snoopware is going to be _fun_. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From whgiii at invweb.net Thu Oct 23 09:57:55 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Fri, 24 Oct 1997 00:57:55 +0800 Subject: Singaporean control freaks & CMR (Re: puff pieces vs tough crypto issues) In-Reply-To: <199710231543.XAA02822@ganymede.contact.com.sg> Message-ID: <199710231649.MAA26636@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <199710231543.XAA02822 at ganymede.contact.com.sg>, on 10/23/97 at 11:43 PM, Harish Pillay said: >Hi. For the sake of sanity and completeness, the following has to be >corrected. >> Declan McCullagh writes: >> > The relevance? Another example of Singapore's loony politics. Strict social >> > controls and relative economic freedom. I find it fascinating in light of >> > Net-filtering and other attempts at restricting information flow; if you >> > don't, well, you can always delete it. :) >> >> The net-filtering and social control aspects of Singapore are very >> interesting. Seems that somewhere like Singapore might be an earlier >> adopter of mandatory GAK -- social ills have hugely disproportionate >> treatment over there. I hear (and our Singaporean contributer >> confirms) that chewing gum is illegal, jay walking too. (Hey you have >> the jay walking laws in the US too don't you?) (I missed the social >> control aspect of the vote for kewlest public toilet story). >Chewing gum per se is not illegal. I just cannot buy them from any store >in Singapore. I can chew to my heart's content. I can go up north to >Malaysia, buy a whole month's supply of gum (name your flavour) and bring >it back into Singapore. >So, what is moronically illegal is that I cannot sell that pack of gum. Signapore is a prime example of "mirco management" at it's worst. Whenever such management is attempted either in the public or private sector they fail. It should be intresting to see how long Singapore can keep it up. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNE+Ar49Co1n+aLhhAQFkGgP9EBgH35RfnpFLuWUnZnLESCeShTmAiOMG hClqCT7hKdjjqnfxAaPU5DlLKcTsgYlssMXiv8q0T2C+g7vooI+QAHvEowArY4Vo UxjaQgcsCF7gbVccJwTzBzaGBushiMJx1bUVsdFpWn/H/LfOaPbKSaBj4uFCV71q zOuU1jIqbZg= =2hOc -----END PGP SIGNATURE----- From tcmay at got.net Thu Oct 23 10:01:42 1997 From: tcmay at got.net (Tim May) Date: Fri, 24 Oct 1997 01:01:42 +0800 Subject: What RSA & Netscape have to offer In-Reply-To: <199710230817.EAA21914@users.invweb.net> Message-ID: At 1:19 AM -0700 10/23/97, William H. Geiger III wrote: >While the list is busy knocking PGP for not doing the "right thing" or >being the "first ones to blink" I though I would share with the list what >some of the "big boys" are doing for the spread of "Strong Crypto to the >Masses". Below is from the most current S/MIME draft >"draft-dusse-smime-msg-05" dated 19-Oct-1997: ... >I think that when taking pot-shots at PGP, Inc. and Phil Zimmerman one >should look at what the alternatives are and who are really are friends >here. IMNSHO companies like RSA, Netscape, Microsoft, Verisign, et al, who >would sell us all out if it improved their bottom lines do not qualify. The consistent theme of the Cyphepunks contributors, modulo the noise and insults and general fun over the past 5 years, has been to call a spade a spade. That is, regardless of what the alternatives may be, we call them as we see them. Weaknesses are weaknesses. Science dictates what we say. "But Bad Option B is even worse than Bad Option A, so we should support Bad Option A" is not very compelling to most of us. That other companies may also be preparting GAK or GMR or deliberately weakened ciphers is hardly news. Big Brother is leaning on companies in many ways, ranging from threats of lawsuits, to antitrust actions, to denial of export permits, to dangling lucrative contracts. And the alternatives, for us as users, are not necessarily PGP for Business 5.5 vs. Netscape for Security Departments vs. Internet Explorer for Fascists. No, the alternatives are to continue using ciphers with strong cores and long keys. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From tcmay at got.net Thu Oct 23 10:17:07 1997 From: tcmay at got.net (Tim May) Date: Fri, 24 Oct 1997 01:17:07 +0800 Subject: PGP 5.5 CMR/GAK: a possible solution In-Reply-To: <877615176.6781.193.133.230.33@unicorn.com> Message-ID: At 6:59 AM -0700 10/23/97, mark at unicorn.com wrote: >tcmay at got.net wrote: > >> Our mileages apparently vary. When _I_ send a message to, say, Jon Callas >> at PGP, Inc., it is to Jon Callas, not to others. It might be a job offer, >> it might be an invitationf for him to help monkeywrench CMR, it might be a >> stock tip, it might be a comment about a conversation we had a party, it >> might be a lot of things. > >Hmm, as usual, you make a good point. The uses I was thinking of were the >kind of uses that people have suggested as reasons for CMR; emailing orders, >etc to companies. Today I rarely do that because telephoning companies is >much easier, and in the future I'd expect to be sending most of them over >the Web rather than by email. I presume these *are* the kind of uses that >PGP Inc are expecting, since their system seems to have no other value >except as snoopware. And things like purchase orders, contract negotiations, etc., are best handled by storing in plaintext. Communications security is just that: _communications_ security, not storage security. These sorts of items--purchase orders, etc.--will likely exist on employee machines in plaintext. Or encrypted to the storage key the employee is using. (Will PGP for Business deal with this reality in any meaningful way? This is the real "disaster planning" scenario, that Joe Employee's 4 GB hard drive is either fully encrypted, or is filled with encrypted files. With the increasing use of "open landscaping" in offices, machine security in cubicles is probably more important than communications security. At Intel I used to find my machines had sometimes been played with by the nightime shift....and I'd find sandwich wrappers and Coke cans in my trashcan, and crumbs, indicating that some swing or graveyard shift worker had used my office as his own little lunchroom. Were I still working, I'd certainly be encrypting my files against casual snooping. Or even industrial espionage snooping. And I wouldn't be using my communications key!) >> If I was sending it to "Jon's coworkers in Department Z," I probably either >> wouldn't encrypt it at all, or would (if the option existed) encrypt to >> some departmental or group key. > >Yep, which is basically what I was suggesting. The user chooses which key >to use based on their perception of the sensitivity of the message, not >the enforced company policy. If it's confidential, it's confidential; if >the company think I'm up to no good they can come around and force me to >decrypt a particular message, or sack me if I refuse. Their call. I agree, but this doesn't seem to be the way PGP 5.5 and its Policy Enforcer will work. Users (senders from outside, like me) will not have the options you describe. My private message to Jon Callas will not get through to him unless I also encrypt to the Security Department's CMR key...and they may have some interesting questions for him about the content of my message! (Yes, as always, companies have the right to demand pretty much anything they please. No debate there. What we're arguing is the wisdom, on multiple fronts, of PGP, Inc. building in Big Brother like this.) >Ditto, at least if it's PGP's current 'mandatory voluntary' snoopware >design. I won't be running any version of PGP which includes this >'feature' in its current form; I would also suggest that we boycott any >scanning and proofreading efforts for future versions of PGP which include >this code, or remove it from the source before release. If PGP's commercial >customers lose business as a result, that's their choice. I think a boycott of PGP's products is a distinct possibility, from what I'm hearing. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From agrapa at banamex.com Thu Oct 23 10:24:01 1997 From: agrapa at banamex.com (Arturo Grapa Ysunza) Date: Fri, 24 Oct 1997 01:24:01 +0800 Subject: Bill Gates, the Bully Savior Message-ID: Almost. The government should regulate MS for anti-trust reasons. As I mentioned "If MS wins anti-trust litigation then so be it". >---------- >Desde: Lizard[SMTP:lizard at mrlizard.com] >Enviado el: Jueves 23 de Octubre de 1997 11:38 AM >Para: Arturo Grapa Ysunza Cc: 'Jennifer S. Granick' >Asunto: RE: Bill Gates, the Bully Savior > >At 07:20 PM 10/22/97 -0500, Arturo Grapa Ysunza wrote: > >>MS can�t be blamed for the incompetence of the rest of the industry. If >>MS wins anti-trust litigation then so be it but someone has to keep them >>in check. We elect the people who appoint others to review these >>matters. > >Lemme see if I've got this straight. > >The rest of the industry, due to stupidity, lethargy, or other >incompetance, can't compete succesfully with Microsoft. > >Therefore, the government must regulate Microsoft, in order to give the >other companies a fair chance. > >Uh-HUH. > >Who is John Galt? > From emc at wire.insync.net Thu Oct 23 10:24:50 1997 From: emc at wire.insync.net (Eric Cordian) Date: Fri, 24 Oct 1997 01:24:50 +0800 Subject: [RANT] Why America Can't Compete Message-ID: <199710231711.MAA05853@wire.insync.net> I've just uncovered a massive plot to destroy our nation's competitiveness and inculcate its young people in the collectivist mentality. The tool? Youth sports! This morning's AP wire reports that two football coaches are suing a youth football league after being banned for life because their 11 and 12 year old players won by too large a point spread. Apparently, and I find this truly shocking, it is a common practice in youth sports today to have a rule limiting the number of points by which a game may be won, with horrendous sanctions for violating it. Winning by more than that, it is argued, is "demoralizing" to the other team, and (Gasp!) UNETHICAL! Once the designated point spread is reached, coaches must order their players to deliberately lose, play badly, and act retarded. I became aware of this idiotic practice after I mentioned the AP article to several people, and rather than throwing up their arms in horror, they volunteered that their own local teams had such rules as well. It's time to check closely, to make sure such shenanigans are not afoot in your town, polluting the entrepreneurial spirit of your very own children. Imagine if Ross Perot had played on such a team, or Bill Gates, or Adolf Hitler? The entire course of history might have been changed. ----- FRIENDSWOOD, Texas (AP) -- Two volunteer coaches are taking a youth football league to court after they were banned for life because their 11- and 12-year-old players couldn't resist playing hard. After the Sagemont Cowboys destroyed the Friendswood Chiefs 62-0 on Oct. 4, the Bay Area Football League banned twin brothers Roy and Rene Aguilar -- whose team has dominated the league for several years. ``They're saying that because we demoralized the other team and that we are teaching the kids unethical practices that we're out for life,'' Rene Aguilar, the team's assistant coach, said in Wednesday's editions of The Galveston County Daily News. The league has a rule that prohibits teams from winning by more than 42 points. The Aguilars say they told the team to slow down after building a 42-0 lead, but the players couldn't help scoring again. The Friendswood Chiefs, named after this Houston suburb, fumbled the ball in their own end zone and Sagemont recovered to increase its lead to 48-0. Rene Aguilar said the coaches tried to tell the players not to recover the fumble. ``That's confusing to them,'' he said. ``One minute we're trying to tell them to play hard, then we're telling them to lay down.'' Recovering that fumble, according to a league rule, meant a one-game suspension for the head coach and a $100 fine for the team. Rene Aguilar said the Sagemont club president was at the game and told the coaches to handle the situation however they saw fit. ``So we played the rest of the game because we already knew we were going to be penalized,'' he said. The Cowboys went on to score another 14 points. League officials met two days later and gave the Aguilars a lifetime ban. A judge granted the Aguilars a restraining order to prevent the ban from taking effect, but the order expires Friday. The Aguilars met with the league officials late Wednesday for private mediation in an effort to avoid a court hearing Friday. ``We're not allowed to discuss what went on,'' Peggy Bittick, the coaches' attorney, told The Associated Press late Wednesday. ``We're going full force to court.'' Calls to league officials were not returned. Ms. Bittick said she watched a videotape of the game and it appeared that Friendswood was not trying to recover the fumble. ``It looked like the other team just threw up their hands and gave up.'' -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law" From jeffb at issl.atl.hp.com Thu Oct 23 10:30:48 1997 From: jeffb at issl.atl.hp.com (Jeff Barber) Date: Fri, 24 Oct 1997 01:30:48 +0800 Subject: ADMIN: lost messages (fwd) In-Reply-To: <199710231312.IAA17874@einstein.ssz.com> Message-ID: <199710231721.NAA04296@jafar.issl.atl.hp.com> Jim Choate writes: > Yes, there are occassional breakdowns in the communications between the > list remailers. The reason that there are several of them is if one goes > down for more than a few minutes the whole lists doesn't go down which would > occur if we were still on a single remailer. I understand this rationale. But that doesn't explain what's happening to the missing messages. Is there a flaw in the distributor/reflector duplicate-filtering algorithms? Or is this a problem of certain messages being introduced into a node whose product does not get propagated to all subscribers of all the other nodes? Or are you saying that if ssz (say) goes down for a few minutes it forgets about any mail it has queued up for its counterparts at cyberpass and algebra (et al.)? -- Jeff From anon at anon.efga.org Thu Oct 23 10:49:49 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 24 Oct 1997 01:49:49 +0800 Subject: Singaporean control freaks & CMR Message-ID: Adam Back writes: > The problem is that pgp5.x is both an email encryption system and a > file encryption system. So PGP Inc argue that they need the recovery > features for files. Well OK, but for emails in transit? Define "in transit". Specifically, when exactly does email stop being "in transit". When it is received on a mail server? Transfered to the destination computer? Displayed to the user? Saved in an archive? How long might a piece of email spend "in transit"? Compare and contrast with the amount of time a piece of data from an encrypted phone call spends in transit. Or an SSL protected HTTPS web transaction. Do you understand the difference between transit times of a fraction of a second and of days or weeks? Does this suggest any differences in the need for recovery of encrypted data "in transit"? Not all communications are alike. The longer data spends "in transit" the more need there is for recovery features. From kiqe11 at zeta.org.au Fri Oct 24 02:23:03 1997 From: kiqe11 at zeta.org.au (kiqe11 at zeta.org.au) Date: Fri, 24 Oct 1997 02:23:03 -0700 (PDT) Subject: ***BULK EMAIL FOR PROFIT*** Message-ID: <199710244079JAA40429@post.sa.omnes.net>


******************************************************
        
            MAIL THOUSANDS OF EMAIL MESSAGES
                PER HOUR - NO KIDDING !!

          SEND YOUR EMAIL MESSAGES OUT, AT
         1,000's MESSAGES / HOUR (28.8K modem)

           YES, as many as 50,000  Of Messages An Hour

******************************************************

	45,000,000+ EMAIL ADDRESSES

                      ******** $100.00 *******

******************************************************

  YOU'LL RECEIVE 2 HIGH-SPEED EMAIL SOFTWARE PROGRAMS

Introducing...."FLOODGATE BULK EMAIL LOADER" 
        AND...."GOLDRUSH STEALTH MASS MAILER"

This is the same software that all bulk emailing services use!

----------------------------------------------------

Floodgate Bulk Email Loader Version 5.2 AND
Goldrush Stealth Mass Mailer Version 2.018
for Windows 95 and Windows 3.1 now Supports 17 
(really more with the free form filter) File Formats

----------------------------------------------------


SEND OUT 20,000+ MARKETING LETTERS EVERY SINGLE DAY if you want!

Or...every few days. In fact, when I send out just a few thousand marketing letters each day, it doesn't take long before I'm completely swamped with email inquiries and phone calls. This is very easy to do. And each one of these bulk mailings costs me nothing. I can teach you how to do this and provide you with the tools you'll need.

If you've got a good marketing letter, I'll show you how to open the floodgates. You'll be deluged with inquiries, leads, and real sales, using nothing but email alone.

Writing a good marketing letter is not easy. I often have to rewrite my marketing letters a half dozen times before I get the results I'm looking for. But once you have a good letter, as you probably know, you can use the same letter over and over again, predictably and consistently, closing sales, week after week, month after month.

It takes me about one hour to send my marketing letter to THOUSANDS of fresh email addresses. I can do this, thanks to a Windows program I use. It's called Floodgate and Goldrush Stealth Mass Mailer. It's a bulk email loader and an email software program. If you're interested in electronic marketing, you should know about these programs.

PROGRAM #1: FLOODGATE FOR WINDOWS

The Floodgate Bulk Email Loader imports simple text files that anyone can download from CompuServe, Prodigy, Delphi Genie, or the Internet. These text files contain classified ads, forum messages, or data from the member directory. Each of these files is filled with email addresses.

Floodgate is designed to read these files and strip out the email addresses. It then sorts the addresses, removes any duplicates, and formats them into an output file, with 10, 20 or 30 addresses per line. This is all done in one simple step. Just point and click.

You'll need either a Windows based Internet account or an America On-line account to send out your marketing letters. Neither AOL nor the Internet charges to send email. Send your letter to 1,000 people or 10,000 people -- the cost is always the same. NOTHING!

NEW! PREPARE A MAILING OF 50,000+ 
IN LESS THAN A 1/2 HOUR

If you open an Internet account, you can send each letter to 20,000+ people. The new Floodgate now directly writes distribution lists. Some people are always collecting new addresses, but if you publish a newsletter or adsheet, you'll be using the same addresses over and over again. That's real power! When using addresses you've previously collected, you can press a few buttons and prepare a mailing of 50,000+ in less than a half hour.

(To get a list of all the Internet access providers in your local calling area goto: http://thelist.com and click on your area code.)

The Floodgate Users Guide will teach you, step by step, how to download the right files, how to strip the addresses, and finally, how to cut and paste the formatted addresses into your marketing letter. Or, if you have an Internet account, how to create distribution lists. One you've done this a few times you won't even have to think. It's that simple!

FOR THE BRAVE & DARING: PUSHING TECHNOLOGY TO ITS LIMITS

As you may know, the practice of sending unsolicited email is usually frowned upon, and most service providers have rules against it. But, like jay-walking, there is little enforcement. It's not illegal. If someone tells you that it is, ask them to provide the citation (and don't let them give you some nonsense about faxes - that's not email). They can't do it because it's not there. Sometimes, when a lot of people complain, I get a warning letter. And that's about it.

About 1 in 200 will write back and tell me, "take me off the list", which I can do, thanks to Floodgates Remove List feature. Many people reply back thanking me for sending them my informative letter. That's always nice. Most people though, just reply and say, "send me more info." In this way, it usually takes me two or three letters to close a sale.

The Floodgate Users Guide will provide you with proven formats for writing a successful marketing letter. You'll test and rewrite, test and rewrite. Then, once you've got it, just push a few buttons, and open the floodgates!!!

THE FLOODGATE BULK EMAIL LOADER CURRENTLY SUPPORTS 17+ FILE FORMATS

1. CompuServe Classifieds: Send your marketing letter to everyone who is running a classified ad. I'll teach you how to download all the classifieds from any single ad category. This is one of the most responsive list of buyers. They check their email every day and they're already in business.

2. America On-line Classifieds: Download 1,000 addresses in 15 minutes. These are excellent lists for business to business sales.

3. CompuServe Forums: You can join a forum and download hundreds of forum messages in a matter of minutes.

4. America On-line Forums: Choose from dozens of forums. All good targeted lists.

5. Prodigy Forums: Prodigy allows you to easily export any group of forum messages. More targeted lists.

6. Internet Newsgroups: These are all targeted lists. You'll be able to send your marketing letter to everyone who posts a message in any newsgroup. Easily collect 1,000's of addresses per hour.

7. America On-line Member Directory: Most member directories only allow you to search by city and state. With AOL, you can search by business type, hobbies, computer type, etc. This is the gem of all
member directories. Build huge targeted lists.

8. CompuServe Member Directory: This is a major resource. If you're willing to target your mailing to a single city, you can collect about 1,000 email addresses an hour.

9. Delphi Member Directory: The Delphi member directory allows you to search for people based on key words. These are good targeted mailing lists. A single search can easily generate 5,000 addresses.

10. Genie Member Directory: Similar to the CompuServe member directory, only you can download names much quicker. You can easily pull hundreds of thousands of addresses out of each of these member directories.

11. CompuServe File Cabinet: If you run classified ads, and save the responses in the CIM file cabinet, you'll be able to easily reuse these addresses. You can send your marketing letter to everyone in any single folder. Build master lists and clean UP your hard drive.

12. Free Form: If you have a text file with email addresses that floodgate does not support, chances are the Free Form filter will be just what you need. Just enter a key word to search for.

13. CompuServe Form Profiles (Forum Membership Directories): Easy to build targeted lists here. Each search can easily bring you 500+
addresses.

14. Genie Profiles: If you're building targeted lists, you'll get a lot of addresses very quickly from Genie.

15. Plain Addresses: Read Floodgate Master Files back into Floodgate to merge files and do selective mailings. Also useful for the management of email address lists that you might purchase.

Floodgate also has filters to allow you to include or exclude any groups of addresses in your final distribution lists. For example, you could include only email addresses that ended in .com or exclude all with .gov. You could exclude all noc, root, and other addresses that almost guarantee a negative response. These filters are fully configurable and can be used together.

BUILD REUSABLE MASTER FILES

Floodgate maintains Master Files for each of your marketing letters. If you download from the same place on a regular basis, you only want to send your letter to the new people. Floodgate will compare the new addresses with those in the Master File, and prepare a mailing list of only new people. The new addresses are, of course, then added to the Master File. With each new mailing your Master File grows and grows.

You may create as many Master Lists as you need. When you start a new marketing campaign, you'll want to send your new letter to everyone on your Master List. If you write a newsletter, each time you send your newsletter, you'll send it to everyone on a Master List.

THE REMOVE LIST

Very often, people will reply and tell you to take them off your mailing list. Place these addresses in the REMOVE.MST file and they will never receive another letter from you again. In this way, you will be operating your business with the most professionalism
possible.

DON'T BE FOOLED

We have some new competitors that have tried to copy Floodgate. The following list describes why Floodgate is BETTER.......

**Floodgate is a mature, bug free product. Not an initial release.
**Floodgate comes with over 100 pages of step by step       documentation.
**Floodgate is the only one offering a money back guarantee.
**Floodgate has more testimonials. 
**Filter for filter, Floodgate offers more capabilities, way more. 
**Floodgate does everything all the others *combined* claim. 
**Floodgate is by far the easiest to use.
**There is NO *cutting and pasting* with Floodgate. 
**We have by far, the BEST technical support.

SOME QUICK MATH

Floodgate can pay for itself in a few days. It can also cut your advertising costs down to almost nothing. Think of what the competition will do when they get their Floodgate program. Don't be left in the dust - there are 75 million people out there, just a few keystrokes away. Let's do the math:

- Email 50,000 sales letters (takes about 1-2 hours)
- Let's say your product will bring you $5 profit per   sale.
- Let's also say you only get a 1% response(occasionally higher).

* That's 500 orders x $5 = $2,500 profit !! Now imagine what 500,000 letters would do for your business !!

WHAT CAN I MARKET ON-LINE?

You can market anything on-line using direct email, that can be marketed using conventional postal direct mail marketing. The possibilities are practically endless. If it sells off-line, you can sell it on-line.

EASY TO INSTALL AND EASY TO LEARN

The Floodgate Email Loader requires Windows. The SUPPLIED MANUAL tells you where to go, what to do, and how to do it. All you need are basic computer skills that can be learned with a little practice or help from our computer savvy technicians.

PROGRAM #2: GOLDRUSH STEALTH MASS MAILER

Do not get this program confused with other slow speed programs that call themselves "STEALTH". This program is the only one in the world that can send email out at HIGH SPEEDS with one single connection to the internet. 

This is NEW, Cutting Edge Email Technology. First Of It's Kind.. The Most Powerful BULK EMAIL SENDER In The World.. NOTHING CAN EVEN COME CLOSE! 

Thanks to our top programmer's, this technology is NOW available and we are the only place you can get it from! 

     *ONLY "ONE" DIAL-UP OR ISDN CONNECTION NEEDED. 
     *NO MORE TERMINATED CONNECTIONS. 
     *NO MORE WAITING TO SEND LARGE AMOUNTS OF EMAIL. 
     *IMMEDIATE RESPONSE TO YOUR MASS MAILINGS. 
     *YOU WILL HAVE ALL THE CONTROL AND CONFIDENCE OF 
       SENDING EMAIL THE WAY IT SHOULD BE SENT... IN HUGE AMOUNTS! 
     *SEND YOUR WHOLE LIST IN ONE DAY, WHETHER IT BE 500,000 
       OR 5 MILLION - AND JUST SIT BACK AND WAIT FOR YOUR 
       ORDERS TO POUR IN. 
     *NO MORE DOWNLOADING UNDELIVERABLE NAMES.

Bulk Emailer's Dream Come True!!! - >>>GOLDRUSH STEALTH MASS MAILER<<< 

Connect to multiple mail servers (20 or more), make multiple connections to a single server or any combination of the two ( All Simultaneously ) with one single dial-up connection. 

SEND MULTIPLE SIMULTANEOUS MAILINGS... 

View complete details about your mailings. Shows each server your connected to, the status of that connection, how many messages are going out through that connection, etc...

We show you ALL the tricks all the mass e-mailers don't want you to know... 

Here are just a few features the GOLDRUSH STEALTH MASS MAILER offers to you... 

     *Forge the Header - Message ID - ISP's will Spin their wheels. 
     *Add's a Bogus Authenticated Sender to the Header. 
     *Add's a complete bogus Received From / Received By line with 
      real time / date stamp and recipient to the Header. 
     *Does NOT require a valid POP Account be entered in order to 
      send your mailings. 
     *Easy to use and operate 
     *Plus much more! 

All this, at speeds of up to 50,000's messages/hour
(28.8k modem and heigher). 

SPECIAL INTRODUCTORY PRICE... 

NOW YOU CAN HAVE BOTH THE FLOODGATE AND 
GOLDRUSH STEALTH MASS MAILER FOR JUST $499.00! 

UPDATE ... SAVE $149.05 AND ORDER NOW, BE ONE OF THE FIRST 100 ORDERS! 

Step up to the plate and play with the big boys TODAY and receive the COMPLETE 2 SOFTWARE PACKAGE for the unbelievably low price of ONLY $349.95! 

(Other bulk email software has sold for as much as $2,500 and can't even come close to the cutting edge technology of EASE, ACCURACY AND SPEED ... SPEED ... SPEED!) 

Try the Goldrush Stealth Mass Mailer & Floodgate Bulk Email Loader for 10 days FREE. 
And receive UNLIMITED technical support for 30 days.

**************************************************************

		45,000,000+ EMAIL ADDRESSES
	MILLIONS AND MILLIONS OF EMAIL ADDRESSES

CD with 45,000,000+ email addresses separated by domain name.
All addresses are simple text format one per line. Addresses
from the following domains: Pipleline, MSN, MCI, Juno, Delphi,
Genie, AOL, Compuserve, Internet, .com & .net, MILLIONS OF THEM!
Not available on diskette or download.

===> WANT THE 45,000,000+ MILLION ADDRESSES FOR $100.00? <===

Just buy our Floodgate / Goldrush software package (with ALL
the bonuses INCLUDED), and the 45,000,000+ addresses are yours
for just $100.00 additional.

These addresses will be delivered to you in simple text files
that any bulk emailing program can use, on CD Rom. With this CD,
YOU CAN BEGIN MAKING MONEY IMMEDIATELY!!!

***************************************************************

***SPECIAL BONUS #1:*** STOP Losing ISP Dial Up Accounts! 

If you order The FLOODGATE / GOLDRUSH software within the next 5 days - When you receive your program, you will also receive: 

*Complete instructions on "how to keep your dial up account from  showing up in the header", plus everything you will need to get started doing this. 

IMPORTANT NOTICE! We will initially only be offering 100 copies of the program for sale, First come / First Served basis only. We are doing this because of the extreme power that these programs offer.


***SPECIAL BONUS #2*** 

When you receive your two programs, you will also receive:
OVER 250 REPRINT AND RESELL RIGHTS REPORTS YOU CAN START TO MARKET
AND MAKE MONEY IMMEDIATELY!!! 

     These HOT sellers include: 
     1) How to Get a Top Rating in the Search Engines 
     2) 70 Money Making Reports 
     3) 75 MONEY MAKING PLANS & TRADE SECRETS and MUCH MUCH MORE!!!  
         ($200 RETAIL VALUE - FREE!!!) 


***SPECIAL BONUS #3***

With your two software programs, you will also receive our NEW "Address Grabber" utility program that enables you to grab 100's of THOUSANDS of email addresses from
newsgroups in minutes ($100 RETAIL VALUE - FREE).


***SPECIAL BONUS #4***

RECEIVE CHECKS BY EMAIL, PHONE OR FAX MACHINE. With this software
program, you can receive payment for your product or service INSTANTLY!!
There is no more waiting for your customers chec to arrive. This
software will no doubt, add to your sales, for customers who
don't have credit cards, as well as the impulse buyers.

With this software, you can print up your payments as soon as your
customer gives you his/her checking information. You will then
add the information given, to the proper blank check spaces, then
just print and go to the bank!!


         ****************************************************

              HURRY ... RESERVE YOURS TODAY! 

So, if you are interested in taking advantage of the most powerful bulk 
email software in the world and start making money hand over fist.....

Print out the EZ ORDER form below and FAX or MAIL it to our office.

If you have any questions don't hesitate to call us at: 1-954-784-0312 ext505

SYSTEM REQUIREMENTS

386 or larger
Windows 95 OR Windows 3.1 with 8 meg ram
Extra 5 MB hard drive space

Floodgate & Goldrush can be run on a fast Mac with 24 MB RAM and SoftWindows.

NOTES FROM SATISFIED USERS

"It is everything you said it was. Within one week of my first mailing, I received a record number of orders. All you need to print money is a decent sales letter. Thanks." Randy albertson, Wolverine Capital.

"After using Floodgate and your utility program all day today, let me say these are as two of the finest programs I have ever bought in my 52 years! Your support has been superb. Thank You!" Vernon Hale, Prime Data Systems

"My first day and I just used Floodgate and Pegasus to send 1,469 sales letters. So far I've got about 25 positive responses. It works GREAT!!! Thanks." Donald Prior

"I was able to use Floodgate to extract the names from the Internet news groups. It works perfectly. Needless to say, I am very excited about the use of this new technology." Mark Eberra, Inside Connections

"This is a great piece of software and an invaluable marketing tool." Joe Kuhn, The Millennium Group

"I just thought you'd like to know that this program is fantastic. After loading it on my system, I wanted to test it out. In my first hour of using this, I collected 6,092 email addresses!" Richard Kahn, LD Communications

"I just love the Floodgate program. It saves me hours and hours of time. This is the beginning of a wonderful FUN time marketing on-line. Thank you so much for writing this program." Beth O'Neill, Eudora, KS

"Your software is brilliant, and from the technical support I've received, I can see you have a genuine love and respect of people...Floodgate is a divine package. Wish I had found it sooner." Tom Sanders, Peoria, IL

-------------------------------------------------
E-Z ORDER FORM:

Please print out this order form and fill in the blanks......
Please send order form and check or money order, payable to:

Dave Mustachi
DEPT KA
P.O. Box 772261
Coral Springs, FL 33077-2261
(954) 784-0312 ext.505


______Yes! I would like to try your cutting-edge software so that I can advertise my business to thousands of people on-line whenever I like! I understand that I have 10 days to trial the software. If I am not fully delighted, I will cheerfully be refunded the purchase price, no questions asked! Please rush me the FLOODGATE and GOLDRUSH package now!

______I am ordering within 72 hours! That qualifies me to receive the FLOODGATE and GOLDRUSH package at a substantial discount! I am ordering BOTH software packages for only $349.95. (Save $150 off the retail price....Software has sold for as much as $2,499.95)

______I am ordering within 72 hours! That qualifies me to receive UNLIMITED technical support for 30 days.

______I want to receive the package OVERNIGHT. I'm including $18.00 for shipping charges.

______I want to receive the package 2nd DAY. I'm including $3.00 for shipping charges.

______I'm ordering Floodgate / Goldrush software and want to order the 45,000,000+ email addresses as well. My additional cost is $100.00 enclosed.

______I'm NOT ordering your Floodgate / Goldrush software, but I
want to order your 45,000,000+ addresses on CD. Enclosed is $249.00.

(CHECKS: ALLOW 1 WEEK FOR BANK CLEARANCE)


YOUR NAME_________________________________________________

COMPANY NAME_________________________________________________

YOUR POSITION_____________________________________________

STREET ADDRESS______________________________________________

CITY, STATE, ZIP____________________________________________

PHONE NUMBERS_______________________________________________

FAX NUMBERS_________________________________________________

EMAIL ADDRESSES_____________________________________________

************************************************************

We accept Checks, Money Orders, MasterCard, Visa,
American Express. You can either mail your order to 
us OR fax your order to:

			954-572-5837
************************************************************

Today's date:_____________
 
Visa____MasterCard____American Express____
 
Card #:____________________________________________________
 
Expiration date:___________________________________________
 
Name on card:______________________________________________
 
Billing address:___________________________________________
 
Amount to be charged: $________________


Signature:___________________________________________


I agree to pay Dave Mustachi an additional $29 fee if my check is returned for insufficient or uncollectable funds.

SIGNATURE: X________________________________DATE:_______________

Please send all order forms and check or money order to payable to:

Dave MustachI
DEPT KA
P.O. Box 772261
Coral Springs, FL 33077
(954) 784-0312 ext.505


***************************************************

OR:

PLEASE PASTE YOUR CHECK HERE

(If you fax a check, there is no need for you to send the original check by mail. We will draft up a new check, with the exact information from your original check that you faxed to us)

Please fax the above order form and check to: 1-954-572-5837








From rah at shipwright.com  Thu Oct 23 11:32:33 1997
From: rah at shipwright.com (Robert Hettinga)
Date: Fri, 24 Oct 1997 02:32:33 +0800
Subject: Laws recognizing digital signatures
In-Reply-To: 
Message-ID: 



At 9:24 am -0400 on 10/23/97, Vincent Cate wrote:

> I mentioned that there were a few other jurisdictions that had passed some
> laws like this and they would like me to try to pin down which and, if
> possible, get copies of the laws.
>
> I remember some talk about this on cypherpunks, so I am hoping someone
> here can tell me which places (think there was some state) have such laws,
> and if possible tell me where I can get a copy.

Funny you should ask that. There's a bunch of lawyerly traffic on
DIGSIG at VM.TEMPLE.EDU, run off of LISTSERV at VM.TEMPLE.EDU. I've sent you the
welcome message under separate cover. Of course, if you'd been subscribing
to e$pam, you'd know all of this. :-). (Of course, if I could just get some
keyword searchable archives of e$pam up and running, you wouldn't have to
subscribe to a mail-firehose like e$pam ;-)).

Take a look at:

http://www.smu.edu/~jwinn/esig.htm

Jane Winn is god. (this week anyway)

Cheers,
Bob Hettinga

-----------------
Robert Hettinga (rah at shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/
Ask me about FC98 in Anguilla!: 







From FisherM at exch1.indy.tce.com  Thu Oct 23 11:34:57 1997
From: FisherM at exch1.indy.tce.com (Fisher Mark)
Date: Fri, 24 Oct 1997 02:34:57 +0800
Subject: PGP and CMR: Just a Few Lines...
Message-ID: <2328C77FF9F2D011AE970000F84104A74933CE@indyexch_fddi.indy.tce.com>



A point that I still feel gets lost by some participants in this issue
is that the changes to PGP for CMR/GMR are very minor -- all that needs
to occur is to get the CMR keys from wherever they are stored, and then
add them as additional recipients.  The political value of persuading
PGP to adopt CDR >> actual technical value, as the change to CMR should
involve < 10 lines of code (said, of course, without actually inspecting
the code :).
==========================================================
Mark Leighton Fisher          Thomson Consumer Electronics
fisherm at indy.tce.com          Indianapolis, IN
"Their walls are built of cannon balls, their motto is
'Don't Tread on Me'"






From rah at shipwright.com  Thu Oct 23 11:38:35 1997
From: rah at shipwright.com (Robert Hettinga)
Date: Fri, 24 Oct 1997 02:38:35 +0800
Subject: (Fwd from f-c) Note from PGP employee on MRK
In-Reply-To: 
Message-ID: 



At 10:35 pm -0400 on 10/22/97, Declan McCullagh wrote:


> >A friend of mine by the name of Jason Bobier  happens
> >to work at PGP, Inc.  I'll preface his comments by pointing out that
> >I'm sure he doesn't speak for the company in any way.

> >> Sometimes I really feel like screaming at these people. _All_ of
> >> the developers at PGP are personal privacy zealots and no one
> >> likes the idea of the MRK.

Kind of like aeronautical engineers are aviation zelots?

The ganglia twitch...

Cheers,
Bob Hettinga

-----------------
Robert Hettinga (rah at shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/
Ask me about FC98 in Anguilla!: 







From declan at well.com  Thu Oct 23 12:04:13 1997
From: declan at well.com (Declan McCullagh)
Date: Fri, 24 Oct 1997 03:04:13 +0800
Subject: PGP, Inc.--What were they thinking?
Message-ID: 



>X-POP3-Rcpt: declan at relay.pathfinder.com
>From: spencer_ante at webmagazine.com
>X-Lotus-FromDomain: PCWORLD
>To: whgiii at invweb.net
>cc: hallam at ai.mit.edu, declan at well.com, aba at dcs.ex.ac.uk, tcmay at got.net,
>        fight-censorship at vorlon.mit.edu
>Date: Thu, 23 Oct 1997 10:36:44 -0700
>Subject: Re: PGP, Inc.--What were they thinking?
>Mime-Version: 1.0
>Sender: owner-fight-censorship at vorlon.mit.edu
>X-Loop: fight-censorship at vorlon.mit.edu
>X-FC-URL: Fight-Censorship is at http://www.eff.org/~declan/fc/
>X-FC-URL: To join send "subscribe" to fight-censorship-request at vorlon.mit.edu
>
>
>So, I was driving to work this morning listening to KQED's Forum program
>and lo and behold: Good 'ol Michael Krasny is leading a discussion on
>surveillance in the workplace that centered around a new survey/special
>report that PC World just published in its November issue.
>
>You Are Being Watched
>An exclusive PC World survey of 200 company executives shows that more and
>more businesses are
>monitoring their employees' Web use. Here's the lowdown on what you should
>know about surfing
>the Net on company time.
>
>http://www.pcworld.com/workstyles/online/articles/nov97/1511p245.html
>
>Should provide some interesting points for discussion.
>
><<>>
>







From lrp at warp.com.br  Thu Oct 23 12:31:30 1997
From: lrp at warp.com.br (LEANDRO R. PREDA)
Date: Fri, 24 Oct 1997 03:31:30 +0800
Subject: No Subject
Message-ID: 



Please I need your help!
I need of coputers virus ,
To I infectin the my computers school







From nobody at REPLAY.COM  Thu Oct 23 13:09:23 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Fri, 24 Oct 1997 04:09:23 +0800
Subject: PGP Employee on MKR
Message-ID: <199710231945.VAA05198@basement.replay.com>



> FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP 
> AWAY FROM GAK. FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT 
> IS ONE STEP AWAY FROM GAK! FORCING ENCRYPTION TO MULTIPLE KEYS FOR 
> ONE RECIPIENT IS ONE STEP AWAY FROM GAK!! FORCING ENCRYPTION TO 
> MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP AWAY FROM GAK!! 
> !!!*FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE 
> STEP AWAY FROM GAK*!!!

Mark, just remove the self signature on the user key.  The message
recovery key packet goes away!  That's all you have to do.  Is that
so tough?  This big threat, the dangerous CMR key, turns out to take
two seconds of user actions to be destroyed.  Something this easy to
turn off will never be good enough for GAK.

People say, "Oh, but then the government will make everybody run the
policy enforcer and reject any mail not encryped to the government."

First, if they were going to do this, they could do it with old versions
of PGP too.  Multiple recipients have been around practically forever.

Second, it's a ridiculous idea which ignores how email works.  More and
more people are running systems at home which could send and receive
SMTP mail.  The trend is towards home servers which support the multiple
home computers people will have in the next decade.  There's no way to
make those people run filters!

People say, "Oh, but they'll make it illegal to receive mail at home
without going through an ISP."  I'm serious, this has actually been
suggested on this list.  It has to be suggested, because it's the only
way this incredibly stupid scenario could be made to work.  I can only
assume that people are blinded by emotions or they wouldn't suggest such
a bizarre idea.

Making it illegal to implement probably the most widely used internet
protocol package (email) would be a totally unprecedented, invasive,
unjustifiable and unenforcable intervention by government.  If the only
way the government can enforce GAK is by making it illegal for people to
receive email through paths which don't pass through government filters
we can all rest easy, because it will never happen.

Even for the cases where filtering is done (like businesses), there are
easy countermeasures, described by no other than Jon Callas, PGP's chief
scientist!  Why would he say this if there were a massive conspiracy to
enable GAK?  He's also the one who explained the point above about the
self signature.  He has suggested two other easy workarounds:

Modify the PGP 5.0 source to put a fake recipient block on it.  How many
companies release their source so that you could do this?

Or superencrypt to the real end user, like you suggested in your scheme.
Why is this OK as a privacy workaround for your idea but it doesn't
count for PGP?

Then people say, "Oh, but PGP shouldn't have written the SMTP filter
anyway (or at least they shouldn't have put that one policy in) because
it would make it easier for the government to make everybody use it."

Ignoring all the considerations above about what a stupid idea this is,
the fact is that a simple filter like this is incredibly easy to write.
I'm sure a skilled Perl hacker like Adam Back could put together something
to check that a PGP message is encrypted to a desired key in a few hours.
There are already Perl scripts out there to help parse PGP messages.  You
just have to look at the recipients and compare with the key you want to
see.

The existence of such a filter is totally insignificant in the big
picture.  If we are ever forced into a GAK system and filtering turns
out to be a part of the picture, it will be trivial for such filters to
be created.  PGP's SMTP product will not make any difference one way or
the other.

The fact is, nobody has come up with a scenario where PGP's CMR feature
can be turned into GAK in any practical way.  They have to assume that all
kinds of changes and additions are made - inability to remove CMR keys,
forcing everyone to run SMTP filters, making it illegal to receive email
at home, preventing people from implementing clients with workarounds,
changing the technology to make it harder to implement workarounds
using binding cryptography.  Any system can be turned into GAK if you're
allowed to postulate these kinds of changes.  And the fact is that every
GAK system so far designed can be trivially defeated.

The big GAK danger has always been that the encryption manufacturers
would release GAK-only versions of their software, so that you have a
choice between an easy to use system with GAK support, or a difficult
and balky product like PGP 2.6.2, distributed via underground means and
with GAK workarounds.  Now at last you can be sure that even if the very
worst happens, you will at least have the convenience and ease of use of
PGP 5.0 as the GAK disabled product, via a non-GAK international version.
This doesn't have anything to do with PGP's policies or motives; it is
strictly because of PGP 5.0's source distribution, which will make it
easy for cypherpunks to modify it to look compliant with GAK while using
superencryption or some other technology to avoid it.

No longer will it be a choice between convenient GAK or clumsy non-GAK,
opening the latter option only to cypherpunks and hackers.  Now people
opposed to GAK will be guaranteed an option of making their software at
least as easy to use as PGP 5.0.  If source code becomes available for
PGP 5.5, that will raise the guaranteed ease of use of non-GAK software
even further (by all accounts, 5.5 has an even better interface than 5.0).

The existence of these products in source code form will forever stand
as a barrier to any hope to coax (most) people into using GAK software
by forcing it into built-in products, leaving the alternative of non-GAK
software only to a tiny minority.  This in itself should monkey wrench
any government plans for requiring GAK.






From shamrock at cypherpunks.to  Thu Oct 23 13:09:40 1997
From: shamrock at cypherpunks.to (Lucky Green)
Date: Fri, 24 Oct 1997 04:09:40 +0800
Subject: PGP Employee on MKR
In-Reply-To: <877607187.26935.193.133.230.33@unicorn.com>
Message-ID: 



I have watched this silly debate for some time now. PGP pulled an awsome
hack on corporate America, bringing strong crypto to thousands of
corporate drones,  while Cypherpunks, the crypto elite, seems incapable of  
reponding with anything other than to engage in frenzied mutual
masturbation fueld by GAK fantasies.

This is sad. Very sad.

--Lucky

On Thu, 23 Oct 1997 mark at unicorn.com wrote:

> 
> 
> A PGP Employee wrote:
> >> Unfortunately these people just don't get it. Corporations refused
> >> to buy 5.0 because it did not have any way for the corps to get at
> >> email encrypted to their employees. There are some very legitimate
> >> uses of this, such as when an employee dies and someone else has
> >> to take over for them.
> 
> No, PGP Inc 'just don't get it'. I'm sure that there are plenty of people
> out there who disagree with the entire concept of CMR, and I'm not very
> happy with it myself. But that's not the most important issue here.
> 
> Since this point just doesn't seem to get through to PGP Inc employees, I'm
> going to shout.
> 
> FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP AWAY FROM
> GAK. FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP AWAY 
> FROM GAK! FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE STEP 
> AWAY FROM GAK!! FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT IS ONE 
> STEP AWAY FROM GAK!! !!!*FORCING ENCRYPTION TO MULTIPLE KEYS FOR ONE RECIPIENT 
> IS ONE STEP AWAY FROM GAK*!!!
> 
> Is that clear enough? Do you understand what I (and, apparently, Adam Back
> and others) am saying now? The problem is not so much with the fact that
> you're supporting company needs, but with the way you're doing so.
> 
> >> They also don't seem to realize that you always have the ability
> >> to remove the MRK from your list of recipients.
> 
> Just as government-supported rating schemes are purely voluntary and will
> be so for, oh, I don't know, a couple of years? Once the infrastructure is
> there, we need only an executive order to make it mandatory. If this 
> software ships in its current form and becomes the dominant player in the
> market, in four or five years all keys will be GMR keys with the FBI or
> NSA as one mandatory recipient. You 'privacy zealots' will have created the
> government's surveillance infrastructure. I hope you'll feel proud.
> 
> >> Sometimes I really feel like screaming at these people. _All_ of
> >> the developers at PGP are personal privacy zealots and no one
> >> likes the idea of the MRK. 
> 
> Good. Then reimplement it to avoid giving the government a GAK/GMR
> infrastructure. Yesterday I posted a modified version of PGP's CMR to
> the cypherpunks list which can't be used for GAK because it only encrypts
> to one key; Jon Callas just told me I'd 'redesigned PGP 5.5'. Cool. I've redesigned PGP 5.5 so that it can't support GAK; in that case, please 
> implement it, or accept that you're deliberately choosing to support the 
> thugs in governments around the world and have become part of the problem.
> 
> >> That is why we refuse to make them
> >> required. 
> 
> Just 'mandatory voluntary' for companies which have your SMTP enforcer
> enabled. What's the difference?
> 
> >> Most everyone at PGP has
> >> internalized personal privacy as a cause (actually most had it
> >> before they joined PGP).
> 
> So prove it. Stop working on creating a GMR/GAK infrastructure. The current
> PGP CMR system has numerous problems which many people have pointed out on
> the cypherpunks list, and you'd do better to solve those problems rather 
> than see them in a major New York Times article about '101 Ways PGP 5.5 
> Harms Company Security'. How long will PGP Inc last when it's reputation 
> for providing secure products is in tatters, because it chose to release a product which deliberately reduced company security and opened them to new threats, rather than redesign their CMR to remove these problems?
> 
> The current CMR implementation is bad for us, bad for PGP Inc's commercial
> customers, and bad for PGP Inc. Why is this so hard for you to accept? Why
> ship a bad product when you can fix the problems?
> 
>     Mark
> 
> 


-- Lucky Green  PGP encrypted email preferred.
   "Tonga? Where the hell is Tonga? They have Cypherpunks there?"






From ant at notatla.demon.co.uk  Thu Oct 23 13:40:08 1997
From: ant at notatla.demon.co.uk (Antonomasia)
Date: Fri, 24 Oct 1997 04:40:08 +0800
Subject: PGP 5.5 and the corporate environment
Message-ID: <199710231922.UAA03157@notatla.demon.co.uk>



> Just a small aside.  Our help desk handles about 50 to 75
> "I forgot my password" requests per day.  This might be one
> small motivating factor why corporations desire an alternative
> method to recover encrypted files.

>From my experience I'm sure most of those are due to
daft password aging mechanisms.

    over-frequent compulsory changes

    forcing a change at no notice
    (password expired - think of a new one RIGHT NOW)

    forcing a new password on Fridays
    (Monday morning: I know my _old_ password!)

I have practically no trouble remembering numerous passphrases upwards
of 20 mixed chars if I use them semi-regularly and they don't change often.

Anyway, when I have forgotten a long passphrase it has only been
temporarily - a few days.   If your employee is reasonably confident
of decrypting his work within the week you're no worse off than if
he'd fluffed his cooking ("stand in boiling water" or something).


--
##############################################################
# Antonomasia   ant at notatla.demon.co.uk                      #
# See http://www.notatla.demon.co.uk/                        #
##############################################################






From anon at anon.efga.org  Thu Oct 23 14:27:19 1997
From: anon at anon.efga.org (Anonymous)
Date: Fri, 24 Oct 1997 05:27:19 +0800
Subject: Note from PGP employee on MRK (sic)
Message-ID: 



-----BEGIN PGP SIGNED MESSAGE-----

Declan McCullagh wrote:
>A friend of mine by the name of Jason Bobier  happens
>to work at PGP, Inc.  I'll preface his comments by pointing out that
>I'm sure he doesn't speak for the company in any way.
>
>> Unfortunately these people just don't get it. Corporations refused
>> to buy 5.0 because it did not have any way for the corps to get at
>> email encrypted to their employees. There are some very legitimate
>> uses of this, such as when an employee dies and someone else has
>> to take over for them.
>>
>> Without corps buying the product, there is no PGP, Inc., and thus
>> no dedication of resources to the production of PGP. This leads us
>> back to the floundering state of development that PGP was in
>> before 5.0.
>>
>> They also don't seem to realize that you always have the ability
>> to remove the MRK (sic) from your list of recipients.
>>
>> Sometimes I really feel like screaming at these people. _All_ of
>> the developers at PGP are personal privacy zealots and no one
>> likes the idea of the MRK (sic). That is why we refuse to make them
>> required. It is also why there still are freeware and personal
>> versions of the product. I wish they would just realize that we
>> aren't some evil group of people that are solely plotting how to
>> make the most money off of this. Most everyone at PGP has
>> internalized personal privacy as a cause (actually most had it
>> before they joined PGP).
>>
>> *sigh* OK, enough ranting. Feel free to quote various parts of
>> this if you feel like responding to the list.

I would hope that the employees of PGP, Inc. take a deep breath and
seriously consider the many cogent and well thought out points its
critics have made.  We haven't seen much of this, unfortunately.

(And those who are claiming that their critics are rude should recall
how Dorothy Denning was treated.)

It is the unfortunate reality that good people can join a good company
which then later does bad things.  This can occur due to moles and
internal subversion, greed, or simply foolishness.

I have seen repeated claims by PGP, Inc. employees that they are
privacy zealots.  I'm sure some of them really believe what they are
saying.  But, these points are irrelevant if the result is the wide
dispersal of tools which can be effortlessly converted into a
mandatory GAK system.

A number of people have been arguing that it is necessary for the
company to issue snoopware because they can make money doing it.  How
often have we rejected this argument when the company is AT&T, ITT,
Standard Oil, United Fruit, or Microsoft?  This rejection is proper,
and it applies to PGP, Inc. like any other company.

Another claim is that by making money selling snoopware, the proceeds
may be taken and used for privacy software.  Wouldn't it make more
sense to earn money in some more palatable way and then plough the
proceeds into a company which is writing privacy software?

I'm sure most PGP, Inc. employees would reject the "We had to destroy
the village to save it" line of thinking if it were found in any other
context.

Monty Cantsin
Editor in Chief
Smile Magazine
http://www.neoism.org/squares/smile_index.html
http://www.neoism.org/squares/cantsin_10.htm

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBNE+ow5aWtjSmRH/5AQFsWAf+LWjZNCdR6jdAsffX4PR6KLhX8W+V4jkQ
J6odSQNpStVkFhPtcByG+AWaPQLmKxlwVKcO44pQVhTIDhMUlFniSnYtQ/zq+6RF
aeqNG7WLE/58g9Pgh78iBOfJ4wKLi/U5dzpdDX1Ua86B8uzcGKVGTerbN6QoFwH2
aOd2tytomYWmFQeMdguN43Ak9hP+ruA1dcqrlZjRPhEBhBJOfbYLSYt3GPDn6Cqq
jTL/Ui3fu4KHcK8zGgVnXVwQNL0XubBhQmTZ54ohxywejt1A2Q4g4sh0oxvSCEDY
giqk4uElp5an7K+N1tY+vExvkjdRkjsAQEtFAgp4fzHozbS5jNXBWA==
=FFl7
-----END PGP SIGNATURE-----







From cs at dev.null  Thu Oct 23 15:11:55 1997
From: cs at dev.null (Corporate Spy)
Date: Fri, 24 Oct 1997 06:11:55 +0800
Subject: Use crypto, face the Stockholders / Re: Use crypto, face a death squad
In-Reply-To: <7c7e99dd47%Tim@tim01.ex.ac.uk>
Message-ID: <344FA63D.3CFB@dev.null>



Tim Griffiths wrote:
> In message <87761312106967 at cs26.cs.auckland.ac.nz> Peter wrote:
> > There have been various rumours and comments over the past few years that
> > the
> > use of crypto in certain countries (Syria, Iraq, possibly China) is very
> > dangerous for the end user, but very little actual evidence to substantiate
> > this.
> > [snip, with reference to Iraq]
> >  He can't remember the exact details any more, but the implication was
> > that any encrypted messages sent to them would result in them quietly
> > dissapearing.
> 
> So a possible consequence of someone from Iraq being obnoxious on a
> mailing list, to someone in the know, could be several PGP-encrypted
> mails dumped in their inbox... A little extreme, for us gentles, but the
> threat should be effective.

 If email not encrypted to a Korrect Kompany Key is filtered 'from'
the recipient's mbox, I imagine it would also be filtered 'to' another
mbox, for signs of suspicious activity.
 e.g. - an encrypted message to the CEO of the company from 
  "Corporate_Spy at your_competitor.com" with a subject heading such as,
  "Information received--money deposited to your account."

  Of course, if the message enclosed was a bunch of garbage, encrypted
to the CEO's private key, and then slightly corrupted, then that would
make it all the more suspicious, interesting, wouldn't it?

> Of course, spamming every Iraqui email address you could find with encoded
> mail could cause a _lot_ of trouble.

  Not that you're a troublemaker...

C-Spy






From wendigo at ne-wendigo.jabberwock.org  Thu Oct 23 15:52:38 1997
From: wendigo at ne-wendigo.jabberwock.org (Mark Rogaski)
Date: Fri, 24 Oct 1997 06:52:38 +0800
Subject: US Senator Lott Criticizes FBI Crypto Plans (fwd)
Message-ID: <199710232229.SAA30870@deathstar.jabberwock.org>



An entity claiming to be Matthew Gaylor wrote:
>From freematt at coil.com  Thu Oct 23 18:18:01 1997
X-Sender: freematt at bronze.coil.com
Message-Id: 
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 23 Oct 1997 18:01:40 -0400
To: freematt at coil.com (Matthew Gaylor)
From: freematt at coil.com (Matthew Gaylor)
Subject: US Senator Lott Criticizes FBI Crypto Plans

From: "--Todd Lappin-->" 
Subject: Senator Lott Criticizes FBI Crypto Plans
Posted to the fight-censorship at vorlon.mit.edu mailing list
URL: Fight-Censorship is at http://www.eff.org/~declan/fc/
To join send "subscribe" to fight-censorship-request at vorlon.mit.edu



From: http://www.cdt.org/crypto/legis_105/lott.html

In a statement entered into the Congressional Record, Senator Lott urged
his Senate colleagues to "deal with reality" by passing legislation to
relax cold-war era export controls on encryption, and to reject FBI efforts
to impose new domestic law enforcement access requirements.

Full text from: http://www.cdt.org/crypto/legis_105/971021_lott.html

------------------------------------------------------------------------
ENCRYPTION (Senate - October 21, 1997)
------------------------------------------------------------------------

[Page: S10879]

Mr. LOTT. Mr. President, I would like to report to my colleagues on the
activities in the House to establish a new export policy on encryption.
This is an issue that is still at the top of my list of legislation I
hope this Congress can resolve within the next 2 months. The House's
actions last month turned a spotlight on how this issue should
ultimately be resolved.

Let me briefly review the issue. Encryption is a mathematical way to
scramble and unscramble digital computer information during transmission
and storage. The strength of encryption is a function of its size, as
measured in computer bits. The more bits an encryption system has, the
more difficult it is for someone else to illegally unscramble or hack
into that information.

Today's computer encryption systems commonly used by businesses range
from 40 bits in key length to 128 bits. A good hacker, let's say a
criminal or a business competitor, can readily break into a computer
system safeguarded by a lower-technology 40-bit encryption system. On
the other hand, the 128-bit encryption systems are much more complex and
pose a significant challenge to any would-be hacker.

Obviously, all of us would prefer to have the 128-bit systems. And
equally as important, we would like to buy such systems from American
companies. Firms we can routinely and safely do business with. Foreign
companies and individuals also want to buy such systems from American
companies. They admire and respect our technological expertise, and
trust our business practices. The United States remains the envy of the
world in terms of producing top-notch encryption and information
security products.

However, current regulations prohibit U.S. companies from exporting
encryption systems stronger than the low-end, 40-bit systems. A few
exceptions have been made for 56-bit systems. Until recently, it has
been the administration's view that stronger encryption products are so
inherently dangerous they should be classified at a level equal to
munitions, and that the export of strong encryption must be heavily
restricted.

While we are restricting our own international commerce, foreign
companies are now manufacturing and selling stronger, more desirable
encryption systems, including the top-end 128-bit systems, anywhere in
the world they want. Clearly, our policy doesn't make sense. Just as
clearly, our export policies on encryption have not kept up to speed
with either the ongoing changes in encryption technology or the needs
and desires of foreign markets for U.S. encryption products.

My intention is neither to jeopardize our national security nor harm law
enforcement efforts. I believe we must give due and proper regard to the
national security and law enforcement implications of any changes in our
policy regarding export of encryption technology. But it is painfully
obvious we must modernize our export policies on encryption technology,
so that U.S. companies can participate in the world's encryption
marketplace. The legislative initiative on this issue has always been
about exports, but this summer that changed.

During the past month, the FBI has attempted to change the debate by
proposing a series of new mandatory controls on the domestic sale and
use of encryption products. Let me be clear. There are currently no
restrictions on the rights of Americans to use encryption to protect
their personal financial or medical records or their private e-mail
messages. There have never been domestic limitations, and similarly,
American businesses have always been free to buy and use the strongest
possible encryption to protect sensitive information from being stolen
or changed. But now, the FBI proposes to change all that.

The FBI wants to require that any company that produces or offers
encryption security products or services guarantee immediate access to
plain text information without the knowledge of the user. Their proposal
would subject software companies and telecommunications providers to
prison sentences for failure to guarantee immediate access to all
information on the desktop computers of all Americans. That would move
us into an entirely new world of surveillance, a very intrusive
surveillance, where every communication by every individual can be
accessed by the FBI.

Where is probable cause? Why has the FBI assumed that all Americans are
going to be involved in criminal activities? Where is the Constitution?

And how would this proposal possibly help the FBI? According to a
forthcoming book by the M.I.T. Press, of the tens of thousands of cases
handled annually by the FBI, only a handful have involved encryption of
any type, and even fewer involved encryption of computer data. Let's
face it--despite the movies, the FBI solves its cases with good
old-fashioned police work, questioning potential witnesses, gathering
material evidence, and using electronic bugging or putting microphones
on informants. Restricting encryption technology in the U.S. would not
be very helpful to the FBI.

The FBI proposal won't work. I have talked with experts in the world of
software and cryptography, who have explained that the technology which
would provide compliance with the FBI standard simply does not exist.
The FBI proposal would force a large unfunded mandate on our high
technology firms, at a time when there is no practical way to accomplish
that mandate.

Rather than solve problems in our export policy, this FBI proposal would
create a whole new body of law and regulations restricting our domestic
market.

This and similar proposals would also have a serious impact on our
foreign market. Overseas businesses and governments believe that the
U.S. might use its keys to computer encryption systems to spy on their
businesses and politicians. Most U.S. software and hardware
manufacturers believe this is bad for business and that nobody will
trust the security of U.S. encryption products if this current policy
continues. In fact, this proposal appears to violate the European
Union's data-privacy laws, and the European Commission is expected to
reject it this week.

So, the FBI proposal would: Invade our privacy; be of minimal use to the
FBI; would require nonexistent technology; would create new
administrative burdens; and would seriously damage our foreign markets.

This is quite a list.

Mr. President, the FBI proposal is simply wrong. I have learned that
even the administration does not support this new FBI proposal. So why
does the FBI believe it must now subject all Americans to more and more
surveillance?

This independent action by the FBI has created confusion and mixed
signals which are troublesome for the Senate as it works on this
legislation. Perhaps the FBI and the Justice Department need to focus
immediately on a coordinated encryption position.

Mr. President, I congratulate the members of the House Commerce
Committee for rejecting this FBI approach by a vote margin of more than
2 to 1.

I am sure all of my colleagues are sympathetic to the fact that emerging
technologies create new problems for the FBI.

But we must acknowledge several truths as Congress goes forward to find
this new policy solution. People increasingly need strong information
security through encryption and other means to protect their personal
and business information. This demand will grow, and somebody will meet
it. In the long term, it is clearly in our national interest that U.S.
companies meet the market demand. Individuals and businesses will either
obtain that protection from U.S. firms or from foreign firms. I firmly
believe that all of our colleagues want American firms to successfully
compete for this business. Today there are hundreds of suppliers of
strong encryption in the world marketplace. Strong encryption can be
easily downloaded off the Internet. Even if Congress wanted to police or
eliminate encryption altogether, I am not sure that is doable.

So, let's deal with reality. Clamping down on the constitutional rights
of American citizens, in an attempt to limit the use of a technology, is
the wrong solution. The wrong solution. This is especially true with
encryption technology because it has so many beneficial purposes. It
prevents hackers and espionage agents from stealing valuable
information, or worse, from breaking into our own computer networks. It
prevents them from disrupting our power supply, our financial markets,
and our air traffic control system. This is scary--and precisely why we
want this technology to be more available.

Only a balanced solution is acceptable. Ultimately, Congress must
empower Americans to protect their own information. Americans should not
be forced to only communicate in ways that simply make it more
convenient for law enforcement officials. This is not our national
tradition. It is not consistent with our heritage. It should not become
a new trend.

Mr. President, I would like to establish a framework to resolve this
difficult issue. I hope to discuss it with the chairmen and ranking
members of the key committees. I especially look forward to working with
the chairman of the Commerce, Science and Transportation Subcommittee on
Communications, Senator Burns. He was the first to identify this issue
and try to solve it legislatively. His approach on this issue has always
been fair and equitable, attempting to balance industry wants with law
enforcement requirements.

I believe there are other possible ideas which could lead to a consensus
resolution of the encryption issue. It is my hope that industry and law
enforcement can come together to address these issues, not add more
complexity and problems. The bill passed by the House Commerce Committee
included a provision establishing a National Encryption Technology
Center. It would be funded by in-kind contributions of hardware,
software, and technological expertise. The National Encryption
Technology Center would help the FBI stay on top of encryption and other
emerging computer technologies. This is a big step. This is a big step
in the right direction.

It is time to build on that positive news to resolve encryption policy.

Mr. President, there is an op-ed piece which appeared in the Wall Street
Journal on Friday, September 26. It is well written and informative,
despite the fact that its author is a good friend of mine. Mr. Jim
Barksdale is the president and CEO of Netscape Communications and is
well-versed in encryption technology. Mr. Barksdale's company does not
make encryption products; they license such products from others. They
sell Internet and business software and, as Jim has told me many times,
his customers require strong encryption features and will buy those
products either from us or foreign companies.

Again, let's deal with reality. The credit union manager in
Massachusetts, the real estate agent in Mississippi, the father writing
an e-mail letter to his daughter attending a California university, each
want privacy and security when using the computer. They will buy the
best systems available to ensure that privacy and security. And, in just
the same way, the banker in Brussels, Belgium, the rancher in Argentina,
and the mother writing e-mail to her daughter in a university in
Calcutta, India, each of these people also want privacy and security.
They also will buy the best systems available to ensure that privacy and
security. And they want encryption systems they trust--American systems.
That's what this debate is about.

Mr. President, if Congress does not modernize our export controls, we
run the real risk of destroying the American encryption industry. And we
risk giving a significant and unfair advantage to our foreign business
competitors.

[Page: S10881]

------------------------------------------------------------------------


**************************************************************************
Subscribe to Freematt's Alerts: Pro-Individual Rights Issues
Send a blank message to: freematt at coil.com with the words subscribe FA
on the subject line. List is private and moderated (7-30 messages per week)
Matthew Gaylor,1933 E. Dublin-Granville Rd.,#176, Columbus, OH  43229
Archived at http://www.reference.com/cgi-bin/pn/listarch?list=FA at coil.com
**************************************************************************



-- 
[] Mark Rogaski                   "That which does not kill me
[] wendigo at pobox.com                 only makes me stranger."






From sr at dev.null  Thu Oct 23 15:56:12 1997
From: sr at dev.null (Snoop Remailer)
Date: Fri, 24 Oct 1997 06:56:12 +0800
Subject: Snoop Remailer Statistics
Message-ID: <344FD159.1C1@dev.null>



Snoop Remailer Statistics for week ending Oct 23, 1997:

Percentage of PGP Employees anonymously supporting PGP 5.5: 35%

Percentage of PGP Employees anonymously slamming PGP 5.5: 35%

Percentage of PGP Employees anonymously pissing in both directions: 35%

Percentage of PGP Employees anonymously fooling anyone: 2%

Percentage of PGP Employees who can't figure out how to use anonymous
remailers: 3%

Percentage of PGP Employees about to quit using the Snoop Remailer: 100%






From nobody at REPLAY.COM  Thu Oct 23 16:18:25 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Fri, 24 Oct 1997 07:18:25 +0800
Subject: PGP Employee on MKR
Message-ID: <199710232308.BAA03552@basement.replay.com>



-----BEGIN PGP SIGNED MESSAGE-----

Lucky Green wrote:
>I have watched this silly debate for some time now. PGP pulled an
>awsome hack on corporate America, bringing strong crypto to thousands
>of corporate drones, while Cypherpunks, the crypto elite, seems
>incapable of reponding with anything other than to engage in frenzied
>mutual masturbation fueld by GAK fantasies.
>
>This is sad. Very sad.

What is sad is that people who are capable of expositing their beliefs
in a clear and coherent way choose instead to stoop to name calling.

Wouldn't it be more effective to explain exactly how our views are
"silly"?  If what you say makes sense, some of us may even agree with
you.

You describe PGP's achievement as "an awsome hack on corporate
America".  Yet, Jason Bobier, an employee of PGP, Inc. says "_All_ of
the developers at PGP are personal privacy zealots and no one likes
the idea of the MRK."

What is it that has Jason and his friends concerned?  Clearly there
are legitimate concerns and some people inside PGP, Inc. have them
like everyone else.

For that matter, why was it that Phil Zimmermann spoke out against
exactly this sort of product not so long ago?  What was it that
concerned Phil?  Why is this concern no longer relevant to the point
of being "silly"?

While we are at it, why was it that we didn't like Clipper?  After
all, its use was entirely voluntary and it would have disseminated
crypto widely.  In many instances, it would actually be preferable to
'PGP for Business' because the Feds wouldn't be tattling to your
employer if you were considering employment elsewhere or complaining
about your boss.

'PGP for Business' doesn't have the government's key built in, but the
infrastructure is all there.  It will get people accustomed to the
idea that it is reasonable to be under constant surveillance by your
employer, an idea which is easily extended to other listeners.  And
we've already seen members of Congress using 'PGP for Business' to
justify GAK.

Monty Cantsin
Editor in Chief
Smile Magazine
http://www.neoism.org/squares/smile_index.html
http://www.neoism.org/squares/cantsin_10.htm

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBNE/J3ZaWtjSmRH/5AQF1Qwf/SA169EBTJ5XPC7By/nkiUMYNb9kZLoRP
FExdNTiKw0hsRP45i99YhKebCifFwHCgGxhCu/Shw8RkHMWziVt0AhvcVUq4FM67
rHDQ9rzX6JTra8yI+esHmxk7A8C/FlaJJP7HHI38kBzd9XP9HMb7FE/OBF39sYvs
RYE6VPKfXv4dL44j90PrJHeTaKRZCDObsauuGWBvynzsZRNNp90dXU9SJiBXQV3e
rtmr0bo+IGmumiI1zpMta2jHguCH+16YWlaOoIOe6Ql5fh6KLqTouI+o5PlHM31S
eqL6uLdEBUOwVFgbTtcdOlJbnWCvNLVgy/y9AhEr1sU0qYbC+jFcEA==
=cVS2
-----END PGP SIGNATURE-----







From apache at bear.apana.org.au  Thu Oct 23 17:39:04 1997
From: apache at bear.apana.org.au (apache at bear.apana.org.au)
Date: Fri, 24 Oct 1997 08:39:04 +0800
Subject: No Subject
Message-ID: <199710240024.KAA05856@bear.apana.org.au>



WARNING: Bad signature, doesn't match file contents!

Bad signature from user "Monty Cantsin".
Signature made 1997/10/23 19:43 GMT using 2047-bit key, key ID 
A6447FF9

> -----BEGIN PGP SIGNED MESSAGE-----
> 
> Declan McCullagh wrote:
> >A friend of mine by the name of Jason Bobier  happens
> >to work at PGP, Inc.  I'll preface his comments by pointing out that
> >I'm sure he doesn't speak for the company in any way.
[...]
> I'm sure most PGP, Inc. employees would reject the "We had to destroy
> the village to save it" line of thinking if it were found in any other
> context.
> 
> Monty Cantsin
> Editor in Chief
> Smile Magazine
> http://www.neoism.org/squares/smile_index.html
> http://www.neoism.org/squares/cantsin_10.htm
> 
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.2
> 
> iQEVAwUBNE+ow5aWtjSmRH/5AQFsWAf+LWjZNCdR6jdAsffX4PR6KLhX8W+V4jkQ
> J6odSQNpStVkFhPtcByG+AWaPQLmKxlwVKcO44pQVhTIDhMUlFniSnYtQ/zq+6RF
> aeqNG7WLE/58g9Pgh78iBOfJ4wKLi/U5dzpdDX1Ua86B8uzcGKVGTerbN6QoFwH2
> aOd2tytomYWmFQeMdguN43Ak9hP+ruA1dcqrlZjRPhEBhBJOfbYLSYt3GPDn6Cqq
> jTL/Ui3fu4KHcK8zGgVnXVwQNL0XubBhQmTZ54ohxywejt1A2Q4g4sh0oxvSCEDY
> giqk4uElp5an7K+N1tY+vExvkjdRkjsAQEtFAgp4fzHozbS5jNXBWA==
> =FFl7
> -----END PGP SIGNATURE-----
> 
> 







From prz at pgp.com  Thu Oct 23 17:50:48 1997
From: prz at pgp.com (Phillip R. Zimmermann)
Date: Fri, 24 Oct 1997 08:50:48 +0800
Subject: PRZ Announcement
Message-ID: <344FEE15.673F@pgp.com>



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

  In light of the great amount of discussion currently taking
place in regard to the benefits and disadvantages of my latest
bid for money, power, fame and the respect of the corporate
computer industry, I would like to reassure the cynics that
my committment to privacy has never been stronger.
  However, I have reassessed my views of who truly has a right
to control access to privacy and have come to the conclusion
that privacy is too important an issue to be left in the hands
of the individual, with the obvious potential for misuse.
  After a review of the astounding success of the PGP Public Key
Server's use, in conjunction with our PGP Privy Products, in
ensuring proper key management and control of forgery, spoofing
and misuse of Public/Private Key technology, it has become clear
that individual privacy can best be ensured under the watchful
eye of those with the resources to provide proper surveillance
of those who have earned the right to privacy, in order to 
prevent abuse of that right.

  I would like to thank my other brother, Phil (Hallam-Baker),
for helping me to see that unsupervised use of the right to
privacy could result in individuals misusing that right to
publish extremely embarassing pictures of me in compromising
positions which could affect my credibility.
  As a matter of fact, it was PH-B who suggested my new
signature line.

PRZ
~~~
"I don't put them in the PGPtray...I just turn on the GAK."
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

- -----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNE/sV17MfpC8gEO7EQKaCQCePKAo033KBg/O/T9Nz5IrGLIcCZcAn0L4
JDtdMovT9RZKA4PXwJTNdvpr
=Xvzl
- -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNE/svUlfPVhsMJvfEQI2zgCg8aQ15PEU4eNItEprsLQHd2259fIAn2a1
wwKyecnoEQuCElB3ZtJBZQBz
=53jb
-----END PGP SIGNATURE-----






From prz at pgp.com  Thu Oct 23 18:00:18 1997
From: prz at pgp.com (Phillip R. Zimmermann)
Date: Fri, 24 Oct 1997 09:00:18 +0800
Subject: Announcement
Message-ID: <344FED49.63BD@pgp.com>



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

  In light of the great amount of discussion currently taking
place in regard to the benefits and disadvantages of my latest
bid for money, power, fame and the respect of the corporate
computer industry, I would like to reassure the cynics that
my committment to privacy has never been stronger.
  However, I have reassessed my views of who truly has a right
to control access to privacy and have come to the conclusion
that privacy is too important an issue to be left in the hands
of the individual, with the obvious potential for misuse.
  After a review of the astounding success of the PGP Public Key
Server's use, in conjunction with our PGP Privy Products, in
ensuring proper key management and control of forgery, spoofing
and misuse of Public/Private Key technology, it has become clear
that individual privacy can best be ensured under the watchful
eye of those with the resources to provide proper surveillance
of those who have earned the right to privacy, in order to 
prevent abuse of that right.

  I would like to thank my other brother, Phil (Hallam-Baker),
for helping me to see that unsupervised use of the right to
privacy could result in individuals misusing that right to
publish extremely embarassing pictures of me in compromising
positions which could affect my credibility.
  As a matter of fact, it was PH-B who suggested my new
signature line.

PRZ
~~~
"I don't put them in the PGPtray...I just turn on the GAK."
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

- -----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNE/sV17MfpC8gEO7EQKaCQCePKAo033KBg/O/T9Nz5IrGLIcCZcAn0L4
JDtdMovT9RZKA4PXwJTNdvpr
=Xvzl
- -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNE/svUlfPVhsMJvfEQI2zgCg8aQ15PEU4eNItEprsLQHd2259fIAn2a1
wwKyecnoEQuCElB3ZtJBZQBz
=53jb
-----END PGP SIGNATURE-----







From apache at bear.apana.org.au  Thu Oct 23 18:20:06 1997
From: apache at bear.apana.org.au (apache at bear.apana.org.au)
Date: Fri, 24 Oct 1997 09:20:06 +0800
Subject: Good signatures -- match file contents
In-Reply-To: <344FEE15.673F@pgp.com>
Message-ID: <344FF0E4.74F5@bear.apana.org.au>



Phillip R. Zimmermann wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> - -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
...
> PRZ
> ~~~
> "I don't put them in the PGPtray...I just turn on the GAK."
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> - -----BEGIN PGP SIGNATURE-----
> Version: PGP for Personal Privacy 5.0
> Charset: noconv
> 
> iQA/AwUBNE/sV17MfpC8gEO7EQKaCQCePKAo033KBg/O/T9Nz5IrGLIcCZcAn0L4
> JDtdMovT9RZKA4PXwJTNdvpr
> =Xvzl
> - -----END PGP SIGNATURE-----
> 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP for Personal Privacy 5.0
> Charset: noconv
> 
> iQA/AwUBNE/svUlfPVhsMJvfEQI2zgCg8aQ15PEU4eNItEprsLQHd2259fIAn2a1
> wwKyecnoEQuCElB3ZtJBZQBz
> =53jb
> -----END PGP SIGNATURE-----






From harish at ganymede.contact.com.sg  Thu Oct 23 18:29:24 1997
From: harish at ganymede.contact.com.sg (Harish Pillay)
Date: Fri, 24 Oct 1997 09:29:24 +0800
Subject: Singaporean control freaks & CMR (Re: puff pieces vs tough crypto  issues)
In-Reply-To: <199710231649.MAA26636@users.invweb.net>
Message-ID: <199710240107.JAA16662@ganymede.contact.com.sg>



William -

Hi.

> In <199710231543.XAA02822 at ganymede.contact.com.sg>, on 10/23/97 
>    at 11:43 PM, Harish Pillay  said:
> 
> >Hi.  For the sake of sanity and completeness, the following has to be
> >corrected.
> 
> >> Declan McCullagh  writes:
> >> > The relevance? Another example of Singapore's loony politics. Strict social
> >> > controls and relative economic freedom. I find it fascinating in light of
> >> > Net-filtering and other attempts at restricting information flow; if you
> >> > don't, well, you can always delete it. :)
> >> 
> >> The net-filtering and social control aspects of Singapore are very
> >> interesting.  Seems that somewhere like Singapore might be an earlier
> >> adopter of mandatory GAK -- social ills have hugely disproportionate
> >> treatment over there.  I hear (and our Singaporean contributer
> >> confirms) that chewing gum is illegal, jay walking too.  (Hey you have
> >> the jay walking laws in the US too don't you?)  (I missed the social
> >> control aspect of the vote for kewlest public toilet story).
> 
> >Chewing gum per se is not illegal.  I just cannot buy them from any store
> >in Singapore.  I can chew to my heart's content.  I can go up north to 
> >Malaysia, buy a whole month's supply of gum (name your flavour) and bring
> >it back into Singapore.  
> 
> >So, what is moronically illegal is that I cannot sell that pack of gum.
> 
> Signapore is a prime example of "mirco management" at it's worst. Whenever
> such management is attempted either in the public or private sector they
> fail. It should be intresting to see how long Singapore can keep it up.

I don't think the "micro management" is at it's worst in Singapore - not by 
a long shot.  It is true that the Singapore government tries to do so and 
in a lot of what they attempt, they somehow come out smelling roses.  But 
they have goofed up royally as well.  

Regards.
-- 
Harish Pillay                             	  h.pillay at ieee.org
Singapore      *** Ask me about Linux *** http://home.pacific.net.sg/~harish






From apache at bear.apana.org.au  Thu Oct 23 18:47:17 1997
From: apache at bear.apana.org.au (apache at bear.apana.org.au)
Date: Fri, 24 Oct 1997 09:47:17 +0800
Subject: wombat
Message-ID: <199710240120.LAA06249@bear.apana.org.au>



-----BEGIN PGP SIGNED MESSAGE-----


LOL

ur a crazy wombat



-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBNE/3zXawhvoxf0r9AQFzVgf/XfZDuyJxaHPIPdV5mYGYryPnXC8B8rgI
EjIkuuipwUeQHH5uO4XKxvEP7gwfM0grUbXn9qJeF7izAZ+xxp6ZrbcLdDbzQAhM
JwL6/rvQ+SovNSK7IpwdMPu/im3g+4GGHxTdo7fw1GEz6r+KLnVtcyHyeJbTDAIg
oa1uHXLkFsk6yY4XCAhqL+85a8TYXeNTEb17ufl/S8Vo2wiw4AOmlCZME11rEqNB
ou5+Jo1nk7TDakBxcEPwqnhvrvSGIMNv58wTpKdAkAxzn7NPW3o6ON6MhAbR1Kd8
VeVF3V9j6+a4QYrc9P1s8sg1Ba1Z3B6+MOCkCEpzLH77r0f4Hv8Yxg==
=tNny
-----END PGP SIGNATURE-----






From nobody at neva.org  Thu Oct 23 18:50:47 1997
From: nobody at neva.org (Neva Remailer)
Date: Fri, 24 Oct 1997 09:50:47 +0800
Subject: CMR versus GAK?
Message-ID: <199710240110.UAA09551@dfw-ix3.ix.netcom.com>





"Big Brother or the Boss?"


Are you SURE that's a dichotomy?

Big Biz and Big Gov are almost inextricably intertwined these days.  If dot-com pushes for snoopware, it is called CMR.  If dot-gov pushes for it, it is called GAK.  The real question is, if the interests of Biz and Gov coincide, and "real cooperation" is achieved, does it really matter where the idea originated?  Either way you still have snoopware.

Cpl Kaos








From rfarmer at HiWAAY.net  Thu Oct 23 18:59:05 1997
From: rfarmer at HiWAAY.net (Randall Farmer)
Date: Fri, 24 Oct 1997 09:59:05 +0800
Subject: PRZ Announcement
In-Reply-To: <344FEE15.673F@pgp.com>
Message-ID: 



On Thu, 23 Oct 1997, there's no way in nine hells that Phillip R. Zimmermann
could have wrote:
...
>   However, I have reassessed my views of who truly has a right
> to control access to privacy and have come to the conclusion
> that privacy is too important an issue to be left in the hands
> of the individual, with the obvious potential for misuse.

Hmm...I haven't checked any signatures or headers yet, but something tells me
that this ain't PRZ. For example, the Organization: header refers to Orwell's
1984 as a "blueprint"...forget the signatures (just got a message saying they
match -- either that person's lying, "they" cracked his key, or it's some
detail that has the program using a different key/ignoring some text), it is
psychologically impossible for someone to go from privacy advocate to
1984-as-a-blueprint that quick.

---------------------------------------------------------------------------
Randall Farmer
    rfarmer at hiwaay.net
    http://hiwaay.net/~rfarmer







From fp7e at fp7e30.net  Fri Oct 24 10:18:50 1997
From: fp7e at fp7e30.net (fp7e at fp7e30.net)
Date: Fri, 24 Oct 1997 10:18:50 -0700 (PDT)
Subject: Important
Message-ID: <44592494_96026847>




                         
                         *** MAKE $34,000 in 14 WEEKS ***
              
The main reason for this letter is to convince you that this system is
honest, lawful, extremely profitable, and is a way to get a huge amount
of money in a short time.  

   I was approached several times before I checked this out.  I joined just 
   to see what one could expect in return for the minimal effort and money 
   required.  Initially I let no one in the organization know that I was an    attorney and, to my astonishment, I received $34,470.00 in the first        14 weeks, with money still coming in.

                      Sincerely yours, Biron Stary, Esquire


                   
                     ***"Please Read This Twice!"***

  Dear friend,

		*** Print This Now For Future Reference ***

The following income opportunity is one you may be interested in  taking a 
look at. It can be started with VERY LITTLE investment ($15) and the 
income return potential is TREMENDOUS!!!

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

You are about to make at least $34,000 in less than 90 days!  
Please read the enclosed program...THEN READ IT AGAIN!!!

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

This is a MONEY-MAKING PHENOMENON. PRINT this letter, read the 
program...  THEN READ IT AGAIN !!!

You are looking at the most profitable and unique program you may ever
see.  It has demonstrated and proven ability to generate large sums of
money.  This program is showing fantastic appeal with a huge and ever
growing population which needs additional income.

                       

      This is a legitimate LEGAL money-making opportunity.  It does not
require you to come in contact with people, do any hard work, and best
of all, you never have to leave the house, except to get the mail.  If you 
believe that some day you will get that lucky break that you have been
waiting for, THIS IS IT!  Simply follow the easy instructions, and your
dream will come true!  

This ORIGINAL electronic multi-level marketing program works 
perfectly...100% EVERY TIME!

     Thousands of people have used this program to raise capital to start 
their own business, pay off debts, buy homes, cars, etc., even retire! 
This is your chance, so don't pass it up.

OVERVIEW OF THIS EXTRAORDINARY ELECTRONIC MULTI-LEVEL MARKETING PROGRAM

   Basically, this is what we do:  

We sell thousands of people a product for $5.00 that costs 
us next to nothing to produce and e-mail.  As with all multi-level 
businesses, we build our business by recruiting new partners
and selling our products.  Every state in the U.S. allows you to recruit
new multi- level business online (with your computer).

The product in this program is a series of four reports. Each order 
will include the e-mail address of the sender.  To fill each order, 
you simply e-mail the product to the buyer. No postage or time wasted.  
THAT'S IT!...the $5.00 is yours!  

This is the GREATEST, EASIEST electronic multi-level marketing 
business anywhere! There are no more costs after you have purchased
the reports. 

FOLLOW THE INSTRUCTIONS EXACTLY!
Let's face it, the profits are worth it!  THEY'RE TREMENDOUS!!!
So go for it.  Remember the 4 points and we'll see YOU at the top!




           ******* I  N  S  T  R  U  C  T  I  O  N  S *******


This is what you MUST do:

1.  Order the reports listed and numbered from the list below.
    For each report send $5.00 CASH, YOUR E-MAIL ADDRESS and YOUR
    RETURN POSTAL ADDRESS (in case of a problem) to each person listed.

     When you order, make sure you request each SPECIFIC report.  You
     will need all three reports, because you will be saving them on your 
     computer and reselling them.

2.  IMPORTANT--DO NOT alter the names, or their sequence other than
    instructed in this program! Or you will not profit the way you should.

    Replace the name and address under REPORT #1 with yours, moving
    the one that was there down to REPORT #2.  Move the name and
    address under REPORT #2 to REPORT #3. Bump off the name in
    the 3rd position, they already are have made thousands, 
    it's your turn now!   

    When doing this, please make certain you copy everyone's name and
    address ACCURATELY!!!  Also, DO NOT move the Report/Product
    positions!

3.  Take this entire program text, including the corrected names list,
    and save it on your computer.

4.  Now you're ready to start a massive advertising campaign on the
    WORLDWIDE WEB!  Advertising on the WEB is very, very inexpensive,
    but there are HUNDREDS of FREE places to advertise also.  Another
    avenue which you could use is e-mail mailing lists.  You can buy
    these lists for under $20/1,000 addresses.  START YOUR AD CAMPAIGN
    AS SOON AS YOU CAN. You should pass this opportunity on to all
    you friends, family, business partners, everyone! The more people that
    participate, the more CASH you make!!!

      ALWAYS PROVIDE SAME-DAY SERVICE ON ALL ORDERS!!!
 
                      ********REQUIRED REPORTS********

***Order each REPORT by NUMBER and NAME***

ALWAYS SEND  $5 CASH (Concealed) FOR EACH ORDER 
REQUESTING THE SPECIFIC REPORT BY NAME AND NUMBER. 
ALWAYS SEND FIRST CLASS OR PRIORITY MAIL AND PROVIDE 
YOUR E-MAIL ADDRESS FOR QUICK DELIVERY.

____________________________________________________
REPORT #1 
"HOW TO MAKE $250,000 THROUGH MULTI-LEVEL SALES"

ORDER REPORT #1 FROM:  
NEW AGE MARKETING
PO Box 60231 
King of Prussia, PA 19406

________________________________________
REPORT #2
"USE YOUR COMPUTER AS A MONEY MAKING  MACHINE"

ORDER REPORT #2 FROM:
C.S. Marketing
PO Box 1125
Valley Forge, PA  19482

___________________________________________________
REPORT #3 
"SOURCES FOR THE BEST MAILING LISTS"

ORDER REPORT #3 FROM:
ek at NYL
1 Radnor Corp. Cntr, Suite 100
Radnor, PA 19087
____________________________________________________



HERE'S HOW THIS AMAZING PLAN WILL MAKE YOU $MONEY$

Let's say you decide to start small just to see how it goes.  Assume
your goal is to get 10 people to participate on your first level.
(Placing a lot of FREE ads on the internet could EASILY get a better
response.)  Also assume that everyone else in YOUR BUILDING 
ORGANIZATION gets ONLY 10 members.  Follow this example 
for the STAGGERING results below.

1st level -- your 10 members with $5   ($5 x 10)                $50
2nd level -- 10 members from those 10  ($5 x 100)              $500
3rd level -- 10 members from those 100 ($5 x 1,000)          $5,000

         			
                                      THIS TOTALS------------$5,550

Remember friends, this is assuming that the people who participate
only recruit 10 people each.  Dare to think for a moment what would
happen if everyone got 20 people to participate!  Some people get
100's of recruits!  THINK ABOUT IT!

By the way, your cost to participate in this is practically nothing.
You obviously already have an internet connection and email is FREE!!!
REPORT#3 will show you the best methods for finding people who will buy 
your reports, and it will how to reach thousands of hot prospects!

REMEMBER:  Approx. 150,000 new people get online monthly!

      ORDER YOUR REPORTS NOW!!!


*******TIPS FOR SUCCESS*******

THIS IS YOUR BUSINESS!  Send for the three reports IMMEDIATELY,
so you will have them when the orders start coming in because:
When you receive a $5 order, you MUST send out the requested 
product/report to comply with the U.S. Postal & Lottery Laws, 
Title 18,Sections 1302 and 1341 or Title 18, Section 3005 in the U.S. 
Code, also Code of Federal Regs. vol. 16, Sections 255 and 436, which
state that "a product or service must be exchanged for money received."

*  ALWAYS PROVIDE SAME-DAY SERVICE ON THE ORDERS YOU RECEIVE.

*  Be patient and persistent with this program.  If you follow the           instructions exactly the results WILL undoubtedly be SUCCE$$!

*  ABOVE ALL, HAVE FAITH IN YOURSELF THAT YOU CAN SUCCEED!


*******YOUR SUCCESS GUIDELINE*******

The check point that guarantees your success is simply this:
You MUST receive 20 orders for REPORT #1!  THIS IS A MUST!  If
you don't within two weeks, advertise more and send out more programs
until you do.  Then, a couple of weeks later you should receive at
least 100 orders for REPORT #2.  If you don't, advertise more and send
out more programs until you do.  Once you have received 100, or more
orders for REPORT #2, YOU CAN RELAX, because you will be on your way
to the BANK!  -OR-  You can DOUBLE your efforts!

REMEMBER:  Every time your name is moved down on the list you are in
front of a DIFFERENT report, so you can KEEP TRACK of your PROGRESS
by what report people are ordering from you. IT'S THAT EASY!!!

NOTE:  IF YOU NEED HELP with starting a business, registering a business
name, how income tax is handled, etc., contact your local office of the 
Small Business Administration (a Federal agency) for free help and answers to questions.  Also, the Internal Revenue Service offers free help via telephone and free seminars about business taxes.

        



           ******* T  E  S  T  I  M  O  N  I  A  L  S *******
 
This program does work, but you must follow it EXACTLY! Especially the
rule of not trying to place your name in a different position, it won't work,you'll lose a lot of money.  I'm living proof that it works.  It really is a great opportunity to make relatively easy money, with little cost to you.  If you do choose to participate, follow the program exactly, and you'll be on your way to financial security.  If you are a fellow Christian and are in financial trouble like I was, consider this a sign.  I DID!
                                            Good Luck & God Bless You,
                                     Sincerely, Minister Chris Johnson

P.S.  Do you have any idea what 11,700 $5 bills ($58,500) looks
like piled up on the kitchen table?...IT'S AWESOME!


My name is Frank.  My wife Doris and I live in Bel-Air, MD.
I am a cost accountant with a major U.S. Corporation and I make
pretty good money.  When I received the program I grumbled to Doris
about receiving "junk mail"!  I made fun of the whole thing, spouting
my knowledge of the population and percentages involved.  I "knew" it
wouldn't work.  Doris totally ignored my supposed intelligence and
jumped in with both feet.  I made merciless fun of her, and was ready
to lay the old "I told you so" on her when the thing didn't work...
well, the laugh was on me!  Within two weeks she had received over 50
responses.  Within 45 days she had received over $147,200 in $5 bills!
I was stunned.  I was sure that I had it all figured and that it wouldn't 
work...I AM a believer now.  I have joined Doris in her "little" hobby. I did have seven more years until retirement,  but I think of the "rat race" andit's not for me...We owe it all to MLM.
                                              Frank T., Bel-Air, MD
 
I just want to pass along my best wishes and encouragement to you. 
Any doubts you have will vanish when your first orders come in.  I even
checked with the U.S. Post Office to verify that the plan was legal.  
It definitely is!  IT WORKS!!!
                                           Paul Johnson, Raleigh, NC

This is the only realistic money-making offer I've ever received.  I 
participated because this plan truly makes sense. I was surprised
when the $5.00 bills started filling my mail box. By the time it tapered
off I had received over 8,000 orders with over $40,000 in cash.  Dozens
of people have sent warm personal notes too, sharing the news of their
good fortunes!  It's been WONDERFUL.
                                              Carl Winslow Tulsa, OK
 
 
This plan works like GANG-BUSTERS!! So far I have had 9,735 total orders
OVER $48,000!!!  I hope I have sparked your own excitement, if you follow
the program exactly, you could have the same success I have, if not better.
Your success is right around the corner, but you must do a little work.
                                                   Good Luck!  G. Bank
 
Not being the gambling type, it took me several weeks to make
up my mind to participate in this plan.  But conservative that I am
I decided that the initial investment was so little that there was
just no way that I wouldn't get enough orders to at least get my money
back.  Boy I was surprised when I found my medium-size post office box
crammed with orders.  After that it got so over-loaded that I had to
start picking up my mail at the window.  I'll make more money this
year than any 10 years of my life before.  The nice thing about this
deal is that it doesn't matter where in the U.S. the people live.
There simply isn't a better investment with a faster return.
                                             Mary Rockland, Lansing, MI

I had received this program before.  I deleted it, but later
I wondered if I shouldn't have given it a try.  Of course, I had no
idea who to contact to get another copy, so I had to wait until I
was e-mailed another program...11 months passed then it came...I
didn't delete this one!...I made $41,000 on the first try!!
                                                 D. Wilburn, Muncie, IN
 
This is my third time to participate in this plan.  We have
quit our jobs, and quite soon we will buy a home on the beach and live
off the interest on our money.  The only way on earth that this plan
will work for you is if you do it.  For your sake, and for your family's
sake don't pass up this golden opportunity.  Remember, when you order
your four reports, SEND CASH.  Checks have to clear the bank and create
too many delays.  Good luck and happy spending!
                                         Charles Fairchild, Spokane, WA
 
Typically when I look at a money-making deal I want to
know if the company is strong, will it be here when it's time for
my big pay off.  In this crazy thing there is no company intervention
for management to blow it.  Just people like me ordering directly
from the source!  Interesting...I had a couple of projects I'd been
trying to fund to no avail so I thought; Why not give it a try?  Well
2 1/2 weeks later the orders started coming in.  One project is funded
and I'm sure the other will be soon!
                                         Marilynn St. Claire, Logan, UT
 
====================================================

We could be printing YOUR testimonial next!!!
 
ORDER YOUR REPORTS TODAY AND GET
STARTED DOWN THE ROAD TO YOUR
FINANCIAL FREEDOM!!!
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
IMPORTANT NOTE: If you don't get a report, please 
email webmaster at crescentstreet.com and inform us,
we monitor to make sure you get your reports quickly.
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
To be removed from our list please visit http://www.iemmc.org





From jya at pipeline.com  Thu Oct 23 19:26:17 1997
From: jya at pipeline.com (John Young)
Date: Fri, 24 Oct 1997 10:26:17 +0800
Subject: Senator Lott on Encryption
Message-ID: <1.5.4.32.19971024015535.00b87684@pop.pipeline.com>



Excerpt below of statement on encryption policy by Senate Majority 
Leader Lott published in the October 21 Congressional Record.
Full statement at: 

     http://jya.com/lott-crypto.htm  (12K)

----------

Senator Lott:

  During the past month, the FBI has attempted to change the debate by 
proposing a series of new mandatory controls on the domestic sale and 
use of encryption products. Let me be clear. There are currently no 
restrictions on the rights of Americans to use encryption to protect 
their personal financial or medical records or their private e-mail 
messages. There have never been domestic limitations, and similarly, 
American businesses have always been free to buy and use the strongest 
possible encryption to protect sensitive information from being stolen 
or changed. But now, the FBI proposes to change all that.

  The FBI wants to require that any company that produces or offers 
encryption security products or services guarantee immediate access to 
plain text information without the knowledge of the user. Their 
proposal would subject software companies and telecommunications 
providers to prison sentences for failure to guarantee immediate access 
to all information on the desktop computers of all Americans. That 
would move us into an entirely new world of surveillance, a very 
intrusive surveillance, where every communication by every individual 
can be accessed by the FBI.

  Where is probable cause? Why has the FBI assumed that all Americans 
are going to be involved in criminal activities? Where is the 
Constitution?

  And how would this proposal possibly help the FBI? According to a 
forthcoming book by the M.I.T. Press, of the tens of thousands of cases 
handled annually by the FBI, only a handful have involved encryption of 
any type, and even fewer involved encryption of computer data. Let's 
face it--despite the movies, the FBI solves its cases with good old-
fashioned police work, questioning potential witnesses, gathering 
material evidence, and using electronic bugging or putting microphones 
on informants. Restricting encryption technology in the U.S. would not 
be very helpful to the FBI.

  The FBI proposal won't work. I have talked with experts in the world 
of software and cryptography, who have explained that the technology 
which would provide compliance with the FBI standard simply does not 
exist. The FBI proposal would force a large unfunded mandate on our 
high technology firms, at a time when there is no practical way to 
accomplish that mandate.

  Rather than solve problems in our export policy, this FBI proposal 
would create a whole new body of law and regulations restricting our 
domestic market.

  This and similar proposals would also have a serious impact on our 
foreign market. Overseas businesses and governments believe that the 
U.S. might use its keys to computer encryption systems to spy on their 
businesses and politicians. Most U.S. software and hardware 
manufacturers believe this is bad for business and that nobody will 
trust the security of U.S. encryption products if this current policy 
continues. In fact, this proposal appears to violate the European 
Union's data-privacy laws, and the European Commission is expected to 
reject it this week.

  So, the FBI proposal would: Invade our privacy; be of minimal use to 
the FBI; would require nonexistent technology; would create new 
administrative burdens; and would seriously damage our foreign markets.

  This is quite a list.

  Mr. President, the FBI proposal is simply wrong. I have learned that 
even the administration does not support this new FBI proposal. So why 
does the FBI believe it must now subject all Americans to more and more 
surveillance?

  This independent action by the FBI has created confusion and mixed 
signals which are troublesome for the Senate as it works on this 
legislation. Perhaps the FBI and the Justice Department need to focus 
immediately on a coordinated encryption position.

  Mr. President, I congratulate the members of the House Commerce 
Committee for rejecting this FBI approach by a vote margin of more than 
2 to 1.

-----







From jsmith58 at hotmail.com  Thu Oct 23 19:34:46 1997
From: jsmith58 at hotmail.com (John Smith)
Date: Fri, 24 Oct 1997 10:34:46 +0800
Subject: US Senator Lott Criticizes FBI Crypto Plans (fwd)
Message-ID: <19971024015327.3587.qmail@hotmail.com>



Senator Lott says:

>Where is probable cause? Why has the FBI assumed that all Americans are
>going to be involved in criminal activities? Where is the Constitution?

Bravo, Senator Lott!

It is a pleasure to hear a Senator speak out against the FBI's
plans.  Plus he is basing it on the Constitution as well as
practical problems.  So many Senators become mouthpieces for the FBI.
What a pleasant difference.

Senator Lott's words deserve to be widely heard.  Let us remember
that not everyone in the government is in Louis Freeh's pocket.  With
people like Senator Lott we can still be confident that Louis Freeh's
Big Brother plans can be stopped.

"John

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com






From jason at pgp.com  Thu Oct 23 19:38:29 1997
From: jason at pgp.com (Jason Bobier)
Date: Fri, 24 Oct 1997 10:38:29 +0800
Subject: PRZ Announcement
In-Reply-To: 
Message-ID: <3450054D.21B8@pgp.com>



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Randall Farmer wrote:
> 
> On Thu, 23 Oct 1997, there's no way in nine hells that Phillip R. Zimmermann
> could have wrote:
> ...
> >   However, I have reassessed my views of who truly has a right
> > to control access to privacy and have come to the conclusion
> > that privacy is too important an issue to be left in the hands
> > of the individual, with the obvious potential for misuse.
> 
> Hmm...I haven't checked any signatures or headers yet, but something tells me
> that this ain't PRZ. 

Randall,
Good eye. This forgery even fooled some of us at PGP.

However, I immediately recognized that PRZ's alleged new signature
line: "I don't put them in the PGPtray...I just turn on the GAK."
was backwards. That is Lying Jackoff Fuck Louis J. Freeh's line.

  Phil's new signature line now reads:
"I just put them in the PGPtray...I don't turn on the GAK."

Jason
~~~~~
"It's not a mask, it's an attitude."
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNFAEDsIoHaOg9jRdEQJrNQCeIPY8Kx8SX0XF/iI+Dt0lkZ94F3QAniWQ
BRedHLydVsyjxBLmfP6d9NNo
=rLE4
-----END PGP SIGNATURE-----






From jya at pipeline.com  Thu Oct 23 19:41:33 1997
From: jya at pipeline.com (John Young)
Date: Fri, 24 Oct 1997 10:41:33 +0800
Subject: David Kahn on National Encryption Policy
Message-ID: <1.5.4.32.19971024020821.00ba3f74@pop.pipeline.com>



This was published in the October 22 Congressional Record as
part of a statement by Senator Moynihan on the retirement of
NSA Deputy Director William Crowell:

                      [From Newsday, Oct. 6, 1997]

    National Security Official Retires--Helped Refocus Agency's Aims

                            (By David Kahn)

       The National Security Agency has said goodbye to its 
     retiring deputy director, who largely brought the super-
     secret spy organization into its public, post-Cold War 
     posture.
       William P. Crowell was the force behind the establishment 
     of the National Cryptologic Museum, which exhibits what had 
     been some of the nation's deepest secrets; the revelation of 
     the VENONA project, which broke Soviet spy codes early in the 
     Cold War; and the National Encryption Policy, which seeks to 
     balance personal privacy with national security.
       Succeeding Crowell will be Barbara McNamara, who, like 
     Crowell, is a career employee of the agency, which breaks 
     foreign codes and makes American Codes for the United States 
     government.
       McNamara is the second female deputy director of the 
     agency. The first, Ann Z. Caracristi, who served from 1980 to 
     1982, is the sister of the late Newsday photographer Jimmy 
     Caracristi.
       More than 500 present and past members of the agency 
     attended Crowell's recent retirement ceremony at its glossy, 
     triple-fenced headquarters at Fort Meade, Md. They applauded 
     as he was presented with awards for his intelligence and 
     executive services and with a folded American flag that had 
     flow over the agency.
       They laughed as a picture, claimed to be his retirement 
     portrait, was unveiled: It was a photograph of Crowell, 
     notorious for his love of motorcycles, astride his fancy 
     bike. During his acceptance speech, Crowell choked up when he 
     thanked his wife, Judy, a former agency employee and fellow 
     motorcyclist, for her help.
       The agency director, Air Force Lt. Gen. Kenneth Minihan, 
     recited some of the administrative landmarks of Crowell's 
     career.
       Crowell, 58, a native of Louisiana, began in New York City 
     in 1962 as an agency recruiter. In 1969, when he sought an 
     assignment to operations, he became instead an executive 
     assistant to the then-director. He eventually got to 
     operations, where he rose to be chief of W group, whose 
     function remains secret, and then chief of A group, which 
     focused on the then-Soviet Union. After a year in private 
     industry, he rose through other posts to the deputy 
     directorship on Feb. 2, 1994.
       Among his organizational accomplishments were conceiving a 
     crisis action center and linking the agency with other 
     producers of intelligence to improve information exchange.
       His more public initiatives included the museum and the 
     VENONA disclosures, which sought to maintain public support 
     for the agency after the disappearance of the Soviet Union. 
     The National Encryption Policy seeks to enable the agency to 
     read the messages of terrorists and international criminals 
     who use computer-based, unbreakable ciphers while enabling 
     individuals to use good cryptosecurity to preserve such 
     rights as security on the Internet.

----------

See Moynihan's statement:

     http://jya.com/nsa-crowell.htm






From rfarmer at HiWAAY.net  Thu Oct 23 20:06:18 1997
From: rfarmer at HiWAAY.net (Randall Farmer)
Date: Fri, 24 Oct 1997 11:06:18 +0800
Subject: PRZ Announcement
In-Reply-To: 
Message-ID: <34500C05.7D6F@HiWAAY.net>



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Some lame forger pretended Randall Farmer wrote:
 
> On Thu, 23 Oct 1997, there's no way in nine hells that Phillip R. Zimmermann
> could have wrote:
> ...
> >   However, I have reassessed my views of who truly has a right
> > to control access to privacy and have come to the conclusion
> > that privacy is too important an issue to be left in the hands
> > of the individual, with the obvious potential for misuse.
> 
> Hmm...I haven't checked any signatures or headers yet, but something tells me
> that this ain't PRZ. For example, the Organization: header refers to Orwell's
> 1984 as a "blueprint"...forget the signatures (just got a message saying they
> match -- either that person's lying, "they" cracked his key, or it's some
> detail that has the program using a different key/ignoring some text), it is
> psychologically impossible for someone to go from privacy advocate to
> 1984-as-a-blueprint that quick.
> 
> ---------------------------------------------------------------------------

  The above is a lame forgery by some troublemaker, and only 
serves to underscore PRZ's new position, namely, that access
to privacy should be supervised by people who have shown that
they have the maturity to act responsibly, as evidenced by
their success in a corporate atmosphere.

  I am PGP signing this post so that there can be no doubt as
to its source and authenticity.
  Cypherpunks list subscribers should be more careful about
checking signatures before believing everything they read.

Randall Farmer
    rfarmer at hiwaay.net
    http://hiwaay.net/~rfarmer

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNFAK/BpRm26Z4YsSEQIA0wCeJZ7R9w/XfDuE0HMo+eP/0ihYOykAoNef
Gt1hIbRHpYtJ1jp/79hWZl0G
=E9PX
-----END PGP SIGNATURE-----






From bd1011 at hotmail.com  Thu Oct 23 20:10:02 1997
From: bd1011 at hotmail.com (Nobuki Nakatuji)
Date: Fri, 24 Oct 1997 11:10:02 +0800
Subject: Elliptic Curve Cryptography
Message-ID: <19971024024428.13967.qmail@hotmail.com>



Is Elliptic Curve Cryptography a better encryption system than RSA ?



______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com






From ravage at ssz.com  Thu Oct 23 20:46:21 1997
From: ravage at ssz.com (Jim Choate)
Date: Fri, 24 Oct 1997 11:46:21 +0800
Subject: ADMIN: lost messages (fwd)
Message-ID: <199710240359.WAA21656@einstein.ssz.com>



Forwarded message:

> From: Jeff Barber 
> Subject: Re: ADMIN: lost messages (fwd)
> Date: Thu, 23 Oct 1997 13:21:27 -0400 (EDT)

> I understand this rationale.

It isn't a rationale, its reality. This view is not moderated by political
or ideological beliefs but the harsh reality that things don't work the
right way all the time.

> But that doesn't explain what's 
> happening to the missing messages.

Your implied base assumption is that the reason is always the same. I
seriously doubt it.

>  Is there a flaw in the 
> distributor/reflector duplicate-filtering algorithms? 

The process is so simple it ain't funny. I believe, but won't guarantee it,
that we are all using a procmail script to remove duplicate messages, and
that is all the 'distributor/reflector duplicate-filter algorithms' there
is. Unless one of the other repeaters is doing something more complicated
they haven't said. In short, you are under the misconception that this is
something special, it ain't.

SSZ receives traffic from the other remailers at cpunks at ssz.com, just a
normal user account, which has the procmail script filtering duplicates. It
then forwards to cypherpunks at ssz.com, which is the majordomo managed list.
cpunks at ssz.com as well as the rest of the subscribers get their traffic from
here. If the procmail breaks then I get a mail loop at SSZ and my box fills
up and lets me know pretty quickly something is broke because majordomo
recognizes this through the X-loop: and kills them in that case as well as
sending postmaster (me) all kinds of nifty hints. The other sites in this
case still filter duplicates so things still don't run away.

>From my end to add another node is to put it in the procmail script for
outbound and have them add cpunks to their outbound list.

> Or is this
> a problem of certain messages being introduced into a node whose
> product does not get propagated to all subscribers of all the other
> nodes?

Sounds good to me...

> Or are you saying that if ssz (say) goes down for a few
> minutes it forgets about any mail it has queued up for its
> counterparts at cyberpass and algebra (et al.)?

No, SSZ has full inbound and outbound traffic queing for up to 4 days
or the hard drive fills up here and at my ISP.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|


ps The ISDN was apparently moved to a new pair. It seems rock solid at
   this point...time will tell.






From ravage at ssz.com  Thu Oct 23 20:49:42 1997
From: ravage at ssz.com (Jim Choate)
Date: Fri, 24 Oct 1997 11:49:42 +0800
Subject: CDR Operators & interaction...
Message-ID: <199710240408.XAA21717@einstein.ssz.com>



Hi,

I have received a couple of pieces of mail that concern me. The content
seems to indicate that people have one or both of two basic misconceptions
about the CDR:

 -  The operators do not communicate between ourselves unless one of us
    begins to recieve duplicates or other indications of problems at
    another site. Outside of that we simply don't communicate.

 -  I am NOT in any way the moderator, central clearing house, or in
    any other manner concerned with the operation of the 'network' of
    remailers. I operarate SSZ as a home-based business and the
    CDR is motivated by my personal interest in the various issues
    as well as the fact that it costs nothing extra for me to carry.

The remailer network was initialy instituted by Igor and myself in order to
keep the Cypherpunks mailing list alive after the toad.com announcement that
the mailing list was going away due to the various issue related to the
moderation experiment. The entire point was to create a system such that it
was simple and could not be compromised by any single operator.

Furthermore, if you or anyone you know is interested in joining the CDR as a
remailer node, archive site, mail-news gateway, etc. then send a message to
the list requesting the various operators for feeds. SSZ has a standing
invitation to anyone who desires to have a full-time participant.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From trei at relay-1.ziplink.net  Thu Oct 23 21:17:05 1997
From: trei at relay-1.ziplink.net (Trei Family)
Date: Fri, 24 Oct 1997 12:17:05 +0800
Subject: Did you taken part in a key crack?
Message-ID: <3.0.1.32.19971024001144.007ae680@pop3.ziplink.net>



I'm giving a presentation at the RSA Data Security Conference
in January, 1998. The title is "Key Cracking for fun and Profit: The
Year in Review".

The main topic will be the activity spawned by the RSA Secret Key 
Challenges, though I'll include other brute-force and factoring 
efforts, in 1997 or before.

If you have taken part in a key search, and/or have any thoughts 
on the topic you'd like to share, I hope you'll send them to me at 
trei at ziplink.net. 

I'm particularly interested in finding out about some of the 
less-known efforts - for example, the DES effort rumored to have
taken place at SGI, and the early, abortive RC5/56 effort at a
New York site.

Stories, anecdotes, and issues raised by the efforts are all 
welcomed. Responses will be kept confidential if desired.

Thanks,

Peter Trei
trei at ziplink.net

DISCLAIMER: The above are my own views, should not be misconstrued 
to represent those of my employer.









From markm at pgp.com  Thu Oct 23 21:17:21 1997
From: markm at pgp.com (Marc J. McArdle)
Date: Fri, 24 Oct 1997 12:17:21 +0800
Subject: Questionable Authenticity / Re: PRZ Announcement
In-Reply-To: 
Message-ID: <34501ADC.504E@pgp.com>



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In order to clear up some confusion in regard to recent posts to
the cypherpunks and coderpunks lists, I would like to remind PGP
users that the only way to truly check the authenticity of any
message is by verifying the PGP signature of a message with the
copy on the PGP Key Server.

Now that we have Key Server technolgy fully developed, all of
the paranoid warnings in the original PGP documentation no longer
apply, as long as a person takes the time to compare message
signatures to the original keys held on the PGP Key Server.

Since PRZ sometimes spells his first name with _one_ 'l' and
sometimes with _two_, it can be confusing. Likewise, his
occasional spelling of his last name with _one_ 'n' and then
with _two_ on other occassions.
I vary the spelling of my own name--between 'Marc' and 'Mark',
and occasionally, 'Marck'--but as long as you can verify my
middle digital signature, you can be assured it is me sending
the message.

Please distribute this message as widely as possible, so that
PGP users realize that adhering to the principles espoused in
the original PGP documentation only makes us all look like a
bunch of paranoid lunatics.

Marck
~~~~~
"I can put my dick in my ear...can you?"

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNFAZVxurK3YPheUYEQLhQwCdHlpQi3QrVchZu0pfHGWcTlb7TXEAoI/R
eeFnnXIvATOoSbAFmUVnmis9
=3MQh
-----END PGP SIGNATURE-----






From dfrntdrums at aol.com  Fri Oct 24 12:21:29 1997
From: dfrntdrums at aol.com (dfrntdrums at aol.com)
Date: Fri, 24 Oct 1997 12:21:29 -0700 (PDT)
Subject: Loose Weight Now
Message-ID: <>


Learn how to trim the dead fat...
Ask me how...
dfrntdrums at aol.com





From dfrntdrums at aol.com  Fri Oct 24 12:21:29 1997
From: dfrntdrums at aol.com (dfrntdrums at aol.com)
Date: Fri, 24 Oct 1997 12:21:29 -0700 (PDT)
Subject: Loose Weight Now
Message-ID: <>


Learn how to trim the dead fat...
Ask me how...
dfrntdrums at aol.com





From declan at well.com  Thu Oct 23 21:27:43 1997
From: declan at well.com (Declan McCullagh)
Date: Fri, 24 Oct 1997 12:27:43 +0800
Subject: US Senator Lott Criticizes FBI Crypto Plans (fwd)
In-Reply-To: <19971024015327.3587.qmail@hotmail.com>
Message-ID: 



To be sure, Lott is one of the good guys on crypto. (So far, at least.) But:

> Let us remember
>>that not everyone in the government is in Louis Freeh's pocket

Remember, the folks not in Freeh's pockets are in the pockets of the
telephone companies or some other rich lobby group. When legislation is at
stake, the needs of industry only occasionally coincide with civil
liberties.

-Declan


At 18:53 -0700 10/23/97, John Smith wrote:
>Senator Lott says:
>
>>Where is probable cause? Why has the FBI assumed that all Americans are
>>going to be involved in criminal activities? Where is the Constitution?
>
>Bravo, Senator Lott!
>
>It is a pleasure to hear a Senator speak out against the FBI's
>plans.  Plus he is basing it on the Constitution as well as
>practical problems.  So many Senators become mouthpieces for the FBI.
>What a pleasant difference.
>
>Senator Lott's words deserve to be widely heard.  Let us remember
>that not everyone in the government is in Louis Freeh's pocket.  With
>people like Senator Lott we can still be confident that Louis Freeh's
>Big Brother plans can be stopped.
>
>"John
>
>______________________________________________________
>Get Your Private, Free Email at http://www.hotmail.com








From web-promotions at nevwest.com  Fri Oct 24 12:41:14 1997
From: web-promotions at nevwest.com (web-promotions at nevwest.com)
Date: Fri, 24 Oct 1997 12:41:14 -0700 (PDT)
Subject: Automated Links Trade
Message-ID: <199710241724.OAA29210@north.nsis.com>


Attention Fellow Webmasters:

THE ULTIMATE TECHNOLOGY IS HERE!!!!!!!!!!!

Do you trade links? Yes
Do you hate trading links and soliciting links trades? Yes
Does it produce good traffic? Yes

http://www.adultsitelinks.com  Automated Links Trade

Well, we've created a program, after 100s of programming and designing
hours that will AUTOMATICALLY trade
links with other adult sites signed up to ASL Net (Adult Site Links
Network) in a matter of seconds. Better yet, you
need not add the links to your links page, because your links page is
AUTOMATICALLY generated by our program
with your style specifications in your links page template. This program
is very slick. It isn't a TOP ?? Anything,
there is no bullshit traffic, the system is designed to find any
cheaters automatically with programs that run every
evening. We've tried to think of everything to produce more traffic for
you. This is simply a way to trade links without
soliciting links trades. You still have a links page, it still has your
sites look, it still trades links with sites in your
hits/day traffic category......the only difference is you do all your
links trades FOREVER one time by signing up.

How much for this service? NOTHING its FREE This is a beta launch, but
we've done heavy internal testing and
everything is flawless as of yet. Don't delay, stop wasting precious
time on tedious link trade solicitations and dead
links......let our software do it for you for FREE and gain a ton of
traffic. Don't try to cheat us, if you do your site,
name and e-mail address will be sent to a sponsor list already very long
warning them not to except your program.
(Sponsors if you want on this list, please e-mail me and I'll add you to
this list)
People this is revolution and you don't want to miss out on it. Sign up
below, gain traffic, lose headaches!! Its that
easy........

ADULT SITE LINKS NETWORK :: ASL-Net

Click below to learn more and sign up now, its instantaneous.

http://www.adultsitelinks.com





<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

This message was sent by Adult Web Promotions with the intent of reaching
it's Adult Webmaster Audience.  

The Advertiser in this email does not maintain the mailing list that you are list on.

If you would like to be removed from future mailings, please type the word REMOVE
in the subject line and reply back to the sender of this email.

<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>  







From president at whitehouse.gov  Thu Oct 23 21:47:46 1997
From: president at whitehouse.gov (William J. Clinton)
Date: Fri, 24 Oct 1997 12:47:46 +0800
Subject: NSA Job Offer
Message-ID: <199710023438.AAA04797@whitehouse.gov>



Dear Randall

I saw your post on the cypherpunks list debunking the
forgery of my good friend Phill Zimmerman. As you are
no doubt aware my Deputy Director of the NSA retired
recently and I've decided that Barbie is no longer suitable
following certain uncomplimentary remarks she made
after a fireside shagging^H^H^H^Hchat we had last night.
I am therefore looking for a supersluth to fill this
challenging position. If you would be interested in
taking the bit between your teeth, so to speak, please
email me and we'll do lunch.

--
Bill C.
"The next person who mentions my penis gets an ICBM up their ass"






From semprini at theschool.com  Thu Oct 23 22:31:52 1997
From: semprini at theschool.com (semprini at theschool.com)
Date: Fri, 24 Oct 1997 13:31:52 +0800
Subject: Spoofing
Message-ID: <199710240516.WAA23264@everest.brigadoon.com>



I don't think I'm out of line here in saying that all this spoofing of 
other users is a bit childish. I'm sure there are better 
things one could find to do with one's time. (Possibly work on 
cracking RSA's 128- bit key?)

--Dylan






From joubin at inch.com  Thu Oct 23 22:51:19 1997
From: joubin at inch.com (Joubin)
Date: Fri, 24 Oct 1997 13:51:19 +0800
Subject: Request for expert opinion and Feedback
Message-ID: <34503432.B31F9382@inch.com>



Hello all,

I am involved in a project which aims at the creation of a free and
portable Java(tm) based object operating system.  A basic functional
requirement for this new OS is to provide /fast and effective/ strong
cryptographic support at the OS level.  

The basic structure of the system is a layered architecture, with the
lowest layer consisting of a platform specific (non-portable) kernel
supporting an embedded JVM (again in C/ASM) and a set of Java(tm)
interfaces to this 'virtual platform'.  The OS proper will sit on top of
this and will be 100% Java (tm).

The issue:

As you may know, SMI has and will deliver a set of 'security' packages
as a standard component of JDK.  This uses RSA technology.  Basic and
general 'interfaces' to encapsulate constructs such as Key, Provider,
Cypher, etc. are also defined.  

A few people in the project group feel that many different groups and
entities out there will provide (portable) Public Key encryption
packages (implemented in Java(tm)) that can be used by the users of the
OS.  They argue against embedding computational support at the Kernel
(non-portable) layer as wasted effort.

Others (& myself included) feel that 'effective' also means efficiency
of execution.  Specially so if such functionality is to be used to
encypher 'streams' and such (if that is possible).


Your expert advice:

a) How do you feel about 'where' the computational support should be
   implemented ?

b) Assuming answer to (a) to be "At the kernel level and in C/ASM", is
   it possible to achieve a fine-grain modularity in terms of fairly
   generic algorithms and computations which can then be combined in
   conjunction to support a variety of encryption strategies ?

c) Is there any benefit to implementing the random number generation
   system in the Kernel?


Your input is greatly appreciated.  If you feel there are other
considerations to be made, please let me know.


Thank you.

Joubin

p.s.  Java(tm) and related items are the tightly guarded property of Sun
Microsystems Inc.

__________________________________
member, alpha zero LLC
joubin at inch.com
NoVA
__________________________________






From nobody at REPLAY.COM  Thu Oct 23 22:53:59 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Fri, 24 Oct 1997 13:53:59 +0800
Subject: Spoofing
Message-ID: <199710240530.HAA17250@basement.replay.com>



semprini at theschool.com wrote:
> 
> I don't think I'm out of line here in saying that all this spoofing of
> other users is a bit childish. I'm sure there are better
> things one could find to do with one's time. (Possibly work on
> cracking RSA's 128- bit key?)
> 
> --Dylan

I already cracked it.
The message is: "Sorry, but we ran out of cash."






From tcmay at got.net  Thu Oct 23 23:25:26 1997
From: tcmay at got.net (Tim May)
Date: Fri, 24 Oct 1997 14:25:26 +0800
Subject: Spoofing
In-Reply-To: <199710240516.WAA23264@everest.brigadoon.com>
Message-ID: 



At 11:17 PM -0700 10/23/97, semprini at theschool.com wrote:
>I don't think I'm out of line here in saying that all this spoofing of
>other users is a bit childish. I'm sure there are better
>things one could find to do with one's time. (Possibly work on
>cracking RSA's 128- bit key?)

I agree, but I think you'll soon see that any calls for the perpetrator(s)
to cool it will only increase his or her output.

Every year or so we've had some Source of Amusement (his amusement, if not
ours). Consult the archives for who the perpetrators were in past years.

Consult the extended headers on the spoofed messages for clues on who this
year's clown is. (Hint: Look for "Received: from wombat.sk.sympatico.ca" in
the extended headers. Connections to little dogs from Kansas, bad rock
bands from Africa, Jim Beam, Elvis's agent, and chainsaws are readily
apparent.)

There's something about the Cypherpunks list that causes some people to
decide it would be a kewl act of performance art to disrupt it, distract
it, stalk it, and mailbomb it.

And complaining never helps...it only stimulates their performance art juices.

There's a sociology thesis in this for someone.

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From suzy1 at aol.com  Fri Oct 24 16:53:55 1997
From: suzy1 at aol.com (suzy1 at aol.com)
Date: Fri, 24 Oct 1997 16:53:55 -0700 (PDT)
Subject: Have some fun
Message-ID: <68399340_89547999>



TEN MINUTES FREE!
Just for you if you're over 18.

Five minutes in our Private Show AND
five minutes in our Voyeur Show.  Try
it to see if you like it. Adults only!
We support the AOL Browser!

http://www.babequest.com

Signup for free and use your free time.





From lutz at taranis.iks-jena.de  Fri Oct 24 02:10:46 1997
From: lutz at taranis.iks-jena.de (Lutz Donnerhacke)
Date: Fri, 24 Oct 1997 17:10:46 +0800
Subject: PGP Employee on MKR
In-Reply-To: 
Message-ID: 



* Lucky Green wrote:
>corporate drones,  while Cypherpunks, the crypto elite, seems incapable of  
>reponding with anything other than to engage in frenzied mutual
>masturbation fueld by GAK fantasies.
>
>This is sad. Very sad.

Look at Open PGP and shut up.






From lutz at taranis.iks-jena.de  Fri Oct 24 02:14:25 1997
From: lutz at taranis.iks-jena.de (Lutz Donnerhacke)
Date: Fri, 24 Oct 1997 17:14:25 +0800
Subject: Elliptic Curve Cryptography
In-Reply-To: <19971024024428.13967.qmail@hotmail.com>
Message-ID: 



* Nobuki Nakatuji wrote:
>Is Elliptic Curve Cryptography a better encryption system than RSA ?

No, it's an other.






From zooko at xs4all.nl  Fri Oct 24 02:59:58 1997
From: zooko at xs4all.nl (Zooko Journeyman)
Date: Fri, 24 Oct 1997 17:59:58 +0800
Subject: spoofing as performance art
Message-ID: <199710240941.LAA00264@xs1.xs4all.nl>



Tim C. May allegedly typed something like:
>
> There's something about the Cypherpunks list that causes some people to
> decide it would be a kewl act of performance art to disrupt it, distract
> it, stalk it, and mailbomb it.
> 
> And complaining never helps...it only stimulates their performance art juices.


Hey, the jokes from Anonymous(ses) and Dmitri M. Vulis are the
only reason I _read_ cpunks anymore!  Oh yeah-- and that 
hilarious spoof about PGP, Inc. putting GAK-friendly features
into their product.  It's so funny that people fall for that
old "PGP is in with the government" gag every time it comes
around.


Also, I'm looking for a job, I think.  Or else a good 
university to go to.


But mostly I'm just reading the hilarious Anonymous posts and 
spoofs.


Regards,

Zooko






From lutz at taranis.iks-jena.de  Fri Oct 24 03:06:24 1997
From: lutz at taranis.iks-jena.de (Lutz Donnerhacke)
Date: Fri, 24 Oct 1997 18:06:24 +0800
Subject: Singaporean control freaks & CMR
In-Reply-To: 
Message-ID: 



* Anonymous wrote:
>Do you understand the difference between transit times of a fraction
>of a second and of days or weeks?  Does this suggest any differences in
>the need for recovery of encrypted data "in transit"?
>
>Not all communications are alike.  The longer data spends "in transit"
>the more need there is for recovery features.

Right. Communication is 'in transit' from MUA to MUA. Stored messages on
MTAs are in transit.






From mark at unicorn.com  Fri Oct 24 03:06:29 1997
From: mark at unicorn.com (mark at unicorn.com)
Date: Fri, 24 Oct 1997 18:06:29 +0800
Subject: PGP Employee on MKR
Message-ID: <877686661.25414.193.133.230.33@unicorn.com>



shamrock at cypherpunks.to wrote:

> I have watched this silly debate for some time now. PGP pulled an awsome
> hack on corporate America, bringing strong crypto to thousands of
> corporate drones,  while Cypherpunks, the crypto elite, seems incapable of  
> reponding with anything other than to engage in frenzied mutual
> masturbation fueld by GAK fantasies.
> 
> This is sad. Very sad.

Lucky, did you actually read anything I wrote, or is this merely another
knee-jerk response?

If you can explain the following, then I'll accept that my fears are merely
fantasies:

1. How PGP can prevent CMR being converted into GMR; their system builds
   all the code required to support mandatory encryption to FBI and NSA
   keys into every copy of PGP.
2. Why PGP prefer this option to almost identical systems which do not
   allow GMR. They don't even seem to be interested in discussing
   alternatives.

These are the important questions we should be asking and noone on the
pro-PGP side seems interested in answering them. Why?

Frankly, this issue seems to be the most important since Clipper, and I'm
amazed that so many cypherpunks are so dazzled by PGP's name that they
refuse to sit and think these issues through. 

    Mark






From ntiat at dev.null  Fri Oct 24 03:13:53 1997
From: ntiat at dev.null (Not That I'm A Troublemaker...)
Date: Fri, 24 Oct 1997 18:13:53 +0800
Subject: spoofing as performance art
In-Reply-To: <199710240941.LAA00264@xs1.xs4all.nl>
Message-ID: <34507278.7483@dev.null>



Zooko Journeyman wrote:
> 
> Tim C. May allegedly typed something like:
> >
> > There's something about the Cypherpunks list that causes some people to
> > decide it would be a kewl act of performance art to disrupt it, distract
> > it, stalk it, and mailbomb it.
> >
> > And complaining never helps...it only stimulates their performance art juices.
> 
> Hey, the jokes from Anonymous(ses) and Dmitri M. Vulis are the
> only reason I _read_ cpunks anymore!  Oh yeah-- and that
> hilarious spoof about PGP, Inc. putting GAK-friendly features
> into their product.  It's so funny that people fall for that
> old "PGP is in with the government" gag every time it comes
> around.

Yeah! It was a master stroke for PGP to redo their homepage to
reflect the addition of the PGP 5.5 Corporate Fascism product.
I bet they fooled a lot of people...yuk, yuk.

> Also, I'm looking for a job, I think.  Or else a good
> university to go to.
> 
> But mostly I'm just reading the hilarious Anonymous posts and
> spoofs.

Me too. I think those assholes spamming the list with all of those
crypto discussions should be forcefully unsubscribed.

Not That I'm A Troublemaker...

S A N D Y
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






From bubba at dev.null  Fri Oct 24 03:16:30 1997
From: bubba at dev.null (Bubba Rom Dos)
Date: Fri, 24 Oct 1997 18:16:30 +0800
Subject: InfoWar Epilogue 6 / The Geigerburg Text
Message-ID: <345070E8.186B@dev.null>



----------------------------------------------------------------------------
----------------------------------------------------------------------------

                       The True Story of the InterNet
                                  Part III

                                   InfoWar

                  Final Frontier of the Digital Revolution

                     Behind the ElectroMagnetic Curtain

                        by TruthMonger 

Copyright 1997 Pearl Publishing
----------------------------------------------------------------------------
----------------------------------------------------------------------------

                          InfoWar Table of Contents

   * Epilogue
   * Bubba Rom Dos

----------------------------------------------------------------------------

                                  Epilogue
----------------------------------------------------------------------------

                              WORK AND NOT WORK

Looking back over the events of my life since I wrote Witness and the
experience of the Institute Summer School of 1962; it becomes more than ever
clear to me that our understanding of man turns upon the problem of Reality.
If the aim of existence is Self-Realization and if this is identical with
God-Realization, then the connecting link that makes them one and the same
is to be found in the meaning of the word 'Reality'. If all were equally
real, then realization means the process of transformation that leads from
the unreality or imperfect reality towards Reality in the fullest sense.

The theme of this book is that there are both degrees and distinctive modes
of Reality, and that there is a process that leads from the Unreal to the
Real. This, in its turn, requires that there should be a means of effecting
the transformation. This 'means' is what we call by the name of WORK. In the
book there are few references to Work, either in the absolute sense as the
process of universal realization, or in the relative sense of personal
transformation. This is because those who participated in the discussions
started from the premise that Work is a reality in both senses: absolute and
relative. We were not concerned to discuss the authenticity of the process
of transformation, but to understand it better.

The obligation to work for Reality is the Categorical Imperative from which
life derives its meaning. It is, as Kant showed in the Grundlage, the
ultimate, irreducible, moral certainty from which are derived our notions of
God, Immortality and Ethic. I have never been satisfied, nor I believe was
Kant himself, with the Critique of Practical Reason. It does not convey the
sense of urgency which we experience in contemplating life based on Work and
life without Work.

I was impelled to write this Epilogue by the impact of a vision or vivid
dream that woke me from sleep a few nights ago.

I found myself in some remote, antipodean place where people were living
ordinary lives. I recognized not a few of them as people I knew or had read
about and noticed with a sense of wonder rather than surprise that some were
still living and others were dead. They did not notice this difference
because in any case they were all ghosts. But they were all aware of being
ghosts and wanted to turn into real people. From time to time, an aeroplane
arrived with others who joined them and among the new arrivals were both
living ghosts and dead ghosts. I was made aware that all was well with these
people because eventually they would cease to be ghosts.

Then I found myself back again nearer home; but this time I was taken to
some kind of underground place. Here also were people more or less happily
occupied with their daily lives and some of them were now living and others
were dead. These also were ghosts but these ghosts were neither able to
distinguish between life and death, nor did they understand that they were
no more than ghosts.

I knew that I must tell them about their condition and about the other place
where ghosts were being transformed into real beings. When I spoke to them
of aeroplanes that could take them over, they said that they would go only
if an aeroplane would come back and assure them that there was a place for
them over there.

I remember very clearly explaining that once an aeroplane had gone over, it
would never return. This seemed to them illogical and unreasonable and they
took no more notice of what I said.

Then I found myself in a kind of lift being taken back to the surface. I
looked at the lift-man and said to myself, "If I were not colour blind I
should see that his face is grey". Somehow, this observation brought home to
me the terror of being a ghost and immense pity filled me for these people
who had lost the possibility of becoming real.

As I began to wake up, I said to myself: "What does it really matter that
they are only ghosts? They are good, decent people, living good, decent
lives and if they are satisfied with unreality why should they be disturbed?
Their ghostly existence is also necessary."

At that moment I awakened completely and saw, in a flash, the infinite
significance of Work. It is the imperative of all imperatives, the source
from which all life takes its meaning, the way to Reality and even Reality
itself. Work takes many forms: but all forms have one common character: the
Will to Reality. Whether active or passive, whether in solitude or in
society, work is always one and the same: it is the dedication of the will
to the realization of Reality. This dedication carries with it the
obligation to share understanding with others and to serve the Work in its
universal significance. That is why those who have seen the difference
between ghost-life and real-life are compelled to speak of what they have
seen-even to those who do not wish to hear.

I am more than ever aware of the imperfections and even the errors in what I
have written. I am ashamed to offer it as a "Spiritual Psychology" to those
who are seeking for the Reality that is Work. Let it be taken as an essay
and an attempt to share an understanding that is still in the process of
being born.

J.G. Bennett.
January, 1964.

{Excerpt from "A Spiritual Psychology" by J.G. Bennett}
----------------------------------------------------------------------------
----------------------------------------------------------------------------

                                Bubba Rom Dos

        "He who shits on the road, will meet flies upon his return."

What is InfoWar?

InfoWar is the voice that tells you that you can shit on the road, and not
meet flies upon your return, if you spray the area with Agent Orange.
InfoWar is the voice that tells you that you can spray the area with Agent
Orange and not suffer any consequences to your own health, because you don't
live here.
InfoWar is the voice that tells you the people who do live here are
Communists who need to be killed, with the help of Agent Orange, and people
who need to be saved from both the Communists and the flies, with the help
of Agent Orange.

InfoWar is when the evening movie at the PX is 'Clockwork Orange' and your
head starts pounding, as a ferocious battle begins between your awakened
prenascence and the thundering voice which is screaming, "It is not
synchronicity�it is only a coincidence."

InfoWar is when you can look at a picture of a napalm-burned child and tell
by the color of their skin whether or not they are the enemy.

I am not arguing for or against this or that battle, this or that war. I am
only pointing out that anyone who returns from war the same as when they
left for war, or with their sanity completely intact, in need of no healing�
Well, let me just say that they already live in a Virtual Reality within
which the inhabitants of that reality do not realize that they are ghosts.
----------------------------------------------------------------------------

InfoWar is when you don't turn on the gas�you only put them in the ovens.
InfoWar is when you don't put them in the ovens�you only turn on the gas.

InfoWar is when you don't drop the atomic bomb, you only design it.
InfoWar is when you have two types of nuclear bombs and you convince
yourself that they both need to be dropped, not for testing purposes, but to
end the war earlier, and to save lives.
InfoWar is going to sleep praying that your Generals and Nuclear Physicists
don't wake you in the morning to tell you that they have developed a third
type of nuclear bomb, which must be dropped in order to shorten the war and
save lives�or a fourth, or a fifth.

InfoWar is convincing you to develop nuclear software without a backdoor
that you can use to prevent it from raining destruction on the innocent,
because you are just a programmer, an engineer, a designer, a grunt, and
these types of decisions are to be made by those who are trained to know
when it is right for millions upon millions of people to die, and for the
earth to be scorched beyond repair.

InfoWar is convincing you to design surveillance software without a
mechanism available to defeat it if it falls into the hands of the
Destroyer.
InfoWar is thinking that you are an island, and that your island only
produces the tools and weapons that can be used for great Good or great
Evil-thinking that those on other islands bear the responsibility for how
those tools and weapons are used.
----------------------------------------------------------------------------

"If ye love wealth greater than liberty, the tranquillity of servitude
greater than the animating contest for freedom, go home from us in peace.
We seek not your counsel, nor your arms. Crouch down and lick the hand that
feeds you. May your chains set lightly upon you; and may posterity forget
that ye were our countrymen." -- Samuel Adams
----------------------------------------------------------------------------

Y2K not a 'bug'-it is not a 'design flaw.' It is a collaboration, in
preparation for�

Apple has not collapsed 'in spite of' being Y2K compliant, but 'because' of
it.

The Congressional IRS investigation is taking place despite the fact that
the agency is not doing anything that it hasn't been doing for years and
years.
When heads roll (out), new heads roll in.

The Secret Lab Players are being given leading stage roles, in positions
such as at the FBI Crime Lab, in preparation for�

What was CAMP (Campaign Against Marihuana Production) all about?
It was a male bonding ritual between the Federal, State, regional and local
law enforcement agencies.
It was laying the groundwork to shipping tens of thousands of federal
assault rifles to local and regional LEA's in preparation for�

Full featured scaleable Telemetry systems for power reticulation control
and a host of other applications. Exciting innovations in Telemetry
Systems. Designed and manufactured to your exact needs.
http://www.tora.net/telemetry/telemetry.html, 1873 bytes, 11Aug97

"The average person's views of love are no longer based upon their
relationship with each other, but upon what they see on TV."
- President of Video Valentine

"That site contains no graphics, no photos, no video clips, no audio. Just
text. Deal with it."
-News of the Weird

"The '[ANY]' program cannot be 'fixed,' because it's working precisely as
the politicians want it to."
-Vin Suprynowicz 
Assistant Editorial Page Editor of the Las Vegas Review-Journal
----------------------------------------------------------------------------

Subject: Check the Archives
From: Ayn Rand 
To: Tim May 

Tim May wrote:
>There's something wrong when I'm a felon under an increasing number of
laws.

Atlas Shrugged wrote:
>"You'd better get it straight that it's not a bunch of boy scouts you're
>up against -- then you'll know that this is not the age for beautiful
>gestures. We're after power and we mean it. Your fellows were pikers,
>but we know the real trick, and you'd better get wise to it. There's no
>way to rule innocent men. The only power any government has is the power
>to crack down on criminals. Well, when there aren't enough criminals,
>one makes them. Once declares so many things to be a crime that it
>becomes impossible for men to live without breaking laws. Who wants a
>nation of law-abiding citizens? What's there in that for anyone? But
>just pass the kind of laws that can neither be observed nor enforced nor
>objectively interpreted -- and you create a nation of law-breakers---and
>then you cash in on guilt. Now that's the system...that's the game, and
>once you understand it, you'll be easier to deal with."
----------------------------------------------------------------------------

Everything since the Big Bang has been plagiarism.

Will the future plagiarize Hitler or Ghandi?

One Free Will, one vote�
----------------------------------------------------------------------------

                        "The Xenix Chainsaw Massacre"

                 "WebWorld & the Mythical Circle of Eunuchs"

           "InfoWar (Part III of 'The True Story of the InterNet')

                Soviet Union Sickle of Eunuchs Secret WebSite
----------------------------------------------------------------------------







From bubba at dev.null  Fri Oct 24 03:21:04 1997
From: bubba at dev.null (Bubba Rom Dos)
Date: Fri, 24 Oct 1997 18:21:04 +0800
Subject: InfoWar Epilogue 6 (Part III of 'The True Story of the InterNet')
Message-ID: <34507062.F5B@dev.null>

A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 11800 bytes
Desc: not available
URL: 

From whgiii at invweb.net  Fri Oct 24 03:31:36 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Fri, 24 Oct 1997 18:31:36 +0800
Subject: [RANT] Why America Can't Compete
In-Reply-To: <199710231711.MAA05853@wire.insync.net>
Message-ID: <199710241022.GAA04419@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <199710231711.MAA05853 at wire.insync.net>, on 10/23/97 
   at 12:11 PM, Eric Cordian  said:

>I've just uncovered a massive plot to destroy our nation's
>competitiveness and inculcate its young people in the
>collectivist mentality.
> 
>The tool?  Youth sports!
> 
>This morning's AP wire reports that two football coaches are suing a
>youth football league after being banned for life because their 11 and 12
>year old players won by too large a point spread.
> 
>Apparently, and I find this truly shocking, it is a common
>practice in youth sports today to have a rule limiting the number of
>points by which a game may be won, with horrendous sanctions for
>violating it.  Winning by more than that, it is argued, is "demoralizing"
>to the other team, and (Gasp!) UNETHICAL!
> 
>Once the designated point spread is reached, coaches must order their
>players to deliberately lose, play badly, and act retarded.
> 
>I became aware of this idiotic practice after I mentioned the AP article
>to several people, and rather than throwing up their arms in horror, they
>volunteered that their own local teams had such rules as well.
> 
>It's time to check closely, to make sure such shenanigans are not afoot
>in your town, polluting the entrepreneurial spirit of your very own
>children.
> 
>Imagine if Ross Perot had played on such a team, or Bill Gates, or Adolf
>Hitler?  The entire course of history might have been changed.

This is nothing new. It the same old socialist philosphy of "equality of
outcome". You see it everywhere in the country from Wefair, SS, EEO,
outcome based education, ... It is a discusting philosphy that rewards
incompentance and punishes achevment, the ultimate in "politics of envy".

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------



-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFB3eo9Co1n+aLhhAQGoYgQAh21o1T1mG1u9F+vD8EZ2DYyj2op1qi7T
bj8yTbrd1QO4c0uo6FvfaNTbsErhkNnGCMUmUtTA3g1HqxbfCkCvwrKnX/Wtq1O2
VX2ua/DkPNmZ7OY0nY9BogWFRQBte5oPV1QLk+teyQN3crfdKatJ5VjGgADheoXN
3qfp5hs4fqY=
=8oCL
-----END PGP SIGNATURE-----






From vipul at best.com  Fri Oct 24 03:48:55 1997
From: vipul at best.com (Vipul Ved Prakash)
Date: Fri, 24 Oct 1997 18:48:55 +0800
Subject: [news] Pentagon computers broken into over 250 times
Message-ID: <199710241551.PAA00349@fountainhead.net>



*** Pentagon computers broken into over 250 times

More than 250 U.S. Defense Department computer systems were broken
into last year and the number of attempted break-ins was projected to
double this year, a U.S. intelligence official said. The comments
that Air Force Lt. Gen. Kenneth Minihan, director of the National
Security Agency (NSA), made Saturday at an intelligence convention
were released Thursday. Urging stepped-up awareness of cyber security
issues, Minihan said the United States built its information
infrastructure on a "poor foundation -- and we will eventually pay
for it." See http://www.infobeat.com/stories/cgi/story.cgi?id=5585016-7b1                   

-- 
Powell lingered. "How's Earth?" 
It was a conventional enough question and Muller gave the 
conventional answer, "Still spinning."
				      -- "Reason", Asimov. 
==================================================================
Vipul Ved Prakash                 | - Electronic Security & Crypto 
vipul at best.com 	                  | - Web Objects 
91 11 2233328                     | - PERL Development 
198 Madhuban IP Extension         | - Linux & Open Systems 
Delhi, INDIA 110 092              | - Networked Virtual Spaces






From jya at pipeline.com  Fri Oct 24 03:56:49 1997
From: jya at pipeline.com (John Young)
Date: Fri, 24 Oct 1997 18:56:49 +0800
Subject: spoofing as performance art
Message-ID: <1.5.4.32.19971024103715.00b404f8@pop.pipeline.com>



Indeed, it is hard to tell the difference between spoofing and
grave pronouncements on threats to one's own interests under
guise of national secuirty and/or personal privacy, for the truthful 
lying that accompanies each performance are identical.

Spoofing has the ethical and humorous edge, however, in that 
it gives clues to its origin as entertainment -- let's us in on the
joke -- while the seriously dramatic performer aims at dominating 
us with profundity, wisdom, righteousness, conviction and disdain
for disbelievers in the blind faith of the performer in the importance of
her responsibility to hector and lecture us into craven servility.

All leaders suffer over self-importance and thereby demand
ridicule to save us from them.

Here's a Bronx cheer to the non-spoofers, who don't get that the
joke's on them.

Thank Zeus and Juno, as far as I've read here, cypherpunks
has no implacably non-spoofers posting, though a few of us are 
pretty good at behaving seriously briefly, spoofing seriousness. 

And PGP is doing a fine sanctimonious act worthy of high ridicule, 
it's just conforming to what businesses and governments do to 
survive the disloyalty of employees and citizens who don't believe 
once-trusted leaders inevitably corrupted by power, fame and chance
to forever escape work (corrupt me, do). They become parodies 
of themselves.

Anonymous got it right: Bosses and Government, no difference,
same liars and snoopers and non-spoofers who just don't get 
what's wrong with putting their interests before ours, we gobbling
voracious maggots.







From ulf at fitug.de  Fri Oct 24 04:30:57 1997
From: ulf at fitug.de (Ulf =?iso-8859-1?Q?M=F6ller?=)
Date: Fri, 24 Oct 1997 19:30:57 +0800
Subject: Please send me some info
In-Reply-To: <19971024102659.5169.qmail@hotmail.com>
Message-ID: <9710241117.AA66926@public.uni-hamburg.de>



> 
> I am a student of the University of New South Wales in Australia, as I 
> am going to do a research about my informayion system assignment, I am 
> mailing to request for some information.  My assignment is regarding to 
> the current examples of "use of computers to commit fraud

http://www.digicrime.com

> use of computer to commit sabotage

http://www.sabotage.org

false advertising/ claims for computer products

http://www.iemmc.org

> degradation of work as a result of computerisation; failures 
> in computerising the workplace"

http://www.microsoft.com

HTH.
 um






From simpsonngan at hotmail.com  Fri Oct 24 04:54:54 1997
From: simpsonngan at hotmail.com (Chiu Ngan)
Date: Fri, 24 Oct 1997 19:54:54 +0800
Subject: Please send me some info
Message-ID: <19971024102659.5169.qmail@hotmail.com>



I am a student of the University of New South Wales in Australia, as I 
am going to do a research about my informayion system assignment, I am 
mailing to request for some information.  My assignment is regarding to 
the current examples of "use of computers to commit fraud; use of 
computer to commit sabotage; false advertising/ claims for computer 
products; degradation of work as a result of computerisation; failures 
in computerising the workplace"

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com






From mark at unicorn.com  Fri Oct 24 04:55:36 1997
From: mark at unicorn.com (mark at unicorn.com)
Date: Fri, 24 Oct 1997 19:55:36 +0800
Subject: PGP Employee on MKR
Message-ID: <877689108.28637.193.133.230.33@unicorn.com>



>Mark, just remove the self signature on the user key. The message
>recovery key packet goes away! That's all you have to do. Is that
>so tough? This big threat, the dangerous CMR key, turns out to take
>two seconds of user actions to be destroyed. Something this easy to
>turn off will never be good enough for GAK.

Gosh, so I can just remove that packet and all my mail will bounce. What
fun. This seems to be one of the mantras which pro-PGP folks are chanting: 
'But there are easy ways to work around it, just modify your copy of PGP
and it will all work fine'. Indeed there are; I have no doubt that there
is no way that anyone could entirely prevent me from communicating privately
with a few people. But what happens when I want to check whether the local
Blockbuster have a copy of 'Debbie does Fort Meade'; will they have modified
their software so I can send mail to them without GMR? Of course not. So
99.9% of my mail will still be visible to the government.

>People say, "Oh, but then the government will make everybody run the
>policy enforcer and reject any mail not encryped to the government."
>First, if they were going to do this, they could do it with old versions
>of PGP too. Multiple recipients have been around practically forever.

*IT'S NOT THE MULTIPLE RECIPIENTS THAT ARE THE PROBLEM, IT'S BUILDING THE
'MANDATORY VOLUNTARY' MULTIPLE ENCRYPTION INTO EVERY COPY OF PGP WHICH IS
THE PROBLEM* This is the other mantra that PGP supporters chant 'Oh, but
it could all be done with PGP 2.6.2 and a few scripts'. Of course it could,
but only a few people would choose to use those filters. If the government
were to set up SMTP enforcers in various choke-points around the Net (and
I'm aware of the performance issues) then anyone using PGP would have to
encrypt to the 'voluntary' FBI key or lose their mail. The Feds aren't
going to issue every PGP user with scripts to do it, but if you build this
facility into the software they can use it.

>Second, it's a ridiculous idea which ignores how email works. More and
>more people are running systems at home which could send and receive
>SMTP mail. The trend is towards home servers which support the multiple
>home computers people will have in the next decade. There's no way to
>make those people run filters!

Duh, of course they won't. But that email will go out over a TCP link to
the SMTP port, where it can be checked on route by sniffers or proxies.
How did the Chinese and Singaporeans restrict Net access? By blocking
connections in the routers and Web proxies. This is the way to do it, not
to force everyone to run an SMTP enforcer on their personal machine. 

>It has to be suggested, because it's the only
>way this incredibly stupid scenario could be made to work. I can only
>assume that people are blinded by emotions or they wouldn't suggest such
>a bizarre idea.

Yes, I must be, mustn't I. I mean, the Feds would never pass a law 
mandating that all Internet providers must provide SMTP proxies which 
enforce the GMR and block other SMTP connections; after all, they never 
passed a law mandating that telephone companies must provide wiretap
access. Oh, they did, didn't they?

>If the only
>way the government can enforce GAK is by making it illegal for people to
>receive email through paths which don't pass through government filters
>we can all rest easy, because it will never happen.

Yes, which is why they won't do it that way. In my last job, any SMTP
access from my machine to any other on the Net was automatically routed
to our local SMTP server which acted as a proxy. Why can't the Feds do
this on the US Internet?

>Or superencrypt to the real end user, like you suggested in your scheme.
>Why is this OK as a privacy workaround for your idea but it doesn't
>count for PGP?

Firstly, that's not a "privacy workaround" in my system, it's to prevent
traffic analysis. Secondly, again it's a workaround which will only be
available to a small number of people. 

>Ignoring all the considerations above about what a stupid idea this is,
>the fact is that a simple filter like this is incredibly easy to write.

As I said before, the SMTP filter is not the evil aspect of your design,
it's the enforced encryption to multiple recipients.
 
>The fact is, nobody has come up with a scenario where PGP's CMR feature
>can be turned into GAK in any practical way. 

I just have. Now try to explain it away.

   Mark






From whgiii at invweb.net  Fri Oct 24 05:08:31 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Fri, 24 Oct 1997 20:08:31 +0800
Subject: PGP Employee on MKR
In-Reply-To: <877686661.25414.193.133.230.33@unicorn.com>
Message-ID: <199710241155.HAA05345@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <877686661.25414.193.133.230.33 at unicorn.com>, on 10/24/97 
   at 02:51 AM, mark at unicorn.com said:

>shamrock at cypherpunks.to wrote:

>> I have watched this silly debate for some time now. PGP pulled an awsome
>> hack on corporate America, bringing strong crypto to thousands of
>> corporate drones,  while Cypherpunks, the crypto elite, seems incapable of  
>> reponding with anything other than to engage in frenzied mutual
>> masturbation fueld by GAK fantasies.
>> 
>> This is sad. Very sad.

>Lucky, did you actually read anything I wrote, or is this merely another
>knee-jerk response?

>If you can explain the following, then I'll accept that my fears are
>merely fantasies:

>1. How PGP can prevent CMR being converted into GMR; their system builds
>   all the code required to support mandatory encryption to FBI and NSA
>   keys into every copy of PGP.

No their system does not. For what the FBI and NSA want much more needs to
be done. Not to mention that *ANY* crypto system can be turned into GAK if
the FBI & NSA get congress to pass the laws that they want.

>2. Why PGP prefer this option to almost identical systems which do not
>   allow GMR. They don't even seem to be interested in discussing
>   alternatives.

What PGP Inc. did was provide what their *customers* , you know the ones
that pay their bills and keep them in business, wanted in a timely fashion
with little modification to their current code while circumventing some of
the more draconian requests.

>These are the important questions we should be asking and noone on the
>pro-PGP side seems interested in answering them. Why?

They have been answered time and time again, you just have not been
interested in listening.

>Frankly, this issue seems to be the most important since Clipper, and I'm
>amazed that so many cypherpunks are so dazzled by PGP's name that they
>refuse to sit and think these issues through. 

If this is such a life and death issue why don't you and some of the other
Cypherpunks Philosopher Kings get off your armchair quarterbacking write,
test, debug, and *market* your superior system?? Then we can all dance and
sing the praises of CP Inc. and what a wonderful thing that they have
done?? No? Perhaps because the majority of the "PGP Inc is evil" crowd
here couldn't make a buck in the business world if their lives depended on
it.

I also find it interesting how there is "much weeping gnashing of teeth"
over PGP 5.5 , which does nothing that couldn't be done with 2.6, while
Netscape, RSA and the S/MIME crowd put weak crypto on every desktop??
Where is the Righteous Indignation?? Where are the cries to burn RSA and
Netscape on the stake?? I think sticking the "unwashed masses" with 40bit
RC2 a more serious and pressing issue than anything going on with PGP 5.5.
Of course the Philosopher Kings are too busy in their PGP feeding frenzy
to notice such thing.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFCNV49Co1n+aLhhAQGtUgP+PejRkW8vx0xTN/QTBLnakHZW6aeuIyH8
Rpsw0yckaZbOyHJnGlXxSCxZrBNM1Aiu0SMdgMmu4X9VBTbZgkJwTJaEpik4jCPa
9nLMLl8OCQMWNtaVN7xJfjyY42TJSjxzXp+eGLPCtOhvcxnu0+CJEu7nZM9jId3j
uxPkXfwtNrU=
=7Le9
-----END PGP SIGNATURE-----






From cableus at internetmedia.com  Fri Oct 24 20:11:01 1997
From: cableus at internetmedia.com (CableUs)
Date: Fri, 24 Oct 1997 20:11:01 -0700 (PDT)
Subject: Save Money...Own your own Cable Descrambler!
Message-ID: 


Don't let your cable company force you to pay OUTRAGEOUS
equipment costs to receive basic/premium channels.
We are Midwest Electronics, Inc. America's LARGEST
PROVIDER of cable converters and descramblers and
we feel you shouldn't have to pay TOO MUCH any
more!

The Communications Act of 1996 approved by Congress and
signed by President Clinton in February 1996 now allows
cable subscribers to purchase cable converters and
descramblers from independent vendors.

We have 18 years experience in the cable industry.
We carry most makes and models of cable converters
and descramblers including Jerrold, Scientific Atlanta,
Tocom, Zenith, Pioneer, Panasonic, Novavision and More.
Our prices start at just $150.00.

*** SPECIAL INTERNET OFFER ***

Call us today at (800) 648-3030 M-F 8:00-5:00 C.S.T.
with the model number of your cable company's
converter/descrambler, usually found on top of your
television, and receive a FREE Battery Charger with any
combination unit purchase.

*** ONLY THOSE NOTIFIED BY ELECTRONIC MAIL ARE ELIGIBLE ***

Our SPECIAL Internet Promotion ends November 15, 1997.
When calling please provide us with your e-mail
address in order to receive your FREE BATTERY CHARGER!!!

If are unable to take advantage of our offer at this
time, but would like to receive our FREE CATALOG  reply
to us via e-mail at cableus at internetmedia.com with your
mailing name or visit our WEBSITE at:

http://www.midwestcable.com

http://www.midwestcable.com

More about us:

* 30-Day Money Back Guarantee!
* We Service What We Sell!
* Personal Assistance Hotline!

Note: No sales to TIME-WARNER or PARAGON cable franchise areas.

-------------------------------------------------------------------------
If you would like to continue receiving updates on prices and other 
information from Midwest Electronics you may REPLY and type SUBSCRIBE 
in the SUBJECT line (Please be sure to include name, address and phone 
for your FREE CATALOG!).  Otherwise, your address will be promptly removed 
from our lists and no further attempts will be made to contact you.
-------------------------------------------------------------------------





From whgiii at invweb.net  Fri Oct 24 05:31:43 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Fri, 24 Oct 1997 20:31:43 +0800
Subject: CMR versus GAK?
In-Reply-To: <199710240110.UAA09551@dfw-ix3.ix.netcom.com>
Message-ID: <199710241222.IAA05621@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <199710240110.UAA09551 at dfw-ix3.ix.netcom.com>, on 10/23/97 
   at 06:05 AM, nobody at neva.org (Neva Remailer) said:


>"Big Brother or the Boss?"


>Are you SURE that's a dichotomy?

>Big Biz and Big Gov are almost inextricably intertwined these days.  If
>dot-com pushes for snoopware, it is called CMR.  If dot-gov pushes for
>it, it is called GAK.  The real question is, if the interests of Biz and
>Gov coincide, and "real cooperation" is achieved, does it really matter
>where the idea originated?  Either way you still have snoopware.

Well their are some basics that seem to get overlooked:

Corporate Access to Plain Text (CAPT)
- ------------------------------

- -- You work for the company
- -- Any documents you create on company time are owned by the company --
The company uses PGP 5.5 to ensure they can decrypt *their* documents --
You know which documents they have access to
- -- CAPT is flexable and can be adjusted to fit the security needs
   of the company.


Government Access to Keys (GAK)
- -------------------------------

- -- The governemnt works for you (at least in theory)
- -- Any document you create are your own.
- -- The govenrment want your keys so they can read *your* documents -- The
government wants access to ALL your documents
- -- There is no fleaxbility in GAK they want it all


There is a clear distinction here between one haveing the ability to
decrypt their own documents and a non-owner decrypting someone elses
documents. This is the distinction between corporate access to plain text
and GAK. The company *owns* the documents. They have a right to read them
any time they want. If you don't want your *private* corrospondance to be
read by others in the company then don't write them and transmit them at
work. 

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFCTn49Co1n+aLhhAQFcBAP9EY+myW2V+/OtXvr8mxbFuoQtIY2LIBbV
gaSSUzkKdSX79t+kcXnyyyADqoHwA1FPrcfA+92l+1IgXq243tT+lwDY3G3cCU/S
X6RBU0UbO9MUvc29LYcncr/nD30AoeN34qWMd3Pu6cwtgd3s7xZu0rdEQSww8nll
SNAKogoJS9c=
=e42J
-----END PGP SIGNATURE-----






From ravage at ssz.com  Fri Oct 24 05:54:05 1997
From: ravage at ssz.com (Jim Choate)
Date: Fri, 24 Oct 1997 20:54:05 +0800
Subject: ADMIN: lost messages (fwd)
Message-ID: <199710241312.IAA23154@einstein.ssz.com>



Forwarded message:

> From: "Attila T. Hun" 
> Date: Fri, 24 Oct 97 04:43:22 +0000
> Subject: Re: ADMIN: lost messages

>     Jim Choate  was purported to have 
>     expostulated to perpetuate an opinion:

> a:> Any clues?
> 
> a:Things get lost on occassion?

>     pure bullshit and ego gratification.

[much deleted]

Put up or shut up junior.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From ravage at ssz.com  Fri Oct 24 06:00:19 1997
From: ravage at ssz.com (Jim Choate)
Date: Fri, 24 Oct 1997 21:00:19 +0800
Subject: update.342 (fwd) [AIP]
Message-ID: <199710241319.IAA23249@einstein.ssz.com>



Forwarded message:

> Date: Wed, 22 Oct 97 10:14:42 EDT
> From: physnews at aip.org (AIP listserver)
> Subject: update.342
> 
> PHYSICS NEWS UPDATE                         
> The American Institute of Physics Bulletin of Physics News
> Number 342  October 22, 1997   by Phillip F. Schewe and Ben
> Stein
> 
> ONE OF THE MOST CONVECTIVE FLUIDS EVER
> OBSERVED IN THE LABORATORY has been created by

[body deleted]

> HIGH-PRECISION COSMOLOGY

[body deleted]

> SEVEN YEARS OF PHYSICS---the entire run of Physics News
> Updates---is now available in searchable form on the AIP Website
> at this address: www.aip.org/physnews/update.  Just type in a term
> or expression and up come references to items in past Updates.  For
> example: searching for "leptoquark" hauls up 2 items; "steven chu"
> finds 3 hits; "DNA" results in 13. All past Updates can be viewed
> by going to the archives.  See also Physics News Graphics
> (www.aip.org/physnews/graphics), our growing archive of physics
> figures, most of which accompany Update items. Subscription
> reminder: to add or delete your name from the distribution list,
> follow these steps---send a message to listserv at aip.org, leave the
> "subject" blank, and in the letter itself specify  either the expression 
> add physnews or delete physnews.
> 






From lutz at taranis.iks-jena.de  Fri Oct 24 06:12:48 1997
From: lutz at taranis.iks-jena.de (Lutz Donnerhacke)
Date: Fri, 24 Oct 1997 21:12:48 +0800
Subject: CMR versus GAK?
In-Reply-To: <199710241222.IAA05621@users.invweb.net>
Message-ID: 



* William H. Geiger III wrote:
>documents. This is the distinction between corporate access to plain text
>and GAK. The company *owns* the documents. They have a right to read them
>any time they want. If you don't want your *private* corrospondance to be

The company *owns* all telephon calls mad from an to there office. So they
have a right to wiretrap and record all phone calls you does from the
company. If you don't want your *private* corrospondance be wiretraped and
recorded, prevent every phone call in private issues from the company.
Forbit your insurance agency to call you in the company, deny the school
attended by your children to phone you at work, if your childen is ill, ...

Somebody should thing about storing and communication. Look in the current
draft. There is a solution.






From mark at unicorn.com  Fri Oct 24 06:25:52 1997
From: mark at unicorn.com (mark at unicorn.com)
Date: Fri, 24 Oct 1997 21:25:52 +0800
Subject: PGP Employee on MKR
Message-ID: <877698834.17691.193.133.230.33@unicorn.com>



whgiii at invweb.net wrote:

> No their system does not. For what the FBI and NSA want much more needs to
> be done.

Really? Read the message I sent after that one. Let's suppose it's 2007,
PGP have 99% of the crypto market. CMR compatibility is incorporated into 
all their products. 

The FBI announce that from today all Internet providers must support PGP
SMTP enforcers on all mail passing across their links, and block all other
SMTP connections. Regardless of whether your mail is spooled on your ISP's
hard disk, it will always pass through their link. All encrypted mail must
now be encrypted to the FBI's key as well as the end user's key or it will
bounce.

So, tell me why "much more needs to be done". Tell me again why this
can't be implemented. The only reason it *can* be implemented is that
PGP build the feature into their software.

> Not to mention that *ANY* crypto system can be turned into GAK if
> the FBI & NSA get congress to pass the laws that they want.

Yes, but PGP WANT TO BUILD THIS INTO EVERY SYSTEM THEY SELL!!!!! I don't
care that any Perl hacker can write a script which builds CMR into PGP
2.6.2, because those scripts are restricted to those who wish to use
them. PGP ARE BUILDING THE FUNCTIONALITY INTO EVERY PRODUCT THEY SELL!!!!

How hard is this to grasp?

> What PGP Inc. did was provide what their *customers* , you know the ones
> that pay their bills and keep them in business, wanted in a timely fashion
> with little modification to their current code while circumventing some of
> the more draconian requests.

Really? Did their customers ask specifically for PGP's flawed CMR
implementation, or did they actually say things like 'Well, we want to
be able to recover mail if someone dies or leaves the company'? If it's
the latter, don't you think that PGP should take responsibility for
implementing it in such a GAK-friendly way?

You seem be repeating the other pro-PGP mantra 'oh, you're not thinking
of the company's point of view'. I certainly am, which is why I want to
see that they get the best, most secure system without any GAK-friendly
features.

Here's a quick example of how cool CMR is... let's suppose that 
loser at foo-bah.com upsets a customer and is working for a CMR corporation.
Mr Irate Customer downloads some of that kiddie porn that we're told is
all over the Net, and encrypts it to loser at foo-bah.com, but doesn't
encrypt it to the company key. Mr Irate Customer mails hundreds of these
images to loser at foo-bah.com. Their system bounces them. The security
personnel at foo-bah.com notice all these bounces and snarf some of the
messages.

The security personell take these messages to Mr Loser, and force him to
decrypt them. Shock, horror, what a hideous, insane pervert Mr Loser must
be to be receiving all these messages. Mr Loser is handed over to the cops
and taken away. He might not go to jail, but he'll lose his job.

With a more rational implementation Mr Loser would receive the messages
and see that they're obscene, and immediately report them to the security
personnel who could track down the sender. But when the security personnel
find them first, they immediately assume that Mr Loser asked for them.

Now, if you want to be able to get people sacked, this is cool. If you
work for a company with CMR, this is really bad. It is also unneccesary.

> >These are the important questions we should be asking and noone on the
> >pro-PGP side seems interested in answering them. Why?
> 
> They have been answered time and time again, you just have not been
> interested in listening.

They have not. All we've heard are 'oh, don't worry, it can't happen,
be happy' assurances with no basis in fact. Is it any wonder we aren't
listening? 

> If this is such a life and death issue why don't you and some of the other
> Cypherpunks Philosopher Kings get off your armchair quarterbacking write,
> test, debug, and *market* your superior system??

Duh, because PGP has name recognition, and because by the time it was
finished they'd already have a large part of the market. But note: I'll
be very surprised if PGP CMR gets into the OpenPGP spec. Which means that
any other compliant implementation of PGP will not be compatible with
CMR. 

> Perhaps because the majority of the "PGP Inc is evil" crowd
> here couldn't make a buck in the business world if their lives depended on
> it.

Oh sure, ad hominem, ad hominem. What the hell do you think I do all
day? Why the hell do you think I'm spending so much time trying to show
people what CMR's problems are when I could be making money?

> I also find it interesting how there is "much weeping gnashing of teeth"
> over PGP 5.5 , which does nothing that couldn't be done with 2.6, while
> Netscape, RSA and the S/MIME crowd put weak crypto on every desktop??

Better weak crypto than GAK. Key-lengths can be increased, government
surveillance infrastructure cannot easily be removed.

    Mark






From whgiii at invweb.net  Fri Oct 24 06:32:24 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Fri, 24 Oct 1997 21:32:24 +0800
Subject: CMR versus GAK?
In-Reply-To: 
Message-ID: <199710241319.JAA06195@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In , on 10/24/97 
   at 01:01 PM, lutz at taranis.iks-jena.de (Lutz Donnerhacke) said:

>* William H. Geiger III wrote:
>>documents. This is the distinction between corporate access to plain text
>>and GAK. The company *owns* the documents. They have a right to read them
>>any time they want. If you don't want your *private* corrospondance to be

>The company *owns* all telephon calls mad from an to there office. So
>they have a right to wiretrap and record all phone calls you does from
>the company. If you don't want your *private* corrospondance be
>wiretraped and recorded, prevent every phone call in private issues from
>the company. Forbit your insurance agency to call you in the company,
>deny the school attended by your children to phone you at work, if your
>childen is ill, ...

Lutz,

I am not quite sure what your point is here. A company has every right to
listen in on any phone conversation you make on their phones. There is no
"expectation of privacy". Many companies have strict guidlines on how you
can use their phones, just try spending alot of time on a 900 number. As
far as emergancy calls, I know of no company that disalows them but don't
expect them to be private as they are not.

>Somebody should thing about storing and communication. Look in the
>current draft. There is a solution.

This is not and issue of storage & communication this is an issue of
property rights. The owner of the property is the one with the rights. :)

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFCg9Y9Co1n+aLhhAQHrOwP9GGJC3ULu6T2XCdcj09ynbhWBEMGIQsa2
Cnfj6kMW9bZmOJ78qyqC/CzomiPOUjMIpbBMPEuRHrAjhArr51lItbJwGMwqSgca
4PVid/L/BviFywVGjRA0auFPE1VsMVByDUow47NerV+yOy4rNp6Id7tEALY98J5j
L+hAmSnJGuk=
=cWDL
-----END PGP SIGNATURE-----






From ravage at ssz.com  Fri Oct 24 06:36:31 1997
From: ravage at ssz.com (Jim Choate)
Date: Fri, 24 Oct 1997 21:36:31 +0800
Subject: CMR versus GAK? (fwd) > Right to monitor
Message-ID: <199710241400.JAA23475@einstein.ssz.com>



Forwarded message:

> From: lutz at taranis.iks-jena.de (Lutz Donnerhacke)
> Subject: Re: CMR versus GAK?
> Date: 24 Oct 1997 13:01:12 GMT

> * William H. Geiger III wrote:
> >documents. This is the distinction between corporate access to plain text
> >and GAK. The company *owns* the documents. They have a right to read them
> >any time they want. If you don't want your *private* corrospondance to be
> 
> The company *owns* all telephon calls mad from an to there office. So they
> have a right to wiretrap and record all phone calls you does from the
> company. If you don't want your *private* corrospondance be wiretraped and
> recorded, prevent every phone call in private issues from the company.
> Forbit your insurance agency to call you in the company, deny the school
> attended by your children to phone you at work, if your childen is ill, ...

It occurs to me that this entire question is really of much larger social
import:

 -  do babysitters in your home have an inherent right to not be monitored
    in case they harm the child?

 -  do operators of vehicles on public roads have an inherent right to
    privacy about the vehicle?

 -  do businesses have the right to monitor the uses that their systems
    are put to?

 -  do public officials have an inherent right to privacy about their
    actions related to their office?

etc. ad nausium...

These various issues can be broken down into two simple questions that
once answered genericaly can be applied to the specific cases.

The bottem line is:

Does the owner of a resource have an inherent right to control that
resource and if so what are the boundaries?

Does the user of a resource have rights outside the purvue of the owner
of that resource and if so what are the boundaries?


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From lutz at taranis.iks-jena.de  Fri Oct 24 06:39:14 1997
From: lutz at taranis.iks-jena.de (Lutz Donnerhacke)
Date: Fri, 24 Oct 1997 21:39:14 +0800
Subject: CMR versus GAK?
In-Reply-To: <199710241319.JAA06195@users.invweb.net>
Message-ID: 



* William H. Geiger III wrote:
>I am not quite sure what your point is here. A company has every right to
>listen in on any phone conversation you make on their phones. There is no
>"expectation of privacy". Many companies have strict guidlines on how you

May be in your (poor) country. There is a world outside US.






From ravage at ssz.com  Fri Oct 24 06:56:55 1997
From: ravage at ssz.com (Jim Choate)
Date: Fri, 24 Oct 1997 21:56:55 +0800
Subject: Internet Child Pornographers Convicted [CNN]
Message-ID: <199710241317.IAA23212@einstein.ssz.com>



Forwarded message:

>    CNN logo 
>    Navigation 
>    
>    Infoseek/Big Yellow 
>    
>    
>    Pathfinder/Warner Bros 
>    
>    
>    
>    
>    Main banner AST. Working For Your Business. rule
>    
>                INTERNET CHILD PORNOGRAPHERS GET LONG JAIL TERMS
>                                        
>      October 23, 1997
>      Web posted at: 3:24 p.m. EDT (1924 GMT)
>      
>      SAN JOSE, California (Reuters) -- Three members of an international
>      child pornography ring that used the Internet to transmit pictures
>      of children were sentenced to jail.
>      
>      The men were jailed for their part in a wide-ranging, Internet-based
>      conspiracy in which several children, aged 10 or younger, were used
>      in sexually explicit acts to produce pornographic pictures and
>      videotapes, the U.S. Attorney's office said.
>      
>      U.S. District Judge James Ware on Wednesday sentenced the three
>      members of the "Orchid Club" in a San Jose courtroom after a long
>      hearing that included poignant personal statements by the victims.
>      
>      The U.S. Attorney's office in San Jose said Ronald Riva, 38, of
>      Greenfield, California, was sentenced to 30 years in prison; David
>      Tank, 35, of Cheney, Washington, to 19 years and 7 months; and
>      Christopher Saemisch, 38, of Lawrence, Kansas, to 11 years.
>      
>      Copyright 1997 Reuters Limited. All rights reserved.
>      
>     
>    rule
>    
>   Related stories:
>      * Officials focus on Internet use in sex crimes - October 8, 1997
>      * FBI: Internet pedophiles a growing threat - April 8, 1997
>      * FBI cracks down on child pornography on the Internet - April 7,
>        1997
>      * 12 arrested in computer pornography sweep - September 14, 1995
>        
>   Related sites:
>   
>      Note: Pages will open in a new browser window
>      * Crime on the Superhighway
>      * Child Safety on the Information Highway
>        
>      
>      
>      External sites are not endorsed by CNN Interactive.
>      
>    
>      _________________________________________________________________
>    
>    Infoseek search ____________________ ____  ____
>    
>      _________________________________________________________________
>    
>    
>    rule Message Boards Sound off on our
>    message boards
>    
>    You said it... [INLINE] AST. Working For Your Business. rule
>    To the top 
>    
>    � 1997 Cable News Network, Inc.
>    All Rights Reserved.
>    
>         Terms under which this service is provided to you.
> 






From lutz at taranis.iks-jena.de  Fri Oct 24 07:08:11 1997
From: lutz at taranis.iks-jena.de (Lutz Donnerhacke)
Date: Fri, 24 Oct 1997 22:08:11 +0800
Subject: CMR versus GAK? (fwd) > Right to monitor
In-Reply-To: <199710241400.JAA23475@einstein.ssz.com>
Message-ID: 



* Jim Choate wrote:
> -  do babysitters in your home have an inherent right to not be monitored
>    in case they harm the child?

No. Not here.

> -  do operators of vehicles on public roads have an inherent right to
>    privacy about the vehicle?

Yes. Nobody but the policy can stop them and have a deeper look.

> -  do businesses have the right to monitor the uses that their systems
>    are put to?

Yes, they can make statistics. Personal specific? No. Not here.

> -  do public officials have an inherent right to privacy about their
>    actions related to their office?

Yes. They have the right to close the door. Even for minutes.

>Does the owner of a resource have an inherent right to control that
>resource and if so what are the boundaries?

He has this right until he touchs the rights of other people. So he have not
all rights he might want.

>Does the user of a resource have rights outside the purvue of the owner
>of that resource and if so what are the boundaries?

Do you own your house? If not, why do you stop your house owner from
snooping in your flat? It's his ressource. Why do you encrypt e-mails over
your provider's lines? It's his ressource.

If privacy is outlawed in offices, nobody can work legally.






From whgiii at invweb.net  Fri Oct 24 07:16:13 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Fri, 24 Oct 1997 22:16:13 +0800
Subject: CMR versus GAK? (fwd) > Right to monitor
In-Reply-To: <199710241400.JAA23475@einstein.ssz.com>
Message-ID: <199710241408.KAA06691@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <199710241400.JAA23475 at einstein.ssz.com>, on 10/24/97 
   at 09:00 AM, Jim Choate  said:

>Forwarded message:

>> From: lutz at taranis.iks-jena.de (Lutz Donnerhacke)
>> Subject: Re: CMR versus GAK?
>> Date: 24 Oct 1997 13:01:12 GMT

>> * William H. Geiger III wrote:
>> >documents. This is the distinction between corporate access to plain text
>> >and GAK. The company *owns* the documents. They have a right to read them
>> >any time they want. If you don't want your *private* corrospondance to be
>> 
>> The company *owns* all telephon calls mad from an to there office. So they
>> have a right to wiretrap and record all phone calls you does from the
>> company. If you don't want your *private* corrospondance be wiretraped and
>> recorded, prevent every phone call in private issues from the company.
>> Forbit your insurance agency to call you in the company, deny the school
>> attended by your children to phone you at work, if your childen is ill, ...

>It occurs to me that this entire question is really of much larger social
>import:

> -  do babysitters in your home have an inherent right to not be
>monitored in case they harm the child?

So long as they are in someone elses home they do not. This is not an
issue of harm to the child this is a issue of it's my house and if you
don't like it get out.

> -  do operators of vehicles on public roads have an inherent right to
>    privacy about the vehicle?

The very nature of acting in public removes any expectation of privacy.

> -  do businesses have the right to monitor the uses that their systems
>    are put to?

Of course.

> -  do public officials have an inherent right to privacy about their
>    actions related to their office?

Nope, public officials are employees of the citizens. As such the citizens
have a right to monitor what they do.

>etc. ad nausium...

>These various issues can be broken down into two simple questions that
>once answered genericaly can be applied to the specific cases.

>The bottem line is:

>Does the owner of a resource have an inherent right to control that
>resource and if so what are the boundaries?

Yes, and the boundaries should be very few. Things like just because you
own a hammer doesn't give you the right to hit people over the head. But
as far as setting policies on how a resource can be used and what
conditions must be met before using them it should be without limit. If
you don't like it the don't use it and go get your own.

>Does the user of a resource have rights outside the purvue of the owner
>of that resource and if so what are the boundaries?

No they do not. If the user of a resource does not like the conditions set
by the owner for the use of that resource then they should not use it.

>        The financial policy of the welfare state requires that there    
>        be no way for the owners of wealth to protect themselves.        
>                                                                         
>                                           -Alan Greenspan-              

Never truer words were spoken.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFCsZY9Co1n+aLhhAQFNbwP/R5gydKcbVEX9nOciUO1vox/+ESTJXspT
eTGknDxzC7fBiDHQYuK5fKayDjGvms8w/6eO32XyH2ZI7260yM/RtyTNGSlRlI16
a26v5LZrwqHfa1cLNQQIMl8tOrITQ0mrVoiFEztbTcYQmyHDp1YHm7JFLaOW1EwS
gnCpUuzaFoY=
=G5sB
-----END PGP SIGNATURE-----






From whgiii at invweb.net  Fri Oct 24 07:22:59 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Fri, 24 Oct 1997 22:22:59 +0800
Subject: CMR versus GAK?
In-Reply-To: 
Message-ID: <199710241414.KAA06756@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In , on 10/24/97 
   at 01:32 PM, lutz at taranis.iks-jena.de (Lutz Donnerhacke) said:

>* William H. Geiger III wrote:
>>I am not quite sure what your point is here. A company has every right to
>>listen in on any phone conversation you make on their phones. There is no
>>"expectation of privacy". Many companies have strict guidlines on how you

>May be in your (poor) country. There is a world outside US.

Lets not be throwing nationalistic stones here as your country has plenty
of dirty laundry too.

Here we have what is know as "property rights". The owner of property is
the one who determines how it will be used. It is really quite simple and
quite basic. Now I know that some of our socialist friends here and abroad
think that through the power of the STATE they have a right to tell others
how to live there lives this bankrupt philosophy has been rejected by most
on this list.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFCuAI9Co1n+aLhhAQHjAwQAhVL0Xbp+lNqoxtmbmP7L3dApUgyaqySv
UgK37t/sxwa0L5JthJLASxBoDtuJWrvN/sCaEp1Nk32YXzyQgt+LVwQ3incIZ5f/
YIQbnHM5/dRdUfs+BmTdyStUW9yRxb49l0yFfcNPlR70qmn2jYBPkkZqspqBtKNl
clN98oOoVUU=
=pW5+
-----END PGP SIGNATURE-----






From kent at bywater.songbird.com  Fri Oct 24 07:39:47 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Fri, 24 Oct 1997 22:39:47 +0800
Subject: PGP Employee on MKR
In-Reply-To: <877689108.28637.193.133.230.33@unicorn.com>
Message-ID: <19971024072954.03509@bywater.songbird.com>



On Fri, Oct 24, 1997 at 03:31:48AM -0700, mark at unicorn.com wrote:
> 
> As I said before, the SMTP filter is not the evil aspect of your design,
> it's the enforced encryption to multiple recipients.

Gee, Mark, I thought it was the SMTP filter that did the enforcing.  
Maybe if PGP didn't call it "CMR" but instead called it something 
neutral like the "key link field".
>  
> >The fact is, nobody has come up with a scenario where PGP's CMR feature
> >can be turned into GAK in any practical way. 
> 
> I just have. Now try to explain it away.

Let's see, your scenario involves putting super sniffers at strategic
positions throughout the net, and passing laws that not only supports
this, but makes it illegal to go around them.  I suggest that if such
laws are passed PGP's software is the least of your problems.

To make it plain, Mark, I "explain it away" this way:  fundametally, 
your scenario assumes what it is trying to prove -- you assume that 
incredibly draconian laws are in place, and then you use that 
assumption to prove that incredibly draconian laws are in place.  
This is known as "circular reasoning" -- perhaps you've heard of it? 

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From aba at dcs.ex.ac.uk  Fri Oct 24 08:31:41 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Fri, 24 Oct 1997 23:31:41 +0800
Subject: secret sharing (Re: CDR design document)
In-Reply-To: <3.0.3.32.19971023073713.031381e0@popd.netcruiser>
Message-ID: <199710241324.OAA01401@server.test.net>




Jon Wienke  writes:
> At 10:55 PM 2/21/97 GMT, Adam Back wrote:
> >
> >Here is a proposal for consideration for inclusion in the OpenPGP
> >standard:
> >
> >	http://www.dcs.ex.ac.uk/~aba/cdr/
> 
> Great work, Adam!  Pursuant to some of the recent rants on cypherpunks, I
> would like to see a proposal for a secret sharing mechanism that would
> allow the recovery of a storage-only key with m of n shares in the event
> that the passphrase to the storage key is unavailable, with the following
> attributes:

I think PGP Inc are considering secret sharing for later versions.
Perhaps it is too much for this iteration?

Secret sharing is nice, I agree, but can be complex too: what if it's
3 of 5, and one of the 5 leaves to join a competitor, can you
redistribute the share without creating a new key without losing
security?  What new packets would be required, etc.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710241437.PAA01543@server.test.net>




Anonymous writes:
> Adam Back writes:
> > The problem is that pgp5.x is both an email encryption system and a
> > file encryption system.  So PGP Inc argue that they need the recovery
> > features for files.  Well OK, but for emails in transit?
> 
> Define "in transit".  Specifically, when exactly does email stop being
> "in transit".  When it is received on a mail server?  Transfered to the
> destination computer?  Displayed to the user?  Saved in an archive?

It is no longer in transit for the purposes of encryption when you
have decrypted it.  At that point you can store it in unencrypted
form, or in encrypted form with recovery information.

> How long might a piece of email spend "in transit"?  Compare and contrast
> with the amount of time a piece of data from an encrypted phone call
> spends in transit.  Or an SSL protected HTTPS web transaction.

One week would cover it mostly?

You can even escrow the communications-only keys if you're really
bothered about people going away for a week and forgetting their
password on return with a few encrypted messages queued up.  Even that
is much better than CMR.

You might want to implement a evenings hacking's worth of PFS
transport level security if you were going to do that to reduce the
risk.

> Do you understand the difference between transit times of a fraction
> of a second and of days or weeks?  Does this suggest any differences in
> the need for recovery of encrypted data "in transit"?
> 
> Not all communications are alike.  The longer data spends "in transit"
> the more need there is for recovery features.

Sure, I can agree with that.

The point of CDR is to make sure the attacker has to attack the
endpoints to get plaintext.  The danger with CMR is that it includes
the recovery information in the message.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710241417.PAA01525@server.test.net>




Declan  forwards:
> >A friend of mine by the name of Jason Bobier  happens
> >to work at PGP, Inc.  I'll preface his comments by pointing out that
> >I'm sure he doesn't speak for the company in any way.
> >
> >> Unfortunately these people just don't get it. Corporations refused
> >> to buy 5.0 because it did not have any way for the corps to get at
> >> email encrypted to their employees. There are some very legitimate
> >> uses of this, such as when an employee dies and someone else has
> >> to take over for them.

When someone dies, it seems to me that you are interested to get at
the archived email primarily, not the odd new emails which is
addressed to that employee.

Regardless, even if you did want to allow the company to be able to
spot check emails arriving for the employee it would simpler, to just
give the employees key to the company.  PGP employees seem to get
upset if you suggest giving companies copies of employess keys -- but
really what difference does it make if the company can read messages
addressed to you with their own key or with your key.

(Clearly in either case you can by pass the whole setup with
superencryption, or just by walking out of the building with a DAT
tape).

> >> Without corps buying the product, there is no PGP, Inc., and thus
> >> no dedication of resources to the production of PGP. This leads us
> >> back to the floundering state of development that PGP was in
> >> before 5.0.

Right.  So implement storage recovery, that's what the corp wants to
protect: data availability.

> >> They also don't seem to realize that you always have the ability
> >> to remove the MRK from your list of recipients.

However, in some circumstances this ability doesn't help you much:
because if the recipient is working for a company running pgp5.5 set
up strictly, it'll bounce your mail unless you keep the "MRK" on the
list of recipients.

> >> Sometimes I really feel like screaming at these people. _All_ of
> >> the developers at PGP are personal privacy zealots and no one
> >> likes the idea of the MRK. That is why we refuse to make them
> >> required. 

The SMTP policy enforcer which bounces mails which don't have extra
CMR crypto-recipients seems to fly in the face of your claimed
refusal.

Yes you can hack around it, yes it's optional, but PGP Inc wrote it,
and provides facilities to enforce this behaviour for those that chose
to use it in that mode.

> >> It is also why there still are freeware and personal
> >> versions of the product. 

pgp5.5 freeware/personal use also knows how to comply with CMR request
from someone using a company account with policy enforcer, and
strict settings.

> >> I wish they would just realize that we
> >> aren't some evil group of people that are solely plotting how to
> >> make the most money off of this. Most everyone at PGP has
> >> internalized personal privacy as a cause (actually most had it
> >> before they joined PGP).

I'm not sure that many people have accused PGP of being "evil" or
plotting to sell us out for money.

What many have said though is that there are better ways to implement
corporate data recovery disaster recovery procedures than PGP have
implemented; ways which are much more resistant to abuse by
government.

There isn't that much objection to companies having what ever access
they want; certainly not much for data recovery.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710241342.OAA01491@server.test.net>




Kent Crispin  writes:
> It may be less obvious, but despite what PGP claims, a significant
> fraction of this demand is for the ability to SNOOP, and not just data
> recovery.  

I was suspicious about this also, the CMR design makes much more sense
if this is the user requirement.  Binding cryptography also would make
sense for this requirement.

But the last time I expressed this suspicion on this list Jon Callas
clearly stated that this was not the case:

Jon Callas  writes:
:    It is possible that
:    there is an unstated perceived user requirement, that the messaging
:    standard be able to allow third party access to the communications
:    traffic directly.
: 
: Nope, that's not what we're arguing for. 

So it would appear that your suspicious are unfounded...

> *All* the debate on this list implicitly takes the employee's side,
> not the management's side, and that is a serious lack.  The
> unpleasant fact is that managers NEED TO BE ABLE TO SNOOP.

Okay!  Some one who is able to say the unpleasant words.  (I think
Lucky may have been hinting at this also).

If this is the case, I reckon it's still better to just escrow their
comms keys locally.  Put them all in the company safe, whatever.  To
go with this kind of a company with this kind of policy, I would
presume that sending or receiving super-encrypted messages would would
be a sackable offense.

However, there is an alternate reason for the CMR design, which you
don't include above (tho' you did I think discuss this earlier):

That PGP Inc thought CMR would be easier to implement within their
plugin API, and dual function crypto (file encryption, and email
encryption), and to cope with things like encrypt-to-self on Cc: to
self to keep copies.

> It is terrible to work for an employer who will snoop, but it is 
> just as terrible to have dishonest employees.  It doesn't take a 
> genius to realize that the existence of dishonest employees is a
> primary motive for management snooping.

Even with snoopware such as you describe, and companies with such
attitudes, there are other similarly easy ways to get data out: user
walks out of building with floppies.  In fact from memory I think this
was one you suggested: "frisbee DAT tape out of window to sweetheart"
or words to that effect.

> Clearly, there are some organizations for which this is more
> important than others -- financial services companies are only the
> most obvious example.

Maybe.  If PGP Inc want to go this far, and design software with these
features, I reckon local key escrow is better.  However that is not
what they are saying.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710241403.PAA01514@server.test.net>




Kent Crispin  writes:
> Declan writes:
> > I agree that PGP 5.5 doesn't meet the FBI's demand for realtime access. But
> > it can be used as a waving-around-on-the-House-floor prop to pass a law
> > that requires mandatory key escrow.
> 
> They could wave around TIS's products (designed by noted cypherpunk
> Carl Ellison, I believe), or NorTel's Entrust, just as well.  Hell, in
> a few months they may be able to wave around Adam Backs CDR product,
> which also facilitates GAK -- access to communications is worse than
> access to data, by some measure, but the LEA's will certainly be
> grateful to Adam for his legitimization of Key Escrow... 

I think there is a large difference between storage key recovery and
message key recovery.  Also a difference between message key recovery
and including information with the message allowing it to be recovered
by fourth parties.

Yes, governments would like to come take your disk, but they've got to
come and get it first.  And when they get there they may find you are
not using GAKked keys on your disk encryption.  They won't know until
they try.  With email GAK and recovery info with the email, they can
tell from remote snooping if you are cheating.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710241447.PAA01552@server.test.net>




Lucky Green  writes:
> I have watched this silly debate for some time now. PGP pulled an
> awsome hack on corporate America, bringing strong crypto to
> thousands of corporate drones, while Cypherpunks, the crypto elite,
> seems incapable of reponding with anything other than to engage in
> frenzied mutual masturbation fueld by GAK fantasies.

Lucky, all we're saying is that there are better ways to do it.  What
is so difficult with that?

We didn't say: "don't have disaster recovery for stored data."  (Well
I didn't and I don't think Mark did either).

We just said: "make it is diffcult as possible to abuse for GAK while
you're designing it".

> This is sad. Very sad.

If you want to get into the debate, at least start making some
specific points criticizing the obvious alternatives:

"corporate key escrow is better than commercial message recovery"

This is so because CKE requires access to the data.  CMR doesn't, the
recovery info goes over the wire.

You of all people I would have thought would see this one clearly, it
was only a few weeks ago you were arguing that the "key escrow"
argument of the Fed's was a fallacy becuase people wouldn't be using
their comms keys to encrypt stored data.  (Or something along those
lines).  Same thing here, just applied to corporate environments.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710241425.PAA01534@server.test.net>




Lucky Green  writes:
> Anybody with half a brain, a copy of perl, and the PGP 5.0 source from
> http://www.pgpi.com/ could write a similar filter in a matter of hours.

Agreed.  But PGP Inc may be able to deploy their system better than
some lone hacker is able to deploy a perl hack.  And deployment of
pgp5.5 / 5.0 is required to provide automatic interoperability for
this.

(Yes I know you could bounce the mail, and demand a Cc: snoop at acme.com
to go with all mails to fred at acme.com, and use a lot of pgp2.x setups
to auto-encrypt to those recipients with pgp2.x crypto recipients, but
this is not as convenient).

> I am going to install PGP's SMTP filter on my box. To make it impossible to
> accidentally send unencrypted mail to certain people. :-)

Fine, a good, entirely separable functionality.

> >To make that a bit stronger, it seems like *any* model that uses 
> >persistent encryption keys essentially enables CMR-like functionality 
> >in a smtp filter -- it could be done using pgp 2.6.
> 
> Correct. But this isn't going to stop people from complaining.

You are right, it's not.

Just because things are possible, doesn't mean you should _do_ them,
nor attempt to massively deploy them.

If the pgp5.5 functionality is designed to provide companies with a
disaster recovery procedure (forgotten passphrase, or dead employee),
there are much better ways to do it.  We're not arguing against the
user requirement, just against the methodology.

> PGP 5.5 is considerably better than PGP 5.0. The LDAP support alone
> is reason to upgrade. The UI is improved and if you don't want to
> use message recovery, just don't turn it on.

Sure, that works.  For now.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710241226.NAA01332@server.test.net>




William Geiger  writes:
> Adam Back  writes:
> >I think we'd be more interested to see an analysis piece of the political
> >merits/demerits of the pgp5.5 CMR corporate message recovery technique
> >than of _toilets_.
> >
> >Where do you stand on the CMR argument?  Or are you staying away from the
> >hot potato :-)
> 
> Exactly who died and made you the guardian of Truth, Justice, and the
> Cypherpunk Way??? 

I just react to issues I think are important, or which seem
interesting to me, same as anyone else.  I happen to think this CMR
issue is important.

If you disagree, and think the CMR danger is over-rated, well speak up
please!

If you think I am a big mouth speak up too (as you have:-)

> Sometimes I think you take yourself way too seriously Adam.

Well there is always a `d' key, or one of your nifty O/S2 spam
filters.

Also I would be interested in your personal views as a PGP compatible
mail script implementor on how easy CDR is to implement
(http://www.dcs.ex.ac.uk/~aba/cdr/) with your setup.  Some people are
objecting to the difficulty of implementing it.  I think it is fairly
easy.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



aba at dcs.ex.ac.uk wrote:

> We didn't say: "don't have disaster recovery for stored data."  (Well
> I didn't and I don't think Mark did either).

Yep. While there are much better options, I think PGP's CMR would be a
tolerable short-term solution for stored data. The problem is that it's
not for stored data, it's for email (or so 'Commerical MESSAGE Recovery')
would imply.

Note that solely using CMR for stored data would not require that the CMR
'feature' be built into freeware or personal versions of PGP, but only into
the corporate version. That in itself would be a big win.

    Mark






From aba at dcs.ex.ac.uk  Fri Oct 24 08:44:02 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Fri, 24 Oct 1997 23:44:02 +0800
Subject: PGP, Inc.--What were they thinking?
In-Reply-To: <01bcdf5a$4a2d3a60$06060606@russell>
Message-ID: <199710241232.NAA01339@server.test.net>




Phillip Hallam-Baker  writes:
> I can understand the pressures on PGP to support key escrow. 

There is reasonable justification for key escrow, or recovery features
for _stored_ encrypted information.  The rate at which people forget
passwords alone suggests that this would be a good idea.

However the PGP design does much more than that: it allows third and
fourth parties to decrypt messages in transit.

> The problem with PGP's move is that it is the first significant
> break by the Internet software provider community. This will make it
> much easier for Netscape or Microsoft to cave in.

I think they could have implemented recovery of stored encrypted
files, and of saved email archives more easily without including
recovery information over the wire.  It's a security risk to send
recovery encrypted info over the wire encrypted to long term public
keys.

> It will also build the pressure on them.
> I wonder what would happen to Bills problem with the DoJ if he had a sudden
> change of heart. Somehow I don't see Netscape and Microsoft holding the line
> on GAK if PGP are happily exporting their product and grabbing market share.
> 
> I really did not expect Phil Zimmerman to be the first to blink.

Me either.

> I also don't understand it from the corporate perspective. PGP may be
> picking up some business in the corporate market but at the cost of
> alienating a significant part of the hacker community which has been his
> best supporter up till now. I would think his best strategy would have been
> to build on this customer base rather than sell it out at the first
> opportunity.

He could have built storage escrow with much less argument; almost no
argument in comparison I would expect.

> If Phil Z. wants to get into the Enterprise market he is going to have to
> start speaking their language. Most companies today are looking for open
> standards. PGP may have been the de facto security solution three years ago
> but the reality today is several million copies of Comminicator and Explorer
> with S/MIME built in. 

The obvious thing I think is for pgp to build systems which can
automatically interoperate with either.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710240956.KAA01225@server.test.net>




Jonah Seiger  writes:
> While I suspect that new key recovery or CMR products may create some new
> traction for supporters of mandatory GAK, PGP 5.5 is not the first example
> of such a product (TIS has been marketing key recovery products for a
> while).

PGP has stated that their corporate user requirement is recovery of
stored data.  This can be easily be acheived by escrowing storage
keys, or other stored data recovery methods.  That includes sent and
received email archives.

CMR seems more functionally suited to wire-tapping or corporate
snooping.  PGP denies that this is a design decision.  PGP states that
they want to make a system which is hard for governments to abuse as
the basis of mandatory GAK.

If we accept those denials, the CMR design does not meet it's design
well.  It sends recovery information with the communication, which is
both a bad security practice, and easy for government to abuse.

Please read:

	http://www.dcs.ex.ac.uk/~aba/cdr/

for an example of a storage key recovery design for data recovery
which is more resilient to government abuse.

> More importantly though, the Blaze et al study
> (http://www.crypto.com/key_study) did not say that key recovery/key escrow
> systems can't be built.  It said that such systems designed to meet law
> enforcement specifications (24/7 real time access, the infrastructure for
> key exchanges, and security considerations necessary for such a system to
> function) are beyond the scope of the field and would create significant
> vulnerabilities in the network.
> 
> This is an important distinction.

That study was talking about the design problems in centralised key
escrow.  PGP Inc's design means that these design problems are
bypassed; the CMR design (if/when it gets abused by government to
become a "GMR" design) means that the NSA can publish a GMR master key
on their web page today, and that Clinton can pass the presidential
decree tomorrow.

Some have argued, that you _could_ build a similar system with pgp2.x
using it's multiple recipients feature.  I agree, you could.

However that is no excuse to go and build such a system!  It is much
less dangerous to build CDR systems; much less dangerous to build systems
which are able to recover only data stored on disk.

> So far, Soloman, the FBI, nor other mandatory GAK supporters have said that
> PGP 5.5 or other key recovery products on the market today solve their
> so-called 'problems'.  I don't really expect them to. They seem to want
> much much more.

All that they want is possible with pgp5.5, or will be with pgp6.0,
and backwards compatibility is already in place in 5.5 (and perhaps
5.0, tho' this compatibility seems to be hard to get anyone to clarify).

Another claim is that the CMR system is easy to by pass, and therefore
it is privacy friendly.

I'm not sure this argument amounts to much, because clipper was also
easy to by pass.  Unless you're using steganography, the government
could detect the bypass, and then the GAK system becomes just another
one of those laws that the die-hards break, but which can translate
into 10 years jail time if you get caught, or if the government
decides you need knocking down a peg or two.

I would have thought if any one understood this, it would have been
Phil Zimmermann, after his Federal investigation.

Really, if you are familiar with the clipper design, PGP Inc's CMR is a very
related design, it is almost exactly clipper implemented in software.

The design allows for multiple "message recovery" keys, or it allows for one
single centralised one (belonging to the NSA, if the NSA has their way).

The Blaze et al report you are quoting just says that having a single
central recovery key is an incredible security risk.  It also says that
managing many frequently changing recovery keys centrally is also complex.

The NSA still seemed to think it worth the risk with the clipper design,
because they figured they could keep the key recovery database locked up
well enough to prevent another Ames selling it to the Russians, or whoever.

PGP 5.5 is clipper written in software.  Yes it can be bypassed, yes the
software has privacy options which make the recovery option optional; it
also has installation options to make it non-optional; by passing the
non-optional version can be detected by a corporate or government snoop.

Corporate snoops are yucky but they are much less ominous than government
snoops.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710241155.MAA01293@server.test.net>




Declan McCullagh  writes:
> >More importantly though, the Blaze et al study
> >(http://www.crypto.com/key_study) did not say that key recovery/key escrow
> >systems can't be built.
> 
> In fact it said: "Building the secure infrastructure of the breathtaking
> scale and complexity that would be required for such a scheme is beyond the
> experience and current competency of the field." Sounds like "can't be
> built" to me.

They are right: it can't be built securely.  But that's not what the
NSA et al are saying, they are saying we can build it if you trust us
not to divulge the keys.  Clearly they can.  Also clearly we don't
trust them.  The Ames syndrome dictates that sooner or later someone
will sell the database or government master key.

pgp5.5 or 6.0 when it comes out, are viable for such purposes.  Quite
similar to clipper: all you need is for the NSA to publish a public
key, and for Clinton to pass a presidential decree that all companies
using (the yet to be released) pgp6.0 should add that key to the list
of CMR recipients.

People sticking up for CMR (Lucky, Jon Callas, others) say: but you
can by pass it.  I say so what.  You could by pass clipper too, it
still didn't make it a good idea.  You can be detected when you by
pass it.  With stiff penalties for companies or individuals for by
passing, and the chance of detection, it sounds viable to me.

> >So far, Soloman, the FBI, nor other mandatory GAK supporters have said that
> >PGP 5.5 or other key recovery products on the market today solve their
> >so-called 'problems'.  I don't really expect them to. They seem to want
> >much much more.
> 
> I agree that PGP 5.5 doesn't meet the FBI's demand for realtime access. 

Why do you think it doesn't meet their demand for real-time access?

pgp5.5 supports multiple CMR fields attached to userids on the key.
So in a company scenario, that would mean that before the presidential
decree, the listed CMR key would be: snoopy at acme.com.  After the
presidential decree, they would have to list two extra crypto
recipients: snoopy at acme.com, and thoughtpolice at nsa.gov.

I think that pgp6.0 (or whatever it will be called) when it is
released will allow keys to have multiple CMR key requests attached to
userids.  This will enable it for real.  (pgp5.5 as far as I can
understand only provides support in the GUI for adding one CMR key
request per userid).  pgp5.5 already supports multiple CMR key
requests per userid in that it knows how to reply to them.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <19971024084128.07044@bywater.songbird.com>



On Fri, Oct 24, 1997 at 06:13:55AM -0700, mark at unicorn.com wrote:
> whgiii at invweb.net wrote:
> 
> > No their system does not. For what the FBI and NSA want much more needs to
> > be done.
> 
> Really? Read the message I sent after that one. Let's suppose it's 2007,
> PGP have 99% of the crypto market. 
[...]

Probabilty: 0% 
Next argument:

> Here's a quick example of how cool CMR is... let's suppose that 
> loser at foo-bah.com upsets a customer and is working for a CMR corporation.
> Mr Irate Customer downloads some of that kiddie porn that we're told is
> all over the Net, and encrypts it to loser at foo-bah.com, but doesn't
> encrypt it to the company key. Mr Irate Customer mails hundreds of these
> images to loser at foo-bah.com. Their system bounces them. The security
> personnel at foo-bah.com notice all these bounces and snarf some of the
> messages.
> 
> The security personell take these messages to Mr Loser, and force him to
> decrypt them. Shock, horror, what a hideous, insane pervert Mr Loser must
> be to be receiving all these messages. Mr Loser is handed over to the cops
> and taken away. He might not go to jail, but he'll lose his job.
> 
> With a more rational implementation Mr Loser would receive the messages
> and see that they're obscene, and immediately report them to the security
> personnel who could track down the sender. But when the security personnel
> find them first, they immediately assume that Mr Loser asked for them.

Words fail me.  This is completely idiotic.

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From aba at dcs.ex.ac.uk  Fri Oct 24 08:55:35 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Fri, 24 Oct 1997 23:55:35 +0800
Subject: PGP, Inc.--What were they thinking?
In-Reply-To: <199710222045.WAA03143@basement.replay.com>
Message-ID: <199710241344.OAA01496@server.test.net>




Anonymous  writes:
> Tim May  writes:
> >Agreed. What amazes me is how PGP, Inc. would decide this should be a core
> >part of their company. "PGP for Business," indeed. What were they thinking?
> 
> Um, maybe that they wanted to stay in business?

No, that's not it.  Storage key recovery or storage data recovery
meets their corporate user requirement for recovery of stored data,
and archived old emails easily.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710241357.OAA01507@server.test.net>




spencer_ante at webmagazine.com writes:
> As a person whose been at work on a very long feature about PGP Inc. for
> Wired, I can tell you that businesses really don't care that much about
> PGP's civil liberties advocacy. 

The suits in charge might not, but many of the security or network
people might.  Technical advice on which product is best suited for
corporate computer and email security often comes from such people.

> In fact, its rep could hurt as much as help them. The Fortune 500 is
> much more pragmatic: They want solutions that work, that help them
> maintain security for their intellectual property and capital. To
> that extent, PGP 5.5--which enables IS directors to manage a public
> key infrastructure and enforce company-wide security policies-- is a
> step in the right direction.

Hmmm.  You can have storage data recovery without allowing third and
fourth parties to read what goes over the wire.  Sending recovery info
with the mesage is bad security practice anyway, especially when the
keys are long term keys.

> And one major thing that needs to be pointed out: PGP's key recovery
> system is *voluntary and private*--not mandatory 

So was clipper remember?  "It's voluntary, read my lips" said the
politicians.  Then a few FOIA's later we found out they were planning
for it to be mandatory all along.  Freeh is calling for mandatory now,
with comments like "if voluntary doesn't work, we may be seeking
mandatory escrow."  It's just a tactic, it's obvious that the
government wants mandatory.  Clearly he will argue that it doesn't
work once he gets a "voluntary" system.  He'll probably engineer an
example of it not working, if a suitable case doesn't arise by itself
in a timely manner.

> and gov.  controlled, which is what the Feds and Louis Freeh have
> been pushing for.

It's not government controlled true.

> One potential positive side effect of PGP 5.5 is that it could
> realign the crypto debate and force people to consider this
> question: Whose back door should netizens be more worried about: Big
> Brother or The Boss?

Big Bro, any day.

But it is not quite that stark because there is a subtly which appears
to be being missed:

  governments want real time access to _communications_

Companies want:

  availability of _stored data_ 
  disaster recovery procedures for encrypted stored data 

(where disaster is sudden death of employee, or employee forgetting
passphrase).

This difference allows you to develop systems which are resistant to
government key grabbing efforts, which at the same time allow
companies disaster recovery plans for encrypted stored data.

PGP's system is too neutral in this respect.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710241505.QAA01565@server.test.net>




Anonymous writes:
> [just remove the CMR key and have your message bounce
> 
> People say, "Oh, but then the government will make everybody run the
> policy enforcer and reject any mail not encryped to the government."

Yep.

> First, if they were going to do this, they could do it with old versions
> of PGP too.  Multiple recipients have been around practically forever.

True.  Doesn't mean I'm going to rush off and implement a policy
enforcer to do the job, nor use the good name of PGP Inc to deploy
such software widely.

> Second, it's a ridiculous idea which ignores how email works.  

Nope, it's not.  Enforcement does not have to be 100%.

People smoke various illicit substances; it's illegal: get caught with
your joint, you go to jail.

> More and more people are running systems at home which could send
> and receive SMTP mail.  The trend is towards home servers which
> support the multiple home computers people will have in the next
> decade.  There's no way to make those people run filters!

I'm on dial up, here.  I'll be going permanent just as soon as the
damn cost comes down.  ($15k for 64k line over here, you've got to be
kidding).

> People say, "Oh, but they'll make it illegal to receive mail at home
> without going through an ISP."  

Most users are going via an ISP right now.

> I'm serious, this has actually been suggested on this list.  It has
> to be suggested, because it's the only way this incredibly stupid
> scenario could be made to work.

Nope.  All that is required is for the sending of non-CMR encrypted
emails to be detectable.  Super-encryption doesn't cut it -- the
government is going to notice that, after they've singled you out for
a spot check.

> If the only way the government can enforce GAK is by making it
> illegal for people to receive email through paths which don't pass
> through government filters we can all rest easy, because it will
> never happen.

Lots of things are illegal which it is easy to get away with most of
the time.  Still doesn't make it a good idea to write software which
makes it easier to do spot checks, does it?

> Even for the cases where filtering is done (like businesses), there are
> easy countermeasures, described by no other than Jon Callas, PGP's chief
> scientist!  Why would he say this if there were a massive conspiracy to
> enable GAK?  He's also the one who explained the point above about the
> self signature.  He has suggested two other easy workarounds:
> 
> Modify the PGP 5.0 source to put a fake recipient block on it.  How many
> companies release their source so that you could do this?
> 
> Or superencrypt to the real end user, like you suggested in your scheme.
> Why is this OK as a privacy workaround for your idea but it doesn't
> count for PGP?

Neither of those cut it.  If your company is sampling your email, and
you've hacked around it, they'll just fire you, or what ever.

If it is the government doing the sampling, they'll just lock you up,
or tack 5 years on to the sentence for "use of non GAKed encryption in
furtherance of a crime".

> Then people say, "Oh, but PGP shouldn't have written the SMTP filter
> anyway (or at least they shouldn't have put that one policy in) because
> it would make it easier for the government to make everybody use it."
> 
> Ignoring all the considerations above about what a stupid idea this is,
> the fact is that a simple filter like this is incredibly easy to write.
> I'm sure a skilled Perl hacker like Adam Back could put together something
> to check that a PGP message is encrypted to a desired key in a few hours.

Sure.  But just because this is possible doesn't mean you should do
it.  The gap between me doing it, and PGP doing it is that PGP are
shipping hundreds of thousands of the things.  Deployment wins.

> The existence of such a filter is totally insignificant in the big
> picture.  If we are ever forced into a GAK system and filtering turns
> out to be a part of the picture, it will be trivial for such filters to
> be created.  PGP's SMTP product will not make any difference one way or
> the other.

Maybe.  The point is that if pgp5.5 didn't include it this extra
deployment hurdle would be the government's problem.  Users would be
using older mail systems for ages.

> The fact is, nobody has come up with a scenario where PGP's CMR feature
> can be turned into GAK in any practical way.  They have to assume that all
> kinds of changes and additions are made - inability to remove CMR keys,

Nope.  Never said that.  You can remove them all you like -- your mail
just bounces when you do.

> forcing everyone to run SMTP filters, 

not required.

> making it illegal to receive email at home, 

not required.

> preventing people from implementing clients with workarounds,

not that much of a big deal; most users have enough problems just
getting out of the box software to work without downloading cypherpunk
patches, knowing what they are etc.  Ie we _know_ that cypherpunk
types will be ok.  That's not the point.

> changing the technology to make it harder to implement workarounds
> using binding cryptography.  

That's an optional.

> Any system can be turned into GAK if you're allowed to postulate
> these kinds of changes.  And the fact is that every GAK system so
> far designed can be trivially defeated.

So could clipper.  Where you defeneding it too?  It was optional (or
so they said), etc.

Think about detection rather than hackign around once things become
laws with associated jail times.

> [source code, non-GAKked freeware]
>
> The existence of these products in source code form will forever stand
> as a barrier to any hope to coax (most) people into using GAK software
> by forcing it into built-in products, leaving the alternative of non-GAK
> software only to a tiny minority.  This in itself should monkey wrench
> any government plans for requiring GAK.

I think you'll find that the majority of users will use the GAKked
stuff.  Most users are using windows.  Most are using 40 bit crypto.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: 



* Adam Back wrote:
>I think that pgp6.0 (or whatever it will be called) when it is
>released will allow keys to have multiple CMR key requests attached to
>userids.  This will enable it for real.  (pgp5.5 as far as I can

PGP 5.0 still supports this.






From mark at unicorn.com  Fri Oct 24 09:37:25 1997
From: mark at unicorn.com (mark at unicorn.com)
Date: Sat, 25 Oct 1997 00:37:25 +0800
Subject: PGP Employee on MKR
Message-ID: <877710384.5611.193.133.230.33@unicorn.com>



Kent Crispin wrote:

>Words fail me. This is completely idiotic.

Indeed. It's just as idiotic as people being killed for receiving encrypted
mail in Iraq. It is, however, just as possible, and anyone who believes the
contrary obviously hasn't worked for a big company before; I've seen them
do far, far, more idiotic things in the past.

   Mark






From mark at unicorn.com  Fri Oct 24 09:57:52 1997
From: mark at unicorn.com (mark at unicorn.com)
Date: Sat, 25 Oct 1997 00:57:52 +0800
Subject: PGP Employee on MKR
Message-ID: <877711665.8054.193.133.230.33@unicorn.com>




>Gee, Mark, I thought it was the SMTP filter that did the enforcing. 
>Maybe if PGP didn't call it "CMR" but instead called it something 
>neutral like the "key link field".

Duh, without the 'mandatory voluntary' encryption to multiple keys, the
enforcer couldn't work. Sure, the Feds could say 'encrypt to the FBI key
or else', but users wouldn't be able to do so automatically without 
getting scripts to do so and the revolt would be too large for even the
FBI to handle. It must be done automatically in the software, or it won't
work.

>Let's see, your scenario involves putting super sniffers at strategic
>positions throughout the net, and passing laws that not only supports
>this, but makes it illegal to go around them. I suggest that if such
>laws are passed PGP's software is the least of your problems.

How is this significantly different from mandatory wiretap access laws
which already exist? Since it only requires action on the part of
Internet providers, it's not going to raise the kind of outcry that
other more widespread laws would create.

>To make it plain, Mark, I "explain it away" this way: fundametally, 
>your scenario assumes what it is trying to prove -- you assume that 
>incredibly draconian laws are in place, 

Incredibly draconian? In what sense? Having to set a bit in your generated
PGP keys? It certainly would be draconian if the FBI passed such a law
today and required everyone to dump their software in favor of new, 
GMR-enabled software, but all new copies of PGP are already GMR-enabled. 
In fact, the FBI could probably stage a public relations coup by giving
away free copies of PGP to anyone who asked.

Draconian would be coming around to your house and taking your keys by
force. Draconian is not merely enabling an option which your software
currently supports. The whole point of not wanting PGP to ship this
system is that it would allow the FBI to snoop *without* truly draconian
laws. Without the current CMR system the FBI would have to force everyone
to change to new software; deployment wins.

As I said, 'don't worry, it won't happen, be happy'. Nothing new.

    Mark






From nobody at bureau42.ml.org  Fri Oct 24 10:07:04 1997
From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer)
Date: Sat, 25 Oct 1997 01:07:04 +0800
Subject: Forgery
Message-ID: 



Forgery is the sincerest form of plagiarism.






From whgiii at invweb.net  Fri Oct 24 10:11:30 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Sat, 25 Oct 1997 01:11:30 +0800
Subject: PGP Employee on MKR
In-Reply-To: <877710384.5611.193.133.230.33@unicorn.com>
Message-ID: <199710241704.NAA08550@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <877710384.5611.193.133.230.33 at unicorn.com>, on 10/24/97 
   at 09:26 AM, mark at unicorn.com said:

>Kent Crispin wrote:

>>Words fail me. This is completely idiotic.

>Indeed. It's just as idiotic as people being killed for receiving
>encrypted mail in Iraq. It is, however, just as possible, and anyone who
>believes the contrary obviously hasn't worked for a big company before;
>I've seen them do far, far, more idiotic things in the past.

There is a simple solution to that don't work for one if you don't like
their policies.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFDV1I9Co1n+aLhhAQHT/AP/cgh6f5TK0mMR5fI4CGjJe3HRJNK5Xshi
bfl1GyCwH3tS5y7P/Wf3G57gA3yk8nEz6YLtyVB+ocdOD8xqL3Ot948bqcu8aaLW
VYKnSVmytt0nvC4U4z7VwepBZnD4TLqYIKxi5lwXiBZa+tvLMZoDNrWTds5+BiJk
khqV19F0xy0=
=o0cl
-----END PGP SIGNATURE-----






From azur at netcom.com  Fri Oct 24 10:17:33 1997
From: azur at netcom.com (Steve Schear)
Date: Sat, 25 Oct 1997 01:17:33 +0800
Subject: IW resources
Message-ID: 



I was cleaning up my HD when I came across a 43 page PowerPoint presentation by Carlo Kopp called "The E-bomb - A Weapon of Electrical Mass Destruction."  It contains a good amount of technology, use and threat assessment data for this sort of EW device.  Very professional.  It was given at IWC-V 1996.  A good candidate for amateur experimentation ;-)

A little alta-vista search brought up Kopp's home page (with links to the above paper) and a wealth of related material, in particular http://www.au.af.mil/au/2025, the Austrailian Air Forces Year 2025 look in to the future,  with a link to http://www.xp.hq.af.mil/xpx, the US Air Force's Strategic Planning Directorate. Very good IW reading.

--Steve







From tcmay at got.net  Fri Oct 24 10:30:52 1997
From: tcmay at got.net (Tim May)
Date: Sat, 25 Oct 1997 01:30:52 +0800
Subject: GMR in the talked-about form here would be unconstitutional
In-Reply-To: <877698834.17691.193.133.230.33@unicorn.com>
Message-ID: 




I agree that draconian crypto laws are afoot, but I don't discount the
power of constitutional challenges.

At 6:13 AM -0700 10/24/97, mark at unicorn.com wrote:

>Really? Read the message I sent after that one. Let's suppose it's 2007,
>PGP have 99% of the crypto market. CMR compatibility is incorporated into
>all their products.
>
>The FBI announce that from today all Internet providers must support PGP
>SMTP enforcers on all mail passing across their links, and block all other
>SMTP connections. Regardless of whether your mail is spooled on your ISP's
>hard disk, it will always pass through their link. All encrypted mail must
>now be encrypted to the FBI's key as well as the end user's key or it will
>bounce.

So,

- the client who communicates with his lawyer must encrypt to the
government's key, allowing the government to read the traffic at any time

- the penitent who confesses electronically (such services already exist)
will be confessing to the government

- a patient and doctor who discuss private medical conditions will be
discussing them with the Thought Police

- a confidential source who reveals information to a journalist will also
be revealing it to the government

And so on, for the usual laundry list of problems with warrantless searches
and widespread surveillance. These are just some of the most
readily-understandable problems.

Will a "must encrypt to government key" provision pass constitutional
muster? I don't think so.

So long as the First and Fourth (and the Fifth may apply, too) Amendments
remain in force, compelling a person to speak in certain ways and
monitoring what he says privately without a proper court order is
unconstitutional.

At least the convoluted stuff in Clipper about "LEAF" fields, splitting of
keys between agencies, proper court orders, etc., had the "fig LEAF" of
protecting some basic constitutional rights. A straight "encrypt to the
government's key" is too crude to withstand any court scrutiny.

I'm obviously not a lawyer, let alone a constitutional scholar, but I think
I'm solid footing here.  A crude, blanket order to include the government
in all communications would absolutely be struck down as a chilling of
speech (political or otherwise) and as an unlawful search and seizure of
one's papers.

In other nations, ignore the above analysis.

--Tim May




>
>So, tell me why "much more needs to be done". Tell me again why this
>can't be implemented. The only reason it *can* be implemented is that
>PGP build the feature into their software.
>
>> Not to mention that *ANY* crypto system can be turned into GAK if
>> the FBI & NSA get congress to pass the laws that they want.
>
>Yes, but PGP WANT TO BUILD THIS INTO EVERY SYSTEM THEY SELL!!!!! I don't
>care that any Perl hacker can write a script which builds CMR into PGP
>2.6.2, because those scripts are restricted to those who wish to use
>them. PGP ARE BUILDING THE FUNCTIONALITY INTO EVERY PRODUCT THEY SELL!!!!
>
>How hard is this to grasp?
>
>> What PGP Inc. did was provide what their *customers* , you know the ones
>> that pay their bills and keep them in business, wanted in a timely fashion
>> with little modification to their current code while circumventing some of
>> the more draconian requests.
>
>Really? Did their customers ask specifically for PGP's flawed CMR
>implementation, or did they actually say things like 'Well, we want to
>be able to recover mail if someone dies or leaves the company'? If it's
>the latter, don't you think that PGP should take responsibility for
>implementing it in such a GAK-friendly way?
>
>You seem be repeating the other pro-PGP mantra 'oh, you're not thinking
>of the company's point of view'. I certainly am, which is why I want to
>see that they get the best, most secure system without any GAK-friendly
>features.
>
>Here's a quick example of how cool CMR is... let's suppose that
>loser at foo-bah.com upsets a customer and is working for a CMR corporation.
>Mr Irate Customer downloads some of that kiddie porn that we're told is
>all over the Net, and encrypts it to loser at foo-bah.com, but doesn't
>encrypt it to the company key. Mr Irate Customer mails hundreds of these
>images to loser at foo-bah.com. Their system bounces them. The security
>personnel at foo-bah.com notice all these bounces and snarf some of the
>messages.
>
>The security personell take these messages to Mr Loser, and force him to
>decrypt them. Shock, horror, what a hideous, insane pervert Mr Loser must
>be to be receiving all these messages. Mr Loser is handed over to the cops
>and taken away. He might not go to jail, but he'll lose his job.
>
>With a more rational implementation Mr Loser would receive the messages
>and see that they're obscene, and immediately report them to the security
>personnel who could track down the sender. But when the security personnel
>find them first, they immediately assume that Mr Loser asked for them.
>
>Now, if you want to be able to get people sacked, this is cool. If you
>work for a company with CMR, this is really bad. It is also unneccesary.
>
>> >These are the important questions we should be asking and noone on the
>> >pro-PGP side seems interested in answering them. Why?
>>
>> They have been answered time and time again, you just have not been
>> interested in listening.
>
>They have not. All we've heard are 'oh, don't worry, it can't happen,
>be happy' assurances with no basis in fact. Is it any wonder we aren't
>listening?
>
>> If this is such a life and death issue why don't you and some of the other
>> Cypherpunks Philosopher Kings get off your armchair quarterbacking write,
>> test, debug, and *market* your superior system??
>
>Duh, because PGP has name recognition, and because by the time it was
>finished they'd already have a large part of the market. But note: I'll
>be very surprised if PGP CMR gets into the OpenPGP spec. Which means that
>any other compliant implementation of PGP will not be compatible with
>CMR.
>
>> Perhaps because the majority of the "PGP Inc is evil" crowd
>> here couldn't make a buck in the business world if their lives depended on
>> it.
>
>Oh sure, ad hominem, ad hominem. What the hell do you think I do all
>day? Why the hell do you think I'm spending so much time trying to show
>people what CMR's problems are when I could be making money?
>
>> I also find it interesting how there is "much weeping gnashing of teeth"
>> over PGP 5.5 , which does nothing that couldn't be done with 2.6, while
>> Netscape, RSA and the S/MIME crowd put weak crypto on every desktop??
>
>Better weak crypto than GAK. Key-lengths can be increased, government
>surveillance infrastructure cannot easily be removed.
>
>    Mark


The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From FisherM at exch1.indy.tce.com  Fri Oct 24 10:38:44 1997
From: FisherM at exch1.indy.tce.com (Fisher Mark)
Date: Sat, 25 Oct 1997 01:38:44 +0800
Subject: PGP Employee on MKR
Message-ID: <2328C77FF9F2D011AE970000F84104A74933D0@indyexch_fddi.indy.tce.com>



>> Not to mention that *ANY* crypto system can be turned into GAK if
>> the FBI & NSA get congress to pass the laws that they want.
>
>Yes, but PGP WANT TO BUILD THIS INTO EVERY SYSTEM THEY SELL!!!!! I
don't
>care that any Perl hacker can write a script which builds CMR into PGP
>2.6.2, because those scripts are restricted to those who wish to use
>them. PGP ARE BUILDING THE FUNCTIONALITY INTO EVERY PRODUCT THEY
SELL!!!!

But the changes to add GAK/GMR/CMR to PGP (or any other crypto product
that permits multiple recipients) are close to trivial.  Don't be fooled
into thinking that if PGP takes this "feature" out (can't be a bug --
it's documented :) that that will make it a lot harder to add that
feature back in once the appropriate laws are passed.

Still, in retrospect, PGP's engineers and scientists should have thought
about all the security implications of CMR -- they might have
implemented CDR to begin with.
==========================================================
Mark Leighton Fisher          Thomson Consumer Electronics
fisherm at indy.tce.com          Indianapolis, IN
"Their walls are built of cannon balls, their motto is
'Don't Tread on Me'"






From aba at dcs.ex.ac.uk  Fri Oct 24 10:48:02 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sat, 25 Oct 1997 01:48:02 +0800
Subject: a day in the life of a pgp5.5 user (Re: PGP Employee on MKR)
In-Reply-To: <877707423.648.193.133.230.33@unicorn.com>
Message-ID: <199710241640.RAA03688@server.test.net>




Mark Grant  writes:
> aba at dcs.ex.ac.uk wrote:
> > We didn't say: "don't have disaster recovery for stored data."  (Well
> > I didn't and I don't think Mark did either).
> 
> Yep. While there are much better options, I think PGP's CMR would be a
> tolerable short-term solution for stored data. The problem is that it's
> not for stored data, it's for email (or so 'Commerical MESSAGE Recovery')
> would imply.
> 
> Note that solely using CMR for stored data would not require that the CMR
> 'feature' be built into freeware or personal versions of PGP, but only into
> the corporate version. That in itself would be a big win.

PGP 5.5 currently has CMR for stored data AND comms data (if you set
it up to have CMR).  CMR for stored data only is much safer from
government abuse.


I think even CMR for just stored data is kind of dumb in that it
doesn't work very well.

Consider a day in the life of a typical Joe Luser (who can't remember
a password to save his life).

He's been using this spiffy new pgp5.5 (or your suggested 5.6 with CMR
storage recovery, but with no CMR message recovery).. he has PGP
encrypted files scattered everywhere.  On backup tapes in the
fire-proof safe, on floppies, on the disk, on the disk inside `.zip'
files `.tar' files, on the optical duke box (full of write-once worm
CDs), etc. etc

He forgets his password (for the third time that month).  He needs all
those files back _now_ because there's a deadline, and there's going
to be serious shit flying if it doesn't get finished.

So now what?

The admin has to come along and recover them all for Joe.  He'll be
there for the duration if he's got to re-encrypt half of the 2Gb disk
(it'll be _slow_ with public key crypto, which PGP Inc insists on
using even for single user storage applications, but we'll save up
that rant for another post).  Could easily take an hour or so before
he's through.  Probably he'll miss some because they are inside `.zip'
files, etc.

And then half an hour after the admin has finished Joe Luser will
accidentally delete that important report.  Then the admin gets called
in again because Joe remembered he had another backup of it inside a
zip file, which he can't read because it's encrypted to his old key.


Key recovery would be simpler.  Just encrypt the private half of Joe's
key with the Admins key.  Leave it on Joe's disk, or chuck a copy in
the company safe.  Then when Joe has another memory lapse, the admin
can be done in 5mins.

That means that the company could now read stuff on Joe's disk.  PGP
Inc seems to view this prospect with horror as if it is a privacy
invasion.  But that's what CMR in pgp5.5 used for storage allows too.
I can't see that it makes much difference how the company gets access
-- they can read all the data either way.

(If Joe has some private files he can encrypt them with another
key.  A progressive crypto vendor would include facilities for
separate keys, some recoverable, some not.)

And frankly the company is in a much better to snoop through the
workstations files anyway; Joe's technically clueless, they own the
machine, they installed the software, they have access to the machine
when he's not there.

Not much you can do against that threat.

PGP sees that threat, and it's response is to implements CMR?  Somehow
it is ok to read data if the users key never gets revealed to the
company?  Can't see that it makes much difference personally, the data
is the interesting stuff, keys are just random numbers.

But at the same time with CMR for message recovery the recovery
information is being sent over the wire.  Now why would you want to
send recovery info over the wire?  To make the attacker's job easier?
Jeeze.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: 



My name is spelled Philip, not Phillip.  --prz

At 8:44 PM -0500 10/23/97, Randall Farmer wrote:
>On Thu, 23 Oct 1997, there's no way in nine hells that Phillip R. Zimmermann
>could have wrote:
>...
>>   However, I have reassessed my views of who truly has a right
>> to control access to privacy and have come to the conclusion
>> that privacy is too important an issue to be left in the hands
>> of the individual, with the obvious potential for misuse.
>
>Hmm...I haven't checked any signatures or headers yet, but something tells me
>that this ain't PRZ. For example, the Organization: header refers to Orwell's
>1984 as a "blueprint"...forget the signatures (just got a message saying they
>match -- either that person's lying, "they" cracked his key, or it's some
>detail that has the program using a different key/ignoring some text), it is
>psychologically impossible for someone to go from privacy advocate to
>1984-as-a-blueprint that quick.
>
>---------------------------------------------------------------------------
>Randall Farmer
>    rfarmer at hiwaay.net
>    http://hiwaay.net/~rfarmer








From lutz at taranis.iks-jena.de  Fri Oct 24 11:13:58 1997
From: lutz at taranis.iks-jena.de (Lutz Donnerhacke)
Date: Sat, 25 Oct 1997 02:13:58 +0800
Subject: GMR in the talked-about form here would be unconstitutional
In-Reply-To: 
Message-ID: 



* Tim May wrote:
>- a patient and doctor who discuss private medical conditions will be
>discussing them with the Thought Police
[...]
>Will a "must encrypt to government key" provision pass constitutional
>muster? I don't think so.

In common enviroments smartcards are used for the example above. Those
smartcards can be only obtained by TTPs, which generate the key pair and
press the secret part on the card. In several countries these TTP are
required to store these private keys for gouvernmental access.

Shure, it's constitutional. You will need a court order to read a special
message with the revealed secret key.

It does not harm, that policy may able to read all previous messages, if
they are stored, because this can't happen. The police is forbitten to do so.






From prz at pgp.com  Fri Oct 24 11:19:46 1997
From: prz at pgp.com (Philip Zimmermann)
Date: Sat, 25 Oct 1997 02:19:46 +0800
Subject: PRZ Announcement
In-Reply-To: <344FEE15.673F@pgp.com>
Message-ID: 



In my last message to this list, I pointed out that my name is spelled
Philip.  I neglected to point out that I also did not write the message
allegedly from me (or from Phillip).  This is why that for signed messages, 
we need to make sure that the signing key is properly signed by trusted 
introducers.  --prz

At 8:44 PM -0500 10/23/97, Randall Farmer wrote:
>On Thu, 23 Oct 1997, there's no way in nine hells that Phillip R. Zimmermann
>could have wrote:
>...
>>   However, I have reassessed my views of who truly has a right
>> to control access to privacy and have come to the conclusion
>> that privacy is too important an issue to be left in the hands
>> of the individual, with the obvious potential for misuse.
>
>Hmm...I haven't checked any signatures or headers yet, but something tells me
>that this ain't PRZ. For example, the Organization: header refers to Orwell's
>1984 as a "blueprint"...forget the signatures (just got a message saying they
>match -- either that person's lying, "they" cracked his key, or it's some
>detail that has the program using a different key/ignoring some text), it is
>psychologically impossible for someone to go from privacy advocate to
>1984-as-a-blueprint that quick.
>
>---------------------------------------------------------------------------
>Randall Farmer
>    rfarmer at hiwaay.net
>    http://hiwaay.net/~rfarmer








From mark at unicorn.com  Fri Oct 24 11:28:01 1997
From: mark at unicorn.com (mark at unicorn.com)
Date: Sat, 25 Oct 1997 02:28:01 +0800
Subject: PGP Employee on MKR
Message-ID: <877714803.13910.193.133.230.33@unicorn.com>



whgiii at invweb.net wrote:

> There is a simple solution to that don't work for one if you don't like
> their policies.

I agree; that's why I don't. But I see an inconsistency here. PGP keep
telling us that CMR isn't so bad because you can work around it, or
superencrypt, or otherwise avoid the company's right to snoop on all
communications. Yet you, who believe in this right, support CMR, which
can be used to defeat that right, over simple escrow of employee's 
corporate communication keys. Why?

Again, I'm not saying that the companies have no such right. Personally
I'd rather escrow my corporate key than see widespread CMR in its current
form.

    Mark






From mark at unicorn.com  Fri Oct 24 11:56:22 1997
From: mark at unicorn.com (mark at unicorn.com)
Date: Sat, 25 Oct 1997 02:56:22 +0800
Subject: GMR in the talked-about form here would be unconstitutional
Message-ID: <877715904.15749.193.133.230.33@unicorn.com>



tcmay at got.net wrote:
 
> I agree that draconian crypto laws are afoot, but I don't discount the
> power of constitutional challenges.

That's probably true: that it's unconstitutional is almost certainly true,
that it would be overturned seems less certain.

The question is, is that grounds for complacency? I'd rather see people use
technology which can't be used against them than hope that such laws would
be overturned.

    Mark






From phm at sprynet.com  Fri Oct 24 12:09:00 1997
From: phm at sprynet.com (Paul H. Merrill)
Date: Sat, 25 Oct 1997 03:09:00 +0800
Subject: Proof IE4 not an OS, was Re: Bill Gates, the Bully Savior
In-Reply-To: 
Message-ID: <3451182C.1E51@sprynet.com>



James Love wrote:
> 
> Nifty comment by Michael McMain on JavaLobbyCafe at iceworld.org
> list:
> 
> --------------------------
> 
> A friend at work made an interesting point about MS's claim that IE4 is
> simply an OS extension and not an application.  All the DA has to do is
> turn on a Power Mac, start IE4, turn to MS and say "So what other parts
> of your OS run on the Macintosh exactly?".
 The MS assertion is not that IE only works within the OS.  Just that it
is a part.

PHM






From rah at shipwright.com  Fri Oct 24 12:09:12 1997
From: rah at shipwright.com (Robert Hettinga)
Date: Sat, 25 Oct 1997 03:09:12 +0800
Subject: FYI: Tygar talk on Monday, November 3 at Harvard
Message-ID: 




--- begin forwarded text


X-Sender: kentborg at pop.tiac.net
Date: Fri, 24 Oct 1997 11:42:25 -0400
To: Robert Hettinga 
From: Kent Borg 
Subject: FYI: Tygar talk on Monday, November 3 at Harvard
Mime-Version: 1.0

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Having recently come out of retirement (my temporary early
retirement, longer than I would have dreamed I could have pulled off,
was wonderful), I have not hit upon a smooth stride in my email
reading techniques.  Riding the bus (most) every day means that I am
going to be running up to date on my Herald Tribune, Economist, Byte,
Science News, Scientific American, etc., but I am behind on such
things as the DCSB mailing list.

So I don't know whether this has gone by on the list, you might want
to send it out:

>From: rivest at theory.lcs.mit.edu (Ron Rivest)
>Date: Fri, 24 Oct 97 11:29:49 EDT
>To: cis-seminars at theory.lcs.mit.edu
>Subject: FYI: Tygar talk on Monday, November 3 at Harvard
>
>
>
>                              Harvard University
>                    Computer Science Colloquium Series
>
>                     Atomicity in Electronic Commerce
>
>                             Doug Tygar
>                       Computer Science Department
>                       Carnegie Mellon University
>
>                        Monday, November 3, 1997
>                                4  PM
>                           Pierce Hall 209
>                       (Tea at 5 pm Brooks Room)
>
>
>Abstract
>
>The explosion of the Internet has brought with it a
>desire to allow information goods to be bought or sold
>over the network.  Several schemes for realizing this
>have been proposed over the last year, and there are a
>number of commercial ventures to support electronic
>commerce.
>
>In the first part of this talk, I examine several
>protocols for electronic commerce from the perspective
>of the distributed transactions.  Most models of
>electronic commerce have presumed a highly-available
>error-free network.  I argue for a more realistic model
>of commerce using notions of atomicity in electronic
>commerce, and propose three levels of atomic
>transactions.  I will discuss how to exploit network
>failures to explicitly attack commercially used
>protocols and fraudulently obtain goods or money.
>
>In the second part of the talk, I will discuss two very
>different approaches to achieving high degrees of
>atomicity:  the first, an internet billing system
>called NetBill is being used to allow highly atomic
>microtransactions of information goods.  This
>technology has recently been licensed for commercial
>use.  The second approach, Information Based Indicia,
>uses secure coprocessor hardware to ensure atomicity,
>and is being adopted by the US Postal Service to
>address their problem of theft of postage through
>counterfeit postage indicia.
>
>
>Host: Professor Michael Rabin
>
>
>
>
>
>
>
>
>
>
>
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNFDB4dL/GwYma/g5EQIziQCbBjVOiEzn11yQKX0htHS2cVCPZJ8AoMXM
aMpfEIV0cYxcgdmFgLV0gmD6
=jeyE
-----END PGP SIGNATURE-----


--
Kent Borg                           kentborg at borg.org
W: +1-781-768-2300 x1741           H: +1-617-776-6899
  "The creative instinct has always been a stronger
   motive than mere profit to do truly new and
   revolutionary things."
                                        - Phil Karn

--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/
Ask me about FC98 in Anguilla!: 







From aba at dcs.ex.ac.uk  Fri Oct 24 12:09:52 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sat, 25 Oct 1997 03:09:52 +0800
Subject: unconstitutional? try this variant...(Re: GMR in the talked-about form here would be unconstitutional)
In-Reply-To: 
Message-ID: <199710241843.TAA05546@server.test.net>




Tim May  writes:
> I agree that draconian crypto laws are afoot, but I don't discount the
> power of constitutional challenges.
> 
> So long as the First and Fourth (and the Fifth may apply, too) Amendments
> remain in force, compelling a person to speak in certain ways and
> monitoring what he says privately without a proper court order is
> unconstitutional.
> 
> At least the convoluted stuff in Clipper about "LEAF" fields, splitting of
> keys between agencies, proper court orders, etc., had the "fig LEAF" of
> protecting some basic constitutional rights. A straight "encrypt to the
> government's key" is too crude to withstand any court scrutiny.

The Clipper set up claimed to have split databases.

I wonder.  Secret splitting is being described as a possibility for
pgp6.0.

Perhaps they'll use:

	thoughtpolice1 at nsa.gov
	thoughtpolice2 at nsa.gov

as the two half GMR fields.  And they'll promise not to combine the
two halves without a court order (except for national security
purposes, of course).  Naturally a court would never violate lawyer
client confidentiality, etc., so they might argue this was
constitutionally ok.

> I'm obviously not a lawyer, let alone a constitutional scholar, but I think
> I'm solid footing here.  A crude, blanket order to include the government
> in all communications would absolutely be struck down as a chilling of
> speech (political or otherwise) and as an unlawful search and seizure of
> one's papers.

An example of a somewhat analogous setup was the digital telephony
wiretapping order.  That was passed.  Not struck down yet (though
floundering because it cost way more money than the Feds claimed it
would).

What about lawyer client confidentiality over telephone?  They would
argue I suppose that you had insufficient expectation of privacy?

Perhaps they would use similar arguments to say that it's not a
problem for the same access to emails.


And anyway, since when has unconstitutionality meant anything to
politicians, law enforcement agents, and spooks.  What about guns,
hmm.  That one was clear enough in the constitution if anything ever
was, and yet the USG is slowly headed the same way as the UK
government.

CDA got struck down which was good, but unconstitutionality doesn't
seem to be adequate protection.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710241853.TAA05556@server.test.net>




Fisher Mark  writes:
> Mark Grant  writes:
> >Yes, but PGP WANT TO BUILD THIS INTO EVERY SYSTEM THEY SELL!!!!! I
> >don't care that any Perl hacker can write a script which builds CMR 
> >into PGP 2.6.2, because those scripts are restricted to those who 
> >wish to use them. PGP ARE BUILDING THE FUNCTIONALITY INTO EVERY 
> >PRODUCT THEY SELL!!!!
> 
> But the changes to add GAK/GMR/CMR to PGP (or any other crypto product
> that permits multiple recipients) are close to trivial.  Don't be fooled
> into thinking that if PGP takes this "feature" out (can't be a bug --
> it's documented :) that that will make it a lot harder to add that
> feature back in once the appropriate laws are passed.

Adding the feature clearly will be easy.  But persuading the people
using the non-CMR enabled software base to downgrade will be a big
problem.  I wonder how many people will still using old versions years
later.  There is a huge inertia to not upgrade that frequently.
People don't like upgrading, companies don't like upgrading, it costs
time, money, it's unwanted hassle.  

I'm guilty of this myself in some areas.  `do fix what isn't broken'.
Eg I'm using an ancient beta Xfree86, and hacking around the expiry
simply because I can't be bothered to download and install the next
version.

At dcs.exeter the admins were _way_ behind.  I had netscape2, and then
3 installed for myself and friends to use, while they were still
trundling along with an antique NCSA Mosaic beta version or something.
I had gcc-273 installed in my own filespace and they had gcc-258 or
something (it matters if you're using templates.. the old ones are
more broken).

> Still, in retrospect, PGP's engineers and scientists should have
> thought about all the security implications of CMR -- they might
> have implemented CDR to begin with.

You would've thought, yes.  Even from a security point of view,
forgetting political arguments CDR is better.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <34511B83.7EF4@acm.org>



James Love wrote:
> 
> Nifty comment by Michael McMain on JavaLobbyCafe at iceworld.org
> list:
> 
> --------------------------
> 
> A friend at work made an interesting point about MS's claim that IE4 is
> simply an OS extension and not an application.  All the DA has to do is
> turn on a Power Mac, start IE4, turn to MS and say "So what other parts
> of your OS run on the Macintosh exactly?".

The MS counter-assertion is not that IE is not a stand-alone piece of
software, just that it is a part of the OS.

(Personnally I can't stand it.)

PHM






From aba at dcs.ex.ac.uk  Fri Oct 24 12:22:28 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sat, 25 Oct 1997 03:22:28 +0800
Subject: forgery quality (Re: PRZ Announcement)
In-Reply-To: 
Message-ID: <199710241900.UAA05563@server.test.net>




Damn, but Toto's improving with those forgeries... I'm not at all
expert on forgeries, but usually you can spot Toto's because it says

: X-Mailer: Mozilla 3.01C-SYMPA  (Win95; U)

in the headers, other tell tales signs being headers with
sk.sympatico.ca in the header such as this:

: Received: from default (orenco30.sk.sympatico.ca [142.165.99.30]) by
: wombat.sk.sympatico.ca with SMTP (8.7.1/8.7.1) id SAA28139 for
: ; Thu, 23 Oct 1997 18:33:57 -0600 (CST)

But this one, can anyone see anything wrong with this... no sympatico,
no X-Mailer: Mozilla 3.01C-SYMPA (Win95; U), someone knows how to
forge well, or PRZ has developed a sense of humor about this CMR
business.

Full headers follow.

Adam

Received: from www.video-collage.com [199.232.240.107] by hermes via ESMTP (TAA06933); Fri, 24 Oct 1997 19:17:50 +0100
Received: (from ichudov at localhost)
	by www.video-collage.com (8.8.5/8.8.5) id OAA08153
	for cypherpunks-outgoing; Fri, 24 Oct 1997 14:05:36 -0400 (EDT)
Received: from sirius.infonex.com (sirius.infonex.com [206.170.114.2])
	by www.video-collage.com (8.8.5/8.8.5) with ESMTP id OAA08141
	for ; Fri, 24 Oct 1997 14:05:21 -0400 (EDT)
Received: (from cpunks at localhost) by sirius.infonex.com (8.8.5/8.7.3) id LAA16816; Fri, 24 Oct 1997 11:07:46 -0700 (PDT)
Received: from rigel.cyberpass.net (root at rigel.infonex.com [206.170.114.3]) by sirius.infonex.com (8.8.5/8.7.3) with ESMTP id LAA16810 for ; Fri, 24 Oct 1997 11:07:40 -0700 (PDT)
Received: from toad.com (toad.com [140.174.2.1]) by rigel.cyberpass.net (8.8.5/8.7.3) with ESMTP id LAA09467 for ; Fri, 24 Oct 1997 11:04:11 -0700 (PDT)
Received: (from majordom at localhost) by toad.com (8.7.5/8.7.3) id LAA16579 for cypherpunks-unedited-outgoing; Fri, 24 Oct 1997 11:01:38 -0700 (PDT)
Received: from fusebox.pgp.com (fusebox.pgp.com [205.180.136.16]) by toad.com (8.7.5/8.7.3) with ESMTP id LAA16574; Fri, 24 Oct 1997 11:01:35 -0700 (PDT)
Received: from [205.180.136.41] (shiva1.pgp.com [205.180.136.41])
	by fusebox.pgp.com (8.8.7/8.8.5) with ESMTP id LAA14655;
	Fri, 24 Oct 1997 11:01:28 -0700 (PDT)
X-Sender: prz at mail.pgp.com
Message-Id: 
In-Reply-To: 
References: <344FEE15.673F at pgp.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Fri, 24 Oct 1997 11:02:22 -0700
To: Randall Farmer 
From: Philip Zimmermann 
Subject: Re: PRZ Announcement
Cc: cypherpunks at toad.com, coderpunks at toad.com
Sender: owner-cypherpunks at Algebra.COM
Precedence: bulk
X-Mailing-List: cypherpunks at algebra.com
X-List-Admin: ichudov at algebra.com
X-Loop: cypherpunks at algebra.com
Status: R


My name is spelled Philip, not Phillip.  --prz






From nobody at replay.com  Fri Oct 24 12:30:34 1997
From: nobody at replay.com (Anonymous)
Date: Sat, 25 Oct 1997 03:30:34 +0800
Subject: GAK on the cheap
Message-ID: <199710241855.UAA11936@basement.replay.com>



GAK fans!

Here's a patch to PGP 2.6.2 to force it to encrypt all messages to the
FBI key.

Patch crypto.c thusly:

2339a2340
>       ++i;            /* Count FBI key */
2368a2370,2372
>       /* encrypt to FBI */
>       keys_used = encryptkeyintofile(g, "", keybuf, keyfile,
>                                       ckp_length, keys_used);

That's it.  Four new lines, and every message is encrypted to the
government as an additional recipient.

Don't let the FBI see this.  If so, we'll be  "one step from
GAK".  Add a few SMTP filters and we're doomed.






From jwn2 at qualcomm.com  Fri Oct 24 12:55:52 1997
From: jwn2 at qualcomm.com (John  W. Noerenberg)
Date: Sat, 25 Oct 1997 03:55:52 +0800
Subject: PGP Employee on MKR
In-Reply-To: <877607187.26935.193.133.230.33@unicorn.com>
Message-ID: 



At 9:49 PM +0200 10/23/97, Lucky Green wrote:
>I have watched this silly debate for some time now. PGP pulled an awsome
>hack on corporate America, bringing strong crypto to thousands of
>corporate drones,  while Cypherpunks, the crypto elite, seems incapable of
>reponding with anything other than to engage in frenzied mutual
>masturbation fueld by GAK fantasies.

Well said, Lucky.

The next step to gaining the wide-spread and richly deserved acceptance
that should be PGP's fate is to certify it as a recognized, codified, and
testable method for using strong crypto.  That is what the IETF effort is
all about.

Remember the IETF is devoted to enabling anyone, anywhere who possess the
wit, perserverance and means to communicate over digital networks to do so.
As we are all aware, that means having the ability to do it privately and
securely.  That is way the standardization effort in the IETF is so
fundamentally important.  No other standards body has the world-wide
breadth nor the commitment to the individual's right to use and develop
computer technology than the IETF.  It is our best shot to make PGP a
standard.

We can't afford to blow it.

best,

john  w noerenberg, ii
jwn2 at qualcomm.com
pager: jwn2 at pager.qualcomm.com
 --------------------------------------------------------------------
  "A beautiful idea has a much greater chance of being a correct idea
   than an ugly one."
 -- Roger Penrose, "The Emperor's New Mind", 1989
 --------------------------------------------------------------------







From anon at anon.efga.org  Fri Oct 24 12:59:56 1997
From: anon at anon.efga.org (Anonymous)
Date: Sat, 25 Oct 1997 03:59:56 +0800
Subject: None
Message-ID: <633f314d1dcc4c2315d89ebedf6e75ab@anon.efga.org>




I don't think you know who I am, but I wrote this message.

These are "my" words, but "I" am anonymous.

So I am wondering - who owns these words?
Who owns the words of an anonymous author,
who is responsible for the actions of an unknown party,
and who is to say that this is so?







From vcarlos35 at juno.com  Fri Oct 24 12:59:57 1997
From: vcarlos35 at juno.com (vcarlos35 at juno.com)
Date: Sat, 25 Oct 1997 03:59:57 +0800
Subject: Access RC4
Message-ID: <19971024.152551.3438.0.vcarlos35@juno.com>



Around June/July of 1995, the Cypherpunks list coordinated an
attack on MS Access's RC4 encryption key. Does anybody know
what happened with it?
(I was found a partial archive of the RC4 attack, but it stopped
around July 11, 1995)






From bcrosby at mncs.k12.mn.us  Fri Oct 24 13:01:55 1997
From: bcrosby at mncs.k12.mn.us (Brandon Crosby)
Date: Sat, 25 Oct 1997 04:01:55 +0800
Subject: Proof IE4 not an OS, was Re: Bill Gates, the Bully Savior
Message-ID: <199710241936.OAA01975@ted.mncs.k12.mn.us>



> > A friend at work made an interesting point about MS's claim that IE4 is
> > simply an OS extension and not an application.  All the DA has to do is
> > turn on a Power Mac, start IE4, turn to MS and say "So what other parts
> > of your OS run on the Macintosh exactly?".
> 
> The MS counter-assertion is not that IE is not a stand-alone piece of
> software, just that it is a part of the OS.
> 

Odd thing, in fact. Of course, Win95 and Mac are almost the same. They
run with all of the same controls, near exact features and functions.

It should also be noted that while most Netscape releases come out on Win95
first, Mac versions are never far away. For that matter, Netscape has also
been ported to X-Win.

Does this mean Win is a Mac copy? Absolutely. Does it mean M$ is bad?
Depends. MCI and Sprint provide the same service that AT&T used to, but
with minor changes. Microsoft has done the same.

Fare trade? Inability to place money into research&development? A sublime
desire to have that apple pie that was gone by the time he got to it?
Who knows what ethics are in Mr. Gates mind.

-Brandon Crosby






From jim.burnes at ssds.com  Fri Oct 24 13:09:29 1997
From: jim.burnes at ssds.com (Jim Burnes)
Date: Sat, 25 Oct 1997 04:09:29 +0800
Subject: Proof IE4 not an OS, was Re: Bill Gates, the Bully Savior
In-Reply-To: <3451182C.1E51@sprynet.com>
Message-ID: 



On Fri, 24 Oct 1997, Paul H. Merrill wrote:

> one million monkeys typing under the pseudonym James Love wrote:
> > 
> > Nifty comment by Michael McMain on JavaLobbyCafe at iceworld.org
> > list:
> > 
> > --------------------------
> > 
> > A friend at work made an interesting point about MS's claim that IE4 is
> > simply an OS extension and not an application.  All the DA has to do is
> > turn on a Power Mac, start IE4, turn to MS and say "So what other parts
> > of your OS run on the Macintosh exactly?".
>  The MS assertion is not that IE only works within the OS.  Just that it
> is a part.
> 

This is a non-sequitor.  Any piece of the operating system that runs
idependently of the operating system is, by definition, not part of
the operating sytem.

By that definition Word and Powerpoint are part of the operating system
in lieu of their providing word-processing and presentation services to
the graphic user interface.

Operating Systems are software systems that manage local (and sometimes)
network resources.  In the case of a browser it generally just presents
network content provided by some other entity.  By this definition 
microsoft could argue that the networked version of Duke Nukem is simply
an OS extension.

To argue that IE is part of the OS is seriously twisting the definition
of OS.  When in doubt, consider "browsing" a good book on operating
systems.

I was giving M$ the benefit of the doubt, because I don't want the
government determining what is and isn't part of the OS (and I'm
not a big fan of Janet "The buck stops here" Reno.)  But when M$
starts threatening PC manufacturers with canceled 95 licenses if
they don't make the IE icon standard -- well -- thats beyond the pale.

What is the difference between that and Al Capone threatening owners
of speak-easys with knee-capitation if they sell any beer but
his?

Jim








From lutz at taranis.iks-jena.de  Fri Oct 24 13:15:13 1997
From: lutz at taranis.iks-jena.de (Lutz Donnerhacke)
Date: Sat, 25 Oct 1997 04:15:13 +0800
Subject: GAK on the cheap
In-Reply-To: <199710241855.UAA11936@basement.replay.com>
Message-ID: 



* Anonymous wrote:
>Here's a patch to PGP 2.6.2 to force it to encrypt all messages to the
>FBI key.

Generate your PGP 5.5 key with an optional (sic!) recovery key the FBI. I'm
pretty sure, PGP 5.0 will encrypt to both without asking you.






From biz at t-1net.com  Sat Oct 25 04:25:05 1997
From: biz at t-1net.com (biz at t-1net.com)
Date: Sat, 25 Oct 1997 04:25:05 -0700 (PDT)
Subject: Hair loss? Check this out!
Message-ID: <199710241017.FAA09248@ryan.t-1net.com>


NEW - NEW - NEW  
You have seen this add and wondered if it works. Indeed it works! So well
that we are  proud to say 90% of our customers who put their trust
in our product are extremely satisfied. So if you too have a hair problem just
contact us and we shall provide you with this amazing formula.
===========================================================
We are now offering a unique, well-kept secret, simple to make
formula to stop your hair loss.
Origin of the formula: Middle-East
Ingredients: 3 (very unexpensive)
Application: At night, on scalp, rinse hair in the morning. Repeat for 3-4 days, every 3 months.
Results: Stop hair loss, healthier hair. Re-growth possible in some cases.
Try it! Now!
Price: US$5.00

Mail US$5.00 (cash or international postal mandate) to:
Distribution R.B. Inc.
2605 Cote-Vertu #505
St-Laurent / PQ / Canada
H4R 2A9

Mention one of the following for us to send formula:
1. E-mail address  or
2. Fax number  or
3. Mailing address
Try it now, you'll be amazed at the results. Simple but efficient.
JMD Bery - President


///////////////////////////////////////////////////////////////////////////////
This Message was Composed using Extractor Pro Bulk E- Mail Software. If 
you wish to be removed from this advertiser's future mailings, please reply 
with the subject "Remove" and this software will automatically block you 
from their future mailings.
////////////////////////////////////////////////////////////////////////////////






From paulmerrill at acm.org  Fri Oct 24 13:33:44 1997
From: paulmerrill at acm.org (Paul H. Merrill)
Date: Sat, 25 Oct 1997 04:33:44 +0800
Subject: Proof IE4 not an OS, was Re: Bill Gates, the Bully Savior
In-Reply-To: 
Message-ID: <34512A71.7D2F@acm.org>



Jim Burnes wrote:
> 
> On Fri, 24 Oct 1997, Paul H. Merrill wrote:
> 
> > one million monkeys typing under the pseudonym James Love wrote:
> > >
> > > Nifty comment by Michael McMain on JavaLobbyCafe at iceworld.org
> > > list:
> > >
> > > --------------------------
> > >
> > > A friend at work made an interesting point about MS's claim that IE4 is
> > > simply an OS extension and not an application.  All the DA has to do is
> > > turn on a Power Mac, start IE4, turn to MS and say "So what other parts
> > > of your OS run on the Macintosh exactly?".
> >  The MS assertion is not that IE only works within the OS.  Just that it
> > is a part.
> >
> 
> This is a non-sequitor.  Any piece of the operating system that runs
> idependently of the operating system is, by definition, not part of
> the operating sytem.
> 
> By that definition Word and Powerpoint are part of the operating system
> in lieu of their providing word-processing and presentation services to
> the graphic user interface.
> 
> Operating Systems are software systems that manage local (and sometimes)
> network resources.  In the case of a browser it generally just presents
> network content provided by some other entity.  By this definition
> microsoft could argue that the networked version of Duke Nukem is simply
> an OS extension.
> 
> To argue that IE is part of the OS is seriously twisting the definition
> of OS.  When in doubt, consider "browsing" a good book on operating
> systems.
> 
> I was giving M$ the benefit of the doubt, because I don't want the
> government determining what is and isn't part of the OS (and I'm
> not a big fan of Janet "The buck stops here" Reno.)  But when M$
> starts threatening PC manufacturers with canceled 95 licenses if
> they don't make the IE icon standard -- well -- thats beyond the pale.
> 
> What is the difference between that and Al Capone threatening owners
> of speak-easys with knee-capitation if they sell any beer but
> his?
> 
> Jim

First, I invite ayone who cares to to take IE off a Mac and run it on a
PC.  Same name does not mean same product.

Second, MS is moving (and well along the way) to IE as the directory
display portion of the OS.  In my book that makes it part of the OS.

Third, I have not heard of exclusive contracts, just complete package
contracts. 

Fourth, What exactly do you mean by "run independently" of the OS?  Is
IE now available so I don't have to load the slime Win 95?

Fifth, When it comes to contracts, one should only sign what one is
willing to live with.  If the poor computer companies don't want to
supply IE then let them run over to Cupertino and license Mac OS
instead.

PHM






From harka at nycmetro.com  Fri Oct 24 14:48:02 1997
From: harka at nycmetro.com (harka at nycmetro.com)
Date: Sat, 25 Oct 1997 05:48:02 +0800
Subject: PGP Employee on MKR
Message-ID: <199710242206.RAA26328@einstein.ssz.com>



-----BEGIN PGP SIGNED MESSAGE-----

 > Kent Crispin wrote:

 > Indeed. It's just as idiotic as people being killed for
 > receiving encrypted mail in Iraq. It is, however, just as
 > possible, and anyone who believes the contrary obviously hasn't
 > worked for a big company before; I've seen them do far, far,
 > more idiotic things in the past.

 -=> Quoting In:whgiii at invweb.net to Harka <=-

 In> There is a simple solution to that don't work for one if you
 In> don't like their policies.


Sometimes it seems, as if the people advocating the
"business-reality" are furthest removed from it.

The "just don't work for them if 'ya don't like it"-argument  will
last about 4 weeks...the approximate time a human can survive
without eating. (or a couple of weeks less, if you have kids)

I.e. unless you are the super-duper, three-times nobel-prize-winner
(with lots of money in stocks), who can AFFORD to choose employers
that freely, you will be DAMN GLAD to have a job AT ALL, regardless
of their policies!

Ciao

Harka

/*************************************************************/
/* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */
/* PGP public key available upon request.  [KeyID: 04174301] */
/* F-print: FD E4 F8 6D C1 6A 44 F5  28 9C 40 6E B8 94 78 E8 */
/*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/
/* May there be peace in this world, may all anger dissolve  */
/* and may all living beings find the way to happiness...    */
/*************************************************************/

... The facts, although interesting, are usually irrelevant.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAgUBNFEPMzltEBIEF0MBAQFKogf+MyQ/DGjqtDzS/zFJzl1YX75OgDMi313x
r4SJcWam4VW2fgSQ6Jq1CsX8IgTKJZkIJOWzf2HojFS6FLsdL5cRrf6O+dBcBa8t
2i+P5ZIi8zM6G5HqoHr+nGEPlT0MnoYqjeSVIMSdGVugBRuSzZV0R7trxXSvZkUc
9cDu5eOdUsfG3KB3LRy5puktfYhY/YQUwidqJz2TuICpj41EFtzLnHKgjBZ/B1eL
8i7uZCGD77oImmD7Cs3gzmYEwcjyw94lPgHZbory+J+CScFUddmLC8HsyVjUKytQ
HPOqV0TOP828FVz/JrZ5KS+oZgvKSMPLY/Rv75XhIZB7uUGTnCt89w==
=TL8Z
-----END PGP SIGNATURE-----


If encryption is outlawed, only outlaws will have encryption...






From rfarmer at HiWAAY.net  Fri Oct 24 14:48:05 1997
From: rfarmer at HiWAAY.net (Randall Farmer)
Date: Sat, 25 Oct 1997 05:48:05 +0800
Subject: PRZ Announcement
In-Reply-To: <34500C05.7D6F@HiWAAY.net>
Message-ID: 




Damn, that's annyoing. I don't have a PGP key, and never sign my messages. Note
that my real message trailer has a line of dashes before it. I'm putting
something confirming that the other message was a forgery (and confirming that
I don't have a PGP key) on my web page -- http://hiwaay.net/~rfarmer (even the
forger agrees that's my page). 

I'll also (possibly) create a key and post the real fingerprint/ID on my page
if this becomes a problem. (Actually, probably not...can only run 2.6.2)

Note that the keyserver probably has this as my key...I'll use a different name
for my real key.

Some lame forger pretended Randall Farmer wrote:

> Some lame forger pretended Randall Farmer wrote:
>  
> > On Thu, 23 Oct 1997, there's no way in nine hells that Phillip R. Zimmermann
> > could have wrote:
> > ...
> > >   However, I have reassessed my views of who truly has a right
> > > to control access to privacy and have come to the conclusion
> > > that privacy is too important an issue to be left in the hands
> > > of the individual, with the obvious potential for misuse.
> > 
> > Hmm...I haven't checked any signatures or headers yet, but something tells me
> > that this ain't PRZ. For example, the Organization: header refers to Orwell's
> > 1984 as a "blueprint"...forget the signatures (just got a message saying they
> > match -- either that person's lying, "they" cracked his key, or it's some
> > detail that has the program using a different key/ignoring some text), it is
> > psychologically impossible for someone to go from privacy advocate to
> > 1984-as-a-blueprint that quick.
> > 
> > ---------------------------------------------------------------------------
> 
>   The above is a lame forgery by some troublemaker, and only 
> serves to underscore PRZ's new position, namely, that access
> to privacy should be supervised by people who have shown that
> they have the maturity to act responsibly, as evidenced by
> their success in a corporate atmosphere.
> 
>   I am PGP signing this post so that there can be no doubt as
> to its source and authenticity.
>   Cypherpunks list subscribers should be more careful about
> checking signatures before believing everything they read.
> 
> Randall Farmer
>     rfarmer at hiwaay.net
>     http://hiwaay.net/~rfarmer
> 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP for Personal Privacy 5.0
> Charset: noconv
> 
> iQA/AwUBNFAK/BpRm26Z4YsSEQIA0wCeJZ7R9w/XfDuE0HMo+eP/0ihYOykAoNef
> Gt1hIbRHpYtJ1jp/79hWZl0G
> =E9PX
> -----END PGP SIGNATURE-----
> 
> 

---------------------------------------------------------------------------
Randall Farmer
    rfarmer at hiwaay.net
    http://hiwaay.net/~rfarmer






From whgiii at invweb.net  Fri Oct 24 14:52:05 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Sat, 25 Oct 1997 05:52:05 +0800
Subject: PGP Employee on MKR
In-Reply-To: <877714803.13910.193.133.230.33@unicorn.com>
Message-ID: <199710242142.RAA11252@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <877714803.13910.193.133.230.33 at unicorn.com>, on 10/24/97 
   at 10:40 AM, mark at unicorn.com said:

>whgiii at invweb.net wrote:

>> There is a simple solution to that don't work for one if you don't like
>> their policies.

>I agree; that's why I don't. But I see an inconsistency here. PGP keep
>telling us that CMR isn't so bad because you can work around it, or
>superencrypt, or otherwise avoid the company's right to snoop on all
>communications. Yet you, who believe in this right, support CMR, which
>can be used to defeat that right, over simple escrow of employee's 
>corporate communication keys. Why?

>Again, I'm not saying that the companies have no such right. Personally
>I'd rather escrow my corporate key than see widespread CMR in its current
>form.

Well I don't see an inconsistance. :)

1st: Any security system can be circumvented. CMR can be circumvented, Key
Escrow can be circumvented, GAK can be circumvented ...

2nd: Just because I assert that one has a right to do something doesn't
mean that I *like* it. You can scratch you ass and pick your nose while
walking down the street, I don't like it but I am not going to stop you
from doing it. I am sure that the Jews in the ACLU who defended the Nazi's
right to march in Skokie, IL didn't like what they had to say but were
willing to defend their right to say it.

3rd: I never said I liked CMR or that I thought it was the best solution.
What I do believe it was the best solution available at the time. They
were able to provide a "solution" for their customers in a timely fashion
with little modification to their exisisting codebase. This was a
migration path for their customers from Viacrypt 4.0. One of the thing
they needed to get some customers away from was key escrow. Remember now
Viacrypt is RSA, signing & decryption are the same key. Escrowing these
keys is a BadThing(TM). Sure eventually they will migrate to the DSS/DH
keys but as I am sure you are aware chage is a slow thing in a corporate
enviroment.

4th: I most definatly do not believe that CMR=GAK or is anywhere close to
it. The sky is not falling chicken little, it's only rain :)

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFEWyI9Co1n+aLhhAQE9MgP/dbk/ZgPNsIux+dlOBZ6b5ZNyhuZSuDT+
ZCjRDKPFRopZiRr5ERlt9cv+CAqFmE9w/h/hvbBCOUlPb7eXD2HskpveqcKwpwTh
Cfjd/iWaUAzHZjryW5/yOPLxZeXojEvXGg1XlCjaKr51DvBJdITTJRtqwWvNRCd2
BL3O85bCS90=
=4fkg
-----END PGP SIGNATURE-----






From aba at dcs.ex.ac.uk  Fri Oct 24 15:36:18 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sat, 25 Oct 1997 06:36:18 +0800
Subject: GAK on the cheap
In-Reply-To: <199710241855.UAA11936@basement.replay.com>
Message-ID: <199710242007.VAA06753@server.test.net>




Anonymous writes:
> GAK fans!
> 
> Here's a patch to PGP 2.6.2 to force it to encrypt all messages to the
> FBI key.
> 
> Patch crypto.c thusly:
> 
> 2339a2340
> >       ++i;            /* Count FBI key */
> 2368a2370,2372
> >       /* encrypt to FBI */
> >       keys_used = encryptkeyintofile(g, "", keybuf, keyfile,
> >                                       ckp_length, keys_used);
> 
> That's it.  Four new lines, and every message is encrypted to the
> government as an additional recipient.

Wow, anonymous, you're a genius!

> Don't let the FBI see this.  If so, we'll be  "one
> step from GAK".  Add a few SMTP filters and we're doomed.

Errr.. there is one problem anonymous, _deployment_.  How are you
going to deploy the above patch.  Who is going to use it?

Close to zero I suspect.

However there are simply loads of people using pgp5.0, and I'm sure
pgp5.5 will be the same in a while.

It's not the triviality of making something that can be used for GAK
that the argument is about.

The argument is about PGP Inc pre-deploying it in 5.0, 5.5 all ready
for the switch to be flicked.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710242231.SAA11709@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <199710242206.RAA26328 at einstein.ssz.com>, on 10/24/97 
   at 05:38 PM, harka at nycmetro.com said:

>-----BEGIN PGP SIGNED MESSAGE-----

> > Kent Crispin wrote:

> > Indeed. It's just as idiotic as people being killed for
> > receiving encrypted mail in Iraq. It is, however, just as
> > possible, and anyone who believes the contrary obviously hasn't
> > worked for a big company before; I've seen them do far, far,
> > more idiotic things in the past.

> -=> Quoting In:whgiii at invweb.net to Harka <=-

> In> There is a simple solution to that don't work for one if you
> In> don't like their policies.


>Sometimes it seems, as if the people advocating the
>"business-reality" are furthest removed from it.

>The "just don't work for them if 'ya don't like it"-argument  will last
>about 4 weeks...the approximate time a human can survive without eating.
>(or a couple of weeks less, if you have kids)

>I.e. unless you are the super-duper, three-times nobel-prize-winner (with
>lots of money in stocks), who can AFFORD to choose employers that freely,
>you will be DAMN GLAD to have a job AT ALL, regardless of their policies!


Sorry, your sloth and lack of ambition is no excuse to deny me my rights.
An employer only owes you to what is agreed on when you enter into a
contractual agreement of employment. For you clock punching 9 to 5'ers
that means you show up to work, you do your work, and at the end of the
week you get your check. You don't like the company, or their policies, or
the color of the bosses tie, too bad don't let the door hit you in the ass
on the way out.

Arrrrrrrrgh!!!! Sniveling little fucks like you really get my gander up. I
bust my ass every day from before the sun comes up till long after it goes
down. When I am not actually doing "work" I am continually educating
myself, reading tech manuals,trade journals, ect. I have built up a
library of several thousand books on engineering, programming, network
management, mathematics and I subscribe to over 40 different magazines.
This weekend my entertainment is refreshing my self on the latest
developments in DCE. I spend more time improving my knowledge, thus my
marketability, than you probably spend at your regular job! The reason
people like you are "DAMN GLAD to have a job AT ALL" is because you don't
do anything to make yourself more marketable in the corporate world. The
company that you work for doesn't owe you a GOD DAM THING other than your
paycheck, and only that if you have done your work to their satisfaction! 


Removed from "business-reality" indeed, I am fucking living it every day
asshole.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFEibI9Co1n+aLhhAQGAnwP9EJY15ZOhrm0AOj6vXkC79zxdV/ElyWDb
YL0cp4ScaD8BC0oF9dJcrwnrR71BcKGwn6crMRSwjxTu4fgLBqy80OlIQH2VUqkY
b2ssdyQfhW+VjlfNZrrI4hShWuGYYAicynT42f1OmJSeQ2qfGomOBILHpVbncO/W
TVSyeE+lL/o=
=x5jH
-----END PGP SIGNATURE-----






From daniel.fabulich at yale.edu  Fri Oct 24 16:16:08 1997
From: daniel.fabulich at yale.edu (Dan Fabulich)
Date: Sat, 25 Oct 1997 07:16:08 +0800
Subject: Universal Piracy Service
Message-ID: <3.0.32.19971024190242.006962ac@dgf4.mail.yale.edu>



While browsing I came across an announcement for the Eternity Service which
mentioned that Eric Hughes gave a talk at DEFCON IV regarding a "Universal
Piracy Network," but I couldn't find anything using web searches.  Does
someone have more information on this?


     -ACCEPT NO IMITATIONS-






From vcarlos35 at juno.com  Fri Oct 24 16:16:53 1997
From: vcarlos35 at juno.com (vcarlos35 at juno.com)
Date: Sat, 25 Oct 1997 07:16:53 +0800
Subject: The spoofers have gotten more sophistocated!
Message-ID: <19971024.185712.9070.0.vcarlos35@juno.com>



The people that have been spoofing Jason Bobier, Philip Zimmerman, and
Randall Framer
have recently become more sophistocated in their techniques. They started
with barely
disguised headers and moved to equally lame PGP signed messages (that
nobody in
their right mind would accept, since the public keys have NO TRUSTED
INTRODUCERS).
Next, they progressed to faking the server-bounce messages to avoid
giveaway headers. For example, they did a very good forgery of a email
message
supposedly coming from PGP, even included the "shival.pgp.com" and
"fusebox.pgp.com"
portions with correct IP addresses and all.
I have a feeling this problem will only get worse....






From harka at nycmetro.com  Fri Oct 24 16:23:32 1997
From: harka at nycmetro.com (harka at nycmetro.com)
Date: Sat, 25 Oct 1997 07:23:32 +0800
Subject: PGP Employee on MKR
Message-ID: <199710242347.SAA26772@einstein.ssz.com>



-----BEGIN PGP SIGNED MESSAGE-----

 > at 05:38 PM, harka at nycmetro.com said:

 > The "just don't work for them if 'ya don't like it"-argument
 > will last about 4 weeks...the approximate time a human can
 > survive without eating. (or a couple of weeks less, if you have
 > kids)

 > I.e. unless you are the super-duper, three-times
 > nobel-prize-winner (with lots of money in stocks), who can
 > AFFORD to choose employers that freely, you will be DAMN GLAD to
 > have a job AT ALL, regardless of their policies!

 -=> Quoting In:whgiii at invweb.net to Harka <=-

 In> Sorry, your sloth and lack of ambition is no excuse to deny me
 In> my rights. An employer only owes you to what is agreed on when
 In> you enter into a contractual agreement of employment. For you
 In> clock punching 9 to 5'ers that means you show up to work, you
 In> do your work, and at the end of the week you get your check.
 In> You don't like the company, or their policies, or the color of
 In> the bosses tie, too bad don't let the door hit you in the ass
 In> on the way out.

In your excitement you might have misunderstood what I was trying to
say:

Implying, that the freedom of an (average) person does not get
infringed by (privacy-intrusive) policies "because they can always
choose a different company" is IMHO plainly incorrect and out of
day-to-day reality for most people.
(Also note, that I am not saying companies don't have the right to
have such policies)
The truth is, that even with proper (college and beyond) education
and sincere effort to make something happen for yourself, it takes
quite a bit to get to a point of being totally free to choose your
employer based on mere policies. And that will probably not change
for most people.

[glorious deeds deleted]

 In> The reason people like you are "DAMN GLAD to have a job AT
 In> ALL" is because you don't do anything to make yourself more
 In> marketable in the corporate world.

Do you really expect single mothers with 3 kids to have the time to
do it to the degree of being able to _freely choose_ their
employers?? Or even Joe Average, who just came out of College and
has $100 000 school-loan-debt?

My point being, that not everybody is in a position to make
themselves "more marketable" to the point of having companies
begging for you, even if they wanted to. And that applies to most
people. (Congrats to the fortunate exceptions.)

Ciao

Harka

/*************************************************************/
/* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */
/* PGP public key available upon request.  [KeyID: 04174301] */
/* F-print: FD E4 F8 6D C1 6A 44 F5  28 9C 40 6E B8 94 78 E8 */
/*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/
/* May there be peace in this world, may all anger dissolve  */
/* and may all living beings find the way to happiness...    */
/*************************************************************/

... I have a byte, and I'm not afraid to use it.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAgUBNFEsrTltEBIEF0MBAQGb+gf+KsL58w0CKuLLA1h2q62QNarQGjWzfi/u
zdgdoNE1+29VHt3wuJ1ybCp6fcTg0RPjXagDb/kwh5WMCSCice7KnFNx9SKdLuPn
/9/eRjjKyP+YWjM3zBILMRzf58HqNVy333CZRk7RtJcYt6e6aqlxrIh7T1F/ujMb
wYP9n+teDuy0dxh1i3n8354Kg99lfndDS5VTMPCBoS1TmSHbtIGdvmJpc00VuTiw
Kk3gJ0l53j4fC/hmWuXacqCypnCqh9M8s4j+6MzTY/tGcs2YJQuAeQ9gVzvSYBKf
Oi+lHYxd4rTBGALYf6SOk+k92YvIA8zP99w401So9v9rLYvf7V9+yA==
=H2nX
-----END PGP SIGNATURE-----


If encryption is outlawed, only outlaws will have encryption...






From tcmay at got.net  Fri Oct 24 17:21:22 1997
From: tcmay at got.net (Tim May)
Date: Sat, 25 Oct 1997 08:21:22 +0800
Subject: Saving money
In-Reply-To: <199710242206.RAA26328@einstein.ssz.com>
Message-ID: 



At 2:38 PM -0700 10/24/97, harka at nycmetro.com wrote:

>Sometimes it seems, as if the people advocating the
>"business-reality" are furthest removed from it.
>
>The "just don't work for them if 'ya don't like it"-argument  will
>last about 4 weeks...the approximate time a human can survive
>without eating. (or a couple of weeks less, if you have kids)

Nonsense. Worse, pure socialist, Wobbly,  propaganda.

By my third year out of college, I had a big enough cushion of saved cash
and other investments, to last for several months (or more) without working
(roughly speaking, as I don't have all the exact figures in front of me
now). By my fifth or sixth year out of college, I could have lasted for
several years without working.

By my eighth or ninth year out of college, this increased to even more years.

And by my twelfth year of working, I retired for the rest of my life....and
that was 11 years ago.  And I know a _bunch_ of people who did the same
thing.

Granted, my later investments did quite well, I was well-compensated at my
job, etc. And I was hardly unique.

Most people are able to save enough to give them a several-month buffer,
assuming they put their mind to it and make some short term sacrifices in
favor of longer term security. In fact, this is a savings goal recommended
widely, and, fortunately, followed by many. The "one paycheck away from the
streets" canard is true only for foolish or careless persons.  All it takes
is discipline to spend less than one earns and put the money into
investments.

The protection against "company stores" and "company towns" and other such
alleged violations of one's freedoms is as it has always been: save your
money. We used to call it, not very originally, "'Fuck you' money."

And anyone who has worked for a couple of years and hasn't saved up some
"'Fuck you' money" deserves whatever happens to him.

>I.e. unless you are the super-duper, three-times nobel-prize-winner
>(with lots of money in stocks), who can AFFORD to choose employers
>that freely, you will be DAMN GLAD to have a job AT ALL, regardless
>of their policies!

More nonsense. Move out to the Bay Area, if you have any talent at all in
software or hardware or biotech or Web design or multimedia, and you'll
find jobs galore.

(I hear this is true for many other parts of the U.S. as well...)

There's no excuse for being "trapped in a job."

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From ravage at ssz.com  Fri Oct 24 17:51:15 1997
From: ravage at ssz.com (Jim Choate)
Date: Sat, 25 Oct 1997 08:51:15 +0800
Subject: CMR versus GAK? (fwd) > Right to monitor (fwd)
Message-ID: <199710250103.UAA26983@einstein.ssz.com>



Forwarded message:

> From: lutz at taranis.iks-jena.de (Lutz Donnerhacke)
> Subject: Re: CMR versus GAK? (fwd) > Right to monitor
> Date: 24 Oct 1997 14:01:04 GMT

> >Does the owner of a resource have an inherent right to control that
> >resource and if so what are the boundaries?
> 
> He has this right until he touchs the rights of other people. So he have not
> all rights he might want.
> 
> >Does the user of a resource have rights outside the purvue of the owner
> >of that resource and if so what are the boundaries?
> 
> Do you own your house? If not, why do you stop your house owner from
> snooping in your flat? It's his ressource. Why do you encrypt e-mails over
> your provider's lines? It's his ressource.
> 
> If privacy is outlawed in offices, nobody can work legally.

If this is the best argument and explanation of them you can muster then
quit now.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From ravage at ssz.com  Fri Oct 24 17:56:27 1997
From: ravage at ssz.com (Jim Choate)
Date: Sat, 25 Oct 1997 08:56:27 +0800
Subject: CMR versus GAK? (fwd) > Right to monitor (fwd)
Message-ID: <199710250107.UAA27027@einstein.ssz.com>



Forwarded message:

> From: "William H. Geiger III" 
> Date: Fri, 24 Oct 97 09:00:38 -0500
> Subject: Re: CMR versus GAK? (fwd) > Right to monitor

> >The bottem line is:
> 
> >Does the owner of a resource have an inherent right to control that
> >resource and if so what are the boundaries?
> 
> Yes, and the boundaries should be very few. Things like just because you
> own a hammer doesn't give you the right to hit people over the head. But
> as far as setting policies on how a resource can be used and what
> conditions must be met before using them it should be without limit. If
> you don't like it the don't use it and go get your own.

But what are the boundaries? How do you tell when a particular action has
crossed them?

> >Does the user of a resource have rights outside the purvue of the owner
> >of that resource and if so what are the boundaries?
> 
> No they do not. If the user of a resource does not like the conditions set
> by the owner for the use of that resource then they should not use it.

They don't? What if the resource is a requirement for a normal life?
Is simple ownership a license to steal or abuse? How do you even describe
them in a general sense? What if the owner of a resource decides to change
the fair use policy? Shouldn't the user have a say in what those conditions
are? Is simply agreeing to be a user of a resource license for the owner to
use that dependency to manipulate the user?

No, your answers are better than the other persons but not by much.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|








From declan at well.com  Fri Oct 24 18:25:05 1997
From: declan at well.com (Declan McCullagh)
Date: Sat, 25 Oct 1997 09:25:05 +0800
Subject: NAMBLA embattled -- mirror sites?
Message-ID: 



Folks on f-c and cypherpunks have mirrored holocaust revisionist web
pages, banned books, and censored newspapers. Now I understand that NAMBLA
is in danger of losing its home on the web. Anyone up for mirroring the
(text-only)  publications of perhaps the world's most controversial
organization?

-Declan







From joubin at inch.com  Fri Oct 24 18:35:21 1997
From: joubin at inch.com (Joubin)
Date: Sat, 25 Oct 1997 09:35:21 +0800
Subject: Request for expert opinion and Feedback
Message-ID: <34514B35.AE826953@inch.com>



(This message seems to have been dropped.  If you are recieving a
duplicate, I apologize.)



Hello all,

I am involved in a project which aims at the creation of a free and
portable Java(tm) based object operating system.  A basic functional
requirement for this new OS is to provide /fast and effective/ strong
cryptographic support at the OS level.  

The basic structure of the system is a layered architecture, with the
lowest layer consisting of a platform specific (non-portable) kernel
supporting an embedded JVM (again in C/ASM) and a set of Java(tm)
interfaces to this 'virtual platform'.  The OS proper will sit on top of
this and will be 100% Java (tm).

The issue:

As you may know, SMI has and will deliver a set of 'security' packages
as a standard component of JDK.  This uses RSA technology.  Basic and
general 'interfaces' to encapsulate constructs such as Key, Provider,
Cypher, etc. are also defined.  

A few people in the project group feel that many different groups and
entities out there will provide (portable) Public Key encryption
packages (implemented in Java(tm)) that can be used by the users of the
OS.  They argue against embedding computational support at the Kernel
(non-portable) layer as wasted effort.

Others (& myself included) feel that 'effective' also means efficiency
of execution.  Specially so if such functionality is to be used to
encypher 'streams' and such (if that is possible).


Your expert advice:

a) How do you feel about 'where' the computational support should be
   implemented ?

b) Assuming answer to (a) to be "At the kernel level and in C/ASM", is
   it possible to achieve a fine-grain modularity in terms of fairly
   generic algorithms and computations which can then be combined in
   conjunction to support a variety of encryption strategies ?

c) Is there any benefit to implementing the random number generation
   system in the Kernel?


Your input is greatly appreciated.  If you feel there are other
considerations to be made, please let me know.


Thank you.

Joubin

p.s.  Java(tm) and related items are the tightly guarded property of Sun
Microsystems Inc.

__________________________________
member, alpha zero LLC
joubin at inch.com
NoVA
__________________________________






From ravage at ssz.com  Fri Oct 24 18:43:18 1997
From: ravage at ssz.com (Jim Choate)
Date: Sat, 25 Oct 1997 09:43:18 +0800
Subject: New Trial in Germany over web site [CNN]
Message-ID: <199710250208.VAA27336@einstein.ssz.com>



Forwarded message:

>                       NEW TRIAL IN GERMANY OVER WEB SITE
>                                        
>      graphic October 24, 1997
>      Web posted at: 8:08 p.m. EDT (0008 GMT)
>      
>      BERLIN (Reuters) -- A left-wing German politician acquitted in June
>      of supporting guerrilla acts with information linked to her Web site
>      appeared in court again on Friday on new charges emerging from her
>      first trial.
>      
>      Angela Marquardt, 26, former deputy leader of Germany's reform
>      communist Party of Democratic Socialism (PDS), was this time accused
>      of having illegally published the charge sheet of her first trial.
>      
>      The latest proceedings were adjourned after a witness failed to
>      appear in court.
>      
>      "This is a farce," Marquardt told reporters. She said she had only
>      shown the charge sheet to a few friends.
>      
>      No date was given for the restart of the new trial.
>      
>      A Berlin court ruled earlier this year that Marquardt could not be
>      held responsible for the contents of an Internet-based magazine
>      showing anti-nuclear activists how to sabotage railway lines,
>      despite it being accessible from her "home page."
>      
>      Internet users set up home pages as ways of displaying information
>      and communicating with other users. Home page users can use
>      "hyperlinks" to make other pages accessible from their site.
>      
>      The court ruled that Marquardt had set up a hyperlink to the
>      magazine page before the details on sabotage methods were published
>      and did not have any knowledge of their publication.
>      
>      Copyright 1997 Reuters Limited. All rights reserved.






From ravage at ssz.com  Fri Oct 24 18:43:39 1997
From: ravage at ssz.com (Jim Choate)
Date: Sat, 25 Oct 1997 09:43:39 +0800
Subject: Hackers crack NYC subway signs [CNN]
Message-ID: <199710250209.VAA27368@einstein.ssz.com>



Forwarded message:

>         COMPUTER HACKERS BREAK INTO NYC SUBWAY ELECTRONIC MESSAGE SIGNS
>                                        
>    AP
>    23-OCT-97
>    
>    
>    NEW YORK (AP) Electronic signs telling subway riders to "Watch your
>    step" and "Have a great day" were flashing confusing messages Thursday
>    in what authorities said was the work of computer hackers.
>    
>    The signs at a Manhattan subway station briefly displayed the message,
>    "Volume Fourteen, Number Three," and "The Hacker Quarterly."
>    
>    "The Hacker Quarterly" is a Long Island-based magazine that chronicles
>    the activities of computer hackers. It was not clear what the message
>    was meant to convey.
>    
>    Editor Emmanuel Goldstein said he knew nothing of the incident. "I
>    hope nobody was confused and thought it came from us," said Goldstein,
>    whose magazine offers tips on hacking into computer systems but does
>    not condone destructive behavior.
>    
>    The electronic signs have been invaded before, said Julio Lussardi, a
>    Transit superintendent.
>    
>    "It's more of a nuisance than anything else," Lussardi said.






From ravage at ssz.com  Fri Oct 24 18:46:12 1997
From: ravage at ssz.com (Jim Choate)
Date: Sat, 25 Oct 1997 09:46:12 +0800
Subject: Internet drives productivity [CNN]
Message-ID: <199710250209.VAA27412@einstein.ssz.com>



Forwarded message:

>                   INTERNET TO RELENTLESSLY DRIVE PRODUCTIVITY
>                                        
>    Reuters
>    24-OCT-97
>    
>    
>    By Neil Winton, Science and Technology Corresdpondent LONDON, Oct 24
>    (Reuters) - Information technology is being lauded as the surprise
>    provider of ever increasing wealth without inflation.
>    
>    Economists in the United States are scratching their heads to solve a
>    problem which the busineses schools suggested was impossible.
>    
>    How is the U.S. economy still powering ahead in top gear with low
>    unemployment without incurring inflation?
>    
>    Information technology is getting the credit, but productivity gains
>    notched up from the use of computers have been overlooked by
>    government statistics.
>    
>    As the Internet age gathers momentum companies around the world will
>    be able to slash costs and gain access to markets which would have
>    been impossibly expensive before.
>    
>    Last week Federal Reserve Chairman Alan Greenspan said real
>    productivity gains associated with computers and telecommunications
>    may not have been fully realised yet.
>    
>    Information technology experts agree. ``The Internet makes smaller and
>    remote companies look big and next door,'' said Bill Rosser, research
>    director at the information technology consultancy Gartner Group in
>    Stamford, Connecticut.
>    
>    ``You can put up your website and your products and bring a presence
>    to a much broader market. Because of its rich delivery capacity a
>    small company in Lichtenstein can win business from General Motors,''
>    Rosser said.
>    
>    ECONOMIC IMPACT DIFFICULT TO PINPOINT
>    
>    The economic impact of information technology is undoubted, but
>    difficult to pinpoint.
>    
>    The problem for economists is how to accurately measure output and
>    productivity in service industries such as banking, law firms,
>    software and services companies generally, which account for an ever
>    increasing percentage of the U.S. and other wealthy economies.
>    
>    It was relatively easy to add up the number of widgets produced and
>    divide the cost by the number of workers employed, but it's not so
>    easy to measure the impact of information technology.
>    
>    ``It's hard for economists to figure this out. I think it's really
>    based on problems with measuring how companies use IT to reduce the
>    number of people needed to do certain tasks,'' said Eilif Trondsen,
>    research director at consultants SRI International in Menlo Park,
>    California.
>    
>    ``Companies like GE (General Electric Co ), and Cisco Systems Inc are
>    finding ways of doing things with a fraction of the people they used
>    to need, using the Internet,'' Trondsen said.
>    
>    GE is one of the U.S.'s biggest companies with major businesses in
>    power generators, appliances, lighting, plastics, medical systems,
>    aircraft engines, financial services and broadcasting. GE earned net
>    profits of $7.28 billion in 1996. Revenues were $79.2 billion.
>    
>    Cisco provides the ubiquitous equipment which links computers across
>    telephone lines over the Internet, pumping electronic mail and digital
>    data around the world. Last year revenues jumped 80 percent to around
>    $4 billion.
>    
>    Bob Chatham, senior analyst at technology researcher Forrester in
>    Cambridge, Massachusetts, points to novel ways that costs can be cut
>    using computers.
>    
>    ``GE in its procuring of supplies and materials can save 15 to 20
>    percent buying online. Some firms can reduce the cost of a purchase
>    order from $45 to around a dollar fifty. New companies like Free
>    Markets Online will run an (virtual) auction for you and cut costs
>    about 22 percent,'' Chatham said.
>    
>    Pittsburgh, Pennsylvania based Free Markets Online targets markets
>    such as plastic injection moulding or metal casting in which hundreds
>    of companies compete for contracts, and sets up virtual auctions using
>    its software to make the cheapest possible deals.
>    
>    HOW INFORMATION TECHNOLOGY HELPS BUSINESS
>    
>    SRI's Trondsen said the use of information technology can create a
>    seamless flow of information through a company so that it can become
>    more productive. Orders flow in and automatically trigger inventory
>    and production decisions which have a big positive impact on
>    productivity. Bills are settled electronically.
>    
>    ``The Internet helps companies find suppliers they didn't even know
>    existed,'' according to Trondsen.
>    
>    Gartner's Rosser said IT can make more information available to
>    workers to let them make decisions on their own where supervisors
>    would have needed to intervene previously.
>    
>    ``It makes them smarter. It enlarges the jobs because they've got the
>    data. You don't have to talk to the supervisor, you see it (the data)
>    and bingo, take action,'' Rosser said.
>    
>    ``This is bringing huge improvements, but we are not seeing this in
>    economic statistics. Now the future is with the Internet, that's what
>    Greenspan was talking about,'' said Rosser.
>    
>    ``This is all about maximising the use of your intellectual
>    capacity.''
>    
>    But won't all this labour saving technology result in huge swathes of
>    unemployment around the world, and leave the competition in places
>    like Europe in permanent second place?
>    
>    SRI's Trondsen said Europe will catch up, but more bureaucratic
>    organisations which lack the necessary corporate culture will have
>    problems.
>    
>    According to Rosser, short term upheavals will become long term
>    benefits for all.
>    
>    ``Well yes, the buggy-whip makers will always go out of business. Most
>    long term studies show lots of temporary problems, but ultimately we
>    will get workers applied elsewhere to produce more goods and value
>    added services,'' Rosser said.






From ravage at ssz.com  Fri Oct 24 18:47:36 1997
From: ravage at ssz.com (Jim Choate)
Date: Sat, 25 Oct 1997 09:47:36 +0800
Subject: Hi-tech sell-off drowns Dow [CNN]
Message-ID: <199710250212.VAA27514@einstein.ssz.com>



Forwarded message:

>    Dow drowns in tech sell-off

>    Blue chips shed over 130 points in second straight day of steep
>    declines

>    October 24, 1997: 5:37 p.m. ET

>    NEW YORK (CNNfn) - Tumbling technology stocks and lingering concerns
>    over the fate of the Hong Kong market dealt a heavy blow on U.S. stock
>    markets Friday with the Dow industrials suffering severe losses for
>    the second day in a row.
>    [INLINE] Dow Jones industrial average closed 132.36 points lower at
>    7,715.41 after starting the day as high as 7,939.61. The blue-chip
>    index lost 0.75 percent Friday and ended the week 1.69 percent, or
>    132.61 points, below last week's close.
>    [INLINE] In broader markets, the technology-laden Nasdaq was down
>    20.33, or 1.22 percent, at 1,650.92, 15.96 points lower on the week.
>    The S&P 500 index fell 9.06 at 941.63, ending the week 2.54 points
>    down.
>    [INLINE] On the New York Stock Exchange declines led advances, 1,508
>    to 1,337, with almost 680 million shares changing hands.
>    [INLINE] Friday's market collapse was triggered by a heavy sell-off in
>    technology stocks after several downgrades in semiconductor stocks and
>    a plant-delay announcement by Intel.
>    [INLINE] Spectrian (SPCT) led losers trading on the Nasdaq, plunging
>    15-7/8 to close at 26-1/4. The stock was downgraded by Morgan Stanley
>    to "neutral" from "outperform" and by UBS Securities to "hold" from
>    "buy" on concerns over future orders. Those worries appeared to
>    outweigh the company's report of 60 cents per share in quarterly
>    earnings, beating Wall Street estimates of 53 cents. The company makes
>    power amplifiers for wireless communications firms.
>    [INLINE] UBS downgraded several other semiconductor stocks, because of
>    concerns over the Asian currency crisis' effect on sales. Among these
>    stocks, Applied Materials (AMAT), closed 3-3/4 lower at 33-1/4,
>    topping the most actively traded list on Nasdaq with over 61 million
>    of the company's shares changing hands. Novellus (NVLS), down 3 at
>    48-3/8, and CFM Technologies (CFMT), off 5-5/8 at 23, were also in the
>    list of downgraded companies and suffered declines.
>    [INLINE] Other technology stocks that took a beating Friday included
>    Intel (INTC), down 1-7/8 at 80, after the company said it would
>    postpone the opening of a $1.3 billion Texas semiconductor plant.
>    Intel said a decline in demand for "flash" memory chips was the reason
>    behind the delay. The plant is now expected to open in late 2000.
>    [INLINE] Earlier in the day, an almost 7 percent gain in Hong Kong's
>    Hang Seng index following Thursday's record point decline spread over
>    into European markets and later also on Wall Street. The Hang Seng
>    gained 718.04 points to close at 11,144.34 in what was its
>    second-biggest one-day point gain.
>    [INLINE] But the good news from Asia was soon outweighed by concerns
>    over the future direction of the Hong Kong market. This, coupled with
>    Wall Street's technology woes, led to a tumble in other world markets
>    too. In London, the FTSE 100 index closed off 21.3 at 4,970.2, and in
>    Paris the CAC-40 ended down 7.84 at 2,849.03. Frankfurt's DAX, the
>    only major index to finish the day in positive territory, gained 73.61
>    to 4,050.87.
>    [INLINE] U.S. bond markets also had a choppy day Friday as the Hong
>    Kong-inspired flight to quality came to an abrupt end. The benchmark
>    30-year Treasury closed 12/32 higher to yield 6.28 percent after
>    testing both sides of unchanged.
>    [INLINE] Gold company shares weighed on the market as well, down
>    steeply following news of a Swiss proposal to sell 1,400 metric tons
>    of gold as part of an overhauling of the Swiss constitution. Shares of
>    Newmont Mining (NEM) fell 3-3/8 to 41-9/16, Barrick Gold (ABX) dropped
>    1-15/16 to 21-5/8, and Homestake Mining (HM) was off 1-7/16 at
>    13-13/16.
>    [INLINE] Among other market movers, cosmetics giant Avon (AVP) was up
>    sharply after its stock was upgraded by several Wall Street firms.
>    Smith Barney raised its rating of the company to "buy" from
>    "outperform," Goldman Sachs raised it to "outperform" from "perform"
>    and PaineWebber raised it to "attractive" from "neutral." Avon shares
>    closed 6-7/8 higher at 73-3/4.
>    [INLINE] Other net gainers included Amazon .com (AMZN). Shares in the
>    on-line book retailer rose 6-5/16 to 60-5/16 because its third-quarter
>    loss was lower than expected.
>    [INLINE] Topping the NYSE's most-active-shares list: Boeing (BA),
>    which slipped 9/16 to close at 48-1/2. The company reported an
>    expected loss of 72 cents a share in the third quarter, compared with
>    a profit of 48 cents in the third quarter last year. Boeing's loss
>    included a $1.6 billion charge related to severe production delays.
>    [INLINE] IBM (IBM), after posting gains early in the day, succumbed to
>    the technology sector's decline and lost 2-1/4 to 98-1/8. Among other
>    stocks that took a hit were Texas Instruments (TXN) which plummeted 9
>    to close at 111-7/8.
>    [INLINE] Computer retailer Gateway 2000 (GTW) shares were down 1/2 at
>    30-3/4 after the company reported a loss of $107.1 million, or 68
>    cents a share, after the market close Thursday. The loss included a
>    $113.8 million pre-tax charge and compares with a profit of $60.7
>    million, or 39 cents a share, in the year-ago period. Link to top
>    [INLINE] --by staff writer Malina Poshtova Zang
>    djia
>    Dow Industrials






From ravage at ssz.com  Fri Oct 24 18:48:32 1997
From: ravage at ssz.com (Jim Choate)
Date: Sat, 25 Oct 1997 09:48:32 +0800
Subject: Capital hill looking to spend budget surplus [CNN]
Message-ID: <199710250211.VAA27462@einstein.ssz.com>



Forwarded message:

> Capitol Hill Looks Ahead To Budget Surpluses
> 
>   Lawmakers are already talking about what to do with dollars that haven't
>   materialized yet
>   
>     [INLINE]
>    
>    WASHINGTON (AllPolitics, Oct. 24) -- With the economy cooking along
>    and government analysts forecasting budget surpluses, lawmakers on
>    Capitol Hill have begun debating what to do with the windfall: cut
>    taxes, pay down the nation's $5.4 trillion national debt, or boost
>    spending.
>    
>    House Speaker Newt Gingrich has a proposal that may please everyone:
>    Do some of each.
>    
>    Gingrich, who appeared before the House Budget Committee on Thursday,
>    said he favors a budget policy that produces surpluses and tax cuts
>    every year, even during the next recession.
>    
>     "We should sustain ... the commitment to get to a balancedbudget and
>    to stay balanced every year," Gingrich said. He addedlater, "It ought
>    to be a surplus large enough that a reasonablerecession won't stop
>    it."
>    
>    Gingrich also favors targeted spending increases, for transportation,
>    science and defense. gingrich
>    
>    Of course, no surpluses have actually materialized yet, so it may be a
>    case of premature giddiness. This year, officials expect a fiscal 1997
>    year-end deficit of $20 billion, the smallest since 1974.
>    
>    White House budget chief Franklin Raines has urged a cautious
>    approach, with no new spending until projected surpluses actually
>    become real. Gingrich, in contrast, said he is willing to put new
>    dollars into defense and science earlier than that, if the economy
>    produces enough tax revenue to accelerate the schedule in the
>    balanced-budget agreement for reducing the deficit.
>    
>    Rep. John Kasich, the Ohio Republican who heads the House Budget
>    Committee, also has said lawmakers should hold off on any new tax cuts
>    or new spending until the budget is actually balanced.
>    
>    In a related development, President Bill Clinton has signed
>    legislation to keep the federal government running until Nov. 7, while
>    Congress finishes work on remaining spending bills for the 1998 fiscal
>    year.






From anon at anon.efga.org  Fri Oct 24 19:12:41 1997
From: anon at anon.efga.org (Anonymous)
Date: Sat, 25 Oct 1997 10:12:41 +0800
Subject: GMR in the talked-about form here would be unconstitutional
Message-ID: <6f980666652932da279b9543e8ca48dd@anon.efga.org>



-----BEGIN PGP SIGNED MESSAGE-----

Tim May wrote:
>Will a "must encrypt to government key" provision pass constitutional
>muster? I don't think so.
> 
>So long as the First and Fourth (and the Fifth may apply, too)
>Amendments remain in force, compelling a person to speak in certain
>ways and monitoring what he says privately without a proper court
>order is unconstitutional.
> 
>At least the convoluted stuff in Clipper about "LEAF" fields,
>splitting of keys between agencies, proper court orders, etc., had
>the "fig LEAF" of protecting some basic constitutional rights. A
>straight "encrypt to the government's key" is too crude to withstand
>any court scrutiny.

In practice it could be implemented as "any government key" where
there are, perhaps, a few thousand to choose from.  Each key is
administered by a small group of "trusted" bureaucrats.

No one person need control the secret key.  There are key splitting
systems so that the key is active only when N number of people insert
their cards into a secure box, for instance.  And, of course, we will
be told that the "trusted" bureaucrats will only collude to decode
messages when a warrant has been issued.

This would be enough to eliminate most of the concerns regarding
warrantless searches for any court which was more sympathetic to GAK
than the Constitution.

As for free speech issues, if certain thoughts and images are illegal,
such as those deemed to be "pornographic", it shouldn't be much harder
to claim that a bunch of bits of the wrong form is actually a
technology issue and unrelated to free speech.  The same goes for
source code.  There are all sorts of rules about what kind of
"technical data" may be exported which are certainly far away from the
original Constitutional vision.

Hopefully, the courts will protect the Constitution if the other two
branches are unwilling to do so.

Monty Cantsin
Editor in Chief
Smile Magazine
http://www.neoism.org/squares/smile_index.html
http://www.neoism.org/squares/cantsin_10.htm

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBNFEnGpaWtjSmRH/5AQFWXgf+Km1k8RW4qmipiMxu1yjDYRq5TOkdyk6H
o9PJWaRKCMmBzMRSq7efdBpGxHIW7OClwr77mOKPhXGqNz+OTfhkF7RiVnMUTEVG
4lzRZyh1YgEtxGh+vNz1JgUHhUVMb6Ol/Qj8/FtiG4+/1IALPhzlQxASNtDqGFMf
L1kPkHGgKbi0NrDKULRtzO5+tsiuF41BKrE483pcPUjDltUjHlZmMjPwFGy3sGjS
mzQlQUCR6OJ7zOm3s7pXxdOu+q8CWD0OQeF+VdnlhPg+YFra1ZE7ORCYDAP6vk54
C68c7r5ZWoFS8RTKSWdm69LmXYL3GLXose4l2xfOHY0EPnsvyYXtCw==
=6f4R
-----END PGP SIGNATURE-----








From attila at hun.org  Fri Oct 24 20:34:24 1997
From: attila at hun.org (Attila T. Hun)
Date: Sat, 25 Oct 1997 11:34:24 +0800
Subject: M$ coercion -anyone doubt my previous claims of Gate$' immorality
Message-ID: <19971025.030404.attila@hun.org>



-----BEGIN PGP SIGNED MESSAGE-----

from ZDNET

> As shocking as this [IE requirement] is, the most
> unsettling revelation is the news that Microsoft required
> its {OEM } "partners" to report any planned contact with
> government officials. If that's not illegal, it should be. It
> implies a threat of reprisal if OEMs so much as inquire
> about their rights.

    like I have said again and again: Gate$ has the basic TS
    trait of "the rules dont apply to me" in spades.  lawyers
    will add their wildest dreams to contracts; Gate$ carried
    the responsibility to exercise common sense --he did not.
    his overwhelming drive: "veni, vidi, vici" is all consuming.
    his temper tantrums are legendary: classic TS.

    yes, the restriction on planned contacts with the government
    is illegal: it constitutes "obstruction of justice" -in
    fact, I would say it is probably the most prima facie case
    of it I have ever seen. it is a slap in the face to our
    basic concept of fairness and the rule of law.

    I vote that the DOJ initiate the criminal phase of the
    Sherman and Clayton acts.  I have always accused Gate$ of
    having lower morals, and dirtier hands, than Cornelius
    Vanderbilt or Jay Gould.

    the argument that dismembering M$ will throw the computer
    industry into total disarray is bullshit.  No, it will
    permit other operating systems and software to enter the
    market. the divested software components can be distributed
    in much the same way the seven Baby Bells were value and
    AT&T stock was split with each AT&T share being worth so
    many of each component and the shareholders could pick.

    Meanwhile, with Gate$, "to heck with Janet Reno" Ballmer,
    and their lawyers in federal prison where they are
    prohibited from running a business, the software industry
    might return to some well needed diversity since Gate$ will
    not be able to swing his mighty hatchet. 

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1
Comment: No safety this side of the grave. Never was; never will be

iQBVAwUBNFFmzrR8UA6T6u61AQFSxQIAiVGb4cdMplUNZdlDw15jNl8bZdX5Lzz+
9teI7hbjJbe8WSZqm85EAH0Q9TfWL3k1b5VS4FAAVHtzaRrFzJlrQQ==
=X4G/
-----END PGP SIGNATURE-----







From declan at well.com  Fri Oct 24 20:55:51 1997
From: declan at well.com (Declan McCullagh)
Date: Sat, 25 Oct 1997 11:55:51 +0800
Subject: Office of the Secretary of Defense vs the First Amendment
Message-ID: 





---------- Forwarded message ----------
Date: Fri, 10 Oct 1997 16:07:23 +0000
From: "Glen L. Roberts" 
To: declan at well.com, noah at pathfinder.com
Subject: Office of the Secretary of Defense vs the First Amendment


From: Glen L. Roberts, PO Box 1533, Oil City, PA 16301
      (814) 676-2345

re:   Office of the Secretary of Defense
                       vs
      The First Amendment


Attn: Seema Singh


Dear Senator Arlen Spector:

I am in receipt of correspondence from the Office of the Secretary of
Defense, dated October 7, 1997. (Copy attached) They appear to be
asking me to stop quoting certain parts of the U.S. Congressional
Record.

Obviously, citizens of the United States have a First Amendment right,
if not an obligation, to express their opinions on matters relating to
the operation of the Government. The DoD, it would appear, is
requesting that I not express my opinions, when such expressions
include certain portions of the Congressional Record, or that I
"excise" my commentary to help cover up their mis-deads. Does the
First Amendment give me the right to express my views, or to express
my views only in accordance with the desires of the DoD?

I can understand the concern and embarassment the DoD may feel by my
highlighting certain portions of the Congressional Record and taking
issue with them. However, I would think that for any government
accountibility to take place, such commentaries are not only proper,
but also a necessity. The First Amendment clearly setsforth my right
to take issue with governmental polices and actions. I do not think it
is within the proper bounds of the DoD to suggest how I may express
myself, or what words might be appropriate or inappropriate to use in
such expressions.

If I were to read between the lines, I would conclude that the DoD is
attempting to place the burden of their improper activities upon my
shoulders. That is, if I stop reprinting the Congressional Record; no
one will understand the problem and it will go away! Completely
disregarding the public nature and purpose of the Congressional
Record. For if I cannot freely quote from the Congressional Record,
why has the Library of Congress moved to increase public availablity
and access to it: "Acting under the directive of the leadership of the
104th Congress to make Federal legislative information freely
available to the Internet public, a Library of Congress team brought
the THOMAS World Wide Web system online in January 1995, at the
inception of the 104th Congress."

There are a number of possible ways that the DoD might seek to resolve
the underlying problems of which I have brought attention to on my web
pages, radio broadcasts and publications. I fail to understand how
adjusting my commentary to meet the desires of the DoD will correct a
stupid mistake they made years ago, and continued for years.
Eliminating the attention will serve only to cover up and avoid any
resolution of the problem.

I request your assistance in supporting my First Amendment rights.


-------------------------
(any typeos in the following are mine)

Office of the Secretary of Defense
1950 Defense Pentagon
Washington DC 202301-1950

Adminstration
& Management

Octover 7, 1997

Mr. Glen L. Roberts
P.O. Box 1533
Oil City, PA 16301

Dear Mr. Roberts:

This Department has taken the position in a wide variety of contexts
that disclosure of the social security number constitutes a clearly
unwarranted invasion of an individual's personal privacy. Therefore,
the Department is as concerned as you are regarding the public
availablity of the SSN and strongly believes that the general public
should not have access to such numbers.

As you have said, teh Department no longer provides the full social
security number to Congress because we recognized and correct what was
then a problem. Unfortunately, the numbers currently exact in print
and at public websites. But this fact does not mean that we should not
minimize, when possible, the proliferation of such lists. Although
your apparent goal to obtain greater privacy protection for the
individual is certainly laudable, publishing consolidated listings on
your website perpetrates and exaverbates the very problem you are
attemping to address. Put differently, such publications disregards
the very privacy interests you are seeking to protect. Though the
lists are available elsewhere, you are making it much simpler to find
them because the other sites are not always easy to locate.

Therefore, consideration should be given to the deletion of the lists,
or in the alternative, excision of the SSN, from your webpage. Either
action on your part will demonstrate, not only by word, but by deed, a
sensitivity that others have ignored, in that, you have elected to
pursure an approach where your advocacy requirements have been
balanced against the privacy interests of the individual.

Sincerely,

//s//

Aurello Nepa, Jr.
Director
Defense Privacy Office









From CCSI at westcoastmemory.com  Sat Oct 25 12:21:33 1997
From: CCSI at westcoastmemory.com (CCSI at westcoastmemory.com)
Date: Sat, 25 Oct 1997 12:21:33 -0700 (PDT)
Subject: INTERNET  CREDIT CARD APPROVAL
Message-ID: <>


INTERNET  CREDIT CARD APPROVAL LETTER
(Account activation hotline: 1 702 256-3000)

CASH ADVANCE APPROVED: YES
APPROVAL NUMBER: 501-7046176
CREDIT LIMIT: $2,500.00
APPROVAL EXPIRES: 11/10/97
CREDIT PROVIDER: CCS
BANK AFFILIATION: NONE
CARD ISSUED: CASHPLUS
MEMBER STATUS: PENDING
ANNUAL FEE: NONE
APR: 11.99%

DEAR FUTURE CARD HOLDER:

Congratulations! You have been approved for a $2,500.00
unsecured credit line from the Financial Card Division of CCS 
regardless of past credit.

Your approval number is 501-7046176 and your Approved credit
line of $2,500.00 for credit purchase and cash advances will be
available once your receive you CashPlus card* just by calling now!

As a membership benefit, you will be processed** for an unsecured 
major credit card with a credit line of up to $1,000.00 regardless 
of past credit.

SEND NO MONEY NOW- There is NO SECURITY OR MONEY DEPOSITS 
required! Call IMMEDIATELY with the approval number to activate your
membership and its benefits.

BY ACTING NOW- We'll assign your CashPlus Card within the next 48
hours and then apply your one-time membership fee by the payment method
you prefer and give you $100.00 off your first credit purchase of over 
$200.00 with the CashPlus Card just by calling now!

Getting more credit is as simple as calling us today to activate your 
membership and obtain your pin code for cash advances before your
approval expires. So get the credityou deserve - CALL NOW -  100%
Quality assurance and no less!

CALL RIGHT NOW!
********** 1- (702) 256-3000 **********
FOR IMMEDIATE ACTIVATION AND
TO ESTABLISH YOUR CREDIT TODAY!


THIS IS A ONE TIME MAILING, PLEASE DO NOT
SEND A REMOVE REQUEST AS YOU WILL NEVER
BE SENT ANOTHER OFFER.
**************************************************************
Consumer Credit Services Inc. hereby known as CCS is 
not affiliated with any bank(s)referred to the consumer by 
CCS. CCS is a credit card referral service and does not issue
any major credit cards to the consumer. Some banks require
annual or processing fees ranging from twenty to one hundred dollars.
(  *CCS does issue the CashPlus card only to its shopping club
members without any fees or charges and is subject to terms and
conditions set forth by CCS.)  ( ** Processing signifies receiving 
and application directly from a financial institution).

Offer not available in Nevada, Wisconsin, Iowa, Connecticut, North Carolina.







From CCSI at westcoastmemory.com  Sat Oct 25 12:21:33 1997
From: CCSI at westcoastmemory.com (CCSI at westcoastmemory.com)
Date: Sat, 25 Oct 1997 12:21:33 -0700 (PDT)
Subject: INTERNET  CREDIT CARD APPROVAL
Message-ID: <>


INTERNET  CREDIT CARD APPROVAL LETTER
(Account activation hotline: 1 702 256-3000)

CASH ADVANCE APPROVED: YES
APPROVAL NUMBER: 501-7046176
CREDIT LIMIT: $2,500.00
APPROVAL EXPIRES: 11/10/97
CREDIT PROVIDER: CCS
BANK AFFILIATION: NONE
CARD ISSUED: CASHPLUS
MEMBER STATUS: PENDING
ANNUAL FEE: NONE
APR: 11.99%

DEAR FUTURE CARD HOLDER:

Congratulations! You have been approved for a $2,500.00
unsecured credit line from the Financial Card Division of CCS 
regardless of past credit.

Your approval number is 501-7046176 and your Approved credit
line of $2,500.00 for credit purchase and cash advances will be
available once your receive you CashPlus card* just by calling now!

As a membership benefit, you will be processed** for an unsecured 
major credit card with a credit line of up to $1,000.00 regardless 
of past credit.

SEND NO MONEY NOW- There is NO SECURITY OR MONEY DEPOSITS 
required! Call IMMEDIATELY with the approval number to activate your
membership and its benefits.

BY ACTING NOW- We'll assign your CashPlus Card within the next 48
hours and then apply your one-time membership fee by the payment method
you prefer and give you $100.00 off your first credit purchase of over 
$200.00 with the CashPlus Card just by calling now!

Getting more credit is as simple as calling us today to activate your 
membership and obtain your pin code for cash advances before your
approval expires. So get the credityou deserve - CALL NOW -  100%
Quality assurance and no less!

CALL RIGHT NOW!
********** 1- (702) 256-3000 **********
FOR IMMEDIATE ACTIVATION AND
TO ESTABLISH YOUR CREDIT TODAY!


THIS IS A ONE TIME MAILING, PLEASE DO NOT
SEND A REMOVE REQUEST AS YOU WILL NEVER
BE SENT ANOTHER OFFER.
**************************************************************
Consumer Credit Services Inc. hereby known as CCS is 
not affiliated with any bank(s)referred to the consumer by 
CCS. CCS is a credit card referral service and does not issue
any major credit cards to the consumer. Some banks require
annual or processing fees ranging from twenty to one hundred dollars.
(  *CCS does issue the CashPlus card only to its shopping club
members without any fees or charges and is subject to terms and
conditions set forth by CCS.)  ( ** Processing signifies receiving 
and application directly from a financial institution).

Offer not available in Nevada, Wisconsin, Iowa, Connecticut, North Carolina.







From tm at dev.null  Fri Oct 24 21:45:56 1997
From: tm at dev.null (TruthMonger)
Date: Sat, 25 Oct 1997 12:45:56 +0800
Subject: Declan speaks out on NAMBLA and TIME
Message-ID: <3451767E.3100@dev.null>



~~~~~~~
SECONDS: Is there any activity that should be forbidden?

DECLAN: I'm not in the business of making laws like that. I don't know
exactly how to define what's underage and what's intimidation. Kids have
to be protected and I sympathize with those who want to write a law. I'm
just saying you have to control the bureaucracy and be extremely careful
about demagoguery. At the moment, there's too much demagogic hysteria 
for people to be thinking sensibly about it.

SECONDS: Does it help the government get further into people's houses?

DECLAN: Another pretext for extension of police apparatuses. Another 
excuse for the government desire to be able to snoop in on any 
electronic conversation. It's a useful thing to get votes. I would say 
where force and violence are involved, where mental violence is 
involved, there's a fine line. What about some thirteen-year-old kid 
whose parents have beat him up and rejected him and is out on the street 
looking for love, hungry, taken in by some pederast who treats him 
nicely, gives him an education, sleeps with him - what are you gonna do? 
What humanely should be done? How are you going to make the distinction? 
The cops don't make the distinction. The law doesn't make the 
distinction. NAMBLA's good for making public discussion on this issue, 
discussing what should be the right laws. People want to scapegoat the 
discussion. They're willing to talk about it publicly all the time and 
bust people but sensible discussion seems to be out of the question. 
I've been accused of being a child rapist simply because I went on the 
air and said I was a member of NAMBLA. Ten years ago, I saw in Time 
Magazine an attack on NAMBLA saying it was a group involved in "the 
systematic exploitation of the weak and immature by the powerful and 
disturbed."
At first reading, it struck me as a precise characterization of Time's 
own assault on the American mind. 
~~~~~~~~~

  OK, so it was really Alan Ginsberg who said the above. I'll try and
put the universe back in balance, later, by attributing some of Declan's
comments to Ginsberg.






From harka at nycmetro.com  Fri Oct 24 22:02:25 1997
From: harka at nycmetro.com (harka at nycmetro.com)
Date: Sat, 25 Oct 1997 13:02:25 +0800
Subject: Saving money
Message-ID: <199710250528.AAA28050@einstein.ssz.com>



-----BEGIN PGP SIGNED MESSAGE-----

 > At 2:38 PM -0700 10/24/97, harka at nycmetro.com wrote:

 > The "just don't work for them if 'ya don't like it"-argument
 > will last about 4 weeks...the approximate time a human can
 > survive without eating. (or a couple of weeks less, if you have
 > kids)

 -=> Quoting In:tcmay at got.net to Harka <=-

 In> By my third year out of college, I had a big enough cushion of
 In> saved cash and other investments

[american dream deleted]

While I am glad for your achievements, you have not addressed my
point: all this doesn't apply to the larger mass of people.

You were fortunate enough to be in the right place at the right
time...one of the founding-members of a company in an industry,
that pays way more than average and thus brought you into the
position, that you're in now. Great...more power to you and I
encourage everybody to try the same.

But that's not applicable to the larger percentage of the
population. Besides, it's a supply and demand question.
Computer-jobs only pay that much because it's a booming industry
right now and there are less people than needed. Fortunate for
those who were/are able to ride the wave.
But if the available work-force exceeds the demand for it, such
jobs wouldn't pay nearly as much as they do right now.
Hence, achieving financial independence to the point of freely
choosing employers would become much harder again.

But this is the reality for MOST people (outside of the
elite-industries) already! Especially if they start out with
student-loan-debts amounting to several ten thousands of dollars.
Add a family/kids to that and you tell me how easy a task it will
be to quickly become independently wealthy.
(Some people will be able to pull it off somehow, most people won't
- - despite their wishes to the contrary. Should they make their best
effort? Absolutely! Will everybody succeed? Absolutely not.)

The background of this discussion is the free choice of employers
(based on their policies). My point is, that for the large mass
there is no such thing as a free choice (of employers), not
necessarely because they're not willing to improve their financial
standing to such a degree (who doesn't want to have more money?),
but because they don't have the time, resources and conditions to
do so.

But even IF you were able to "make yourself more marketable" (as
WHGIII eloquently composed)...if ninety percent of businesses in
the country use the GAK/CAK-feature of PGP 5.5 how much free choice
will then remain for you?

 > I.e. unless you are the super-duper, three-times
 > nobel-prize-winner (with lots of money in stocks), who can
 > AFFORD to choose employers that freely, you will be DAMN GLAD to
 > have a job AT ALL, regardless of their policies!

 In> More nonsense. Move out to the Bay Area, if you have any
 In> talent at all in software or hardware or biotech or Web design
 In> or multimedia, and you'll find jobs galore.

I'll invite you in return to move to Brooklyn, NY to find out for
yourself how easy life is for the non-elitists. Or maybe just take a
walk around your own town.

The truth is, that there are many people outside of Cypherpunks,
who get barely through life _despite_ making efforts. They may get
enough salary in their 9-5 job to maintain themselves to a degree,
but not nearly enough to have the complete freedom, that is the
issue here. And to say, "they get what they deserve" (if they don't
have the abundance of dollars/freedom) is rather narrowminded and
out-of-touch with most people's reality.

But these are the people determining if GAK/CAK ever becomes
widespread. If companies employing it would face extinction, because
nobody would work for them anymore, GAK/CAK wouldn't succeed.

However, capitalism doesn't work that way, despite of the few who
made capitalism work for them.

Ciao

Harka

/*************************************************************/
/* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */
/* PGP public key available upon request.  [KeyID: 04174301] */
/* F-print: FD E4 F8 6D C1 6A 44 F5  28 9C 40 6E B8 94 78 E8 */
/*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/
/* May there be peace in this world, may all anger dissolve  */
/* and may all living beings find the way to happiness...    */
/*************************************************************/

... By the time you can make ends meet, they move the ends.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAgUBNFF8ijltEBIEF0MBAQFvFAf/TtywGVY8r6JKPljBzQjFAUZuDTrQiISZ
qxUAMN6PhXz/fvDHqAJAPSnGiUkMf1goEI0NNG7cpZkdIaayz8PI33JzV9g5dypl
lrUGb65+qzuMBi4+RhYbwWJQe44NOUzNDaZJdc0q3m6LDhXOrMLUoCt/i0b+KdB+
E68FAPBkOsYAgU8ooi4EeQkgabsEJRx5Hf4VB0Y0r3xcY5DBm7AbIpResU2xg9Xm
ySZPsOpRA/PmFS3wOqoSJQIyZeeOx0k2rKVVNGsRYrtsfvVXj8wGegujRACXnGJF
wL+7IIwkosOUESs93LWCQ6CwqsefpQBCrKE0mACxP9F03P4rXEXaGA==
=rRS/
-----END PGP SIGNATURE-----


If encryption is outlawed, only outlaws will have encryption...






From kent at bywater.songbird.com  Fri Oct 24 23:10:13 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Sat, 25 Oct 1997 14:10:13 +0800
Subject: Saving money
In-Reply-To: <199710242206.RAA26328@einstein.ssz.com>
Message-ID: <19971024230425.23878@bywater.songbird.com>



On Fri, Oct 24, 1997 at 05:02:54PM -0700, Tim May wrote:
> At 2:38 PM -0700 10/24/97, harka at nycmetro.com wrote:
> 
> >Sometimes it seems, as if the people advocating the
> >"business-reality" are furthest removed from it.
> >
> >The "just don't work for them if 'ya don't like it"-argument  will
> >last about 4 weeks...the approximate time a human can survive
> >without eating. (or a couple of weeks less, if you have kids)
> 

[Standard "born on third and thinks he hit a home run" rant deleted]

This was such a pathetic self serving self paradoy on Tim's part that
I had to check the headers for "sympatico". 

> There's no excuse for being "trapped in a job."

How about having an IQ of 85? Substantial fraction of the population,
after all... Oh -- I forgot -- broken eggs and all that...

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From tcmay at got.net  Fri Oct 24 23:41:21 1997
From: tcmay at got.net (Tim May)
Date: Sat, 25 Oct 1997 14:41:21 +0800
Subject: Saving money
In-Reply-To: <199710250528.AAA28050@einstein.ssz.com>
Message-ID: 



At 10:00 PM -0700 10/24/97, harka at nycmetro.com wrote:

>[american dream deleted]
>
>While I am glad for your achievements, you have not addressed my
>point: all this doesn't apply to the larger mass of people.

As I recall your point, it was that most people are a few weeks away from
running out of money and hence cannot change jobs readily. I was saying
that a small amount of self-discipline and sacrifice can quite easily
translate into having a few _months'_ worth of savings.

Granted, this takes discipline, to put money away instead of spending it.
But even minimum wage workers are quite capable of saving...this is how
many move out of minimum wage jobs into running their own small shops or
businesses. Examples are legion.

If they won't make these spending tradeoffs and have not even a buffer
sufficient to carry them through a month or two or three, I say screw them.

I won't support restrictions on what a company may do, when perfectly
legal, just because Joe Sixpack spent his paycheck on beer and is now
afraid to look for a job with a better company. Or because Rawandala Brown
spent her money on crack and now is "trapped" in a job.

>You were fortunate enough to be in the right place at the right
>time...one of the founding-members of a company in an industry,
>that pays way more than average and thus brought you into the
>position, that you're in now. Great...more power to you and I
>encourage everybody to try the same.
>
>But that's not applicable to the larger percentage of the
>population. Besides, it's a supply and demand question.

The Mormons teach self-reliance, and savings. So do other religions and
belief systems. Many of them urge their followers to have money put aside
for just these kinds of situations.

As I said, even minimum wage workers have a proven ability to save. If they
won't, this is there problem. "The Grasshopper and the Ant" is far more
important for children to read and internalize the lessons of than the
currently-popular "I Have Two Mommies" crapola.


>
>If encryption is outlawed, only outlaws will have encryption...

Don't you mean, in your world view:

If success is outlawed, only failures will succeed.


(I urge you to think about how your criticisms of the free market fit this
aphorism.)

--Tim May




The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From kent at bywater.songbird.com  Sat Oct 25 00:32:35 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Sat, 25 Oct 1997 15:32:35 +0800
Subject: PGP, Inc.--What were they thinking?
In-Reply-To: <19971022174359.10769@bywater.songbird.com>
Message-ID: <19971025002707.17636@bywater.songbird.com>



On Fri, Oct 24, 1997 at 02:42:19PM +0100, Adam Back wrote:
> 
> Kent Crispin  writes:
> > It may be less obvious, but despite what PGP claims, a significant
> > fraction of this demand is for the ability to SNOOP, and not just data
> > recovery.  
> 
> I was suspicious about this also, the CMR design makes much more sense
> if this is the user requirement.  Binding cryptography also would make
> sense for this requirement.
> 
> But the last time I expressed this suspicion on this list Jon Callas
> clearly stated that this was not the case:
> 
> Jon Callas  writes:
> :    It is possible that
> :    there is an unstated perceived user requirement, that the messaging
> :    standard be able to allow third party access to the communications
> :    traffic directly.
> : 
> : Nope, that's not what we're arguing for. 
> 
> So it would appear that your suspicious are unfounded...

Jon's statement and my statement are consistent, if you look a little 
more closely.

> > *All* the debate on this list implicitly takes the employee's side,
> > not the management's side, and that is a serious lack.  The
> > unpleasant fact is that managers NEED TO BE ABLE TO SNOOP.
> 
> Okay!  Some one who is able to say the unpleasant words.  (I think
> Lucky may have been hinting at this also).
> 
> If this is the case, I reckon it's still better to just escrow their
> comms keys locally. 

In my early days on the list I spent a great deal of effort arguing
exactly this point, perhaps even with you.  Perhaps you recall my
discussions of the "key-safe" model.  (I suppose we could check the
archives...) At that time, however, my proposal was branded as key
escrow and hence evil, and the STANDARD REPLY WAS THAT IT WOULD BE
FAR, FAR BETTER TO JUST ENCRYPT TO A COMPANY KEY AS WELL AS THE
PRIVATE KEY.  *You* may even have made such arguments. 

Now that PGP has actually gone and implemented exactly what some
months ago was the preferred alternative, the jack-rabbit meme-ridden
collective cypherpunk semiconciousness awakens from its hazy stupor
and says "Huh! GAK!", and parades Key Escrow as a safer solution.

So, for sure, either the thinking those months ago was shallow, or the
thinking now is shallow.  The third alternative, that the thinking has
remained at a constant level, is interesting to contemplate.

> Put them all in the company safe, whatever.  To
> go with this kind of a company with this kind of policy, I would
> presume that sending or receiving super-encrypted messages would would
> be a sackable offense.
> 
> However, there is an alternate reason for the CMR design, which you
> don't include above (tho' you did I think discuss this earlier):
> 
> That PGP Inc thought CMR would be easier to implement within their
> plugin API, and dual function crypto (file encryption, and email
> encryption), and to cope with things like encrypt-to-self on Cc: to
> self to keep copies.

Yes, I did mention the matters of history, backward compatibility, 
and expedience under tight schedules as important factors.

> > It is terrible to work for an employer who will snoop, but it is 
> > just as terrible to have dishonest employees.  It doesn't take a 
> > genius to realize that the existence of dishonest employees is a
> > primary motive for management snooping.
> 
> Even with snoopware such as you describe, and companies with such
> attitudes, there are other similarly easy ways to get data out: user
> walks out of building with floppies.  In fact from memory I think this
> was one you suggested: "frisbee DAT tape out of window to sweetheart"
> or words to that effect.

I don't remember saying that, but the point is obvious, anyway.  The
argument that leaking company secrets is the primary concern is
fallacious for exactly the reason you mention -- there are a thousand
ways to leak data out. 

There are other, more realistic concerns.  Is the employee exchanging
encoded gif images with his friends? Is the employee telling the truth
about an exchange with a customer? Is the employee spending all his
time reading mailing lists devoted to home-brew-beer, and other
hobbies? Is the employee distributing porno images from an ftp site on
a company computer? Is the employee running a consulting business on
the company computers?  For investigating any such suspicions, 
snooping incoming mail would be just as valuable as snooping outgoing 
mail. 

BTW: You may laugh -- But I have seen real-life instances of each of
these examples.

> > Clearly, there are some organizations for which this is more
> > important than others -- financial services companies are only the
> > most obvious example.
> 
> Maybe.  If PGP Inc want to go this far, and design software with these
> features, I reckon local key escrow is better.  

I reckon local key escrow is better, myself.  But be real for a
moment, Adam.  If they had designed a system with "local key escrow"
they would have been crucified by the butterfly brains on cypherpunks
far more intently than they are being lambasted for CMR.  The very
phrase "KEY ESCROW IN PGP" would have turned the cypherpunk group mind
into quivering jelly. 

> However that is not
> what they are saying.

It doesn't matter what they are saying, really.  They designed 
something with a set of constraints, one of which was the meme of 
antipathy to anything that could be termed "key escrow".  

I understand what Lucky meant when he said that PGP had pulled the
greatest hack ever on corporate America.  It's so good that you have
to conceal your mirth, for fear of screwing it up... 

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From tcmay at got.net  Sat Oct 25 00:52:19 1997
From: tcmay at got.net (Tim May)
Date: Sat, 25 Oct 1997 15:52:19 +0800
Subject: NAMBLA embattled -- mirror sites?
In-Reply-To: 
Message-ID: 



At 6:14 PM -0700 10/24/97, Declan McCullagh wrote:
>Folks on f-c and cypherpunks have mirrored holocaust revisionist web
>pages, banned books, and censored newspapers. Now I understand that NAMBLA
>is in danger of losing its home on the web. Anyone up for mirroring the
>(text-only)  publications of perhaps the world's most controversial
>organization?

This is one of several types of information too dangerous to mirror. Most
mirrors have involved stuff those damned furriners have banned, like
Holocaust denial info, the Mitterand book, the Homulka-Teale material, etc.
It's pretty safe to mirror stuff banned in Germany, Israel, France, Canada,
etc., but not so easy to mirror stuff banned in the U.S., or highly
controversial material.

Mirroring the NAMBLA stuff could be a severe career-limiter, for example.
Even if not strictly illegal.

(Recall that a student, who shall remain nameless here, mirrored some
controversial stuff at his Ivy League school. He was almost kicked out of
the graduate school program he is in, as I recall the story (but this was
about 2 years ago, so my memory may be hazy). After withdrawing the
material and promising to stay in line, the situation cooled down. Imagine
his woes had he mirrored NAMBLA material!)

Other too-dangerous material would be, for example, U.S. defense secrets,
personal medical files, material ordered closed in court cases, etc.

These are areas where untraceable data havens really shine. My own
Blacknet, as an example. If the NAMBLA material were to be periodically
sent out via remailers, to Usenet, censorship would be nearly impossible.

And so would traceability and, hence, culpability.

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From aba at dcs.ex.ac.uk  Sat Oct 25 04:29:41 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sat, 25 Oct 1997 19:29:41 +0800
Subject: Saving money
In-Reply-To: 
Message-ID: <199710251122.MAA00713@server.test.net>



Tim May  writes:
> Harka writes:
> > [...]
>
> As I recall your point, it was that most people are a few weeks away from
> running out of money and hence cannot change jobs readily. I was saying
> that a small amount of self-discipline and sacrifice can quite easily
> translate into having a few _months'_ worth of savings.

Absolutely.  I recall trying to explain to someone who was prone to
spending money he didn't have:

- if you spend it before you've got it, you'll get to spend less,
  because of the interest you pay in the mean time

- where as if you spend it some time after you've got it, you'll be able
  to spend more because you will accumulate interest prior to spending.

Most people seem to have bought into the credit concept.  Hire
purchase everything.  Their idea of how much they can afford is how
many hire purchase fee structures fit within their current wages.
Same for houses, and mortgages, their idea of how expensive a house
they can afford is determined by how large a loan the bank is willing
to give them on a 99% mortgate over a 25 year mortgage repayment plan.

Well more fool them.

I have no loans.  I bought my house for cash to rent out as an
investment (the house was cheap because I was a cash buyer and one of
those 99% mortgage types had had it repossed from them by the bank so
I bought it at 25% below market value).  I have been working for 20
months (after finishing higher education).  I have enough wealth to
not work for about 7 years at current expenditure levels.  I am
married, and have two pre-school children.  I have a second hand car
which I bought (for cash obviously) for L2000 (you should have seen
the previous car which cost L300).  I have received no inheritances
worth mentioning.  My income is probably lower than most of our US
friends (UK universities do not pay well).  I expect most of our US
friends will be working when they are 50.  I don't figure on being
forced to work to eat at that age.  My liquid assets are invested in
stocks and high interest accounts.  Their's are locked up in fast
depreciating assets: flash cars, big mortgages, consumer electronics,
and in high consumption life styles: eating out, entertainment, etc.

Their life-style choice, their risk.

> If they won't make these spending tradeoffs and have not even a
> buffer sufficient to carry them through a month or two or three, I
> say screw them.

There's some kind of parable in the bible about investments (not that
I'm any kind of religious freak... just it is a reasonable story),
some thing about several people being given a gold coin to look after.
One spent it, another burried it in the ground, and another invested
it.  The person who's money it was came back and took the money off
the one who'd burried it in the ground and gave it to the one who'd
invested it.

Socialism has it in reverse, the one who'd spent it would have had the
government steal it from the investor for redistribution to the
financially foolish one.

Spending every penny before you've got it and then looking around for
someone else to pay the bills is a socialist tendency.  The nanny
welfare state.  Legalised theft from those that have worked to those
who have not.

OK, so maybe you can get a run of bad luck, but that bad luck is going
to hit you much worse if you've spent the next two months wages before
they've arrived.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710251055.LAA00694@server.test.net>




Kent Crispin  writes:
> On Fri, Oct 24, 1997 at 02:42:19PM +0100, Adam Back wrote:
> > > It may be less obvious, but despite what PGP claims, a significant
> > > fraction of this demand is for the ability to SNOOP, and not just data
> > > recovery.  
> >
> > Jon Callas  writes:
> > :    It is possible that
> > :    there is an unstated perceived user requirement, that the messaging
> > :    standard be able to allow third party access to the communications
> > :    traffic directly.
> > : 
> > : Nope, that's not what we're arguing for. 
> > 
> > So it would appear that your suspicious are unfounded...
> 
> Jon's statement and my statement are consistent, if you look a little 
> more closely.

Could you explain, please.  I took it at face value.  He made other
statements also denying that claim.

> > If this is the case, I reckon it's still better to just escrow their
> > comms keys locally. 
> 
> In my early days on the list I spent a great deal of effort arguing
> exactly this point, perhaps even with you.  Perhaps you recall my
> discussions of the "key-safe" model.  (I suppose we could check the
> archives...) At that time, however, my proposal was branded as key
> escrow and hence evil, and the STANDARD REPLY WAS THAT IT WOULD BE
> FAR, FAR BETTER TO JUST ENCRYPT TO A COMPANY KEY AS WELL AS THE
> PRIVATE KEY.  *You* may even have made such arguments. 

I recall your key safe.  I also recall that you suggested cypherpunks
work out ways to do data recovery -- a suggestion which was ignored
because we figure why help them.

There are dangers with each.  The company safe model is better, but
governments could come along and demand a copy of the keys in the
safe, if they are communications keys.

For this reason generally I reckon it's safer to stick only storage
keys in the safe.  Don't back up comms keys.

There are some short-falls to not being able to recover comms keys
(like losing messages which were in transit at time of memory lapse).
So if you do need to recover comms keys, it is I think a good idea to
implement PGP WoT autenticated TLS (I described how to do this in
another post, a reply to one of Jon Callas posts).  This is another
easy thing to do.  A few days hacking at most, everything is in place,
even SMTP agents.

Another thing to do is opportunistic PFS.  Use PFS when you can.  This
just means sending a EG key with each message.  If there is a reply,
the person replying uses the EG key.  The recipient deletes the key
after use.  (EG keys are cheap to generate, if you keep the same
public vales.)  This is good because it allows the company recovery of
comms keys, but denys attackers (industrial espionage, rogue
government agents) access to the ciphertext.

All simple easy things to do.

> Now that PGP has actually gone and implemented exactly what some
> months ago was the preferred alternative, the jack-rabbit meme-ridden
> collective cypherpunk semiconciousness awakens from its hazy stupor
> and says "Huh! GAK!", and parades Key Escrow as a safer solution.
> 
> So, for sure, either the thinking those months ago was shallow, or the
> thinking now is shallow.  The third alternative, that the thinking has
> remained at a constant level, is interesting to contemplate.

Don't know which, but I do suspect a concrete example has helped to
clarify thought.  Also CMR is a new development, yes people have
talked about multiple recipients before; but building in MTA support
to reject messages is an additional part of the system.  (Clipper did
something similar rejection of non "recoverable" messages -- the 16
bit checksum with undisclosed checksum algorithm being one other
example).

> Yes, I did mention the matters of history, backward compatibility, 
> and expedience under tight schedules as important factors.

I'm not sure it's _that_ valid, and heres a few reasons why: pgp5.0
has most of the CMR functionality in it -- this implies that PGP Inc
have been planning the CMR approach for ages.  Also CDR, just
escrowing storage keys, is simple.  Even simpler than CMR and mail
bouncing SMTP agents.

> The argument that leaking company secrets is the primary concern is
> fallacious for exactly the reason you mention -- there are a
> thousand ways to leak data out.
> 
> There are other, more realistic concerns.  Is the employee exchanging
> encoded gif images with his friends? Is the employee telling the truth
> about an exchange with a customer? Is the employee spending all his
> time reading mailing lists devoted to home-brew-beer, and other
> hobbies? Is the employee distributing porno images from an ftp site on
> a company computer? Is the employee running a consulting business on
> the company computers?  For investigating any such suspicions, 
> snooping incoming mail would be just as valuable as snooping outgoing 
> mail. 
> 
> BTW: You may laugh -- But I have seen real-life instances of each of
> these examples.

I'm not laughing.

Protecting secrets stored on company machines is I suspect difficult.
This is because the company controls the machines: it owns them, it
probably installed the software, it can install more software when
you're not in the office (eg key board sniffer).

Also a sense of proportionality is useful; balance what can be weakly
enforced by software, against other ways that company NDAs can be
broken (frisbeeing DAT tape out of window), or other ways that
outsiders can send you info which the company wouldn't like (eg like
sending to your home email address).

> > Maybe.  If PGP Inc want to go this far, and design software with these
> > features, I reckon local key escrow is better.  
> 
> I reckon local key escrow is better, myself.  But be real for a
> moment, Adam.

Always try to be realistic, Kent.

> If they had designed a system with "local key escrow"
> they would have been crucified by the butterfly brains on cypherpunks
> far more intently than they are being lambasted for CMR.  

Not quite as much I don't think.  Especially if they had just
implemented storage key escrow.  We've been discussing CKE (Commercial
Key Escrow) being fine and useful for ages, and GACK of messaging keys
being evil.  This is a very old meme.

> The very phrase "KEY ESCROW IN PGP" would have turned the cypherpunk
> group mind into quivering jelly.

Would have got some opposition to be sure.  But I really think there
would have been much less fuss.

> > However that is not what they are saying.
> 
> It doesn't matter what they are saying, really.  They designed 
> something with a set of constraints, one of which was the meme of 
> antipathy to anything that could be termed "key escrow".  

And pro-privacy seemed to be one of the design principles also.

Unfortunately the net effect is worse than what a privacy and
politically neutral individual would have come up with just security
objectives.

> I understand what Lucky meant when he said that PGP had pulled the
> greatest hack ever on corporate America.  It's so good that you have
> to conceal your mirth, for fear of screwing it up... 

Please share what's so funny.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710250958.KAA00604@server.test.net>




Declan McCullagh  writes:
> Folks on f-c and cypherpunks have mirrored holocaust revisionist web
> pages, banned books, and censored newspapers. Now I understand that NAMBLA
> is in danger of losing its home on the web. Anyone up for mirroring the
> (text-only)  publications of perhaps the world's most controversial
> organization?

Slap 'em up on the eternity service.

At the moment you'll need 1x unix hacker to figure out the scripts,
but it's doable.

	http://www.dcs.ex.ac.uk/~aba/eternity/

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



-----BEGIN PGP SIGNED MESSAGE-----

 > At 10:00 PM -0700 10/24/97, harka at nycmetro.com wrote:

 > While I am glad for your achievements, you have not addressed my
 > point: all this doesn't apply to the larger mass of people.

 -=> Quoting In:tcmay at got.net to Harka <=-

 In> As I recall your point, it was that most people are a few weeks away
 In> from running out of money and hence cannot change jobs readily. I was
 In> saying that a small amount of self-discipline and sacrifice can quite
 In> easily translate into having a few _months'_ worth of savings.

That may indeed work for some people, but the argument of
"self-discipline and sacrifice" usually goes overboard once people
_other than yourself_ are severely affected by that. "Sorry hun,
you can't have a new winter-coat. Mommy has to save enough money so
that she can choose the people she works for. And no...no christmas
this year either".

 In> If they won't make these spending tradeoffs and have not even
 In> a buffer sufficient to carry them through a month or two or
 In> three, I say screw them.

How about you adopting a person/family of your choice instead and
providing them with enough startup-money, so that they can at least
make an realistic effort to work towards a position of becoming
financially independent themselves? :)

 In> I won't support restrictions on what a company may do, when
 In> perfectly legal,

Neither do I.

 In> just because Joe Sixpack spent his paycheck on beer

or on his two daughters...

 In> Or because Rawandala Brown spent her money on crack

or supporting her sick mother instead.
Your repeating of government-propaganda about the "abuse of the
welfare-system" etc. doesn't really cut it as an argument in a
discussion about the realism of having total financial independence
and the freedom of choices, that comes with it.

 In> The Mormons teach self-reliance, and savings. So do other
 In> religions and belief systems. Many of them urge their
 In> followers to have money put aside for just these kinds of
 In> situations.

While I am not a Mormon or whatever, I do believe in self-reliance
myself. But to argue, that everybody already _is_ self-reliant to
the degree of being able to freely choose your employer at any time
is factually incorrect. And that was the beginning of this
discussion.

[Grasshopper stuff deleted]

 In> Don't you mean, in your world view:

 In> If success is outlawed, only failures will succeed.

You don't have to start twisting my signature-file and implying
things, that were never written by anybody but your projections. :)

 In> (I urge you to think about how your criticisms of the free
 In> market fit this aphorism.)

I suggest in return you reconsidering the myth, that a free market
means equal opportunities and thus quick self-reliance for
everybody.

Ciao

Harka

/*************************************************************/
/* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */
/* PGP public key available upon request.  [KeyID: 04174301] */
/* F-print: FD E4 F8 6D C1 6A 44 F5  28 9C 40 6E B8 94 78 E8 */
/*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/
/* May there be peace in this world, may all anger dissolve  */
/* and may all living beings find the way to happiness...    */
/*************************************************************/

... Freedom is not a circumstance in life, it's a State of Mind!

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAgUBNFHX2jltEBIEF0MBAQFftAf/Q4bWgn1DJSz8THyW2VwpvfqXu0Df8uol
4+Kqdg8RRsiKeFiUCXG0h/Ab2IZJmYjYvj4ycI5+VqCReCd5YROckTLqih1K4tc4
t0ZnCwGMkwQF5pJ9rizEQnooo2NhLjW1Nj5zMTfHxYeSUtBUNFabd54Szgl485RC
CWTRnBDJJCHhdxcvBl2xy+RWbviJ0+DbCVnt/28YN/4cH/YQKQn05dSLVGP4dOUW
SZ4VrRqaD+mU/rmFV8oDNfkxSxwx4s4y1yG0WfSBE2XCQea3uzm9oR2ULFwo6vQD
iv0VBBM9x7V4Cl9fDBmi36BXDlZDweJtgUDzGolZq4FAcWQRUzxz4A==
=uJPQ
-----END PGP SIGNATURE-----


If encryption is outlawed, only outlaws will have encryption...






From aba at dcs.ex.ac.uk  Sat Oct 25 05:45:24 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sat, 25 Oct 1997 20:45:24 +0800
Subject: poverty traps (Re: Saving money)
In-Reply-To: <199710251158.GAA28570@einstein.ssz.com>
Message-ID: <199710251226.NAA01559@server.test.net>




Harka  writes:
>  -=> Quoting In:tcmay at got.net to Harka <=-
> 
>  In> As I recall your point, it was that most people are a few weeks away
>  In> from running out of money and hence cannot change jobs readily. I was
>  In> saying that a small amount of self-discipline and sacrifice can quite
>  In> easily translate into having a few _months'_ worth of savings.
> 
> That may indeed work for some people, but the argument of
> "self-discipline and sacrifice" usually goes overboard once people
> _other than yourself_ are severely affected by that. "Sorry hun,
> you can't have a new winter-coat. Mommy has to save enough money so
> that she can choose the people she works for. And no...no christmas
> this year either".

That is indeed a sad financial state to be in.  I have trouble
believing it though.  Most of the people at low levels of income
around where I live (people collecting pretty reasonable social
security paychecks) spend lots of their money on such things as:

- drinking at pubs and bars (expensive hobby, alcohol is taxed at
  2000% or whatever, and the publican is making a hearty markup too)

- smoking (again expensive hobby, taxed at 2000% or whatever, likely
  to make you die young, but hey, that's their choice)

- have satellite dishes, cars, fancy consumer electronics collections

So if any kids are being deprived of winter clothes or whatever, it's
not because their parents don't have enough money, it's because their
parents are stupid, or selfish.  At least this is the overwhelming
case in a socialist welfare state like the UK.

If you go to a big city (soft-target-ville), you will see a few people
lying in doorways begging, sleeping on the streets; they're doing it
because they want to, or because they are mentally ill, or whatever.
There is no excuse with social handouts of L45 ($72) per week spending
money, plus rent paid.

>  In> If they won't make these spending tradeoffs and have not even
>  In> a buffer sufficient to carry them through a month or two or
>  In> three, I say screw them.
> 
> How about you adopting a person/family of your choice instead and
> providing them with enough startup-money, so that they can at least
> make an realistic effort to work towards a position of becoming
> financially independent themselves? :)

In the UK we have a "poverty trap".  That is the social security hand
outs are so generous that it would mean a large pay check cut for many
people to go and get a job.  For example, a qualified auto mechanic I
know: for a while he was on the dole: getting L110 spending money,
rent paid, plus fringe benefits (exemption from certain taxations).
He'd have had to be bringing in > L250/week ($400/week) or so to even
make it worth while working once you took into account lost benefits,
and cost of getting to work, and taxation of income etc.  Even then
he'd have been working for an additional hourly rate of about
0.50p/hr.  Yes he'd be self-sufficient, but working for effectively
0.50p/hr isn't much incentive.

>  In> just because Joe Sixpack spent his paycheck on beer
> 
> or on his two daughters...

More frequently on beer, I think you may find.

>  In> Or because Rawandala Brown spent her money on crack
> 
> or supporting her sick mother instead.

In the UK sick mothers get state pensions, sick pay.  Daughters who
have enough wits about them would even get paid by the state to look
after said sick mother.

> Your repeating of government-propaganda about the "abuse of the
> welfare-system" etc. doesn't really cut it as an argument in a
> discussion about the realism of having total financial independence
> and the freedom of choices, that comes with it.

You don't need total financial independence, all you need is a few
months buffer.


I don't really think that most capitalists are cold-hearted bastards,
charity is fine.  But the state is an ineffient mechanism for
providing social security.  And being forced to hand over `charity' at
the point of a gun isn't appreciated.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



"Self-reliance and socialism are diversions confected by
capitalism to conceal its evils," some poor bastard 
finally understood, muttered to nobody and died.

Nearly all governments are socialist to some degree
in that they provide services (bribes) that other social
structures do not; even the vilest must do so to fend off the 
hordes, rebels and revolutionists, or go broke funding
the military, guards, spies and police, as most eventually
do like the wealthy being sucked empty by their lawyers,
bankers, families and lovers.

Indeed, the most fervent proponents of coercive force
are those who have the greatest wealth to protect against
the folks trying to get it by all possible means. "More cops,
more laws, more education in obedience, more loyalty
oaths and prenupital 'surely you're joking's."

However, even those of great wealth know that mere
coercive power is not enough, that you've got to employ
religion, education, culture and social pressure to induce
acceptance that some have it and some don't, and screw 
those who don't -- keep the Armalite handy. 

Borrowing from the Catholic Church, John Calvin tweaked 
this wealth-hoarding philosophy to a high-definition blind faith in 
predestination: one is born to have it and too bad about the 
others -- which relieves those who got it by luck and crime 
(misnamed self-reliant hard work and careful planning) and 
can't quite find solace in their own self-deception, can't
quite believe their protectors are trustworthy.

Calvinist voodoo in updated guises has been for a couple of 
centuries the fundamentalist faith of the newly wealthy of the 
industrial (and now electronic) culture, and economic 
soothsayers know how to keep the grants, lecture fees and 
book profits coming by peddling all sorts of new versions 
especially tailored to fit semi-ignorant, fearful souls unsure 
how to capitalize on their capital, and terrified that it will 
evaporate just as inexplicably as it rained down on the very 
spot they happened to be at while all around them folks
were dying of drought.

None of this applies to the good hearts on this list, who are
amazingly generous of their time to contribute wit and wisdom
and frank admission that what else can one do except
joke about god's folly, endure the drought and pray that the 
rains come and shit storms don't. As now in southeast Asia.

What an amazing RICO op is Wall Street, now World Street, 
comparable to RICO government, now world gov, composed
of the same Bosses and Pols working hand in hand to
smirk, smirk blame the other, both knowing that self-reliance
and socialism are for clueless fools unable to grasp the 
wonders of highly organized theft to avoid labor (and taxes) 
altogether, that coercive-capitalist-gov self-delusion unable
to stanch the endlessly increasing cost of defending security 
threats.

Now, I have to confess that stock market plunges lift my spirits 
wonderfully. Without that I have only the WSJ's thigh-slapping
comedies of financial vainglory and ruin. And aoccasional 
upbeat homilies here about how to get ahead -- none believable 
of the jokemaster authors. Tim, Adam, Good Humorers.







From whgiii at invweb.net  Sat Oct 25 06:47:40 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Sat, 25 Oct 1997 21:47:40 +0800
Subject: Saving money
In-Reply-To: <1.5.4.32.19971025125724.00b95048@pop.pipeline.com>
Message-ID: <199710251336.JAA19907@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <1.5.4.32.19971025125724.00b95048 at pop.pipeline.com>, on 10/25/97 
   at 08:57 AM, John Young  said:

>Now, I have to confess that stock market plunges lift my spirits 
>wonderfully. Without that I have only the WSJ's thigh-slapping comedies
>of financial vainglory and ruin. And aoccasional  upbeat homilies here
>about how to get ahead -- none believable  of the jokemaster authors.
>Tim, Adam, Good Humorers.

 John is off his med's again.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFH2iI9Co1n+aLhhAQEG5gP/fNLhYK7x9VWqwr7teT/ww///O12H2HzU
6uPKWYMn/M+XnoTbJyu8qI66GsuUCv6WdrfwDxQVSeKqxU6+PFGBtO6SDWfLsB09
3iWQa0XO+23s3CVxNDD6Do0dK4G5XIY+5nP9+29tinmq3vn3CkwYgj0crR026zJd
ANgwafF3cZI=
=02Yu
-----END PGP SIGNATURE-----






From ravage at ssz.com  Sat Oct 25 06:48:35 1997
From: ravage at ssz.com (Jim Choate)
Date: Sat, 25 Oct 1997 21:48:35 +0800
Subject: Administration to revive vetoed projects [CNN]
Message-ID: <199710251415.JAA28964@einstein.ssz.com>



Forwarded message:

> Administration Will Help Revive Some Vetoed Projects
> 
>   Aides put the blame on Defense Department for line-item veto mistakes
>   
>     line item
>    
>    WASHINGTON (AllPolitics, Oct. 24) -- The Clinton Administration is
>    looking for ways to restore funding for a number of military projects
>    which, aides say, the president mistakenly vetoed.
>    
>    In a letter to Senate Appropriations Committee Chairman Ted Stevens
>    (R-Alaska), White House budget chief Franklin Raines blamed the
>    Defense Department for providing faulty data, which he said led to the
>    vetoes.
>    
>    Clinton, wielding his new line-item veto power that allows the
>    president to strike individual items from larger spending bills,
>    vetoed 38 military projects from this year's defense funding bill on
>    Oct. 14. raines
>    
>    Congressional leaders have said despite the administration's mea
>    culpa, they are not about to try to revive the spending projects for a
>    veto-override vote during an election year.
>    
>    But Raines told Stevens, "We are committed to working with Congress to
>    restore funding for those projects that were canceled as a result of
>    inaccuracies in the data provided by the Department of Defense."
>    
>    How? Three possibilities have been floated: One would shift surplus
>    funds from the Defense Department's existing budget; another would
>    include the money in a supplemental spending bill next year; a third
>    would insert the items in a so-called "bill of disapproval."
>    
>    Stevens told reporters the White House had expressed willingness to
>    revive 14 projects, though he put the number of mistakenly vetoed
>    projects at 28.
>    
>    "Maybe even the White House is educable," the Alaskan muttered to
>    reporters after a hearing Thursday on Capitol Hill.






From Cindy at mcglashan.com  Sat Oct 25 21:51:05 1997
From: Cindy at mcglashan.com (Cindy Cohn)
Date: Sat, 25 Oct 1997 21:51:05 -0700 (PDT)
Subject: Bernstein oral argument set for December 8
Message-ID: <199710260417.VAA05536@gw.quake.net>


Hi all,

The 9th Circuit  Court of Appeals has set the specific date and time for the
oral argument.  It will be on Monday December 8, 1997 on the 1:30 p.m.
calendar.   It will be held in Courtroom 1.

The 9th Circuit is located at  95 Seventh Street in San Francisco.

There are 5 cases scheduled for the yet-unknown panel.  The first 3 are
limited to 10 min oral arg per side.  The other two (us included) get 20
min per side.

Cases are generally heard in order so as it stands we would be last.

Cindy
************************ 
Cindy A. Cohn                                                               
McGlashan & Sarrail, P. C.
177 Bovet Road, 6th Floor                                            
San Mateo, CA  94402
(415) 341-2585 (tel)
(415)341-1395 (fax)
Cindy at McGlashan.com
http://www.McGlashan.com






From ravage at ssz.com  Sat Oct 25 06:52:34 1997
From: ravage at ssz.com (Jim Choate)
Date: Sat, 25 Oct 1997 21:52:34 +0800
Subject: FBI say San Francisco blackout sabotage [CNN]
Message-ID: <199710251416.JAA28998@einstein.ssz.com>



Forwarded message:

>                  FBI SAYS SAN FRANCISCO BLACKOUT WAS SABOTAGE
>                                        
>      Blackout October 24, 1997
>      Web posted at: 10:10 p.m. EDT (0210 GMT)
>      
>      SAN FRANCISCO (AP) -- Utility officials increased security at power
>      stations around San Francisco on Friday after FBI investigators said
>      someone intentionally cut power to the city's downtown.
>      
>      "It was a deliberate act," said FBI spokesman George Grotz. "It was
>      not an accident, and it was not a computer intrusion."
>      
>      Robert Glynn Jr., president and chief executive officer of Pacific
>      Gas & Electric Co, declined to comment on whether authorities
>      believe it was an inside job.
>      
>      Grotz said there was no sign of forced entry into the locked city
>      substation, and agents are looking at records of about 75 employees
>      who had access to the building. Sabotage of an electrical facility
>      is a federal offense.
>      
>      FBI agents examined the switches and dusted the equipment for
>      fingerprints, Grotz said.
>      
>      The switches in the substation were toggled in such a way as to
>      maximize the power outage. The saboteur had cut power coming into
>      and out of the station, Grotz said.
>      
>      The effect was that a bank of transformers failed around 6:15 a.m.
>      Thursday, blacking out electricity to 126,000 customers -- about
>      250,000 people -- in a five-mile, mid-city stretch from the Marina
>      to the Sunset districts for 90 minutes or more.
>      
>      The blackout stopped elevators and alarm clocks, knocked out traffic
>      signals and left commuters shouting and honking their horns in
>      frustration.
>      
>      Police spokesman Sherman Ackerson said the department held over its
>      midnight shift and put 450 police and parking patrol officers on the
>      streets to ease traffic headaches.
>      
>      Entire neighborhoods lacked public transit because much of the
>      city's bus system runs on electricity. Bay Area Rapid Transit trains
>      kept running, but two stations went dark and briefly closed.
>      
>      The city was back to normal Friday morning, with traffic and
>      omnipresent coffee machines humming as usual -- a far cry from
>      Thursday's chaos, said Joshua Larsen of the Coffee Roastery, a
>      bean's throw from San Francisco's famous Powell Street cable car
>      turnaround.
>      
>      He had just arrived for work and was preparing the morning coffee
>      when everything stopped.
>      
>      "Right in the middle of grinding coffee -- it was a blend of Kenya
>      and French roast -- the power stopped cold," Larsen said.
>      
>      Copyright 1997   The Associated Press. All rights reserved. This
>      material may not be published, broadcast, rewritten, or
>      redistributed.






From jya at pipeline.com  Sat Oct 25 07:46:24 1997
From: jya at pipeline.com (John Young)
Date: Sat, 25 Oct 1997 22:46:24 +0800
Subject: PGP, Inc.--What were they thinking?
Message-ID: <1.5.4.32.19971025143010.00ba3170@pop.pipeline.com>



Kent Crispin wrote:

>I understand what Lucky meant when he said that PGP had pulled the
>greatest hack ever on corporate America.  It's so good that you have
>to conceal your mirth, for fear of screwing it up... 

Yes, yes, it's great that the bosses bought the fool's tool, as they ever
are doomed to do, unable to escape that the underlings are forever 
disobedient and disloyal, for right and good reasons: too little pay, as 
employers are forever rightfully and reasonably paranoid: too little 
Shut the FU labor.

The eternal conflicting interests of the two -- whether gov/cu, he/she,
them/us -- is what generates economic enterprise between competitive
groups. Each is doomed to fall victim to peddlers of "this will ease
your insecurity for sure, trust me," selling to both sides, betraying both 
sides, bragging to insiders "what clueless jerks, more born every day".
The braggarts whistling in the dark at their own terrors.

Call them leaders, pols, priests, journalists, scientists, wonks, seers, 
agony aunts, talking heads, headless tadpoles, all wise asses who are 
convinced they know what's what when they actually don't know S 
from S but are mesmerized by their latest foolhardy intellectual conceit, 
their copyrighted IP IPO for orchestrating a cheating win they don't 
deserve, doped max on auto-delusionary what were they PGProzacking.

Damn, Geiger, was it you snatched my Rx?







From zooko at xs4all.nl  Sat Oct 25 10:11:23 1997
From: zooko at xs4all.nl (Zooko Journeyman)
Date: Sun, 26 Oct 1997 01:11:23 +0800
Subject: in celebration of informational "vandalism"
Message-ID: <199710251706.TAA04953@xs1.xs4all.nl>



Forgeries motivate people to adopt digital signature 
technology!  Spam motivates people to develop better filtering 
techniques!  Cracks motivate people to adopt secure systems and
to back-up their important data!  Mailbombs and SYN floods 
motivate people to acquire denial-of-service-attack-resistant 
services!  Trolling a la D.M.Vulis separates the tough and 
realistic from the fragile psyche and nascent censor!


In the world of physical interaction, attacks or acts of 
vandalism are the components of evolutionarily stable
(more or less) strategies of extortion and oppression.
But in the world of information exchange, no such strategy
is evolutionarily stable, and each attack is best regarded
as an opportunity to up your tech and improve your capabilities
while simultaneously defending against further attacks.


:-)


Z






From declan at well.com  Sat Oct 25 10:18:43 1997
From: declan at well.com (Declan McCullagh)
Date: Sun, 26 Oct 1997 01:18:43 +0800
Subject: TIME and time again
In-Reply-To: <3451767E.3100@dev.null>
Message-ID: 



At 22:33 -0600 10/24/97, TruthMonger wrote, quoting Ginsberg:
>At first reading, it struck me as a precise characterization of Time's
>own assault on the American mind.

TruthMonger's post is sorta funny, actually. But I wouldn't say that about
Time (at least now -- I don't know what the organization was like
internally before I joined). I've been at Time one year. The people I work
with in the bureau are top-notch reporters.

And for a change one of my articles actually seems to be staying in and not
getting cut for Diana updates -- at least not yet...

-Declan








From tcmay at got.net  Sat Oct 25 10:21:05 1997
From: tcmay at got.net (Tim May)
Date: Sun, 26 Oct 1997 01:21:05 +0800
Subject: The Coming Tax Holocaust
In-Reply-To: 
Message-ID: 



At 4:22 AM -0700 10/25/97, Adam Back wrote:

>Absolutely.  I recall trying to explain to someone who was prone to
>spending money he didn't have:
>
>- if you spend it before you've got it, you'll get to spend less,
>  because of the interest you pay in the mean time
>
>- where as if you spend it some time after you've got it, you'll be able
>  to spend more because you will accumulate interest prior to spending.

This is exactly the "discipline" problem I was talking about. To too many
people, money burns a hole in their pocket: if they've got cash in their
pocket or in their checking account, it's something to be spent. If they've
got multiple credit cards, they see the credit limit as "free cash." So too
many of them are maxed out, or close to be maxed out, on credit cards.

Those of us who think of money as something to be invested, as an engine
for investment growth, have quite the opposite view. Credit card debt is
the worst kind of debt (well, almost the worst....owing money to bookies
and sharks is probably worse).

I also see a lot of fools around me buying lottery tickets and other
state-sponsored gambling ventures. The odds on winning are criminal (these
operations _would_ be criminal if not being run by the state!).  Statistics
show that many of these frequent gamblers--often low-income persons--spend
about $100 a month, on average, in bets.

(Had they instead invested this $100 a month in tech stocks, as I did,
they'd have quite an impressive fund now.)



>Spending every penny before you've got it and then looking around for
>someone else to pay the bills is a socialist tendency.  The nanny
>welfare state.  Legalised theft from those that have worked to those
>who have not.

This is, by the way, why spreading strong, unbreakable, un-GAKked, un-GMRed
crypto is so important. We who have saved need to put our assets beyond the
reach of those who have failed to save...sometimes an Armalite is not
enough, despite what John Young said this morning.

The official U.S. "national debt" (money already spent but not in
possession of the government when spent, hence borrowed from "the future")
is around $5.5 trillion ($5.5 x 10^12). There are 250 million Americans,
but a more important figure is that there are about 100 million taxpayers.
(The rest being children, prisoners, disabled persons, bums, winos, welfare
recipients, drifters, more prisoners, more panhandlers, more on the dole,
etc.).

This means that each and every taxpayer, on average, has a $55,000 share of
this debt, which presumably must be someday paid back.

(There are theories about how this is not actually that much of a debt,
blah blah. I disagree. This debt is much more than the savings or
investments of average taxpayers, meaning, they "owe" more than their
"worth.")

In any case, the story is much worse than this. Because the government has
committed itself legally to cover certain debts and to cover the costs of
certain other obligations, notably pension funds, student loans, and
various financial ventures (savings and loan bailouts, for example), the
actual debt is much higher than the offically reported national debt. The
national debt, for example, does not include the Social Security or
Medicare deficits--the U.S. has been taking in SS and such taxes and
immediately spending them, placing an "I.O.U." into the treasury. These
I.O.U.s will of course have to be redeemed someday, in the sense that the
Baby Boomers, all 60 million of us, are going to start retiring in around
2010 and will be expecting to get their Social Security and Medicare (etc.)
checks. This will correspond to a time when fewer young workers are
available....

The name for this "overhang" is "unfunded liabilities." How large is this
debt? Estimates vary, and official estimates are hard to come by. The
number I have seen reported by reputable actuaries and accounties is, get
this, $20 trillion.

$20 trillion (and growing every year) to cover the promises made, the loans
insured (which are not expected to be repaid by the original borrower), the
pension funds backed by the government, the Social Security and Medicare
systems, the benefits for tens of millions of veterans, the child care
programs, and so on.

Meaning every taxpayer has a $200,000 obligation hanging over him.

This is the situation we have gotten ourselves into.

Some experts have calculated the tax implications of this overhang of
unfunded liabilities. It looks like the average 20-year-old of today,
meaning, many readers of this list, will be expected to pay 50-60% of their
paychecks in 15 years just to service the debt of this overhang.

(I've seen estimates that the tax rate in 2010-2020 will have to climb to
80%, as otherwise there just isn't the funding and the government will
default. This makes certain assumptions about income levels, interest
rates, etc. But the general trends are clear.)

The tax cuts of the past year should not confuse anyone. Nor should the
"national debt is declining" crap confuse anyone. The national debt is not
in fact going down...the last year or so has seen a reduction in the _rate
of increase_, and the budget is close to being "balanced," courtesy of the
recent economic surge. That is, the national debt will, temporarily, remain
at about $5.5 trillion, instead of going to $5.7 T, then $6T, then $6.3T,
etc., as it had been trending toward.

But the overhang remains, and must be paid eventually. (If not paid off,
the interest portion consumes ever-greater portions of spending.)

And the $20 trillion (estimated) overhang of unfunded liabilities will
start to hit hard when these liabilities come due.

So, we as individuals must find ways to protect ourselves from the Coming
Tax Holocaust.

But that's another set of articles.

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From nobody at REPLAY.COM  Sat Oct 25 10:30:27 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 26 Oct 1997 01:30:27 +0800
Subject: Office of the Secretary of Defense vs the First Amendment
In-Reply-To: 
Message-ID: <199710251720.TAA25167@basement.replay.com>



Someone is vastly over-reacting.  I read this letter as a polite request
to do what they think is the "right thing" along with some reasons
intended to gently persuade you that this is a morally correct choice. 

There is no threat.  No hint of compulsion.  It is IMHO utterly legal and
appropriate.

Just as it would be utterly legal to comply with or ignore this
letter. (Appropriateness we could debate...)

No foul.



A. Michael Froomkin        � +1 (305) 284-4285; +1 (305) 284-6506 (fax)
Associate Professor of Law � remailed to foil spam
U. Miami School of Law     � froomkin =A=T= law.miami.edu
P.O. Box 248087            � http://www.law.miami.edu/~froomkin/
Coral Gables, FL 33124 USA � It's quite warm here






From ravage at ssz.com  Sat Oct 25 10:53:21 1997
From: ravage at ssz.com (Jim Choate)
Date: Sun, 26 Oct 1997 01:53:21 +0800
Subject: Office of the Secretary of Defense vs the First Amendment (fwd)
Message-ID: <199710251817.NAA29584@einstein.ssz.com>



Forwarded message:

> Date: Sat, 25 Oct 1997 19:20:55 +0200 (MET DST)
> Subject: Re: Office of the Secretary of Defense vs the First Amendment 
> From: nobody at REPLAY.COM (Anonymous)

> Someone is vastly over-reacting.  I read this letter as a polite request
> to do what they think is the "right thing" along with some reasons
> intended to gently persuade you that this is a morally correct choice. 
> 
> There is no threat.  No hint of compulsion.  It is IMHO utterly legal and
> appropriate.
> 
> Just as it would be utterly legal to comply with or ignore this
> letter. (Appropriateness we could debate...)
> 
> No foul.
> 
> A. Michael Froomkin        � +1 (305) 284-4285; +1 (305) 284-6506 (fax)
> Associate Professor of Law � remailed to foil spam
> U. Miami School of Law     � froomkin =A=T= law.miami.edu
> P.O. Box 248087            � http://www.law.miami.edu/~froomkin/
> Coral Gables, FL 33124 USA � It's quite warm here


Lawyers = bottem feeding scum suckers

They're the ones who get us in these kinds of messes.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From shamrock at netcom.com  Sat Oct 25 11:08:17 1997
From: shamrock at netcom.com (Lucky Green)
Date: Sun, 26 Oct 1997 02:08:17 +0800
Subject: Technical Description of PGP 5.5
In-Reply-To: <3.0.2.32.19971022210316.00727944@netcom10.netcom.com>
Message-ID: <3.0.2.32.19971025110333.03966b0c@netcom10.netcom.com>



At 03:25 PM 10/24/97 +0100, Adam Back wrote:

[Busy week. Expect increased response time].

>If the pgp5.5 functionality is designed to provide companies with a
>disaster recovery procedure (forgotten passphrase, or dead employee),
>there are much better ways to do it.  We're not arguing against the
>user requirement, just against the methodology.

There have been numerous proposals on the list to accomplish the above
goals in a way other than the method employed by PGP. I have read the
proposals and I am not convinced that said proposals are less intrusive.
IMO the vast majority of the proposals I saw are more intrusive. One
subscriber even argued, make that screamed, that PGP 5.5 was evil because
it didn't automatically cc: the email to the corporate recovery agent. The
mind boggles.


--Lucky Green 
  PGP encrypted mail preferred.
  DES is dead! Please join in breaking RC5-56.
  http://rc5.distributed.net/






From ravage at ssz.com  Sat Oct 25 11:12:00 1997
From: ravage at ssz.com (Jim Choate)
Date: Sun, 26 Oct 1997 02:12:00 +0800
Subject: Judge orders man to obtain permission to file suits [CNN]
Message-ID: <199710251836.NAA29693@einstein.ssz.com>



Forwarded message:

>          JUDGE CLAMPS DOWN ON FLORIDA MAN FOR FILING TOO MANY LAWSUITS
>                                        
>    AP
>    25-OCT-97
>    
>    
>    MIAMI (AP) Enough is enough. Chief U.S. District Judge Edward Davis
>    said he is tired of reading "rambling, incomprehensible diatribes"
>    directed at everyone from Elizabeth Dole to William Rehnquist.
>    
>    So Davis has ordered Robert Parker of Deerfield Beach to get his
>    written permission before filing any more lawsuits. Parker has filed
>    at least 85 federal suits in 10 years.
>    
>    In dismissing the latest batch of 11 suits, Davis said Parker has
>    argued that "three presidents, the chief justice of the Supreme Court,
>    the CIA, the FBI, the 11th Circuit Court of Appeals, every judge and
>    magistrate in this district, as well as numerous executives of the
>    American Red Cross and related entities engaged in a massive civil and
>    criminal conspiracy to deprive Parker of employment, his marriage,
>    access to the federal courts and, indeed, his very life."
>    
>    Parker's displeasure apparently stems from his five-year employment
>    with the Red Cross until 1972, and an executive's alleged remark to
>    his next employer that he was fired for stealing.
>    
>    "The bottom line is that this district has expended enough of its
>    scarce resources administering the same complaint from Parker," Davis
>    wrote Thursday.
>    
>    Parker's home telephone number is not listed and he could not be
>    reached for comment.






From ravage at ssz.com  Sat Oct 25 11:15:14 1997
From: ravage at ssz.com (Jim Choate)
Date: Sun, 26 Oct 1997 02:15:14 +0800
Subject: Compuserve going after corporate customers [CNN]
Message-ID: <199710251838.NAA29731@einstein.ssz.com>



Forwarded message:

>             COMPUSERVE SETS ITS SIGHTS ON CORPORATE INTERNET USERS
>                                        
>    InfoWorld
>    25-OCT-97
>    By Rebecca Sykes
>    
>    
>    
>    CompuServe last week announced an online product targeted at business
>    Internet users.
>    
>    The offering, called C from CompuServe, will combine CompuServe's
>    features, such as its forums, in new ways to appeal to Internet-savvy
>    business users who require different functions from the Web than
>    consumers, according to Bob Kington, executive producer of CSi, the
>    company's online service.
>    
>    The Internet "is great for surfers; it's not good for busy business
>    people," Kington said. Business people "want to get on, get their
>    information, and get off [of the Internet]."
>    
>    C for CompuServe will assist them in doing so by packaging
>    CompuServe's assets in new ways. Instead of following the model of
>    CSi, the company's current online offering that gives paying
>    subscribers full access to all forums and other CompuServe resources,
>    C will offer access on three levels.
>    
>    * The Guest level will provide free, read-only access to CompuServe's
>    500 forums to all Web users. Guest-level users also will have access
>    to forums' reciprocal links to thousands of Web sites selected for
>    their relevance to the forums' topics.
>    
>    * The Member level will operate on a pay-per-transaction basis to
>    provide access to hundreds of research databases. Users enter their
>    credit-card information online once and then are charged small amounts
>    for functions they perform.
>    
>    * The Subscriber level will offer three options. One will feature full
>    interactive access to forums, including posting and receiving
>    messages, and will cost less than $10 per month. The other two
>    options, which will each be priced quite a bit lower, are a
>    subscription to integrated e-mail, voice mail, fax, and pager services
>    and a subscription to Computing Pro, a value-added service for
>    computing professionals.
>    
>    The service, free to current CSi users, will be available by year's
>    end.
>    
>    Asked whether CompuServe was acting prematurely given the impending
>    acquisition by America Online of its online assets, Steve Conway,
>    CompuServe vice president of corporate communications, said it was
>    just moving ahead with plans it had before AOL made its bid.
>    
>    CompuServe Inc., in Columbus, Ohio, can be reached at (614) 457-8600.
>    America Online Inc., in Dulles, Va., can be reached at (703) 448-8700.
>    
>    
>    Rebecca Sykes is a Boston correspondent for the IDG News Service, an
>    InfoWorld affiliate.
>    
>    Article Dated 24-OCT-97
>    
>    COPYRIGHT 1997 InfoWorld Publishing Company






From semprini at theschool.com  Sat Oct 25 11:28:49 1997
From: semprini at theschool.com (semprini at theschool.com)
Date: Sun, 26 Oct 1997 02:28:49 +0800
Subject: Elliptic Curves
Message-ID: <199710251814.LAA03164@k2.brigadoon.com>



Can anyone point me to some good documentation on elliptic curves as 
applies to cryptography? I'm interested in finding some good 
documentation from which I would be able to learn how to use elliptic 
curves in creating a public/private key system. I have mainly been 
studying symmetric systems and would like to move on to asymmetric 
systems. Any help would be appreciated.

--Dylan






From mixmaster at remail.obscura.com  Sat Oct 25 11:46:17 1997
From: mixmaster at remail.obscura.com (Mix)
Date: Sun, 26 Oct 1997 02:46:17 +0800
Subject: Saving money
Message-ID: <199710251832.LAA17149@sirius.infonex.com>



-----BEGIN PGP SIGNED MESSAGE-----

Harka wrote:
>Do you really expect single mothers with 3 kids to have the time to
>do it to the degree of being able to _freely choose_ their
>employers?? Or even Joe Average, who just came out of College and has
>$100 000 school-loan-debt?

Certainly there are people who will give up their privacy rights for
money.  Some of them will not perceive it as a problem.  Some will
have put themselves into a bad situation where the money is worth more
than their privacy.

In almost all cases their problems do not exist outside their minds.

The mother with 3 children did not get into that situation by
accident.  Certain choices and actions were taken that put her into
that "bad" situation.  ("Bad" in quotes because if one really really
wants to have children, the situation may be preferable to the
alternative.)

The kid who borrows $100,000 and can't find a good job did not receive
good advice.

It is terribly important to recognize when people are in situations of
their own creation if we wish to advise people in ways to avoid such
situations or avoid them ourselves.

>While I am glad for your achievements, you have not addressed my
>point: all this doesn't apply to the larger mass of people.

I completely disagree with this.  Read "Your Money or Your Life" by
Joe Dominguez and Vicki Robin.  This book describes a method which
anybody can use to make good decisions in managing their life.  The
purpose of the book is to teach ordinary people how to become
independently wealthy.  There are few people who would not benefit
from this method and who are incapable of applying it.

>You were fortunate enough to be in the right place at the right
>time...one of the founding-members of a company in an industry, that
>pays way more than average and thus brought you into the position,
>that you're in now. Great...more power to you and I encourage
>everybody to try the same.

You should also look at "The Millionaire Next Door" by Thomas
J. Stanley and William D. Danko.  This is a study of millionaires in
the United States.  To quote from "Money" magazine: "To learn what
today's millionaires have in common and how they accumulated their
wealth, Stanley and Danko sent questionnaires to affluent Americans
and conducted focus-group interviews.  They learned that about
two-thirds of those millionaires who still work are self-employed -
versus one in ten for all Americans.  The types of businesses they own
tend to be mundane, such as welding and dry cleaning.  The
overwhelming majority aren't trust-fund babies; eight out of ten
accumulated their riches themselves.  Most are extremely frugal.
Although their average net worth is $3.7 million, they generally live
so modestly that even their neighbors don't have a clue about their
wealth."

The article has these five bullet points to recommend:
"1. Live below your means.
 2. Launch a savings and investing plan.
 3. Take on debt sparingly.
 4. Pay as little as possible to Uncle Sam.
 5. Start your own business."

Standard Ben Franklin stuff, but it works.

>But if the available work-force exceeds the demand for it, such jobs
>wouldn't pay nearly as much as they do right now.  Hence, achieving
>financial independence to the point of freely choosing employers
>would become much harder again.

Actually, it doesn't cost much to change employers.  All you have to
do is find an employer who will hire you.  Mostly this is a question
of time and effort.

>But this is the reality for MOST people (outside of the
>elite-industries) already! Especially if they start out with
>student-loan-debts amounting to several ten thousands of dollars.
>Add a family/kids to that and you tell me how easy a task it will be
>to quickly become independently wealthy.  (Some people will be able
>to pull it off somehow, most people won't - - despite their wishes to
>the contrary. Should they make their best effort? Absolutely! Will
>everybody succeed? Absolutely not.)

I agree most people will probably not pull it off, but that's too bad.
The reason they won't pull it off is that they won't make their best
effort.  Sure, you can dig up people who appear to have really tried
and then failed anyway, but they are rare.

You can easily see that most poor people are not making their best
effort by studying how much money they spend on alcohol, tobacco, or
other recreational substances.  You can also study TV watching habits.
Poor people watch a lot of TV instead of making themselves useful.

>The truth is, that there are many people outside of Cypherpunks, who
>get barely through life _despite_ making efforts. They may get enough
>salary in their 9-5 job to maintain themselves to a degree, but not
>nearly enough to have the complete freedom, that is the issue
>here. And to say, "they get what they deserve" (if they don't have
>the abundance of dollars/freedom) is rather narrowminded and
>out-of-touch with most people's reality.

Gee, I don't know about that.  When I was in school there was
tremendous peer pressure to not study, to not get good grades, to not
program, to not study electronics, to not master calculus,
etc. etc. etc.  If those people end up poor, I have no hesitation in
saying they deserve it - at the very least!

>That may indeed work for some people, but the argument of
>"self-discipline and sacrifice" usually goes overboard once people
>_other than yourself_ are severely affected by that. "Sorry hun, you
>can't have a new winter-coat. Mommy has to save enough money so that
>she can choose the people she works for. And no...no christmas this
>year either".

I think I hear violins! ;-)

In practice, these are very seldom the choices that are being made.
Winter coats are available second hand for almost nothing.  When I was
a kid my parents made many of our presents by hand to save money.
Christmas need not be expensive, and it's not clear that it is
improved in any meaningful way by spending lots of money.

People are perfectly capable of living economically and making
good decisions, even when their children are involved.

(In> is Tim May, quoted by Harka.)
> In> If they won't make these spending tradeoffs and have not even a
> In> buffer sufficient to carry them through a month or two or three,
> In> I say screw them.

>How about you adopting a person/family of your choice instead and
>providing them with enough startup-money, so that they can at least
>make an realistic effort to work towards a position of becoming
>financially independent themselves? :)

Uh, excuse me, but I didn't see Tim volunteering for Santa Claus duty.
Why should he help out people who will, in all probability, fail to
take his advice, squander any money he gives them, and resent him for
his efforts?

For that matter, why should he help out people who will be eternally
grateful if he doesn't value that gratitude?

And the claim that all that is needed is a little startup money is a
standard lame excuse that has probably been used for millenia.  Making
excuses is not how the job gets done.

>I suggest in return you reconsidering the myth, that a free market
>means equal opportunities and thus quick self-reliance for everybody.

The term "equal opportunities" is a curious one.  A free market does
mean that everybody has the equal opportunity to make agreements with
each other.  But, clearly some people will have more success making
these agreements for reasons which are not under their control.
Somebody might have parents who introduce them to the right people and
show them the ropes, for instance.  This is one reason why the free
market does not eliminate the formation of elites.  But, so what?  Are
we really going to claim that people shouldn't help their children to
succeed?

In the sense that I think you mean the term, "equal opportunities" are
exceedingly undesirable.

Monty Cantsin
Editor in Chief
Smile Magazine
http://www.neoism.org/squares/smile_index.html
http://www.neoism.org/squares/cantsin_10.htm

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBNFIxl5aWtjSmRH/5AQFjQAf9GlFXsJQ1Iyii7Ch26a38Xi80Q1QMcbq4
rJPVzncFntQjfau99j6jUiNdsjk2Zr8XhLZtyP95yQX3VcaAmsyY7imXImWyH1uU
r2OezEg5S9+e/mi7knTsOfzlYOBhKklMTprKo2K539g05B9xJCOqb8S9CyX9/Ie6
5ZH2gss2jANWM6cWsCmZ0nRtG3Rc1fKXJDl5DgsdceCzkVRGms6r7WMzvwUxTTFC
wlaWUwjyUcnEK+cqnvsq4rBW/Bh4dvCwzUnEHbyckukO5wOsYxDFb9kuWaIufMJh
ukvif/SP9SGzLsqpJ/Iv2pqdRL7B/C4DP+gFP1iODkaER0a7/wUR9A==
=9Kt3
-----END PGP SIGNATURE-----







From jya at pipeline.com  Sat Oct 25 11:57:55 1997
From: jya at pipeline.com (John Young)
Date: Sun, 26 Oct 1997 02:57:55 +0800
Subject: Office of the Secretary of Defense vs the First Amendment (fwd)
Message-ID: <1.5.4.32.19971025184415.00b67218@pop.pipeline.com>



Jim choate wrote:

>Lawyers = bottem feeding scum suckers
>
>They're the ones who get us in these kinds of messes.

You may be right for all others, and you may be kidding, but in the 
case (!) of world-beloved  Michael Froomkin, he's the sweetest, 
kindest, most caring, funniest lawyer professor qua human on the 
orb, in the dying galaxy, ever. 

Visit his web page for irrefutable confirmation that he is the real 
thing in earthbound angels of legal humor.

   http://www.law.miami.edu/~froomkin/

Best of all, he has no e-mail address.

[This is a pitifully low-bartered bar-prohibited ad]








From nobody at REPLAY.COM  Sat Oct 25 12:22:25 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 26 Oct 1997 03:22:25 +0800
Subject: PGP Employee on MKR
Message-ID: <199710251915.VAA07284@basement.replay.com>



-----BEGIN PGP SIGNED MESSAGE-----

Harka wrote:
>Implying, that the freedom of an (average) person does not get
>infringed by (privacy-intrusive) policies "because they can always
>choose a different company" is IMHO plainly incorrect and out of
>day-to-day reality for most people.  (Also note, that I am not saying
>companies don't have the right to have such policies)

It sounds like everybody is in agreement, then.  Companies have the
right to ask their employees to give up some privacy, time, and
effort.  You are arguing that many employees will opt to give up their
privacy rights because that choice is preferable to the others they
perceive.  Because there is a large number of such people, it is
likely that large numbers of people will become accustomed to giving
up their privacy and will be sympathetic when other people are forced
to give up their privacy.

Where there may be some disagreement is whether the solution is to
pass even more laws that restrict what choices people may make
or to pursue other solutions.

Given that the governments of the world are the source of nearly all
privacy problems, it seems unlikely that an appeal to government is
likely to be productive.

Monty Cantsin
Editor in Chief
Smile Magazine
http://www.neoism.org/squares/smile_index.html
http://www.neoism.org/squares/cantsin_10.htm

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBNFIjYJaWtjSmRH/5AQHm7gf+NswjBZyddLueZ66LbSw3YA2xcf5U8PLz
v8dZaB2RjFqI7GCS8xXKY+fOg7OQ31sy6OR7yOOpHRoeAB5OU1vqR9lAKQwUX26C
pp+ROMKT+TRCj1uLaCdSqgCq8I4Hg8TFWHxuVM81si8sgZGDMTD72EmXY32Av9na
8CtQu+vFx7OZiKZeoDl30TkoR3O/bnb9X4KIBNm5TTn2Fld6HL3c/iy1tSGuETnS
zLWSUvxqAm761wv/W73A9GAlQpOd+4DiT/rav0HIUcDrhGpGWeEhDgs5l9w6HQ9w
U2GbdiWFb74lrGS0pvPAvzfp7cZeWvODUKD/2Zk57YThhlQjIWuvFQ==
=Ghfd
-----END PGP SIGNATURE-----







From tm at dev.null  Sat Oct 25 12:23:15 1997
From: tm at dev.null (TruthMonger)
Date: Sun, 26 Oct 1997 03:23:15 +0800
Subject: Lipstick Curves
In-Reply-To: <199710251814.LAA03164@k2.brigadoon.com>
Message-ID: <34524416.726F@dev.null>



::
Anon-To: cypherpunks at toad.com

semprini at theschool.com wrote:
> 
> Can anyone point me to some good documentation on lipstick curves as
> applies to creepology? I'm interested in finding some good
> documentation from which I would be able to learn how to use lipstick
> curves in creating a public/private genitals system. I have mainly been
> studying syphlitic systems and would like to move on to ass-me-trick
> systems. Any help would be depreciated.
>
> --Dylan

Bob,
  You sick bastard. This is a _crypt_ list, not a _creep_ list.
Even someone whose mail alias is 'semiprincipled' should understand
the difference. Ask ? the Platypus for some pointers.

CreepMonger






From ravage at ssz.com  Sat Oct 25 12:34:47 1997
From: ravage at ssz.com (Jim Choate)
Date: Sun, 26 Oct 1997 03:34:47 +0800
Subject: Forwarded mail...
Message-ID: <199710252000.PAA30149@einstein.ssz.com>



Forwarded message:

> Date: Sat, 25 Oct 1997 21:15:11 +0200 (MET DST)
> From: nobody at REPLAY.COM (Anonymous)
> Subject: Re: PGP Employee on MKR

> It sounds like everybody is in agreement, then.  Companies have the
> right to ask their employees to give up some privacy, time, and
> effort.

> Given that the governments of the world are the source of nearly all
> privacy problems, it seems unlikely that an appeal to government is
> likely to be productive.
> 
> Monty Cantsin
> Editor in Chief
> Smile Magazine

Monty, without a doubt that is the stupidest thing you have ever said on
this list.

If a company makes your employment contingent on something you don't like,
change jobs. DON'T need laws, don't want laws that get involved in this.
This is *STRICTLY* a civil contract issue between the two parties, PERIOD.

Why is it that so many people start discussions regarding social issues and
then meander into government issues, or visa versa, without ANY recognition
of their schizophrenia?

Personaly, I blame it on spin doctors like yourself.

At least I have the satisfaction knowing that in no way am I contributing to
putting food on your table, making your car payments, or paying off your drug
dealer...


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From tm at dev.null  Sat Oct 25 12:51:25 1997
From: tm at dev.null (TruthMonger)
Date: Sun, 26 Oct 1997 03:51:25 +0800
Subject: Paid Ad for Michael Froomkin / Re: Office of the Secretary of Defense vs the First Amendment (fwd)
In-Reply-To: <1.5.4.32.19971025184415.00b67218@pop.pipeline.com>
Message-ID: <345249B4.95B@dev.null>



Michael Froomkin paid John Young $5.00 to write: 
> Jim choate wrote:
> >Lawyers = bottem feeding scum suckers

> You may be right for all others, and you may be kidding, but in the
> case (!) of world-beloved  Michael Froomkin, he's the sweetest,
> kindest, most caring, funniest lawyer professor qua human on the
> orb, in the dying galaxy, ever.
> 
> Visit his web page for irrefutable confirmation that he is the real
> thing in earthbound angels of legal humor.
> 
>    http://www.law.miami.edu/~froomkin/

John,
  You should have held out for $10.00 and a blow-job from a puppy
to be named later, like me.

My Testimonial:
  I lay bleeding to death in the back of the ambulance as the driver
became hopelessly lost. It was only when he stopped to check his map,
that Michael Froomkin, clinging to the back bumper, was able to 
climb inside and give the driver directions to the hospital.
  Michael not only saved my life, but he also sued the ambulance
company, the driver, the attendant, the doctor, nurses and hospital,
two witnesses to the accident, a guy in the emergency room with a
broken leg, a woman I raped six years ago, and the parents of the
two missing children who were found buried in my back yard.

  Michael had me legally change my name to Buddha, so I could collect
for the pain and suffering of the whole world, and I received a
judgment of 6 billion dollars.
  His fees came to 6 billion and two hundred dollars, but Michael
was kind enough to let me make payments on the two hundred, at only
27% interest.

  Some would have you believe that he did no more for me than any
other lawyer would do, but I think he's special.

TruthMonger






From harka at nycmetro.com  Sat Oct 25 13:14:34 1997
From: harka at nycmetro.com (harka at nycmetro.com)
Date: Sun, 26 Oct 1997 04:14:34 +0800
Subject: poverty traps (Re: Sa
Message-ID: <199710252037.PAA30248@einstein.ssz.com>



-----BEGIN PGP SIGNED MESSAGE-----

 > Harka  wrote:

 > That may indeed work for some people, but the argument of
 > "self-discipline and sacrifice" usually goes overboard once
 > people _other than yourself_ are severely affected by that.
 > "Sorry hun, you can't have a new winter-coat. Mommy has to save
 > enough money so that she can choose the people she works for.
 > And no...no christmas this year either".

 -=> Quoting In:aba at dcs.ex.ac.uk to Harka <=-

 In> That is indeed a sad financial state to be in.  I have trouble
 In> believing it though.

[examples of well-fares deleted]

 In> So if any kids are being deprived of winter clothes or
 In> whatever, it's not because their parents don't have enough
 In> money, it's because their parents are stupid, or selfish.

Although my statement was deliberately somewhat exaggerated, it is
not that far from reality for quite a few people I know.

A real-life example:

A single (divorced) mother, 4 kids (3-12 years), working full-time
and making in theory $42 000/year. After taxes that comes down to
$2000 cash per month.

In order for her to be able to work her two youngest kids go to a
day-care-center. Wham! $1000 per month (hiring a baby-sitter would
amount to even more).
Her apartment costs $800/month excluding utilities. That leaves
$200 (+ $800 she gets in child-support) per month for _five_ people
to live on (clothes, food, utilities, school-books, gas for the
car, etc.etc.)

One thousand dollars per month for five people!! And that in New
York City!
She is not entitled to any support such as free school-meals for
the kids etc., because she "makes too much money" (_before_ taxes,
of course!)

What efforts has she made to make "herself more marketable"? She has
been working ever since the age of 16, went 8 years to College (paid
by herself and paying rent at the same time) and now has a Masters
Degree in teaching.

What has it brought her? Bill-collectors calling every day!

She made a calculation and (confirming your statement) came to the
conclusion, that she indeed would have _more_ money by not working
at all and simply going on welfare.

However, that is not a choice she wants to make.

Is she to be called "stupid" and "selfish" because she's poor
despite her efforts???

I don't think so. She, btw., is not the only person I know
struggeling in this manner from one month into the next, barely
being able to even catch up on bills.

Neither does she have a free choice of employers. There is only one
board of education in the City. Changing for a private school would
come with (at least a temporary) pay-cut, that she obviously can't
afford.

Therefore:

Since she isn't the only person I can think of, who is in such a
position, the argument formerly known as "If 'ya don't like the
company-policy [employing GAK/CAK] just leave and work for
somebody else" may now be called: "Ad Acta".

Ciao

Harka

/*************************************************************/
/* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */
/* PGP public key available upon request.  [KeyID: 04174301] */
/* F-print: FD E4 F8 6D C1 6A 44 F5  28 9C 40 6E B8 94 78 E8 */
/*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/
/* May there be peace in this world, may all anger dissolve  */
/* and may all living beings find the way to happiness...    */
/*************************************************************/

... Don't you hate it when the pessimists are right all the time?

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAgUBNFJRbDltEBIEF0MBAQFAGgf+PoTI/+900uSojxfC/xKFPsEnco5fp+df
Etn4uJ23l9ZB7QczEuP96JMo+5vmFXc9Tabh5nMkNCRrA3QaAwxFh2+Boc8RvzAv
SBLbjeqnCkvca1EgfOO+eZKv/YcRAZ47JH/w6/g/ggSx3vyM9quFeOqGzljG21au
JdjFhtcdvWP2R79ldGnjswjjuT8MntSGwfx+wiKVQtt6YcK81/OKCBFMaZ8o7JTr
gzYRzv6y+622Z97rUItmdEwQtDqq8k9wtRfmV1xPloqAHJ65VcJ3HI1LoItTmase
oEWPiy6NBIeyN+Nbn+aK/egOalOHev8nX/LqTPxN3TawmxnESldEsg==
=u2Q5
-----END PGP SIGNATURE-----


If encryption is outlawed, only outlaws will have encryption...






From pnwood at earth.we-deliver.net  Sun Oct 26 04:15:41 1997
From: pnwood at earth.we-deliver.net (pnwood at earth.we-deliver.net)
Date: Sun, 26 Oct 1997 04:15:41 -0800 (PST)
Subject: DISCOUNT ADVERTISING SOURCES! $1 PER PAPER!
Message-ID: <199710210726.CAA15921@earth.we-deliver.net>


UTILIZE THIS VALUABLE INFORMATION AND IT WILL PAY FOR 
ITSELF MANY TIMES OVER!

***Nationwide Newspapers V2.0 TM***

Powerful New Reference Software

-  The First of its Kind, Classified Advertising Tool!

-  Electronic Directory of over 3,600 newspapers!

-  Sources for Over 6,000 newspapers!

-  Daily, Weekly, Shoppers, Community Papers and More!

-  Find Hard to Reach People to Respond to Your Offer!

-  Advertise by City, State, Regionally, or Nationwide!

-  Statewide and Network Advertising, Including Pricing!

-  Discount Advertising Less Than $1 Per Paper!

-  Powerful Tool for Building Huge Downlines!

-  Save Time and Money with Network Advertising, 1 Call, 
   1 Payment & you're in 100's of Papers with Millions 
   of Readers, at a Big Discount Over Individual Rates!

SPECIAL FEATURE-  Built in Sort Tool Enables Sorts by 
State, City, Circulation, Phone Number & More!

PROOF IS IN THE RESULTS!- Here's just a few:

"This program is fantastic. It allows you to target your
audience specifically or sweep whole states and regions 
of the US. I have had tremendous success with this product 
and would recommend it to anyone who advertises. It saves
time and money. What could be better!"   
  
         	--Winston James, Phoenix AZ

"I never believed in those success stories...never believed 
I would be one of them...using your program, in just one 
month, I took in over $7,000. This program provides cost 
effective time saving advertising sources that generate 
sales and leads. I recommend it to anyone in business."   
                                
          	--Ryan Tedeschi, Newport Beach CA


SPECIAL BONUS- Wholesale Rights! Act now and we will include 
information on how you could purchase this software at low 
wholesale prices. You can then market this powerful product 
any way you wish and earn big profits!


ABOUT OUR COMPANY:

We're a privately held corporation that specializes in 
Information Publishing, Marketing, Software Design, and 
creative tools for the Entrepreneur of the 90's. We have no 
doubt that this information can and will be a valuable asset 
to your business. It's the perfect product, at the perfect 
time, at the perfect price. We've seen similar information 
costing 100's of dollars.  Companies charge these high fees 
because they know that people who understand the value of the 
information will easily pay for it. Our products are more 
advanced and we make them affordable. They say that information 
is power, well we look forward to supplying you with all the 
power you need for years to come!

PRICE: We are currently charging $49. This is only a test price 
and will soon be lifted.

TO ORDER:Click on this direct link and follow 
ordering instructions.

http://www.primemarket.com/natnews1.html


$ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $
		    
WE VALUE YOUR BUSINESS

VISIT OUR WEBSITE AT

http://www.primemarket.com

FOR MONEY MAKING BUSINESS TOOLS 
THAT YOU CAN USE OR SELL.

NEW ITEMS BEING ADDED OFTEN

$ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $


*To be removed simply hit reply and send.







From pethern at inet.uni2.dk  Sat Oct 25 13:45:47 1997
From: pethern at inet.uni2.dk (Peter Herngaard)
Date: Sun, 26 Oct 1997 04:45:47 +0800
Subject: NAMBLA embattled -- mirror sites?
In-Reply-To: 
Message-ID: 



What is the NAMBLA controversy about and where can I download the site?
If the content is not commercial, that would be in violation of my AUP 
nor illegal, I can
see no reason for not mirroring it in Denmark.






From ravage at ssz.com  Sat Oct 25 13:50:09 1997
From: ravage at ssz.com (Jim Choate)
Date: Sun, 26 Oct 1997 04:50:09 +0800
Subject: poverty traps (Re: Sa (fwd)
Message-ID: <199710252113.QAA30388@einstein.ssz.com>



Forwarded message:

> From: harka at nycmetro.com
> Date: 25 Oct 1997 16:09:58 EDT
> Subject: Re: poverty traps (Re: Sa

> Although my statement was deliberately somewhat exaggerated, it is
> not that far from reality for quite a few people I know.
> 
> A real-life example:

> Is she to be called "stupid" and "selfish" because she's poor
> despite her efforts???
> 
> I don't think so. She, btw., is not the only person I know
> struggeling in this manner from one month into the next, barely
> being able to even catch up on bills.

I know quite few people in that sort of situation.

> Neither does she have a free choice of employers. There is only one
> board of education in the City. Changing for a private school would
> come with (at least a temporary) pay-cut, that she obviously can't
> afford.

I must disagree there. She has the qualifications to obtain employment in
may corporations and such. As a matter of fact, unless she happens to be
inequivicaly wedded to live in her current abode have her send me her
resume. I will be quite happy to submit it to the H/R department at Tivoli
(an IBM company I admit) for a position in our training department (last
time I checked they had like 90 positions they wanted to fill globaly). I
can guarantee the cost of living is somewhat lower than NY here in Texas
and her pay will most likely be higher than current. There is also the
opportunity for global travel if she is interested and were to get hired.

Sending out resumes is cheap, about $.40 a company.

> Therefore:
> 
> Since she isn't the only person I can think of, who is in such a
> position, the argument formerly known as "If 'ya don't like the
> company-policy [employing GAK/CAK] just leave and work for
> somebody else" may now be called: "Ad Acta".

Obviously this is open to alternate interpretation depending upon to what
lengths the party is willing to go to change their life. Skills are what you
sell not a particular job title or duty set.

Complacency and despondancy can be opportunity killers.

[I have attached my 'long' .sig both to include the Tivoli address and to
 aggravate those who bitch about the length of my 'short' .sig]



             "Reality is observer dependant"
                              \
                                \   \\/////
                                    |     | 
                                    (.) (.)
      ===========================oOO==(_)==OOo==========================             

                                  James Choate

         Tivoli Systems, Inc.                   The Armadillo Group
         Senior Engineer                        SOHO - Internet - Technology

         9442 Capitol of Texas Highway North    608 E. 48th.
         Suite 500                              Austin, TX  78751  
         Austin, TX 78759

         Email: jchoate at tivoli.com              Email: ravage at ssz.com
         Phone: 512-436-8893                    Phone: 512-451-7087
         Fax:   512-345-2784                    Fax:   n/a
         WWW:   www.tivoli.com                  WWW:   www.ssz.com
         Modem: n/a                             Modem: 512-451-7009
         Pager: n/a                             Pager: n/a
         Cellular: n/a                          Cellular: n/a

      ===================================================================

         Political ideal: The Constitution says "Congress shall make
                          no law..." & What happened to the 9th &
                          10th Amendments?

         Philosophy: Pantheism - the belief that everything is divine,
                                 that God is not seperate but totaly
                                 identified with the cosmos, and that
                                 God does not possess personality or
                                 transcendence.

         Favorite Cartoon - Danger Mouse & Mighty Mouse (the original)

      ===================================================================


            The end of our exploring will be to arrive at where we
            started, and to know the place for the first time.

                                                 T.S. Eliot

      ===================================================================

                           Adopt, adapt, improvise!

                                            Anonymous

      ===================================================================

            For a succesful technology, reality must take precedence
            over public relations, for nature cannot be fooled.

                                               Richard Feynman

      ===================================================================

            Sometimes it is said that man cannot be trusted with the
            government of himself.  Can he, then, be trusted with
            the government of others? Or have we found angels in the
            forms of kings to govern him?  Let history answer this
            question.

                             Thomas Jefferson, 1st Inaugural Addr

      ===================================================================

            The Chinese icon for crisis consists of the icons for
            danger and opportunity.

                                                An observation
                                                by J. Choate

      ===================================================================

            You are
            What you do
            When it counts

                     The Masao

              






From tcmay at got.net  Sat Oct 25 13:52:33 1997
From: tcmay at got.net (Tim May)
Date: Sun, 26 Oct 1997 04:52:33 +0800
Subject: Orthogonality and Disaster Recovery
Message-ID: 




One of the themes of modern computing I strongly support is that of
"orthogonality," or clean functionality. A browser should not also try to
be a money management program. A word processor should not also try to be
an accounting program.

Failure to observe this rule of thumb has led to spreadsheets which can run
MPEG movies in spreadsheet cells (I'm not kidding), and to Web browsers
which take 20 MB of free memory to run reliably because they also contain
mediocre news readers, mediocre mailers, and lots of bloatware cruft.

The move toward modular decomposition is supported in functional and
object-oriented languages (like Java and C++) and in modern operating
systems. Much of the strenght of Unix has obviously come from the
philosophy that a function or utility should do some small set of things
well and cleanly, with chaining of these clean tools to accomplish more
complicated tasks.

A crypto program like PGP is intended to encrypt messages between a sender
and a recipient, or to provide authentication through signatures, or to
encrypt files on a storage medium. These are the classic, well-documented,
oft-discussed functions of crypto. Look in textbooks under "crypto" and
there won't be much talk of how to supply MIS with emergency backdoors, or
ways to monitor employees.

If properly modularized and orthogonalized (so to speak), such crypto
programs can then be used as building blocks for other tasks, like
remailers, data havens, and so on.

But there is a growing tendency, as seen in the bloatware examples of
browsers and spreadsheets mentioned above, to throw in all kinds of "wish
list" and "wouldn't it be nice" stuff. PGP is headed for bloatware. ("It's
not just a crypto program, it's also a tax preparation  and disaster
planning program!")

I'm quite certain that the Security and MIS directors at various companies
asked PGP, Inc. to include message recovery features. Not so much to handle
the very rare (almost nonexistent) cases where a piece of mail sent at some
time in the past has to be recovered because Alice was hit by a truck, or
similiar unlikely events (*), but because Security and MIS folks would like
the option of "monitoring" e-mail traffic.

(* I have heard no plausible scenarios under which transient
communications, which are presumably stored in the form composed
(plaintext) on the sender's machine or in the for received and read (also
in plaintext) on the receiver's machine, need to be recovered from the
*transit* state. We know why the FBI wants access to communications
keys--because access to the transit state is what they get when they
wiretap or sniff a communications line--but there is no plausbile
explanation of why a company would not simply ask Alice for the plaintext,
or ask Bob if for some reason Alice is unavailable. The idea someone
floated, that he needs to go in and decrypt his employee's mail in
emergencies is far-fetched.)

But are such bloatware crypto programs even good for disaster recovery? I
say they are not. I say e-mail will be a tiny, tiny portion of the recovery
strategy if Alice gets hit by a truck, for example. Far more important will
be recovery of her hard disk and related files.

(No, I am _not_ proposing anything be added to PGP to deal with this
disaster planning. Nor am I proposing that PGP enforce plaintext storage,
or anything else for that matter. These are all matters _orthogonal_ to the
basic function of a crypto program, and a crypto program cannot enforce
crypto hygiene any more than a spreadsheet can enforce good tax planning
hygiene.)

I am also not terribly interested in convoluted, byzantine schemes for
building "CDR" and such into crypto programs, as some are proposing. Again,
this is trying to make a crypto program into a disaster preparation
product, and trying to (partly) solve backup and disaster problems best
solved in other ways. Not something PGP should worry about (either the
program or the company).

"What if Alice forgets her key?" (Loses her private key, forgets her
passphrase, whatever.)  A very real concern. A concern I have myself. I
won't say how I deal with it, for security reasons, but it ain't something
I expect PGP, Inc. to solve _for_ me. Nor is my solution, whatever it is, a
step toward GAKking of keys, or any kind of building of an infrastructure
for surveillance.

In fact, this was my point a while back about how a diversity of approaches
to disaster planning, to key insurance measures, makes the imposition of
mandatory key escrow or Government Message Recovery (GMR) very difficult.
The very chaos helps. "Let a thousand flowers bloom."

And it turns out that the "what if Alice forgets her key?" scenario is very
poorly dealt with by PGP 5.5 (unless the corporation actually _does_  keeps
a copy of the private key generated for or by Alice...something supporters
of CMR says is not the case. Whether it _can_ or _will_ be the case is
another issue.)

So, disaster planning, for dealing with crashed disks, dead employees,
malicious employees (who, for example, encrypt their disks and then leave
the company), and general failures to backup work product, etc., these
examples of disaster planning issues are NOT dealt with in any important
way by PGP 5.5. Nor should any communications security program try to be
this kind program.

Keep it simple, stupid. This kind of bloatware is a fig leaf for security,
and very probably introduces major new  security flaws. (I've discussed at
length the issues of just who will be reading the CMR messages. It's very
unlikely such CMR messages will simply be archived away for that rare day
when someone's old messages need to be "recovered" for the reasons usually
given...in fact, as I have been arguing, I can't imagine companies even
bothering to get some transient piece of e-mail sent 2 years earlier by
Alice to Bob. They don't archive phone calls, and these are every bit as
likely to be "critical" in some sense as old e-mail messages are.)

As this relates to PGP, it just ain't their problem to try to answer the
demands of control freaks in corporate MIS departments that backdoors be
built into crypto products.

(Call it snoopware, call it surveillance software, call it CMR. But what it
really is a backdoor built into a crypto system. And one thing we know from
several decades of crypto work is that backdoors are holes in security.
Given that these backdoors apparently have little use in any real disaster
situations, they represent a serious dilution of security for little or
nothing gained.)

PGP, Inc. should stick to its core business, and not try to build in
snoopware backdoors for control freak MIS managers.

If it is claimed that corporate America is demanding these backdoors, our
industry and community then faces a major educational battle.

If this battle is lost, as it may already be, then the same reasons for
corporations to insist on "emergency access" (which of course won't be very
"emergency" oriented, as actually used in corporations) will be seen by
many to apply to government as well. "What have you got to hide?"

Keep it simple, stupid. That makes for efficiency, functionality, and
easier product development. And it doesn't build the case for government to
later demand message recovery.

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From ravage at ssz.com  Sat Oct 25 14:07:14 1997
From: ravage at ssz.com (Jim Choate)
Date: Sun, 26 Oct 1997 05:07:14 +0800
Subject: Orthogonality and Disaster Recovery (fwd)
Message-ID: <199710252128.QAA30492@einstein.ssz.com>



Forwarded message:

> Date: Sat, 25 Oct 1997 13:52:05 -0700
> From: Tim May 
> Subject: Orthogonality and Disaster Recovery

> One of the themes of modern computing I strongly support is that of
> "orthogonality," or clean functionality.

Any idea how a term meaning 'at right angles' came to hold all the various
interpretations it now does?...

I see this word in a lot of my reading and it almost never implies any sort
of 'indipendent multi-variant reference system'.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From nobody at REPLAY.COM  Sat Oct 25 14:43:20 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 26 Oct 1997 05:43:20 +0800
Subject: Use of an 'air freshener' in commission of a crime...
Message-ID: <199710252134.XAA22829@basement.replay.com>



* In June, a Scripps Howard News Service reporter examined
Consumer Product Safety Commission records recently made
public and found that 1,823 serious injuries caused by "electronic
air-fresheners" had been reported to the agency.  Though the
records were short on details, they included 50 cases of amputation,
46 burns, 48 scaldings, 68 poisonings, 56 "foreign-body"
penetrations, and 69 "drownings." 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To read these News of the Weird newspaper
columns from the past six months, go to
http://www.nine.org/notw/notw.html
(That site contains no graphics, no photos, no video clips, no
audio.  Just text.  Deal with it.)







From nobody at REPLAY.COM  Sat Oct 25 14:43:20 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 26 Oct 1997 05:43:20 +0800
Subject: Great Balls of Fire!
Message-ID: <199710252134.XAA22839@basement.replay.com>



* In April in Port Washington, Wis., Kevin Gillson, 18, was
convicted of sexual assault of a child when his 15-year-old
girlfriend became pregnant, despite the fact that the couple were
attending parenting classes together and that Gillson said they
planned to marry.  Upon conviction, Gillson was barred from being
around any non-adults, including the mother of his child.  And
Richard A. Duke Jr., 22, was jailed for 30 days in May in St. Mary's
County, Md., for having sex with the 15-year-old girl whom he had
married in the interim between arrest and conviction.  Nonetheless,
a judge ordered Duke, thus as a sex offender, to stay away from the
girl, even though she is his wife.







From nobody at REPLAY.COM  Sat Oct 25 14:44:08 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 26 Oct 1997 05:44:08 +0800
Subject: Shit happened...
Message-ID: <199710252133.XAA22742@basement.replay.com>



* The Michigan Court of Appeals in April ruled, on a technicality,
in favor of a prison inmate who had tossed a cup of liquified feces
in the face of a guard.  Alphonso Gaines, 34, already serving time
for assault, could not be punished further, said the court, because
the prosecutors forgot to prove that Gaines was "lawfully"
incarcerated in the Ionia facility at the time he threw the feces. 
Prosecutor Gail Hitchcock was incensed:  "Did they think we were
charging someone who had sneaked into prison?" 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To read these News of the Weird newspaper
columns from the past six months, go to
http://www.nine.org/notw/notw.html
(That site contains no graphics, no photos, no video clips, no
audio.  Just text.  Deal with it.)







From nobody at REPLAY.COM  Sat Oct 25 14:44:13 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 26 Oct 1997 05:44:13 +0800
Subject: Terry Nichols gets new court-appointed lawyer...
Message-ID: <199710252131.XAA22416@basement.replay.com>



* Defense lawyer Phillip Robertson, intending to make a dramatic
point in front of the jury at his client's robbery trial in Dallas,
Tex.,
in June, pointed the 9mm pistol used in the crime toward the jury
box, causing two jurors to fling their arms in front of their faces and
others to gasp audibly.  Though Robertson was arguing that his
client should be sentenced only to probation, the horrified jury gave
him 13 years.






From 3umoelle at informatik.uni-hamburg.de  Sat Oct 25 15:00:03 1997
From: 3umoelle at informatik.uni-hamburg.de (Ulf =?iso-8859-1?Q?M=F6ller?=)
Date: Sun, 26 Oct 1997 06:00:03 +0800
Subject: "who owns these words?"
In-Reply-To: <633f314d1dcc4c2315d89ebedf6e75ab@anon.efga.org>
Message-ID: <19971025170136.01289@ulf.dialup.uni-hamburg.de>



On Fri, Oct 24, 1997 at 03:36:35AM -0400, Anonymous wrote:

> I don't think you know who I am, but I wrote this message.
> 
> These are "my" words, but "I" am anonymous.
> 
> So I am wondering - who owns these words?
> Who owns the words of an anonymous author,

According to copyright law, the anonymous author, with the exception
that the copyright expires 70 years after publication rather than 70
years after the author's death.

> who is responsible for the actions of an unknown party,
> and who is to say that this is so?






From norm at dev.null  Sat Oct 25 16:03:27 1997
From: norm at dev.null (News of the Normal)
Date: Sun, 26 Oct 1997 07:03:27 +0800
Subject: Stuff Your Momma Never Told You...
Message-ID: <345276E4.1430@dev.null>



CLOSET STATISTICS DON'T LIE

*Statistics International reports that since gays have come out of the
 closet, snap counts in football have increased an average of 40% in 
 length (up to 70% when either the center or quarterback is named
 'Bruce'.) This figure increases astronomically in College football, 
 in cases where the center is a freshman and the quarterback is a senior
 who is a member of NAMBLA. (North American Man-Boy Love Association)

HAS ANYBODY SEEN MY BOOTSRAPS...???

*Recent revelations revolving 'round revisionist recorrections indicate
 that Horatio Alger died in poverty after the S&L where his funds were 
 deposited collapsed, the head of his pension fund was indicted, his
 former employer could no longer afford to support his 'lifetime' health
 insurance benefits, and Chelsea Clinton robbed him to buy crack cocaine
 as part of her homework for a Stanford 'History of Ebonics' class.

IT'S A TOUGH WAY TO MAKE A LIVING

*NEWS OF THE WEIRD, a nationally syndicated newspaper column founded in
 1988, and distributed by Universal Press Syndicate has finally run its
 course, and will be discontinued in the near future.
 A disappointed Chuck Shepherd told reporters, "I could see that the
 end was coming when President Reagan's statement that 'trees cause 
 more pollution than automobiles' became mainstream news."
 Shepherd went on to say, "I can no longer compete with the regular
 news when citizens are getting toilet plungers stuck up their ass
 every day, parabolically speaking. I've heard that Clinton, Reno and
 Freeh are now a serious threat to the comedy industry, as well. Who
 is going to be foolish enough to pay for our products when they can
 get material of greater quality and quantity free on C-Span and the
 front page of the Washington Post?"


AUTHENTICITY:  All news stories mentioned in News of the
Normal are just shit we make up (or occasionally, get from
supermarket tabloids in other countries or other 
disreputable magazines and journals).  No so-called 
reputable news source, and no story that was not intended
to spread FUD (Fear, Uncertainty and Disinformation) is 
ever the source of a News of the Normal story. 

News of the Normal is not copyrighted by anyone who would
admit to it in public.






From ravage at ssz.com  Sat Oct 25 16:08:44 1997
From: ravage at ssz.com (Jim Choate)
Date: Sun, 26 Oct 1997 07:08:44 +0800
Subject: Defendants adopt Freemenspeak [CNN]
Message-ID: <199710252334.SAA31096@einstein.ssz.com>



Forwarded message:

>                      MORE DEFENDANTS ADOPT 'FREEMENSPEAK'
>                                        
>      Freemen in court
>      
>   It's gibberish to the judges
>   
>      October 25, 1997
>      Web posted at: 6:33 p.m. EDT (2233 GMT)
>      
>      BILLINGS, Montana (AP) -- Standing scornful and defiant, the
>      defendants shout their cases. They are sovereign citizens, not
>      subject to the court! The judges are unqualified! The lawyers are
>      illegal!
>      
>      "To hell with you and your kangaroo court!" one defendant bellows at
>      his sentencing for dealing drugs.
>      
>      The bizarre claims are trademarks of the Montana Freemen, the
>      militant anti-government zealots who have been jailed here, awaiting
>      trial, since their 81-day standoff ended 16 months ago.
>      
>      But the claims are now coming from garden-variety criminals, fellow
>      inmates in the Yellowstone County jail. These non-Freemen are
>      proving to be ardent students of the convoluted legal fantasies of
>      the jail's most famous residents.
>      
>      They are firing their lawyers, torpedoing their own plea agreements,
>      writing their own legal briefs, arguing -- and losing -- their own
>      cases. They are making life and work difficult, and often miserable,
>      for those who run the court system.
>      
>      Chief public defender Sandy Selvey calls the Freemen a plague. At
>      least seven clients of his office have tried "Freemenspeak" in state
>      court; others have tried it in federal court.
>      
>      "They're contaminating our good criminals," says District Judge
>      Diane Barz, who tangled with the Freemen as a federal prosecutor.
>      
>      About two dozen Freemen have been among the jail's 300 inmates since
>      June 13, 1996, when they surrendered after an armed, 81-day standoff
>      with FBI agents at their isolated farm compound in the remote
>      outback of eastern Montana's "Big Open." Three minor figures have
>      pleaded guilty, but trials for the rest won't begin until next
>      spring.
>      
>      The host of federal charges against them include wire and bank fraud
>      and threatening the life of a federal judge and other public
>      officials. The FBI says some 800 people from around the country
>      attended classes at the rural stronghold, learning to issue the
>      worthless liens and "warrants" that the Freemen claim are legal
>      tender.
>      
>      People in several states have been charged, and some convicted, of
>      trying to use such documents, often bearing the name of Freeman
>      leader Leroy Schweitzer. The Dallas Morning News reported that at
>      least 151 people in 23 states were under investigation for Freeman
>      connections.
>      
>      The Freemen's legal "philosophy" is a jumble of odds and ends from
>      the Bible, the U.S. Constitution, the Magna Carta and the Uniform
>      Commercial Code, the body of federal laws that govern interstate
>      financial transactions.
>      
>      They dress it up in pseudo-scholarly terms and meaningless Latin
>      phrases and claim, in essence, they are laws unto themselves -- and
>      over everyone else.
>      
>      "There are some real gaps in their education, and ... I think they
>      are darned close to acting like the mentally ill," Barz said.
>      
>      The Freemen commonly rant, belch, challenge the federal judges and
>      get banished from the courtroom to watch on closed-circuit TV as
>      appointed lawyers try to defend them. More conventional inmates soon
>      started imitating them.
>      
>      Their verbose legal filings, often prepared by Freemen, are so
>      peculiar that District Court Clerk Jean Thompson rejects many of
>      them.
>      
>      Accused wife-murderer Jerry Swinney filed a 25-page "Demand for Bill
>      of Particulars." Adopting the Freemen's name style -- Jerry period
>      comma Swinney -- it opens this way:
>      
>      "Jerry., Swinney, Affiant, hereinafter at all times relevant,
>      Demandant, a self-realized entity, a Man upon the free soil of the
>      several American independent and sovereign states, ..."
>      
>      Twenty-five eye-glazing pages later, this is how it closes:
>      
>      "NOTICE. This instrument comes under, and brings into the instant
>      action, the doctrines of res gestae, res ipsa loquitor, tacit
>      procuration, prior knowledge, willful intent, as against YOU and you
>      and your private characters. Further affiant sayeth not."
>      
>      County Attorney Dennis Paxinos, public defender Selvey and the
>      judges say the biggest problem the Freemen imitators have created is
>      how to protect themselves from themselves. It may be a bad idea for
>      them to act as their own lawyer -- but it's their legal right.
>      
>      "The judges and prosecutors seem to be as concerned with protecting
>      these Freeman-type people as their own attorneys are," says Deputy
>      County Attorney Joe Coble. "The only people who seem to want to run
>      roughshod over these people's rights are these people themselves."
>      
>      "The real concern I have is trying to figure out if, hidden among
>      the rubble of rhetoric, there's any viable complaint or issue we
>      really should consider," says District Judge G. Todd Baugh.
>      
>      As far as the judges can recall, that hasn't happened yet.
>      
>      "It's incredibly difficult to figure out what they're trying to
>      say," says District Judge Russell Fagg.
>      
>      Judges usually appoint a standby lawyer, often over the defendant's
>      protests.
>      
>      "Standby is the worst possible situation for a defense lawyer,"
>      Selvey said. "You have to know all the facts, all the witnesses and
>      what they'll testify to, all the forensic evidence, and the
>      authorities the guy's going to cite.
>      
>      "And then you have to stand there and watch while he goes down in
>      flames."
>      
>      Copyright 1997   The Associated Press. All rights reserved. This
>      material may not be published, broadcast, rewritten, or
>      redistributed.






From jya at pipeline.com  Sat Oct 25 16:42:24 1997
From: jya at pipeline.com (John Young)
Date: Sun, 26 Oct 1997 07:42:24 +0800
Subject: Defendants adopt Freemenspeak [CNN]
Message-ID: <1.5.4.32.19971025232833.00c26d20@pop.pipeline.com>



All right, Jim, a truly uplifting thigh-slapper. All right, Freemen, 
go for the ranting, belching, farting lingo jumbo, it's how the law 
fogs who's complicit in police power ebonics.







From azur at netcom.com  Sat Oct 25 16:47:24 1997
From: azur at netcom.com (Steve Schear)
Date: Sun, 26 Oct 1997 07:47:24 +0800
Subject: Saving money
In-Reply-To: <199710251832.LAA17149@sirius.infonex.com>
Message-ID: 



>Mix , wrote:
>The term "equal opportunities" is a curious one.  A free market does
>mean that everybody has the equal opportunity to make agreements with
>each other.  But, clearly some people will have more success making
>these agreements for reasons which are not under their control.
>Somebody might have parents who introduce them to the right people and
>show them the ropes, for instance.  This is one reason why the free
>market does not eliminate the formation of elites.  But, so what?  Are
>we really going to claim that people shouldn't help their children to
>succeed?

Yes, if "equal opportunities" was a reality then the wealth of your family
would not be an aid nor would the destitution of your family be a
hinderance.  This, of course, is the stuff of socialism.  I suspect that
even if inheritance was banned those from wealthy and connected parents
would see some significant benefit, but probably not as much as those from
families in which good work ethic, self-reliance, savings and investment
were stressed.

--Steve







From anon at anon.efga.org  Sat Oct 25 18:25:00 1997
From: anon at anon.efga.org (Anonymous)
Date: Sun, 26 Oct 1997 09:25:00 +0800
Subject: poverty traps (Re: Sa
Message-ID: 



-----BEGIN PGP SIGNED MESSAGE-----

Harka wrote:
>A real-life example:

Violins coming!  ;-)

Let's call the mother Janice.

>A single (divorced) mother, 4 kids (3-12 years), working full-time
>and making in theory $42 000/year. After taxes that comes down to
>$2000 cash per month.

Below you mention she receives $800 in child support, so she is seeing
$2800/month in cash.

The government is not Janice's friend.  It takes away $18,000 from her
each year and plunges her into poverty, sort of.  If you are appealing
to the government to assist Janice, first ask it to get the hell out
of the way.  (I realize you may just be saying that Janice's plight is
unavoidable, not that she should be helped with government money.)

>In order for her to be able to work her two youngest kids go to a
>day-care-center. Wham! $1000 per month (hiring a baby-sitter would
>amount to even more).

Janice should be baby sitting.  Were she to take in 4 kids at
$500/month, she would make as much as her job and be able to watch her
own kids during the same time.  This income need not be reported.  The
parents of the other kids would be getting a good deal because their
kids would get much more attention than at daycare.  Some might even
consider it a good deal to be able to hire someone with a Master's
Degree in Education!

>Her apartment costs $800/month excluding utilities. That leaves $200
>(+ $800 she gets in child-support) per month for _five_ people to
>live on (clothes, food, utilities, school-books, gas for the car,
>etc.etc.)

Uh, doesn't this mean $1000/month for five people after rent has been
paid?

Telephone: $20/month
Electricity: $40/month (?)
Heat: $100/month (?)
Food: $600/month (generous)
Goodwill Clothes: $100/month (generous)
Total: $860/month

The food is generous because four of the five are kids, the oldest
only being 12.  Kids don't each much.  The actual amount should be
much lower.  If Janice joins a food coop and optimizes her buying
choices for cost and nutrition, the actual cost of food could be
dramatically lower.  If Janice does not practice vegetarianism, she
should start.

Clothing at the Goodwill costs next to nothing.  $1200/year should be
more than enough, not even considering that the younger kids can wear
clothing cast off by the older kids.

Janice should not be driving - she cannot afford it.

The cost of schoolbooks is negligible.  (Aren't they provided by the
school, anyway?)

>One thousand dollars per month for five people!! And that in New York
>City!

Of course, there is no law that requires one to live in New York City.

>What efforts has she made to make "herself more marketable"? She has
>been working ever since the age of 16, went 8 years to College (paid
>by herself and paying rent at the same time) and now has a Masters
>Degree in teaching.

It seems pretty clear that making money was not her top priority.
It's never been a secret that teachers are not top earners.  I'm not
seeing a description of somebody who really tried to make money in a
serious way.

Being "more marketable" does not mean "obtain a masters degree in a
field which is renowned for low pay."

>She made a calculation and (confirming your statement) came to the
>conclusion, that she indeed would have _more_ money by not working at
>all and simply going on welfare.

>However, that is not a choice she wants to make.

Good for her.  It sounds like Janice may have the strength of
character to turn her situation around.

>Is she to be called "stupid" and "selfish" because she's poor despite
>her efforts???

You should both read "Your Money or Your Life" from cover to cover.
This book will help teach Janice and yourself how to live efficiently.

Monty Cantsin
Editor in Chief
Smile Magazine
http://www.neoism.org/squares/smile_index.html
http://www.neoism.org/squares/cantsin_10.htm

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBNFJ8f5aWtjSmRH/5AQHU+Af9HWEadTH/x62ZZ8E8XLhJLS9ZxZm8Jkvh
LvtdKxq/xI4KHVehL6EqghjvbpndyEByaRNm1D18Hd0Ug3Iy/Ateq69ky2mV7MT6
tCKwaVJEMVH8FYE7HyVHSQs394ID8yGPEnNT79d+VHhaSsFnd349QvQlaHQom6Di
ksdNqe+n8WD7ewj2xXaZcZCfE8ESlY2KQ62yHlO/qRR0h8AzOw75B4Vft75r/5Df
XHZVSNx1UhP2B1P4rb3IV2XdD6m+xzqSARYO4p9aTCyH588/wS62tMfs8LT54hnu
KOFcte8wavQlEdQPFX+JCkOr6woCdjqUeR3ZPrprh2iegq222Ql5Sw==
=vyWR
-----END PGP SIGNATURE-----








From ichudov at www.video-collage.com  Sat Oct 25 18:39:18 1997
From: ichudov at www.video-collage.com (Igor Chudov @ home)
Date: Sun, 26 Oct 1997 09:39:18 +0800
Subject: Doubts about Smith legislation  (Falk & Allberry)
In-Reply-To: <62ttli$n0m@camel15.mindspring.com>
Message-ID: <199710260135.BAA18431@manifold.algebra.com>



In news.groups, Cipher  wrote:
* In article <62oshu$pov at news1.panix.com> Information Security,
* The at NSA.sucks writes:
* >To further rub in things, the UCENET II proponents are coming
* >out with a "munging FAQ" that lists three times as many
* >"reasons" not to munge versus to munge.
* >
* >What a bunch of assholes.
* >
* >On top of that, Mozena couldn't even state in plain English
* >in the CFV for comp.org.cauce that it will require your
* >real email address to post...it just kinda mumbles it
* >while talking about robomoderation and tokens.
* >
* >Someone should give Mozena a hard kick in the balls.

Let us give the anti-privacy, anti-munging, and anti-anonymity
proponents a collective kick in the ass by voting against
comp.org.cauce in its present form.

To get a ballot and vote, send email to
bostwick at cas.chemistry.gatech.edu and ask him for comp.org.cauce ballot.

-- 
	- Igor.






From goddesshera at juno.com  Sat Oct 25 18:48:40 1997
From: goddesshera at juno.com (Anonymous Remailer)
Date: Sun, 26 Oct 1997 09:48:40 +0800
Subject: [Fwd: Fwd: (Fwd) Fw: THIS IS MY KIND OF CHAIN LETTER!!! =)] (fwd)
Message-ID: <19971025.193514.10135.8.goddesshera@juno.com>



> here you go! no need to thank me! ;-)
> 
> Since We are ALL so Tired of those Chain Letters!!!!!!!!!!
> 
> THE DEAL IS:  THIS LETTER GIVES YOU THE POWER TO NEVER HAVE TO  SEND
> ANOTHER CHAIN LETTER EVER AGAIN.  YOU SEND THIS TO 10 PEOPLE
> WITHIN
> 7
> DAYS OF
> THE TIME THAT YOU READ IT,  AND FROM THAT POINT ON YOU CAN IGNORE,
> 
> OR
> READ
>     AND DELETE,  ANY CHAIN LETTER SENT TO YOU.  THE BEST PART
> OF
> THIS
> DEAL
> IS,
>      YOU WILL STILL GET ALL OF THE LUCK, LOVE, OR GOOD SEX
> GUARANTEED
> TO
> YOU
> BY
>     ANY CHAIN LETTER YOU READ!
>     EVENTUALLY THIS WILL STOP THE CIRCULATION OF ALL CHAIN
> LETTERS.
> SO,
> IT
> IS
>     VERY IMPORTANT THAT YOU SEND THIS OUT ON TIME!!!  AND THE
> CATCH
>  IS,
> THAT
> IF
>     YOU END UP NOT SENDING THIS ON TIME,  OR NEVER SENDING IT
> AT
> ALL,
> YOU
> WILL
>     GET ALL OF THE BAD LUCK,  NONE OF THE LOVE,  AND NONE OF
> THE
> GOOD
> SEX
> FROM
>     ANY CHAIN LETTER YOU GET.  THIS IS FOR ALL OF THE
> SUPERSTISIOUS
> PEOPLE
> THAT
>     HATE CHAIN LETTERS,  AND ALL OF THE EVIL PEOPLE THAT WRITE
> THEM.
>       GOOD LUCK, LOVE AND SEX TO ALL OF YOU!!!!!!!
> 




This message was automatically remailed. The sender is unknown, unlogged,
and nonreplyable. Send complaints and blocking requests to
.






From semprini at theschool.com  Sat Oct 25 19:01:07 1997
From: semprini at theschool.com (semprini at theschool.com)
Date: Sun, 26 Oct 1997 10:01:07 +0800
Subject: Elliptic Curves
Message-ID: <199710260147.SAA24913@k2.brigadoon.com>



I found good online documentation. No need for further help. Just as 
a side note: TruthMonger's command of the English language is 
incredible. :)

-- Dylan






From ravage at ssz.com  Sat Oct 25 19:18:30 1997
From: ravage at ssz.com (Jim Choate)
Date: Sun, 26 Oct 1997 10:18:30 +0800
Subject: poverty traps (Re: Sa (fwd)
Message-ID: <199710260243.VAA31587@einstein.ssz.com>



Forwarded message:

> Date: Sat, 25 Oct 1997 21:24:20 -0400
> From: Anonymous 
> Subject: Re: poverty traps (Re: Sa

> >In order for her to be able to work her two youngest kids go to a
> >day-care-center. Wham! $1000 per month (hiring a baby-sitter would
> >amount to even more).
> 
> Janice should be baby sitting.  Were she to take in 4 kids at
> $500/month, she would make as much as her job and be able to watch her
> own kids during the same time.  This income need not be reported.

Wrong, this income not only must be reported but in every state that I am
aware of you need a license to legaly do baby-sitting for hire.  Many
states, such as Texas, won't let you do it from your home. You even
need one in Texas to baby-sit peoples pets, though you can do that from
your home if your yard is big enough for the number of pets you are 
licensed to sit.

Have Janice go to jail for tax-evasion and lack of a license isn't going to
do her or her kids a lick of good.

> >Her apartment costs $800/month excluding utilities. That leaves $200
> >(+ $800 she gets in child-support) per month for _five_ people to
> >live on (clothes, food, utilities, school-books, gas for the car,
> >etc.etc.)
> 
> Uh, doesn't this mean $1000/month for five people after rent has been
> paid?
> 
> Telephone: $20/month

Not counting long-distance to grandma and grandpa, other relatives.

> Electricity: $40/month (?)
> Heat: $100/month (?)

Let's combine electricity and gas into a single bill, since this will cover
both of these. You're probably looking at $150 - $200 a month with 6 kids.
You're also leaving out water and waste-water which adds another $50-$100
considering 6 kids and their baths and such.

> Food: $600/month (generous)

Hell, I'm single and come close to this and food costs in Texas are a LOT
lower than in New York. Though I do eat out at lunch every weekday. And no,
I don't go partying regularly at all. Way too busy with work (>16hrs/day
5 days a week & 16-20 on weekends) to do that other than a couple of times a
month. I went to the store today and bought enough food for 4 days and it
cost me $30. So that comes to something like $250 - $300 for me not counting
lunches, and that's for just a single person. Multiply that for 6 and the
numbers are considerably higher.

> Goodwill Clothes: $100/month (generous)
> Total: $860/month
> 
> The food is generous because four of the five are kids, the oldest
> only being 12.  Kids don't each much.

Man, you must not know the kids I know. Not only do they eat a lot they
waste a lot because they seldom finish 'adult' size portions.

> Clothing at the Goodwill costs next to nothing.  $1200/year should be
> more than enough, not even considering that the younger kids can wear
> clothing cast off by the older kids.

Not exactly true. The hand-me downs are 1-gen old when the first kid gets
them. By the 2nd or 3rd kid the clothes will be too worn out and soiled
to wear. My parents were dirt poor and I got lots of hand-me-downs as a kid
and can speak from personal experience here. They might last two kids.

While we're at it let's not forget the various school supplies and other
things the kids will need, medical and dental costs (my experience is that
government agencies don't cover 100%), then there's toys, books, music, etc.
Even considering buying everything used and using the public library this is
going to be a very tight budget.

You also left out auto costs such as gasoline, oil, normal maintenance,
insurance, registration, etc. Birthdays, Christmas, Mothers Day, Fathers
Day, movies with friends and such, hair-cuts (it's clear she won't have time
to do that herself), pets, kids hobbies, life insurance, etc.

Nope, your figures are WAY off.

My guess is that you are either single or if married your wife has her own
career and you each make at least $45k. Also, no kids or more than one pet.

You don't raise good kids by sticking them in a closet wearing burlap sacks
and feeding them scraps.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From JonWienk at ix.netcom.com  Sat Oct 25 19:48:11 1997
From: JonWienk at ix.netcom.com (Jonathan Wienke)
Date: Sun, 26 Oct 1997 10:48:11 +0800
Subject: poverty traps (Re: Sa
In-Reply-To: <199710252037.PAA30248@einstein.ssz.com>
Message-ID: <3.0.3.32.19971025192922.03137ed0@popd.netcruiser>

At 04:09 PM 10/25/97 EDT, harka at nycmetro.com wrote:
>A real-life example:
>
>A single (divorced) mother, 4 kids (3-12 years), working full-time
>and making in theory $42 000/year. After taxes that comes down to
>$2000 cash per month.
>
>In order for her to be able to work her two youngest kids go to a
>day-care-center. Wham! $1000 per month (hiring a baby-sitter would
>amount to even more).
>Her apartment costs $800/month excluding utilities. That leaves
>$200 (+ $800 she gets in child-support) per month for _five_ people
>to live on (clothes, food, utilities, school-books, gas for the
>car, etc.etc.)
>
>One thousand dollars per month for five people!! And that in New
>York City!
>She is not entitled to any support such as free school-meals for
>the kids etc., because she "makes too much money" (_before_ taxes,
>of course!)
>
>What efforts has she made to make "herself more marketable"? She has
>been working ever since the age of 16, went 8 years to College (paid
>by herself and paying rent at the same time) and now has a Masters
>Degree in teaching.
>
>What has it brought her? Bill-collectors calling every day!
>
>She made a calculation and (confirming your statement) came to the
>conclusion, that she indeed would have _more_ money by not working
>at all and simply going on welfare.
>
>However, that is not a choice she wants to make.
>
>Is she to be called "stupid" and "selfish" because she's poor
>despite her efforts???
>
>I don't think so. She, btw., is not the only person I know
>struggeling in this manner from one month into the next, barely
>being able to even catch up on bills.
>
>Neither does she have a free choice of employers. There is only one
>board of education in the City. Changing for a private school would
>come with (at least a temporary) pay-cut, that she obviously can't
>afford.

This whole sob story makes me want to puke.  First of all, there are
thousands of cities in the US with a higher wage-to-cost-of-living ratio
that socialist cesspool New York City.  Anyone stupid enough to volunteer
to live in a city with one of the most confiscatory tax policies in the
country deserves what they get.

I currently live in a 900 square foot, 2-bedroom condo in Vacaville,
California, in a not-so-nice part of town.  I have to keep paint on hand to
cover the gang graffiti that grows in my carport, in 2 years I have
personally witnessed 2 gang assaults, (one of which resulted in an
individual being medevac'd to a local hospital) and I have good reason to
believe that there are some drug dealers moving into my neighborhood.  I am
currently paying a $67,000 mortgage for the privilege of living here.  For
the same money, I could purchase a 40 acre woodlot with a stream running
through it, and a 4 bedroom house, near Clare, Michigan.  Why do I stay
here?  Mainly so I can be near my wife and son, but I also have a job that
I really like, even though it doesn't pay much.  Does my financial
situation suck?  You bet!  My finances are in worse shape than those of the
woman described above.  Do I expect (or deserve) the pity of others?
Absolutely not!  Do I need some kind of government handout to save me from
my pathetic life?  Absolutely not!

I am where I am at because of choices I have made, and I can make choices
that will change my situation for the better.  This is the beauty of
America.  If you are willing to do what it takes (although most people
aren't) you can improve ypur lot in life.

Jonathan Wienke

What part of "the right of the people to keep and bear Arms, shall not be
infringed" is too hard to understand? (From 2nd Amendment, U.S. Constitution)

PGP 2.6.2 RSA Key Fingerprint: 7484 2FB7 7588 ACD1  3A8F 778A 7407 2928
DSS/D-H Key Fingerprint: 3312 6597 8258 9A9E D9FA  4878 C245 D245 EAA7 0DCC
Public keys available at pgpkeys.mit.edu. PGP encrypted e-mail preferred.

US/Canadian Windows 95/NT or Mac users:
Get Eudora Light + PGP 5.0 for free at http://www.eudora.com/eudoralight/
Get PGP 5.0 for free at http://bs.mit.edu:8001/pgp-form.html

Non-US PGP 5.0 sources:
http://www.ifi.uio.no/pgp/
http://www.heise.de/ct/pgpCA/download.shtml
ftp://ftp.pca.dfn.de/pub/pgp/V5.0/
ftp://ftp.fu-berlin.de/pub/pc/win95/pgp
ftp://ftp.fu-berlin.de/pub/mac/pgp
http://www.shopmiami.com/utopia.hacktic.nl/pub/replay/pub/pgp/pgp50/win/

RSA export-o-matic:
print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0

From tm at dev.null  Sat Oct 25 20:01:12 1997
From: tm at dev.null (TruthMonger)
Date: Sun, 26 Oct 1997 11:01:12 +0800
Subject: Buttfucking Bad BillyG
Message-ID: <3452AEF3.3B0A@dev.null>



It looks like the DOJ is getting tired of bungholing the cold, dead
carcass of Horatio Alger, and is now looking for a fresh, pink rim to
act as a depository for the zygote of the Reptilian Nazis that they
are bringing out of their secret underground bunkers to head the FBI
Criminal Factory/Crime Laboratory and the IRS.

I've spent more than my share of time on the front-lines of the computer
industry, throwing rocks at the windows of the MS-DOS code-writers, but
I also spent a fair amount of time searching out tools, such as 4DOS,
which allowed me to route around the damage caused by a PC market base
of end-users whose biggest concern was not chipping their nails while
typing, so they would look good when flirting with the guys in suits
who showed up to charge their bosses outrageous sums of money for making
all of the dichotomous software enemies of the MS-DOS operating system 
play nicely with one another without leaving blood on the hard drive.

As 'The World's Foremost Computer Expert', I tried to talk some sense
into Unix and Xenix producers and vendors.
"Give the shit away!" I told them, time and time again. "You're not
going to go broke having everyone in the fucking world using your
product, and counting on you for support."
They wouldn't listen. Usually, they just bought a few copies of my
Country Porno albums and sent me on my way.

I wanted to provide my individual customers with UNIX/XENIX OS's
and applications, but the producers and vendors didn't want my
individual customers' business. They wanted a Grand to say 'hello'
and a million bucks worth of software and support sales so that
even their janitors could buy a new suit in this year's latest
'power color.'
So I put my corporate customers into UNIX/XENIX and my individual
customers into MS-DOS.
And I am not interested in hearing Sun Microsystems or anyone else
whining about Bad BillyG capturing the market that he was going
after while they captured the market that they were going after.

SCO finally came out with a single/double user GUI product (can't
even remember it's name) which was years ahead of what Windows
finally became after M$ legally ripped off Apple's face mask.
I screamed at them to provide it at a price that was simply
outrageous instead of totally outrageous, so that I could sell
it to people who were willing to put off buying a second Ferrari
so that they could work with a decent operating system.
SCO told me to fuck off.

The DOJ seems deathly concerned that M$'s customers are going to
get an InterNet browser "basically, for free."
Oh horror, oh horror.
I got M$ Explorer for free. I use Nut$crape.
I got Nut$crape for free too. ($19.95 with 100 hours of Net time
on Sympatico) I installed it, and it worked for me.
I installed M$ Explorer and didn't want to take the time and trouble to
learn all the fancy shit it does, so I uninstalled it. (My ISP tweaked
their version of Nut$crape so that it works fine out of the box)

My lifelong dream is to have Bad BillyG show up on my doorstep to 
install all of the M$ products I have so that they will work without me
having to pull out my hair figuring them all out, and to bring MickJ
with him, so I can get a blow-job from those fat, sexy lips while I
watch BBG at work.
Now my hopes are dashed, because Nazi Cunt Reno, child-murderer, is
afraid that I might be a lobotomized, brain-dead idiot with no free-will
and she wants to protect me from the Bad Man.

Fuck Nazi Cunt Reno (with _your_ dick, not mine)!
At least Bad BillyG hasn't burned any children to death recently (though
he did give a couple of them 2nd degree burns as a result of learning
how to freebase from Richard Pryor).

Even when doing all of my serious bid'ness on UNIX/XENIX OS's, I still
did all of my writing with a PC, using M$ Word. Because I *like* it!
When lying awake at night, plotting my armed assault on the Micro$oft
Corporate office, for all of the pain and suffering they have put me
through over the years, I always planned to let those working in the
M$ Word division off with just a sound thrashing, for making the pain
bearable.
Now Janet Reno wants to jump my claim to revenge against the Big M$
and she likely wants to whack out my pals in the M$ Word division,
as well.
This means war!

Fresh From the Clue Server!!!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The upcoming Millennium is going to usher in a battle between Big
Brother/Governments and Medium Brother/Corporations.
Big Brother has control of most of the weapons, and the serious
firepower is in the hands of their armed thugs.
Medium brother has control of most of the electronic weapons, but
the serious firepower is in *our* hands. We *ARE* the electronic
armed forces.
The Corporations can 'take' the government in the upcoming battle,
and we can 'take' the Corporations if they decide they want to 
move up a notch, to Big Brother status.

Reality is that M$ is a fraction of the size of other industry
players such as IBM, etc.
Reality is that if the Corporate Giants want to oppress us, we are
in a much better position to tell them to go fuck themselves. We
can use pirated software and pirated hardware.
I can't give you a Nuke if the government wants to fuck you over,
but I can give you a copy of Win2000 if M$ wants to fuck you over.

Reality is that our best chance for getting the Government to fall
into line with true freedom and democracy is to back the rise of
Corporations in the Net World Order.
Reality is that the Government doesn't really need our votes, but
the Corporations need our bucks.
Reality is that many more of us are in a postition to say "No" to
Corporations than are in a postition to say "No" to Governments.

Our power lies in the workplace. We can still rule our workplace.
{We are all guerilla warriors, under the leadership of Che Dilbert.)

The Millennial War is InfoWar. It will take place in CyberSpace and
in MindSpace. We need to fight for control of our Virtual Reality.
It is InterActive, and *we* need to *act* from our end of the Inter.

Micro$oft/Nut$crape/$un Microsystems? Who do we 'back'?
We 'back' anyone who will make our access to and control of information
stronger, and the Governments' electronic contol of us weaker.
Scream loud and long at the DOJ Fascists for their attack on M$, and 
then go out and buy Nut$crape. Scream loud and long at the DOJ Fascists
for their anti-trust actions against Intel, and then go out and by an
Apple/Mac. (And get M$ Word for Macintosh! Keep 'em confused!)

InfoWarMonger
"It's not InfoWar until *you* realize it's InfoWar!"






From semprini at theschool.com  Sat Oct 25 21:33:19 1997
From: semprini at theschool.com (Dylan N. Vitt)
Date: Sun, 26 Oct 1997 12:33:19 +0800
Subject: Elliptic Curves
In-Reply-To: <2.2.32.19971026011202.0106cdc0@popd.ix.netcom.com>
Message-ID: <199710260419.VAA15700@k2.brigadoon.com>



On 25 Oct 97 at 22:12, MJ S wrote:
> 
> Could you send me this information too... thanks.
> 
> Mark
> 
> 

A good explanation of elliptic curves, their application, etc. can be 
found at http://www.certicom.com/ecc

I found this site was mislinked in numerous places as 
http://www.certicom.com/html/ecc, for those of you with web-sites 
having links to this site.

--Dylan






From kent at bywater.songbird.com  Sun Oct 26 00:41:01 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Sun, 26 Oct 1997 15:41:01 +0800
Subject: Orthogonality and Disaster Recovery (fwd)
In-Reply-To: <199710252128.QAA30492@einstein.ssz.com>
Message-ID: <19971026003520.35384@bywater.songbird.com>



On Sat, Oct 25, 1997 at 04:28:52PM -0500, Jim Choate wrote:
> Forwarded message:
> 
> > Date: Sat, 25 Oct 1997 13:52:05 -0700
> > From: Tim May 
> > Subject: Orthogonality and Disaster Recovery
> 
> > One of the themes of modern computing I strongly support is that of
> > "orthogonality," or clean functionality.
> 
> Any idea how a term meaning 'at right angles' came to hold all the various
> interpretations it now does?...
> 
> I see this word in a lot of my reading and it almost never implies any sort
> of 'indipendent multi-variant reference system'.

I can't believe that you haven't studied vector spaces, Jim.  In that 
particular niche of mathematics, the meaning you quote is precisely the 
meaning of 'orthogonal'.  Vector algebra underlies a very large part 
of mathematics, and modern physics would not exist without it.

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From highxt at juno.com  Sun Oct 26 16:11:19 1997
From: highxt at juno.com (highxt at juno.com)
Date: Sun, 26 Oct 1997 16:11:19 -0800 (PST)
Subject: $4370.00 a month for LIFE!!!!
Message-ID: <1934352792GAA46578@clisonnero.acl.ul.jp>


To be removed from our list HIT REPLY and type "remove" in the subject.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HOW TO EARN A MONTHLY INCOME OF $4,370.00 or MORE FOR LIFE
JUST BY GIVING AWAY FREE CALLING CARDS!
(YOU'LL EARN A COMMISSION EVERY SINGLE TIME A CARD
YOU GIVE AWAY IS USED. WE NEED YOU!)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


And we are willing to pay you handsomely for your help.
Listen, I know your time is valuable, so I'll cut right
to the chase... We need enterprising people like you who
are interested in earning a RESIDUAL MONTHLY INCOME just
for giving away something of real value.

**ALSO, MAKE $20.00 FAST START BONUS FOR EVERY
DISTRIBUTOR YOU SIGN UP!!!***

This is truly a great opportunity.
SKYCOM has made it easy for anyone to make money.
****THE INSIDE EDGE LETTER****

Thats right! WE WILL PAY YOU  very well simply for helping
us give away our FREE calling cards.  And you will earn a great commission every single time the cards are used --
weeks, months , even years after you give them away! Of
 course the obvious question you must have now is....
How am I going to make money giving away something for free?
Well that is a very good question, Fortunately, we have
a very good answer.

Actually, the answer is very simple...

CLICK HERE TO CONTINUE!!! 
(allow approx.10 seconds to load) OR Simply point your Web Browser to: http://www.mega-money.com/skycom2.htm From kent at bywater.songbird.com Sun Oct 26 01:40:33 1997 From: kent at bywater.songbird.com (Kent Crispin) Date: Sun, 26 Oct 1997 16:40:33 +0800 Subject: Orthogonality and Disaster Recovery In-Reply-To: Message-ID: <19971026013055.34951@bywater.songbird.com> On Sat, Oct 25, 1997 at 01:52:05PM -0700, Tim May wrote: > One of the themes of modern computing I strongly support is that of > "orthogonality," or clean functionality. A browser should not also try to > be a money management program. A word processor should not also try to be > an accounting program. [...] > > A crypto program like PGP is intended to encrypt messages between a sender > and a recipient, or to provide authentication through signatures, or to > encrypt files on a storage medium. These are the classic, well-documented, > oft-discussed functions of crypto. You are missing the less well-documented, but equally classic function of key management, which is a part of any useful crypto system. The key management part of it *could* exist as a separate program from the encryption/decryption part, but they are *far* more closely tied than word processing and accounting, and what you would have is a crypto *system*, composed of several relatively tightly coupled programs that share complex data formats. Such a crypto system would be quite useful, and would allow the construction of all kinds of other products by using scripting languages. However, the ergonomics of such a crypto system would not be appropriate for the average point and click MacWindows Moron. [...] > If properly modularized and orthogonalized (so to speak), such crypto > programs can then be used as building blocks for other tasks, like > remailers, data havens, and so on. > > But there is a growing tendency, as seen in the bloatware examples of > browsers and spreadsheets mentioned above, to throw in all kinds of "wish > list" and "wouldn't it be nice" stuff. PGP is headed for bloatware. ("It's > not just a crypto program, it's also a tax preparation and disaster > planning program!") I think you are quite off base here. There is very little additional functionality added by CMR; and the enforcement *is* done by a separate program. [...] > But are such bloatware crypto programs even good for disaster recovery? Nice try, but the bloat, if any, comes from the gui and other stuff, not the crypto functionality. PGP 5.x, from a user interface point of view, is much simpler than previous versions -- it integrates very cleanly and unobtrusively with the system on the MacWindows platform. [...] > I am also not terribly interested in convoluted, byzantine schemes for > building "CDR" and such into crypto programs, as some are proposing. Again, > this is trying to make a crypto program into a disaster preparation > product, and trying to (partly) solve backup and disaster problems best > solved in other ways. Not something PGP should worry about (either the > program or the company). Are you nuts? Of course PGP, Inc, should be worrying about this kind of stuff. They *need* new products to survive. > "What if Alice forgets her key?" (Loses her private key, forgets her > passphrase, whatever.) A very real concern. A concern I have myself. I > won't say how I deal with it, for security reasons, but it ain't something > I expect PGP, Inc. to solve _for_ me. Nor is my solution, whatever it is, a > step toward GAKking of keys, or any kind of building of an infrastructure > for surveillance. Fine -- you use your personal solution. PGP, Inc is trying to provide solutions that work in an organizational setting, where forgotten passwords are a constant fact of life, and where the security issues are vastly different from your situation. [...] > As this relates to PGP, it just ain't their problem to try to answer the > demands of control freaks in corporate MIS departments that backdoors be > built into crypto products. If they want to survive as a company, it is. > PGP, Inc. should stick to its core business, and not try to build in > snoopware backdoors for control freak MIS managers. Just precisely what is their core business, Tim -- supplying freeware to Cypherpunks? > If it is claimed that corporate America is demanding these backdoors, our > industry and community then faces a major educational battle. "If it is claimed..."? Of course it is claimed -- it's a fact. And yes, there is a major educational battle -- ivory tower cypherpunks have to educate themselves about the nature of the world. You believe, apparently, that large organizations contemplating crypto are just misguided or duped by evil governments into doing the devil's work. Until you actually grok what is going on you will never be all that effective in dealing with it. -- Kent Crispin "No reason to get excited", kent at songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html From prz at acm.org Sun Oct 26 01:18:59 1997 From: prz at acm.org (Philip R. Zimmermann) Date: Sun, 26 Oct 1997 17:18:59 +0800 Subject: InfoWar Epilogue 7 / TEXT Message-ID: <345306C3.3014@acm.org> ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * Epilogue * I Broke PGP! ---------------------------------------------------------------------------- * When ignorance is bliss, it is folly to be wise. ---------------------------------------------------------------------------- Epilogue ---------------------------------------------------------------------------- Discoveries of any great moment in mathematics and other disciplines, once they are discovered, are seen to be extremely simple and obvious, and make everybody, including their discoverer, appear foolish for not having discovered them before. It is all too often forgotten that the ancient symbol for prenascence of the world is a fool, and that foolishness, being a divine state, is not a condition to be either proud or ashamed of. Unfortunately, we find systems of education today that have departed so far from the plain truth that they now teach us to be proud of what we know and ashamed of ignorance. This is doubly corrupt. It is corrupt not only because pride in knowledge is to put an effective barrier against any advance upon what is already known, since it makes one ashamed to look beyond the bounds imposed by one's ignorance. To any person prepared to enter with respect into the realm of his great and universal ignorance, the secrets of being will eventually unfold, and they will do so in a measure according to his freedom from natural and indoctrinated shame in his respect of their revelation. In the face of the strong, and indeed violent, social pressures against it, few people have been prepared to take this simple and satisfying course toward sanity. And in a society where a prominent psychiatrist can advertise that, given the chance, he would have treated Newton to electric shock therapy, who can blame any person for being afraid to do so? To arrive at the simplest truth, as Newton knew and practiced, requires years of contemplation. Not an activity. Not reasoning. Not calculating. Not busy behavior of any kind. Not reading. Not talking. Not making an effort. Not thinking. Simply bearing in mind what it is one needs to know. And yet those with the courage to tread this path to real discovery are not only offered practically no guidance on how to do so, they are actively discouraged and have to set about it in secret, pretending meanwhile to be diligently engaged in the frantic diversions and to conform with the deadening personal opinions that are being continually thrust upon them. In these circumstances, the discoveries that any person is able to undertake represent the places where, in the face of induced psychosis, he has, by his own faltering and unaided efforts, returned to sanity. Painfully, and even dangerously, maybe. But nonetheless returned, however furtively.-G. Spencer Brown.* * The Laws of Form, London: Geo. Allen & Unwin, 1969. ---------------------------------------------------------------------------- "Whatever you do will be insignificant, but it is very important that you do it." -Mahatma Gandhi ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- I Broke PGP! by RTFM How to Protect Public Keys from Tampering In a public key cryptosystem, you don't have to protect public keys from exposure. In fact, it's better if they are widely disseminated. But it is important to protect public keys from tampering, to make sure that a public key really belongs to whom it appears to belong to. This may be the most important vulnerability of a public-key cryptosystem. This whole business of protecting public keys from tampering is the single most difficult problem in practical public key applications. It is the Achilles' heel of public key cryptography, and a lot of software complexity is tied up in solving this one problem. You should use a public key only after you are sure that it is a good public key that has not been tampered with, and actually belongs to the person it claims to. You can be sure of this if you got this public key certificate directly from its owner, or if it bears the signature of someone else that you trust, from whom you already have a good public key. Also, the user ID should have the full name of the key's owner, not just her first name. No matter how tempted you are-- and you will be tempted-- never, NEVER give in to expediency and trust a public key you downloaded from a bulletin board, unless it is signed by someone you trust. That uncertified public key could have been tampered with by anyone, maybe even by the system administrator of the bulletin board. ---------------------------------------------------------------------------- SECONDS: What is the hysteria to protect children from so-called obscene stuff? GINSBERG: It's a demagogic political issue that can be used to divert attention from deeper corruption's like the S&L scandal or the rape of the planet by the post-industrial nations. Although we conquered literary censorship in books between the years '58 and '62 when, through a series of trials, Henry Miller , Lady Chatterley's Lover by D.H. Lawrence, Naked Lunch and Howl were all cleared and declared to be protected by the Constitution. That same kind of censorship which was used on literature and film now only applies to the main marketplace of ideas, electronic broadcasting. SECONDS: Why do they want to censor things? Why don't they want people to become sexually excited? GINSBERG: As Plato pointed out, "When the mode of music changes, the walls of the city shake." So when you have modern free speech in idiomatic language that people can understand and are interested in, immediately it becomes a political issue. Demagogues want to hush it up because people get to know too much. If you can get people by the balls you control their most deep-seated emotions, which are erotic. Once you control that you control all the other emotions. You take emotional control, blank out the Eros, and substitute a lot of violence. ---------------------------------------------------------------------------- Vulnerabilities =============== No data security system is impenetrable. PGP can be circumvented in a variety of ways. In any data security system, you have to ask yourself if the information you are trying to protect is more valuable to your attacker than the cost of the attack. This should lead you to protecting yourself from the cheapest attacks, while not worrying about the more expensive attacks. Some of the discussion that follows may seem unduly paranoid, but such an attitude is appropriate for a reasonable discussion of vulnerability issues. Compromised Pass Phrase and Secret Key Probably the simplest attack is if you leave your pass phrase for your secret key written down somewhere. If someone gets it and also gets your secret key file, they can read your messages and make signatures in your name. Don't use obvious passwords that can be easily guessed, such as the names of your kids or spouse. If you make your pass phrase a single word, it can be easily guessed by having a computer try all the words in the dictionary until it finds your password. That's why a pass phrase is so much better than a password. A more sophisticated attacker may have his computer scan a book of famous quotations to find your pass phrase. An easy to remember but hard to guess pass phrase can be easily constructed by some creatively nonsensical sayings or very obscure literary quotes. For further details, see the section "How to Protect Secret Keys from Disclosure" in the Essential Topics volume of the PGP User's Guide. Public Key Tampering A major vulnerability exists if public keys are tampered with. This may be the most crucially important vulnerability of a public key cryptosystem, in part because most novices don't immediately recognize it. The importance of this vulnerability, and appropriate hygienic countermeasures, are detailed in the section "How to Protect Public Keys from Tampering" in the Essential Topics volume. To summarize: When you use someone's public key, make certain it has not been tampered with. A new public key from someone else should be trusted only if you got it directly from its owner, or if it has been signed by someone you trust. Make sure no one else can tamper with your own public key ring. Maintain physical control of both your public key ring and your secret key ring, preferably on your own personal computer rather than on a remote timesharing system. Keep a backup copy of both key rings. "Not Quite Deleted" Files Another potential security problem is caused by how most operating systems delete files. When you encrypt a file and then delete the original plaintext file, the operating system doesn't actually physically erase the data. It merely marks those disk blocks as deleted, allowing the space to be reused later. It's sort of like discarding sensitive paper documents in the paper recycling bin instead of the paper shredder. The disk blocks still contain the original sensitive data you wanted to erase, and will probably eventually be overwritten by new data at some point in the future. If an attacker reads these deleted disk blocks soon after they have been deallocated, he could recover your plaintext. In fact this could even happen accidentally, if for some reason something went wrong with the disk and some files were accidentally deleted or corrupted. A disk recovery program may be run to recover the damaged files, but this often means some previously deleted files are resurrected along with everything else. Your confidential files that you thought were gone forever could then reappear and be inspected by whomever is attempting to recover your damaged disk. Even while you are creating the original message with a word processor or text editor, the editor may be creating multiple temporary copies of your text on the disk, just because of its internal workings. These temporary copies of your text are deleted by the word processor when it's done, but these sensitive fragments are still on your disk somewhere. Let me tell you a true horror story. I had a friend, married with young children, who once had a brief and not very serious affair. She wrote a letter to her lover on her word processor, and deleted the letter after she sent it. Later, after the affair was over, the floppy disk got damaged somehow and she had to recover it because it contained other important documents. She asked her husband to salvage the disk, which seemed perfectly safe because she knew she had deleted the incriminating letter. Her husband ran a commercial disk recovery software package to salvage the files. It recovered the files all right, including the deleted letter. He read it, which set off a tragic chain of events. The only way to prevent the plaintext from reappearing is to somehow cause the deleted plaintext files to be overwritten. Unless you know for sure that all the deleted disk blocks will soon be reused, you must take positive steps to overwrite the plaintext file, and also any fragments of it on the disk left by your word processor. You can overwrite the original plaintext file after encryption by using the PGP -w (wipe) option. You can take care of any fragments of the plaintext left on the disk by using any of the disk utilities available that can overwrite all of the unused blocks on a disk. For example, the Norton Utilities for MSDOS can do this. Even if you overwrite the plaintext data on the disk, it may still be possible for a resourceful and determined attacker to recover the data. Faint magnetic traces of the original data remain on the disk after it has been overwritten. Special sophisticated disk recovery hardware can sometimes be used to recover the data. Viruses and Trojan Horses Another attack could involve a specially-tailored hostile computer virus or worm that might infect PGP or your operating system. This hypothetical virus could be designed to capture your pass phrase or secret key or deciphered messages, and covertly write the captured information to a file or send it through a network to the virus's owner. Or it might alter PGP's behavior so that signatures are not properly checked. This attack is cheaper than cryptanalytic attacks. Defending against this falls under the category of defending against viral infection generally. There are some moderately capable anti-viral products commercially available, and there are hygienic procedures to follow that can greatly reduce the chances of viral infection. A complete treatment of anti-viral and anti-worm countermeasures is beyond the scope of this document. PGP has no defenses against viruses, and assumes your own personal computer is a trustworthy execution environment. If such a virus or worm actually appeared, hopefully word would soon get around warning everyone. Another similar attack involves someone creating a clever imitation of PGP that behaves like PGP in most respects, but doesn't work the way it's supposed to. For example, it might be deliberately crippled to not check signatures properly, allowing bogus key certificates to be accepted. This "Trojan horse" version of PGP is not hard for an attacker to create, because PGP source code is widely available, so anyone could modify the source code and produce a lobotomized zombie imitation PGP that looks real but does the bidding of its diabolical master. This Trojan horse version of PGP could then be widely circulated, claiming to be from me. How insidious. You should make an effort to get your copy of PGP from a reliable source, whatever that means. Or perhaps from more than one independent source, and compare them with a file comparison utility. There are other ways to check PGP for tampering, using digital signatures. If someone you trust signs the executable version of PGP, vouching for the fact that it has not been infected or tampered with, you can be reasonably sure that you have a good copy. You could use an earlier trusted version of PGP to check the signature on a later suspect version of PGP. But this will not help at all if your operating system is infected, nor will it detect if your original copy of PGP.EXE has been maliciously altered in such a way as to compromise its own ability to check signatures. This test also assumes that you have a good trusted copy of the public key that you use to check the signature on the PGP executable. I recommend you not trust your copy of PGP unless it was originally distributed by MIT or ViaCrypt, or unless it comes with a digitally signed endorsement from me. Every new version comes with one or more digital signatures in the distribution package, signed by the originator of that release package. This is usually someone representing MIT or ViaCrypt, or whoever released that version. Check the signatures on the version that you get. I have actually seen several bogus versions of PGP distribution packages, even from apparently reliable freeware distribution channels such as CD-ROM distributors and CompuServe. Always check the signature when you get a new version. Physical Security Breach A physical security breach may allow someone to physically acquire your plaintext files or printed messages. A determined opponent might accomplish this through burglary, trash-picking, unreasonable search and seizure, or bribery, blackmail or infiltration of your staff. Some of these attacks may be especially feasible against grassroots political organizations that depend on a largely volunteer staff. It has been widely reported in the press that the FBI's COINTELPRO program used burglary, infiltration, and illegal bugging against antiwar and civil rights groups. And look what happened at the Watergate Hotel. Don't be lulled into a false sense of security just because you have a cryptographic tool. Cryptographic techniques protect data only while it's encrypted-- direct physical security violations can still compromise plaintext data or written or spoken information. This kind of attack is cheaper than cryptanalytic attacks on PGP. Tempest Attacks Another kind of attack that has been used by well-equipped opponents involves the remote detection of the electromagnetic signals from your computer. This expensive and somewhat labor-intensive attack is probably still cheaper than direct cryptanalytic attacks. An appropriately instrumented van can park near your office and remotely pick up all of your keystrokes and messages displayed on your computer video screen. This would compromise all of your passwords, messages, etc. This attack can be thwarted by properly shielding all of your computer equipment and network cabling so that it does not emit these signals. This shielding technology is known as "Tempest", and is used by some Government agencies and defense contractors. There are hardware vendors who supply Tempest shielding commercially, although it may be subject to some kind of Government licensing. Now why do you suppose the Government would restrict access to Tempest shielding? Exposure on Multi-user Systems PGP was originally designed for a single-user MSDOS machine under your direct physical control. I run PGP at home on my own PC, and unless someone breaks into my house or monitors my electromagnetic emissions, they probably can't see my plaintext files or secret keys. But now PGP also runs on multi-user systems such as UNIX and VAX/VMS. On multi-user systems, there are much greater risks of your plaintext or keys or passwords being exposed. The Unix system administrator or a clever intruder can read your plaintext files, or perhaps even use special software to covertly monitor your keystrokes or read what's on your screen. On a Unix system, any other user can read your environment information remotely by simply using the Unix "ps" command. Similar problems exist for MSDOS machines connected on a local area network. The actual security risk is dependent on your particular situation. Some multi-user systems may be safe because all the users are trusted, or because they have system security measures that are safe enough to withstand the attacks available to the intruders, or because there just aren't any sufficiently interested intruders. Some Unix systems are safe because they are only used by one user-- there are even some notebook computers running Unix. It would be unreasonable to simply exclude PGP from running on all Unix systems. PGP is not designed to protect your data while it is in plaintext form on a compromised system. Nor can it prevent an intruder from using sophisticated measures to read your secret key while it is being used. You will just have to recognize these risks on multi-user systems, and adjust your expectations and behavior accordingly. Perhaps your situation is such that you should consider running PGP only on an isolated single-user system under your direct physical control. That's what I do, and that's what I recommend. Traffic Analysis Even if the attacker cannot read the contents of your encrypted messages, he may be able to infer at least some useful information by observing where the messages come from and where they are going, the size of the messages, and the time of day the messages are sent. This is analogous to the attacker looking at your long distance phone bill to see who you called and when and for how long, even though the actual content of your calls is unknown to the attacker. This is called traffic analysis. PGP alone does not protect against traffic analysis. Solving this problem would require specialized communication protocols designed to reduce exposure to traffic analysis in your communication environment, possibly with some cryptographic assistance. Protecting Against Bogus Timestamps A somewhat obscure vulnerability of PGP involves dishonest users creating bogus timestamps on their own public key certificates and signatures. You can skip over this section if you are a casual user and aren't deeply into obscure public key protocols. There's nothing to stop a dishonest user from altering the date and time setting of his own system's clock, and generating his own public key certificates and signatures that appear to have been created at a different time. He can make it appear that he signed something earlier or later than he actually did, or that his public/secret key pair was created earlier or later. This may have some legal or financial benefit to him, for example by creating some kind of loophole that might allow him to repudiate a signature. I think this problem of falsified timestamps in digital signatures is no worse than it is already in handwritten signatures. Anyone may write a date next to their handwritten signature on a contract with any date they choose, yet no one seems to be alarmed over this state of affairs. In some cases, an "incorrect" date on a handwritten signature might not be associated with actual fraud. The timestamp might be when the signator asserts that he signed a document, or maybe when he wants the signature to go into effect. In situations where it is critical that a signature be trusted to have the actual correct date, people can simply use notaries to witness and date a handwritten signature. The analog to this in digital signatures is to get a trusted third party to sign a signature certificate, applying a trusted timestamp. No exotic or overly formal protocols are needed for this. Witnessed signatures have long been recognized as a legitimate way of determining when a document was signed. A trustworthy Certifying Authority or notary could create notarized signatures with a trustworthy timestamp. This would not necessarily require a centralized authority. Perhaps any trusted introducer or disinterested party could serve this function, the same way real notary publics do now. When a notary signs other people's signatures, it creates a signature certificate of a signature certificate. This would serve as a witness to the signature the same way real notaries now witness handwritten signatures. The notary could enter the detached signature certificate (without the actual whole document that was signed) into a special log controlled by the notary. Anyone can read this log. The notary's signature would have a trusted timestamp, which might have greater credibility or more legal significance than the timestamp in the original signature. There is a good treatment of this topic in Denning's 1983 article in IEEE Computer (see references). Future enhancements to PGP might have features to easily manage notarized signatures of signatures, with trusted timestamps. Cryptanalysis An expensive and formidable cryptanalytic attack could possibly be mounted by someone with vast supercomputer resources, such as a Government intelligence agency. They might crack your RSA key by using some new secret factoring breakthrough. Perhaps so, but it is noteworthy that the US Government trusts the RSA algorithm enough in some cases to use it to protect its own nuclear weapons, according to Ron Rivest. And civilian academia has been intensively attacking it without success since 1978. Perhaps the Government has some classified methods of cracking the IDEA(TM) conventional encryption algorithm used in PGP. This is every cryptographer's worst nightmare. There can be no absolute security guarantees in practical cryptographic implementations. Still, some optimism seems justified. The IDEA algorithm's designers are among the best cryptographers in Europe. It has had extensive security analysis and peer review from some of the best cryptanalysts in the unclassified world. It appears to have some design advantages over the DES in withstanding differential and linear cryptanalysis, which have both been used to crack the DES. Besides, even if this algorithm has some subtle unknown weaknesses, PGP compresses the plaintext before encryption, which should greatly reduce those weaknesses. The computational workload to crack it is likely to be much more expensive than the value of the message. If your situation justifies worrying about very formidable attacks of this caliber, then perhaps you should contact a data security consultant for some customized data security approaches tailored to your special needs. Boulder Software Engineering, whose address and phone are given at the end of this document, can provide such services. In summary, without good cryptographic protection of your data communications, it may have been practically effortless and perhaps even routine for an opponent to intercept your messages, especially those sent through a modem or E-mail system. If you use PGP and follow reasonable precautions, the attacker will have to expend far more effort and expense to violate your privacy. If you protect yourself against the simplest attacks, and you feel confident that your privacy is not going to be violated by a determined and highly resourceful attacker, then you'll probably be safe using PGP. PGP gives you Pretty Good Privacy. Copyright Anonymous ---------------------------------------------------------------------------- Son, if you think it appropriate, you might tell your mom: The Aztecs were extremely clean. The Spanish conquistadors were extremely dirty. The Spaniards won. LMBoyd Web Site ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ---------------------------------------------------------------------------- From prz at acm.org Sun Oct 26 01:19:24 1997 From: prz at acm.org (Philip R. Zimmermann) Date: Sun, 26 Oct 1997 17:19:24 +0800 Subject: InfoWar Epilogue 7 (Part III of 'The True Story of the InterNet') Message-ID: <34530666.1192@acm.org> A non-text attachment was scrubbed... Name: not available Type: text/html Size: 25274 bytes Desc: not available URL: From anon at anon.efga.org Sun Oct 26 01:42:00 1997 From: anon at anon.efga.org (Anonymous) Date: Sun, 26 Oct 1997 17:42:00 +0800 Subject: No Subject Message-ID: <3b12f82f7fbe5b11957530ac03ed49ea@anon.efga.org> It was a dark and misty night. From 89726768 at juno.com Sun Oct 26 17:59:23 1997 From: 89726768 at juno.com (89726768 at juno.com) Date: Sun, 26 Oct 1997 17:59:23 -0800 (PST) Subject: Deliverable Mail Message-ID: <9905176390876.YTR40918@3017greatcredit.net>

/////////////////////////////////////////////////////////////////
CREDIT CENTER***CREDIT CENTER***CREDIT CENTER***CREDIT CENTER
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
If you received this electronic mailing by mistake, please pardon the
intrusion.

Dear Friend;

Are you or somebody you know experiencing credit problems?  If the
answer is yes, our special offer might be just the cure you have been
looking for.  No longer will you have to live like a second class
citizen due to a bad credit report.  Bad credit can happen due to a
variety of reasons and can happen to anybody.  There is no profile of a
person with credit problems, it can happen to anybody.  In fact, one in
three Americans live with some form of bad credit.  Fortunately, the
United States Government has passed many laws under the Fair Credit
Reporting Act, all of which protect your rights as a consumer.  Our
manuals will show you how to use these Federal Laws to your advantage to
repair your credit, obtain a new credit report or add good credit to
your credit report!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
*****  'THE FRESH START PROGRAM II' (TM) *****

Have you recently been denied credit due to a bad credit report?  Have
you seen your credit report lately?  If your answered yes, then you need
to take advantage of the 'FRESH START PROGRAM II' (TM) NOW!  This manual
is unique in that it shows you how to obtain a brand new Social Security
number which will allow you to open a brand new, fresh credit report. 
Using guidelines set forth by the Social Security Administration, this
easy-to-follow manual will guide you through the steps necessary to
obtaining your new Social Security Number.  Regardless of your present
credit, you can open a new credit file free of ANY judgements,
charge-off's, foreclosures, bankruptcies, bad credit, tax liens's,
garnishments, late pays and inquiries.

////////////////////////////////////////////////////////////////

***** THE 'WorldCard' (TM) INSTANT CREDIT Credit Card *****

This program is very simple.  It extends to you a $5,000 instant line of
credit in the exclusive 'WorldCard' (TM) Wholesale Purchasing Club. 
This credit card comes to you with absolutely NO credit checks!

You will receive the 'WorldCard' (TM) Wholesale Purchasing Club catalogs
with over 5,000 items to choose from.  Jewelry, toys, tools, gift items,
housewares and much more are available.  After your first purchase, each
quarter you will receive updated catalogs with brand new items
available.

You will be required to make a small down-payment with your orders
and then make a monthly payment of 10% of the unpaid balance.  It's just
that simple!  Your good credit with WorldCard will be reported to the
credit bureau's, which will show your excellent credit!

As a special BONUS, if you take advantage of this offer within the next
24 hours, you will be given $200 in cash certificates!  $100 may be used
on the first $300 unpaid balance and the other $100 may be used after
you have charged $600 on your new account.

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

***** 'STOP COLLECTION AGENCIES COLD' (TM) *****

If you have ever experienced the humiliation of a collection agency
calling you at home or at work, then this hard-hitting manual will put
an IMMEDIATE stop to those calls!

Millions of collection agency telephone calls and letters are made or
sent each week to those who owe money.  Consumers have been helpless to
stop the harassment of these predators, UNTIL NOW!

This manual will show you how to put an end to these telephone calls and
letters, INSTANTLY!  At the same time, these collection agencies will be
forbidden to EVER call or write you again!!  This manual has the inside
secrets the credit world does not want you to have!

Gain back your self-esteem and piece-of-mind by ordering 'Stop
Collection Agencies Cold' (TM) TODAY!!!

/////////////////////////////////////////////////////////////////

***** 'THE COMPLETE CREDIT REPAIR KIT' (TM) *****

Good credit empowers you to qualify for personal loans, automobile
loans, business loans, credit cards, home loans and other types of
credit you may apply for at the very best interest rate.  As you know,
if you don't have excellent credit, lenders will NOT extend credit to
you!  The Fair Credit Reporting Act will allow you to legally and
permanently ERASE the negative information on your credit bureau file.

Anything damaging to your credit, such as bankruptcies, judgements, tax
liens, slow pays, repossessions, charge off's, foreclosures, late
payments, student loans and inquiries may be permanently and legally
REMOVED from your credit report!

If bad credit on your credit file is standing in the way of your
achieving the American dream, then order 'The Complete Credit Repair
Kit'(TM) NOW!!!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

IMS
5201 Kingston Pike, Suite 6-216
Knoxville, Tennessee 37919

YES, please rush the manuals checked below:

_____   'The Fresh Start Program II' (TM)         	$34.95

_____   'WorldCard' (TM) Credit Card            	$34.95

_____   'Stop Collection Agencies Cold' (TM)   	 $34.95

_____   'The Complete Credit repair Kit' (TM)   	$34.95

_____   TAKE ALL FOUR (SAVE over $39)   	$99.95


$____________  Sub-Total

$4.95    Shipping & Handling for each manual ordered
$15.00   RUSH Delivery (Optional)

$____________  TOTAL ENCLOSED

I Have Enclosed (Check One):
_____   Cashiers Check
_____   Money Order
_____   Personal Check
_____   FAX ORDER


SHIPPING INFORMATION:

Name:__________________________________________________
Address:________________________________________________
City:_______________________State:________Zip Code:_________
Telephone Number:___________________

Your E-Mail Address (For order confirmation):___________________

////////////////////////////////////////////////////////////////

FREE  -  FREE  -  FREE  -  FREE  -  FREE  -  FREE  -  FREE  -  FREE  

Fax your order within 24 hours and receive a special Kodak film book
entitling you to
100 rolls of Kodak film as well as five 6X10 and ten 4X5 enlargements
FREE!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

Please tape your signed personal check in the space below and fax to
IMS.  The 24 hour facsimile number is 1-423-681-6520.

******************************************************

FAX 1-423-681-6520

Please TAPE Your Check Here

Please SIGN Your Check

******************************************************

THANK YOU For Your Order!!!











From jon at pgp.com  Sun Oct 26 02:18:34 1997
From: jon at pgp.com (Jon Callas)
Date: Sun, 26 Oct 1997 18:18:34 +0800
Subject: I Broke PGP!!!
Message-ID: <345316D6.2F73@pgp.com>



Sorry...

        Jon

-----
Jon Callas                                  jon at pgp.com
Chief Scientist                             555 Twin Dolphin Drive
Pretty Good Privacy, Inc.                   Suite 570
(415) 596-1960                              Redwood Shores, CA 94065
Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS)
              665B 797F 37D1 C240 53AC 6D87 3A60 4628           (RSA)






From nobody at REPLAY.COM  Sun Oct 26 03:00:59 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 26 Oct 1997 19:00:59 +0800
Subject: Secure envelopes
Message-ID: <199710261053.LAA14833@basement.replay.com>



The only `culture' Timmy May possesses is that 
cultivated from his foreskin scrapings.

   \|/
  (*,*) Timmy May
 _m_-_m_






From jya at pipeline.com  Sun Oct 26 04:16:44 1997
From: jya at pipeline.com (John Young)
Date: Sun, 26 Oct 1997 20:16:44 +0800
Subject: poverty traps (Re: Sa
Message-ID: <1.5.4.32.19971026121729.00b3a3c0@pop.pipeline.com>



Jonathan Wienke wrote:

>that socialist cesspool New York City.

This is true, NYC is an SC. My pinko nose is barely above the 
surface, for it's a hump treading the globe's shipped in effluvia with 
concrete boots made of the NIMBYs' unpaid share. And you never
get used to it, for sure the waves caused by tens of thousands 
of NIMBYs cannonballing in for X-rated sin lacking IMBY.







From ant at notatla.demon.co.uk  Sun Oct 26 05:17:38 1997
From: ant at notatla.demon.co.uk (Antonomasia)
Date: Sun, 26 Oct 1997 21:17:38 +0800
Subject: Orthogonality and Disaster Recovery (fwd)
Message-ID: <199710261410.OAA01609@notatla.demon.co.uk>



From: kent at bywater.songbird.com

> On Sat, Oct 25, 1997 at 04:28:52PM -0500, Jim Choate wrote:

> > Any idea how a term meaning 'at right angles' came to hold all the various
> > interpretations it now does?...
> > 
> > I see this word in a lot of my reading and it almost never implies any sort
> > of 'indipendent multi-variant reference system'.

> I can't believe that you haven't studied vector spaces, Jim.  In that 
> particular niche of mathematics, the meaning you quote is precisely the 
> meaning of 'orthogonal'.  Vector algebra underlies a very large part 
> of mathematics, and modern physics would not exist without it.


I believe that is Jim's point.  The dictionary definition and
"one task, one tool" seem to have quite a gap between them.



--
##############################################################
# Antonomasia   ant at notatla.demon.co.uk                      #
# See http://www.notatla.demon.co.uk/                        #
##############################################################






From ravage at ssz.com  Sun Oct 26 05:35:08 1997
From: ravage at ssz.com (Jim Choate)
Date: Sun, 26 Oct 1997 21:35:08 +0800
Subject: Flag ban in Mississippi [CNN]
Message-ID: <199710261401.IAA32569@einstein.ssz.com>



Forwarded message:

>                      FLAG BAN TUGS ON OLE MISS TRADITIONS
>                                        
>      Students wave Confederate flags
>      
>   Confederate banner impedes athletic recruiting
>   
>      October 25, 1997
>      Web posted at: 10:44 p.m. EDT (0244 GMT)
>      
>      From Correspondent Brian Cabell
>      
>      OXFORD, Mississippi (CNN) -- On any given football Saturday, when
>      the Ole Miss Rebels find the end zone and the crowd explodes, you
>      can see Confederate flags being waved.
>      
>      But there are not nearly as many rebel flags as in years past -- and
>      there will soon be even fewer if the University of Mississippi's
>      chancellor has his way.
>      
>      This week, chancellor Robert Khayat ordered a ban on all sticks at
>      athletic events, starting next week. It's ostensibly for safety
>      reasons, but no one is fooled -- it is clearly an attempt to keep
>      out the Confederate flags attached to those sticks. CNN's Brian
>      Cabell reports
>      icon 2 min., 1 sec. VXtreme streaming video
>      
>      At Ole Miss, tradition is grudgingly giving way to the political and
>      social reality that the rebel flag is perceived by some people,
>      particularly African Americans, as a racist symbol.
>      
>      "We're tired of the attention, the negative publicity that we're
>      getting," said athletic director Pete Boone. "I mean, we've got a
>      great university here, a great academic program, and we're being
>      held back from a national perspective because of this Confederate
>      flag."
>      
>      Saturday's football game against Alabama was the first since Khayat
>      ordered the ban. And while the student senate this week also
>      recommended that the rebel flags be left home, they were
>      particularly visible in the student section.
>      
>      "Other people can do things and wave things and it's fine, but if we
>      do it, it seems like it's racist," complained one student. "But it's
>      not racist. We're proud of our Southern heritage."
>      
>      Ironically, many of those who have forsaken the flag are older Ole
>      Miss fans, who express fears about what the Confederate flag in the
>      stands does to the quality of the team on the field.
>      
>      Indeed, Ole Miss football coach Tommy Tuberville has told fans that
>      the university is losing black recruits because of the flag. He says
>      he's gratified that flags are disappearing.
>      
>      "I'm proud of our students and our fans, and I think they understand
>      the situation," he said. "Hopefully, we can continue to make
>      progress."






From ravage at ssz.com  Sun Oct 26 05:35:11 1997
From: ravage at ssz.com (Jim Choate)
Date: Sun, 26 Oct 1997 21:35:11 +0800
Subject: G7 to meet in Amazon [CNN]
Message-ID: <199710261400.IAA32530@einstein.ssz.com>



Forwarded message:

>               G7 TO MEET IN AMAZON TO REVIEW DEVELOPMENT PROGRAM
>                                        
>      G7 graphic October 25, 1997
>      Web posted at: 8:03 p.m. EDT (0003 GMT)
>      
>      BRASILIA, Brazil (Reuters) -- Brazil and the Group of Seven
>      industrialized nations meet in the Amazonian capital of Manaus next
>      week to agree on the next stage of a program promoting sustainable
>      development in the rain forest.
>      
>      The annual meeting of G7 donors to the so-called Pilot Program
>      (G7-PP), administered by the World Bank, begins formally on Tuesday,
>      with Monday dedicated to presentations by Brazilian government
>      officials of projects in the Amazon.
>      
>      "When we speak of the future, that means completing and
>      consolidating current projects and thinking about Phase Two of the
>      G7-PP," Brazilian Environment Minister Gustavo Krause said.
>      
>      Starting six years ago, the program has given out $181.3 million of
>      a total of $250 million pledged to fund projects such as the
>      demarcation of Indian reserves and protecting fishing communities
>      from large-scale competitors.
>      
>      The rest is budgeted, one of the aims of the three-day meeting will
>      be to identify new sources of money and coax fresh funds out of the
>      participants -- Germany, the United States, the European Union,
>      Japan, Italy, the Netherlands, Britain and Canada.
>      
>      Germany has financed the bulk of projects, contributing 35 percent
>      of the total and even more as the principal economic power in the
>      European Union.
>      
>      The United States, despite spending pledges made by President
>      Clinton on a visit to Brazil earlier this month, lags in fourth
>      place, behind the EU and Japan.
>      
>      Environmental pressure groups said the most important aspect of the
>      meeting is a proposal to establish zones in the gigantic Amazon
>      river basin. Map of Brazil 
>      
>      They say Pilot Program managers are resigned to the fact Brazil will
>      pursue large-scale infrastructure projects in the rain forest,
>      including paving a road from Manaus to Venezuela and river-widening
>      projects to boost soybean exports.
>      
>      "It seems important that the realities of the Amazon region and of
>      its political weight and significance must be taken into account if
>      effective conservation of at least a good part of the Amazon are to
>      be achieved," the World Bank's Rain Forest Unit said in a memo.
>      
>      The infrastructure projects basically correspond to what the bank
>      calls "development corridors" where the "objective is to increase
>      and geographically concentrate economic activity."
>      
>      Such corridors would be counter-balanced by "conservation corridors"
>      where biodiversity would be protected.
>      
>      In between, in so-called inter-corridor spaces, the Rain Forest Unit
>      suggests policies should make sure economic activity that preserves
>      as much of the forest as possible becomes more attractive than
>      clearing land for agriculture.
>      
>      A concrete task set by the officials meeting in Manaus is to decide
>      when Phase Two of the program will begin.
>      
>      They must also decide what type of transition is needed to blend
>      Phase One projects into a broader, cohesive program that fits into
>      the Brazilian government's plans for the region.
>      
>      Copyright 1997 Reuters Limited. All rights reserved.






From whgiii at invweb.net  Sun Oct 26 07:15:35 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Sun, 26 Oct 1997 23:15:35 +0800
Subject: poverty traps (Re: Sa
In-Reply-To: <199710252037.PAA30248@einstein.ssz.com>
Message-ID: <199710261509.KAA01240@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <199710252037.PAA30248 at einstein.ssz.com>, on 10/25/97 
   at 04:09 PM, harka at nycmetro.com said:

>-----BEGIN PGP SIGNED MESSAGE-----

> > Harka  wrote:

> > That may indeed work for some people, but the argument of
> > "self-discipline and sacrifice" usually goes overboard once
> > people _other than yourself_ are severely affected by that.
> > "Sorry hun, you can't have a new winter-coat. Mommy has to save
> > enough money so that she can choose the people she works for.
> > And no...no christmas this year either".

> -=> Quoting In:aba at dcs.ex.ac.uk to Harka <=-

> In> That is indeed a sad financial state to be in.  I have trouble
> In> believing it though.

>[examples of well-fares deleted]

> In> So if any kids are being deprived of winter clothes or
> In> whatever, it's not because their parents don't have enough
> In> money, it's because their parents are stupid, or selfish.

>Although my statement was deliberately somewhat exaggerated, it is not
>that far from reality for quite a few people I know.

>A real-life example:

>A single (divorced) mother, 4 kids (3-12 years), working full-time and
>making in theory $42 000/year. After taxes that comes down to $2000 cash
>per month.

CLUE #1: The reason she is divorced with 4 kids is because she made the
CHOICES in life that put her there!

>In order for her to be able to work her two youngest kids go to a
>day-care-center. Wham! $1000 per month (hiring a baby-sitter would amount
>to even more).
>Her apartment costs $800/month excluding utilities. That leaves $200 (+
>$800 she gets in child-support) per month for _five_ people to live on
>(clothes, food, utilities, school-books, gas for the car, etc.etc.)

>One thousand dollars per month for five people!! And that in New York
>City!

CLUE #2: If she can't afford to live in New York City then MOVE!!

>She is not entitled to any support such as free school-meals for the kids
>etc., because she "makes too much money" (_before_ taxes, of course!)

CLUE #3: She is not "entitled" to anything regardless of what she makes.

>What efforts has she made to make "herself more marketable"? She has been
>working ever since the age of 16, went 8 years to College (paid by
>herself and paying rent at the same time) and now has a Masters Degree in
>teaching.

CLUE #4: She made a bad choice of getting a Masters Degree in teaching.
She just as well could have spent the 8 yrs becoming a lawer. She made the
CHOICE to become a teacher, that's here problem not ours.

>What has it brought her? Bill-collectors calling every day!

CLUE #5: She is living above her means. Move to a cheaper apartment, get a
better paying job in Industry, spend less on "luxury items", ...ect

>She made a calculation and (confirming your statement) came to the
>conclusion, that she indeed would have _more_ money by not working at all
>and simply going on welfare.

>However, that is not a choice she wants to make.

>Is she to be called "stupid" and "selfish" because she's poor despite her
>efforts???

CLUE #6: She has made CHOICES in her life that has brought her to where
she is today. Now she needs to make another choice of wether she want's to
stay there or improve he lot in life. It is up to her to do so, not her
boss, not the school she works for, and not the government.

>I don't think so. She, btw., is not the only person I know
>struggeling in this manner from one month into the next, barely being
>able to even catch up on bills.

And if you bother to look at how and why they are there you would see that
it is of their own making.

>Neither does she have a free choice of employers. There is only one board
>of education in the City. Changing for a private school would come with
>(at least a temporary) pay-cut, that she obviously can't afford.

Of course she has free choice of employers. She just has to be willing to
make them.

>Therefore:

>Since she isn't the only person I can think of, who is in such a
>position, the argument formerly known as "If 'ya don't like the
>company-policy [employing GAK/CAK] just leave and work for somebody else"
>may now be called: "Ad Acta".

Therefore:

This is yet another case of one being unwilling of taking the
RESPONSIBILITY for their actions. She put herself there and she is the
only one who can get herself out.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFNr4o9Co1n+aLhhAQH9qQP/d/SJwtlJEm/y9iyEOR7H5YwMEQ2V78Xl
NgRIjO1/ndgJ25cP8VtBDmNMysJFGJol4dio/tcDC8TD+OSsEmaO4VEucaIRYz3M
7P7nZmIIzvnHRpcHn/pzafROdeOsLjYy1tm1+Ns8fuR0FBFhZmHfXx3J9soFNZZu
OjY38H5sR3U=
=FD9Z
-----END PGP SIGNATURE-----






From ravage at ssz.com  Sun Oct 26 08:22:27 1997
From: ravage at ssz.com (Jim Choate)
Date: Mon, 27 Oct 1997 00:22:27 +0800
Subject: Orthogonal
Message-ID: <199710261616.KAA00300@einstein.ssz.com>



Hi,

I believe the first definition for orthogonal is not the vector or Cartesian
definition but rather from geometry.

Where, for example, polygonal means a closed shape made up from many line
segments, orthogonal means a closed shape made from line segments at right
angles to each other. The simplest being the square.

DeCarte used the concept of ortho- to describe the relationship between the
axis of his measurement system, hence orthogonal. Strictly speaking
orthogonal is a misnomer and should be orthometric or 'measurements at right
angles'.

I am interested in how orthogonal obtained its variety of other meanings. I
run across it in linguistics, computer science, philosophy, etc. In most of
them it means some sort of pure or simple relationship. Unfortunately I
can't find any sort of description of how it got expanded this way.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From harka at nycmetro.com  Sun Oct 26 08:24:48 1997
From: harka at nycmetro.com (harka at nycmetro.com)
Date: Mon, 27 Oct 1997 00:24:48 +0800
Subject: poverty traps (Re: Sa
Message-ID: <199710261616.KAA00310@einstein.ssz.com>



-----BEGIN PGP SIGNED MESSAGE-----

 -=> Quoting In:anon at anon.efga.org (Monty Cantsin) to Harka <=-

 In> The government is not Janice's friend.  It takes away $18,000
 In> from her each year and plunges her into poverty, sort of.  If
 In> you are appealing to the government to assist Janice, first
 In> ask it to get the hell out of the way.  (I realize you may
 In> just be saying that Janice's plight is unavoidable, not that
 In> she should be helped with government money.)

Hmm, we all agree, that the government is not somebody to be
trusted to be your friend. However, we also know the amount of laws
possible to "violate" and the consequences that would have. And one
of the worst things you can do is evading taxes. At least when they
clamp down on you. Not something, I'd recommend to a mother of four
kids (that she really doesn't want to give up to
government-so-schill-workers). Jim Choate commented on that already,
so I save further words.

 In> Janice should be baby sitting.  Were she to take in 4 kids at
 In> $500/month, she would make as much as her job and be able to
 In> watch her own kids during the same time.

True in short-term. But after 8 kids have been rummaging around in
your apartment every day (even without licence and off-the-books and
all that stuff) you can definitely expect to spend a couple of
grands on repairs in a matter of a month.

 In> Telephone: $20/month
 In> Electricity: $40/month (?)
 In> Heat: $100/month (?)
 In> Food: $600/month (generous)
 In> Goodwill Clothes: $100/month (generous)
 In> Total: $860/month

You obviously don't live in NYC (and don't have kids). It costs her
alone six bucks a day just to get to work and back (with public
transportation).

 In> The food is generous because four of the five are kids, the
 In> oldest only being 12.  Kids don't each much.

You're confirming my suspicion about not having kids :)

 In> Of course, there is no law that requires one to live in New
 In> York City.

As a matter of fact there is. At least for her. She's _required_ by
the divorce-court to live within a 60-mile-zone of her ex-husband
and father of her kids (he's in the City too). For
visitation-rights and all that (i.e. she can't move out of state
without his approval or be charged with kidnapping, if she does it
anyway). A thing applicable to probably hundreds of thousands of
people (women mostly) in the US. And that alone limits one's "free
choice of employers" quite severely.

 In> It seems pretty clear that making money was not her top
 In> priority. It's never been a secret that teachers are not top
 In> earners.  I'm not seeing a description of somebody who really
 In> tried to make money in a serious way.

Talking about freedom at the same time then is an oxymoron and
you're confirming my "criticisms about the free market" (Yes Tim, I
have re-considered my position without changing my perspective in
the end).
Capitalism in it's current form does not allow for individual
freedom for most people (exceptions apply), because they have to
make the money to be free (independent).
If that requires doing for years, what you don't want to do
(working in computers, although you hate them and all you really
want to do is paint and live as an artist but can't afford to, for
example), then that means by definition, that freedom has to be
given up. At least temporarely and as mentioned before, that can be
a _very_ long time for most people (who have been born into the
"wrong" families, for example).

 In> Good for her.  It sounds like Janice may have the strength of
 In> character to turn her situation around.

Btw., I'll forward her all of the advice and suggestions everybody
gave. Thanks for everybodies effort and consideration of the (for
her personal) matter.

Also, (violins or not :)) :

It was not my primary intention to cause tears of compassion for
Janices personal situation (a lot of people on and off the list
have a rough time too to get on in life), but to introduce some
realism into the discussion of "free choice of employers".
Cypherpunks sometimes tend to become somewhat theoretical about
things, neglecting the possibility, that it may not apply on a
larger (real-life)scale.
Pointing such things out I regard as a very important thing to the
effectiveness of Cypherpunks-discussions and subsequent influence.
The argument of an (for everybody) existing "free choice of
employers", for example, should by now be seen as rather relativ, if
not completely negated.

Further it is a social issue of importance also for Cypherpunks.
Obviously we don't want governments "taking care of people", but
desire individual freedom, self-determination and independence
instead. However, as proven such things are possible in the "free
market" only to a limited degree, i.e not applicable by default to
everybody, IMHO.

Do I have a solution? Honestly, I don't and I wish I had. That
doesn't prevent me from seeing (and pointing out) things, that I
don't agree with when looking out the window or talking with
friends, who are in a very different position than I might be in.

If anybody _does_ have a solution, that enables _all_ people
(regardless of background) to become truly free and also provides a
realistic way to achieve that (for everybody), then I'll be more
than happy to listen and to adjust my own perspective.

Ciao

Harka

/*************************************************************/
/* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */
/* PGP public key available upon request.  [KeyID: 04174301] */
/* F-print: FD E4 F8 6D C1 6A 44 F5  28 9C 40 6E B8 94 78 E8 */
/*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/
/* May there be peace in this world, may all anger dissolve  */
/* and may all living beings find the way to happiness...    */
/*************************************************************/

... "It is better to die on our feet than to live on our knees."

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAgUBNFNs/jltEBIEF0MBAQFfYwf9FthPQH1q3A66xWtMf/9NGfOf4Vn6JaY9
Gt/6nVCQ+nZJIRPP//9NwowOm7DcbEYMCKASHVEIGNyUtGuWpcf1wZxywlHJ/AEs
d34/XwCYe9y/L/pIwk7RfN9aqr5pALw5FGAVPWQZiCyom8XuWSMcPrkEQxsctp99
Qs9cQ33fgBfvpydkM7l9ugkPs5eynycv/pHLvwym9BMl2jQxe4IiUqs1tNbjW8Er
A3qM39bmU599GHF3kyvRy+w8ATC1oFg3qvFVx8DvH/856VgD0jRW0rAPhC2jOcYb
NbgHADbw469uG7hVFQSY8ghN1aXCgGDJAI8Fih3OGfsgfm/ttdIU0Q==
=r2F2
-----END PGP SIGNATURE-----


If encryption is outlawed, only outlaws will have encryption...






From david at sternlight.com  Sun Oct 26 09:25:25 1997
From: david at sternlight.com (David Sternlight)
Date: Mon, 27 Oct 1997 01:25:25 +0800
Subject: Orthogonality and Disaster Recovery
In-Reply-To: 
Message-ID: <34537A18.9FE77210@sternlight.com>



Dunno why I got this since I'm not on the cypherpunks list, but I found it
interesting and worth responding to. (Tim--please repost to the list if my
attempt to do so fails.)

Robert Hettinga wrote:
> 
> --- begin forwarded text
> 
> X-Sender: tcmay at mail.got.net
> Mime-Version: 1.0
> Date: Sat, 25 Oct 1997 13:52:05 -0700
> To: cypherpunks at algebra.com
> From: Tim May 
> Subject: Orthogonality and Disaster Recovery
> Sender: owner-cypherpunks at cyberpass.net
> Precedence: bulk
> Reply-To: Tim May 
> X-Loop: cypherpunks at cyberpass.net
> 
> One of the themes of modern computing I strongly support is that of
> "orthogonality," or clean functionality. A browser should not also try to
> be a money management program. A word processor should not also try to be
> an accounting program.

This is a sensible criterion when the functions are indeed independent. There
are small leakages even there--thus an on-line money management program which
can send inquiries about incomplete transactions to a bank and receive replies
needs a small e-mailer and certainly an Internet interface.

The argument has, however, become polarized for self-serving purposes by
Microsoft. They have linked their Internet Explorer with the OS, claiming the
desktop as the place of commonality. That permits them to require bundling of
the two. They have apparently threatened vendors who don't bundle THEIR
browser on the desktop with pulling their Windows license. They have refused
to allow vendors to remove their browser icon from the desktop on grounds it
then "doesn't present the complete 'Windows experience' to the user". What's
next-integrating Word with the desktop to drive out competing word processors;
integrating Access to drive out competing data bases. The matter is currently
under challenge by the Federal government, whose definition of orgthoganality
seems to be that a particular application has (in practice) or has had a
separate market--been sold separately.

> 
> Failure to observe this rule of thumb has led to spreadsheets which can run
> MPEG movies in spreadsheet cells (I'm not kidding), and to Web browsers
> which take 20 MB of free memory to run reliably because they also contain
> mediocre news readers, mediocre mailers, and lots of bloatware cruft.

Under the Federal definition as long as a news reader or a mailer have been
sold separately they are separate product. But in this case there is important
common functionality. Netscape Communicator integrates not only the mailer and
newsreader, but provides a near-identical interface to the two and lists
newsgroups as a continuation of your list of mail folders. The model feels a
little artificial (and their newsreader doesn't yet have filters so it's
inconvenient), but one can see some sense in it.

Similarly, one often wishes to mail pages one is browsing. Integration of the
mailer and the browser are thus quite convenient. It is true one can use the
passing of events and the clipboard to do it with separate applications but
that's both inelegant and a source of inefficiency and problems.

The fundamental problem with the modular approach is configuration control and
that is a big enough mess as it is with control panels and extensions, as any
user can attest. A small industry has sprung up which reports inconsistencies
there, and programs which test for such incompatibilities (and are quite
time-consuming) also exist (at least on the Mac), illustrating the reality of
the problem. In such cases strong central control and integrated operation is
best. It is, in fact, the root of the Mac metaphor, where Apple's Human
Interface Guidelines have forced a common user interface on all "Mac-like"
applications, making for a short learning curve and the famous lack of a need
to RTFM for most Mac applications. Windows has a long way to go but is heading
in a similar direction (one hopes). Meanwhile, the "modular" approach of many
Windows applications leads to remarks like anything other than changing a file
name wiil likely require a reboot. (There's a grain of truth in every satire.) 

>Much of the strenght of Unix has obviously come from the
> philosophy that a function or utility should do some small set of things
> well and cleanly, with chaining of these clean tools to accomplish more
> complicated tasks.

It is also the reason why Unix is arcane, complex, and difficult for most
novices and why poor imitations of Mac windowing and the Mac finder have
sprung up. The value of Unix isn't that modularity. It is the robustness of
the kernel. In fact modern operating systems use a Unix Kernet under a
Mac-like user interface (Rhapsody, Be, etc.).

> 
> A crypto program like PGP is intended to encrypt messages between a sender
> and a recipient, or to provide authentication through signatures, or to
> encrypt files on a storage medium. These are the classic, well-documented,
> oft-discussed functions of crypto. Look in textbooks under "crypto" and
> there won't be much talk of how to supply MIS with emergency backdoors, or
> ways to monitor employees.

This seems to be a defense of a major failing of PGP. Rather than being a
complete package for a user function (encrypting and signing mail, for
example) it is a pre- and post-processor which requires a separate mailer and
newsreader. In fact this whole argument may be viewed as an attempt to defend
that failing of PGP. The failing is understandable since Phil wanted to get
something out there quickly and hadn't (and probably still doesn't have) the
resources and talents available to do a complete PGP mailer/newsreader--much
less be able to compete successfully with those who DO do such mailers and newsreaders.

By the way, if one's world-view is PGP-centric there's another argument for
combining a mailer and a newsreader--both need to be able to sign traffic and
process signed traffic; to pass signed and perhaps encrypted files.

> 
> If properly modularized and orthogonalized (so to speak), such crypto
> programs can then be used as building blocks for other tasks, like
> remailers, data havens, and so on.

A defense of the obsolete, in my view. Like most "bright ideas" I believe this
notion of modules and plug-ins will eventually collapse of its own interface
management weight except in cases of both very tightly defined sandboxes, and
open-ended/niche needs (such as in an OS or a do-everything text editor such
as BBEdit) which the vendor hasn't the personnel and time to fill. Don't be
misled by the need for such niche tweaks into thinking there's a fundamental
principle at work here.

> 
> But there is a growing tendency, as seen in the bloatware examples of
> browsers and spreadsheets mentioned above, to throw in all kinds of "wish
> list" and "wouldn't it be nice" stuff. PGP is headed for bloatware. ("It's
> not just a crypto program, it's also a tax preparation  and disaster
> planning program!")

Netscape has really been moving toward a multi-purpose Net/Web OS for some
time. That's why it has a browser, mailer, newsreader, web page maker,
conferencer, and push-traffic channel handler. If done well (there's the rub)
it is both more convenient, more consistent of user interface, and more
integrated, providing user benefits.

It is true there are those who prefer some other module (Eudora or Claris
e-mailer; Newswatcher) either out of habit or desire. To accommodate them
Netscape has unbundled the browser. But that's simply an accomodation to a
sub-market of relatively sophisticated users and not a mainstrem strategy.
Remember that Netscape is used by about 25 million out there (give or take),
and most of them haven't the time, patience or expertise to manage several
non-integrated modules. They want another of the Mac's basic philosophical
principles (regardless of OS platform)--plug and play. Here, too, Microsoft is
just beginnning to catch up but that's the clear direction they're going in.

> 
> I'm quite certain that the Security and MIS directors at various companies
> asked PGP, Inc. to include message recovery features. Not so much to handle
> the very rare (almost nonexistent) cases where a piece of mail sent at some
> time in the past has to be recovered because Alice was hit by a truck, or
> similiar unlikely events (*), but because Security and MIS folks would like
> the option of "monitoring" e-mail traffic.

Anyone who has been exposed to industrial espionage knows that one needs such
features in a corporate environment, not only for micro-disaster recovery but
also for investigatory purposes.

> 
> (* I have heard no plausible scenarios under which transient
> communications, which are presumably stored in the form composed
> (plaintext) on the sender's machine or in the for received and read (also
> in plaintext) on the receiver's machine, need to be recovered from the
> *transit* state. We know why the FBI wants access to communications
> keys--because access to the transit state is what they get when they
> wiretap or sniff a communications line--but there is no plausbile
> explanation of why a company would not simply ask Alice for the plaintext,
> or ask Bob if for some reason Alice is unavailable. The idea someone
> floated, that he needs to go in and decrypt his employee's mail in
> emergencies is far-fetched. 

Not in any real company where much daily design, negotiation, and dynamic
interaction exists only in e-mail until things are finalized by the attorneys
or a design review board.

> 
> But are such bloatware crypto programs even good for disaster recovery? I
> say they are not. I say e-mail will be a tiny, tiny portion of the recovery
> strategy if Alice gets hit by a truck, for example. Far more important will
> be recovery of her hard disk and related files.

And if Alice is a contract negotiator doing it via e-mail? There are many
other examples where your assertions break down.
> 
> (No, I am _not_ proposing anything be added to PGP to deal with this
> disaster planning. Nor am I proposing that PGP enforce plaintext storage,
> or anything else for that matter. These are all matters _orthogonal_ to the
> basic function of a crypto program, and a crypto program cannot enforce
> crypto hygiene any more than a spreadsheet can enforce good tax planning
> hygiene.)

A better example would be a money management program with a tax module. They
are linked and one's money management strategies have tax consequences and
vice-versa. You can always find inappropriate examples where little synergy
exists, but there are plenty of examples where strong synergy DOES exist. See
also my examples above.

> 
> I am also not terribly interested in convoluted, byzantine schemes for
> building "CDR" and such into crypto programs, as some are proposing. Again,
> this is trying to make a crypto program into a disaster preparation
> product, and trying to (partly) solve backup and disaster problems best
> solved in other ways. Not something PGP should worry about (either the
> program or the company).

You are trying to refute a valid argument by labelling. The issue isn't labels
such as "disaster recovery program" but functionality and synergy. You can
always create distinctions that would try to make your case, but you do so
only by ignoring other, important distinctions.


I think this is enough to deal with the fundamental issue, so I'm going to
pass on the rest of the side-issues such as "What if Alice forgets her key."
The main issues dominate such side issues.

David






From ravage at ssz.com  Sun Oct 26 09:52:55 1997
From: ravage at ssz.com (Jim Choate)
Date: Mon, 27 Oct 1997 01:52:55 +0800
Subject: Another David Bohm book [non-crypto]
Message-ID: <199710261747.LAA00630@einstein.ssz.com>



Hi,

I know this isn't crypto related but several times David Bohm has come up in
discussions relating to physics and various interpretations of Quantum
Physics.

Check out the essay collection:

Quantum Implications: Essays in Honour of David Bohm
ed. B.J. Hiley, F.D. Peat
ISBN 0-415-06960-2
$19.95

Hiley collaborated with Bohm in his physics and co-authored The Undivided
Universe, while Peat co-authored with Bohm the book Science, Order, and
Creativity.

30 essays by:

B.J. Hiley & F.D. Peat
David Bohm
E.P. Gross
D. Pines
A.J. Leggett
R. Penrose
T.D. Clark
B. d'Espagnat
J.P. Vigier, C. Dewdney, P.R. Holland A. Kyprianidis
I. Prigogine, Y. Elskens
Y. Aharonov, D. Albert
J.S. Bell
R.P. Feynman
G.F. Chew
H.P. Stapp
C.W. Kilmister
F.A.M. Frescura, B.J. Hiley
D. Finkelstein
P.R. Holland, C. Phillipidis
H. Frohlich
R. Rosen
B.C. Goodwin
M.H.F. Wilkins
A. Ford
K.H. Pribram
G.G. Globus
M. Ullman
D. Shainberg
J. Briggs
R. Weber


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From whgiii at invweb.net  Sun Oct 26 10:36:14 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Mon, 27 Oct 1997 02:36:14 +0800
Subject: Orthogonality and Disaster Recovery
In-Reply-To: <34537A18.9FE77210@sternlight.com>
Message-ID: <199710261832.NAA03035@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <34537A18.9FE77210 at sternlight.com>, on 10/26/97 
   at 09:13 AM, David Sternlight  said:

>This seems to be a defense of a major failing of PGP. Rather than being a
>complete package for a user function (encrypting and signing mail, for
>example) it is a pre- and post-processor which requires a separate mailer
>and newsreader. In fact this whole argument may be viewed as an attempt
>to defend that failing of PGP. The failing is understandable since Phil
>wanted to get something out there quickly and hadn't (and probably still
>doesn't have) the resources and talents available to do a complete PGP
>mailer/newsreader--much less be able to compete successfully with those
>who DO do such mailers and newsreaders.

This is quite silly argument David,

Do all E-Mail vendors need to be cryptologist?? Do all cryptologist need
to be application vendors?? Obviously not. PGP is a tool much like a
database is. The majority of vendors who develop apps that require a
database do not go out and write their own, rather they use a database
engine that is suited to their needs. Betreve doesn't try to develop every
application that may use a database, instead they sell the database engine
and let the application developers make the apps. The same is true for
E-Mail vendors, they integrate PGP into their products. No need for PGP
Inc, to develop their own E-Mail product.

FWIW: I am quite confedent that if Phil wished to write an
E-Mail/NewsReader he is quite capable of producing a better product than
the peice of crap N$ has on the market.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFObb49Co1n+aLhhAQHdWwP/YS0QqHPxMyQUbElKR/dIcCNDBy1OSIWc
x+LDvth5QXn0676tC++bYyW30aw4Wc/PX2WkGJ4uDwmvRg+sPzPwtX2gTvEsPlO9
XiNg7vBaJbewUf2vfKEPFaj7YVZEG1en0lN6WLpQeN6Movb7kJNM9wyPJeS0qVNM
IuKKOIN2VHU=
=4aZI
-----END PGP SIGNATURE-----






From secret at nsa.fbi.cia.org  Sun Oct 26 12:16:38 1997
From: secret at nsa.fbi.cia.org (secret at nsa.fbi.cia.org)
Date: Mon, 27 Oct 1997 04:16:38 +0800
Subject: Click HERE for Boy Sex
Message-ID: <199710262011.MAA29005@uwin2.u.washington.edu>



An interesting anti-censorship experiment is currently taking
place on Usenet.
 
It's ingredients: One Libertarian-minded California ISP named
InterBBS which provides a variety of services to various pay XXX
Web sites, for resale to their customers, including an
uncensored, unfiltered, and unexpurgated newsfeed, which InterBBS
is protected by Common Carrier status from liability for the
contents of.
 
A nifty piece of software, recently added to InterBBS, which runs
something called "newspix", a web-based interface to Usenet
binaries pictures groups, pre-decoded and cross-referenced for
your instant point-and-clicking pleasure.
 
A guy named "Dave", a customer of InterBBS, who is reselling the
services of InterBBS through a pay boy pictures site, including
web access to a number of boy-related erotica newsgroups, whose
content neither Dave nor InterBBS controls.  Dave is very careful
to tell us that it is imperative that we not download anything
which would be illegal according to our community standards, and
that if we "unknowingly" do so, we should delete it immediately.
InterBBS, and its lawyers, maintain that their decoded neatly
indexed web-accessible Usenet pictures service enjoys the same
immunity for its content due to their Common Carrier status as
the raw newsfeed does, and of course, they wouldn't think of
keeping records on which customers read which Usenet articles.
 
The owner of InterBBS is Marlin Schwanke, who also runs
*CENSORED*.com, and is well known for giving bandwidth to
persecuted causes.
 
The net effect of all of these things coming together is that
there now exists convenient pseudoanonymous web access to all
boy-related child porn pictures posted to Usenet, for a small fee
you may bill monthly to the credit card of your choice.
 
This new service has caused a huge rift amongst Net Boylovers,
who believe that even if this operation is technically legal, and
protects the confidentiality of its customers, that such
conspicuous promotion of locations on Usenet where illegal
material is very likely to be found, and facilitating its easy
access to the non-technically minded for profit, is not in
anyones best interests.
 
For Further Reading:
 
   http://boypics.com/newspix.html            (Dave's Naughty Pix)
   http://www.ivan.net/bc/messages/38850.htm  (Marlin Answers His Critics)
   http://www.interbbs.com/                   (InterBBS home page)
 
Surely the Feds are not going to take this lying down. :)
 
Will Marlin and Dave be dragged to Tennessee or Utah to face
trial in front of a bunch of inbred jurors?  Will yokels from the
cast of "Deliverance" in the courtroom audience squeal like pigs
when the words "10 year old erect penis" are mentioned?
 
Will Dave get a cell next to Robert Thomas of AA BBS fame?
 
Will Reno and Freeh engage in unnatural sex and have a deformed
cow?
 
Is this the technology that will finally drive Officer Mike
"Sewer Site" Paladino to take his own life?
 
Stay tuned for the next episode of "Boy Pics from Dave."
 
--BoySexMonger
 






From daniel at relaxed.com  Sun Oct 26 12:17:25 1997
From: daniel at relaxed.com (daniel at relaxed.com)
Date: Mon, 27 Oct 1997 04:17:25 +0800
Subject: FUTUREWEAR  (fashion, clothing and clubwear)
Message-ID: <199710262000.MAA07022@toad.com>



FUTUREWEAR  (fashion, clothing and clubwear)
by Daniel Eder

FUTUREWEAR T-SHIRTS NOW AVAILABLE:

http://www.futurewear.com/

--------

wholesalers, resalers and promoters:
contact me at daniel at futurewear.com








From berezina at qed.net  Sun Oct 26 12:18:30 1997
From: berezina at qed.net (Paul Spirito)
Date: Mon, 27 Oct 1997 04:18:30 +0800
Subject: NAMBLA embattled -- mirror sites?
In-Reply-To: 
Message-ID: <19971026200752100.AAA149@Berezina>



At 07:40 AM 10/25/97 +0000, Tim May wrote:

>These are areas where untraceable data havens really shine. My own
>Blacknet, as an example. If the NAMBLA material were to be periodically
>sent out via remailers, to Usenet, censorship would be nearly impossible.
>
>And so would traceability and, hence, culpability.

The problem is that this only makes the technological point that censorship
is increasingly difficult, not the political point that it's wrong -- that
NAMBLA has a right to publish their material. The technological point is
worth making, but -- particularly when the information has little inherent
value -- I believe the political point is more important. I'd like to avert
a society in which unpopular publications exist only by subterfuge. In
fact, a technological response may be negative in this case, inspiring
calls for greater controls, which, while they may fail to achieve their aim, would make life worse.

Anyway -- sign me up, Declan.

Paul






From cnn at dev.null  Sun Oct 26 12:19:51 1997
From: cnn at dev.null (Canadian Nutly News)
Date: Mon, 27 Oct 1997 04:19:51 +0800
Subject: Flag ban in Canada [CNN]
In-Reply-To: <199710261401.IAA32569@einstein.ssz.com>
Message-ID: <3453A513.A33@dev.null>



FLAG BAN TUGS ON BEANTOWN TRADITIONS

                        Barflies wear American flags

               Star Spangled Banner impedes athletic recruiting
     October 31, 1997
     Web posted at: 07:09 p.m. EDT (0709 GMT)
     From Correspondent Psionist Cabal

      BIENFAIT, Sask (CNN) -- On any given fooseball Saturday, when
      the Bienfait Patriots find the hole and the crowd explodes, you
      can see American flags being waved as the barflies wiggle the
      butts of their Star Spangled jeans and jiggle the Stars and
      Stripes on their buxom breasts.

      But there are not nearly as many American flags as in years past
-- 
      and there will soon be even fewer if the Coaldust Saloon of
      Bienfait's bar owner has his way.

      This week, bar owner Fu Cue ordered a ban on all clothes at
      athletic events, starting next week. It's ostensibly for lewd
      reasons, but no one is fooled -- it is clearly an attempt to keep
      out the American flags attached to those clothes. CNN's Psionist
      Cabal reports
      icon 2 min., 1 sec. VXtreme cum-streaming video

      At Ole Beaner, tradition is grudgingly giving way to the political
and
      social reality that the American flag is perceived by some people,
      particularly Euro-Canadians, as a racist symbol.

      "We're tired of the attention, the negative publicity that we're
      getting," said bar choir director Pat Boone. "I mean, we've got a
      great bar here, a great drinking program, and we're being
      held back from a national perspective because of this American
      flag. And we don't even have any goddamn niggers, here."
      After a short pause he added, sheepishly, "I meant...coloreds.
      Sorry."

      Saturday's fooseball game against Oxbow was the first since Cue
      ordered the ban. And while the barroom drunks this week also
      recommended that the American flags be left home, they were
      particularly visible in the vomiting section.

      "Other people can do things and wave things and it's fine, but if
we
      do it, it seems like it's racist," complained one drunk. "But it's
      not racist. We're proud of our slave-owning, Constitution writing,
      Star Spangled American Puppet Masters."

      Ironically, many of those who have forsaken the flag are older Ole
      Beaner fans, who express fears about what the American flag in the
      bars does to the quality of the team at the fooseball table.

      Indeed, Ole Beaner fooseball coach Fu Cue II has told fans that
      the bar team is losing recruits because of the flag. He says
      he's gratified that flags are disappearing.
      "It's not like we get any...coloreds...here," he said, but we get
      a lot of...colored-lovers." He then asked, "Is that a 'word'?"

      "I'm proud of our drunks and our barflies, and I think they 
      understand the situation," he said. "Hopefully, we can continue 
      to make a profit off these Canadian-American drunks."






From harka at nycmetro.com  Sun Oct 26 12:23:18 1997
From: harka at nycmetro.com (harka at nycmetro.com)
Date: Mon, 27 Oct 1997 04:23:18 +0800
Subject: Choices
Message-ID: <199710262019.OAA01028@einstein.ssz.com>



-----BEGIN PGP SIGNED MESSAGE-----

Both Monty Cantsin and WHGIII have commented upon current personal
conditions being the result of one's past choices (leading up to
it).

While I agree from a mere causal viewpoint, on a personal level I
would like to point out a few things nevertheless:

We can take as given, that everybody's life is a stream of decisions
or choices. We make 'em to the best of our ability as we go along in
life.

However, having a choice in matters does not imply the guarantee of
making the _right_ choices. In fact, even society acknowledges that
fact by making certain choices available only after a certain point
in life, such as voting, marriage, driving, drinking etc.etc on the
ground, that making such decisions requires a certain level of
insight and maturity.

But there's _still_ no guarantee for making right choices even
after the "magical" age of 18 (or 21). The only thing one can do is
to gather enough information in order to make the best choice based
on available information and conditions _known_ to you _at that
time_.

And here's also the catch. By making a certain choice, one does
usually _not_ choose the consequences of his/her actions
consciously! In fact, the possible consequences may not even be
foreseeable, predictable or expected in any way!

One does not drive a car with the previous conscious knowledge of
crashing it and living in a wheelchair ever after.

One does not climb Mt. Everest with the expectation of perishing in
a snow-storm.

One does not start using PGP based on the prediction, that your
key will be GAK'ed at some point.


Let's take the example of Janice one more time (violins for
Monty:)) : certainly her decision to get married and have 4 kids
was her personal and free choice at that time.
But it was not foreseeable nor expectable for her, that her husband
would take off after a while for another chick, leaving her with
the kids and a bunch of bills to pay!
Thus she married him and later did what every wife would do:
supporting him while he went to school instead of keeping the money
for herself as a backup-cushion in case he leaves.

Is that really so out of the ordinary a choice??


But even if one is able to make fairly good decisions overall in
life: you may not have previous conditions necessary to make certain
choices.

If you're born into a poor family, who just can't afford to send you
to College, how much of a choice to study will you have in that
event? More likely is, that you'll have to work and aid in the
support of the family instead of going to College.

But are you to be held responsible for the conditions that you are
born into or grow up under?

Clearly not. As you go along in life, one's personal ability to
influence your surroundings, conditions and overall life increase
(with right effort). But to expect everybody to be able to make
certain choices in a certain (right) way, or even expecting those
choices being available, is not based on the realities of life but
a mere projection from _your_ reality onto "theirs".

So is the statement of "screw 'em all" (if they weren't able to make
certain choices for reasons we don't know about). Not only does it
lack basic notions of humanity, such as caring for other people, but
also devalues the human ability to learn and change.

Just because you were young and careless (out of lack of
understanding at that time) or you were born in a slum in Rio de
Janeiro (or NYC) shouldn't mean, that you should still get
"screwed" for it when you're fifty or you now deserve the
dis-respect of society and no chances anymore. You may have never
had them...

While technically it is probably correct to say, that current
conditions are caused by previous actions (different people have
different expressions for that: karma, choices, fate etc.), there's
no justification for suffering and certainly none for watching it
passively and saying "they deserve it", IMHO.

But then this is also a valid choice one can freely make. You just
have to live with the consequences of it :)

Ciao

Harka

/*************************************************************/
/* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */
/* PGP public key available upon request.  [KeyID: 04174301] */
/* F-print: FD E4 F8 6D C1 6A 44 F5  28 9C 40 6E B8 94 78 E8 */
/*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/
/* May there be peace in this world, may all anger dissolve  */
/* and may all living beings find the way to happiness...    */
/*************************************************************/

... "Of course I care about other people...I watch CNN!"

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAgUBNFOmJjltEBIEF0MBAQHsKwf/Sh6IWC0UCvSiWAQsTcmDqyw4k6v7AuIg
z0IlsrcSbpkBA0c3q2ghaq2TfqFIfOgSIIFr8FKK2Za3erIp6yPfcvc8V+7Lwg70
r7tnBM0janv/3j9asehV4PxiXtghQIZOxqL+14yzKgCHGzYkDglIzMmOBOcz2xrQ
lziiPMirHzOii06PJ0daBwhxhqva4zw2m6fWnqdkMfr2/mNZ8/39Y8juCqG6AeSs
/WP4D4cpXP581ldHskRMkTvYZEEN6IjnRU9PwWbYvSikU61Y7LXTaD4H39N4Xr2V
LYx0AdvAmaOC4H3f/8tU29AkAMFgsVGn3moKzG2FE6frFlbG3L1HPg==
=XB87
-----END PGP SIGNATURE-----


If encryption is outlawed, only outlaws will have encryption...






From ravage at ssz.com  Sun Oct 26 12:34:50 1997
From: ravage at ssz.com (Jim Choate)
Date: Mon, 27 Oct 1997 04:34:50 +0800
Subject: Choices
Message-ID: <199710262028.OAA01093@einstein.ssz.com>



You are

What you do

When it counts

       The Masao


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|







From pethern at inet.uni2.dk  Sun Oct 26 14:27:33 1997
From: pethern at inet.uni2.dk (Peter Herngaard)
Date: Mon, 27 Oct 1997 06:27:33 +0800
Subject: NAMBLA embattled -- mirror sites?
In-Reply-To: <19971026200752100.AAA149@Berezina>
Message-ID: 



Yes. Sign me up too Declan if necessary.
I can set up a mirror in Denmark of the site.
I can seperate it from my own account at Datashmprer Denmark and put another
user name in the fingerable account.
In Denmark we even tolerate a Paedophilia Society (Paedofilforeningen).
Advocating the right to freedom of speech for paedophilia in Denmark may 
be unpopular but not
destroying for ono's employment opportunities.
 






From ravage at ssz.com  Sun Oct 26 14:40:52 1997
From: ravage at ssz.com (Jim Choate)
Date: Mon, 27 Oct 1997 06:40:52 +0800
Subject: Ohio registers Trick-or-Treaters [CNN] [Politics]
Message-ID: <199710262237.QAA01345@einstein.ssz.com>



Forwarded message:

>               OHIO TOWN REQUIRES TRICK-OR-TREATERS TO BE LICENSED
>                                        
>      Graphic October 26, 1997
>      Web posted at: 4:29 p.m. EST (2129 GMT)
>      
>      BRIDGEPORT, Ohio (CNN) -- The Bridgeport City Council, fearing too
>      many out-of-town children would descend on the community for
>      Halloween, is requiring trick-or-treaters to have a license to ask
>      for candy this year.
>      
>      Kids age 14 and under who register with the city will be given an
>      orange sticker to wear in order to receive goodies. Bridgeport has
>      also moved Halloween celebrations from Friday to Thursday to avoid
>      busy Friday night traffic.
>      
>      While Police Chief William Fraser is going along with the sticker
>      plan, he and his officers won't be out looking for unlicensed
>      goblins. After all, there won't be a penalty for not having a
>      sticker.
>      
>      The Associated Press contributed to this report.






From emc at wire.insync.net  Sun Oct 26 14:46:08 1997
From: emc at wire.insync.net (Eric Cordian)
Date: Mon, 27 Oct 1997 06:46:08 +0800
Subject: Click HERE for Boy Sex
Message-ID: <199710262243.QAA10648@wire.insync.net>



secret at nsa.fbi.cia.org writes:
 
[And to think I almost deleted this without reading it, presuming it
 was SPAM]
 
> InterBBS, and its lawyers, maintain that their decoded neatly indexed
> web-accessible Usenet pictures service enjoys the same immunity for
> its content due to their Common Carrier status as the raw newsfeed
> does, and of course, they wouldn't think of keeping records on which
> customers read which Usenet articles.
 
Didn't the feds raid some company right here in Texas a while back,
called NetPics, for providing decoded Usenet pictures via a Web
interface?  As I recall, NetPics got raided even though they tried to
filter out child porn, and had all of their equipment seized.
 
One hesitates to even think of what the feds will do to someone who is
deliberately offering only decoded boysex newsgroups over the Web, but
it will undoubtedly involve sharpened castration shears and lots of
really bad publicity.
 
> The net effect of all of these things coming together is that there
> now exists convenient pseudoanonymous web access to all boy-related
> child porn pictures posted to Usenet, for a small fee you may bill
> monthly to the credit card of your choice.
 
Providing the Feds haven't already taken it over, killed everyone
associated with it, and decided to run it as a sting.
 
Of course, this is an interesting legal question.  Clearly, offering
raw Usenet content the ISP doesn't originate absolutely shields the ISP
from responsibility for the material, under current telecommunications
law.
 
The unanswered legal question is whether processing the raw news feed
in some way, such as would be needed to provide web access to decoded
pictures, also enjoys the same protection.
 
It would seem that automatic transcoding of Usenet, in a way which is
not content sensitive, should not be considered the origination of new
content.  On the other hand, the Feds are hardly going to sit still
for a URL which, when clicked upon, fills ones browser screen with
hundreds of thumbnails of blond pre-teen Scandinavian boys in
mid-orgasm, with a legend which reads - "Click on thumbnail to get
full-sized picture." And all for only $6 a month.
 
> http://www.ivan.net/bc/messages/38850.htm  (Marlin Answers His Critics)
 
This guy has elephant-sized balls.  I wish him well in his quest to
push the envelope.
 
Certainly a lot more interesting than Prof. Bernstein and that Snuffle
thing. :)
 
> Surely the Feds are not going to take this lying down. :)
 
"If it saves only one child..."

--
Eric Michael Cordian 0+
O:.T:.O:. Mathematical Munitions Division
"Do What Thou Wilt Shall Be The Whole Of The Law"
 






From nobody at REPLAY.COM  Sun Oct 26 15:33:24 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Mon, 27 Oct 1997 07:33:24 +0800
Subject: NAMBLA embattled -- mirror sites?
Message-ID: <199710262317.AAA26327@basement.replay.com>



Declan writes:

>Folks on f-c and cypherpunks have mirrored holocaust revisionist web
>pages, banned books, and censored newspapers. Now I understand that NAMBLA
>is in danger of losing its home on the web. Anyone up for mirroring the
>(text-only)  publications of perhaps the world's most controversial
>organization?

Nah, I'll pass on this one. If the membership list is included, I'd be glad
to forward it to my local police, though...

I'm not sure the right to free speech includes the right to endorse guys
fucking little boys, whether they give it a moniker like "transgenerational
love" or not. Any sex with a minor is rape, since they can't legally give
consent. All Hillary Klinton's "It Takes A Village" bullshit aside, I can't
see giving NAMBLA the same kind of protection as someone like Zundel.

Ratbert







From real at freenet.edmonton.ab.ca  Sun Oct 26 15:47:29 1997
From: real at freenet.edmonton.ab.ca (Graham-John Bullers)
Date: Mon, 27 Oct 1997 07:47:29 +0800
Subject: Secure envelopes
In-Reply-To: <199710261053.LAA14833@basement.replay.com>
Message-ID: 



On Sun, 26 Oct 1997, Anonymous wrote:


I think Vulis needs each of us to send ten copies of this back to him.

> The only `culture' Timmy May possesses is that 
> cultivated from his foreskin scrapings.
> 
>    \|/
>   (*,*) Timmy May
>  _m_-_m_
> 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Graham-John Bullers                      Moderator of alt.2600.moderated   
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    email :  : 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         http://www.freenet.edmonton.ab.ca/~real/index.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






From ravage at ssz.com  Sun Oct 26 15:56:24 1997
From: ravage at ssz.com (Jim Choate)
Date: Mon, 27 Oct 1997 07:56:24 +0800
Subject: Republic of Texas seperatist go on trial [CNN]
Message-ID: <199710262352.RAA01555@einstein.ssz.com>



Forwarded message:

>                   TRIAL SET FOR REPUBLIC OF TEXAS SEPARATISTS
>                                        
>      
>      
>      ALPINE, Texas (Reuters) - Texas separatists who held off police in a
>      seven-day armed standoff in May before surrendering are to go on
>      trial this week on charges of engaging in organized criminal
>      activity.
>      
>      Republic of Texas "ambassador" Richard McLaren and three of his
>      followers could face up to 99 years in prison if found guilty of the
>      first-degree state felony charges.
>      
>      McLaren and his bodyguard Robert "White Eagle" Otto are facing trial
>      together, as are Gregg and Karen Paulson, a married couple who also
>      joined the Republic of Texas group.
>      
>      All four defendants claim that Texas was illegally annexed by the
>      United States in 1845 and that neither state or federal courts have
>      jurisdiction over them.
>      
>      Prosecutors allege McLaren and his followers are common criminals
>      who used the rhetoric of Texas independence as a cover for
>      fraudulent schemes aimed at taking property away from individuals
>      and businesses.
>      
>      McLaren, his wife and several other Republic members also face
>      separate federal fraud and conspiracy charges for allegedly issuing
>      $1.8 billion in bogus financial warrants.
>      
>      Copyright 1997 Reuters Limited. All rights reserved.






From mbp at pharos.com.au  Sun Oct 26 16:43:09 1997
From: mbp at pharos.com.au (Martin Pool)
Date: Mon, 27 Oct 1997 08:43:09 +0800
Subject: NAMBLA embattled -- mirror sites?
In-Reply-To: <199710262317.AAA26327@basement.replay.com>
Message-ID: 



On Mon, 27 Oct 1997, Ratbert wrote:

> I'm not sure the right to free speech includes the right to endorse guys
> fucking little boys, whether they give it a moniker like "transgenerational
> love" or not. Any sex with a minor is rape, since they can't legally give
> consent. 

There's a huge difference between people talking about fucking little
boys, and people actually doing it.  The latter is certainly rape, and
perpetrators should certainly be jailed at the very least.  However, for
all that it may be offensive, data doesn't hurt children, except in that
it records previous crimes, or foreshadows future ones.  

Even if we were to admit some of this information constitutes a thought
crime there's still no shortage of far more important physical crimes
against children for our protectors to deal with. 

Read some de Sade from your local library.  For many liberal people, it
can be challenging to reconcile a general belief in freedom of speech and
thought with their revulsion at what he wrote.  It's easy to believe in
freedom in the abstract: you have to look at the boundary cases to decide
what you really believe.

--
Martin Pool







From kent at bywater.songbird.com  Sun Oct 26 16:44:05 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Mon, 27 Oct 1997 08:44:05 +0800
Subject: Orthogonal
In-Reply-To: <199710261616.KAA00300@einstein.ssz.com>
Message-ID: <19971026163358.52901@bywater.songbird.com>



On Sun, Oct 26, 1997 at 10:16:03AM -0600, Jim Choate wrote:
> Hi,
> 
> I believe the first definition for orthogonal is not the vector or Cartesian
> definition but rather from geometry.
> 
> Where, for example, polygonal means a closed shape made up from many line
> segments, orthogonal means a closed shape made from line segments at right
> angles to each other. The simplest being the square.
> 
> DeCarte used the concept of ortho- to describe the relationship between the
> axis of his measurement system, hence orthogonal. Strictly speaking
> orthogonal is a misnomer and should be orthometric or 'measurements at right
> angles'.
> 
> I am interested in how orthogonal obtained its variety of other meanings. I
> run across it in linguistics, computer science, philosophy, etc. In most of
> them it means some sort of pure or simple relationship. Unfortunately I
> can't find any sort of description of how it got expanded this way.

Sorry I misread your prior post.

The first context where I am aware of this use of the term orthogonal
is from language design -- it was promoted by Niklaus Wirth and other
purists, with languages like Pascal, Modula, CLU, and so on.  Larry
Wall's "perl" language, with its slogan "there's more than one way to
do it", is a direct revolt against the language purists.

The basic idea is that a computer language should have the minimum
number of constructs necessary to span the intended application.  So
for example, you don't provide hyperbolic trig functions, because the
user can implement them using simpler math functions.  On the other
hand, you do supply commonly used math functions that would otherwise
require iterative algorithms.

I do believe the use of the term this way was inspired by the 
notion of a 'basis' in a vector space -- a set of orthogonal
vectors that span the space, ideally, unit vectors.

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From ravage at ssz.com  Sun Oct 26 16:48:40 1997
From: ravage at ssz.com (Jim Choate)
Date: Mon, 27 Oct 1997 08:48:40 +0800
Subject: Orthogonal (fwd)
Message-ID: <199710270042.SAA01737@einstein.ssz.com>



Forwarded message:

> Date: Sun, 26 Oct 1997 16:33:58 -0800
> From: Kent Crispin 
> Subject: Re: Orthogonal

> The first context where I am aware of this use of the term orthogonal
> is from language design -- it was promoted by Niklaus Wirth and other
> purists, with languages like Pascal, Modula, CLU, and so on.  Larry
> Wall's "perl" language, with its slogan "there's more than one way to
> do it", is a direct revolt against the language purists.
> 
> The basic idea is that a computer language should have the minimum
> number of constructs necessary to span the intended application.  So
> for example, you don't provide hyperbolic trig functions, because the
> user can implement them using simpler math functions.  On the other
> hand, you do supply commonly used math functions that would otherwise
> require iterative algorithms.
> 
> I do believe the use of the term this way was inspired by the 
> notion of a 'basis' in a vector space -- a set of orthogonal
> vectors that span the space, ideally, unit vectors.

Can you better define the term 'basis'?

I can see the union 'build complicated things out of basic building blocks'
and the use of Occam's Razor (I'm as lazy as any other programmer) but fail
to see how this maps to anything relating to the concept of orthogonal.
Which clearly doesn't have any inherent minimalist cast.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From proff at iq.org  Sun Oct 26 17:19:33 1997
From: proff at iq.org (Julian Assange)
Date: Mon, 27 Oct 1997 09:19:33 +0800
Subject: cryptographic anecdotes
Message-ID: <19971027010829.851.qmail@iq.org>




I'm involved in producing a segment on cryptograpic issues for Radio
National (ABC) to be aired latter this week. I have no problems with
the technical issues but could use some (reliable) "colour" i.e small
quirky or unusual anecdotes that will draw in and hold the larger
order of listeners who don't otherwise have any cryptography/
cryptographic-policy background.

	e.g	o RSA export-a-crypto-system .sig
		o algorithm tatoos (couldn't find any confirmation of
		  this :()
		o if cryptography is arms, then US constitution
		  right to bear arms
		o programming languages embody freedom of speech
		  (patel)
		o (otoh) machine-understandable languages are not protected
		  speech: as soon as a computer can understand Ulysses
		  it's no-longer protected. (I'm not sure about Ulysses
		  but Oracle and the computational linguistics groups
		  at Edinburgh and MIT have code to perform summaries
		  of the King James bible).
	
Cheers,
Julian.

--
Prof. Julian Assange  |"Don't worry about people stealing your ideas. If your
		      | Ideas are any good, you'll have to ram them down
proff at iq.org          | people's throats."
proff at gnu.ai.mit.edu  |                -- Howard Aiken     






From azur at netcom.com  Sun Oct 26 17:32:12 1997
From: azur at netcom.com (Steve Schear)
Date: Mon, 27 Oct 1997 09:32:12 +0800
Subject: Click HERE for Boy Sex
In-Reply-To: <199710262243.QAA10648@wire.insync.net>
Message-ID: 



>Of course, this is an interesting legal question.  Clearly, offering
>raw Usenet content the ISP doesn't originate absolutely shields the ISP
>from responsibility for the material, under current telecommunications
>law.
>
>The unanswered legal question is whether processing the raw news feed
>in some way, such as would be needed to provide web access to decoded
>pictures, also enjoys the same protection.
>
>It would seem that automatic transcoding of Usenet, in a way which is
>not content sensitive, should not be considered the origination of new
>content.  On the other hand, the Feds are hardly going to sit still
>for a URL which, when clicked upon, fills ones browser screen with
>hundreds of thumbnails of blond pre-teen Scandinavian boys in
>mid-orgasm, with a legend which reads - "Click on thumbnail to get
>full-sized picture." And all for only $6 a month.

Despite the sometimes controversial contents of Usenet feeds it is unlikely
that the Feds will move to put the kabosh on Usenet.  Services, like
Etermity, which merely act as reference engines to simplify Usenet access
are also unlikely to be targeted.  Even services which refresh existing
Usenet feeds to provide persistence may be off-limits, especially if the
articles are encrypted, the service does not possess the key and it is the
client browsers which decrypt and handle the cleartext.

The Feds are undoubtedly honing their skills at traffic analysis for
locating posters and email correspondants of interest.  It is the
cypherpunk role to provide the means to keep the Fed nose from coming under
the privacy tent.

--Steve

PGP mail preferred, see  	http://www.pgp.com and
				http://web.mit.edu/network/pgp.html
RSA PGP Fingerprint: FE 90 1A 95 9D EA 8D 61  81 2E CC A9 A4 4A FB A9
---------------------------------------------------------------------
Steve Schear (N7ZEZ)     | Internet: azur at netcom.com
7075 West Gowan Road     | Voice: 1-702-658-2654
Suite 2148               | Fax: 1-702-658-2673
Las Vegas, NV 89129      | economic and crypto dissident
---------------------------------------------------------------------

	The push by western governments for financial transparency and
	banning unrestricted use of cryptography is blatent politicial
	tyranny.

	Free Cypherpunk Political Prisoner Jim Bell







From nobody at REPLAY.COM  Sun Oct 26 17:43:51 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Mon, 27 Oct 1997 09:43:51 +0800
Subject: NAMBLA embattled -- mirror sites?
Message-ID: <199710270130.CAA15425@basement.replay.com>



Anonymous wrote:

> I'm not sure the right to free speech includes the right to endorse guys
> fucking little boys, whether they give it a moniker like "transgenerational
> love" or not. Any sex with a minor is rape, since they can't legally give
> consent. All Hillary Klinton's "It Takes A Village" bullshit aside, I can't
> see giving NAMBLA the same kind of protection as someone like Zundel.
> 
> Ratbert

I am being in agreement with Mr. Ratbert, here.

I am seeing the writing of women in your country who write about the
showing of their bare legs and the uncovering of their faces and I
am thinking that this also should not get the protection of being
able to write about such abominations.
And making the rape with minors is also an abomination, unless you
have bought them from their families, and then it is OK that you
should write about it.
I am stoning to death just last week a man who raped a ten year old
girl without paying any dowry, and people should not write about this
either.

I would like to meet some cypherpunks girls with their faces uncovered
sometimes, but just for the evening, OK?

Mr. Ratali






From web-promotions at nevwest.com  Mon Oct 27 09:52:41 1997
From: web-promotions at nevwest.com (web-promotions at nevwest.com)
Date: Mon, 27 Oct 1997 09:52:41 -0800 (PST)
Subject: IF YOU NEED FREE HITS, I THINK WE C
Message-ID: <199710271634.LAA21460@mail0.tor.acc.ca>


Join the SexSwap Team and get MORE FREE HITS within minutes

SEXSWAP IS THE LARGEST ADULT BANNER EXCHANGE
/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
Now almost 1,000 active members ACTIVE!
We clear out all dead accounts weekly to make the system FASTER!

SEXSWAP IS THE FASTEST BANNER EXCHANGE
/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
Serving 800,000 banners a day at 10 banners a second...this ain't no 
freaking weak-ass shareware exchange....this ain't no browser-bombing, 
console based poser-exchange.

THE FASTEST BANDWIDTH MEANS YOU GET THE MOST HITS
/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
Traceroute www.sexswap.com and then traceroute any of our competition and
see which site is 7 hops coast to coast with the fastest hop times.

SEXSWAP HAS THE BEST MEMBERS WITH THE BEST BANNERS
/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
Several members are banner getting 30%+ click thrus...not 12%...not 
15%...not
20...our members know how to crank the volume up to 32.9%...join and 
learn theie secrets.

MULTIPLY YOUR SHOWINGS!
/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
Sign up for several accounts and place the code on every page of your site
and get Mega-showings...and even test multiple banners!
We host all banners, so you don't waste any precious bandwidth.

Let's face it, the adult market has over 7 banner exchanges and maybe 20
consoles...do you want to join the 6th best exchange, or do you want to 
hook up with number one?

COMPARE US TO THE COMPETITION! 
/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
Drop by and check out the professionalism of the SexSwap site vs. 
competition
Traceroute www.sexswap.com vs. the ompetition
Page refresh SexSwap vs. the competition
And here is the BIGGEST TEST of them all...email me andy at sexswap.com 
(owner),
and see how long it takes me to email you back. Most people are 
flabbergasted
that I usually write back within three hours and many members get a 
letter back
within 30 minutes! I always write back! I will upload your banner,
I will shrink your gif,
I will answer any questions that I know the answers too.

WHAT YOU WILL GAIN!
/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
You can add 2%-10% instant hits to your site without wasting any 
bandwidth.
You will become a member of the best banner exchange: SexSwap
You will receive our secret newsletter bi-weekly that is full of 
newsgroup,
search engine, bulk email and other spam tricks to help you get more hits!

We want you on the SexSwap Team.

Click here to VISIT the SexSwap site
http://www.sexswap.com

Click here to JOIN the SexSwap
http://www.sexswap.com/join.htm

Click here to see the TOP100 King-Pins
http://www.sexswap.com/top100.htm






From david at sternlight.com  Sun Oct 26 18:16:08 1997
From: david at sternlight.com (David Sternlight)
Date: Mon, 27 Oct 1997 10:16:08 +0800
Subject: Orthogonality and Disaster Recovery
In-Reply-To: <199710261832.NAA03035@users.invweb.net>
Message-ID: <3453F663.C886F1DE@sternlight.com>



William H. Geiger III wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> In <34537A18.9FE77210 at sternlight.com>, on 10/26/97
>    at 09:13 AM, David Sternlight  said:
> 
> >This seems to be a defense of a major failing of PGP. Rather than being a
> >complete package for a user function (encrypting and signing mail, for
> >example) it is a pre- and post-processor which requires a separate mailer
> >and newsreader. In fact this whole argument may be viewed as an attempt
> >to defend that failing of PGP. The failing is understandable since Phil
> >wanted to get something out there quickly and hadn't (and probably still
> >doesn't have) the resources and talents available to do a complete PGP
> >mailer/newsreader--much less be able to compete successfully with those
> >who DO do such mailers and newsreaders.
> 
> This is quite silly argument David,

Not at all. See below. You give yourself away by starting out this way.

> 
> Do all E-Mail vendors need to be cryptologist?? 

If the client's e-mail is to be secure, yes. But let's be accurate here. Phil
is not, nor has he ever been a cryptologist. He's a programmer who learned a
few things about crypto algorithms and copied existing work. His unique
contribution, if there was a technical one, was in key management. I haven't
studied enough cryptology to know if "web of trust" was copied too.

> Do all cryptologist need
> to be application vendors?? Obviously not.

Now that IS nonsensical because cryptology is a wide and deep art only a small
part of which has to do with mail applications themselves. In contrast, mail
applications to be secure must use encryption. There's some very muddy
thinking going on in your post.

> PGP is a tool much like a
> database is. The majority of vendors who develop apps that require a
> database do not go out and write their own, rather they use a database
> engine that is suited to their needs. 

Except for the occasional password protection, databases don't need encryption
to the extent e-mail does.

>Betreve doesn't try to develop every
> application that may use a database, instead they sell the database engine
> and let the application developers make the apps. The same is true for
> E-Mail vendors, they integrate PGP into their products. No need for PGP
> Inc, to develop their own E-Mail product.

You miss the point here. And you miss the many worked examples. RSA is selling
lots and lots of toolkits for lots and lots of money for in-line integration
into applications, not for pre- and post-processing. The former is the way to
go; the latter a kludge until something better comes along.

> 
> FWIW: I am quite confedent that if Phil wished to write an
> E-Mail/NewsReader he is quite capable of producing a better product than
> the peice of crap N$ has on the market.

You are losing it. First of all I doubt very much that Phil could do this. If
you look at the development time and staffing for good e-mail applications,
this is simply beyond his capabilites and he's never claimed otherwise. Second
of all, it's clear that you've not checked out the current Communicator mail
module if you call it a "piece of crap". You simply don't know what you're
talking about. Same for Internet Explorer, whose mail module has gotten rave
reviews and the best mail program yet and caused reviewers to switch from
Eudora. It, too has integrated crypto.

David






From ravage at ssz.com  Sun Oct 26 18:38:49 1997
From: ravage at ssz.com (Jim Choate)
Date: Mon, 27 Oct 1997 10:38:49 +0800
Subject: Orthogonality and Disaster Recovery (fwd)
Message-ID: <199710270228.UAA02091@einstein.ssz.com>



Forwarded message:

> Date: Sun, 26 Oct 1997 18:03:16 -0800
> From: David Sternlight 
> Subject: Re: Orthogonality and Disaster Recovery

> > Do all E-Mail vendors need to be cryptologist?? 
> 
> If the client's e-mail is to be secure, yes. But let's be accurate here.

I absolute agree we need to be accurate. To that end, it is not the
applications that need security but rather the network and session layers.

> > Do all cryptologist need
> > to be application vendors?? Obviously not.
> 
> Now that IS nonsensical because cryptology is a wide and deep art only a small
> part of which has to do with mail applications themselves. In contrast, mail
> applications to be secure must use encryption. There's some very muddy
> thinking going on in your post.

He said 'application vendors', not just mail. Pay attention to the details
of the argument and quit trying to change the subject without specificaly
noteing the change, otherwise known as a strawman. His muddy thinking
doesn't stand alone.

> > PGP is a tool much like a
> > database is. The majority of vendors who develop apps that require a
> > database do not go out and write their own, rather they use a database
> > engine that is suited to their needs. 
> 
> Except for the occasional password protection, databases don't need encryption
> to the extent e-mail does.

I work everyday with the NSA, CIA, Dod, Army, SAIC, all the phone companies,
many of the major banks, Intel, Human Genome Project, etc. Every one of these
folks would disagree with you. In fact it was one of the motivating factors
behind Tivoli comming out with their new Security Management application
because vendors required us to move away from our custom databases and
toward industry standards (Oracle, Sybase, Informix, DB2, DBMX, etc.) *AND*
at the same time requiring a better security mechanism than the existing one
we use (DES & Kerberos based).

The reality of the market does not support your thesis.

> You miss the point here. And you miss the many worked examples. RSA is selling
> lots and lots of toolkits for lots and lots of money for in-line integration
> into applications, not for pre- and post-processing. The former is the way to
> go; the latter a kludge until something better comes along.

Are they involved with the new Cryptographic Standard projects of the
government and Tivoli - IBM? I don't think so, at least I still haven't seen
them involved in any of the work I have had access to so far; much to my own
personal disappointment.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|







From kent at bywater.songbird.com  Sun Oct 26 19:22:25 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Mon, 27 Oct 1997 11:22:25 +0800
Subject: Orthogonal (fwd)
In-Reply-To: <199710270042.SAA01737@einstein.ssz.com>
Message-ID: <19971026191312.56933@bywater.songbird.com>



On Sun, Oct 26, 1997 at 06:42:14PM -0600, Jim Choate wrote:
> > I do believe the use of the term this way was inspired by the 
> > notion of a 'basis' in a vector space -- a set of orthogonal
> > vectors that span the space, ideally, unit vectors.
> 
> Can you better define the term 'basis'?

This is basic linear algebra:

V a vector space -- the set of all (s1,s2,s3,...,sn), where si is an
element of the set of reals.  A set of vectors {v1,v2,...,vm} in V is
linearly independent if there is no set of scalars {c1,c2,...,cm} with
at least one non-zero element such that sum(ci*vi) == 0.  A set of
vectors S spans a vector space V iff every element of V can be expressed
as a linear combination of the elements of S.   Finally, a basis for 
V is a linearly independent set of vectors in V that spans V.  A 
space is finite dimensioned if it has a finite set for a basis.  The 
standard basis (or natural basis) for a vector space of dimension n 
is th set of vectors

(1,0,0,...0)
(0,1,0,...0)
(0,0,1,...0)






From SHOP at netsteward.cm  Sun Oct 26 19:58:23 1997
From: SHOP at netsteward.cm (SHOP at netsteward.cm)
Date: Mon, 27 Oct 1997 11:58:23 +0800
Subject: Webdeals! Less than wolesale
Message-ID: <1334218758-2910385@mail.clarityconnect.com>



 Deal of the day.
 A chance to save money........a penny saved
 is a penny earned:--Ben Franklin__1706-1790.
 Various products below wholesale featured daily,
 straight UPS shipping YOU calculate, NO HANDLING charges.
 Something for everyone at:
  http://netsteward.com/webdeals.htm
 Thank you for your time, please have a pleasant day.
 
  One time email.






From ravage at ssz.com  Sun Oct 26 21:41:21 1997
From: ravage at ssz.com (Jim Choate)
Date: Mon, 27 Oct 1997 13:41:21 +0800
Subject: Orthogonal (fwd)
Message-ID: <199710270528.XAA02347@einstein.ssz.com>



Forwarded message:

> Date: Sun, 26 Oct 1997 19:13:12 -0800
> From: Kent Crispin 
> Subject: Re: Orthogonal (fwd)

> > > I do believe the use of the term this way was inspired by the 
> > > notion of a 'basis' in a vector space -- a set of orthogonal
> > > vectors that span the space, ideally, unit vectors.
> > 
> > Can you better define the term 'basis'?
> 
> This is basic linear algebra:
> 
> V a vector space -- the set of all (s1,s2,s3,...,sn), where si is an
> element of the set of reals.

Actualy si (scalars) can be rational, real, or complex. It is also possible 
to use more general structures such as fields. [1]

Note that complex numbers numbers may be used, in other words a vector can
be used to multiply another vector.

> A set of vectors {v1,v2,...,vm} in V is

A vector of vectors, and you haven't even really defined vector yet...:(

> linearly independent if there is no set of scalars {c1,c2,...,cm} with
> at least one non-zero element such that sum(ci*vi) == 0

Are you saying:

(c1*v1)+(c2*v2)+...+(cn*vn) <> 0

where at least one ci is <>0, is some sort of test for membership in a vector
space? What about,

(1/c1*v1)+(-1/c2*v2)+(0*v3)...+(0*vn) = 0,
     1         -1

if so it should be clear that except for the case of c=0 there is always a
way to take two, which is clearly more than one, of the scalars and cause
the sum to be zero. Now if you have a single non-zero scalar multiplier then
it seems reasonable that you can create such a structure that is always <>0.

> A set of
> vectors S spans

In other words 'are expressible in'?

> a vector space V iff every element of V can be expressed
> as a linear combination of the elements of S.
              ^^^^^^^^^^^
              Need to better define this one.

The operations that are applicable to a vector space are: [1]

1.  Associative law of addition: (x+y)+z = x+(y+z)
2.  Commutative law of addition: x+y=y+x
3.  Existance of zero: x+0=x for all x in V
4.  Existance of inverses: x+(-x)=0
5.  Associative law of multiplication: a(bx)=(ab)x
6.  Unital law: 1*x=x
7.  First distributive law: a(x+y)=(a*x)+(a*y)
8.  Second distributive law: (a+b)*x=(a*x)+(b*x)

where x is of the form 'asubn(x^n)+bsubn-1(x^n-1)+...+asub1x+asub0'

This is a remarkably circular definition to present. In clearer wording;

The set of vectors S is expressible in a vector space V iff S is contained in 
V.

While this may be a requirement or test for membership in a vector space (as
used below) it doesn't qualify as a definition.

> Finally, a basis for 
> V is a linearly independent set of vectors in V that spans V.  A 
> space is finite dimensioned if it has a finite set for a basis.  The 
                                                 ^^^
                                                 set of what?

> standard basis (or natural basis) for a vector space of dimension n 
> is th set of vectors
> 
> (1,0,0,...0)
> (0,1,0,...0)
> (0,0,1,...0)

In other words, any 'vector' can be expressed as the sum of the
multiplication of unit elements by some set of scalars.

Is this definition something you just wrote or would you be so kind as to
give the reference if it isn't.

This definition uses 'basis', doesn't define it. You can't use a term to
define the term, it's called circular reasoning. My question still stands,
can you please better define 'basis'. Or is your claim that basis is simply
a way of stating 'elements of unit magnitude'?

Furthermore, a definition of vector space has nothing to do with orthogonal
measurement systems, it does have to do with polynomials. It just so
happens that this sort of geometry shares the same sort of rules, that
doesn't make them the same thing. There is nothing in your description, in
particular the nifty little (*,*,*,...*)'s that implies any sort of
measurement system based on line-segment axis that are 90 degrees apart,
merely that there is more than one variable (ie x,y,z,...a) involved. 

Vector space -  a vector space is a set of objects or elements that can be
                added together and multiplied by numbers (the result being
                an element of the set), in such a way that the usual rules
                of calculations hold. [1]


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|


[1]  The VNR Concise Encyclopedia of Mathematics
     Gellert, Kustner, Hellwich, Kastner
     ISBN 0-442-22646-2
     17.3 Vector spaces
     pp. 362


[Hallowen Trivia]

   'Dracula' is a word derived from 'dracul' meaning dragon and was given
   to Vlad Tepish, whose name means 'son of the devil', he was further known
   as Vlad the Impaler because he would impale people on poles and place them
   along the roads in Transylvania. When he died in 1496 his head was
   impaled on a stick as well.






From ichudov at Algebra.COM  Sun Oct 26 21:51:25 1997
From: ichudov at Algebra.COM (Igor Chudov @ home)
Date: Mon, 27 Oct 1997 13:51:25 +0800
Subject: poverty traps (Re: Sa (fwd)
In-Reply-To: <199710260243.VAA31587@einstein.ssz.com>
Message-ID: <199710270540.FAA06551@manifold.algebra.com>



Jim Choate wrote:
> > Food: $600/month (generous)
> 
> Hell, I'm single and come close to this and food costs in Texas are a LOT
> lower than in New York. Though I do eat out at lunch every weekday. And no,
> I don't go partying regularly at all. Way too busy with work (>16hrs/day
> 5 days a week & 16-20 on weekends) to do that other than a couple of times a
> month. I went to the store today and bought enough food for 4 days and it
> cost me $30. So that comes to something like $250 - $300 for me not counting
> lunches, and that's for just a single person. Multiply that for 6 and the
> numbers are considerably higher.

Oh my Gawd! And I thought I was spending too much on food! I guess the
prices in OK are the same as in TX.

	- Igor.






From ravage at ssz.com  Sun Oct 26 22:00:06 1997
From: ravage at ssz.com (Jim Choate)
Date: Mon, 27 Oct 1997 14:00:06 +0800
Subject: poverty traps (Re: Sa (fwd)
Message-ID: <199710270548.XAA02492@einstein.ssz.com>



Forwarded message:

> Subject: Re: poverty traps (Re: Sa (fwd)
> Date: Sun, 26 Oct 1997 23:40:15 -0600 (CST)
> From: ichudov at algebra.com (Igor Chudov @ home)

> Jim Choate wrote:
> > > Food: $600/month (generous)
> > 
> > Hell, I'm single and come close to this and food costs in Texas are a LOT
> > lower than in New York. Though I do eat out at lunch every weekday. And no,
> > I don't go partying regularly at all. Way too busy with work (>16hrs/day
> > 5 days a week & 16-20 on weekends) to do that other than a couple of times a
> > month. I went to the store today and bought enough food for 4 days and it
> > cost me $30. So that comes to something like $250 - $300 for me not counting
> > lunches, and that's for just a single person. Multiply that for 6 and the
> > numbers are considerably higher.
> 
> Oh my Gawd! And I thought I was spending too much on food! I guess the
> prices in OK are the same as in TX.

>From the times I have been in Oklahoma (my family is ensconced along the Red
River - Murphies, Joneses, Peoples, etc.) I would say the costs are about
the same.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From wendigo at ne-wendigo.jabberwock.org  Sun Oct 26 22:44:52 1997
From: wendigo at ne-wendigo.jabberwock.org (Mark Rogaski)
Date: Mon, 27 Oct 1997 14:44:52 +0800
Subject: Orthogonal (fwd)
In-Reply-To: <199710270042.SAA01737@einstein.ssz.com>
Message-ID: <199710270636.BAA11525@deathstar.jabberwock.org>



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

An entity claiming to be Jim Choate wrote:

: I can see the union 'build complicated things out of basic building blocks'
: and the use of Occam's Razor (I'm as lazy as any other programmer) but fail
: to see how this maps to anything relating to the concept of orthogonal.
: Which clearly doesn't have any inherent minimalist cast.
: 

Minimalism is merely a by-product of orthogonality.  A language is considered
orthogonal if builtin functions do not provide overlapping functionality.
So the term orthogonal probably refers to the fact that there is no
point of intersection in the functionality of the language (or system, as
the thread started out).

And I will not argue about vector spaces until I get bookshelves and actually
dig my Linear Algebra texts out of the boxes around my apartment.

Mark

- -- 
[] Mark Rogaski                   "That which does not kill me
[] wendigo at pobox.com                 only makes me stranger."

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNFQ2VcHFI4kt/DQOEQJthACfRixtwgdtb1+IYITBX39GewBXi58AoN4k
J7kuqRvU6PMP4//S/WzfVYWy
=HZWg
-----END PGP SIGNATURE-----






From shamrock at cypherpunks.to  Sun Oct 26 22:57:17 1997
From: shamrock at cypherpunks.to (Lucky Green)
Date: Mon, 27 Oct 1997 14:57:17 +0800
Subject: PGP Employee on MKR
In-Reply-To: <877686661.25414.193.133.230.33@unicorn.com>
Message-ID: 



On Fri, 24 Oct 1997 mark at unicorn.com wrote:

> 
> If you can explain the following, then I'll accept that my fears are merely
> fantasies:

OK, I must be missing something. How can it be more evil if the email
isn't automatically sent to the owner of the MK key than if the email is
automatically cd'ed?

 > 
> 1. How PGP can prevent CMR being converted into GMR; their system builds
>    all the code required to support mandatory encryption to FBI and NSA
>    keys into every copy of PGP.

Agreed. And so did PGP 2.x and any version of PGP that allows for
encryption to multiple keys. Anybody can take the 2.6 source and hardcode
in a second recipient key.

The answer is that no PK crypto system can prevent being converted for GAK
use.


 > 2. Why PGP prefer this option to almost identical systems which do
not >    allow GMR. They don't even seem to be interested in discussing
>    alternatives.

I read the recently  proposed alternatives
and fail to see how they would prevent GMR any more than PGP's solution.
All I saw were convoluted and frequently hasty designs, many of which
lend themselves even more to GAK then what PGP did.

> Frankly, this issue seems to be the most important since Clipper, and I'm
> amazed that so many cypherpunks are so dazzled by PGP's name that they
> refuse to sit and think these issues through. 

Once, (as many of you know IMHO it is a "once", not an "if")  GAK becomes
mandatory, it can be implemented with 2.6 just a easy as
with 5.5. And it isn't PGP for Business  that will cause this to occur. It
will be some guy with a laptop who downloaded the DNA sequence for a nasty
bug to feed it  into his sequencer. Or some other act of terrorism. Heck,
perhaps a print out of old list traffic might suffice. :-)


-- Lucky Green  PGP encrypted email preferred.
   "Tonga? Where the hell is Tonga? They have Cypherpunks there?"






From nobody at REPLAY.COM  Sun Oct 26 23:01:27 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Mon, 27 Oct 1997 15:01:27 +0800
Subject: cryptographic anecdotes
In-Reply-To: <19971027010829.851.qmail@iq.org>
Message-ID: <199710270529.GAA08435@basement.replay.com>



http://dcs.ex.ac.uk/~aba/rsa/tattoo.html

At 01:08 AM 10/27/97 -0000, you wrote:
>
>I'm involved in producing a segment on cryptograpic issues for Radio
>National (ABC) to be aired latter this week. I have no problems with
>the technical issues but could use some (reliable) "colour" i.e small
>quirky or unusual anecdotes that will draw in and hold the larger
>order of listeners who don't otherwise have any cryptography/
>cryptographic-policy background.
>
>	e.g	o RSA export-a-crypto-system .sig
>		o algorithm tatoos (couldn't find any confirmation of
>		  this :()
>		o if cryptography is arms, then US constitution
>		  right to bear arms
>		o programming languages embody freedom of speech
>		  (patel)
>		o (otoh) machine-understandable languages are not protected
>		  speech: as soon as a computer can understand Ulysses
>		  it's no-longer protected. (I'm not sure about Ulysses
>		  but Oracle and the computational linguistics groups
>		  at Edinburgh and MIT have code to perform summaries
>		  of the King James bible).
>


http://dcs.ex.ac.uk/~aba/rsa/tattoo.html 

I was so inspired by this guy that I had the source to sendmail tattooed on
my back and the source to emacs tattooed on my left thigh. I then figured
out I missed the point, this was supposed to be a political statement, so I
had the entire contents of the nambla web site tattooed on my left forearm.
Dont worry about mirroring it, if anyone wants to know whats on the namble
site they can visit me in jail where I am currently getting a crash course
in man-boy love.


 	







From shamrock at cypherpunks.to  Sun Oct 26 23:26:23 1997
From: shamrock at cypherpunks.to (Lucky Green)
Date: Mon, 27 Oct 1997 15:26:23 +0800
Subject: PGP, Inc.--What were they thinking?
In-Reply-To: <199710241342.OAA01491@server.test.net>
Message-ID: 



On Fri, 24 Oct 1997, Adam Back wrote:
> 
> If this is the case, I reckon it's still better to just escrow their
> comms keys locally.  Put them all in the company safe, whatever.  To
> go with this kind of a company with this kind of policy, I would
> presume that sending or receiving super-encrypted messages would would
> be a sackable offense.

Adam,
How does your system prevent the employer  from fabricating forged
signatures in a PK system that uses the same key for signing and
decrypting? And if you don't use such a system, then how do you deal with
future versions of the software that will allow the user to swap DH keys
from underneath the ElGamal keys?

Thanks,

-- Lucky Green  PGP encrypted email preferred.
   "Tonga? Where the hell is Tonga? They have Cypherpunks there?"






From mbp at pharos.com.au  Mon Oct 27 00:00:48 1997
From: mbp at pharos.com.au (Martin Pool)
Date: Mon, 27 Oct 1997 16:00:48 +0800
Subject: cryptographic anecdotes -- GPS and
In-Reply-To: <19971027010829.851.qmail@iq.org>
Message-ID: 



On 27 Oct 1997, Julian Assange wrote:

> I'm involved in producing a segment on cryptograpic issues for Radio
> National (ABC) to be aired latter this week. I have no problems with
> the technical issues but could use some (reliable) "colour" i.e small
> quirky or unusual anecdotes that will draw in and hold the larger
> order of listeners who don't otherwise have any cryptography/
> cryptographic-policy background.

Do you know the timeslot yet?

"Java Network Services" (I forget the exact title) from Prentice Hall has
a case study about interfacing Java to GPS hardware.  The introduction to
the chapter provides some very interesting information about GPS which,
like crypto, is a "dual use technology".  It's not exactly the same, of
course -- GPS is about people getting information that the state would
like to keep secret, not vice versa -- but it's still interesting.
("Location escrow" is a nice phrase.)

If the book is correct, then the system was originally designed to
introduce errors into the part of the time signal decypherable by civilian
users that would produce positional uncertainty of about 100m.  The
complete signal, available (in theory) only to US or US-sponsored forces,
allowed positions to be calculated to within an accuracy of about 1m.

However, hackers being what they are ;-), somebody realized that since the
same errors were observed by all receivers, one could compensate for them
to some extent.  

Specifically, one has a base station somewhere whose location you know
very accurately by other means.  This station continuously subtracts it's
known position from the position calculated by it's civilian GPS hardware,
and broadcasts the difference over the pager network or some other public
medium.  (The math is not quite that simple, I imagine, but conceptually
that's what you do.)  Combining this information with the satellite signals
allows civilian GPS hardware to improve it's accuracy by an order of
magnitude to about 10m of uncertainty, which could make all the difference
in, say, a search-and-rescue situation.  This technique is called,
obviously enough, "differential GPS". 

Even more interesting is that the DOT is apparently negotiating with the
DOD to make full GPS publicly available, presumably because it would sell
more cars.  (Just what the world needs...)  Quite possibly there will be
export restrictions, of course.  The similarities to commerce vs TLA
concerns in encryption are obvious.  I don't know the outcome of the
negotiations, but I got the impression it was more likely than not. 

The book was not immensely technical, so some (or all) details may be
wrong.

Assuming you're talking about Australian RN, then comparisons to the
recent gun buy-back scheme might be interesting, on the topic of
balance-of-power between the people and the state.  (Hmm, wish I could
post "Blue Murder", a documovie about NSW police corruption in the 80s to
the list.) 

--
Martin Pool






From ualdv8 at sk.sympatico.ca  Mon Oct 27 00:04:15 1997
From: ualdv8 at sk.sympatico.ca (Six)
Date: Mon, 27 Oct 1997 16:04:15 +0800
Subject: I Broke PGP!!!
In-Reply-To: <345316D6.2F73@pgp.com>
Message-ID: <34543357.2971@sk.sympatico.ca>



Jon Callas, on behalf of the Electronic Forgery Foundation, wrote:
> 
> Sorry...

ROTFLMAO!
(Don't worry, Jon, I think it can be fixed.)

Philip R. Zimmermann, on behalf of the Electronic Forgery Foundation
and the Circle of Eunuchs, wrote:
>----------------------------------------------------------------------
>                           InfoWar Table of Contents
>    * Epilogue
>    * I Broke PGP!
>----------------------------------------------------------------------
>                                 I Broke PGP!
>                                    by RTFM
...
>                                Vulnerabilities
>                                ===============

I have known TruthMonger #1's nephew for a number of years, and have
played no small hand in teaching him to intercept his uncle's email
and add his own small touches to the messages contained therein. So
it came as no surprise to me to see a message which contained a
prophecy of a chapter of 'InfoWar' titled, "I Broke PGP!" and a
ludicrous claim that the 'writer' would kiss everyone's dirty,
hairy, ass if he could not back up that claim.
To tell the truth, I thought that Human Gus-Peter had finally used 
his uncle's mouth to write a check his uncle's ass couldn't cash.

After reading 'InfoWar Epilogue 7' I thought that #1 had indeed 
cashed the promised check, but had perhaps done so in the manner of
a 'trickster'. However, after reading Jon Callas' 'apology' for
'breaking' PGP, I realized that TruthMonger had perhaps made a more
succinct statement regarding the recent developments in PGP/CMR
than many of the more lengthy missives recently written and/or
ranted on the Cypherpunks mailing list.
~~~~~~~~~~
Disclaimer: I am writing this on Toto's laptop, under the influence
~~~~~~~~~~ of half a bottle of his finest Scotch.

In short, I have come to the conclusion (_remembered_ would be a
more appropriate word, actually) that it is not up to Philip R.
Zimmermann or Jon Callas to protect and defend my privacy.
It is up to _me_ to protect and defend my privacy. Always has 
been, always will be.

It has long been a tradition for CofE members who have not seen
each other for a long time to get together for a drink and read
PRZ's PGP documentation, once again, before continuing on to 
discuss our current adventures in the time-space continuum.
If you will sit and read it, now, I believe you will perhaps
'remember' that PRZ has never, from the beginning, pretended to
have written anything other than a program which will give you
and I 'Pretty Good Privacy'.

The cold, hard fact of the matter is, no matter how grand or secure
the design of PGP, or any other security product, there are going
to be a mountain of users, from the secretary to the head of system
security, who are going to write their triple-secret password on
a piece of tape on the underside of their keyboard.
Although it is important to discuss (even to rant and rave over)
the issues surrounding the design, development and implementation
of products such as PGP, there is something, in the end, that is
even more important to discuss than the security or lack thereof
of encryption systems and products: Vulnerability.

Bonus Question: "Who is TruthMonger #1?"
Bonus Answer: "He's Randall Farmer's best friend."

Love,
 Tokyo Rose
 ~~~~~~~~~~
"Loose lips...pink slips."
~~~~~~~~~~~~~~~~~~~~~~~~~~
Re: PRZ Announcement
Randall Farmer (rfarmer at HiWAAY.net)
Fri, 24 Oct 1997 16:37:28 -0500 (CDT) 

 Damn, that's annyoing. I don't have a PGP key, and never sign my
messages. Note
that my real message trailer has a line of dashes before it. I'm putting
something confirming that the other message was a forgery (and
confirming that
I don't have a PGP key) on my web page -- http://hiwaay.net/~rfarmer
(even the
forger agrees that's my page). 

I'll also (possibly) create a key and post the real fingerprint/ID on my
page
if this becomes a problem. (Actually, probably not...can only run 2.6.2)

Note that the keyserver probably has this as my key...I'll use a
different name
for my real key.

Some lame forger pretended Randall Farmer wrote:

> Some lame forger pretended Randall Farmer wrote:
> 
> > On Thu, 23 Oct 1997, there's no way in nine hells that Phillip R. Zimmermann
> > could have wrote:
> > ...
> > > However, I have reassessed my views of who truly has a right
> > > to control access to privacy and have come to the conclusion
> > > that privacy is too important an issue to be left in the hands
> > > of the individual, with the obvious potential for misuse.
> > 
> > Hmm...I haven't checked any signatures or headers yet, but something tells me
> > that this ain't PRZ. For example, the Organization: header refers to Orwell's
> > 1984 as a "blueprint"...forget the signatures (just got a message saying they
> > match -- either that person's lying, "they" cracked his key, or it's some
> > detail that has the program using a different key/ignoring some text), it is
> > psychologically impossible for someone to go from privacy advocate to
> > 1984-as-a-blueprint that quick.
> > 
> > ---------------------------------------------------------------------------
> 
> The above is a lame forgery by some troublemaker, and only 
> serves to underscore PRZ's new position, namely, that access
> to privacy should be supervised by people who have shown that
> they have the maturity to act responsibly, as evidenced by
> their success in a corporate atmosphere.
> 
> I am PGP signing this post so that there can be no doubt as
> to its source and authenticity.
> Cypherpunks list subscribers should be more careful about
> checking signatures before believing everything they read.
> 
> Randall Farmer
> rfarmer at hiwaay.net
> http://hiwaay.net/~rfarmer
> 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP for Personal Privacy 5.0
> Charset: noconv
> 
> iQA/AwUBNFAK/BpRm26Z4YsSEQIA0wCeJZ7R9w/XfDuE0HMo+eP/0ihYOykAoNef
> Gt1hIbRHpYtJ1jp/79hWZl0G
> =E9PX
> -----END PGP SIGNATURE-----
> 
> 

---------------------------------------------------------------------------
Randall Farmer
rfarmer at hiwaay.net
http://hiwaay.net/~rfarmer






From nobody at bureau42.ml.org  Mon Oct 27 00:18:53 1997
From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer)
Date: Mon, 27 Oct 1997 16:18:53 +0800
Subject: Mmphmmphmmmph! (WAS Re: I Broke PGP!!!)
Message-ID: 



That was the sound of me eating crow.
Although I am a closet reader of the True Story of the Internet series
I am generally perturbed by the many of the inane Truthmonger posts to
the list. I had decided several days ago to make a small apology to
Truthmonger for some of my more emotional attacks on him (or her) but
I put it off and put it off. I decided not to put it off after reading
the following:
Six wrote:
> Bonus Question: "Who is TruthMonger #1?"
> Bonus Answer: "He's Randall Farmer's best friend."

That is _exactly_ what I thought when I read Randalls whining post
about how Truthmongers rudeness might necessitate Randall instituting
security and identity procedures that would enable others to verify
whether a digitally signed message was indeed from himself. When I saw
Tokoyo Rose echoing my thoughts then I thought I should take the trouble
to point out what I myself learned from Truthmonger. [Although I am not
certain if it is the same one.]
I made the mistake of informing several people that the exercise that
was suggested in Epiloge 5? of Infowar was bullshit but when I tried
it it spit out my secret key like a hot damn much to my surprise.
So I owe Truthmonger an apology but it will not be a public one.
[Very few of you would know me anyway since I am mostly a list lurker.]
The reason I will not make a public apology is because I also had
PGP spit out the secret keys of my boss and coworkers. Although I am
not a bad person in general possession of these keys is making me
begin to think like Truthmonger. I will probably just test whether
I can indeed password break them and use them to decipher a few
files and then erase my copy of them. [Maybe.]
[Maybe I should make my .sig line "Beware of Truthmonger inside!"]

I did a search for the post that Tokoyo Rose talked about Truthmongers
nephew adding things to Truthmongers email and found:
>   Also, as a 'teaser', I would like to announce to one and all that
> the quickly closing saga of 'InfoWar' will include an epilogue
> chapter titled, "I Broke PGP," written by myself.
>   Believe it or not, I speak the truth, although not in a way that
> it direct and obvious.
>  If you think I am bullshiting, then stop washing your asshole,
> starting today, because if you can show me I am wrong, I will kiss
> your ugly, hairy ass.
>
> Love and Kisses,
> TruthMangler

After looking at other posts that have Truthmangler in them instead
of Truthmonger I think that it might be a sign that the nephew is
messing with them since they seem to have things inserted in them
which appear to come more from a childs mind than Truthmongers.
[If that is possible.] (;>)
I would be interested in finding out if other people have been able 
to get secret keys using the method described in the Infowar book.
We are using PGP 2.6.3i. I wonder about other versions.

Croweatingmonger






From tjunker at mail.phoenix.net  Mon Oct 27 00:39:17 1997
From: tjunker at mail.phoenix.net (Thomas Junker)
Date: Mon, 27 Oct 1997 16:39:17 +0800
Subject: Technical Description of PGP 5.5
In-Reply-To: <199710241425.PAA01534@server.test.net>
Message-ID: <199710270843.CAA26524@raid2.fddi.phoenix.net>



On 25 Oct 97 at 11:03, Lucky Green wrote:

> At 03:25 PM 10/24/97 +0100, Adam Back wrote:
> 
> >If the pgp5.5 functionality is designed to provide companies with a
> >disaster recovery procedure (forgotten passphrase, or dead employee),
> >there are much better ways to do it.  We're not arguing against the
> >user requirement, just against the methodology.
> 
> There have been numerous proposals on the list to accomplish the above
> goals in a way other than the method employed by PGP. I have read the
> proposals and I am not convinced that said proposals are less intrusive.
> IMO the vast majority of the proposals I saw are more intrusive.

How about *no* recovery, eh?  Is that not less intrusive?

Recovery of messages in transit is a complete red herring.  Such
messages are not recoverable now except by means that are complete
no-brainers ("Joe, I never got your reply to my request for
blah-blah, did you send it?  If so, please resend.")  Isn't the mere
fact that such messages might be encrypted both incidental and
inconsequential?  Add to that the *fact* that Internet email is
nowhere as unreliable as so many seem to suggest.  The only losses
of email that I've ever seen were attributable to user error or ISP
outage, not to failure of delivery attributable to the network. I've 
maintained threads of back and forth email exceeding 600 message 
cycles without the thread being broken by failure of a message to 
arrive at its intended destination.

Recovery of messages in transit is entirely a snooping issue, 
methinks.

Recovery of stored messages and files also seems to me to be a
solution to a largely imaginary problem.  As I wrote before, there
are more ways and more likely ways to lose data than through keeping
encrypted files.  People live with it.  If they wish to address it,
either individually or institutionally, they can do so without
special features in PGP.  A feature in mail clients to store the 
decrypted message in place of the original would do more to avoid 
loss of stored encrypted messages than anything else I've seen 
proposed.

This reminds me a lot of the objections of a few to sending EDI 
traffic over the Internet.  When I proposed this in recent years I 
got a wail from some people over the loss of third-party time 
stamping and message delivery verification that can occur in the 
simpler scenarios of bypassing the cash-cow Value Added Networks.  
But, um, didn't everyone print those documents on *paper* and drop 
them into USPS *mail boxes* just a few short years ago?  What 
reliable third party time stamping and message delivery verification 
did they have then?  Am I mistaken or didn't the entire economy 
function on the basis of snail-mailed invoices and other documents? 
How on earth did people manage under those primitive circumstances?

How on earth can people manage email and disk files without the 
ability to "recover" data that can be lost in a thousand other ways 
that no encryption package can protect against.  Geez.  Let's get 
real here.

Regards,

Thomas Junker
tjunker at phoenix.net






From hgp at dev.null  Mon Oct 27 01:25:09 1997
From: hgp at dev.null (Human Gus-Peter)
Date: Mon, 27 Oct 1997 17:25:09 +0800
Subject: Mmphmmphmmmph! (WAS Re: I Broke PGP!!!)
In-Reply-To: 
Message-ID: <345450B4.6957@dev.null>



bureau42 Anonymous Remailer wrote:
> > Bonus Question: "Who is TruthMonger #1?"
> > Bonus Answer: "He's Randall Farmer's best friend."

  No he isn't. I am!

> Public Key Server -- Index ``randall farmer''
>
> Type bits/keyID    Date       User ID
> pub   512/99E18B12 1997/10/24 *** KEY REVOKED ***
>                               Randall Farmer 
 
{Him and Bianca are ! so I am using his 
 computer.}

I am going to see if I can un-revoke the key, too. But if I can,
then I will re-revoke it. 
{I just want to see if I can do it.}

> After looking at other posts that have Truthmangler in them instead
> of Truthmonger I think that it might be a sign that the nephew is
> messing with them since they seem to have things inserted in them
> which appear to come more from a childs mind than Truthmongers.
> [If that is possible.] (;>)

  Nope. You're wrong!

TruthMangler (hee, hee...)
~~~~~~~~~~~~
p.s. - I know who you are, too, Mr. Anonymous person who works for
my uncle's internet provider. Am I right?






From aba at dcs.ex.ac.uk  Mon Oct 27 02:17:01 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Mon, 27 Oct 1997 18:17:01 +0800
Subject: Orthogonality and Disaster Recovery
In-Reply-To: 
Message-ID: <199710271108.LAA01020@server.test.net>




Tim wrote at length about the usefulness of cleanly separating
functionality.

As this applies to pgp5.x, one could apply this idea in the following
way:

- remove pgp file encryption functionality from pgp5.x

- store decrypted emails in the clear in mail folders

- develop PGPdisk for more platforms, and/or market a separate file
  encryption program which only uses symmetric keys.  Integrate
  recovery into that if required, or let the users figure out to copy
  the symmetric storage only "key ring" onto floppies and place in
  fire proof safe themselves.


Problems with this are:

- pgp5.0, pgp5.5 already have this file encryption function built in
  (they might not want to take it out)

- several people are arguing for the need for the company to be able
  to read queued emails encrypted to a company use key when recipient
  is away on holiday, or leaves company, etc.

- some people argue for functionality of having email archives encrypted


Once you start trying to tackle those problems, things get unavoidably
complicated as you attempt to balance the criteria of resistance to
political abuse, resistance to privacy invasion, security, ergonomics,
and meeting user requirements.

I think it's useful to attempt to design systems which balance those
criteria, even though anything which automates any aspect of third
party access to data is inherently dangerous and more prone to
government abuse.

Kent Crispin said sometime ago that cypherpunks (he addressed the
comment to the list readership) should have a go at designing
commercial data recovery protocols.

Even pgp2.x is not that resistant to government abuse as an email
transport.  Governments can demand copies of private keys, governments
can request to be 2nd crypto recipients.  Some governments sooner or
later may even try that with pgp2.x itself.

So I think it is interesting to encourage use of perfect forward
secrecy, at the transport layer, and opportunistically in the pgp
encryption layer.

It is perhaps dangerous, but if people are doing it anyway, it is
useful to examine politically government resistant company storage
recovery, and integration of this into pgp implementations, and
standards even.  Not something cypherpunks would normally consider,
I'm sure, but the functionality of the deployed base is all important,
as is the functionality of standards -- and both of these are to a
large extent influenced by commercial users.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710270936.JAA00696@server.test.net>




Lucky Green  writes:
> On Fri, 24 Oct 1997, Adam Back wrote:
> > 
> > If this is the case, I reckon it's still better to just escrow their
> > comms keys locally.  [..] To go with this kind of a company with this
> > kind of policy, I would presume that sending or receiving super-
> > encrypted messages would would be a sackable offense.
> 
> How does your system prevent the employer  from fabricating forged
> signatures in a PK system that uses the same key for signing and
> decrypting?

PGP isn't using ARR (Additional Recipient Requests) for the old RSA
keys either, I don't think -- so I think a copy of pgp5.5 for business
which has been configured by an admin with the strictest settings
would not be able to generate RSA keys.

So the simple way seems to be to not escrow the private components of
the DSA signature key.  If people forget their passphrase, they'll
need to generate a new signature key and get it freshly certified by
the admin while he's recovering their encryption key.

> And if you don't use such a system, then how do you deal with future
> versions of the software that will allow the user to swap DH keys
> from underneath the ElGamal keys?

Interesting question even if you are using separate signature keys.
You've got a new signature key.  You want to bind your recovered EG
keys to it.  So I guess you just strip the self-certificates from the
EG keys, and add new ones made by the new signature key.  You can
still decrypt messages, and even pgp5.0 would be able to cope with
that (it'll try to fetch keys to check the certification on the
signature key).

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0




Misty Ed the incredible talking horse.






From aba at dcs.ex.ac.uk  Mon Oct 27 02:56:50 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Mon, 27 Oct 1997 18:56:50 +0800
Subject: NAMBLA embattled -- mirror sites?
In-Reply-To: 
Message-ID: <199710271007.KAA00977@server.test.net>




Martin Pool  writes:
> It's easy to believe in freedom in the abstract: you have to look at
> the boundary cases to decide what you really believe.

Very true.  That comment is worthy of a .sig quote.

It's the boundary cases that define the difference between `do you
believe in unconditional free speech' or `do you believe in free
speech as long as it doesn't offend you.

I would also say that just because someone is saying something
unpopular doesn't make me want to stick my neck out in mirroring it if
it's dangerous to do so.

Technological solutions are the answer, cf Tim's comments on Blacknet,
and anonymous USENET posts.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



Harish Pillay wrote:

>I don't think the "micro management" is at it's worst in Singapore - not by 
>a long shot.  It is true that the Singapore government tries to do so and 
>in a lot of what they attempt, they somehow come out smelling roses.  But 
>they have goofed up royally as well.  
...................................................................


If you don't mind my asking in front of everybody, how do you stand it,
living there?  Do you get very frustrated (it sounds as though you might),
and want to leave for Anguilla?   Do you remind yourself not to litter with
those gum wrappers you're not supposed to have anyway, what do you think
when you're being incentivized to find a sexual partner and produce
children, or to Do This and Not do That or risk painful punishments?  Do
co-workers become critical of each other's petty "crimes", do you feel
opressed all around, or is it not as bad as it seems from here?


    ..
Blanc






From blancw at cnw.com  Mon Oct 27 02:58:11 1997
From: blancw at cnw.com (Blanc)
Date: Mon, 27 Oct 1997 18:58:11 +0800
Subject: poverty traps (Re: Sa
Message-ID: <3.0.32.19971027024339.006adea0@cnw.com>



harka at nycmetro.com wrote:

>Further it is a social issue of importance also for Cypherpunks.
>Obviously we don't want governments "taking care of people", but
>desire individual freedom, self-determination and independence
>instead. However, as proven such things are possible in the "free
>market" only to a limited degree, i.e not applicable by default to
>everybody, IMHO.
   [. . .]
>If anybody _does_ have a solution, that enables _all_ people
>(regardless of background) to become truly free and also provides a
>realistic way to achieve that (for everybody), then I'll be more
>than happy to listen and to adjust my own perspective.
..................................................


The concept of a free market is not that it will "make you" free, nor that
it shall "provide you" ("you" being any one engaged in the exchange of
goods/services) with a perfect life, free of worry and the work of thought
and decision-making, creating the "perfect life" solution for everybody.
A free market doesn't "do things" for a person in spite of themselves.

In a free market scenario it is intended that any individual will be a free
agent - free from government interferance, free from government compulsion
- to create their *own* life's "solution", satisfactory to themselves
(regardless of whether it agrees with, or is at variance to, any one else's
standards of living). 

It is intended that an individual will be left to their own devices, to
seek out the methods which they themselves calculate will lead to the
achievement of their own goals, according to their own vision of success  -
that is, not the government's vision of success, nor the vision of their
neighbor, or of their mother-in-law, or anyone else who wants to shape
one's life for them and tell one what to do with it and how (no, Jim
Choate, I am not discriminating against Mothers-in-law, I'm just using them
as a stereotypical example of an interfering busy-body.  Don't worry about
it.).

It is way too easy to say that if you don't like something (like working
for a certain employer) you should change employers (easier to say than
done).   But the real aim of this argument is against the attitude of
tolerance, of tolerating the unacceptable or uncomfortable; it is that when
a person finds themselves seemingly trapped, they should not merely suffer
the circumstance (or worse, whine about it to everyone within earshot), but
should rather orient themselves towards finding a creative solution and
never cease searching for a way out.  Because nothing is created or
advanced into improvement by merely tolerating the intolerable, by just
"taking what was given", or from continuing to bear up under low standards
of functioning.   

The "free market " is not for the purpose of freeing everyone from the work
of solving their own problems; the idea is to leave them free to negotiate
with others on the terms of their interactive business arrangements (you
know - work/pay, hours/compensation, overtime/stock options, your place/my
place, etc.  Ideally, that is.  As everyone knows, we do not live in a
"pure" free-market economy, therefore these negotiations are presently all
regulated, to force everyone into a standardized success & happiness).   

There are many obstacles to overcome in an imperfect world, in an imperfect
society, in an imperfect economy, under imperfect governments, not to
mention all the competition.  It is very discouraging and sometimes you
want to hug your Teddy Bear for comfort [ :>) ].  But sometimes the first,
and largest,  obstacle to overcome is one's own pessimism and negativity
against mustering up the courage and creativity to "push the envelope".
This fatalism is what is being criticized.

    ..
Blanc






From mark at unicorn.com  Mon Oct 27 03:28:22 1997
From: mark at unicorn.com (mark at unicorn.com)
Date: Mon, 27 Oct 1997 19:28:22 +0800
Subject: PGP Employee on MKR
Message-ID: <877948732.5974.193.133.230.33@unicorn.com>



shamrock at cypherpunks.to wrote:

> OK, I must be missing something. How can it be more evil if the email
> isn't automatically sent to the owner of the MK key than if the email is
> automatically cd'ed?

Uh, don't understand the question. The issue is that it's being encrypted
to multiple keys for one recipient.

> Agreed. And so did PGP 2.x and any version of PGP that allows for
> encryption to multiple keys. Anybody can take the 2.6 source and hardcode
> in a second recipient key.

But, for the fifth or sixth time, _that isn't being shipped as standard 
by PGP_. 

> I read the recently  proposed alternatives
> and fail to see how they would prevent GMR any more than PGP's solution.
> All I saw were convoluted and frequently hasty designs, many of which
> lend themselves even more to GAK then what PGP did.

Really? I seem to recall Jon Callas saying my system 'redesigned CMR' 
but was simpler than theirs. The mere fact that CMR requires an enforcer 
implies that it's a convoluted and hasty design. 

> Once, (as many of you know IMHO it is a "once", not an "if")  GAK becomes
> mandatory, it can be implemented with 2.6 just a easy as
> with 5.5.

But it can't; for a start 2.6-based GAK won't interoperate with 
international versions the way that CMR will. Cutting the US off from
encrypted mail from the rest of the world would probably not go down
too well.

Lucky, one question: wouldn't you be complaining if Netscape or Microsoft
were shipping a system which enforced encryption to snooping keys? Why should 
we feel any differently about PGP?

    Mark






From aba at dcs.ex.ac.uk  Mon Oct 27 03:31:08 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Mon, 27 Oct 1997 19:31:08 +0800
Subject: pgp2.x is dangerous too (Re: PGP Employee on MKR)
In-Reply-To: 
Message-ID: <199710271050.KAA00998@server.test.net>




Lucky Green  writes:
> On Fri, 24 Oct 1997 mark at unicorn.com wrote:
> > 
> > If you can explain the following, then I'll accept that my fears are merely
> > fantasies:
> 
> OK, I must be missing something. How can it be more evil if the email
> isn't automatically sent to the owner of the MK key than if the email is
> automatically cd'ed?

Uh.. I think you've hit on the center of the problem here.

Here's my take on it:

CMR is potentially dangerous because it can be abused; therefore make
things which are harder to abuse for government communications
snooping.

pgp2.x is potentially dangerous because it can be abused; therefore
make things which are harder to abuse for government communications
snooping.

I think pgp2.x is potentially dangerous too -- the only difference
being that no-one that I know was widely deploying policy enforcers
for it.

Yes even easy to write code has to be deployed -- deployment is the
larger part of the battle, clearly.  TIS has been selling GAKware for
years, and no-one much is using it, as one example.  Passing a law
over-night that everyone must downgrade to TIS GAKware is problematic
-- people will revolt, even companies who have no political stance,
just because of the hassle of it.

Interoperability matters.  If we can widely deploy software which
needs to `unpublished' to deploy GAK, we've built some additional
resistance to GAK.  (With Luckian outlook, this will be a delay rather
than a prevention, but it's still a net good).

Standards matter too -- if we widely deployed a Internet mail standard
(say OpenPGP:-) which would have to be modified in non-backwards
compatible ways to introduce government communications message
snooping, we'd have enormous resistance to GAK.  This is because it
becomes international -- if the US doesn't switch to GAK, then a
France which tries will face problems: cut themselves off, or not do
it, or attempt to do it, but have it unenforceable even for
non-technical users.

Now the main point isn't that CMR and policy enforcer is ever so
slightly more dangerous than pgp2.x, the point is that pgp5.x is being
widely deployed; and that people are switching from pgp2.x to 5.x
(especially due to limited backwards compatibility being used to
encourage move to non-patented algorithms).


Say, for the sake of argument, that OpenPGP adds a MUST or a SHOULD
feature to have some kind of forward secrecy.  Say this feature gets
deployed everywhere.  (I'm sure we'll all be 100% behind that one!)

Numerous anti-GAK features have been proposed.  PFS TLS, which as I've
shown can be authenticated via the existing PGP WoT is one way (easy
to bolt on to existing PGP SMTP agents -- another weekends hack at
most).  Providing opportunistic PFS inside the PGP message envelope by
sending new keys with messages, which may be used to reply in a
forward secret manner, and basing data recovery features on storage
recovery where possible are others.

Deploy such features.  Deploy such standards.

Imagine trying to revoke SSL standard to make it non forward secret.
(Government recovery of web traffic, yeah).  That'd be a tough one,
right?

I presume that is part of C2's motivation in delploying 128 bit web
servers, and 40 <-> 128 bit local proxies to uprate browser security.

> > 1. How PGP can prevent CMR being converted into GMR; their system builds
> >    all the code required to support mandatory encryption to FBI and NSA
> >    keys into every copy of PGP.
> 
> Agreed. And so did PGP 2.x and any version of PGP that allows for
> encryption to multiple keys. Anybody can take the 2.6 source and hardcode
> in a second recipient key.

This to me doesn't say "give up", it says: make something that is more
resistant to being abused by governments.  What the deployed base
does, and what the standards say is important.  What the government in
some tin pot dictatorship hacks into pgp2.x hardly matters, if the new
standard refuses to talk to it.

> The answer is that no PK crypto system can prevent being converted
> for GAK use.

It just isn't that black and white.  Some things are clearly much more
resistant than others.  Most anything can be subverted by governments,
but some things are harder than others.

> I read the recently proposed alternatives and fail to see how they
> would prevent GMR any more than PGP's solution.  All I saw were
> convoluted and frequently hasty designs, many of which lend
> themselves even more to GAK then what PGP did.

Pick a design, explain why it could lend itself to GAK, help improve
design to reduce danger.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: 



On Mon, 27 Oct 1997, Adam Back wrote:

> 
> Lucky Green  writes:
> > On Fri, 24 Oct 1997, Adam Back wrote:

> > And if you don't use such a system, then how do you deal with future
> > versions of the software that will allow the user to swap DH keys
> > from underneath the ElGamal keys?

[Stupid typo my part. This was  supposed to be "swap ElGamal keys from
under the DSA keys."]
 
> Interesting question even if you are using separate signature keys.
> You've got a new signature key.  You want to bind your recovered EG
> keys to it.  So I guess you just strip the self-certificates from the
> EG keys, and add new ones made by the new signature key.  You can
> still decrypt messages, and even pgp5.0 would be able to cope with
> that (it'll try to fetch keys to check the certification on the
> signature key).
> 
> Adam
> -- 
> Now officially an EAR violation...
> Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/
> 
> print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 


-- Lucky Green  PGP encrypted email preferred.
   "Tonga? Where the hell is Tonga? They have Cypherpunks there?"






From jya at pipeline.com  Mon Oct 27 04:48:01 1997
From: jya at pipeline.com (John Young)
Date: Mon, 27 Oct 1997 20:48:01 +0800
Subject: CMR versus GAK?
Message-ID: <1.5.4.32.19971027124538.006add84@pop.pipeline.com>



Lutz wrote:

>May be in your (poor) country. There is a world outside US.

Good point, and note that there are many other worlds within the US
besides the LOOD stud-employer-has-manifest-destiny-control 
version.

But it is good marketing to sell fearful business owners gadgets
and to perpetuate their sense of knowing what's going on behind
their backs, as with frightened pols, spies, cops, parents and 
straights, leaky prophylactics supplemented with arms to bear 
when the hints of betrayal and inadequacy become unbearable. 

Not that the gadgets and arms work when you can't ID or crosshair 
the elusive backalley cats aprowl.

Same goes for workers and youngsters who think the bosses and
oldsters are duncemunge: WSJ, Dilbert and Phrack are funnies to 
avoid the admitting the deeper complicity of secret crossovers by
your favorite peer group into the opposing camps, political, economic, 
legal, scientific, not to say no longer secure national and sexual borders.

LOOD = Long Out Of Date






From blancw at cnw.com  Mon Oct 27 05:26:57 1997
From: blancw at cnw.com (Blanc)
Date: Mon, 27 Oct 1997 21:26:57 +0800
Subject: Don't Worry, Be Happy
Message-ID: <3.0.32.19971027051811.0068ac14@cnw.com>



Unix and other OSes were designed for Elite Techno-savvy Info Warriors like
yourselves.  Windows and the other MS apps are designed to appeal to the
"common folk" who would still rather use a pc than a Mac in spite of
psychological counseling against it ().   They have choices, there are
many stores and vendors, they take their pick.

As long as you can get what you want, what do youall care what other people
use - why do you worry for everyone?


    ..
Blanc






From ravage at ssz.com  Mon Oct 27 05:49:31 1997
From: ravage at ssz.com (Jim Choate)
Date: Mon, 27 Oct 1997 21:49:31 +0800
Subject: Orthogonal (fwd)
Message-ID: <199710271341.HAA03473@einstein.ssz.com>



Forwarded message:

> From: Mark Rogaski 
> Subject: Re: Orthogonal (fwd)
> Date: Mon, 27 Oct 1997 01:36:06 -0500 (EST)

> An entity claiming to be Jim Choate wrote:
> 
> : I can see the union 'build complicated things out of basic building blocks'
> : and the use of Occam's Razor (I'm as lazy as any other programmer) but fail
> : to see how this maps to anything relating to the concept of orthogonal.
> : Which clearly doesn't have any inherent minimalist cast.
> : 
> 
> Minimalism is merely a by-product of orthogonality.

Which orthogonality are you speaking of?

> A language is considered
> orthogonal if builtin functions do not provide overlapping functionality.

Are you talking linguistics, philosophy, or computer? Consider, historicaly
the point of 'orthogonality' was to indicate a  *non-overlapping* or
reducable structure, something which provides a reference to evaluate other
things.

> So the term orthogonal probably refers to the fact that there is no
> point of intersection in the functionality of the language (or system, as
> the thread started out).

Orthogonal implies there is intersection, it's hard to have a closed
geometric shape (-gonal) or a right angle (ortho-) axis system without them.

> And I will not argue about vector spaces until I get bookshelves and actually
> dig my Linear Algebra texts out of the boxes around my apartment.

Good, I understand how it is used in vector spaces and don't really get my
jollies off on arguing on unrelated issues. What I *would* like to
know is how a mathematical term related to geometry and right angles got
expanded *historicaly* to mean something completely unrelated. I don't think
a linear algebra book is relevant to this question, despite the protestations
of the techno-masturbatory ot the contrary.

There are a whole host of users on this list who live by strawman arguments.
I am glad to see you aren't one of them (apparently).


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From blancw at cnw.com  Mon Oct 27 06:10:48 1997
From: blancw at cnw.com (Blanc)
Date: Mon, 27 Oct 1997 22:10:48 +0800
Subject: CMR versus GAK?
Message-ID: <3.0.32.19971027060249.006b2b1c@cnw.com>



John Young wrote, I think:

>Same goes for workers and youngsters who think the bosses and
>oldsters are duncemunge: WSJ, Dilbert and Phrack are funnies to 
>avoid the admitting the deeper complicity of secret crossovers by
>your favorite peer group into the opposing camps, political, economic, 
>legal, scientific, not to say no longer secure national and sexual borders.
..................................................


John, you should write a book.  
Light reading.   
haiku.



    ..
Blanc






From lutz at taranis.iks-jena.de  Mon Oct 27 06:18:22 1997
From: lutz at taranis.iks-jena.de (Lutz Donnerhacke)
Date: Mon, 27 Oct 1997 22:18:22 +0800
Subject: New Trial in Germany over web site [CNN]
In-Reply-To: <199710250208.VAA27336@einstein.ssz.com>
Message-ID: 



* Jim Choate quoted:
>> Angela Marquardt, 26, former deputy leader of Germany's reform
>> communist Party of Democratic Socialism (PDS), was this time accused
>> of having illegally published the charge sheet of her first trial.

This is indeed illegal in Germany. It is a farce, because it's not uncommon
to publish such papers before the trial starts.

The main question is, if Andrea published or not. She sent it to a 'closed'
mailinglist.






From harish at ganymede.contact.com.sg  Mon Oct 27 06:42:39 1997
From: harish at ganymede.contact.com.sg (Harish Pillay)
Date: Mon, 27 Oct 1997 22:42:39 +0800
Subject: Singaporean control freaks & CMR (Re: puff pieces vs tough
In-Reply-To: <3.0.32.19971027025435.006b993c@cnw.com>
Message-ID: <199710271415.WAA02980@ganymede.contact.com.sg>



Blanc -

Hi.

> >I don't think the "micro management" is at it's worst in Singapore - not by 
> >a long shot.  It is true that the Singapore government tries to do so and 
> >in a lot of what they attempt, they somehow come out smelling roses.  But 
> >they have goofed up royally as well.  
> ...................................................................
> 
> If you don't mind my asking in front of everybody, how do you stand it,
> living there?  

Sure you may ask and I would venture an answer.  Promise me that you will 
answer the same question as to where you live (Pacific Northwest I assume -
ah, how I would love to move back there!).  How do I stand it living here?
I don't really know.  This is my home after all.  Warts and all.  I was born 
here 38 years ago.  When I was born, Singapore was a British Crown Colony 
(as Hong Kong was up until June 30th this year).  In 1963, we joined our 
northern neighbour, Malaysia, and became a state within that country.  In 
1965, we got booted out.  I was 6.  The country was in shambles to say the 
least.  We are nothing but a piece of island about 600 sq km (or 230+ sq 
miles for the metric-challenged Americans :-)), with no natural resources, 
save for a population them of about 1.5M and a great natural harbour.  We 
have a racial mix of 70% ethnic Chinese, 15% native Malays, 10% ethnic 
Indians and about 5% so-called Others.  What holds this cocktail together - 
nothing except for the hope for a better life.  My parents were immigrants - 
they came to Singapore after WWII from India for a better life.  These people 
are willing to put up with "nonsense" to make money and dream to retire to 
their motherlands during their twilight years.

My parents are now Singapore citizens and so are over 3 million others now.
They are not planning on any form of retirement in any other country - this
is their home.  The formula that saw Singapore be transformed from a 3rd 
world dump to a 1st world city is now not valid.  People of my generation 
have seen the transition and now we are able to assert ourselves as full 
citizens of a island city state and are beginning to do so in an increasing 
manner.  The Internet is helping in that direction.

> Do you get very frustrated (it sounds as though you might), and want to 
> leave for Anguilla?   

Yes, I am frustrated at times - aren't we all.  But I can do pretty much what 
I want.  This is not a police state by any definition.  I am able to buy what 
I want, pay for it in any form I choose and generally go about my life as I 
please.  The income taxes are ridiculously low (much much lower than in the
US) and the general standard of living is good. 

> Do you remind yourself not to litter with those gum wrappers you're not 
> supposed to have anyway.

Why would I have to remind myself?  Good habits are all that it takes.  Have
you checked your city's ordinance to see if littering is an offence and the 
penalty it carries?  What is it that just because in Singapore there are 
signs that state the obvious, it immediately becomes a problem?  True, if the 
society is naturally gracious, there is not need for such reminders - but the 
social habits of the populace in earlier days warranted that.  No apologies 
are really needed, but things have to be placed in perspective.  The unfortunate
thing about the international media is that they are always picking bones on 
the most silly of issues and the some of the bozos in the local government 
here have such thin skins that they get very excitable for no reason.

> what do you think when you're being incentivized to find a sexual partner 
> and produce children, or to Do This and Not do That or risk painful 
> punishments?  

Hmm.  This is what I mentioned in a previous post that there are some things
the lobotomized parts of the government does that is shamefully stupid.  Just
laugh it off.  The govt loves to micromanage.  The generation of Singaporeans
who grew up post independence (1965) have been brought up in that sort of
environment.  But, unlike their parents, this post-1965 generation does not
ask how high when asked to jump, but asks why.

> Do co-workers become critical of each other's petty "crimes", do you feel
> opressed all around, or is it not as bad as it seems from here?

Spot on.  It is all a matter of perspectives and type and quality of
information that is being fed.  We need opening of minds and exchange of
information to remove misconceptions.  Sometime in 1989 (I was living in
Seattle then) I was bombarded by e-mail from a chap from somewhere in 
eastern Europe on how I could defend Singapore when there are people starving 
on the streets, libraries without books, children malnourished etc etc.  I 
don't know what he was smoking, but it sure made for a interesting read.   
I sent back a note asking him to clarify what he was saying, to which he 
replied that that was the type of information he was being fed by their 
media.

Perhaps a more balanced perspective of Singapore can be gotten at 
www.sintercom.org.  Open your minds.  No, this is not a god-forsaken place.
It's home and it's livable.  Come visit us.   Buy me some chewing gum, I'll 
buy the beers.

So, now to come back to the first line.  Tell me how you can tolerate living 
in wherever that it you live in?

Regards.
-- 
Harish Pillay                             	  h.pillay at ieee.org
Singapore      *** Ask me about Linux *** http://home.pacific.net.sg/~harish






From kent at bywater.songbird.com  Mon Oct 27 06:51:14 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Mon, 27 Oct 1997 22:51:14 +0800
Subject: Technical Description of PGP 5.5
In-Reply-To: <199710241425.PAA01534@server.test.net>
Message-ID: <19971027063955.64669@bywater.songbird.com>



On Mon, Oct 27, 1997 at 02:26:27AM -0500, Thomas Junker wrote:
> 
> Recovery of messages in transit is entirely a snooping issue, 
> methinks.

Actually, it's snooping of messages in transit on a network OWNED BY 
THE COMPANY.

> Recovery of stored messages and files also seems to me to be a
> solution to a largely imaginary problem.  As I wrote before, there
> are more ways and more likely ways to lose data than through keeping
> encrypted files.  People live with it.  If they wish to address it,
> either individually or institutionally, they can do so without
> special features in PGP.  A feature in mail clients to store the 
> decrypted message in place of the original would do more to avoid 
> loss of stored encrypted messages than anything else I've seen 
> proposed.
[and]
> How on earth can people manage email and disk files without the 
> ability to "recover" data that can be lost in a thousand other ways 
> that no encryption package can protect against.  Geez.  Let's get 
> real here.

Given the frequency of "I've forgotten my password" incidents at
company help desks, widespread use of cryptography would cause this to
become *the* prime cause of lost data.  As has been pointed out, 
email is actually very reliable.  Hard disks are very reliable, tapes 
are very reliable.  Loss of data through these media has become very 
rare, and with intelligent practice, non-existent for all practical 
purposes. 

> This reminds me a lot of the objections of a few to sending EDI 
> traffic over the Internet.  When I proposed this in recent years I 
> got a wail from some people over the loss of third-party time 
> stamping and message delivery verification that can occur in the 
> simpler scenarios of bypassing the cash-cow Value Added Networks.  
> But, um, didn't everyone print those documents on *paper* and drop 
> them into USPS *mail boxes* just a few short years ago?  What 
> reliable third party time stamping and message delivery verification 
> did they have then?  Am I mistaken or didn't the entire economy 
> function on the basis of snail-mailed invoices and other documents? 
> How on earth did people manage under those primitive circumstances?

This is a bad argument for you to use.  From a privacy perspective,
didn't people send all kinds of very private stuff on *paper* and
through *mailboxes* just a few short years ago?  How did they survive 
without strong encryption?!  "Geez.  Let's get real here."

The physical mail analogy to PGP's implementation of CMR is as 
follows:  Company policy is that it does not accept private pmail for 
individuals.  All mail for individuals must be addressed

XYZ Company
attn: Indi Vidual
Address1
Address2

Mail addressed like this:

Indi Vidual
Address1
Address2

will be returned, because the company doesn't accept private mail.  
Company mail is to be used for company business.  You don't receive 
Playboy at work, you receive it at home.

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From raph at CS.Berkeley.EDU  Mon Oct 27 07:05:23 1997
From: raph at CS.Berkeley.EDU (Raph Levien)
Date: Mon, 27 Oct 1997 23:05:23 +0800
Subject: List of reliable remailers
Message-ID: <199710271450.GAA04159@kiwi.cs.berkeley.edu>



   I operate a remailer pinging service which collects detailed
information about remailer features and reliability.

   To use it, just finger remailer-list at kiwi.cs.berkeley.edu

   There is also a Web version of the same information, plus lots of
interesting links to remailer-related resources, at:
http://www.cs.berkeley.edu/~raph/remailer-list.html

   This information is used by premail, a remailer chaining and PGP
encrypting client for outgoing mail. For more information, see:
http://www.c2.org/~raph/premail.html

   For the PGP public keys of the remailers, finger
pgpkeys at kiwi.cs.berkeley.edu

This is the current info:

                                 REMAILER LIST

   This is an automatically generated listing of remailers. The first
   part of the listing shows the remailers along with configuration
   options and special features for each of the remailers. The second
   part shows the 12-day history, and average latency and uptime for each
   remailer. You can also get this list by fingering
   remailer-list at kiwi.cs.berkeley.edu.

$remailer{'cyber'} = ' alpha pgp';
$remailer{"mix"} = " cpunk mix pgp hash latent cut ek ksub reord ?";
$remailer{"replay"} = " cpunk mix pgp hash latent cut post ek";
$remailer{"jam"} = " cpunk mix pgp hash middle latent cut ek";
$remailer{"winsock"} = " cpunk pgp pgponly hash cut ksub reord ?";
$remailer{'nym'} = ' newnym pgp';
$remailer{"squirrel"} = " cpunk mix pgp pgponly hash latent cut ek";
$remailer{'weasel'} = ' newnym pgp';
$remailer{"reno"} = " cpunk mix pgp hash middle latent cut ek reord ?";
$remailer{"cracker"} = " cpunk mix remix pgp hash ksub esub latent cut ek reord post";
$remailer{'redneck'} = ' newnym pgp';
$remailer{"bureau42"} = " cpunk mix pgp ksub hash latent cut ek";
$remailer{"neva"} = " cpunk pgp pgponly hash cut ksub ?";
$remailer{"lcs"} = " mix";
$remailer{"medusa"} = " mix middle"
$remailer{"McCain"} = " mix middle";
$remailer{"valdeez"} = " cpunk pgp pgponly hash ek";
$remailer{"arrid"} = " cpunk pgp pgponly hash ek";
$remailer{"hera"} = " cpunk pgp pgponly hash ek";
$remailer{"htuttle"} = " cpunk pgp hash latent cut post ek";
catalyst at netcom.com is _not_ a remailer.
lmccarth at ducie.cs.umass.edu is _not_ a remailer.
usura at replay.com is _not_ a remailer.
remailer at crynwr.com is _not_ a remailer.

There is no remailer at relay.com.

Groups of remailers sharing a machine or operator:
(cyber mix reno winsock)
(weasel squirrel medusa)
(cracker redneck)
(nym lcs)
(valdeez arrid hera)

This remailer list is somewhat phooey. Go check out
http://www.publius.net/rlist.html for a good one.

Last update: Thu 23 Oct 97 15:48:06 PDT
remailer  email address                        history  latency  uptime
-----------------------------------------------------------------------
hera     goddesshera at juno.com             ------------  5:03:45  99.86%
nym      config at nym.alias.net             +*#**#**###       :34  95.82%
redneck  config at anon.efga.org             #*##*+#****      2:00  95.44%
mix      mixmaster at remail.obscura.com     +++ ++++++*     19:18  95.27%
squirrel mix at squirrel.owl.de              -- ---+---    2:34:19  95.16%
cyber    alias at alias.cyberpass.net        *++***+ ++      11:26  95.11%
replay   remailer at replay.com              ****   ***      10:06  94.93%
arrid    arrid at juno.com                   ----.------   8:50:34  94.41%
bureau42 remailer at bureau42.ml.org          ---------    3:38:29  93.53%
cracker  remailer at anon.efga.org           +  +*+*+*+      16:32  92.80%
jam      remailer at cypherpunks.ca          +  +*-++++      24:14  92.79%
winsock  winsock at rigel.cyberpass.net      -..-..----    9:59:18  92.22%
neva     remailer at neva.org                ------****+   1:03:02  90.39%
valdeez  valdeez at juno.com                               4:58:22 -36.97%
reno     middleman at cyberpass.net                        1:01:28  -2.65%

   History key
     * # response in less than 5 minutes.
     * * response in less than 1 hour.
     * + response in less than 4 hours.
     * - response in less than 24 hours.
     * . response in more than 1 day.
     * _ response came back too late (more than 2 days).

   cpunk
          A major class of remailers. Supports Request-Remailing-To:
          field.
          
   eric
          A variant of the cpunk style. Uses Anon-Send-To: instead.
          
   penet
          The third class of remailers (at least for right now). Uses
          X-Anon-To: in the header.
          
   pgp
          Remailer supports encryption with PGP. A period after the
          keyword means that the short name, rather than the full email
          address, should be used as the encryption key ID.
          
   hash
          Supports ## pasting, so anything can be put into the headers of
          outgoing messages.
          
   ksub
          Remailer always kills subject header, even in non-pgp mode.
          
   nsub
          Remailer always preserves subject header, even in pgp mode.
          
   latent
          Supports Matt Ghio's Latent-Time: option.
          
   cut
          Supports Matt Ghio's Cutmarks: option.
          
   post
          Post to Usenet using Post-To: or Anon-Post-To: header.
          
   ek
          Encrypt responses in reply blocks using Encrypt-Key: header.
          
   special
          Accepts only pgp encrypted messages.
          
   mix
          Can accept messages in Mixmaster format.
          
   reord
          Attempts to foil traffic analysis by reordering messages. Note:
          I'm relying on the word of the remailer operator here, and
          haven't verified the reord info myself.

   mon
          Remailer has been known to monitor contents of private email.
          
   filter
          Remailer has been known to filter messages based on content. If
          not listed in conjunction with mon, then only messages destined
          for public forums are subject to filtering.
          

Raph Levien






From kent at bywater.songbird.com  Mon Oct 27 07:15:10 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Mon, 27 Oct 1997 23:15:10 +0800
Subject: CMR versus GAK?
In-Reply-To: <1.5.4.32.19971027124538.006add84@pop.pipeline.com>
Message-ID: <19971027070358.62857@bywater.songbird.com>



On Mon, Oct 27, 1997 at 07:45:38AM -0500, John Young wrote:
> Lutz wrote:
> 
> >May be in your (poor) country. There is a world outside US.
> 
> Good point, and note that there are many other worlds within the US
> besides the LOOD stud-employer-has-manifest-destiny-control 
> version.
> 
> But it is good marketing to sell fearful business owners gadgets
> and to perpetuate their sense of knowing what's going on behind
> their backs, as with frightened pols, spies, cops, parents and 
> straights, leaky prophylactics supplemented with arms to bear 
> when the hints of betrayal and inadequacy become unbearable. 

Implicit you make the notion there is no merit.  But experience is a 
harsh mistress -- employees do steal.  This is not fiction, but fact.

> Not that the gadgets and arms work when you can't ID or crosshair 
> the elusive backalley cats aprowl.
> 
> Same goes for workers and youngsters who think the bosses and
> oldsters are duncemunge: WSJ, Dilbert and Phrack are funnies to 
> avoid the admitting the deeper complicity of secret crossovers by
> your favorite peer group into the opposing camps, political, economic, 
> legal, scientific, not to say no longer secure national and sexual borders.

People change.  Usually, they learn.  Sometimes they burn.

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From rhayden at orion.means.net  Mon Oct 27 07:46:30 1997
From: rhayden at orion.means.net (Robert A. Hayden)
Date: Mon, 27 Oct 1997 23:46:30 +0800
Subject: DoS
Message-ID: 



This was forwarded to me in house.  Just FYI.

---------- Forwarded message ----------
Date: Mon, 27 Oct 1997 09:38:28 -0600
From: Chris Silker 

MCI RELEASES FREE DENIAL OF SERVICE TRACKER SECURITY TOOL
MCI has released an interesting piece of software called the Denial of
Service Tracker (DoS). The security program helps track the source of
denial of service attacks, which aim to overload a target computer system
to the point that it's unusable for anything else. According to MCU, the
DoS Tracker works against SYN, ICMP flood, bandwidth saturation, and
concentrated source attacks, and is currently being modified to detect
other DoS-based attacks, including a new attack called the Smurf. The info,
a free download, and all the technical information is at the site. A must
have for sysops. 


 
=-=-=-=-=-=
Robert Hayden			rhayden at means.net	       UIN: 3937211
IP Network Administrator	http://rhayden.means.net
MEANS Telcom			(612) 230-4416 






From frantz at netcom.com  Mon Oct 27 07:50:21 1997
From: frantz at netcom.com (Bill Frantz)
Date: Mon, 27 Oct 1997 23:50:21 +0800
Subject: Request for expert opinion and Feedback
In-Reply-To: <34514B35.AE826953@inch.com>
Message-ID: 



At 6:28 PM -0700 10/24/97, Joubin wrote:
>I am involved in a project which aims at the creation of a free and
>portable Java(tm) based object operating system.  A basic functional
>requirement for this new OS is to provide /fast and effective/ strong
>cryptographic support at the OS level.
>
>...
>
>Your expert advice:
>
>a) How do you feel about 'where' the computational support should be
>   implemented ?

Look at the Java Ecnryption stuff that JavaSoft has put out.  The
interfaces aren't too bad, and in any case you will need native code for
efficency at the lowest level.

>c) Is there any benefit to implementing the random number generation
>   system in the Kernel?

Yes.  In the kernel, you have access to many more hard-to-guess physical
inputs than an application level program


-------------------------------------------------------------------------
Bill Frantz       | Internal surveillance      | Periwinkle -- Consulting
(408)356-8506     | helped make the USSR the   | 16345 Englewood Ave.
frantz at netcom.com | nation it is today.        | Los Gatos, CA 95032, USA







From blancw at cnw.com  Mon Oct 27 07:58:28 1997
From: blancw at cnw.com (Blanc)
Date: Mon, 27 Oct 1997 23:58:28 +0800
Subject: Singaporean control freaks & CMR (Re: puff pieces vs tough
Message-ID: <3.0.32.19971027075645.006b2b1c@cnw.com>



Harish Pillay wrote:

>So, now to come back to the first line.  Tell me how you can tolerate living 
>in wherever that it you live in?
.......................................................


Well, it's not so bad -  I live about 3 minutes drive from Microsoft, with
micro-millionaires all around.  I live across the street from Crossroads
Mall, which has practically everything I need, including free music/jazz
concerts on weekends, the weather is nice most of the time (I *like* rain),
and I'm not far away from the sea, the mountains, hiking, skiing, biking,
boating, snorkeling, whatever, and lots of other genteel entertainment of
all kinds.

Frankly, I can just barely tolerate it, and I've been contemplating what
life would be like in Anguilla.  :>)  No seriously, I'm referring to the
political climate in the U.S. in general (although The East Side, as this
side of Washington Lake is called, is considered too conservative by most
Seattlites and has a large Libertarian representation, probably because of
all those programmers at MS).   

But then, I'm a real purist and wish for extreme things, and like the
princess & the pea in the fairy tale, am highly sensitive to deviations
from perfection.  :O 

It's hard to tolerate being moved to act by people (whether in government
or otherwise, but of course mostly in political circles) who carelessly and
disrespectfully override my personal choices in order to make their social
dreams for everyone come true, using any resources they can "legitimize"
taking from myself or anyone to accomplish them; it's a pain to contemplate
their rationalizations.

I read/study in psychology & cognition, and the area of Thinking in
general, and it helps me to understand people like them, as well as to
maintain a rational, balanced state of mind when contemplating their
existence and considering ways to deal with it.

It takes a lot of creativity to see beyond collectivist/coercive methods
and carry on in spite of having to subserviently respond in "voluntary
complicity".   I've been mulling the whole situation over, and I think it's
a good idea to emulate Bill Gates.   "We're not taking over the whole
world", he protested in one interview.  "I mean, all we do is produce these
small boxes that you can buy and put it into your pc, what does that have
to do with taking over?" (hee-hee).

No, it's just dragging some people, kicking and screaming, to a new level
of technological opportunities.  I like that.    I think they all
deserve it.

Anyway, thanks for the reply.   I wouldn't argue against Singaporean
citizens who actually like their way of life.  I would only be concerned if
they couldn't go in the directions they prefer.   Micro-management is not
something I myself could laugh off, as my sense of humor isn't that good,
although my sense of the ridiculous is easily aroused. 






    ..
Blanc






From nobody at bureau42.ml.org  Mon Oct 27 08:20:31 1997
From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer)
Date: Tue, 28 Oct 1997 00:20:31 +0800
Subject: No Subject
In-Reply-To: <199710270529.GAA08435@basement.replay.com>
Message-ID: <+4zqRahTI/l4VDF17VtvrQ==@bureau42.ml.org>



Anonymous   writes:

> I was so inspired by this guy that I had the source to sendmail
> tattooed on my back and the source to emacs tattooed on my left
                      ^^^ ^^^ ^^^^^^ ^^ ^^^^^
> thigh.

Just how fat are you?






From attila at hun.org  Mon Oct 27 08:29:03 1997
From: attila at hun.org (Attila T. Hun)
Date: Tue, 28 Oct 1997 00:29:03 +0800
Subject: Tim's worst nightmare.,..
Message-ID: <3454BF94.7ED3@hun.org>



-----BEGIN PGP SIGNED MESSAGE-----


    here we go again, the AP wire just laid on this morning's
    action at Roby IL --it sounds to close to Ruby Ridge for
    my taste. This is beyond police harassment and save face
    for what was a civil action and will now end up with the
    poor lady wearing a ciminal jacket longer than her life.

October 27, 1997
Woman in Standoff Shoots at Police
Filed at 10:12 a.m.  EST
By The Associated Press

ROBY, Ill.  (AP) -- Gunfire rang out again at the home of a woman
involved in a month-long standoff with authorities who have a
court order to bring her in for psychological testing.

Shirley Allen shot a police dog through the nose Sunday after
officers threw pepper spray into her farmhouse, state police
director Terrance Gainer said.

    well, wouldn't you if the dog is put in your house...

She also fired a shot when police used mirrors on long sticks to
peer in, but no one was injured, Gainer said.

    well, wouldn't you?

Gainer said sound detection equipment had picked up a conversation
Mrs.  Allen had with herself on Friday in which she sounded as if
she was ``moving closer to suicide,'' followed by a long period of
inactivity.

    33 days the lady has stood off a virtual army who cut off her
    power, water, and telephone --wouldn't you talk to yourself 
    for company. hell, who wouldn't commit suicide rather than
    face the scheiBesturm she faces when they finally "bag" her.

That prompted police to drive an all-terrain vehicle around her
back yard Sunday, break her windows and a sliding glass door,
throw in nine canisters of pepper spray and send in a German
shepherd wired for sound.  She fired once at the dog, Gainer said.
The dog was taken to a veterinary hospital for treatment.

    shit, let's airdrop her a dozen TOW missles. she can put them
    to good use. nine canisters of pepper spray --who the hell 
    do the think they are? Los Angeles police beating Rodney King?

Mrs.  Allen, 51, has attracted the sympathy of many neighbors, and
her case has become a rallying point for those who compare it to
Ruby Ridge and Waco as an example of overzealous law enforcement.

    she needs more than sympathy, she needs some action!

Gainer said Mrs.  Allen's actions show that she is dangerous and
prove that state police cannot back off and leave her alone
because she is a threat to herself and to others.

    she wasnt dangerous until the bastards violated her privacy;
    all over the fact a greedy nephew wants to get control of
    the valuable 40 some acres. most of the family say she's fine,
    but the liberal press does not report that fairly.

The standoff, about 20 miles southeast of Springfield, started
Sept.  22 when she used a shotgun to resist sheriff's deputies
serving commitment papers obtained by her family.  Relatives said
Mrs.  Allen, a former nurse, had become increasingly depressed
after her husband died of pancreatic cancer in 1989 and recently
began refusing to see or talk to her mother and brother.

    hell, if your relatives are being assholes, you can turn the
    switch off there, too.  a telephone is solely for calling out
    with --and connecting to the net....





-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1
Comment: No safety this side of the grave. Never was; never will be

iQBVAwUBNFS9zrR8UA6T6u61AQFctgH+OKh2NXtQrujbVnCmIQu7NVcyih66RgKe
VdC36i2c30GRxCwLtXWWRKz5FXcAXXoTzlWPQ+7qHS+PtcE7sjiXOA==
=HOw2
-----END PGP SIGNATURE-----






From take at barrier-free.co.jp  Mon Oct 27 08:30:28 1997
From: take at barrier-free.co.jp (Hayashi_Tsuyoshi)
Date: Tue, 28 Oct 1997 00:30:28 +0800
Subject: [NEW] mixer@htp.org (was: List of reliable remailers)
In-Reply-To: <199710271450.GAA04159@kiwi.cs.berkeley.edu>
Message-ID: <199710271621.BAA31069@ns.barrier-free.co.jp>



# Sorry if dup.

Dear Raph Levien,

This is Tsuyoshi Hayashi, lives in Yokohama, Japan.

On Mon, 27 Oct 1997 06:50:08 -0800, Raph Levien said:
 >   I operate a remailer pinging service which collects detailed
 >information about remailer features and reliability.
[..]

Please add mixer at htp.org, the first public remailer in
Japan, was setup by a member of cypherpunks-j.

# it is not me.

 >$remailer{'cyber'} = ' alpha pgp';
 >$remailer{"mix"} = " cpunk mix pgp hash latent cut ek ksub reord ?";
[..]

mixer at htp.org is probably:

  $remailer{"mixer"} = " cpunk mix pgp";

Please add this record to your check list.

====

Note that a lot of members at cypherpunks-j are now
leaning how to use remailer(s) and they (and I) want to
need some info about it.  So, in the next time, please
send your report (everytime) to cypherpunks-j's list,
cypherpunks-j at htp.org.

Thanks,

 - Tsuyoshi Hayashi 
 - Barrier Free, Inc. (established on 25 Jan 1996)
 - http://TEL.TO/045-776-3524






From attila at hun.org  Mon Oct 27 08:43:57 1997
From: attila at hun.org (Attila T. Hun)
Date: Tue, 28 Oct 1997 00:43:57 +0800
Subject: the usual two sided mouth political free speech
Message-ID: <3454C2E9.1AD@hun.org>



-----BEGIN PGP SIGNED MESSAGE-----

    the usual two sided mouth political free speech
    in re: NYTimes letter to the editor, 26 Oct 97

    sometimes I wonder if free speech isn't already muffled;
    the rest of the time I know it is. anytime a politician
    can get a headline, they will stamp on someone's rights.
    common sense has been exerminated more effectively than
    NYC's vermin.

    I dont like my kids being exposed to that "kind" of 
    material, but I would sure rather it was done in an 
    educational environment (unless it is some faggot teacher 
    then advocating homosexual practice). children will find
    that "knowledge" one way or the other.

    You can not condemn "evil" without observing "evil" and 
    making a _personal_ value judgement which should not be
    reflected in calling for laws for or against.  If the adults
    would stop acting like 6 year olds, and the politicians as 4
    year old bullies, our children might get an education.

    OB Crypto:  maybe the teacher should be distributing this
    material on PGP with individual student keys; the teacher
    can sort out the Christian Coalition and Orthodox Jews early
    on and just forget to include their key --end of problem. So 
    there is a valid use for PGP in the schools --of course, the 
    old PGP, not their GAKed sellout.

To the Editor:

Gov.  George E. Pataki's comments regarding Charles Self, the
New York City schoolteacher who distributed a sexually explicit
poem to his students, were transparently political (news
article, Oct.  23).

First, the Governor disassociated himself from ruling on the
matter ("the appropriate sanction is not something for Albany to
decide"), and then jabbed the system that must rule on it ("I
think a letter in a file is not good enough").  It would have
been better to remain silent.

Second-best would have been to remind us of reality:  most
teachers are competent most of the time.  They occasionally make
errors in judgment.  Mr.  Self, reputedly a teacher who
motivates his students, made a mistake -- apparently the first
in 17 years to be placed on the record.

In such matters we ought to set aside the broad political brush
and work to rebuild the trusting relationship that teachers so
richly deserve to enjoy.  The Governor would do well to remember
that politicians are currently held in even lower esteem than
teachers.

GILBERT CASS New Haven, Oct.  24, 1997

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1
Comment: No safety this side of the grave. Never was; never will be

iQBVAwUBNFTB07R8UA6T6u61AQHhRQH/SAdMr/RJ6Ix6of7FPxIohxn/oOY2KOsN
a09/LtVErCffpMJc0tH4ZYF5aUrBH24CyNVCeIpDQjAYEg+5TH6LLQ==
=PM10
-----END PGP SIGNATURE-----






From kent at bywater.songbird.com  Mon Oct 27 08:57:20 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Tue, 28 Oct 1997 00:57:20 +0800
Subject: Orthogonal (fwd)
In-Reply-To: <199710270528.XAA02347@einstein.ssz.com>
Message-ID: <19971027084716.54057@bywater.songbird.com>



On Sun, Oct 26, 1997 at 11:28:09PM -0600, Jim Choate wrote:
> Forwarded message:
> 
> > Date: Sun, 26 Oct 1997 19:13:12 -0800
> > From: Kent Crispin 
> > Subject: Re: Orthogonal (fwd)
> 
> > > > I do believe the use of the term this way was inspired by the 
> > > > notion of a 'basis' in a vector space -- a set of orthogonal
> > > > vectors that span the space, ideally, unit vectors.
> > > 
> > > Can you better define the term 'basis'?
> > 
> > This is basic linear algebra:
> > 
> > V a vector space -- the set of all (s1,s2,s3,...,sn), where si is an
> > element of the set of reals.
> 
> Actualy si (scalars) can be rational, real, or complex. It is also possible 
> to use more general structures such as fields. [1]

That's true.  You asked for a better definition of "basis".  I was 
trying to do that without writing a textbook, though.
> 
> Note that complex numbers numbers may be used, in other words a vector can
> be used to multiply another vector.
> 
> > A set of vectors {v1,v2,...,vm} in V is
> 
> A vector of vectors, and you haven't even really defined vector yet...:(

No.  A *set* of vectors.  And I presumed you already knew what a
vector was, and a slight reminder would be all that was necessary.. 
if you aren't at least somewhat familiar with the ideas of sets and
vectors, it would be somewhat difficult for you to follow the rest of 
what I wrote, I grant.

> > linearly independent if there is no set of scalars {c1,c2,...,cm} with
> > at least one non-zero element such that sum(ci*vi) == 0
> 
> Are you saying:
> 
> (c1*v1)+(c2*v2)+...+(cn*vn) <> 0
> 
> where at least one ci is <>0, is some sort of test for membership in a vector
> space? 

Yes, though you have to understand that "0" is the zero *vector*  -- 
the sum of vectors is always another vector.

I was defining "linear independence", a basic concept needed to 
understand the notion of a basis.

> What about,
> 
> (1/c1*v1)+(-1/c2*v2)+(0*v3)...+(0*vn) = 0,
>      1         -1
> 
> if so it should be clear that except for the case of c=0 there is always a
> way to take two, which is clearly more than one, of the scalars and cause
> the sum to be zero. Now if you have a single non-zero scalar multiplier then
> it seems reasonable that you can create such a structure that is always <>0.

Nope.  It may be the zero vector vs zero scalar confusion.  Consider
the two linerarly *dependent* vectors in 2-space: (1,0), (2,0), and
the set {2,-1} of non-zero scalars: 2*(1,0) + -1*(2,0) = (0,0). 

Contrast with the two linearly *independent* vectors (1,0), (0,2).  
There is *no* set of scalars {c1,c2}, with at least 1 of ci != 0, such that 
c1*(1,0) + c2*(0,2) == (0,0).  This is obvious:

c1*(1,0) + c2*(0,2) = (c1,2*c2), which obviously cannot be (0,0) if 
either c1 or c2 is non-zero.


> 
> > A set of
> > vectors S spans
> 
> In other words 'are expressible in'?

If you like.  I am defining the word "span", however, because that is 
the common terminology.

> > a vector space V iff every element of V can be expressed
> > as a linear combination of the elements of S.
>               ^^^^^^^^^^^
>               Need to better define this one.

Sorry.  I really thought the notion of a "linear combination" would be
common knowledge.  You can check your dictionary.

> The operations that are applicable to a vector space are: [1]
> 
> 1.  Associative law of addition: (x+y)+z = x+(y+z)
> 2.  Commutative law of addition: x+y=y+x
> 3.  Existance of zero: x+0=x for all x in V
> 4.  Existance of inverses: x+(-x)=0
> 5.  Associative law of multiplication: a(bx)=(ab)x
> 6.  Unital law: 1*x=x
> 7.  First distributive law: a(x+y)=(a*x)+(a*y)
> 8.  Second distributive law: (a+b)*x=(a*x)+(b*x)
> 
> where x is of the form 'asubn(x^n)+bsubn-1(x^n-1)+...+asub1x+asub0'
> 
> This is a remarkably circular definition to present. In clearer wording;

No, in fact it's not.  There is nothing original in the definition -- 
I'm just parroting what I learned 20 years ago.

> The set of vectors S is expressible in a vector space V iff S is contained in > V.

That's not what I said, though.

> While this may be a requirement or test for membership in a vector space (as
> used below) it doesn't qualify as a definition.
> 
> > Finally, a basis for 
> > V is a linearly independent set of vectors in V that spans V.  A 
> > space is finite dimensioned if it has a finite set for a basis.  The 
>                                                  ^^^
>                                                  set of what?

Oh Jeez.  Vectors.  Note that the last sentence defines "finite 
dimensioned", not "basis".

> > standard basis (or natural basis) for a vector space of dimension n 
> > is th set of vectors
> > 
> > (1,0,0,...0)
> > (0,1,0,...0)
> > (0,0,1,...0)
> 
> In other words, any 'vector' can be expressed as the sum of the
> multiplication of unit elements by some set of scalars.
> 
> Is this definition something you just wrote or would you be so kind as to
> give the reference if it isn't.  

I paraphrased material from "Calculus of Vector Functions", 3rd
edition, by Williamson, Crowell, and Trotter and "Linear Algebra", by
Hoffman and Kunze.  These are both really old texts, but any book on
linear algebra will cover the same material.

> This definition uses 'basis', doesn't define it. You can't use a term to
> define the term, it's called circular reasoning.

Nope.  The definition is "a basis for V is a linearly independent set
of vectors in V that spans V." I defined "linearly independent" and
"span" without using the word "basis", or even the idea of a "basis".  
It is not a circular definition.

> My question still stands,
> can you please better define 'basis'. Or is your claim that basis is simply
> a way of stating 'elements of unit magnitude'?

At this point, it is clear that I should simply refer you to an
elementary linear algebra text.  I will just repeat that, for those
that are familiar with linear algebra, the analogical use of "orthogonal"
in language design is pretty intuitive.  If you don't have the
background you may not have the intuition, and discussion on this list
probably isn't the best way to build it.

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From tcmay at got.net  Mon Oct 27 09:44:15 1997
From: tcmay at got.net (Tim May)
Date: Tue, 28 Oct 1997 01:44:15 +0800
Subject: Orthogonal (fwd)
In-Reply-To: <199710270528.XAA02347@einstein.ssz.com>
Message-ID: 




At 9:47 AM -0700 10/27/97, Kent Crispin wrote:

>At this point, it is clear that I should simply refer you to an
>elementary linear algebra text.  I will just repeat that, for those
>that are familiar with linear algebra, the analogical use of "orthogonal"
>in language design is pretty intuitive.  If you don't have the
>background you may not have the intuition, and discussion on this list
>probably isn't the best way to build it.

I returned home after being away to find half a dozen or more posts arguing
about the use of the word "orthogonal." Which I used in my essay Saturday.

Like Kent, I don't see any point in arguing basic concepts of linear
algebra, vector spaces, correlations, inner products, and how these ideas
relate to machine and language functions. This is stuff most of us learned
way, way back, and the usage for machines and languages is natural. Arguing
about what a "basis" is, or what a "linear combination" is, is just a waste
of time.

I will give just _one_ example of orthogonality, though. Imagine a 747,
with various commands or functions to do things like lower the wing flaps,
retract the landing gear, dump excess fuel, turn on cabin lights, signal an
emergency, etc.

Normally, most of these commands are "orthogonal" to each other, in that
issuing a command to turn on the cabin lights does not also lower the
landing gear. Orthogonal in that there is no "projection" of one vector
onto the other. (Viewed in another way, the inner product of the two
commands is zero, or nearly zero, meaning there is no correlation, or
interaction, between the commands or vectors.)

(If Jim Choates quibbles in a overly literalitst way that "commands are not
vectors," I don't plan to respond.)

Contrast this orthogonal situation to one where one had these kinds of
commands:

Command 353: Lower landing gear, turn on cabin lights, and release
emergency braking parachute.

Command 792: Raise landing gear, send out emergency signal, and
depressurize cabin.

(The above examples might be a kind of "complex instruction set" for a
plane, because some architect decided that Command 353 _might_ conceivably
be needed someday. A cleaner, more functionally orthogonal instruction set
would be more like a RISC architecture.)

These commands would "intereact" with each other. The inner product, or
measure of correlation, would be far from being zero.

In fact, this 747 example is not original to me. When people discuss
software complexity, where small changes can have huge effects elsewhere,
one may hear examples like: "When a pilot tells the plane to raise it wing
flaps, he doesn't expect the tail section to fall off." Meaning, clean
design limits global propagation in various ways, keeps functions fairly
simple, and minimizes interactions and side effects.

Thus is the connection between my usage and software.

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From tcmay at got.net  Mon Oct 27 09:52:50 1997
From: tcmay at got.net (Tim May)
Date: Tue, 28 Oct 1997 01:52:50 +0800
Subject: Tim's worst nightmare.,..
In-Reply-To: <3454BF94.7ED3@hun.org>
Message-ID: 



At 9:21 AM -0700 10/27/97, Attila T. Hun wrote:

>October 27, 1997
>Woman in Standoff Shoots at Police
>Filed at 10:12 a.m.  EST
>By The Associated Press
>
>ROBY, Ill.  (AP) -- Gunfire rang out again at the home of a woman
>involved in a month-long standoff with authorities who have a
>court order to bring her in for psychological testing.
...

Not really "Tim's worse nightmare..."

Besides, you folks ought to see the latest self-protection gizmo, which I
just bought at the San Jose Gun Show. An Olympic Arms OA-96 pistol, firing
30 rounds of .223. Basically an AR-15 with a barrel cut down to about 6
inches, a pistol grip, and a few other changes. (Sadly, the 30-round
magazine is welded in place, to comply with the letter of the law on
"assault guns.")

I needed something for answering the door in an era where the Bad Guys
routinely wear body armor sufficient to stop handgun rounds (.45, 9mm, .40,
and sometimes even .44 Magnum). My existing AR-15 and other .223 rifles
(5.56mm, in metric/NATO) will of course punch right through any feasible
body armor now being sold, but bringing such rifles up to bear in a doorway
is tough. Hence the market for .223-based machine pistols.

(The guy who sold it to me says he's been selling quite a few of these to
police SWAT "entry teams." Entry teams, for those of you not in the know,
are the folks wearning black ninja suits and body armor who break down
doors and spray everything inside with submachines guns--usually things
like H&K MP5s. Apparently they're feeling the need to move from handgun
calibers to .223.)

These new assault pistols are already being marked for eventual outlawing,
which is why I was in kind of a hurry to get one.

Ironically, I live up on top of a ridge, about 500 feet above the valley
floor below me, with three sides almost impossible to conventional entry
methods. So, if there's a "Ruby Ridge" or "Roby Ridge" at my place, the
dynamics will be quite different.

(Yes, besides my "readiness to hand" weapons, I also have some long-range,
scope-equipped weapons.)

Only in America.....

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From stewarts at ix.netcom.com  Mon Oct 27 10:12:41 1997
From: stewarts at ix.netcom.com (stewarts at ix.netcom.com)
Date: Tue, 28 Oct 1997 02:12:41 +0800
Subject: Laws recognizing digital signatures
In-Reply-To: 
Message-ID: <3.0.3.32.19971026204052.006b547c@popd.ix.netcom.com>



At 09:24 AM 10/23/1997 -0400, Vincent Cate wrote:
>I have talked to people in government and the offshore private sector here
>and think Anguilla has a very good chance of passing a law making digital
>signatures legally recognized, at least for corporations.  I think we
>would be the first taxhaven to do so.  Currently companies use corporate
>seals. [....]
>I mentioned that there were a few other jurisdictions that had passed some
>laws like this and they would like me to try to pin down which and, if
>possible, get copies of the laws. 

Cem Kaner  gave a good presentation on the legal climate 
surrounding digital signatures at is month's Cypherpunks meeting.  
There's a lot of bad legislation being proposed in various UN and US 
working groups, where "bad" includes "inflexible" and 
"favoring specific models of what a signature means" and 
"favoring the certificate authority rather than the merchant or customer
in a transaction using certified signatures" and
"limiting who can be a CA, possibly including licensing".
He's got information available at www.kaner.com and www.badsoftware.com.
You might also want to talk to Carl Ellison about his views on signatures.

The basic problem is 
- Person Alice may have a key
- Merchant Bob has an online store
- Customer X presents Bob with a key K, certified by CA Charlie,
	claiming that she's Alice, K is Alice's key,
	and downloads the merchandise from Bob.
- Alice says it wasn't her and refuses to pay Bob the bill.

So who gets stuck with the bill?  Alice?  Bob?  Charlie?
In most commercial transactions, there's a legal tradition that defines
the liability when a signature is misused or a transaction fails badly.  
With forged checks or counterfeit Federal Reserve notes, the merchant loses.
With checks written against insufficient funds, Alice is liable,
though if she doesn't have any money to collect, the merchant still loses.
With credit cards in the US, the credit card company is liable to the merchant,
whether the credit card was stolen or Alice doesn't pay; in case of theft
Alice is liable to the credit card company for $50, but it's not Bob's problem.
This is a benefit to the merchant, since he can almost always accept a payment
and make a sale, and it's a benefit to the consumer, because the merchant
will accept her payment so she can get her stuff, and it's a big pain to the
credit card companies, who lose a lot of money to fraud every year, though
of course their fee to the merchant includes that cost, as does the merchant's
price to the consumer which is higher to cover the credit card fees.

In most of the new digital signature legislation, it's being pushed by the
Certificate Authority companies, who want to make sure they're not liable,
and who generally want to stick the consumer Alice with the bill,
since it's her fault if she let her public key get misused.
Not only is consumer getting the short end of the stick on these laws,
which is Cem's interest in this topic, but so is the merchant,
because if Alice is liable, he's got to collect from her if he can;
Cem is surprised that the Sears Roebuck and similar large merchant types
haven't been actively participating in these meetings.

>From a Cypherpunks and PGP perspective, there are a bunch of problems here.
One is "what does a signature mean, and how do we represent it",
which sidetracked much of the discussion during Cem's talk.
Another is that there's a preference toward a hierarchical model of CAs,
rather than the everybody's-a-CA web-of-trust model used by PGP;
in particular, regulations on digital signatures often require CAs
to meet some set of licensing requirements, which would mean you couldn't
sign anybody's key without a license, or at least without acquiring some
liability for how they used it.  (Then of course, once CAs are licensed and
findable, they're a regulatory target - even if you can't force them to
escrow their users' keys, you can at least use them for traffic analysis,
especially if you're using certificate revocation lists.)

An entertaining problem Cem also brought up is that if he doesn't
get his keys signed by anyone, they're just keys, and mean whatever
he agrees contractually with his clients that they mean.
On the other hand, if he gets his keys signed by someone,
there's some definition of liability that may obtain from that action,
not only based on the contracts he makes with the CA, but potentially
on any regulations on CAs and digital signatures that get adopted.
				Thanks! 		Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639
[I'm currently having hardware problems with my main email; 
send Cc: billstewart at att.com if you need to reach me in a hurry.]






From FisherM at exch1.indy.tce.com  Mon Oct 27 10:21:15 1997
From: FisherM at exch1.indy.tce.com (Fisher Mark)
Date: Tue, 28 Oct 1997 02:21:15 +0800
Subject: PGP Employee on MKR
Message-ID: <2328C77FF9F2D011AE970000F84104A74933DB@indyexch_fddi.indy.tce.com>



Harka wrote:
>The "just don't work for them if 'ya don't like it"-argument  will
>last about 4 weeks...the approximate time a human can survive
>without eating. (or a couple of weeks less, if you have kids)
>
>I.e. unless you are the super-duper, three-times nobel-prize-winner
>(with lots of money in stocks), who can AFFORD to choose employers
>that freely, you will be DAMN GLAD to have a job AT ALL, regardless
>of their policies!

Start your own business.  It will take sacrifice, but it can be done.
It doesn't even need to be in your day-job profession, for that matter
-- of the 4 start-ups I've been in, the biggest crash-and-burn was in
the computer business (I seem to think mainly like a "practical
researcher" rather than a businessperson when it comes to computers...).

One of her problems is that teaching is basically a monopoly profession
(a fact we are dealing with in our own family) -- there is no second,
third etc. public school system as an employer.  Another is that she is
living in the confines of New York City, although I would think there
should be places within 60 miles of her ex-husband where the cost of
living should be significantly less.  (In the Indianapolis area, she
could be buying a house on her income -- maybe through a contract sale
by owner rather than through the more common "Realtor" scenario, but
buying a house nonetheless.)

"Chance favors only the prepared mind", Louis Pasteur once said -- we
took advantage of a new local trend 2 years ago, got a guaranteed sale
on our large house (2300 sq.ft. with basement), went to a small house
(1600 sq.ft. without basement), using the money left over to develop
some ground.  (All while helping my mother-in-law cope after my
father-in-law's death.)  There are opportunities out there -- you just
have to look for them.  They may take a lot of your time (so I advise
looking for opportunities that you don't mind or even like exercising at
10pm at night after working a day job and caring for your children), but
they do exist.
==========================================================
Mark Leighton Fisher          Thomson Consumer Electronics
fisherm at indy.tce.com          Indianapolis, IN
"Their walls are built of cannon balls, their motto is
'Don't Tread on Me'"






From stewarts at ix.netcom.com  Mon Oct 27 10:28:15 1997
From: stewarts at ix.netcom.com (stewarts at ix.netcom.com)
Date: Tue, 28 Oct 1997 02:28:15 +0800
Subject: DEA trying to subpoena book dealers
Message-ID: <3.0.3.32.19971027084119.006bf4fc@popd.ix.netcom.com>



Heard on the radio this morning that a book publisher in Berkeley
received a subpoena from the DEA (not from a judge, from a DEA agent...)
requesting information on everybody in Arizona who bought their
book on marijuana hydroponics.  The publisher declined to cooperate,
and there was a nice First Amendment riff from the reporter about it.
Their name sounded like Ronin Press.  A book store in Tempe also received
a subpoena for names of everyone who'd bought the book.

Cypherpunks relevance?  Will web publishers get the same treatment?
Will corporations running Corporate Message Recovery get requests
for email sent to their sales addresses?  How many of them will comply
rather than noticing the bogosity of the subpoena?  On the other hand,
at least with CMR, companies can set decide how much information to keep,
and this sort of abuse may encourage them to limit their use of it.
				Thanks! 		Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639
[I'm currently having hardware problems with my main email; 
send Cc: billstewart at att.com if you need to reach me in a hurry.]






From orchardshop at juno.com  Tue Oct 28 02:29:25 1997
From: orchardshop at juno.com (orchardshop at juno.com)
Date: Tue, 28 Oct 1997 02:29:25 -0800 (PST)
Subject: YOU ARE NOT SAFE !!!
Message-ID: <199710280959.EAA18846@bmg.bmg.com>


XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Did you know that each year 51 out of every 1000 Americans are the victim of
violent crime?   That's a 1 in 20 chance of YOU being attacked THIS YEAR!  If
you're like me, you don't like those odds.

There are over 2.6 million burglaries in the U.S. every year.  The scary
fact of the matter is that it doesn't always happen to the "other guy."  If
you don't take the proper precautions it could happen to you.

That's where our new report "Personal Security Basics" comes in.  This unique
report gives you a hands on, common sense approach to protecting yourself,
your family, and your assets.

The cost of this report is just $4.95 with nothing more to buy....ever.  It
even comes with a money back guarantee!  This report shares little known
criminal techniques....and how to protect yourself against them.  It also
shows you how a criminal identifies you as a prospective victim.  

For a free sample of the type of information you will find in this report, as
well as ordering information click here--> Be Safe and Protect Your Assets! 

This is not a scam to join a multi level marketing plan, you will not be
added to any list.  It is simply an opportunity for you to protect yourself
and your family from a world with an ever increasing crime rate.  
For only $4.95...can you afford NOT to be safe?

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX






From aba at dcs.ex.ac.uk  Mon Oct 27 10:33:38 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Tue, 28 Oct 1997 02:33:38 +0800
Subject: [NEW] mixer@htp.org (was: List of reliable remailers)
In-Reply-To: <199710271621.BAA31069@ns.barrier-free.co.jp>
Message-ID: <199710271825.SAA02741@server.test.net>




Tsuyoshi Hayashi  writes:
> 
> Please add mixer at htp.org, the first public remailer in
> Japan, was setup by a member of cypherpunks-j.
> 
> mixer at htp.org is probably:
> 
>   $remailer{"mixer"} = " cpunk mix pgp";

Congrats on starting a remailer in a new jurisdiction!

Lots of jurisdictions on long chains is very useful because the
attacker must break all of them, and the more different jurisdictions
the more expensive and politically difficult it is for the attacker to
compromise the whole chain.

Jurisdiction shopping is good, too -- wonder what Japan offers as a
jurisdiction opportunity -- are there things legal in Japan which are
not legal in Europe, or US?

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0




THE V CHIP, COMING TO A COMPUTER NEAR YOU

Time Magazine
November 3, 1997
Page 36

If you hated the idea of a V chip in your television,
wait until you hear that the government wants to
install one in your computer. TIME has learned that
the FCC has proposed that new PCs be outfitted with a
V chip to filter out video violence and sex. Still
unclear is what Net broadcasts could be affected. The
idea alarms free-speech advocates, who wonder why
Americans need a Net-nanny. "What you get is a
devolution of the First Amendment," argues lawyer Bob
Corn-Revere. FCC chairman REED HUNDT says the
high-tech industry can "be part of the process" as the
agency sets rules. There's a low-tech alternative: the
off switch.

--By Declan McCullagh/Washington

**********

For details check out the Netly News (netlynews.com) at:

  http://cgi.pathfinder.com/netly/opinion/0,1042,1528,00.html

-Declan








From aba at dcs.ex.ac.uk  Mon Oct 27 10:34:46 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Tue, 28 Oct 1997 02:34:46 +0800
Subject: Technical Description of PGP 5.5
In-Reply-To: <19971027063955.64669@bywater.songbird.com>
Message-ID: <199710271820.SAA02733@server.test.net>




Kent Crispin  writes:
> Given the frequency of "I've forgotten my password" incidents at
> company help desks, widespread use of cryptography would cause this to
> become *the* prime cause of lost data.

pgp5.5 doesn't cope with this very well -- it requires all of the
stored emails to be decrypted by the holder of the recovery key and
re-encrypted to the users new key.  Same thing for tape archives,
write once CD archives, etc., etc.

Password memory lapses are likely to be the major problem.

It would suggest that smart cards might be a valuable ergonomics
investment.  I understand dumb card readers are dirt cheap (~$10 in
volume) and can be plugged inline into keyboard cables.  Reckon you
could swallow the cost in the product price even ($159 or whatever the
business edition is).

> The physical mail analogy to PGP's implementation of CMR is as 
> follows:  Company policy is that it does not accept private pmail for 
> individuals.  All mail for individuals must be addressed
> 
> XYZ Company
> attn: Indi Vidual
> Address1
> Address2
> 
> Mail addressed like this:
> 
> Indi Vidual
> Address1
> Address2
> 
> will be returned, because the company doesn't accept private mail.  
> Company mail is to be used for company business.  You don't receive 
> Playboy at work, you receive it at home.

Reasonable analogy of what's going on wrt strictly company use
addresses, and with companies which may allow private use addresses.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



Tim May wrote:
>I'm quite certain that the Security and MIS directors at various
companies
>asked PGP, Inc. to include message recovery features. Not so much to
handle
>the very rare (almost nonexistent) cases where a piece of mail sent at
some
>time in the past has to be recovered because Alice was hit by a truck,
or
>similiar unlikely events (*), but because Security and MIS folks would
like
>the option of "monitoring" e-mail traffic.

As someone who has witnessed recovering email (the icky task fell to
someone else), I can tell you it's not a pretty sight.  Employees leave,
sometimes under a cloud (sometimes under several tornadoes worth of bad
weather), sometimes people are assigned overseas, etc. -- sometimes file
recoveries need to be done, which implies that there may have been
encryption used on those files.  CDR (IMHO) would allow for these kind
of recoveries without compromising the security of the data en-route.
Personally, I would prefer a CDR system that did _not_ encrypt the
stored plaintext, just because that simplifies matters while also
preventing use of CDR for GAK, as there are _no_ general organization
keys for the government to desire.  Nothing prevents the employee from
encrypting the "recovery file" anyway, which should be done if the
information is "sensitive but unclassified" (like company financial data
that should only be viewable by the employees responsible for that
data).  (This should be done in most companies because any computer kept
at the desktop is inherently insecure.)  (Handling disk/file encryption
keys in a corporate setting is a separate matter.)

The ability to recover important documents is what _I_ want as an IS
member -- and CMR isn't the best way to do it.

(Personally, if IS has time to monitor everyone's email, I think they
are *way* overstaffed...)
==========================================================
Mark Leighton Fisher          Thomson Consumer Electronics
fisherm at indy.tce.com          Indianapolis, IN
"Their walls are built of cannon balls, their motto is
'Don't Tread on Me'"






From nobody at REPLAY.COM  Mon Oct 27 11:27:23 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Tue, 28 Oct 1997 03:27:23 +0800
Subject: Tim's worst nightmare
Message-ID: <199710271918.UAA22699@basement.replay.com>



 > Woman in Standoff Shoots at Police
 > Filed at 10:12 a.m.  EST
 > By The Associated Press

 > ROBY, Ill.  (AP) -- Gunfire rang out again at the home of a
 > woman involved in a month-long standoff with authorities who
 > have a court order to bring her in for psychological testing.


Just imagine a few hundred (or thousand) people getting together in
Roby, Ill., defying the police-ordered half mile ban around her
house and sitting down peacefully between her and the police...






From tcmay at got.net  Mon Oct 27 11:36:16 1997
From: tcmay at got.net (Tim May)
Date: Tue, 28 Oct 1997 03:36:16 +0800
Subject: DEA trying to subpoena book dealers
In-Reply-To: <3.0.3.32.19971027084119.006bf4fc@popd.ix.netcom.com>
Message-ID: 



At 9:41 AM -0700 10/27/97, stewarts at ix.netcom.com wrote:
>Heard on the radio this morning that a book publisher in Berkeley
>received a subpoena from the DEA (not from a judge, from a DEA agent...)
>requesting information on everybody in Arizona who bought their
>book on marijuana hydroponics.  The publisher declined to cooperate,
>and there was a nice First Amendment riff from the reporter about it.
>Their name sounded like Ronin Press.  A book store in Tempe also received
>a subpoena for names of everyone who'd bought the book.

At the Gun Show I was at yesterday, a book dealer (who deals only in cash,
not checks and not credit cards, and who has no interest in keeping names
of customers in any kind of file) said that law enforcement often wanders
around the tables at the gun show, asking about the books on making C-4
explosives, making silencers for guns, growing dope, making
methamphetamines, rigging booby traps, etc. This is why most of the dealers
operate on a cash-and-carry basis. I don't know if any of the dealers have
yielded to pressures to give up lists of customers, but I suspect most of
them haven't. And cash makes it tough.

(This is, ObCrypto, why true 2-way untraceability is needed for ecash
systems. When Chaum speaks of only 1-way untraceability (protecting the
buyer from surveillance) being needed, he neglects the cases where law
enforcement busts a _seller_.  For online transactions, this is a very real
issue. Suppliers of the above-type information, but also suppliers of birth
control information, abortion info, controversial material, pornography,
etc. Chaum conceded these points, and said he'd think about how sellers
could be protected in his latest scheme.)

By the way, most of these books are of a far more accurate, it appears,
quality than that found in the usual book cited, "The Anarchist Cookbook."
That book was most probably a CIA disinformation work, designed to blow up
some would-be bombmakers. Sort of like "think of it as evolution in action."

The dealer I bought $150 worth of books and pamphlets from had a sign
saying "This ain't Barnes and Noble." Indeed.

As for plant cultivation, I'm sure we all recall the cases where DEA SWAT
teams have raided homes because some electric company report gave the DEA
some suspicion that grow lamps were being used. (In a lot of these raids,
there are "side effects" of the residents being sprayed with small arms
fire. "Whoops." Even more embarassing when no grow lamps are found.
"Whoops." So much for the Fourth Amendment, which was gutted more than 70
years ago during the First War on Drugs.)



>Cypherpunks relevance?  Will web publishers get the same treatment?
>Will corporations running Corporate Message Recovery get requests
>for email sent to their sales addresses?  How many of them will comply
>rather than noticing the bogosity of the subpoena?  On the other hand,
>at least with CMR, companies can set decide how much information to keep,
>and this sort of abuse may encourage them to limit their use of it.

Though it's more likely with CMR deployed for companies to be _instructed_
by the FTC, SEC, OSHA, IRS, etc., _not_ to delete messages from their CMR
archives. In fact, I'll bet that if CMR is widely deployed in corporate
America that various regulatory agencies will publish standards (like
Accounting standards) for how such CMR archives are to be handled.

Altering CMR archives will be treated akin to shredding files, which most
companies are now disincentivized from doing.

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From tcmay at got.net  Mon Oct 27 11:57:27 1997
From: tcmay at got.net (Tim May)
Date: Tue, 28 Oct 1997 03:57:27 +0800
Subject: Tim's worst nightmare
In-Reply-To: <199710271918.UAA22699@basement.replay.com>
Message-ID: 



At 12:18 PM -0700 10/27/97, Anonymous wrote:
> > Woman in Standoff Shoots at Police
> > Filed at 10:12 a.m.  EST
> > By The Associated Press
>
> > ROBY, Ill.  (AP) -- Gunfire rang out again at the home of a
> > woman involved in a month-long standoff with authorities who
> > have a court order to bring her in for psychological testing.
>
>
>Just imagine a few hundred (or thousand) people getting together in
>Roby, Ill., defying the police-ordered half mile ban around her
>house and sitting down peacefully between her and the police...

Such persons are called "cannon fodder."

Not too far from me, some dumb shit antiwar protestor decided to practice a
Gandhi-style protest of munitions shipments by train. So he sat down on the
tracks near the Concord Naval Weapons Station.

Chop, chop, off went the legs.

He now, having somehow survived this moral victory, campaigns for more
statist laws forcing private businesses to provide ramps and elevators for
cripples.

--Tim May



The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From jim.burnes at ssds.com  Mon Oct 27 12:06:37 1997
From: jim.burnes at ssds.com (Jim Burnes)
Date: Tue, 28 Oct 1997 04:06:37 +0800
Subject: DEA trying to subpoena book dealers
In-Reply-To: 
Message-ID: 



On Mon, 27 Oct 1997, Tim May wrote:

> At 9:41 AM -0700 10/27/97, stewarts at ix.netcom.com wrote:
> >Heard on the radio this morning that a book publisher in Berkeley
> >received a subpoena from the DEA (not from a judge, from a DEA agent...)
etc....
> The dealer I bought $150 worth of books and pamphlets from had a sign
> saying "This ain't Barnes and Noble." Indeed.
> 
> As for plant cultivation, I'm sure we all recall the cases where DEA SWAT
> teams have raided homes because some electric company report gave the DEA
> some suspicion that grow lamps were being used. (In a lot of these raids,
> there are "side effects" of the residents being sprayed with small arms
> fire. "Whoops." Even more embarassing when no grow lamps are found.
> "Whoops." So much for the Fourth Amendment, which was gutted more than 70
> years ago during the First War on Drugs.)

That wouldn't be the Donald Scott case, would it?  I'm so suprised at
you, Tim.  The local prosecutor said they "lost their moral compass".
The poor men! Now go back home, fill out your 1040 and shuddup.  ;-)

Maybe someone will eventually voluteer to go find their moral compass
for them.

> The Feds have shown their hand: they want a ban on domestic cryptography

the feds want a ban on cryptography
some people want a cryptographic ban on the feds

have a better one,

jvb






From harka at nycmetro.com  Mon Oct 27 12:11:22 1997
From: harka at nycmetro.com (harka at nycmetro.com)
Date: Tue, 28 Oct 1997 04:11:22 +0800
Subject: [NEW] mixer@htp.org (
Message-ID: <199710272003.OAA05300@einstein.ssz.com>



-----BEGIN PGP SIGNED MESSAGE-----

 > Tsuyoshi Hayashi  writes:
 >
 > Please add mixer at htp.org, the first public remailer in Japan,
 > was setup by a member of cypherpunks-j.
 >
 > mixer at htp.org is probably:
 >
 >   $remailer{"mixer"} = " cpunk mix pgp";


Congrats for the new remailer and a related question: Are the
cypherpunks-e and cypherpunks-j lists now fully included into the
list-distribution from and to the other three nodes?
(The last thing I can recall was, that there were still some
problems with the distribution)

Ciao

Harka

... "Use a Cipher - Be Free!"

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAgUBNFTydTltEBIEF0MBAQE4Igf+L6+JAkmntV4rNalAU63f2nYtxWW0Fvpl
EK4IrKyVEAHRsduvanzoTdHlrn46ZIc5lzyUgUcEiBmPxWUyAqNrWAPyWkYGdBkW
NlyXzoXrNk/cY4CsU9h9FmrIxW1fCoF6vc5JPm7fCpEweQqwAP4zE5zlCL4U1/Ny
/+kYEIH5hhL5L1DHmNNLWVMcdP2JYU8Q1M6mYWf0y92fnCZfPY0mW7G5U5ONJqVR
XrUlVMm4PD2TsUXmgKLTSqu24t82fNVgJ3U/bSDQGhA/Hx+B+hwuBvSBSF9XAO4G
lUg8dzraUaGOrcChLwVv/ChBueBedxol+vpItsz2FIJE0sPTEpTpIQ==
=XGoj
-----END PGP SIGNATURE-----


If encryption is outlawed, only outlaws will have encryption...






From lutz at belenus.iks-jena.de  Mon Oct 27 12:11:55 1997
From: lutz at belenus.iks-jena.de (Lutz Donnerhacke)
Date: Tue, 28 Oct 1997 04:11:55 +0800
Subject: Laws recognizing digital signatures
In-Reply-To: <3.0.3.32.19971026204052.006b547c@popd.ix.netcom.com>
Message-ID: 



* stewarts at ix.netcom.com wrote:
>The basic problem is 
>- Person Alice may have a key
>- Merchant Bob has an online store
>- Customer X presents Bob with a key K, certified by CA Charlie,
>	claiming that she's Alice, K is Alice's key,
>	and downloads the merchandise from Bob.
>- Alice says it wasn't her and refuses to pay Bob the bill.
>
>So who gets stuck with the bill?  Alice?  Bob?  Charlie?

Bob asks Charlie, who is really behind K. Charlie must be able to point to
Alice. If he can't do that, Bob will sue him. (Like any customer fooled by a
McLain control signed and certified by Verisign, which revoke the
certificate due to a request from Microsoft.)

Alice is responsible for her key K. If X can fool Bob, he has access to the
secret part of K, so the problem goes to Alice. Alice can inform Charlie for
revoking the certificate. If she did this, the problem went to Charlie. If
he updated his public database, the problem went to Bob. If Bob did non
check nor get a real timestamp (I.e. eternity logfile), he has lost.
Otherwise he lost, because he knew, that Alice's key was comprimised before
delivery.






From eli at gs160.sp.cs.cmu.edu  Mon Oct 27 12:20:29 1997
From: eli at gs160.sp.cs.cmu.edu (Eli Brandt)
Date: Tue, 28 Oct 1997 04:20:29 +0800
Subject: FCPUNX:puff pieces vs tough crypto issues (Re: Singapore TOILET
In-Reply-To: <199710271900.OAA26708@beast.brainlink.com>
Message-ID: <199710271947.LAA15435@toad.com>



Declan McCullagh wrote:
> >From my perch in Washington, I see PGP 5.5/CMR as an existence proof that
> key recovery can be done. So far the crypto-advocates have been able to
> wave around the Blaze et al white paper that says we don't know how to do
> it. Even Dorothy Denning agreed. But now when a mandatory GAK bill goes to
> the House floor, all Rep. Solomon etc. have to do is wave around a
> shrinkwrapped copy of PGP and say: "I bought this for $19 at the Egghead
> shop at 21st and L." Details will be lost in the fearmongering.

Key detail lost: what the white paper says is that we don't know how
to do it *right*.

-- 
     Eli Brandt  |  eli+ at cs.cmu.edu  |  http://www.cs.cmu.edu/~eli/






From raph at acm.org  Mon Oct 27 12:32:43 1997
From: raph at acm.org (Raph Levien)
Date: Tue, 28 Oct 1997 04:32:43 +0800
Subject: [NEW] mixer@htp.org (was: List of reliable remailers)
In-Reply-To: <199710271621.BAA31069@ns.barrier-free.co.jp>
Message-ID: 





On Tue, 28 Oct 1997, Hayashi_Tsuyoshi wrote:

> # Sorry if dup.
> 
> Dear Raph Levien,
> 
> This is Tsuyoshi Hayashi, lives in Yokohama, Japan.
> 
> On Mon, 27 Oct 1997 06:50:08 -0800, Raph Levien said:
>  >   I operate a remailer pinging service which collects detailed
>  >information about remailer features and reliability.
> [..]
> 
> Please add mixer at htp.org, the first public remailer in
> Japan, was setup by a member of cypherpunks-j.
> 
> # it is not me.
> 
>  >$remailer{'cyber'} = ' alpha pgp';
>  >$remailer{"mix"} = " cpunk mix pgp hash latent cut ek ksub reord ?";
> [..]
> 
> mixer at htp.org is probably:
> 
>   $remailer{"mixer"} = " cpunk mix pgp";
> 
> Please add this record to your check list.

Hi. I am aware of this remailer and am very happy to see one started in 
Japan. However, I am having a little problem adding it to the list 
because the Type-1 side of the remailer uses PGP 5.0, causing some 
compatibility problems with the remailer list software, which is based on 
PGP 2.6.2. Hopefully I can resolve these problems soon and add the remailer.

Thanks for your interest!

Raph






From gbroiles at netbox.com  Mon Oct 27 13:28:51 1997
From: gbroiles at netbox.com (Greg Broiles)
Date: Tue, 28 Oct 1997 05:28:51 +0800
Subject: key recovery meeting/demonstration in DC, 11/5
Message-ID: <199710272113.NAA01177@ideath.parrhesia.com>



	�������
See ; there's going to be a meeting
discussing key recovery technology and legislation in Washington, D.C. on
November 5. I don't really have time to track down the organizational
pedigree of "GITS" (Government Information Technology Services), the
institution organizing the conference, but they've got space on the Dept of
Treasury's web server. The meeting features, among other folks, William
Reinsch, undersecretary at the Dept of Commerce, and an unnamed luncheon
speaker who will discuss the future of KR legislation. The cost is $100,
and they want you to register by today. Am unsure how easy it'd be to crash
the conference - it's at the Omni Shoreham Hotel.

The web page features plenty of obfuscation/confusion which tries to link
KR technology with encryption/security technology, suggesting that a
combination of the two (or merely the former) is required to allow
widespread use of the Internet for commerce and data transfer. 

If anyone happens to attend, I imagine that list subscribers would be
interested in a summary of the comments, etc.

--
Greg Broiles                | US crypto export control policy in a nutshell:
gbroiles at netbox.com         | Export jobs, not crypto.
http://www.io.com/~gbroiles | http://www.parrhesia.com






From tcmay at got.net  Mon Oct 27 13:29:43 1997
From: tcmay at got.net (Tim May)
Date: Tue, 28 Oct 1997 05:29:43 +0800
Subject: "I have in my hand a working message recovery system"
In-Reply-To: <199710271900.OAA26708@beast.brainlink.com>
Message-ID: 




(I've changed the thread name to "I have in my hand a working message
recovery system." Some of you may know what this is a reference to.)

At 12:47 PM -0700 10/27/97, Eli Brandt wrote:
>Declan McCullagh wrote:
>> >From my perch in Washington, I see PGP 5.5/CMR as an existence proof that
>> key recovery can be done. So far the crypto-advocates have been able to
>> wave around the Blaze et al white paper that says we don't know how to do
>> it. Even Dorothy Denning agreed. But now when a mandatory GAK bill goes to
>> the House floor, all Rep. Solomon etc. have to do is wave around a
>> shrinkwrapped copy of PGP and say: "I bought this for $19 at the Egghead
>> shop at 21st and L." Details will be lost in the fearmongering.
>
>Key detail lost: what the white paper says is that we don't know how
>to do it *right*.

Agreed, but this is just the kind of "detail" Congress is already so good
at ignoring.

Declan is right, that Congress will hold PGP 5.5 and its CMR and "Policy
Manager" up and will say, "See, even industry is demanding message
recovery. And here's a program that already does it."

Granted, CMR will not meet FBI requirements for real-time access, and will
not meet SIGIN/COMINT wishes for surveillance-friendly systems, but it's a
start.

I'll bet, as I said in a post a few hours ago, that if CMR is widely
adopted, that various regulatory agencies like the FTC, SEC, OSHA, etc.,
will begin to impose rules about how and where CMR archives are stored....

Then the battle will be 80% over.

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From tcmay at got.net  Mon Oct 27 13:45:27 1997
From: tcmay at got.net (Tim May)
Date: Tue, 28 Oct 1997 05:45:27 +0800
Subject: DEA trying to subpoena book dealers
In-Reply-To: 
Message-ID: 



At 1:53 PM -0700 10/27/97, Jim Burnes wrote:
>On Mon, 27 Oct 1997, Tim May wrote:

>> As for plant cultivation, I'm sure we all recall the cases where DEA SWAT
>> teams have raided homes because some electric company report gave the DEA
>> some suspicion that grow lamps were being used. (In a lot of these raids,
>> there are "side effects" of the residents being sprayed with small arms
>> fire. "Whoops." Even more embarassing when no grow lamps are found.
>> "Whoops." So much for the Fourth Amendment, which was gutted more than 70
>> years ago during the First War on Drugs.)
>
>That wouldn't be the Donald Scott case, would it?  I'm so suprised at
>you, Tim.  The local prosecutor said they "lost their moral compass".
>The poor men! Now go back home, fill out your 1040 and shuddup.  ;-)
>

Donald Scott, of Malibu, was one of these examples.

For those who don't know the story, he was a retired medical doctor, living
with his wife on a farm or ranchette of some sort on the Malibu coast,
adjacent to some L.A. County public or park lands. Environmentalist groups
had been trying to get him to sell his land cheaply, or donate it, to the
parklands system.

The LA County Sheriff's Office apparently took a close look at his land, to
see if there was any way they could force him to sell.  As I recall the
story (a Web search will reveal more), they found a snitch who said Donald
Scott was growing pot on his property. Aerial surveys were inconclusive.

They raided his home, hoping to find drugs and thus seize the property
under the civil forfeiture laws, then sell the property to the parklands
system and realized a nice profit. (The civil forfeiture laws work like the
"letters of marque and reprisal" system the freebooters had: those doing
the raiding get to keep the profits from their raids. This has become a
major revenue generator. See old episodes of "Miami Vice" for details on
how this works.)

Anyway, in the predawn hours the raider ninjas burst into Scott's home. No
polite knocks on the door. (As if he could have flushed his alleged
marijuana plants down the toilet.)

Scott saw the intruders burst into his bedroom, reached for a gun from his
night stand, and was sprayed with 9mms. His wife survived.

No marijuana plants were found. No drugs were found. Probably not even any
Paladin Press books.

If there were justice in America, those who did the raiding would be tried,
found guilty of capital murder, and sent to the gas chamber at San Quentin.

But they won't be. "We lost our moral compass" is the most that will come
out of this. Oh, and more laws making it illegal for sheep-units to have
guns to defend themselves.

And so it goes. This is why I have 3000 rounds of .223 stashed away, and
several loaded weapons readily available. And an early warning system in
case the night ninjas decide my house needs to be raided before dawn.


--Tim May



The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From gs at dev.null  Mon Oct 27 13:48:50 1997
From: gs at dev.null (George Spelvin)
Date: Tue, 28 Oct 1997 05:48:50 +0800
Subject: Fucking Minors / Re: NABMLA embattled -- mirror sites?
In-Reply-To: <34550336.162A@dev.null>
Message-ID: <34550789.259A@dev.null>



Human Gus-Peter wrote:
> Anonymous wrote:
> > I'm not sure the right to free speech includes the right to endorse guys
> > fucking little boys, whether they give it a moniker like "transgenerational
> > love" or not. Any sex with a minor is rape, since they can't legally give
> > consent.
> 
> That's right. People who are too lazy to drive a fourteen year old
> to New Mexico, where they can legally fuck their brains out, should
> go to jail for a long, long time.
> When I cruise the children's chat lines, I always tell them I would
> like to meet them in New Mexico and fuck their brains out. That's
> legal.

  I consider this issue so important that I thought it appropriate
to reply to it even before it arrived at the Cypherpunks mailing
list.
  I believe that people should be required by law to provide not
only their true identity when using the Internet for communications,
but should also be required to provide their true physical location,
so that law enforcement agencies will know whether what they are
writing is legal or illegal in the state from which they are 
sending the communication.
 
> What I love about the law is that it gives us clear guidelines to
> help us recognize the difference between those filthy fucking
> child-molesting perverts fucking fourteen year olds in California,
> and the decent, upstanding citizens fucking the fourteen year
> olds in New Mexico.

  Amen!
 
> God Bless America,
> LegallyFuckingFourteenYearOldsMonger

George Spelvin
"Legally fucking Eighteen Year Olds in California."






From die at pig.die.com  Mon Oct 27 14:00:39 1997
From: die at pig.die.com (Dave Emery)
Date: Tue, 28 Oct 1997 06:00:39 +0800
Subject: DEA trying to subpoena book dealers
In-Reply-To: <3.0.3.32.19971027084119.006bf4fc@popd.ix.netcom.com>
Message-ID: <19971027163457.17131@pig.die.com>



On Mon, Oct 27, 1997 at 11:04:34AM -0700, Tim May wrote:
> >a subpoena for names of everyone who'd bought the book.
> 
> At the Gun Show I was at yesterday, a book dealer (who deals only in cash,
> not checks and not credit cards, and who has no interest in keeping names
> of customers in any kind of file) said that law enforcement often wanders
> around the tables at the gun show, asking about the books on making C-4
> explosives, making silencers for guns, growing dope, making
> methamphetamines, rigging booby traps, etc. This is why most of the dealers
> operate on a cash-and-carry basis. I don't know if any of the dealers have
> yielded to pressures to give up lists of customers, but I suspect most of
> them haven't. And cash makes it tough.
> 
	Sadly, it appears that another catagory of hobby flea market is
soon to join this ever growing list.   A bill (HR2369) working its way through
the House bans the "manufacture, sale, distribution, modification,
import, export" of radio equipment such as scanners (but by no means
limited to scanners) that can be used for "unauthorized interception of
wireless communications" and provides 5 year jail terms and $500,000
fines for each individual sale.   While this may or may not seem just a
bit draconian to a privacy oriented group such as cypherpunks, it should
be noted that most ham radio equipment sold in the last 20 years covers
more than just ham bands, and almost all scanners (which have legitimate
and fully legal uses to monitor public safety and other wireless (radio)
communications without a legal expectation of privacy under the ECPA)
cover frequencies which would make them contraband under this proposed
law.  

	If passed, the traditional hamfest flea markets where all sorts
of bizzare old radio junk gets traded for cash or swapped for other
gear will be largely a thing of the past, as almost all radio receivers
and transcievers that hams and other electronic hackers might want to
sell or trade will be seriously illegal, and one never knows who that
anonymous cash customer really is...

	I guess the obligatory cypherpunk relevance is that if the NSA
hadn't pressured the cell industry, cell and cordless phones would be at
least minimally  encrypted and industry lobbiests would not be pushing
to make selling or buying simple used radio receivers more illegal than
forcible rape or armed robbery in many states.

	And of course if anyone doubts NSA's real motive, think of this.
They can monitor, under warrent from the secret FISL court, virtually
anything they want by intercepting the call at the MTSO switch using
those nice CALEA wiretap subroutines...  so why do they need to
discourage over the air encryption they can't trivially deal with ?  
Well think about all the intercepts in the USA of US citizen
communications done for the TLAs (NSA in particular) by foreign
intelligence operations (notably GCHQ but also others) - obviously
foreign governments have no standing under FISL and CALEA and cannot get
FISL authority to legally wiretap US citizens - so making sure that
encrypted US wireless communications can be broken by the Brits or
Canadians or others makes sure that the NSA can get those UKUSA partners
to provide them to NSA and US TLAs when it is politically inconveniant
or downright illegal for NSA to intercept them directly.

-- 
	Dave Emery N1PRE,  die at die.com  DIE Consulting, Weston, Mass. 
PGP fingerprint = 2047/4D7B08D1 DE 6E E1 CC 1F 1D 96 E2  5D 27 BD B0 24 88 C3 18






From nobody at REPLAY.COM  Mon Oct 27 14:04:39 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Tue, 28 Oct 1997 06:04:39 +0800
Subject: NABMLA embattled -- mirror sites?
Message-ID: <199710272113.WAA04739@basement.replay.com>



Anonymous wrote:

> I'm not sure the right to free speech includes the right to endorse guys
> fucking little boys, whether they give it a moniker like "transgenerational
> love" or not. Any sex with a minor is rape, since they can't legally give
> consent. 

That's right. People who are too lazy to drive a fourteen year old
to New Mexico, where they can legally fuck their brains out, should
go to jail for a long, long time.
When I cruise the children's chat lines, I always tell them I would
like to meet them in New Mexico and fuck their brains out. That's
legal.

What I love about the law is that it gives us clear guidelines to
help us recognize the difference between those filthy fucking
child-molesting perverts fucking fourteen year olds in California,
and the decent, upstanding citizens fucking the fourteen year
olds in New Mexico.

God Bless America,
LegallyFuckingFourteenYearOldsMonger






From nobody at REPLAY.COM  Mon Oct 27 14:11:28 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Tue, 28 Oct 1997 06:11:28 +0800
Subject: Fucking Minors / Re: NABMLA embattled -- mirror sites?
Message-ID: <199710272150.WAA08567@basement.replay.com>



George Spelvin wrote:
> Anonymous wrote:
> > That's right. People who are too lazy to drive a fourteen year old
> > to New Mexico, where they can legally fuck their brains out, should
> > go to jail for a long, long time.
 
>   I consider this issue so important that I thought it appropriate
> to reply to it even before it arrived at the Cypherpunks mailing
> list.

I would like to remind George Spelvin (if that is your  *real* name)
that is improper Netiquette to reply to your own anonymous posts
before they have even arrived to the mailing list to which they were
sent.
While the Mandatory/Voluntary Netiquette rules are unclear in regard
to those with psychic abilities responding to the posts of others
before they arrive at the mailing list, I am certain that the concept
is the same.

>   I believe that people should be required by law to provide not
> only their true identity when using the Internet for communications,
> but should also be required to provide their true physical location,
> so that law enforcement agencies will know whether what they are
> writing is legal or illegal in the state from which they are
> sending the communication.

  This is patently ridiculous!
  How do you know for certain that 'Anonymous' is not the person's
*real* name? And how do we know that Anonymous is not physically
*at* REPLAY.COM? Point to it on a map for me, why don't you?
  For that matter, how do we know that George Spelvin is *your*
real name? And how do we know if you are physically at dev.null?
  I think that others on the list will agree with me that your logic
is lame, and your arguments are ridiculous.
 
LegallyPullingMyOwnPudAtREPLAY.COMonger






From declan at well.com  Mon Oct 27 14:27:10 1997
From: declan at well.com (Declan McCullagh)
Date: Tue, 28 Oct 1997 06:27:10 +0800
Subject: key recovery meeting/demonstration in DC, 11/5
In-Reply-To: <199710272113.NAA01177@ideath.parrhesia.com>
Message-ID: 



At 13:17 -0800 10/27/97, Greg Broiles wrote:
>	       
>See ; there's going to be a meeting
>discussing key recovery technology and legislation in Washington, D.C. on
>November 5. I don't really have time to track down the organizational
>pedigree of "GITS" (Government Information Technology Services), the
>institution organizing the conference, but they've got space on the Dept of
>Treasury's web server. The meeting features, among other folks, William
>Reinsch, undersecretary at the Dept of Commerce, and an unnamed luncheon
>speaker who will discuss the future of KR legislation. The cost is $100,
>and they want you to register by today. Am unsure how easy it'd be to crash
>the conference - it's at the Omni Shoreham Hotel.

It could be possible. The hotel sprawls just enough. If anyone (I know, or
know of) from out of town is coming to the conference, you can stay with me
-- I live just a few blocks from the hotel.

-Declan







From danbaldi at tin.it  Mon Oct 27 14:32:28 1997
From: danbaldi at tin.it (daniele baldi)
Date: Tue, 28 Oct 1997 06:32:28 +0800
Subject: prova
Message-ID: <34551063.9F5EAD7D@tin.it>



Anon-Post-To: danbaldi at tin.it

daniele






From tm at dev.null  Mon Oct 27 14:33:06 1997
From: tm at dev.null (TruthMonger)
Date: Tue, 28 Oct 1997 06:33:06 +0800
Subject: Singaporean control freaks & CMR (Re: puff pieces vs tough crypto  issues)
In-Reply-To: <3.0.32.19971027025435.006b993c@cnw.com>
Message-ID: <3455151F.2D4B@dev.null>



Blanc wrote:
> Harish Pillay wrote:
> >I don't think the "micro management" is at it's worst in Singapore - not by
> >a long shot.  It is true that the Singapore government tries to do so and
> >in a lot of what they attempt, they somehow come out smelling roses.  But
> >they have goofed up royally as well.
> ...................................................................

> If you don't mind my asking in front of everybody, how do you stand it,
> living there?  Do you get very frustrated (it sounds as though you might),
> and want to leave for Anguilla?   Do you remind yourself not to litter with
> those gum wrappers you're not supposed to have anyway, what do you think
> when you're being incentivized to find a sexual partner and produce
> children, or to Do This and Not do That or risk painful punishments?  Do
> co-workers become critical of each other's petty "crimes", do you feel
> opressed all around, or is it not as bad as it seems from here?

Q: "Why do you beat your head against the wall?"
A: "Because it feels so good when I stop!"

Q: "Why don't you stop beating your head against the wall?"
A1: "It's illegal to stop."
A2: "It goes against tradition/religion/beliefs/society to stop."
A3: "I'll make less money if I stop."
A3: ...ad infinituum...

  I was going to speak my true mind about the Waco tragedy at work,
but I was coming up for a promotion...
  I was going to speak my true mind about the Waco tragedy at the PTA
meeting, but I didn't want it to look like I was supporting child 
molesters.
  I was going to speak my true mind about the Waco tragedy to my 
company bowling team, but most of them are rednecks.
  I was going to speak my true mind about the Waco tragedy to my spouse,
but she would tell her parents my views, and her father, the Sheriff,
is going to lend us the down-payment on a house.
  I was going to speak my true mind about the Waco tragedy to our
children, but they go to a very conservative school, and I don't want
them to rock the boat and destroy their future.
  I was going to speak my true mind about the Waco tragedy...

Q: "If 1984 was so terrible, why didn't Winston just move to another
year?
A: "Duuhhh..."

  "It may be a prison, but it's *MY* prison."
  "I'm thinking of painting the walls chartreuse, do you think it will 
go well with the scarlett bars on the window? (I had to take the bars
out of the windows to sand them, but I put them back in so that the
Warden won't cut off my exercise privileges.)"

TruthMonger






From declan at well.com  Mon Oct 27 14:46:53 1997
From: declan at well.com (Declan McCullagh)
Date: Tue, 28 Oct 1997 06:46:53 +0800
Subject: key recovery meeting/demonstration in DC, 11/5
In-Reply-To: <199710272113.NAA01177@ideath.parrhesia.com>
Message-ID: 



At 13:17 -0800 10/27/97, Greg Broiles wrote:
>See ; there's going to be a meeting
>discussing key recovery technology and legislation in Washington, D.C. on
>November 5. I don't really have time to track down the organizational
>pedigree of "GITS" (Government Information Technology Services), the
>institution organizing the conference, but they've got space on the Dept of
>Treasury's web server. The meeting features, among other folks, William
>Reinsch, undersecretary at the Dept of Commerce, and an unnamed luncheon
>speaker who will discuss the future of KR legislation. The cost is $100,
>and they want you to register by today.

Just spoke to the folks setting it up at (202) 986-0200. They're accepting
registrations up until the day of the conference. Breakfast speaker likely
to be Sen. Bob Kerrey. Luncheon speakers may be an IBM VP or Magaziner.

-Declan







From hgp at dev.null  Mon Oct 27 14:52:19 1997
From: hgp at dev.null (Human Gus-Peter)
Date: Tue, 28 Oct 1997 06:52:19 +0800
Subject: prova
In-Reply-To: <34551063.9F5EAD7D@tin.it>
Message-ID: <34551757.555E@dev.null>



Anon-To: danbaldi at tin.it
 
daniele has trouble reading the remailer instructions because
she has to peek around the huge horse cock she has in her
mouth






From bianca at dev.null  Mon Oct 27 15:20:23 1997
From: bianca at dev.null (Bianca)
Date: Tue, 28 Oct 1997 07:20:23 +0800
Subject: prova
In-Reply-To: <34551063.9F5EAD7D@tin.it>
Message-ID: <34551DF9.33FC@dev.null>



Human Gus-Peter wrote:
> 
> Anon-To: danbaldi at tin.it
> 
> daniele has trouble reading the remailer instructions because
> she has to peek around the huge horse cock she has in her
> mouth

There is supposed to be a '::' at the start for proper sintax.
(What is that in _*your*_ mouth, HG-P?)

Julia
ps you are going to be in big big trouble when your uncle gets back






From stewarts at ix.netcom.com  Mon Oct 27 15:20:48 1997
From: stewarts at ix.netcom.com (stewarts at ix.netcom.com)
Date: Tue, 28 Oct 1997 07:20:48 +0800
Subject: Infastructure Protection and Paranoia
Message-ID: <3.0.3.32.19971026170732.006bf4fc@popd.ix.netcom.com>



At 03:41 PM 10/21/1997 +0100, Sandy J. Wong wrote on Cyberia-L
>Buried in Tuesday's Wall Street Journal was a small three-paragraph article
>mentioning that the U.S. may be vulnerable to a cyberspace version of the
>Pearl Harbor attack. A futile suggestion--in my opinion--was made by the
>President's Commission on Critical Infrastructure Protection spend $1
>billion during the next seven years on cyber-security research. that
>suggestion followed a 15-month study of the nation's critical
>infrastructures.

The story, in shorter or longer form, has been in most of the major papers.
The InfoWar crowd has been lobbying and running conferences about this one 
for a couple of years, and it sounds like they're making political progress.
The longer versions of the articles make the connection between
infrastructure risk and the need for encryption to prevent attacks, 
with various FBI spokecritters talking about how we obviously need FBI access 
to all communications to ban InfoTerrorists.

I've got mixed feelings about it; on one hand it seems like a bunch of
Defense Department wonks trying to find a way to keep their jobs now that 
the world isn't threatened by Commies any more, but on another hand,
some of them may have looked at the problem seriously and said
    "!  Disabling the country's critical infrastructure 
    really does look pretty easy!  Fixing it is probably our job."

The new direction for the electric power industry in California
replaces the current monopolies with an Internet-technology-based 
running auction with buyers and sellers trading electricity in
half-hour chunks.  I don't think it's out on the open Internet,
unless one of the hundreds of players gets careless with computer security,
but it's certainly a vulnerability issue.   Denial of service attacks
are much harder to block than privacy cracks - how secure are the protocols?
The regulatory process will probably require revealing most of the information 
anyway; I doubt we'd end up with anonymous buyers and sellers of power :-)
(Actually, anonymity is probably fairly easy; just use corporations
instead of remailers to provide your pseudonyms.  (This message is
brought to you by Californians For A Secure Electrical Infrastructure.))

The recent San Francisco power failure appears to have been sabotage - 
somebody turned off a bunch of switches around 6am taking out 1/4 of the 
city's power for 2-3 hours; the papers don't say if it was just that one substation
(in which case they should have been able to bring it up much faster)
or whether it cascaded to a bunch of the other substations as well.
Is it just another disgruntled employee?  An organized Ecoterrorist Conspiracy?
Or a government provocation to reinforce their report's impact?
In either case I'm sure the government will take political advantage of it.
				Thanks! 		Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639
[I'm currently having hardware problems with my main email; 
send Cc: billstewart at att.com if you need to reach me in a hurry.]






From nobody at REPLAY.COM  Mon Oct 27 15:21:20 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Tue, 28 Oct 1997 07:21:20 +0800
Subject: Microsoft's CMR Keys
Message-ID: <199710272304.AAA16802@basement.replay.com>




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tim May, or someone like him, Wrote: 
> I am offering $25,000 for the CMR key for Microsoft. 
> (As a loyal American, 
> I plan to then send it to Janet Reno and Louis Freeh.)

Here's the public key (that _was_ what you asked for, wasn't it? :-)

If you'd like the private key, please enclose $25,000 in small unmarked
Mark Twain digicash encrypted to the CMR key, mailed to billg at microsoft.com,
with Subject: Testing Message Recovery, Please Ignore
and I'll get back to you RSN.

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: PGP for Personal Privacy 5.0
Comment: Where do you want your email to go today?

mQDiBDRUOOkRAgDtlZ1gI4119yWvNk3Z3bdCtGinrTYRM9aBSKGpLnQWMgQRTKag
xoEvj+PSkzdOplbQNb17FkyS+eqNOD3FxDLvAKD/2YkyTt80jTpYE7JKxhN+J0I3
+wH9HI9pkAJIShLGZb7u6WgqRWlR3imV6mKuGG6t7vbWouZhypvfsoxpzGg6oyFk
xeQA7N0ABVUGWBkWAwrhUjp8iAIAo1hA59RTDdeUBysdJpsli2Bg/Sfq7Zf5VQ2o
nvrR0vlrCPxOJOAkr8SGHkUBEQNmtFNL5TB/qRq8LHCtGEkDCrQ6TWljcm9zb2Z0
IENvcnBvcmF0ZSBNZXNzYWdlIEFwcHJvdmFsIDxiaWxsZ0BtaWNyb3NvZnQuY29t
PokAUQQQEQIAEQUCNFQ46QUJABZpgAQLAwECAAoJEB6kQiu8rV1FoIgAnRZkIP1i
yANKty1MAoIjYXvCzyE+AKCBQkDQGDgxEuTByy3BYb1NA2DE4rkAjQQ0VDjtEAIA
6Oe+OrwLtt90xns7irMJz+VMd0HxixdLlieOLb9s0kkeUME2sKIq0KdgGM46n1Pn
4HDQVzdwx58PQ9unNwDnVQACAgH8D4vJKkYtf5hFfqdm1OSXTZ0pvv3roIxUupEL
H8udhVTOWuD6Y9oglXXtzmPIomISBN0XMFstiHkkERBvIbICw4kATAQYEQIADAUC
NFQ47QUJABZpgAAKCRAepEIrvK1dRcdZAKCb3QJ4REIo6OhDLeaJtnZuoaZu3ACg
tNtmL3GB3O4cwXZQ7FgDP2zXBH4=
=M5ch
- -----END PGP PUBLIC KEY BLOCK-----

			Janet
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNFQ97R6kQiu8rV1FEQItRACfY1uQmy77eu26qX2HHVxylRp1PPMAoOGZ
pYLAVHGuHxzJeJkju0B0MZve
=hz8F
-----END PGP SIGNATURE-----

				Thanks! 		Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639
[I'm currently having hardware problems with my main email; 
send Cc: billstewart at att.com if you need to reach me in a hurry.]






From bianca at dev.null  Mon Oct 27 15:26:25 1997
From: bianca at dev.null (Bianca)
Date: Tue, 28 Oct 1997 07:26:25 +0800
Subject: prova
In-Reply-To: <34551063.9F5EAD7D@tin.it>
Message-ID: <34552029.5E8A@dev.null>



Bianca wrote:

> Julia
> ps you are going to be in big big trouble when your uncle gets back

I might as well get in trouble too...
Maybe Attila will _*spank*_ me. [I am only twelve ;>]

Misty Formea






From emc at wire.insync.net  Mon Oct 27 15:36:31 1997
From: emc at wire.insync.net (Eric Cordian)
Date: Tue, 28 Oct 1997 07:36:31 +0800
Subject: Click HERE for Boy Sex
Message-ID: <199710280026.SAA00803@wire.insync.net>



Steve Schear (azur at netcom.com) writes:
 
> Despite the sometimes controversial contents of Usenet feeds it is
> unlikely that the Feds will move to put the kabosh on Usenet.
 
This appears to be the case.  A quick perusal of the Web shows that
NetPics, which was raided earlier this year amidst much fanfare, is
still a booming business with a big array of powerful Web servers,
providing pre-decoded Usenet pictures groups to all comers.
 
This is one high profile child porn prosecution which apparently
fizzled.
 
Still, Netpics advertises that it does not carry about a dozen groups
devoted to the topic of child porn, and monitors other high risk
groups for the purpose of removing illegal material from them.
 
It will be interesting to see how the "only providing a newsfeed"
defense works when the images in question are carefully culled from
known child porn groups, for the specific purpose of sale to a
pedosexual clientele.

--  
Eric Michael Cordian 0+
O:.T:.O:. Mathematical Munitions Division
"Do What Thou Wilt Shall Be The Whole Of The Law"






From rfarmer at HiWAAY.net  Mon Oct 27 16:10:32 1997
From: rfarmer at HiWAAY.net (Randall Farmer)
Date: Tue, 28 Oct 1997 08:10:32 +0800
Subject: I Broke PGP!!!
In-Reply-To: <34543357.2971@sk.sympatico.ca>
Message-ID: 



> Bonus Question: "Who is TruthMonger #1?"
> Bonus Answer: "He's Randall Farmer's best friend."

Huh? I'm asking my best friend about this tomorrow...

---------------------------------------------------------------------------
Randall Farmer
    rfarmer at hiwaay.net
    http://hiwaay.net/~rfarmer







From bianca at dev.null  Mon Oct 27 16:13:53 1997
From: bianca at dev.null (Bianca)
Date: Tue, 28 Oct 1997 08:13:53 +0800
Subject: Apology
Message-ID: <345529E3.740E@dev.null>



The good news is that the computers at the 'Home for the Criminally
Insane' are back in the hands of the 'Children of a Lesser Lunatic.'

The bad news is that these kids are the Cypherpunks of the future.

Tip of the Day: If you are going to attempt to hide your subversive
  email activities from your elders by deleting messages from the
  'Inbox,' then don't forget to empty the 'Trash' folder.

Anyone in favor of corporal punishment (as opposed to loss of 
'Simpsons' privileges) send email to ualdv8 at sk.sympatico.ca.
{Not you, Attila. You have a vested interest.}

Love,
 Bianca






From vcarlos35 at juno.com  Mon Oct 27 16:45:38 1997
From: vcarlos35 at juno.com (vcarlos35 at juno.com)
Date: Tue, 28 Oct 1997 08:45:38 +0800
Subject: Theory of the Day!!
Message-ID: <19971026.192833.3646.0.vcarlos35@juno.com>



___Theory Of Everything___
Drumroll please...
L. Deitweler is the same person as wombat.sympatico.ca.

Send all flames, comments, replies, whatever... to me.






From nobody at REPLAY.COM  Mon Oct 27 17:01:47 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Tue, 28 Oct 1997 09:01:47 +0800
Subject: Theory of the Day!!
Message-ID: <199710280049.BAA02265@basement.replay.com>



vcarlos35 at juno.com wrote:
> 
> ___Theory Of Everything___
> Drumroll please...
> L. Deitweler is the same person as wombat.sympatico.ca.
> 
> Send all flames, comments, replies, whatever... to me.

  Checked your headers. Turns out, the above is yesterday's theory.
  Nice try.

L. Dietweler






From JonWienk at ix.netcom.com  Mon Oct 27 19:15:56 1997
From: JonWienk at ix.netcom.com (Jonathan Wienke)
Date: Tue, 28 Oct 1997 11:15:56 +0800
Subject: poverty traps (Re: Sa
In-Reply-To: <3.0.32.19971027024339.006adea0@cnw.com>
Message-ID: <3.0.3.32.19971027180905.02fece3c@popd.netcruiser>

At 02:55 AM 10/27/97 -0800, Blanc wrote:
>There are many obstacles to overcome in an imperfect world, in an imperfect
>society, in an imperfect economy, under imperfect governments, not to
>mention all the competition.  It is very discouraging and sometimes you
>want to hug your Teddy Bear for comfort [ :>) ].  But sometimes the first,
>and largest,  obstacle to overcome is one's own pessimism and negativity
>against mustering up the courage and creativity to "push the envelope".
>This fatalism is what is being criticized.

I couldn't have said it better.


Jonathan Wienke

What part of "the right of the people to keep and bear Arms, shall not be
infringed" is too hard to understand? (From 2nd Amendment, U.S. Constitution)

PGP 2.6.2 RSA Key Fingerprint: 7484 2FB7 7588 ACD1  3A8F 778A 7407 2928
DSS/D-H Key Fingerprint: 3312 6597 8258 9A9E D9FA  4878 C245 D245 EAA7 0DCC
Public keys available at pgpkeys.mit.edu. PGP encrypted e-mail preferred.

US/Canadian Windows 95/NT or Mac users:
Get Eudora Light + PGP 5.0 for free at http://www.eudora.com/eudoralight/
Get PGP 5.0 for free at http://bs.mit.edu:8001/pgp-form.html

Non-US PGP 5.0 sources:
http://www.ifi.uio.no/pgp/
http://www.heise.de/ct/pgpCA/download.shtml
ftp://ftp.pca.dfn.de/pub/pgp/V5.0/
ftp://ftp.fu-berlin.de/pub/pc/win95/pgp
ftp://ftp.fu-berlin.de/pub/mac/pgp
http://www.shopmiami.com/utopia.hacktic.nl/pub/replay/pub/pgp/pgp50/win/

RSA export-o-matic:
print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0

From ravage at ssz.com  Mon Oct 27 19:50:59 1997
From: ravage at ssz.com (Jim Choate)
Date: Tue, 28 Oct 1997 11:50:59 +0800
Subject: [NEW] mixer@htp.org ( (fwd)
Message-ID: <199710280343.VAA06957@einstein.ssz.com>



Forwarded message:

> From: harka at nycmetro.com
> Date: 27 Oct 1997 15:06:04 EDT
> Subject: Re: [NEW] mixer at htp.org (
> 
> Congrats for the new remailer and a related question: Are the
> cypherpunks-e and cypherpunks-j lists now fully included into the
> list-distribution from and to the other three nodes?
> (The last thing I can recall was, that there were still some
> problems with the distribution)

cypherpunks-j is indipendent. cypherpunks-e recieves feeds from SSZ.
There used to be a problem with traffic with blank subject: headers
but recently haven't seen the problem. That was the only problem that I was
aware of.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From nobody at REPLAY.COM  Mon Oct 27 20:16:24 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Tue, 28 Oct 1997 12:16:24 +0800
Subject: No Subject
Message-ID: <199710280357.EAA23335@basement.replay.com>




 " If passed, the traditional hamfest flea markets where all sorts
of bizzare old radio junk gets traded for cash or swapped for other
gear will be largely a thing of the past, as almost all radio receivers
and transcievers that hams and other electronic hackers might want to
sell or trade will be seriously illegal, and one never knows who that
anonymous cash customer really is..."

The odds are very good that as technology increases the power & freedom of individuals to make an end run around the state that the state will increasingly make the effort to stop it.
This could get really ugly in the future.  Indeed, it has already, but most are not awake enough to notice. Devolution or the demise of the central power is a dangerous process to be caught up in.
In the case of the fedgov, it has a lot of power to abuse and I expect that the latest encryption fight is just a warmup. If the crooks & criminals in the intelligensia can't get their way legally,
then their only option is "any means possible." That covers a lot of territory.

Insure youself against the state. The King likes it *his* way.

A. From the Cyber-Jurisdiction
        






From nobody at bureau42.ml.org  Mon Oct 27 20:19:30 1997
From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer)
Date: Tue, 28 Oct 1997 12:19:30 +0800
Subject: Choices
Message-ID: 



> Q: "If 1984 was so terrible, why didn't Winston just move to another
>     year?
> A: "Duuhhh..."

Q: "How would history have changed if Horatio Alger was black?"
A: ???






From nobody at REPLAY.COM  Mon Oct 27 20:32:44 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Tue, 28 Oct 1997 12:32:44 +0800
Subject: PGP 5.5 available outside US
Message-ID: <199710280423.FAA25974@basement.replay.com>



Lucky Green wrote:
> It seems that unknown Cypherpunks have yet again shown their disrespect of
> US export laws by exporting the latest version of PGP. The Windows version
> of PGP 5.5 is now available for your downloading pleasure at
> ftp://ftp.replay.com/pub/crypto/incoming/PGP55.zip

I installed it. It seems to automatically encrypt everything to Lucky.
Hmmm...






From shamrock at cypherpunks.to  Mon Oct 27 21:25:17 1997
From: shamrock at cypherpunks.to (Lucky Green)
Date: Tue, 28 Oct 1997 13:25:17 +0800
Subject: PGP 5.5 available outside US
Message-ID: 



It seems that unknown Cypherpunks have yet again shown their disrespect of
US export laws by exporting the latest version of PGP. The Windows version
of PGP 5.5 is now available for your downloading pleasure at
ftp://ftp.replay.com/pub/crypto/incoming/PGP55.zip

PGP 5.5 features superior LDAP keyserver integration, multiple signature
categories, and automatic decryption (set Preferences -> Email ->
Automatically Decrypt).

"You heard the rumors. Now try it yourself." :-)

-- Lucky Green  PGP encrypted email preferred.
   "Tonga? Where the hell is Tonga? They have Cypherpunks there?"






From rah at shipwright.com  Mon Oct 27 21:26:18 1997
From: rah at shipwright.com (Robert Hettinga)
Date: Tue, 28 Oct 1997 13:26:18 +0800
Subject: WPI Cryptography Seminar
Message-ID: 




--- begin forwarded text


X-Authentication-Warning: goya.WPI.EDU: christof owned process doing -bs
Date: Mon, 27 Oct 1997 13:26:02 -0500 (EST)
From: Christof Paar 
To: ecegraduate at ece.WPI.EDU, ma-clipboard at wpi.WPI.EDU, DCSB ,
        ecefaculty at ece.WPI.EDU, faculty at owl.WPI.EDU, graduate at owl.WPI.EDU
Subject: WPI Cryptography Seminar
MIME-Version: 1.0
Sender: bounce-dcsb at ai.mit.edu
Precedence: bulk
Reply-To: Christof Paar 

Starting next week, we will again offer an open Cryptography Seminar at
WPI. We will meet (mostly) Tuesdays at 4:30. Some of the talks until the
end of this year are

- Erik DeWin, K.U. Leuven, Belgium:
  The P1363 IEEE Public-Key Standard.

- David Jablon:
  A new network identification system.

- Jens-Peter Kaps, WPI:
  High-speed implementation of DES on FPGAs.

- Christian Cachin, MIT:
  Unconditionally secure key agreement.

- Tobias Lohrenz and Kai Wollenweber, U. Siegen, Germany:
  Implementation of a key-agile ATM security module.

IF YOU WANT TO RECEIVE ANNOUNCEMENTS FOR THE CRYPTO SEMINAR, please
send me a brief reply and I put you on the mailing list. Otherwise
you won't here from us again :)

Regards,

Christof Paar


PS: All students in my current or past cryptography courses are
automatically on the list; please don't respond.


*************************************************************************
Christof Paar                   http://ee.wpi.edu/People/faculty/cxp.html
Assistant Professor             email:  christof at ece.wpi.edu
Cryptography Group              phone:  (508) 831 5061
ECE Department, WPI             fax:    (508) 831 5491
100 Institute Road
Worcester, MA 01609, USA
*************************************************************************



For help on using this list (especially unsubscribing), send a message to
"dcsb-request at ai.mit.edu" with one line of text: "help".

--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/
Ask me about FC98 in Anguilla!: 







From jeremey at bluemoney.com  Mon Oct 27 23:27:00 1997
From: jeremey at bluemoney.com (Jeremey Barrett)
Date: Tue, 28 Oct 1997 15:27:00 +0800
Subject: Fortify
Message-ID: <199710280724.XAA00424@einstein.bluemoney.com>

Saw this on BoS...



To: best-of-security at cyber.com.au
Subject: BoS: 128bit for Netscape ouside the US
From: Stef Hoeben 
Date: Mon, 27 Oct 1997 13:00:54 +0100 (MET)
Old-Status: O
Old-X-Envelope-From: Stefan.Hoeben at esat.kuleuven.ac.be  Mon Oct 27 23:02:17 1997
Old-X-Originally-To: To: best-of-security at cyber.com.au
Old-X-Originated-From: From: Stef Hoeben 
Organization: ESAT, K.U.Leuven, Belgium
Resent-Date: Tue, 28 Oct 1997 16:57:55 +1100 (EST)
Resent-From: best-of-security at cyber.com.au
Resent-Message-ID: <"eSK-kC.A.f_C.2wSV0"@plum>
Resent-Sender: best-of-security-request at cyber.com.au
Sender: darrenr at cyber.com.au



A program, called Fortify, has been developed that hacks
Netscape to provide strong encryptioni.e. 168bit 3DES or
128bit RC4).
Available on most platforms and for both versions 3.0
and 4.0 of Netscape. Freely available on the site
below and only some 500K.

http://www.geocities.com/Eureka/Plaza/6333

We have tested it on one of our pc's
...and it worked.
-> DES-CBC3-SHA connections with my own testserver have been made
-> Netscape: "high-grade encryption key for U.S. domestic use only"










From doorlist at doors.com  Tue Oct 28 15:46:50 1997
From: doorlist at doors.com (doorlist at doors.com)
Date: Tue, 28 Oct 1997 15:46:50 -0800 (PST)
Subject: Strange Days Vol. 2
Message-ID: <199710282342.QAA26836@quasar.fiber.net>




    WELCOME  to The Doors Collectors Magazines
             Strange Days News Emailer! Vol. 2
 
              The Celebration has just begun:

----For removal instructions, please see end of newsletter----


CONTENTS:
	 1. The Doors Box Set is in the stores TODAY!!!
	 2. Doors Web Ring Ranks 15th Largest!
	 3.  Lycos Top 5%!  We�re in!
	 4.  New Doors Memorabilia List On-Line News
	 5.  Strange Days Specials


>>>>>1. The Doors Box Set is in the stores TODAY!!!

Today, October 28th, 1997 is the first day that millions of Doors fans will finally be able to get their hands on a copy of The Doors long awaited box set. The media blitz across the nation has caused such a surge on our web site that it slowed downloads down to a halt earlier yesterday. Thanks to the quick response of our ISP (Fibernet, Inc) we have bolstered the site to withstand anything that can hit us today!  Check us out at     
              http://www.doors.com
Included in all the promotion is a new three hour long syndicated radio show (Without a Safety Net) about The Doors aired within the last two days and hundreds of classic rock radio stations played Doors block parties all weekend long to honor this auspicious occasion.  

Those of you who live in NYC might want to call Tower Records for details because all three Doors will be signing box sets today! For those fans back in Los Angeles be sure to go to the Tower Records on Sunset next Saturday for the same opportunity.   On a personal note: I would love to buy any spare copies of  the box set that are signed by all three Doors, so if you get the chance� why not help me out and help pay for your own box set at the same time! Email me for details at: kerry at doors.com

For those of you asking about price: The list price is $69 but many large record chains are celebrating the release with special prices� The lowest I�ve seen so far is $45

Ever since the set list was released (http://www.doors.com/sd.html) I�ve had tons of emails asking questions about the box set�but the one question that I have been asked repeatedly and had no answer for was why the song "Paris Blues" whose lyrics appeared in Danny Sugerman�s "Illustrated Lyrics" book was not to be on the box set song line up?  So at the press conference earlier this month, I grabbed the microphone and asked the question.   Ray offered an explanation saying that the song just didn�t make the cut. Plain and simple.

But don�t worry!   The box set kicks a big ass!  I can�t even tell you how excited that I am for the fans to hear some of the incredible tunes represented on the set. PICK IT UP!   IT�S AT YOUR LOCAL CD STORE TODAY!!!!



>>>>>2. Doors Web Ring Ranks 15th Largest!

The WebRing of The Doors which is sponsored by The Doors Collectors Magazine has now skyrocketed to being the 15th largest music related WebRing on the net!  We recently too k out the Hanson WebRing (MmmmBop!  Two thumbs up for this!!!) Check out the WebRing of The Doors at:
http://www.doors.com/webring/



>>>>>3.  LYCOS TOP 5% OF ALL WEB SITES NOW INCLUDES OUR SITE!

The Doors Collectors Magazine (http://www.doors.com) has made it to the Lycos Top 5% of all web sites!  Check out our site�s review below. I think most of it is pretty good!:

This online version of the print magazine contains a trunk full of articles, interviews and beautiful loser trinkets. The Stones have a credit card; the Doors have an e-mail address: doors.com. It's not all just Lizard King worship, either. DCM focuses on the band's music, life and career rather than simply deifying Jim Morrison. True believers can trade concert tapes, check in on tribute bands, and read back issues. Big Picture projects: mounting a campaign to strike Morrison's criminal record for his alleged exhibitionism on a Miami stage. A slavish yet seductive entrance to the Doors web ring. 
	


>>>>>4.   New Doors Memorabilia List On-Line News

We just updated our on-line memorabilia list with over 150 new illustrations of all kinds of Doors memorabilia!  Never before has it been easier to see what you need before ordering.  Our secure order site makes it safe for you to sit at home and find those hard to find Doors items that you�ve been looking for. 

Coming Soon:  An online form for you to submit your want lists to us!



>>>>>5.  Strange Days Specials (Good until October 31, 1997 only when you mention this ad) Regular postage rates apply.

 ***�They Died Too Young: Jim Morrison� by Jon E. Lewis (UK) Out of print miniature pocket book entirely on Morrison. Cond: M Regularly $15 now just $10!
	http://www.doors.com/door_mem/books/index.html

***�This is Happening� underground newspapers from 1967-68. Every issue (but #3) had some Doors related article or teaser. Now till Oct. 31 take 20% off each issue�s price. Supplies may be limited since I only have 5 copies of each!
	http://www.doors.com/door_mem/magazines/index.html

***�Jim Morrison's Testimony from Miami Obscenity Trial'  49 pages of rare transcripts in a deluxe binder. Find out for yourself what Jim said on the witness stand. Excellent quality and extremely interesting! Regularly $8 now just $5!
	http://www.doors.com/door_mem/books/index.html

***'Creem (Summer �81) Doors Special Edition'  Entire issue devoted to The Doors. Over 50 photos. Some never seen before! Reflections from close friends. New interviews and more! Out of stock for over a year! RARE! Cond: M. Regularaly $125 now just $100!
	http://www.doors.com/door_mem/magazines/creem_se.html

***For Hard Core Fans:  One FREE 90 minute cassette volume from our trade list for every $100 spent on Doors memorabilia from our memorabilia list at:
	http://www.doors.com/door_mem/
Or you can check out our list of audio cassette tapes for trade at:
	http://www.doors.com/liveshow/

***Attention European Doors fans:  We now have capabilities to dub videos from our trade list directly in PAL at no additional cost (trade value).


	THIS IS THE END MY FRIEND... TILL NEXT TIME!

Kerry
kerry at doors.com



\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
Thanks you for reading The Doors Collectors Magazine's Strange Days Email 
Newsletter. If you have received this newsletter in error, please just 
return this message back to doorlist at doors.com with "REMOVE" in the 
subject heading. DO NOT RESPOND to this email address unless you want to 
be removed from future emailings of our newsletters.
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\








From tm at dev.null  Mon Oct 27 23:58:58 1997
From: tm at dev.null (TruthMonger)
Date: Tue, 28 Oct 1997 15:58:58 +0800
Subject: Infastructure Protection and Paranoia
In-Reply-To: <3.0.3.32.19971026170732.006bf4fc@popd.ix.netcom.com>
Message-ID: <3455885C.204E@dev.null>



stewarts at ix.netcom.com wrote:
> At 03:41 PM 10/21/1997 +0100, Sandy J. Wong wrote on Cyberia-L
> >Buried in Tuesday's Wall Street Journal was a small three-paragraph article
> >mentioning that the U.S. may be vulnerable to a cyberspace version of the
> >Pearl Harbor attack.

  Why don't you phone up NSA and tell them that you made a Xerox (TM)
copy of the InfoWar plans left overnight at the bar/lounge at the 
Holiday Inn in Albuquerque last week?
  Let me know how it turns out for you...

> The story, in shorter or longer form, has been in most of the major papers.
> The InfoWar crowd has been lobbying and running conferences about this one
> for a couple of years, and it sounds like they're making political progress.
> The longer versions of the articles make the connection between
> infrastructure risk and the need for encryption to prevent attacks,
> with various FBI spokecritters talking about how we obviously need FBI access
> to all communications to ban InfoTerrorists.

  These rocket scientists can't figure out that our infrastructures
might not need all that much defending if our dearly beloved LEA's,
overt and covert, were not sticking foreign objects in the citizen's
anus, sabotaging other countries' infrastructures and economies,
assassinating citizens and foreign citizens, etc., etc.

> I've got mixed feelings about it; on one hand it seems like a bunch of
> Defense Department wonks trying to find a way to keep their jobs now that
> the world isn't threatened by Commies any more, but on another hand,
> some of them may have looked at the problem seriously and said
>     "!  Disabling the country's critical infrastructure
>     really does look pretty easy!  Fixing it is probably our job."

  The world is threatened by the DOD...
 
> The recent San Francisco power failure appears to have been sabotage -
> somebody turned off a bunch of switches around 6am taking out 1/4 of the
> city's power for 2-3 hours; the papers don't say if it was just that one substation
> (in which case they should have been able to bring it up much faster)
> or whether it cascaded to a bunch of the other substations as well.
> Is it just another disgruntled employee?  An organized Ecoterrorist Conspiracy?
> Or a government provocation to reinforce their report's impact?
> In either case I'm sure the government will take political advantage of it.

  Yes, the question on everyone's mind is: "Was it the act of a lone 
madman, or an act of the same federal agencies who are putting assault
rifles in the hands of law enforcement agencies at every level, in 
preparation for...

TruthMonger






From tm at dev.null  Tue Oct 28 00:56:03 1997
From: tm at dev.null (TruthMonger)
Date: Tue, 28 Oct 1997 16:56:03 +0800
Subject: Fed's worst nightmare... / Re: Tim's worst nightmare.,..
In-Reply-To: 
Message-ID: <34558F8C.3A4D@dev.null>



Tim May wrote:
 
> Ironically, I live up on top of a ridge, about 500 feet above the valley
> floor below me, with three sides almost impossible to conventional entry
> methods. So, if there's a "Ruby Ridge" or "Roby Ridge" at my place, the
> dynamics will be quite different.

Agent #1: "Shall we go after the "Nuke DC" guy, or the grandmother?"

Agents #'s (2,3,4,5...infinity) : "GRANDMA!!!"






From frantz at netcom.com  Tue Oct 28 01:25:55 1997
From: frantz at netcom.com (Bill Frantz)
Date: Tue, 28 Oct 1997 17:25:55 +0800
Subject: key recovery meeting/demonstration in DC, 11/5
In-Reply-To: <199710272113.NAA01177@ideath.parrhesia.com>
Message-ID: 



At 1:17 PM -0800 10/27/97, Greg Broiles wrote:
>	       
>See ; there's going to be a meeting
>discussing key recovery technology and legislation in Washington, D.C. on
>November 5...
>
>The web page features plenty of obfuscation/confusion which tries to link
>KR technology with encryption/security technology, suggesting that a
>combination of the two (or merely the former) is required to allow
>widespread use of the Internet for commerce and data transfer.

I just love the politicians who say they want to regulate, "To foster
Internet growth" when the real problems are mostly keeping the physical
plant up with the growth.

Note to Washington: The Internet is doing fine all on its own.


-------------------------------------------------------------------------
Bill Frantz       | Internal surveillance      | Periwinkle -- Consulting
(408)356-8506     | helped make the USSR the   | 16345 Englewood Ave.
frantz at netcom.com | nation it is today.        | Los Gatos, CA 95032, USA







From stewarts at ix.netcom.com  Tue Oct 28 03:00:26 1997
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Tue, 28 Oct 1997 19:00:26 +0800
Subject: unconstitutional? try this variant...(Re: GMR in the talked-about form here would be unconstitutional)
In-Reply-To: 
Message-ID: <3.0.3.32.19971028001822.006ee9d8@popd.ix.netcom.com>



At 07:43 PM 10/24/1997 +0100, Adam Back wrote:
> The Clipper set up claimed to have split databases.

The NSA claimed that, but the chip itself didn't implement it -
all of that was external to the chip, and even if you believe that
the NSA wasn't cheating at first by keeping both halves in one place, 
all they need to do is change their own rules and then they can start.

Doing secret-sharing is important, and it's often hard to find a 
good algorithm to implement it; using the regular secret-sharing 
method to reconstruct the one key needed to feed into your program
means your program really only uses one key...  
				Thanks! 
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From jya at pipeline.com  Tue Oct 28 03:54:35 1997
From: jya at pipeline.com (John Young)
Date: Tue, 28 Oct 1997 19:54:35 +0800
Subject: Tim's worst nightmare.,..
Message-ID: <1.5.4.32.19971028115311.009a71e8@pop.pipeline.com>



Tim's arms race is as hypnotizing as that of the search
for max strength crypto: how to prepare for beseiged last 
war scenarios, when resupply is overrun with refugees, 
weather prevents airborne rescue, comm is jammed, 
deadmeat is piled all around or run away screaming with 
terror ... or numb with media burnout.

Have many other of us have been on that hilltop, too, or
struggling to get there RSN 'cause life truly sucks?

What you do when no help is coming and nobody on earth
gives a FF about your lonely carcass, well, that's when
you fire the last .223 where it's been designed to indifferently
go, to finally solve Cunanin misjudgments with hoseaway 
mess.

Hard life teaches: The only safelove communication is end 
to end to yourself, ricochet alarms of system breakdown of 
pointless existence between heart and head. 

The universe broadcasts: The only totally impregnable 
protection of survivalist megalomania hardwired in all of 
us is to wage war and lose all our ambitions for immortality 
within our custom-made body bag.

Or race ahead terabyte to orthagonal suicide, clearing slow-go 
bandwidth for reproductive mates to logon to a more reliably
lazy DNA ISP.







From 22724924 at juno.com  Tue Oct 28 23:28:12 1997
From: 22724924 at juno.com (? x)
Date: Tue, 28 Oct 1997 23:28:12 -0800 (PST)
Subject: Free Home Security System
Message-ID: <>







From 22724924 at juno.com  Tue Oct 28 23:28:12 1997
From: 22724924 at juno.com (? x)
Date: Tue, 28 Oct 1997 23:28:12 -0800 (PST)
Subject: Free Home Security System
Message-ID: <>







From nobody at REPLAY.COM  Tue Oct 28 07:47:37 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Tue, 28 Oct 1997 23:47:37 +0800
Subject: NABMLA embattled -- mirror sites?
Message-ID: <199710281535.QAA28901@basement.replay.com>



Anonymous (no, another Anonymous!) wrote:

>Anonymous wrote:
>
>> I'm not sure the right to free speech includes the right to endorse guys
>> fucking little boys, whether they give it a moniker like "transgenerational
>> love" or not. Any sex with a minor is rape, since they can't legally give
>> consent. 
>
>That's right. People who are too lazy to drive a fourteen year old
>to New Mexico, where they can legally fuck their brains out, should
>go to jail for a long, long time.
>When I cruise the children's chat lines, I always tell them I would
>like to meet them in New Mexico and fuck their brains out. That's
>legal.
>
>What I love about the law is that it gives us clear guidelines to
>help us recognize the difference between those filthy fucking
>child-molesting perverts fucking fourteen year olds in California,
>and the decent, upstanding citizens fucking the fourteen year
>olds in New Mexico.

Excellent! So have NAMBLA move their HQ to New Mexico. Then they can talk
about fucking little boys' brains out to their heart's content, in person
or on their Web site, without breaking any local laws.

Welcome to the Fifty Fiefdoms. Of course, there'll be changes in the next revision of the Constitution:

  1) The First, Second, Fourth and Fifth Amendments will be missing.
  2) The Tenth Amendment will be altered so that the it says:
     "The powers not delegated to the United States by the Constitution,
     nor prohibited by it to the States, are reserved to the States
     respectively, or to the people -- unless we feel like usurping them,
     or we can convince people they don't need them by spreading FUD."







From shamrock at cypherpunks.to  Tue Oct 28 07:51:18 1997
From: shamrock at cypherpunks.to (Lucky Green)
Date: Tue, 28 Oct 1997 23:51:18 +0800
Subject: Source code obfuscation
Message-ID: 



Is anyone familiar with tools that can be used to 
obscure source code so that it builds, but no longer
contains comments or useful variable or procedure
names?

Thanks,
-- Lucky Green  PGP encrypted email preferred.
   "Tonga? Where the hell is Tonga? They have Cypherpunks there?"






From ariel at watsun.cc.columbia.edu  Tue Oct 28 08:19:08 1997
From: ariel at watsun.cc.columbia.edu (Ariel Glenn)
Date: Wed, 29 Oct 1997 00:19:08 +0800
Subject: dumb and dumber
Message-ID: 



every day I think, 'things can't possibly get any stupider'.  and
invariably, I am proven wrong.

from CNET: http://www.news.com/News/Item/0,4,15721,00.html

Next year's Pentium II computers will be subject to
export controls if a bill pending in Congress passes.
It's expected to come up in the House today. 

Under an amendment to the 1998 Defense
Authorization bill, computer makers shipping machines
that can perform 2,000 million theoretical operations
per second (MTOPS) or more to developing nations
will have to apply to the Commerce Department for an
export license. 

...

Lofgren explained that about the only way to stop the
provision from becoming law at this point would be a
presidential veto, because the sprawling piece of
legislation has already been approved in substance by
the House and Senate.

etc., etc., etc.


sheesh...

Ariel Glenn
ariel at columbia.edu






From whgiii at invweb.net  Tue Oct 28 08:20:20 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Wed, 29 Oct 1997 00:20:20 +0800
Subject: Source code obfuscation
In-Reply-To: 
Message-ID: <199710281613.LAA28421@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In ,
on 10/28/97 
   at 04:52 PM, Lucky Green  said:

>Is anyone familiar with tools that can be used to 
>obscure source code so that it builds, but no longer
>contains comments or useful variable or procedure
>names?

Write it in ASM, 99.9% woun't have a clue to what it is. :)

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFYOgY9Co1n+aLhhAQGMIAQAx42lvkz9dynJF5jwjmzenn9VrjwNS1MB
hq93tq2X8kQVjrZq4D+pmztCdFqatMiO4a4q0xLuwewQQ4gH7mcpVo5OixPONldr
oS/rd6bf/U8yNDQvW9N+1nh2nzOV01UFoXbz0hUjhgvZpQlvs0Xs+2V1CVk1q6hA
3jhSS8ZwSaI=
=ckXx
-----END PGP SIGNATURE-----






From declan at well.com  Tue Oct 28 08:34:22 1997
From: declan at well.com (Declan McCullagh)
Date: Wed, 29 Oct 1997 00:34:22 +0800
Subject: Search warrants and Senate hearing on medical privacy
Message-ID: 



I'm sitting in a Senate hearing room right now; the topic is medical
privacy. Sen. Patrick Leahy (D-Vermont), an occasional friend of civil
liberties, is speaking: "How is our right of privacy, one of our most
cherised freedoms, going to be protected?"

Well, senator, perhaps the best way of protecting our privacy is to ensure
that law enforcement officials need a search warrant before browsing
through your medical files. Right now police do not need to go before a
judge to get your records from your hospital or doctor's office; often
"informal arrangements" exist. If a doctor or hospital wants to promise to
"protect your privacy," they can't.

Yesterday a senior Justice Department official told journalists (in a
background briefing at Main Justice) that requiring police to obtain a
search warrant could derail counter-terrorism efforts. "Imposing a probable
cause standard is something we would vehemently object to," he said. Which
explains why he doesn't vehemently object to the legislation this committee
is considering. The versions of the "medical privacy" bills I'm familiar
with don't include such strict safeguards. We require the FBI to obtain a
search warrant to enter your house or office: why shouldn't we require the
same for medical files?

At yesterday's briefing some of us asked what safeguards are in place to
prevent dragnet fishing by police. For instance, what if agents access a
1,000,000-person database during a medical fraud case and stumble across
someone who's being treated for illegal drugs? Can they prosecute that
person for drug crimes? Yes, they're allowed to but they probably won't. "I
don't see that as being a realistic issue," the Justice Department official
said.

-Declan







From maxson1 at MARSHALL.EDU  Tue Oct 28 08:36:27 1997
From: maxson1 at MARSHALL.EDU (Matthew Maxson)
Date: Wed, 29 Oct 1997 00:36:27 +0800
Subject: PGP and GMR
In-Reply-To: <199710231945.VAA05198@basement.replay.com>
Message-ID: <3.0.3.32.19971028112552.006bc4b8@hobbit.marshall.edu>




<><

e-mail:  maxson1 at marshall.edu
www:     http://webpages.marshall.edu/~maxson1

My ham call is KC8CDT.






From tcmay at got.net  Tue Oct 28 09:16:02 1997
From: tcmay at got.net (Tim May)
Date: Wed, 29 Oct 1997 01:16:02 +0800
Subject: dumb and dumber
In-Reply-To: 
Message-ID: 



At 9:06 AM -0700 10/28/97, Ariel Glenn wrote:
>every day I think, 'things can't possibly get any stupider'.  and
>invariably, I am proven wrong.
>
>from CNET: http://www.news.com/News/Item/0,4,15721,00.html
>
>Next year's Pentium II computers will be subject to
>export controls if a bill pending in Congress passes.
>It's expected to come up in the House today.
>
>Under an amendment to the 1998 Defense
>Authorization bill, computer makers shipping machines
>that can perform 2,000 million theoretical operations
>per second (MTOPS) or more to developing nations
>will have to apply to the Commerce Department for an
>export license.

It could be an interesting legal battle. Intel will certainly bring a lot
of firepower to bear on this.

Interestingly, one of the reasons the Pentium, and Pentium II, is being
fabbed in Israel (they ignored my "soft target" evaluation) and Ireland
(ditto), is to get production inside the borders of the area, including the
European Community.

So, what happens when Pentium IIs are drop-shipped straight to Penang,
Malaysia for packaging and test and are then drop-shipped directly to
"developing nations"? Where did the export occur?

With crypto code, it was the shipment of intellectual property to a
non-U.S. nation. E.g., if RSADSI sends programmers to Ireland to write a
crypto program so as to bypass U.S. laws, that's where the violation
supposedly occurred. (We haven't seen major prosecutions based on this
interpretation, yet.)

But I suppose it won't be too much of a hassle. Intel and other computer
companies dealt with the COCOM laws adequately, and the new proposal,
though pissing into the wind, won't even be as onerous as COCOM was.

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From usura at sabotage.org  Tue Oct 28 09:20:42 1997
From: usura at sabotage.org (Alex de Joode)
Date: Wed, 29 Oct 1997 01:20:42 +0800
Subject: Source code obfuscation
Message-ID: <199710281708.SAA10105@basement.replay.com>



Lucky Green sez:

: Is anyone familiar with tools that can be used to 
: obscure source code so that it builds, but no longer
: contains comments or useful variable or procedure
: names?

I believe HP once was forced to supply sourcecode to
a French guvmint agency. They did just that, the source they
supplied would compile but there were no clues inside.
(don't have a ref for this story though) The French weren't
amused.

--
  Alex de Joode | usura at SABOTAGE.ORG | http://www.sabotage.org
	Sabotage Internet: Your Internet Problem Provider.






From maxson1 at MARSHALL.EDU  Tue Oct 28 09:29:38 1997
From: maxson1 at MARSHALL.EDU (Matthew Maxson)
Date: Wed, 29 Oct 1997 01:29:38 +0800
Subject: PGP and GMR
Message-ID: <3.0.3.32.19971028112812.006bc3fc@hobbit.marshall.edu>



-----BEGIN PGP SIGNED MESSAGE-----

All,

Sorry about that blank post.  It was qued up to send and I did not
realize it


I am new to this list and cryptogrophy, and have a few questions.
1)what is CMR?  2) how does it relate to PGP?  3) what is GAK?  I
have gathered that it is a back door that will encrypt all messags
to
the goverment (or some other official body) as well as encrypting it
to the recipiant.  Also, I assume that PGP 5.X has added this to
their encryption scheme to allow companies to read employee e-mail.
Does PGP 2.6.2 have this back door into it?  tnx for your help. 


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNFYSjQ5f1xn5SKgdAQEEAwP/VGRd2CcQubkDAQH7G6lOU7ShvxjqBYke
4ZJ3RyMLvWkTIFtJJIpIY0fRtkkw9OL0dxQdfCSyk/gNedh7viTEB5ozTwBT7jfd
Jaz4euv+XHuvVfTXTI6Iy+i0XufRaxGxX9sn8vj6UKdLa+L/nzEwRsbyDOpASqvK
Pb4t7jJj0FE=
=wPLv
-----END PGP SIGNATURE-----

<><

e-mail:  maxson1 at marshall.edu
www:     http://webpages.marshall.edu/~maxson1

My ham call is KC8CDT.






From 68363368 at gte.net  Wed Oct 29 01:41:15 1997
From: 68363368 at gte.net (68363368 at gte.net)
Date: Wed, 29 Oct 1997 01:41:15 -0800 (PST)
Subject: Thanksgiving Cookbook
Message-ID: <199702170025.GAA08056@gte.net>




                                               DJ Zip Publishing Co.
                                               PO Box 461670
                                               Los Angeles, CA 90046


Would you like to make this Thanksgiving holiday unforgettable for your family and friends?  
Than do it with our magic Thanksgiving Cookbook!

More people go home for Thanksgiving than for any other holiday, most of them looking forward to nothing more than a good meal and the companionship of immediate and extended family and friends.

DJ Zip Publishing Co. would like to present you with special offer of the new Thanksgiving Cookbook.  More than 40 recipes are included in this publication for all of your traditional Thanksgiving favorites.  Thanksgiving Cookbook is divided into seven categories, such as:
Appetizers, Soups, Vegetables, Stuffing, Poultry, Gravies & Sauces, and Deserts.

In addition, you will be provided with the information on how to create a delicious Thanksgiving dinner for Party of 6, 8, 12, and 18.
And you can get this fabulous Thanksgiving Cookbook for just $10 (S&H included)

Don't wait, Thanksgiving is just around the corner!  

If you would like to purchase this publication please fill out the order form today!


ORDER FORM

Name __________________________________________
Address_________________________________________
City___________________State___________Zip_______

Method of Payment:

O  Check
O  Money Order
O  Cash

Please note that all orders will be supplied within 4 to 5 days.


Thank you and have a great Thanksgiving!






From tcmay at got.net  Tue Oct 28 09:42:19 1997
From: tcmay at got.net (Tim May)
Date: Wed, 29 Oct 1997 01:42:19 +0800
Subject: Search warrants and Senate hearing on medical privacy
In-Reply-To: 
Message-ID: 



At 9:15 AM -0700 10/28/97, Declan McCullagh wrote:

>Well, senator, perhaps the best way of protecting our privacy is to ensure
>that law enforcement officials need a search warrant before browsing
>through your medical files. Right now police do not need to go before a
>judge to get your records from your hospital or doctor's office; often
>"informal arrangements" exist. If a doctor or hospital wants to promise to
>"protect your privacy," they can't.

Not just this, but doctors and nurses are under strong laws which forbid
them from keeping certain kinds of patient information private. For example:

* under Tarasoff, counsellors and shrinks must "narc out" their patients
who are discussing their fantasies, dreams, past actions, future plans, etc.

* gunshot and similar wounds may not be treated in privacy....doctors and
nurses face prison time if they don't narc out such patients

(One of the books I almost bought at the Gun Show was a controversial and
gory book, "Ditch Medicine," intended for treatment of gunshot wounds,
emergency amputations, etc., when doctors are not around, as in a battle or
in the wilderness, or where a "bootleg doctor" cannot be obtained. No doubt
the American Medical Association would like to see this book banned.)


>Yesterday a senior Justice Department official told journalists (in a
>background briefing at Main Justice) that requiring police to obtain a
>search warrant could derail counter-terrorism efforts. "Imposing a probable
>cause standard is something we would vehemently object to," he said. Which
>explains why he doesn't vehemently object to the legislation this committee
>is considering. The versions of the "medical privacy" bills I'm familiar
>with don't include such strict safeguards. We require the FBI to obtain a
>search warrant to enter your house or office: why shouldn't we require the
>same for medical files?

The "medical privacy" bills are guaranteed to be like other "privacy
bills": fig leaves for social planners to hold up in front of Joe Sixpack,
but with the usual backdoors.

(PGP, Inc. could increase market share by offering a special "Hospital
Records Recovery" feature. "It's for the children!!!!")

All we need to ensure medical privacy is a return to the right of contract.
I pay Dr. Jones for his services and for his agreement to not pass my
medical file around to his buddies, or to sell it to advertisers, or to let
"counter-terrorism" agents snoop around in his files. Sounds fair to me.

(And if he violates this trust, kneecap him in the parking lot....it'll
send a message to other contract-breakers.)

>At yesterday's briefing some of us asked what safeguards are in place to
>prevent dragnet fishing by police. For instance, what if agents access a
>1,000,000-person database during a medical fraud case and stumble across
>someone who's being treated for illegal drugs? Can they prosecute that
>person for drug crimes? Yes, they're allowed to but they probably won't. "I
>don't see that as being a realistic issue," the Justice Department official
>said.

Right. Sure. Whatever.

Until they decide they want to.

America is emulating the Soviet "psychiatric prison" system. Look at Roby
Ridge, where some possibly eccentric old lady is being beseiged by
Waco-type raiders. Look for her to "set her house on fire."

(Not to sound like the little dog in Oz, but: "Pay no attention to the SWAT
team pushing the nozzle of a flame thrower under her door.")

As for Leahy, he's been a typical political criminal, guilty of several
capital crimes, for decades. I was never fooled.

--Tim May


The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From jeffb at issl.atl.hp.com  Tue Oct 28 10:32:15 1997
From: jeffb at issl.atl.hp.com (Jeff Barber)
Date: Wed, 29 Oct 1997 02:32:15 +0800
Subject: Roby latest
Message-ID: <199710281825.NAA09614@jafar.issl.atl.hp.com>



See http://www.sj-r.com/roby.html for the latest.


My favorite excerpt:

> Illinois State Police feared that any progress in getting Allen - who's
> suspected to suffer from paranoia, delusions and suicidal thoughts - to
> exit on her own may have been undone. On Sunday, troopers broke out most
> of the remaining windows in Allen's house, tossed nine pepper-spray
> grenades inside and sent a police dog in to subdue Allen.
> 
> All the tactics failed: Allen fired what police believe was a small-caliber
> handgun as troopers inserted mirrors into her house to look around, she
> apparently huddled in a bathroom to ward off the pepper spray, and she 
> shot the police dog through the mouth.

[snip]

> Police movement toward the house was sparked by a long silence inside.
> Despite sophisticated surveillance and listening devices monitoring
> the house, Allen hadn't been seen or heard since 1 p.m. Saturday,
> McDonald said (not 1 a.m. as previously reported). Troopers wanted to
> see if she had collapsed or fallen ill.
> 
> Should similar circumstances arise again, police may try different
> tactics to check Allen's health.
             ^^^^^^^^^^^^^^^^^^^^

Oh!  They were checking her health!  Of course.


-- Jeff






From FisherM at exch1.indy.tce.com  Tue Oct 28 11:21:11 1997
From: FisherM at exch1.indy.tce.com (Fisher Mark)
Date: Wed, 29 Oct 1997 03:21:11 +0800
Subject: Source code obfuscation
Message-ID: <2328C77FF9F2D011AE970000F84104A74933E7@indyexch_fddi.indy.tce.com>



>Is anyone familiar with tools that can be used to 
>obscure source code so that it builds, but no longer
>contains comments or useful variable or procedure
>names?

 has 2 shareware
tools for C code.  I also know there is/was some kind of commercial
tool, that used to be used by Abraxas  for
their CodeCheck product in Unix configurations.
==========================================================
Mark Leighton Fisher          Thomson Consumer Electronics
fisherm at indy.tce.com          Indianapolis, IN
"Their walls are built of cannon balls, their motto is
'Don't Tread on Me'"






From nobody at REPLAY.COM  Tue Oct 28 11:44:44 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Wed, 29 Oct 1997 03:44:44 +0800
Subject: ITAR a la Canada
Message-ID: <199710281924.UAA25841@basement.replay.com>




Anyone know if Canada has accepted all of the restrictions
under ITAR?

Specifically, U.S. companies must (I assume) identify your
domain before permitting access to restricted versions of
software.  Does the same apply for Canada?






From tm at dev.null  Tue Oct 28 12:09:23 1997
From: tm at dev.null (TruthMonger)
Date: Wed, 29 Oct 1997 04:09:23 +0800
Subject: Search warrants and Senate hearing on medical privacy
In-Reply-To: 
Message-ID: <34564260.159C@dev.null>



Declan McCullagh wrote:

> Yesterday a senior Justice Department official told journalists (in a
> background briefing at Main Justice) that requiring police to obtain a
> search warrant could derail counter-terrorism efforts. "Imposing a probable
> cause standard is something we would vehemently object to," he said.

Declan,
  I didn't see anything about it in the news. Did your gun jam?

TruthMonger






From tm at dev.null  Tue Oct 28 12:44:42 1997
From: tm at dev.null (TruthMonger)
Date: Wed, 29 Oct 1997 04:44:42 +0800
Subject: Roby latest
In-Reply-To: <199710281825.NAA09614@jafar.issl.atl.hp.com>
Message-ID: <34564637.6A32@dev.null>



Jeff Barber wrote:
> See http://www.sj-r.com/roby.html for the latest.
 
> My favorite excerpt:
> 
> > Illinois State Police feared that any progress in getting Allen - who's
> > suspected to suffer from paranoia, delusions and suicidal thoughts - to
> > exit on her own may have been undone. On Sunday, troopers broke out most
> > of the remaining windows in Allen's house, tossed nine pepper-spray
> > grenades inside and sent a police dog in to subdue Allen.

I used to run a 24-hour Drop-In Center which had trained volunteer
counsellors on staff around the clock.
I was checking on the night shift one time, and heard Alan, one of
the night counsellors, telling a paranoid schizophrenic (who had
come to the Center when the walls began closing in on him at 4 a.m.),
"I'm a Warlock, you know. I could kill you just by looking at you."

I always wondered what became of Alan. Anyone spot him at Roby Ridge?

> > Should similar circumstances arise again, police may try different
> > tactics to check Allen's health.
>              ^^^^^^^^^^^^^^^^^^^^
> 
> Oh!  They were checking her health!  Of course.

Those pepper-spray grenades contained organically grown pepper, from
the "We're from the Government and We're Here to Help You, Inc."
company, located in the basement of the Pentagon.
>From the brochure: "...and a valuable aide in clearing up sinus
  congestion."

TruthMonger






From tien at well.com  Tue Oct 28 13:27:54 1997
From: tien at well.com (Lee Tien)
Date: Wed, 29 Oct 1997 05:27:54 +0800
Subject: ITAR a la Canada
In-Reply-To: <199710281924.UAA25841@basement.replay.com>
Message-ID: 



I never personally delved into the Canadian regulations.  However, Stewart
Baker wrote a summary of the differences between Canadian and U.S. crypto
export regulations.  It seems that Canada is considerably more liberal than
the United States.  Check out the article, in the publications section of
www.steptoe.com

Lee

At 11:24 AM -0800 10/28/97, Anonymous wrote:
>Anyone know if Canada has accepted all of the restrictions
>under ITAR?
>
>Specifically, U.S. companies must (I assume) identify your
>domain before permitting access to restricted versions of
>software.  Does the same apply for Canada?








From declan at well.com  Tue Oct 28 13:58:28 1997
From: declan at well.com (Declan McCullagh)
Date: Wed, 29 Oct 1997 05:58:28 +0800
Subject: Search warrants and Senate hearing on medical privacy
In-Reply-To: 
Message-ID: 



If you're going to respond to Tim's post, you should copy him or
cypherpunks... I've attached your whole message below...

I will respond to one point, though:

>The free market approach won't keep medical records private.

We haven't tried that approach yet, at least in the late 20th century. The
wealth of federal regulation and involvement in health care is
breathtaking. Ever since after WWII when for tax reasons businesses began
bundling insurance and the rise of medicare/medicaid, well, the "free
market" in healthcare has become much less robust. (Fortunately Clinton's
socialistic health care plan was derailed.)

In other words, the reason a "free market" approach may not work right now
is because the market isn't free.

-Declan



At 13:14 -0800 10/28/97, Jennifer S. Granick wrote:
>Tim May wrote:
>
>>At 9:15 AM -0700 10/28/97, Declan McCullagh wrote:
>>
>>>Well, senator, perhaps the best way of protecting our privacy is to ensure
>>>that law enforcement officials need a search warrant before browsing
>>>through your medical files. Right now police do not need to go before a
>>>judge to get your records from your hospital or doctor's office; often
>>>"informal arrangements" exist. If a doctor or hospital wants to promise to
>>>"protect your privacy," they can't.
>>
>>Not just this, but doctors and nurses are under strong laws which forbid
>>them from keeping certain kinds of patient information private. For example:
>>
>>* under Tarasoff, counsellors and shrinks must "narc out" their patients
>>who are discussing their fantasies, dreams, past actions, future plans, etc.
>>
>
>This comment probably sent anyone out there who sees a therapist into a
>downward depressive spiral.  But don't worry!  That thing you said about
>your mother last week hasn't been reported to the Feds and included in your
>FBI file.
>
>Under Tarasoff, a psychiatrist has a duty to warn a foreseeable and
>identifiable potential victim of his patient's. In other words, if I have a
>fantasy about killing my boyfriend, he doesn't have to tell.  If I talk
>about killing my boyfriend, and my plans to do so, and it would be
>unreasonable for the doctor to think that I wasn't going to try to kill my
>boyfriend, then he has to warn my boyfriend to watch out.
>
>Please read nothing into the fact that I used killing my boyfriend as an
>example.
>
>>* gunshot and similar wounds may not be treated in privacy....doctors and
>>nurses face prison time if they don't narc out such patients
>>
>
>In California, its a misdemeanor punishable by up to 6 months in the county
>jail and/or a fine of up to $1000.  i.e. not state prison, but definitely
>potential jail time.
>
>-snip-
>
>>All we need to ensure medical privacy is a return to the right of contract.
>>I pay Dr. Jones for his services and for his agreement to not pass my
>>medical file around to his buddies, or to sell it to advertisers, or to let
>>"counter-terrorism" agents snoop around in his files. Sounds fair to me.
>>
>>(And if he violates this trust, kneecap him in the parking lot....it'll
>>send a message to other contract-breakers.)
>>
>
>Here Tim puts his finger on exactly why we can't depend on contracts to
>preserve our medical privacy.  What if the contract is violated?  You can't
>kneecap the guy (well, you *can*, but then we're talking another penal code
>section), and you can't sue him.  (What are your damages?  If they're
>difficult to calculate or forsee, they aren't recoverable under contract
>law.)
>
>The free market approach won't keep medical records private.  Neither will
>the Constitution.  We need federal legislation to create and protect that
>right.
>
>Jennifer Granick








From anon at anon.efga.org  Tue Oct 28 14:15:36 1997
From: anon at anon.efga.org (Anonymous)
Date: Wed, 29 Oct 1997 06:15:36 +0800
Subject: cryptographic anecdotes
Message-ID: 



Julian Assange wrote:
>I'm involved in producing a segment on cryptograpic issues for Radio
>National (ABC) to be aired latter this week. I have no problems with
>the technical issues but could use some (reliable) "colour" i.e small
>quirky or unusual anecdotes that will draw in and hold the larger
>order of listeners who don't otherwise have any cryptography/
>cryptographic-policy background.
>
>        e.g     o RSA export-a-crypto-system .sig
>                o algorithm tatoos (couldn't find any confirmation of
>                  this :()

http://www.dcs.ex.ac.uk/~aba/rsa/ has a picture and name of the person
with the RSA tattoo.







From nobody at REPLAY.COM  Tue Oct 28 14:57:57 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Wed, 29 Oct 1997 06:57:57 +0800
Subject: Kids...don't try this at home! / Re: Roby latest
Message-ID: <199710282132.WAA09810@basement.replay.com>



Jeff Barber wrote:
> See http://www.sj-r.com/roby.html for the latest.

> My favorite excerpt:
>
> > Illinois State Police feared that any progress in getting Allen - who's
> > suspected to suffer from paranoia, delusions and suicidal thoughts - to
> > exit on her own may have been undone. On Sunday, troopers broke out most
> > of the remaining windows in Allen's house, tossed nine pepper-spray
> > grenades inside and sent a police dog in to subdue Allen.

I know what you're thinking, kid.
You're thinking, "I'm going to try doing this on Halloween, and if I
get caught, I'm going to tell mom and dad I was checking on the old
lady's health."

Forget it. You don't have a badge, and you're going to get your
bottom tanned.

KidMonger






From rah at shipwright.com  Tue Oct 28 15:08:14 1997
From: rah at shipwright.com (Robert Hettinga)
Date: Wed, 29 Oct 1997 07:08:14 +0800
Subject: Bob - FYI -- not sure if this was already posted ?
Message-ID: 




--- begin forwarded text


Date: Tue, 28 Oct 1997 18:24:41 -0500
From: David Kaufman 
Reply-To: davidk at air.com
Organization: Allied International Resources
MIME-Version: 1.0
To: rah at shipwright.com
Subject: Bob - FYI -- not sure if this was already posted ?

12:51 PM ET 10/28/97

FBI chief calls for computer crime crackdown

            ORLANDO, Fla. (Reuters) - FBI director Louis Freeh said
Tuesday that criminals were moving increasingly into cyberspace
and without new laws ``drug dealers, arms dealers,  terrorists
and spies will have immunity like no other''.
            Freeh told the International Association of Chiefs of Police
that software manufacturers should be required by law to include
a feature that allows police to descramble encrypted
communications.
            ``It could take a $30 million supercomputer a year to figure
out the simplest encrypted message without this feature,'' Freeh
said. ``And that message might be 'we have the victim and will
kill him in an hour'.''
            ``We're not opposed to encrypting. Encrypting is very
important when transacting business but encrypting makes it very
hard to enforce court orders for surveillance.''
            Freeh said he supported a cyber surveillance law with these
features which passed out of the House Intelligence Committee.
That bill has the support of the FBI, Justice Department, Drug
Enforcement Administration and other federal law enforcement
agencies but does not have White House backing.
            ``Our own administration has not gotten behind this
initiative. There are some very powerful industry forces
opposing this,'' Freeh said.
            The ability of criminals to communicate with one another
with computers is changing the face of law enforcement, Freeh
said.
            ``All the boxes of evidence we used to bring back have been
replaced by hard drives and discs. When we graduate our agents
we give them in addition to a gun and a badge a laptop
computer.''
         ^REUTERS@

--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/
Ask me about FC98 in Anguilla!: 







From aba at dcs.ex.ac.uk  Tue Oct 28 15:08:52 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Wed, 29 Oct 1997 07:08:52 +0800
Subject: PGP and GMR
In-Reply-To: <3.0.3.32.19971028112812.006bc3fc@hobbit.marshall.edu>
Message-ID: <199710282301.XAA02835@server.test.net>




Matthew Maxson  writes:
> I am new to this list and cryptogrophy, and have a few questions.
> 1)what is CMR?  

The CMR acronym stands for "Corporate Message Recovery".

> 2) how does it relate to PGP?  

CMR is the corporate disaster recovery mechanism built in to pgp5.5
(and some support for it in pgp5.0).

> 3) what is GAK?  

Government Access to Keys.  Governments seem to have an unhealthy
desire to obtain your communications keys.  They use lots of slick PR
terms to make their snooping urges seem less obnoxious -- things like
"clipper", "key escrow", "key recovery", etc.

> I have gathered that it is a back door that will encrypt all messags
> to the goverment (or some other official body) as well as encrypting
> it to the recipiant.

CMR doesn't do it.  Why people are getting upset is that it could be
used for this though.

> Also, I assume that PGP 5.X has added this to their encryption
> scheme to allow companies to read employee e-mail.

Yes, CMR is to allow companies to recover email in case of employee
forgetting passphrase, or is on holiday, or leaves on bad terms,
or dies unexpectedly.

> Does PGP 2.6.2 have this back door into it?  tnx for your help. 

PGP2.x doesn't have CMR in it.  You don't have to use the CMR feature
on your own key with pgp5.x.  The argument is more about what it could
be used for by government in the future.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710282253.WAA02826@server.test.net>




Lucky Green  writes:
> Is anyone familiar with tools that can be used to obscure source
> code so that it builds, but no longer contains comments or useful
> variable or procedure names?

Do a search on ANDF -- not sure of the acronym's meaning anymore, but
I think there is a GNU version, so perhaps there is a working system
that can be had.

I think it's for architecturally independent distribution -- "compile"
or mangle your source with the ANDF system, and then finish the
compile (compile the garbled C code) on the target system.

(Odd thing for GNU to get involved in what with their source
availability theme.)

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
Message-ID: <199710282249.WAA02819@server.test.net>




Attila T. Hun  writes:
> Mrs.  Allen, 51, has attracted the sympathy of many neighbors, and
> her case has become a rallying point for those who compare it to
> Ruby Ridge and Waco as an example of overzealous law enforcement.
> 
>     she needs more than sympathy, she needs some action!

I'm wondering ... surely all those militia types are watching this
case -- wouldn't it be a real coo to intervene and rescue Mrs Allen
:-)

Let's talk tactics ... how would you disable the Feds without killing
Mrs Allen -- helicopter and nerve gas -- well organised get away?

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



On 10/25/97 7:30 AM, harka at nycmetro.com (harka at nycmetro.com)  passed this 
wisdom:

>Your repeating of government-propaganda about the "abuse of the
>welfare-system" etc. doesn't really cut it as an argument in a
>discussion about the realism of having total financial independence
>and the freedom of choices, that comes with it.

 no he is not .... he is repeating what we all see in the grocery store 
checkout lines and in the gutters with regularity ... even here in 
Vermonte where self-sufficiency is a way of life we see third, fourth, 
and fifth generation welfare families. I literally just came from picking 
up groceries in a Grand Union in Essex Junction (biiiggg suburb of 
Burlington, also home of a big IBM plant) the lady in fromt of me was 
playing the food stamp game ... there was more junk in that basket along 
with the beer. I teach 'at risk' students in a high school near here and 
I am dealing with kids who have some potential to do something with 
themselves and have no inclination to try. I have a kid who is definitely 
got the brains to go to college to do something with himself whose main 
aim in life right now was figuring out how to forge the slip for free 
school lunches for him and his sister so he can pocket the lunch money 
from his parents ... yeah, I know, send him into politics!


Brian B. Riley --> http://www.macconnect.com/~brianbr
  For PGP Keys  

 "...Those of you who turned your swords into plowshares will soon
  find yourselves under the yokes of those of us who kept our swords..." 
      -- author unknown







From nobody at REPLAY.COM  Tue Oct 28 16:52:57 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Wed, 29 Oct 1997 08:52:57 +0800
Subject: Use a Mac...Go to Jail / Re: Saving money
Message-ID: <199710290043.BAA07513@basement.replay.com>



Brian B. Riley wrote:
> Brian B. Riley --> http://www.macconnect.com/~brianbr
>   For PGP Keys  
> 
>  "...Those of you who turned your swords into plowshares will soon
>   find yourselves under the yokes of those of us who kept our swords..."
>       -- author unknown

I have always envisioned Mac users as sitting at their computers and
drawing flowers while they bounce a cute baby on their knee.

Lately, however, I have seen increasing militantism from a wide variety
of Mac users, from the quote above to "MacNuke DC" ranters.
Is this a 'Death of the '60's' thing, or a sign of 'Armageddon'?






From ravage at ssz.com  Tue Oct 28 16:56:30 1997
From: ravage at ssz.com (Jim Choate)
Date: Wed, 29 Oct 1997 08:56:30 +0800
Subject: Another CDR member?
Message-ID: <199710290053.SAA09994@einstein.ssz.com>



Hi,

I received a subscription today from cypherpunks at comsec.com.

I believe there is another node on the CDR.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From jellicle at inch.com  Tue Oct 28 17:02:33 1997
From: jellicle at inch.com (Michael Sims)
Date: Wed, 29 Oct 1997 09:02:33 +0800
Subject: (off-topic--delete now) Re: Search warrants and Senate hearing o
In-Reply-To: 
Message-ID: <199710290004.TAA12015@arutam.inch.com>



> If you're going to respond to Tim's post, you should copy him or
> cypherpunks... I've attached your whole message below...
> 
> I will respond to one point, though:
> 
> >The free market approach won't keep medical records private.
> 
> We haven't tried that approach yet, at least in the late 20th
> century. The wealth of federal regulation and involvement in health
> care is breathtaking. Ever since after WWII when for tax reasons
> businesses began bundling insurance and the rise of
> medicare/medicaid, well, the "free market" in healthcare has become
> much less robust. (Fortunately Clinton's socialistic health care
> plan was derailed.)
> 
> In other words, the reason a "free market" approach may not work
> right now is because the market isn't free.

Declan, every part of the "health-care market" that people are
complaining about, the parts of it that routinely and for fiscal
reasons violate people's privacy, are completely and utterly
dollar-driven and do not result from big nasty government making any
laws.  That HMO shlepping your medical record around to a dozen
adminstrators to decide whether or not to pay for your care?  Those
huge insecure insurance databases with information about what
diseses you're genetically susceptible to?  Those intrusive
questions and psychological screening tests at job interviews? 
Those urinalysis tests which screen for the presence of illegal
drugs, undisclosed prescription drugs and nicotine, with the
intention of firing you if *any* of the above test positive?  All are 
examples of a free market in health care information.

Oh, there are a few examples of government-caused privacy violations 
of health-care information.  I'm thinking of mandatory HIV/AIDS 
disclosure laws, Medicare information, and the fact that the 
government still hasn't figured out that putting all the health-care 
information they can get ahold of into a big database is a bad idea.  
These can certainly represent gross threats to individuals' privacy.  
(Haven't CDT and EPIC discussed this from time to time?  Though not 
extensively on either of the lists this is sent to, where it's 
assuredly off-topic.)  Yet, these aren't the abuses that people 
complain about /today/.

You're confusing services and information.

The US has the closest to a free-market in health-care information of 
any of the industrialized nations.  And people suffer for it every 
day.  You can say it's cool, it's Libertarianism in action, or you 
can think it stinks.

But don't try to blame those abuses on the government.

I found it astonishing that Tim May wrote:

"All we need to ensure medical privacy is a return to the right of
contract. I pay Dr. Jones for his services and for his agreement to
not pass my medical file around to his buddies, or to sell it to
advertisers, or to let "counter-terrorism" agents snoop around in his
files. Sounds fair to me."

Tim, you've got that right today, with a few minor exceptions like
gunshot wounds.  You have it!  You can insist on only going to a
doctor, or only belonging to an HMO, that won't share your
information around town!  The government has nothing to do with it! 
This "problem" you're talking about is solely a market failure
resulting from a nearly-pure, barely-adulterated free-market --- 
completely confidential health services are hard to obtain because 
they cost more and there isn't a sufficient market!  Those privacy 
violations occur because it helps companies make a profit, which 
outweighs your measly privacy concerns!

Gawd, libertarians complaining about a market failure.  I may cry.  


-- Michael Sims






From whgiii at invweb.net  Tue Oct 28 17:06:46 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Wed, 29 Oct 1997 09:06:46 +0800
Subject: Bob - FYI -- not sure if this was already posted ?
In-Reply-To: 
Message-ID: <199710290101.UAA00406@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In , on 10/28/97 
   at 06:03 PM, Robert Hettinga  said:

>            ``All the boxes of evidence we used to bring back have been
>replaced by hard drives and discs. When we graduate our agents we give
>them in addition to a gun and a badge a laptop
>computer.''


They should give them a copy of the Constitution and a conscience.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFaKT49Co1n+aLhhAQHRYQP/UFhT1/QphXpx1R3MhDwWthyn9Cxk0lbH
t3GomXkdh8jR4ApeWm/tDLbyrnJ3TtgAwJHiJhrel1zRWZhL/iuPxcwkIHkG5uFS
XCb4FakndNDPpb/1Dk8NiZopZkQ4zvBp0Dfj7aQ9VV8tBffi9lBDNI8w8CLHf90f
WqEXcJ+juPg=
=lqGF
-----END PGP SIGNATURE-----






From nobody at REPLAY.COM  Tue Oct 28 17:48:15 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Wed, 29 Oct 1997 09:48:15 +0800
Subject: Another CDR member?
Message-ID: <199710290129.CAA15287@basement.replay.com>



Jim Choate wrote:
>
> Hi,
>
> I received a subscription today from cypherpunks at comsec.com.
>
> I believe there is another node on the CDR.

Do you think it is malignant?






From tm at dev.null  Tue Oct 28 17:52:13 1997
From: tm at dev.null (TruthMonger)
Date: Wed, 29 Oct 1997 09:52:13 +0800
Subject: rescue Mrs Allen from the Feds (Re: Tim's worst nightmare.,..)
In-Reply-To: <199710282249.WAA02819@server.test.net>
Message-ID: <34569547.2520@dev.null>



Adam Back wrote: 
> Attila T. Hun  writes:
> > Mrs.  Allen, 51, has attracted the sympathy of many neighbors, and
> > her case has become a rallying point for those who compare it to
> > Ruby Ridge and Waco as an example of overzealous law enforcement.
> >
> >     she needs more than sympathy, she needs some action!
 
> I'm wondering ... surely all those militia types are watching this
> case -- wouldn't it be a real coo to intervene and rescue Mrs Allen
> :-)
> 
> Let's talk tactics ... how would you disable the Feds without killing
> Mrs Allen -- helicopter and nerve gas -- well organised get away?

  Perhaps a variation on the 'Parker Plan' might work.

The Date: Mid 1980's
The Situation: Sitting in the hills of Humboldt County, Ca. guarding the
  'patch'. Relaxing on the half-moon commode when there comes the sound
  of CAMP (Campaign Against Marihuana Production) vehicles and
helicopters
  coming over the hill.
The Solution: Put on shades and baseball cap, tuck .45 in belt, join the
  'crew' as they march toward the shack, kick the door in, grab the TV
  and a chainsaw, go outside and throw them into one of the vehicles,
  wave to the 'guys', saying, "You guys get the pot, and I'll meet you
  back in town."






From tcmay at got.net  Tue Oct 28 18:24:03 1997
From: tcmay at got.net (Tim May)
Date: Wed, 29 Oct 1997 10:24:03 +0800
Subject: I don't need no steenking badge...but I got one anyway
In-Reply-To: <199710282132.WAA09810@basement.replay.com>
Message-ID: 



At 2:32 PM -0700 10/28/97, Anonymous wrote:

>I know what you're thinking, kid.
>You're thinking, "I'm going to try doing this on Halloween, and if I
>get caught, I'm going to tell mom and dad I was checking on the old
>lady's health."
>
>Forget it. You don't have a badge, and you're going to get your
>bottom tanned.

You should see some of the various realistic-looking badges one can buy at
the gun shows! From agencies and correctional departments and obscure law
enforcement agencies...but all very realistic-looking. Also availabe from
the back of various gun and survival magazines, but I like to look at
things in person, up close, before committing to a purchase.

This has some very slight ObCrypto connections, in that badges are, as a
class, taken to be "face value claims of authority." Flashing a badge is
often all it takes to gain entrance to a house, or access to controlled
areas.

So, with the proliferation of essentially perfect copies of badges, and
laser-printed credentials to match them, what happens to "real"
badge-carrying officers? (And just what _are_ real officers in an era of
ten thousand police and law enforcement jurisdictions, hundreds of agencies
authorized to have their agents carry guns and make arrests, and no
traceability, no top-down authentication system?)

--Lt. Timothy May, sworn Peace Officer, Lagrange County, CLS

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."








From berezina at qed.net  Tue Oct 28 18:27:57 1997
From: berezina at qed.net (Paul Spirito)
Date: Wed, 29 Oct 1997 10:27:57 +0800
Subject: (off-topic--delete now) HMO Market (URL)
Message-ID: <01bce408$2c56f960$3f7d8dcc@Berezina>



I think the subject is too complex & off-topic to discuss here, but

http://www.slate.com/medicalexaminer/97-10-24/medicalexaminer.asp

is an excellent exposition of the problems with HMOs, using a market-based
analysis.

Paul

"The fear is of profit deflation emanating from Asia."






From tm at dev.null  Tue Oct 28 18:55:57 1997
From: tm at dev.null (TruthMonger)
Date: Wed, 29 Oct 1997 10:55:57 +0800
Subject: Alan Found! / Re: Roby latest
In-Reply-To: <199710281825.NAA09614@jafar.issl.atl.hp.com>
Message-ID: <34569CA6.410@dev.null>



TruthMonger wrote: 
> Jeff Barber wrote:
> > See http://www.sj-r.com/roby.html for the latest.
> > My favorite excerpt:
> > > Illinois State Police feared that any progress in getting Allen - who's
> > > suspected to suffer from paranoia, delusions and suicidal thoughts - to
> > > exit on her own may have been undone. On Sunday, troopers broke out most
> > > of the remaining windows in Allen's house, tossed nine pepper-spray
> > > grenades inside and sent a police dog in to subdue Allen.

> I used to run a 24-hour Drop-In Center which had trained volunteer
> counsellors on staff around the clock.
> I was checking on the night shift one time, and heard Alan, one of
> the night counsellors, telling a paranoid schizophrenic (who had
> come to the Center when the walls began closing in on him at 4 a.m.),
> "I'm a Warlock, you know. I could kill you just by looking at you."
> 
> I always wondered what became of Alan. Anyone spot him at Roby Ridge?

  A few days after the episode above, some of the employees were
giving Alan shit for sleeping on the nightshift, and thus not
being available to help those who came in to the Drop-In Center.
  Alan replied that, as a Warlock, he was not sleeping, but was
in a very deep state of meditation, able to hear a pin drop,
anywhere in the building.
  Sure enough, a couple days later, Alan was in his deep state
of meditation when someone came in and stole the TV set which
was sitting a few feet from his head.

>From News of the Weird:
* In January, Prime Minister H. D. Deve Gowda of India told a
meeting of government employees in Bangalore that, in contrast
with his image of laziness, he is actually a workaholic.  The various
photographs of him dozing off during official meetings are not
accurate, he said.  "Most of the time I am in deep thought about
various welfare programs for the people." 

  Right. That would account for the holes in his arm...

OffTopicMonger






From azur at netcom.com  Tue Oct 28 19:13:36 1997
From: azur at netcom.com (Steve Schear)
Date: Wed, 29 Oct 1997 11:13:36 +0800
Subject: Microsoft's CMR Keys
In-Reply-To: <199710272304.AAA16802@basement.replay.com>
Message-ID: 



At 12:04 AM +0100 10/28/1997, Anonymous wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Tim May, or someone like him, Wrote:
>> I am offering $25,000 for the CMR key for Microsoft.
>> (As a loyal American,
>> I plan to then send it to Janet Reno and Louis Freeh.)
>
>Here's the public key (that _was_ what you asked for, wasn't it? :-)
>
>If you'd like the private key, please enclose $25,000 in small unmarked
>Mark Twain digicash encrypted to the CMR key, mailed to billg at microsoft.com,
>with Subject: Testing Message Recovery, Please Ignore
>and I'll get back to you RSN.

OK, I'll bite.  Why don't we both escrow $25,000 in MT ecash with a trusted
3rd party, say Lucky, while another party, say TCM judges whether your
private key matches MS' public key.  Winner take all.  All decsion by the
judge are final.

--Steve







From rfarmer at HiWAAY.net  Tue Oct 28 19:19:10 1997
From: rfarmer at HiWAAY.net (Randall Farmer)
Date: Wed, 29 Oct 1997 11:19:10 +0800
Subject: Infastructure Protection and Paranoia
In-Reply-To: <3455885C.204E@dev.null>
Message-ID: 



>   Why don't you phone up NSA and tell them that you made a Xerox (TM)
> copy of the InfoWar plans left overnight at the bar/lounge at the 
> Holiday Inn in Albuquerque last week?

How the hell did my papers get *there*? :-)

[Before you even ask, NO, those weren't my papers]

...
>   These rocket scientists can't figure out that our infrastructures
> might not need all that much defending if our dearly beloved LEA's,
> overt and covert, were not sticking foreign objects in the citizen's
> anus, sabotaging other countries' infrastructures and economies,
> assassinating citizens and foreign citizens, etc., etc.

Well, even if the establishment weren't as screwed as it is, you'd still have a
few purely sadistic people (or people maligned by someone other than Uncle Sam
and his relatives) attacking the infrastructure...enough of them that the
infrastructures (that's one damn cool word) would still need good cryptographic
protection. 

> 
>   The world is threatened by the DOD...

Screwballs with nukes they may be, but their job is still to defend the U.S.; 
you'd think you could at least trust them to keep the power/water/phone lines
from being a target for an attack.

> 
> TruthMonger

---------------------------------------------------------------------------
Randall Farmer
    rfarmer at hiwaay.net
    http://hiwaay.net/~rfarmer







From nobody at REPLAY.COM  Tue Oct 28 20:12:19 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Wed, 29 Oct 1997 12:12:19 +0800
Subject: I don't need no steenking badge...but I got one anyway
Message-ID: <199710290348.EAA28926@basement.replay.com>



Tim May wrote:
> 
> At 2:32 PM -0700 10/28/97, Anonymous wrote:
> 
> >I know what you're thinking, kid.
> >You're thinking, "I'm going to try doing this on Halloween, and if I
> >get caught, I'm going to tell mom and dad I was checking on the old
> >lady's health."
> >
> >Forget it. You don't have a badge, and you're going to get your
> >bottom tanned.

> This has some very slight ObCrypto connections, in that badges are, as a
> class, taken to be "face value claims of authority." Flashing a badge is
> often all it takes to gain entrance to a house, or access to controlled
> areas.

  Indeed, many of the so-called 'off-topic' missives sent to the CPUNX
list actually deal with the heart of cryptography/key-identity, namely,
"face value claims of" authority/identity.
  e.g.
> >Forget it. You don't have a badge, and you're going to get your
> >bottom tanned.
 
  Why do the average citizens put up with behavior from legislators and
law enforcement agents that they would not tolerate in their children?
  It is because of the 'forged keys' of authority that they have 
uploaded to the mainstream media servers...
  "As an unelected member of an organization created by executive
   decree, I am happy to accept the reins of power."
  ...and because of the public misconception that a 'valid key' confers
some kind of real authority or integrity on its owner...
-----BEGIN CHIEF CYPHERPUNKS SPOKESPERSON SIGNED MESSAGE-----
  "Timmy C. Mayonnaise carries a turd in his wallet for identification
   purposes."
-----END CHIEF CYPHERPUNKS SPOKESPERSON SIGNED MESSAGE-----

> So, with the proliferation of essentially perfect copies of badges, and
> laser-printed credentials to match them, what happens to "real"
> badge-carrying officers? (And just what _are_ real officers in an era of
> ten thousand police and law enforcement jurisdictions, hundreds of agencies
> authorized to have their agents carry guns and make arrests, and no
> traceability, no top-down authentication system?)

  "Real officers?"
  There was a 60 Minutes show recently on "real officers" who rape and
murder the citizenry under cover of their badges.
  {How does this relate to cryptography? Glad you asked...} 

  Who do I send my GAK key to? 
  To the "real officer" who sexually molested and/or raped over a 
hundred citizens under the cover of authority?
  To the "real officers" who fired this guy when his activities came
to light, but gave him glowing letters of recommendation so that he
could move to other law enforcement agencies to continue his criminal
activity?
  To the "real officers" who rape and murder the citizens?
  To the hundreds/thousands/tens-of-thousands of "real officers" who
use their access to LEA databases to get the names and addresses of
citizen/victims in order to murder, rape and rob them?

> --Lt. Timothy May, sworn Peace Officer, Lagrange County, CLS

AnonymousPoliceOfficerRobberRapistMurderer, swearing Piece-of-Ass 
  Officer, Anytown, USA






From nobody at secret.squirrel.owl.de  Tue Oct 28 20:20:28 1997
From: nobody at secret.squirrel.owl.de (Secret Squirrel)
Date: Wed, 29 Oct 1997 12:20:28 +0800
Subject: rescue Mrs Allen from the Feds (Re: Tim's worst nightmare.,..)
Message-ID: <506b11017bc6059ad972be3d6a7eeaa4@squirrel>



-----BEGIN PGP SIGNED MESSAGE-----

>Attila T. Hun  writes:
>> Mrs.  Allen, 51, has attracted the sympathy of many neighbors, and
>> her case has become a rallying point for those who compare it to
>> Ruby Ridge and Waco as an example of overzealous law enforcement.
>> 
>>     she needs more than sympathy, she needs some action!
>
>I'm wondering ... surely all those militia types are watching this
>case -- wouldn't it be a real coo to intervene and rescue Mrs Allen
>:-)
>
>Let's talk tactics ... how would you disable the Feds without killing
>Mrs Allen -- helicopter and nerve gas -- well organised get away?

Question: Are the Feds involved, or is it just the State of Illinois?
If the Feds really are involved, what possible justification do they
have?

The best way to help Mrs. Allen is to find ways for her to communicate
with the civilized world.

Maybe use a model airplane deliver a CB?  Or a spread spectrum radio?

Monty Cantsin
Editor in Chief
Smile Magazine
http://www.neoism.org/squares/smile_index.html
http://www.neoism.org/squares/cantsin_10.htm

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBNFaN+5aWtjSmRH/5AQGvDwf8CswVCjME+ISU3Mw/8BqChhkpZnNs7hor
0hHJZ/TgtkCcEKJCL8tTD+SgMhFTXRHVPVQRBUQ2flk/bYUsDQF/UJ/D0RhK/0yX
6M0ErILUmVIo9Qn1PJzRebMYdobzIo+Td0gqB5ET4kswGZphd+Oa9KBq20FHhXxr
/uXz2ED0BaVCGLK+Fg3rmxiMg5OFWMzhjESTBkM0X9jhjFIQqqA+yniLkfDRoau6
yNonHOklxf/+VoxhD9mz8KtWc7r0AaHi05bjBJCzUpp4t14NuO1Bk9zUbhgkNIps
cjAd3MVPAdpTVpw0okw2Z4SR4xV/E++Hap9e0Sf9mNB7oKiRB4v75g==
=bbsb
-----END PGP SIGNATURE-----







From tm at dev.null  Tue Oct 28 20:20:30 1997
From: tm at dev.null (TruthMonger)
Date: Wed, 29 Oct 1997 12:20:30 +0800
Subject: Infastructure Protection and Paranoia
In-Reply-To: 
Message-ID: <3456B357.34BE@dev.null>



Randall Farmer wrote:
> TruthMonger writed:
> >   The world is threatened by the DOD...
> 
> Screwballs with nukes they may be, but their job is still to defend the U.S.;
> you'd think you could at least trust them to keep the power/water/phone lines
> from being a target for an attack.


Far be it from me to point any fingers, but...
_
 )
 )_______
  _______) 
 )
_)

TruthMonger






From wabe at smart.net  Tue Oct 28 20:37:25 1997
From: wabe at smart.net (wabe)
Date: Wed, 29 Oct 1997 12:37:25 +0800
Subject: PGP and Outlook
Message-ID: <01bce439$c1400b80$af7f61ce@dave>



So without the obligatory flames for using a microshaft product,
can anyone tell me if they have PGP 5.0 working for the
newest version of Outlook? (And how?)

_______________________________________
-wabe




From whgiii at invweb.net  Tue Oct 28 20:37:33 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Wed, 29 Oct 1997 12:37:33 +0800
Subject: rescue Mrs Allen from the Feds (Re: Tim's worst nightmare.,..)
In-Reply-To: <506b11017bc6059ad972be3d6a7eeaa4@squirrel>
Message-ID: <199710290424.XAA02264@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <506b11017bc6059ad972be3d6a7eeaa4 at squirrel>, on 10/29/97 
   at 03:55 AM, Secret Squirrel  said:

>-----BEGIN PGP SIGNED MESSAGE-----

>>Attila T. Hun  writes:
>>> Mrs.  Allen, 51, has attracted the sympathy of many neighbors, and
>>> her case has become a rallying point for those who compare it to
>>> Ruby Ridge and Waco as an example of overzealous law enforcement.
>>> 
>>>     she needs more than sympathy, she needs some action!
>>
>>I'm wondering ... surely all those militia types are watching this
>>case -- wouldn't it be a real coo to intervene and rescue Mrs Allen
>>:-)
>>
>>Let's talk tactics ... how would you disable the Feds without killing
>>Mrs Allen -- helicopter and nerve gas -- well organised get away?

>Question: Are the Feds involved, or is it just the State of Illinois? If
>the Feds really are involved, what possible justification do they have?

>The best way to help Mrs. Allen is to find ways for her to communicate
>with the civilized world.

>Maybe use a model airplane deliver a CB?  Or a spread spectrum radio?

What is needed is several thousand well armed militia to go down there and
send the JackBooted thugs packing. I am willing to donate my time to such
a worthy cause.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFa6B49Co1n+aLhhAQFrRwQAr7a+kE6VCz6D2tUQ8nECtw4nZJIVlOzL
DIeoRWZb7vdbh5+Kqle/cOL7ZSPzMByvAFleoHPHuk7c0+ZpXzOTZUtsrztYHa+q
xz505L9h54O4OIVeaSN3elxonuYlUHzbsDRO/GEN58LDWPCJ/yYspBW5bq/j31IZ
bdoPL2vS0KE=
=s22q
-----END PGP SIGNATURE-----






From JonWienk at ix.netcom.com  Tue Oct 28 20:39:45 1997
From: JonWienk at ix.netcom.com (Jonathan Wienke)
Date: Wed, 29 Oct 1997 12:39:45 +0800
Subject: Bob - FYI -- not sure if this was already posted ?
In-Reply-To: 
Message-ID: <3.0.3.32.19971028202208.0312e638@popd.netcruiser>

>            ORLANDO, Fla. (Reuters) - FBI director Louis Freeh said
>Tuesday that criminals were moving increasingly into cyberspace
>and without new laws ``drug dealers, arms dealers,  terrorists
>and spies will have immunity like no other''.
>            Freeh told the International Association of Chiefs of Police
>that software manufacturers should be required by law to include
>a feature that allows police to descramble encrypted
>communications.
>            ``It could take a $30 million supercomputer a year to figure
>out the simplest encrypted message without this feature,'' Freeh
>said. ``And that message might be 'we have the victim and will
>kill him in an hour'.''

Like a kidnapper is really going to encrypt a ransom note so the kidnap
victim's friends won't be able to figure out how to deliver the ransom
money.  DUHHHHHHH!


Jonathan Wienke

What part of "the right of the people to keep and bear Arms, shall not be
infringed" is too hard to understand? (From 2nd Amendment, U.S. Constitution)

PGP 2.6.2 RSA Key Fingerprint: 7484 2FB7 7588 ACD1  3A8F 778A 7407 2928
DSS/D-H Key Fingerprint: 3312 6597 8258 9A9E D9FA  4878 C245 D245 EAA7 0DCC
Public keys available at pgpkeys.mit.edu. PGP encrypted e-mail preferred.

US/Canadian Windows 95/NT or Mac users:
Get Eudora Light + PGP 5.0 for free at http://www.eudora.com/eudoralight/
Get PGP 5.0 for free at http://bs.mit.edu:8001/pgp-form.html

Non-US PGP 5.0 sources:
http://www.ifi.uio.no/pgp/
http://www.heise.de/ct/pgpCA/download.shtml
ftp://ftp.pca.dfn.de/pub/pgp/V5.0/
ftp://ftp.fu-berlin.de/pub/pc/win95/pgp
ftp://ftp.fu-berlin.de/pub/mac/pgp
http://www.shopmiami.com/utopia.hacktic.nl/pub/replay/pub/pgp/pgp50/win/

RSA export-o-matic:
print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0

From graycastle at ppw.net  Tue Oct 28 20:44:57 1997
From: graycastle at ppw.net (graycastle at ppw.net)
Date: Wed, 29 Oct 1997 12:44:57 +0800
Subject: [cpe:3185] Re: rescue Mrs Allen from the Feds (Re: Tim's worst nightmare.,..)
In-Reply-To: <199710290424.XAA02264@users.invweb.net>
Message-ID: <3456BE4E.3B3D@ppw.net>



> >>Let's talk tactics ... how would you disable the Feds without killing
> >>Mrs Allen -- helicopter and nerve gas -- well organised get away?
> 
> >Question: Are the Feds involved, or is it just the State of Illinois? If
> >the Feds really are involved, what possible justification do they have?
> 
> >The best way to help Mrs. Allen is to find ways for her to communicate
> >with the civilized world.
> 
> >Maybe use a model airplane deliver a CB?  Or a spread spectrum radio?
> 
> What is needed is several thousand well armed militia to go down there and
> send the JackBooted thugs packing. I am willing to donate my time to such
> a worthy cause.

that is the type of answer that gets even more people killed.
what good is developing privacy software if you are going to march out
and invite uncle sam to put a bullet in you?

i go with the model plane.

kasumi
"Just because I know nothing about crypto doesn't mean I have no common
sense."




From nobody at REPLAY.COM  Tue Oct 28 20:54:17 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Wed, 29 Oct 1997 12:54:17 +0800
Subject: PGP and Outlook
Message-ID: <199710290437.FAA03889@basement.replay.com>



wannabe smart wrote:
> 
> So without the obligatory flames for using a microshaft product,
> can anyone tell me if they have PGP 5.0 working for the
> newest version of Outlook? (And how?)

We could tell you, but then we'd have to killfile you...






From whgiii at invweb.net  Tue Oct 28 21:13:45 1997
From: whgiii at invweb.net (William H. Geiger III)
Date: Wed, 29 Oct 1997 13:13:45 +0800
Subject: [cpe:3185] Re: rescue Mrs Allen from the Feds (Re: Tim's worst nightmare.,..)
In-Reply-To: <3456BE4E.3B3D@ppw.net>
Message-ID: <199710290507.AAA02702@users.invweb.net>



-----BEGIN PGP SIGNED MESSAGE-----

In <3456BE4E.3B3D at ppw.net>, on 10/29/97 
   at 01:40 PM, graycastle at ppw.net said:

>> >>Let's talk tactics ... how would you disable the Feds without killing
>> >>Mrs Allen -- helicopter and nerve gas -- well organised get away?
>> 
>> >Question: Are the Feds involved, or is it just the State of Illinois? If
>> >the Feds really are involved, what possible justification do they have?
>> 
>> >The best way to help Mrs. Allen is to find ways for her to communicate
>> >with the civilized world.
>> 
>> >Maybe use a model airplane deliver a CB?  Or a spread spectrum radio?
>> 
>> What is needed is several thousand well armed militia to go down there and
>> send the JackBooted thugs packing. I am willing to donate my time to such
>> a worthy cause.

>that is the type of answer that gets even more people killed. what good
>is developing privacy software if you are going to march out and invite
>uncle sam to put a bullet in you?

>i go with the model plane.

Well just exactly how do you think these types of atrocities are going to
be stopped?? the LEA's in this country are going to continue to bully the
citizens around until we band together and let them know that we will no
longer tolerate such behavior.

"It is better to die on one's feet than to live on one's knees"

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNFbD649Co1n+aLhhAQHFTwP/aRuyaV2h5G051jIcf9yDTokWUn7KSD1c
pGxnz2us6ljC3tFVdVCqSvdTy5/ofbHafbT2eYz83X8EVsz/zNZNnne1LPhWGy6Q
vH9fVeMCK7qwPcpeOYvEm6cVhJzuDof+m1dwolB/2TKCTe3nvx0FrJq+PCS2ojxU
4tQhpOhg4AQ=
=JK05
-----END PGP SIGNATURE-----






From shamrock at cypherpunks.to  Tue Oct 28 21:29:29 1997
From: shamrock at cypherpunks.to (Lucky Green)
Date: Wed, 29 Oct 1997 13:29:29 +0800
Subject: Microsoft's CMR Keys
In-Reply-To: 
Message-ID: 



On Tue, 28 Oct 1997, Steve Schear wrote:
> 
> OK, I'll bite.  Why don't we both escrow $25,000 in MT ecash with a trusted
> 3rd party, say Lucky, while another party, say TCM judges whether your
> private key matches MS' public key.  Winner take all.  All decsion by the
> judge are final.

Fine with me.

-- Lucky Green  PGP encrypted email preferred.
   "Tonga? Where the hell is Tonga? They have Cypherpunks there?"






From nobody at bureau42.ml.org  Tue Oct 28 21:39:02 1997
From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer)
Date: Wed, 29 Oct 1997 13:39:02 +0800
Subject: At Last...We Finally Know For Sure.
Message-ID: 



> -----BEGIN CHIEF CYPHERPUNKS SPOKESPERSON SIGNED MESSAGE-----
>   "Timmy C. Mayonnaise carries a turd in his wallet for identification
>    purposes."
> -----END CHIEF CYPHERPUNKS SPOKESPERSON SIGNED MESSAGE-----

                                \
That's good enough for me! {:>)=======<
                                /






From ravage at ssz.com  Tue Oct 28 21:42:48 1997
From: ravage at ssz.com (Jim Choate)
Date: Wed, 29 Oct 1997 13:42:48 +0800
Subject: [cpe:3185] Re: rescue Mrs Allen from the Feds (Re: Tim's worst nightmare.,..) (fwd)
Message-ID: <199710290525.XAA11419@einstein.ssz.com>



Forwarded message:

> From: "William H. Geiger III" 
> Date: Tue, 28 Oct 97 23:01:19 -0600
> Subject: Re: [cpe:3185] Re: rescue Mrs Allen from the Feds (Re: Tim's worst nightmare.,..)

> "It is better to die on one's feet than to live on one's knees"

A true idiots answer.

Paraphrased:

Your job isn't to die for your country, your job is to make that other poor
son-of-a-bitch die for his.

                                                Gen. George S. Patton

Remember, dead men NEVER won a war.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From ravage at ssz.com  Tue Oct 28 21:44:09 1997
From: ravage at ssz.com (Jim Choate)
Date: Wed, 29 Oct 1997 13:44:09 +0800
Subject: I don't need no steenking badge...but I got one anyway (fwd)
Message-ID: <199710290531.XAA11513@einstein.ssz.com>



Forwarded message:

> Date: Wed, 29 Oct 1997 04:48:17 +0100 (MET)
> Subject: Re: I don't need no steenking badge...but I got one anyway
> From: nobody at REPLAY.COM (Anonymous)

>   Why do the average citizens put up with behavior from legislators and
> law enforcement agents that they would not tolerate in their children?

I'll tell you, course I won't be lucky enough your head will then explode
but I can wish....

It's called *trust* in a ideal.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From nobody at REPLAY.COM  Tue Oct 28 22:17:48 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Wed, 29 Oct 1997 14:17:48 +0800
Subject: At Last...We Finally Know For Sure.
Message-ID: <199710290607.HAA14255@basement.replay.com>



bureau42 Anonymous Remailer wrote:
> 
> > -----BEGIN CHIEF CYPHERPUNKS SPOKESPERSON SIGNED MESSAGE-----
> >   "Timmy C. Mayonnaise carries a turd in his wallet for identification
> >    purposes."
> > -----END CHIEF CYPHERPUNKS SPOKESPERSON SIGNED MESSAGE-----
> 
>                                 \
> That's good enough for me! {:>)=======<
>                                 /


Hey! Somebody shot my arms off! {:<)=======<






From ravage at ssz.com  Tue Oct 28 22:31:14 1997
From: ravage at ssz.com (Jim Choate)
Date: Wed, 29 Oct 1997 14:31:14 +0800
Subject: Orthogonal (fwd)
Message-ID: <199710290529.XAA11468@einstein.ssz.com>



Forwarded message:

> Date: Wed, 29 Oct 1997 05:05:07 +0100 (MET)
> From: Anonymous 
> Re: Orthogonal
> 
> Oxford English Dictionary Word and Language Service
> 
> Do you have a query about words, their
> origin, meaning, use, spelling, pronunciation,
> or any other aspect of the English language?
> Then write to OWLS at Oxford University Press,
> Walton Street, Oxford OX2 6DP, England.
> 
> All queries willl be answered using the full 
> resources of the Oxford Dictionary Department.

Like the rest of the mentaly mastubatory on here, you missed the *entire*
point of my original question.

How did the word get there, NOT what the word means. I KNOW what and how
to use the word.

Some of you people are fucking worthless for anything other than baiting.


    ____________________________________________________________________
   |                                                                    |
   |                                                                    |
   |                   If the foo shits, wear it.                       |
   |                                                                    |
   |                                    Killroy                         |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From tm at dev.null  Tue Oct 28 22:32:52 1997
From: tm at dev.null (TruthMonger)
Date: Wed, 29 Oct 1997 14:32:52 +0800
Subject: (off-topic--delete now) Re: Search warrants and Senate hearing o
In-Reply-To: 
Message-ID: <34568F07.6F0B@dev.null>



Michael Sims wrote:
> Declan wroted: 
> > Somebody writ:
> > >The free market approach won't keep medical records private.
> >
> > We haven't tried that approach yet, at least in the late 20th
> > century.
...
> > In other words, the reason a "free market" approach may not work
> > right now is because the market isn't free.

> Declan, every part of the "health-care market" that people are
> complaining about, the parts of it that routinely and for fiscal
> reasons violate people's privacy, are completely and utterly
> dollar-driven and do not result from big nasty government making any
> laws.

  Right. And you're going to use examples pertaining to huge 
health industry corporations who exist only because of the mountains 
of government regulations which keep small health care providers
from providing simple, sane market options.

>  That HMO...
> huge insecure insurance databases...
> 
> Oh, there are a few examples of government-caused...

  Do not pass GoFuckYourself. Do not collect 200 Reputation Capital
Credits.

  The totality of today's medical profession and health care system
*is* 'government-caused.'
  You can't piss in a pot you keep under your bed without violating
a hundred laws from the Health Department to the EPA to...
  Kiss your child's 'stubbed' toe 'better' and you'll end up in prison
for unlawfully practicing medicine.

> The US has the closest to a free-market in health-care information of
> any of the industrialized nations.

  Earth to Michael! Earth to Michael...

> Gawd, libertarians complaining about a market failure.  I may cry.

  No. Libertarians complaining about government perversion of a
free market.
  If you cry, make sure you wipe those tears with a towel that meets
government standards. (Cost: $3,000.00)

TruthMonger






From tm at dev.null  Tue Oct 28 22:51:23 1997
From: tm at dev.null (TruthMonger)
Date: Wed, 29 Oct 1997 14:51:23 +0800
Subject: William Louis Pol J. Pot speaks...
Message-ID: <3456D99B.5C44@dev.null>



FROM MOUNTAIN MEDIA
    FOR IMMEDIATE RELEASE DATED OCT. 27, 1997
    THE LIBERTARIAN, By Vin Suprynowicz
    Pol pot speaks

    On Oct. 16 Nate Thayer, an American correspondent for the weekly Far
Eastern Economic Review, conducted the first known interview since 1979
with Cambodian Communist Pol Pot. The New York Times printed excerpts
Oct.
23.
...
  From 1975 and 1979, as summarized by The New York Times, Pol Pot
"turned
his country into a vast labor camp, driving people from the cities and
forcing them to work in the fields in primitive conditions. In the name
of
a radical agrarian ideal, he slaughtered the middle class;
professionals,
monks, artists -- anyone with an education, anyone with glasses. ...
...
  That death toll would be equivalent to executing 75 million Americans.

  And what does the enfeebled mass murderer now have to say?

  "Our movement made mistakes," he graciously acknowledges
...
  "I came to carry out the struggle, not to kill people," Pol Pot still
insists. "We had no other choice" but to kill political opponents, he
argues. "Naturally, we had to defend ourselves." But "To say that
millions
died is too much. ... Even now, and you can look at me: am I a savage
person? My conscience is clear."
...
  And now, the sheer mundanity of this tired old man, confined to a hut
and
insisting there were "only hundreds of thousands."
...
  Even if the survivors in righteous indignation were to seize Pol Pot
and
tear him limb from limb, the central, nagging question would remain:

  "Even now, and you can look at me: am I a savage?"

  No. Pol Pot is not a savage.
...
  It took the massive organization of the modern nation-state -- the
division of labor with its apparent dilution of responsibility, welded
to
the pervasive notion that academy-trained government "experts" know
better
than the common folk how society should be organized, and have the right
to
enforce those plans by force -- to allow Lenin, Stalin, Hitler, Mao, and
Pol Pot to engage in "social engineering" on this scale.

  Nor were any of these characters stupid, or even uneducated. Pol Pot
studied under the best of France's socialist intellectuals.

  That is what finally must be acknowledged here. These mass murders
were
an exercise in the gratification of intellectual notions of how best to
"improve" society.

  A letter writer recently commented that it would be absurd to blame
Pol
Pot's socialist university professors in Paris for what he eventually
did.

  No, it is not. Ideas have consequences. The idea that the wise "social
engineers" of government have some right first to conscript our youth
into
mandatory uniform propaganda camps ("public schools"), then to begin
"licensing" our chosen jobs, then to seize huge hunks of our incomes to
fund these schemes (higher percentages from the rich, of course, as they
seek like Pol Pot to "level things"), and finally to catalog and track
our
employment as well as our cars, our guns, and our money, will eventually
lead by logical and inevitable progression to government deciding --
under
the guise of whatever "emergency" proves convenient -- who lives and who
dies.

  What thing did government ever find in its power, and not eventually
try?

  This is what is really being debated, when lonely voices cry out for
"less government meddling in our lives," while the statists now in power
(yes, including "conservative Republicans") respond, "Sure, sure, We
hear
you. Less government, right. But first we just need to institute this
new
nationally standardized drivers license with an electronically scannable
fingerprint, and a way to eavesdrop on all your phone calls and e-mail,
and
a new law to require your bank to report any cash transaction over
$2500.

  "But we'll get around to giving you that smaller, less intrusive
government you keep voting for, one of these days real soon. Just as
soon
as we outlaw eight more kinds of firearms before lunch. After all,
private
citizens aren't allowed to own firearms, at all, in really (start
ital)civilized(end ital) countries like Germany, Russia, China, and
Cambodia. Meantime, I'm afraid you'll have to get in line over there to
give us your urine sample. ..."

  But they don't mean for it ever to go as far as it went in Cambodia.
Honest.

  And if some of their armed henchmen (start ital)do(end ital)
occasionally
get carried away ... well, they can always claim "self-defense," or
quibble
about the numbers.

Vin Suprynowicz is the assistant editorial page editor of the Las Vegas
Review-Journal. Readers may contact him via e-mail at vin at lvrj.com. The
web
site for the Suprynowicz column is at http://www.nguworld.com/vindex/.
The
column is syndicated in the United States and Canada via Mountain Media
Syndications, P.O. Box 4422, Las Vegas Nev. 89127.

***


Vin Suprynowicz,   vin at lvrj.com

"If ye love wealth greater than liberty, the tranquility of servitude
greater than the animating contest for freedom, go home from us in
peace.
We seek not your counsel, nor your arms. Crouch down and lick the hand
that
feeds you. May your chains set lightly upon you; and may posterity
forget
that ye were our countrymen."    -- Samuel Adams






From stewarts at ix.netcom.com  Tue Oct 28 22:56:50 1997
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Wed, 29 Oct 1997 14:56:50 +0800
Subject: CMR versus GAK?
In-Reply-To: <1.5.4.32.19971027124538.006add84@pop.pipeline.com>
Message-ID: <3.0.3.32.19971028225014.00691d48@popd.ix.netcom.com>



At 07:03 AM 10/27/1997 -0800, Kent Crispin wrote:
>Implicit you make the notion there is no merit.  But experience is a 
>harsh mistress -- employees do steal.  This is not fiction, but fact.

Sure.  The securities industry is especially concerned about the problem,
since there are many combinations of people who can rip of the others;
there's enough money floating around fast enough that anybody even
marginally dishonest can make lots of money quickly,
just as they can make money by arbitraging other market inefficiencies.

- broker and customer conspire to rip off the house
- broker and house conspire to rip off customer
- broker and insider conspire to rip off insider's company
- broker and insiders conspire to rip off outsiders
- broker leaves for another house, taking customers
- broker, customer, and house conspire to avoid taxes
- broker and customer conspire to otherwise hide money
- broker and customer conspire to transfer money to another customer
- broker and house conspire to deceive auditors

Some of these get controlled by the house to preserve its money;
some get controlled by regulators trying to "help" consumers,
some get controlled by the house because too many disgruntled customers
cuts into your reputation capital.  (Insider trading is especially like this.)
For the most part, this gets handled by extensive recordkeeping and auditing,
and the value of CAK/CMR is diluted here because it's mostly providing
access to information that was already being provided anyway.
You're better off using the PGP SMTP filters to _require_ encryption....
				Thanks! 
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From stewarts at ix.netcom.com  Tue Oct 28 23:10:00 1997
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Wed, 29 Oct 1997 15:10:00 +0800
Subject: cryptographic anecdotes
In-Reply-To: <19971027010829.851.qmail@iq.org>
Message-ID: <3.0.3.32.19971028203232.00691d48@popd.ix.netcom.com>



At 01:08 AM 10/27/1997 -0000, Julian Assange wrote:
>I'm involved in producing a segment on cryptograpic issues for Radio
>National (ABC) to be aired latter this week. I have no problems with
>the technical issues but could use some (reliable) "colour" i.e small

Cool.

My usual rant on cryptography and privacy goes like this:
	[If you're talking to non-Americans, fill in your local
	versions of Bureaucratic TaxID numbers...]
- How may of you like to fill out forms with your Social Security Number?
It's so convenient, having one little number that ties in everything,
from your taxes to your bank accounts to your credit reports to your
cellphone to your credit cards to all the jobs you've worked to
the $25 lunch you had yesterday and the books you bought at Borders
to the people you live with to the gasoline your roommate Bob bought 
for your car Friday night?   Me neither.   

Computers are really good at tying information together -
take one thing you know, and they can connect it to other things they know -
and they're getting so ridiculously cheap that the only reason they
_don't_ tie two things together is that nobody's figured out how to
make money off of that combination yet.  We know that after Bob bought gas,
he had a couple of drinks at a bar where many of the other patrons 
use the same credit cards at gay bookstores, but we just haven't decided yet
whether to send _you_ some discount coupons for the same bookstores,
or to suggest that your girlfriend Alice get an AIDS test before we'll
give her medical insurance at her new job.  After all, we're already testing her
cholesterol level because of all the pork you've been buying at Safeway.

So what can we do about it?  Computers keep getting cheaper 
and faster every year, and that won't stop.  Laws don't help much.
Some European governments try data privacy laws, but they're mainly an 
excuse to inspect _your_ computer for illicit data -
the same governments already require you to join the National Health Care
and carry a National ID card in many of them, and pay income tax,
and there's that nice new EC driver's license instead of the old 
one from each country.  The US makes some noise about that,
but it's the same government that's making you give your SSN and
thumbprint to get a driver's license and registering all kids with the IRS.

If you can't stop people from combining information, the alternative
is don't give it to them - use cash, but more importantly build computer
systems that let businesses solve their business problems without
universal identifiers.  Use employee ID numbers on forms instead of SSNs
(and in a global business environment, it's pretty dumb to do otherwise.)
Use cryptographic techniques, like digital cash, to let people buy things
on the web without sending your credit card numbers.  There's some cool
work by David Chaum on creating credentials, like driver's licenses that 
keep track of your tickets but don't use ID numbers, and voter registration
that indicates your voting district and status but aren't tied to the census
that says three of your neighbors are black with Haitian parents.
You can give everybody a stack of taxpayer-ids, whether
on paper or on a smartcard, any bank or employer that needs to collect
taxes on you has a number to use, but only the IRS can tie them together,
because nobody else needs to.  9-digit SSNs are running out soon anyway;
we could change to something secure for the next time.

Chaum's digicash system was designed for automated road tolls, so you can
drive through the tollbooth without slowing down, and the toll system takes
the money off your smartcard, without telling Big Brother where _you_ were.
Here in California, we can send a monthly bill to the address on your license,
but there are European countries that are still remember having German or 
Russian soldiers running them and want an infrastructure they can't abuse.
We're more worried about the automatic traffic fines, when your car didn't take
enough minutes to get from Exit 4 to Exit 17 Friday night.  You know,
the exit by that bar Bob went to.  Next door to the synagogue bookstore.

There's an alternative to crypto - it's "give up privacy".  
Go the David Brin route, and make sure that if the police have
video cameras everywhere pointed at you, you and your neighbors
have video cameras everywhere pointed at them.  Ask Rodney King
if that matters - or ask the next cop who wants to beat up the next driver.
Cameras keep getting cheaper and smaller, and networks to tie them
together and computers to interpret the pictures are getting faster.

And the police do have cameras - last year, when San Francisco was planning
to close the Central Freeway for repairs, they video taped all the cars 
for a few days, looked up the license plate numbers, and mailed the drivers
postcards asking them to take a different road when construction started.
It worked real well, especially because they didn't need 100% coverage.
They used cheap labor to read the license plates off the video tapes,
but computers can do it in real time if you need to do it often,
and they can match the SSN on your car registration with the SSN
on your tax forms from work, so they _could_ send you a nice postcard
suggesting the best router to get to _your_ office.  And a coupon for 
the Starbucks drivethrough on the way.  So Have A _Nice_ Day!

>o programming languages embody freedom of speech

One of my favorite programming languages is Algol.
It's designed for describing mathematical problems very precisely
for humans, and it was the standard language used by the
"Communications of the ACM" journal for many years.
	[ACM=Association for Computing Machinery].
It's not designed for telling computers what to do,
though there is computer software that will read Algol
and do it.  But if an American math teacher writes a couple  
lines of mathematics in Algol and emails them to a non-American student,
he'd better be a registered international arms dealer,
or he can be busted....
				Thanks! 
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From ddt at pgp.com  Tue Oct 28 23:12:33 1997
From: ddt at pgp.com (Dave Del Torto)
Date: Wed, 29 Oct 1997 15:12:33 +0800
Subject: Attention, Third Balcony (was: Re: PGP and Outlook)
In-Reply-To: <01bce439$c1400b80$af7f61ce@dave>
Message-ID: 



-----BEGIN PGP SIGNED MESSAGE-----

At 11:10 pm -0800 10/28/97, wabe wrote:
>X-Mailer: Microsoft Outlook Express 4.71.1712.3
[elided]
>So without the obligatory flames for using a microshaft product,
>can anyone tell me if they have PGP 5.0 working for the
>newest version of Outlook? (And how?)

Sure, Wabe, just not for Outlook Express, which doesn't support plugins of
any type.

We do hope, though (with MS help), to have PGP (v6) built into Outlook
Express v5.0 sometime next Spring (as well as into Outlook).

   dave


-----BEGIN PGP SIGNATURE-----
Version: PGP for Business Security 5.5
Comment: It's email, so press hard - you're making lots of copies!

iQCVAwUBNFbNnaHBOF9KrwDlAQFPowQAwOAbA3BZPiJrCupmknLXNkWjWksoEcsc
IG02OF+yy+B/3/RBo+rTrPOHCzAr/5zNJzNlgbE7uVZ2a8zRnN+veIVbAeTRnFH6
9971mloCdX2UmH2JAIclQ2zYvWDETgClLz+FNXTpKgD5bHtkCl4Omv5kUJ2dPVWY
1zXID2T0sfw=
=TNs2
-----END PGP SIGNATURE-----


____________________________________________________________________
My new book on Diplomacy: "Don't Make Me Come Over There, Adam Gak!"







From Michael.Johnson at mejl.com  Tue Oct 28 23:41:58 1997
From: Michael.Johnson at mejl.com (Mike)
Date: Wed, 29 Oct 1997 15:41:58 +0800
Subject: PGP 5.5 available outside US
In-Reply-To: 
Message-ID: <3.0.3.32.19971029083648.00987670@localhost>

Lucky Green wrote:
>PGP 5.5 features superior LDAP keyserver integration, multiple signature
>categories, and automatic decryption (set Preferences -> Email ->
>Automatically Decrypt).

How does the keyserver integration work? Is it possible to have PGP
automatically fetch the public key from the servers whenever I read a
signed message, and to show me if this newly fetched key is in my web of
trust?

I want the key fetched every time, not cached locally on my own key ring,
so that revocations shows up immediately.

Is the communications channel to the key server encrypted, so that a
passive listener won't see what keys I fetch?

I understand that anybody who breaks root on the key servers will see a lot
of interesting traffic. Can we do anything about that?

Mike.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pgp00010.pgp
Type: application/octet-stream
Size: 190 bytes
Desc: "PGP signature"
URL: 

From kent at bywater.songbird.com  Tue Oct 28 23:53:52 1997
From: kent at bywater.songbird.com (Kent Crispin)
Date: Wed, 29 Oct 1997 15:53:52 +0800
Subject: CMR versus GAK?
In-Reply-To: <1.5.4.32.19971027124538.006add84@pop.pipeline.com>
Message-ID: <19971028234553.48920@bywater.songbird.com>



On Tue, Oct 28, 1997 at 10:50:14PM -0800, Bill Stewart wrote:
> At 07:03 AM 10/27/1997 -0800, Kent Crispin wrote:
> >Implicit you make the notion there is no merit.  But experience is a 
> >harsh mistress -- employees do steal.  This is not fiction, but fact.
> 
> Sure.  The securities industry is especially concerned about the problem,
> since there are many combinations of people who can rip of the others;
> there's enough money floating around fast enough that anybody even
> marginally dishonest can make lots of money quickly,
> just as they can make money by arbitraging other market inefficiencies.
> 
> - broker and customer conspire to rip off the house
> - broker and house conspire to rip off customer
> - broker and insider conspire to rip off insider's company
> - broker and insiders conspire to rip off outsiders
> - broker leaves for another house, taking customers
> - broker, customer, and house conspire to avoid taxes
> - broker and customer conspire to otherwise hide money
> - broker and customer conspire to transfer money to another customer
> - broker and house conspire to deceive auditors
>
> Some of these get controlled by the house to preserve its money;
> some get controlled by regulators trying to "help" consumers,
> some get controlled by the house because too many disgruntled customers
> cuts into your reputation capital.  (Insider trading is especially like this.)
> For the most part, this gets handled by extensive recordkeeping and auditing,
> and the value of CAK/CMR is diluted here because it's mostly providing
> access to information that was already being provided anyway.
> You're better off using the PGP SMTP filters to _require_ encryption....

Requiring encryption is a win, of course.  However, requiring 
encryption increases the value of CMR, because you have more 
opportunity for important records to be lost.  Especially as legally 
binding digital signatures become common -- you could have an actual 
contract, worth large sums of money, lost forever because someone 
forgot their passphrase.

My wife works for an "investment banking boutique" and my freedom to
invest is pretty tightly constrained.  I have first-hand experience
with the controls involving insider trading, and I have a fair
familiarity with the business practices there.  IMO you have it
exactly backward: the CMR model fits extremely well with the type of
controls I am familiar with.  Indeed it is true that there is
extensive record-keeping and auditing -- highly secure record-keeping;
secured conference rooms, careful procedures controlling who has what
information, etc.  CMR would fit right in as a valued addition, not a 
useless redundancy. 

-- 
Kent Crispin				"No reason to get excited",
kent at songbird.com			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html






From wendigo at ne-wendigo.jabberwock.org  Tue Oct 28 23:58:46 1997
From: wendigo at ne-wendigo.jabberwock.org (Mark Rogaski)
Date: Wed, 29 Oct 1997 15:58:46 +0800
Subject: Orthogonal (fwd)
In-Reply-To: <199710290529.XAA11468@einstein.ssz.com>
Message-ID: <199710290728.CAA06565@deathstar.jabberwock.org>



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

An entity claiming to be Jim Choate wrote:

: 
: How did the word get there, NOT what the word means. I KNOW what and how
: to use the word.

I agree with Jim, we have shown WHAT orthogonal means to the fields of
programming languages, computer theory, and software engineering.  The
question is WHY it was adopted.


: 
: Some of you people are fucking worthless for anything other than baiting.

Oh, come now, any human has many uses if you put your mind to it.
A cheap, renewable replacement for ballistic test gelatin, maybe? ;)

Mark

- -- 
[] Mark Rogaski                   "That which does not kill me
[] wendigo at pobox.com                 only makes me stranger."

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNFbloMHFI4kt/DQOEQJSAACeKYPsTTsdIkyWJmgBITIX+JBTGEUAoKfL
JyNmBdHK8OIM/qsNdzWA8T4q
=PB3c
-----END PGP SIGNATURE-----






From stewarts at ix.netcom.com  Wed Oct 29 00:24:51 1997
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Wed, 29 Oct 1997 16:24:51 +0800
Subject: Infastructure Protection and Paranoia
In-Reply-To: <3.0.3.32.19971026170732.006bf4fc@popd.ix.netcom.com>
Message-ID: <3.0.3.32.19971028233541.006e8d74@popd.ix.netcom.com>



At 12:38 AM 10/28/1997 -0600, some TruthMonger tentacle wrote:
>stewarts at ix.netcom.com wrote:
>> At 03:41 PM 10/21/1997 +0100, Sandy J. Wong wrote on Cyberia-L
>> >Buried in Tuesday's Wall Street Journal was a small three-paragraph article
>> >mentioning that the U.S. may be vulnerable to a cyberspace version of the
>> >Pearl Harbor attack.
>
>  Why don't you phone up NSA and tell them that you made a Xerox (TM)
>copy of the InfoWar plans left overnight at the bar/lounge at the 
>Holiday Inn in Albuquerque last week?
>  Let me know how it turns out for you...

At this year's CFP one evening we were playing the game of
"You want to cause maximum disruption to the US infrastructure,
and you've got 100 small explosive devices.  Where do you put them?"
Much creativity was displayed and substantial amounts of testosterone reveled in,
and the overall conclusion was that we'd be in deep trouble if
anybody even vaguely competent wanted to monkeywrench the system.

After that, we played the Russell-Brand-like game of 
"Destruction is easy.  What would you do if you wanted to create
the most joy in the world instead."  That was harder :-)
				Thanks! 
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From ncsofga at ix.netcom.com  Wed Oct 29 17:42:22 1997
From: ncsofga at ix.netcom.com (NCS, INC)
Date: Wed, 29 Oct 1997 17:42:22 -0800 (PST)
Subject: ADVERTISEMENT: MEN IMPROVE YOUR PERFORMANCE
Message-ID: <199710291999SAA51491@post.ix.netcom.com>


A SIMPLE CHEMICAL CAN KEEP YOU ERECT!!!

     When the New England Journal of Medicine reported that the cause 
of most cases of male impotence was tied to the body's failure to 
produce enough of a simple chemical, our research team immediately 
went to work.  And, while other researchers were getting 
congratulations for discovering the cause of the important male 
problem, we developed a product that could be capable of restoring a 
man's performance and self-confidence.

     The researchers found a shortage of this chemical would keep a 
man from performing his sexual activities at a normal level.  For an 
erection to occur, a rapid increase of blood flow must enter the 
penis, causing the vessels to enlarge in diameter.  The results will 
be an erection which can be maintained.  Without sufficient amounts 
of this chemical, the penis is unable to get and stay erect.  FORMULA 
41 lets your body increase its production of this sexually vital 
chemical.  With FORMULA 41 you are able to achieve peak performance 
every time.  The results will astound you.  Even if you're not one of 
the 30 million men diagnosed with some form of impotence, you will be 
able to reach new heights of sexual performance and potency with 
FORMULA 41.

     FORMULA 41 is the one product that is finally able to deliver 
and provide help for men who suffer from inadequate sexual 
performance.

     Try FORMULA 41 today.  All you stand to lose is the uncertainty 
and disappointment of inadequate erections and unsatisfactory sexual 
performance.

   THE ANSWER TO A MAN'S MOST IMPORTANT PROBLEM IS HERE.





                      UNCONDITIONAL GUARANTEE
FORMULA 41 has been clinically and customer tested for 100% 
effectiveness and safety for impotency, and lack of sexual 
fulfillment.  It should work for you.  However, if, for any reason, 
you are not completely satisfied with this product just return the 
unused portion or empty bottle along with proof of purchase within 60 
days for a full refund of your purchase price.

















To Order FORMULA 41, please mail to:
     Order Dept.
     PO Box 1242
     Snellville, Ga 30278-1242

Enclosed is my check or money order for $__________, Payable to NCS.

Name__________________________________________________
Address_______________________________________________
City, State Zip_______________________________________



Description			Price		How Many
Two Month Supply		$54.95      ________ 

Three Month Supply	$69.95      ________

One Month Supply		$34.95      ________ 

                    				Sub Total
	                 		            Postage &  	
		                 			Handling    $5.00
Srfsm                                     
							Total      ______
 
              








From nobody at REPLAY.COM  Wed Oct 29 01:57:33 1997
From: nobody at REPLAY.COM (Anonymous)
Date: Wed, 29 Oct 1997 17:57:33 +0800
Subject: Where are the tough guys when we need them?
Message-ID: <199710290845.JAA00766@basement.replay.com>



Tim wrote:

> America is emulating the Soviet "psychiatric prison" system. 
> Look at Roby Ridge, where some possibly eccentric old lady 
> is being beseiged by Waco-type raiders. Look for her to "set 
> her house on fire."

> (Not to sound like the little dog in Oz, but: "Pay no 
> attention to the SWAT team pushing the nozzle of a flame 
> thrower under her door.")

I can't help wondering if some former SPECWAR guy somewhere 
out there who took his oath seriously, just one, may not get 
a little sick of watching this stuff on the news and give 
the old lady a present and the Nazis a message one morning... 
a SWAT team sleeping the eternal sleep at their posts, their 
necks having been mildly adjusted during the quiet night.

"Whatcha gonna do when they come for you, come for you...?"

Nighty-night!






From Keith34 at aol.com  Wed Oct 29 19:27:16 1997
From: Keith34 at aol.com (Combined Resource Technology)
Date: Wed, 29 Oct 1997 19:27:16 -0800 (PST)
Subject: YOU...at the TOP of the pyramid!
Message-ID: <199710291387BAA45227@post.unite.net>



Yes... that can be you at the top... and...
not just the top of another scam pyramid.... but a
great product that all mlmers can use!
a monthly business journal with conference calls,
chat groups, and newsgroups that help you succeed in the
program of your choice!

Access to a web site with hundreds of free offers and items of 
particular interest to networkers!

A 3x9 forced matrix that has a 50% matching sponsor bonus
and a 33% payout on the first level to keep the little guy in!
=================================================
THE TOP POSITIONS WILL BE SET IN THE NEXT FEW DAYS
AS THERE ARE LESS THAN 100 PEOPLE IN THE PROGRAM NOW!
=================================================
We need people to call back the people who respond to this ad!
Call 1-800-304-5632 NOW for your free issue and business plan!







From jya at pipeline.com  Wed Oct 29 03:29:42 1997
From: jya at pipeline.com (John Young)
Date: Wed, 29 Oct 1997 19:29:42 +0800
Subject: EU E-Commerce Report
Message-ID: <1.5.4.32.19971029111842.00b6b4b8@pop.pipeline.com>



The EU-based Global Internet Project has published a new 
report on electronic commerce:

   http://jya.com/gip-ecomm.htm  (29K)

An excerpt on crypto policy:

1.No nation's cryptography policy can stand alone.

2. Immediate steps should be taken to solve pressing 
cryptographic needs that directly affect the global Internet.

3. Reliable and international systems for authentication 
and integrity should be established.

4. Governments and industry must respond to legitimate user 
concerns.

5. Users should be permitted to decide whether and the degree 
to which key escrow, trusted third party, or key recovery 
technologies will be desirable in their environments or not.

6. Trade barriers should not be disguised as cryptographic 
regulations.

7. Export controls on encryption should be made multilateral 
in practice and when used, focused narrowly and genuinely on 
national security threats. They should not be used as indirect 
domestic controls.

8. Governments should establish and publish the process by 
which keys will be obtained for government purposes. This 
process should include independent judicial review, time limits 
on access, reasonable notice to the key owner when this would 
not interfere with the purposes of the decryption, and 
opportunities for independent audit of compliance with legal 
process.

9. Liability for misuse of escrowed keys should be the subject 
of international understanding.

10. When key recovery is voluntarily chosen by the user, 
self-retention of key recovery information should be encouraged.







From stewarts at ix.netcom.com  Wed Oct 29 03:56:04 1997
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Wed, 29 Oct 1997 19:56:04 +0800
Subject: Kyl S-474 Anti-Gambling Bill passes committee
Message-ID: <3.0.3.32.19971029032045.007052b8@popd.ix.netcom.com>



>> SENATE JUDICIARY COMMITTEE APPROVED BILL (S-474) BY SEN. KYL
   (R-ARIZ.) TO PROHIBIT GAMBLING OVER INTERNET.<> - Senate Judiciary
   Committee approved bill by Sen. Kyl to prohibit gambling over
   Internet. As proposed by Kyl to panel, bill would have allowed states
   to allow Internet gambling, but provision was dropped when Sens.
   Biden and Sessions objected. [TELEVISION DIGEST, 66 words]

				Thanks! 
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From aba at dcs.ex.ac.uk  Wed Oct 29 03:59:07 1997
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Wed, 29 Oct 1997 19:59:07 +0800
Subject: [cpe:3185] Re: rescue Mrs Allen from the Feds (Re: Tim's worst nightmare.,..)
In-Reply-To: <3456BE4E.3B3D@ppw.net>
Message-ID: <199710291117.LAA01288@server.test.net>




graycastle at ppw.net
> > >The best way to help Mrs. Allen is to find ways for her to communicate
> > >with the civilized world.
> > 
> > >Maybe use a model airplane deliver a CB?  Or a spread spectrum radio?
> > 
> > What is needed is several thousand well armed militia to go down there and
> > send the JackBooted thugs packing. I am willing to donate my time to such
> > a worthy cause.
> 
> that is the type of answer that gets even more people killed.
> what good is developing privacy software if you are going to march out
> and invite uncle sam to put a bullet in you?

A robin hood style hack would be preferable -- rescue Mrs Allen
without killing any Feds, not that they might not deserve it, but it
makes for better PR.

How about the model airplane to get a spread spectrum radio to Mrs
Allen, followed by a suprise tank attack, or APC if the Feds have no
hardware with them to touch a tank, drive right into her front room.


The Gandi style walk in, in numbers walk off with Mrs Allen :-)  What are
they going to do, shoot 1000 unarmed citizens?

This kind of tactic works quite well for tyrants who have become too 
civilised.

Adam
-- 
Now officially an EAR violation...
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0



Jonathan Wienke (JonWienk at ix.netcom.com) wrote:
> Like a kidnapper is really going to encrypt a ransom note so the kidnap
> victim's friends won't be able to figure out how to deliver the ransom
> money. DUHHHHHHH!

But what if you're out at lunch or on vacation, or just moved, and 
no-one can read the message because they don't have the key? We must 
have GMR encryption to FBI keys now, just in case!

(That's not entirely facetious, I could see them making this kind of
argument if CMR is widely adopted... it's not Big Brother, it's just
another useful public service).

	Mark






From lharrison at dueprocess.com  Wed Oct 29 04:19:08 1997
From: lharrison at dueprocess.com (Lynne L. Harrison)
Date: Wed, 29 Oct 1997 20:19:08 +0800
Subject: FWD: US Computer Security Called a Critical Mess
In-Reply-To: <19971028221501.23310.qmail@ladyluck.wired.com>
Message-ID: <3.0.3.32.19971029071539.007356d0@pop.mhv.net>



>   W I R E D   N E W S              http://www.wired.com
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
>           BUSINESS    CULTURE    TECHNOLOGY    POLITICS
>
>           T O P   S T O R I E S         11:55am 28.Oct.97.PST
>           - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
>       TECH. 11:55 am
>           US COMPUTER SECURITY CALLED A
>           CRITICAL MESS
>           Saying America's critical infrastructure "stinks," security
>           guru Peter Neumann fires off a warning over the Clinton
>           administration's "obvious" recommendations for staving
>           off hacks.
>           . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
>           http://www.wired.com/news/email/8053.html


*************************************************************
Lynne L. Harrison, Esq.       |    A Word to the Wise:
Poughkeepsie, New York        |     "When the gods
lharrison at dueprocess.com      |     wish to punish us,
http://www.dueprocess.com     |   they answer our prayers."
*************************************************************

DISCLAIMER:  I am not your attorney; you are not my client.
             Accordingly, the above is *NOT* legal advice.






From stewarts at ix.netcom.com  Wed Oct 29 04:27:58 1997
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Wed, 29 Oct 1997 20:27:58 +0800
Subject: Microsoft's CMR Keys
In-Reply-To: 
Message-ID: <3.0.3.32.19971029031645.007045cc@popd.ix.netcom.com>



At 06:14 AM 10/29/1997 +0100, Lucky Green wrote:
>On Tue, 28 Oct 1997, Steve Schear wrote:
>> 
>> OK, I'll bite.  Why don't we both escrow $25,000 in MT ecash with a trusted
>> 3rd party, say Lucky, while another party, say TCM judges whether your
>> private key matches MS' public key.  Winner take all.  All decsion by the
>> judge are final.

I really do have to remember to leave off my .signature when forging 
mail to the list :-)
				Thanks! 
					Bill
Bill Stewart, stewarts at ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639






From ravage at ssz.com  Wed Oct 29 05:17:57 1997
From: ravage at ssz.com (Jim Choate)
Date: Wed, 29 Oct 1997 21:17:57 +0800
Subject: [cpe:3185] Re: rescue Mrs Allen from the Feds (Re: Tim's (fwd)
Message-ID: <199710291312.HAA12834@einstein.ssz.com>



Forwarded message:

> Date: Tue, 28 Oct 1997 23:44:10 -0800
> Subject: Re: [cpe:3185] Re: rescue Mrs Allen from the Feds (Re: Tim's
>  worst nightmare.,..) (fwd)

> In Reply to the Message wherein it was written:
> [snip]
> >Remember, dead men NEVER won a war.
> 
> Wrong.
> 
> Dead men *win* the wars by foolishly dying for someone or something, but
> the really *smart* ones live to enjoy the peace afterwards and rewrite
> history to make themselves look good.
> 
> You're cynical all right, but you're just not cynical *enough*.

[The names have been changed to protect the idiotic]

Dead men are dead, they don't do anything but feed worms.

Live men win wars by being the ones who don't say 'uncle'.


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From ravage at ssz.com  Wed Oct 29 05:24:34 1997
From: ravage at ssz.com (Jim Choate)
Date: Wed, 29 Oct 1997 21:24:34 +0800
Subject: Orthogonal (fwd)
Message-ID: <199710291314.HAA12880@einstein.ssz.com>



Forwarded message:

> From: Mark Rogaski 
> Subject: Re: Orthogonal (fwd)
> Date: Wed, 29 Oct 1997 02:28:33 -0500 (EST)

> : Some of you people are fucking worthless for anything other than baiting.
> 
> Oh, come now, any human has many uses if you put your mind to it.
> A cheap, renewable replacement for ballistic test gelatin, maybe? ;)

Ok, so I was wrong that particular point. Come to think of it, I do need
somebody to wipe my butt after I shit too, when I do it my carpal-tunnel
syndrome gets aggravated...


    ____________________________________________________________________
   |                                                                    |
   |    The financial policy of the welfare state requires that there   |
   |    be no way for the owners of wealth to protect themselves.       |
   |                                                                    |
   |                                       -Alan Greenspan-             |
   |                                                                    | 
   |            _____                             The Armadillo Group   |
   |         ,::////;::-.                           Austin, Tx. USA     |
   |        /:'///// ``::>/|/                     http://www.ssz.com/   |
   |      .',  ||||    `/( e\                                           |
   |  -====~~mm-'`-```-mm --'-                         Jim Choate       |
   |                                                 ravage at ssz.com     |
   |                                                  512-451-7087      |
   |____________________________________________________________________|






From bdolan at USIT.NET  Wed Oct 29 05:28:03 1997
From: bdolan at USIT.NET (Brad Dolan)
Date: Wed, 29 Oct 1997 21:28:03 +0800
Subject: apropos list talk and our culture
In-Reply-To: 
Message-ID: 




"Michael Hays" is a new CBS series about a U.S. District Attorney.  Last
night's episode was about how a radio talk-show host incited a listener
to kill a BATF agent and was brought to justice.  DA convinced a jury
that some things were "more important" than the first amendment.

bd 






From billy at bingo.edu  Wed Oct 29 21:57:47 1997
From: billy at bingo.edu (billy at bingo.edu)
Date: Wed, 29 Oct 1997 21:57:47 -0800 (PST)
Subject: DON'T MAKE THE MISTAKE OF DELETING THIS MESSAGE! L@@k!!
Message-ID: <1997102928QAA55679@venus.t-1net.dk>



THIS MAY BE THE MOST IMPORTANT DECISION OF YOUR LIFE, BUT IT'S 
UP TO YOU...  I AM GIVING YOU THE OPPORTUNITY TO OPEN YOUR 
MIND, VISUALIZE YOUR GOALS AND YOUR DREAMS, AND TAKE THE 
FIRST STEP TOWARD THEM.  THE INFORMATION I HAVE PROVIDED 
HERE WILL ALLOW YOU TO ACHIEVE YOUR GOALS AND REALIZE 
YOUR DREAMS.  YOUR INCOME DOES NOT HAVE TO BE LIMITED TO 
AN HOURLY WAGE OR A SALARY.  TAKE THE INITIATIVE!  DO 
YOURSELF AND YOUR FAMILY THIS FAVOR AND READ THE 
ENCLOSED INFORMATION.  DON'T CLOSE THE DOOR IN THE FACE 
OF OPPORTUNITY...                 

The main reason for this letter is to convince you that this system is
honest, lawful, extremely profitable, and is a way to get a large amount of
money in a short time.  I was approached several times before I checked
this out.  I joined just to see what one could expect in return for the minimal
effort and money required.  What I've found is a phenomenon that can only 
be described as unbelievable.  When you ask yourself who might possibly 
be interested in a program such as this, consider for a moment the fact that 
you are.  So many people are content to live their lives working so that other 
people profit.  It's difficult to believe that there is something better out there, 
but the most difficult step toward financial freedom is that first one.  Make 
the decision to achieve your financial freedom.  Let this program help you 
to realize your dreams as I am realizing mine. 
                              Sincerely yours, Brianna Stone

                   *** Please Print This Now For Future Reference ***

Dear friend,
	I would like to invite you personally to take a long and hard look
at the following income opportunity.  It can be started with a $20 investment
and the income return is tremendous!  Depending on your persistence, you
could gross over $250,000 THIS YEAR!  I want to share this dream of mine with
you. . . Together we can earn enough money to go fishing every Friday, send
the kids off to college, pay off the house & car loans, and even buy some
tickets to a major league ball game.  There will be no need to fuss about not
having enough money!  This plan is amazing and workable for anyone who
chooses to have a financial gold mine.  I would like to share this letter
with anyone who has a burning desire for life and loves people.  If you
do not fit into that description, please READ NO FURTHER. 

You are looking at the most profitable and unique program you may ever
see.  It has demonstrated and proven ability to generate large sums of money.
This program is showing fantastic appeal with a huge and ever growing
population which needs additional income. If you believe that some day you
will get that lucky break that you have been waiting for, THIS IS IT!
Simply follow the easy instructions, and your dream will come true!
This electronic multi-level marketing program works perfectly...100% EVERY TIME!

Thousands of people have used this program to raise capital to start their
own business, pay off debts, buy homes, cars, etc., even retire!

Opportunities DON'T GO AWAY, OTHERS TAKE ADVANTAGE OF THEM!

OVERVIEW OF THIS EXTRAORDINARY
ELECTRONIC MULTI-LEVEL PROGRAM
We sell thousands of people a product for $5.00 that teaches them to
reach financial independence.  As with all multi-level businesses, we build
our business by recruiting new partners and selling our products.
Every state in the U.S. allows you to recruit people in your new multi-level
business online.  The product in this program consists of a series of four
business and financial reports.  Recently updated for 1997, these excellent 
and comprehensive reports detail the do's and don't's of one of the most 
rapidly growing areas of the business world today:  THE INTERNET!  Each 
$5.00 order you receive to YOUR home will include the e-mail address of 
the sender.  To fill each order, you simply e-mail the product to the buyer.  
THAT'S IT!...$5.00 EARNED!  This is not only the EASIEST electronic 
Multi-Level Marketing business anywhere, but the EASIEST WORK you 
can find in the U.S.A..

FOLLOW THE INSTRUCTIONS EXACTLY!  That's what they're here for.
Let's face it, the profits are worth it!  Around $60,000 in 90 days. 
It's a possibility to earn $250,000 a year.  SO GO FOR IT!!!

                        ******* I  N  S  T  R  U  C  T  I  O  N  S *******

This is what you MUST do TODAY:
1.  Order all 4 reports listed and numbered from the list below. For each
     report send $5.00 CASH, YOUR E-MAIL ADDRESS and YOUR
     RETURN POSTAL ADDRESS (in case of a problem) to each person listed.
     When you order, make sure you request each SPECIFIC report.
     You'll need all four reports, because you will be distributing
     them via e-mail with your computer.
2.  IMPORTANT--DO NOT alter the names or sequence other than instructed
     in this program!  You will not profit the way you should.  Replace the name
     and address under REPORT #1 with yours, moving the one that was there
     down to REPORT #2.  Move the name and address under REPORT #2 to
     REPORT #3.  Move the name and address under REPORT #3 to
     REPORT #4.  The name and address that was under REPORT #4 is
     dropped off the list and is NO DOUBT on vacation. When doing this, please
     make certain you copy everyone's name and address ACCURATELY!!!
     Also, DO NOT move the Report/Product positions!
3.  Take this entire program text, including the corrected names list, and SAVE
     it as a TEXT (.txt) file on your computer.
4.  Now you're ready to start a massive advertising campaign on the
     WORLDWIDE WEB!  Advertising on the WEB is very, very inexpensive,
     but there are HUNDREDS of FREE places to advertise also.  I will provide
     directions to find low cost e-mail addresses in report #3 for you to send out.
     Plus I will explain how you can utilize sources like BULK E-mail.

ALWAYS PROVIDE SAME-DAY SERVICE ON ALL ORDERS!!!

                              ----REQUIRED REPORTS----
***Order each REPORT by NUMBER and NAME***
ALWAYS SEND $5 CASH (concealed) FOR EACH ORDER REQUESTING
THE SPECIFIC REPORT BY NAME AND NUMBER.
ALWAYS SEND FIRST CLASS OR PRIORITY MAIL AND PROVIDE
YOUR E-MAIL ADDRESS FOR QUICK DELIVERY.
_____________________________________________________

Report #1
B. Abrahamson
P.O.  Box 1751
Maple Grove, MN 55311

Report #2
M. Gleeson
P.O. Box 31220
Chicago, IL 60631-0220

Report #3
A & J Enterprises
P.O. Box 16141
Sugar Land, Texas 77496-6141

Report #4
R. Davis
1423 Florida Avenue
St. Cloud, FL 34769
_____________________________________________________

HERE'S HOW THIS AMAZING PLAN WILL EARN YOU MONEY
Let's say you decide to start small just to see how it goes.
Assume your goal is to get only 10 people to participate on your first level.
(Placing FREE ads on the internet could get a better response.)

Also assume that everyone else in YOUR BUILDING ORGANIZATION
gets only 10 downline members.  Follow this example for the STAGGERING 
results below:

1st level -- your 10 members with $5  ($5 x 10)                     $50     (position 1)
2nd level --10 members from those 10 ($5 x 100)                  $500    (position 2)
3rd level -- 10 members from those 100 ($5 x 1,000)           $5,000   (position 3)
4th level -- 10 members from those 1,000 ($5 x 10,000)     $50,000   (position 4)
                                                THIS TOTALS----------->   $55,550

Remember friends, this is assuming that the people who participate only
recruit 10 people each.  Substitute 20 members for the original 10 and the total soars from $50,000 to over $800,000.  Dare to think for a moment what would happen
if everyone got 10 more people to participate!  Some people get 100's of recruits!  
STOP AND THINK ABOUT IT!

By the way, your cost to participate in this is practically nothing.
You obviously already have an internet connection and e-mail is FREE!!!
REPORT #3 will show you how to MASS MAIL for FREE.

REMEMBER: Approx. 50,000 new people get online monthly! ORDER YOUR REPORTS NOW!!!

*******TIPS FOR SUCCESS******* TREAT THIS AS YOUR BUSINESS! Send for the four reports IMMEDIATELY, so you will have them when the orders start coming in because: When you receive a $5 order, you MUST send out the requested product/report to comply with the U.S. Postal & Lottery Laws, Title 18, Sections 1302 and 1341 or Title 18, Section 3005 in the U.S. Code, also Code of Federal Regs. vol. 16, Sections 255 and 436, which state that: "a product or service must be exchanged for money received." * ALWAYS PROVIDE SAME-DAY SERVICE ON THE ORDERS YOU RECEIVE. * Be patient and persistent with this program. If you follow the instructions EXACTLY the results WILL undoubtedly be SUCCESS! * ABOVE ALL, HAVE FAITH IN YOURSELF THAT YOU CAN SUCCEED! *******YOUR SUCCESS GUIDELINE******* The check point that guarantees your success is simply this: You MUST receive 10 to 20 orders for REPORT #1! THIS IS A MUST! If you don't within two weeks, advertise more and send out more programs until you do. Then, a couple of weeks later you should receive at least 100 orders for REPORT #2. If you don't, advertise more and send out more programs until you do. Once you have received 100, or more orders for REPORT #2, YOU CAN RELAX, because you will be on your way to the BANK! Or, you can DOUBLE your efforts! REMEMBER: Every time your name is moved down on the list you are in front of a DIFFERENT report, so you can KEEP TRACK of your PROGRESS by what report people are ordering from you. IT'S THAT EASY!!! ******* T E S T I M O N I A L S ******* This program does work, but you must follow it EXACTLY! Especially the rule of not trying to place your name in a different position, it won't work, you'll lose a lot of money. I'm living proof that it works. It really is a great opportunity to make relatively easy money, with little cost to you. If you do choose to participate, follow the program exactly, and you'll be on your way to financial security. If you are a fellow Christian and are in financial trouble like I was, consider this a sign. I DID! Good Luck & God Bless You, Sincerely, Chris Johnson P.S. Do you have any idea what 11,700 $5 bills ($58,500) looks like piled up on the kitchen table?...IT'S AWESOME! My name is Frank. My wife Doris and I live in Bel-Air, MD. I am a cost accountant with a major U.S. Corporation and I make pretty good money. When I received the program I grumbled to Doris about receiving "junk mail"! I made fun of the whole thing, spouting my knowledge of the population and percentages involved. I "knew" it wouldn't work. Doris totally ignored my supposed intelligence and jumped in with both feet. I made merciless fun of her, and was ready to lay the old "I told you so" on her when the thing didn't work... well, the laugh was on me! Within two weeks she had received over 50 responses. Within 45 days she had received over $147,200 in $5 bills! I was stunned. I was sure that I had it all figured and that it wouldn't work...I AM a believer now. I have joined Doris in her "little" hobby. I did have seven more years until retirement, but I think of the "rat race" and it's not for me...We owe it all to MLM. Frank T., Bel-Air, MD I just want to pass along my best wishes and encouragement to you. Any doubts you have will vanish when your first orders come in. I even checked with the U.S. Post Office to verify that the plan was legal. It definitely is! IT WORKS!!! Paul Johnson, Raleigh, NC This is the only realistic money-making offer I've ever received. I participated because this plan truly makes sense. I was surprised when the $5.00 bills started filling my mail box. By the time it tapered off I had received over 8,000 orders with over $40,000 in cash. Dozens of people have sent warm personal notes too, sharing the news of their good fortunes! It's been WONDERFUL. Carl Winslow, Tulsa, OK Not being the gambling type, it took me several weeks to make up my mind to participate in this plan. But, conservative that I am, I decided that the initial investment was so little that there was just no way that I wouldn't get enough orders to at least get my money back. Boy, I was surprised when I found my medium-size post office box crammed with orders! After that it got so over-loaded that I had to start picking up my mail at the window. I'll make more money this year than any 10 years of my life before. The nice thing about this deal is that it doesn't matter where in the U.S. the people live. There simply isn't a better investment with a faster return. Mary Rockland, Lansing, MI I had received this program before. I deleted it, but later I wondered if I shouldn't have given it a try. Of course, I had no idea who to contact to get another copy, so I had to wait until I was e-mailed another program... several months passed then it came...I didn't delete this one!...I made $41,000 on the first try!! D. Wilburn, Muncie, IN Typically when I look at a money-making deal I want to know if the company is strong, will it be here when it's time for my big pay off. In this crazy thing there is no company intervention for management to blow it. Just people like me ordering directly from the source! Interesting...I had a couple of projects I'd been trying to fund to no avail so I thought; Why not give it a try? Well 2 1/2 weeks later the orders started coming in. One project is funded and I'm sure the other will be soon! Marilynn St. Claire, Logan, UT

==================================================== ORDER TODAY AND GET STARTED ON THE PATH TO YOUR FINANCIAL FREEDOM!!!

A PERSONAL NOTE FROM THE ORIGINATOR OF THIS PROGRAM By the time you have read the enclosed information and looked over the enclosed program and reports, you should have concluded that such a program could not have been created by an amateur. Allow me to tell you a little about myself. I had a profitable business for ten years. Then in 1979 my business began falling off. I was doing the same things that were previously successful for me, but it wasn't working. Finally, I figured it out. It wasn't me, it was the economy. Inflation and recession had replaced the stable economy that had been with us since 1945. I don't have to tell you what happened to the unemployment rate... because many of you know from first hand experience. There were more failures and bankrupcies than ever before. The middle class was vanishing. Those who knew what they were doing invested wisely and moved up. Those who did not, including those who never had anything to save or invest, were moving down into the ranks of the poor. As the saying goes, "THE RICH GET RICHER AND THE POOR GET POORER." The traditional methods of making money will never allow you to "move up" or "get rich", inflation will see to that. You have just received information that can give you financial freedom for the rest of your life, with "NO RISK" and "JUST A LITTLE BIT OF EFFORT." You can make more money in the next few months than you have ever imagined. E-mail is the sales tool of the future. Take advantage of this non-commercialized method of advertising NOW!! The longer you wait, the more people will be doing business using e-mail. Get your piece of this action!! MULTI-LEVEL MARKETING (MLM) has finally gained respectability. It is being taught in the Harvard Business School, and both Stanford Research and The Wall Street Journal have stated between 50% and 65% of all goods and services will be sold throughout Multi-Level Methods by the mid-to-late 1990's. This is a Multi-Billion Dollar industry and of the 500,000 millionaires in the US, 20% (100,000) made their fortune in the last several years in MLM. Moreover, statistics show 45 people become millionaires everyday through Multi-Level Marketing. CONCLUSION Very few people reach financial independence, because when opportunity knocks, they choose to ignore it. It is much easier to say "NO" than "YES", and this is the question that you must answer. Will YOU ignore this amazing opportunity or will you take advantage of it? If you do nothing, you have indeed missed something and nothing will change. Please re-read this material, this is a special opportunity. My method is simple. I sell thousands of people a product for $5 that costs me pennies to produce and e-mail. I should also point out this program is legal and everyone who participates WILL make money. This is not a chain letter or pyramid scam. This is a business! You are offering a legitimate product to your people. After they purchase the product from you, they reproduce more and resell them. As you learned from the enclosed material, the PRODUCT is a series of four 4 FINANCIAL AND BUSINESS REPORTS. The information contained in these REPORTS IS VALUABLE! They will not only help you in making your participation in this program more rewarding, but will be useful in any other business decisions you make in the future. You are also buying the rights to reprint all of the REPORTS, which will be ordered from you by those to whom you mail this program. The concise REPORTS you will be buying are easy to duplicate for your entrepreneurial endeavor. Thank you for your attention. Now make the decision that's right for you.

<� From nobody at neva.org Wed Oct 29 06:16:47 1997 From: nobody at neva.org (Neva Remailer) Date: Wed, 29 Oct 1997 22:16:47 +0800 Subject: Louis Freeh calls for communication crackdown Message-ID: <199710291407.GAA08620@mail-gw.pacbell.net> -----BEGIN PGP SIGNED MESSAGE----- Robert Hettinga wrote that David Kaufman wrote that Reuters wrote: >``It could take a $30 million supercomputer a year to figure out the >simplest encrypted message without this feature,'' Freeh said. ``And >that message might be 'we have the victim and will kill him in an >hour'.'' This seems like a good time to try out The Cypherpunk War Cry: Shine Shine!! Bakayarou!! Aho!! Manuke!! Anpontan!! (Hope it means something bad!) Jonathan Wienke correctly pointed out the absurdity of Freeh's example. But, there are two ways Louis and his supporters can wriggle out of this point. One is that the friends and relatives of the kidnap victime are sometimes tempted to conceal the crime as they may believe that a quiet negotiation and ransom payment will be more likely to secure the hostage's release than involving the authorities. (In many countries it is illegal to do this.) However, if the all knowing and all seeing secret police agency can intercept all communications they will be able to find out and interfere with plans to make ransom payments and jail the friends of the victim. That might be a little rough on the trophy, it is true, but it will be said that this will generally discourage other kidnappings in the future. The second is that encryption makes remailers possible. Remailers make it possible for kidnappers to untraceably send messages. What Louis and his supporters are neglecting is that kidnappers are already able to do this without encryption. The unabomber, while not a kidnapper, is an especially good example. For the at least a decade he was communicating with the FBI itself on a regular basis without facing any consequences. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFbKiJaWtjSmRH/5AQFNngf+Jly6DbqAU2JFPsF2gghY4tXHmp8XkVx3 t7F2IlBterhE99wxEbs+B6Nm4e0MvOCoTNbKly+XJi4If/3llFbcqBEisiib511N eX7ttczuV+ne5I2yNmt0M5vPwqRG/iaOSvwyDNbKQw72Y19PsMhZLfTp1WXYcYTC y/FcQa7JZKcf0/17kvVTgOq20XB4qxfPVMI6j7L4Dh7qRKl7Ph9CENaUq/uJtbBq NSDgsK64KFktTrERtnisJJA6RtDO+ZKUPU93vyoRuttST34EUDOcUq0QP566BAlw OKfi28+12AJtEqSUD2MEh0EgwLkKWUIkDNUp8yXzgI7BZeSSeoPbDg== =FPRq -----END PGP SIGNATURE----- From mixmaster at remail.obscura.com Wed Oct 29 06:30:04 1997 From: mixmaster at remail.obscura.com (Mix) Date: Wed, 29 Oct 1997 22:30:04 +0800 Subject: Private Health Care [On topic, please read.] Message-ID: <199710291412.GAA29666@sirius.infonex.com> -----BEGIN PGP SIGNED MESSAGE----- Michael Sims wrote: [Ed. note: Declan wrote?:] > >>The free market approach won't keep medical records private. > > > In other words, the reason a "free market" approach may not work > > right now is because the market isn't free. > Declan, every part of the "health-care market" that people are > complaining about, the parts of it that routinely and for fiscal > reasons violate people's privacy, are completely and utterly > dollar-driven and do not result from big nasty government making any > laws. This greatly underestimates the influence and involvement of the government. The medical profession uses the government to keep out competitors and keep their prices high. In many areas, the majority of the money spent on legislative campaigns is provided by various professional medical organizations. The flip side is that the medical profession will have a powerful incentive to remain in the good graces of the established political powers, whatever they may be. That means no weird experiments in protecting people's privacy. Doctors are also terribly vulnerable to liability suits. As patients, we are unable to agree to waive most liability. This makes it harder to walk into a doctor's office with a sheaf of bills and ask for service. The doctor has a strong incentive to have everything documented and ship shape because to do otherwise would make him or her look poorly in court. This may also endanger the doctor's liability insurance policy. And, because the medical market is tightly controlled, it is not possible to legally enter the market as an outsider. IMNSHO, I should be able to consult my drug dealer about ailments and their proper medication. The fact is, many people have much greater rapport with their drug dealers than with their doctors and there is often greater concern by the drug dealer for his client's welfare, at least in terms of obvious problems such as pain. Similar things can be said for health insurance companies. They are very greatly constrained in the types of policies they can offer and the sorts of agreements they can make with their customers. You could imagine an anonymous policy which opens with a medical exam which is repeated every so often for couple of years before taking effect. After, say, two years of good health, full coverage on the policy kicks in. Ironically, some states have rules very much like this, minus the anonymity. After a certain number of years all illnesses are covered regardless of whether the customer had the illness previously and lied about it on their application. (Some states even forbid life insurance issuers from excluding suicide for coverage for long term customers! Not only does this raise the price of life insurance, but in certain instances it compels people to kill themselves "for the good of their family". ) Given this legal environment, you would expect some company some where to try to corner the market on anonymous health insurance. There are a few reasons why this does not happen. One is the extreme discretionary power of insurance commissioners. This power is probably even greater than in most industries because the insurance industry is, absurdly, widely hated. No insurance company is going to rock the boat. Insurance regulation also creates a barrier to entry. Many states limit the amount of profit an insurance company can make. These limits are often very low and do not justify new entrants or new and interesting product offerings. Finally, in practice very few people choose their own insurance. The purchase decision is made indirectly by the company they work for. The feedback between what the user of insurance wants and what he or she gets is attenuated by this structure. This structure is required by law in many places because employers are required to provide "free" health insurance to their employees. The federal tax code strongly encourages companies to provide health insurance as it is a benefit which is not taxed as income. There is more to be said on this topic, I am sure. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFbSfZaWtjSmRH/5AQHP0Af/SiXKivk8zzUlvKgcYw3AFaHx2nad1ezl E/i7mYi887mx5bMhaHKQfcD2l7oXKM/tkU3ym9PXOdngMxdVvZj96XxazDpQMW8o MIhEIwMPlwQsoNylyD0+UraWCX9X/SsyFchTJqlodmn9QH7OrtLtOcnX+ibMB/Wl 3WkvHAIZeEQaSjMYhbEqEZA/N7ojz6WFsY3jQWRmsFbAKmwn0tr+3ncbuzxZP0h+ 6Bq97xnS+17wRPX1hVp04qq+gtgmnDzEmCI1wDqUrGGJXmDHiTYNurOy1mcNUU+L RaguGy69kSBNqOzLen4sV0xL+w2nw8iMVWTQ0Xg1Zo6QgLnAIv+k8w== =DdvV -----END PGP SIGNATURE----- From rah at shipwright.com Wed Oct 29 06:49:29 1997 From: rah at shipwright.com (Robert Hettinga) Date: Wed, 29 Oct 1997 22:49:29 +0800 Subject: <>(October 28, 1997) The Power of Ecobabble Message-ID: --- begin forwarded text X-Lotus-FromDomain: ILGW @ BIONOMICS at INTERLIANT @ OUTBOUND From: "VitaminB" To: "DAILY DOSE" Date: Tue, 28 Oct 1997 17:37:57 -0800 Subject: <>(October 28, 1997) The Power of Ecobabble Mime-Version: 1.0 X-MIME-Autoconverted: from quoted-printable to 8bit by pop.sneaker.net id VAA29180 Vitamin B: Your Daily Dose of Bionomics October 28, 1997 The Power of Ecobabble Paul Krugman is, without doubt, a well known economist. With a professorship at MIT and a publication list long enough to impress Stephen King, those Nobel guys in Sweden are really the only ones he hasn't impressed. In other words, just the kind of successful, mainstream economist who wouldn't give Bionomics the time of day. Until last week, that is. We don't know why, but out of the blue, Paul Krugman chose to devote his entire _Slate_ column to an analysis of Bionomics (much like a shark will analyze a tuna). Maybe he was wondering why he, a clear expert in the field of evolutionary economics, wasn't invited to speak at our conference (Nov 13-15 in San Francisco plug plug plug). Maybe he actually doesn't think that language and metaphors matter to our mental maps of the economy. Or, maybe he got asked just one too many times, "So, Prof. Krugman, what do you think of _Bionomics_, and this guy Rothschild? He's been talking about biology and economics since 1990." In any case, we're genuinely pleased to see he's spending so much time thinking about Bionomics -- you simply can't write this forcefully about something off-the-cuff. For those who haven't read it yet, the article is included below: The Power of Biobabble Pseudo-economics meets pseudo-evolution. By Paul Krugman The invitation came, rather disappointingly, by conventional mail. Still, it sounded enticing: "The Cato Institute and the Bionomics Institute invite you to Now What? Living With Perpetual Evolution, the fifth annual Bionomics Conference." Leading the list of speakers for the Nov. 13-15 conference was Gregory Benford, one of my favorite science-fiction writers. And at the top of the card was a stirring quotation from Bionomics Institute founder Michael Rothschild: ?Like a deep-sea volcano bursting to the surface, spewing out vast new lands soon to be inhabited by a complex ecosystem, the Web is creating a virtual landscape that will soon be occupied by an awesome array of economic organisms. ... It's evolution at warp speed. Strap yourself in.? The Cato Institute is a libertarian think tank noted mostly for its adamant opposition to government regulation. But what on earth (or in cyberspace) is bionomics--and why is Cato (and _Forbes ASAP_, which is a co-sponsor of the conference) promoting it? Although you have to look at Rothschild's 1990 book, _Bionomics: Economy as Ecosystem_, to get the full flavor, the essential tenets of the movement are spelled out on the Bionomics Institute home page, which offers a primer called "Bionomics 101." The primer explains: [A]ll traditional schools of economics are based on the concepts of classical physics, while bionomics is based on the principles of evolutionary biology. ... [O]rthodox economics describes the "economy as a machine." ... Instead, bionomics says that an economy is like an "evolving ecosystem." A modern market economy is like a tropical rainforest. Sounds good, doesn't it? Bionomics has won converts not only at the Cato Institute but also among a wide variety of influential people ranging from Newt Gingrich to Clyde Prestowitz. (Fortune has described it as "a policymakers' version of The Celestine Prophecy.") And Rothschild is certainly a bright, energetic fellow. There are, however, two big weaknesses in his thinking: He doesn't know much about economics, and he doesn't know much about evolution. When I say that Rothschild doesn't know much about economics, I don't mean that conventional economics is right and his ideas are wrong--although where they differ that is generally true. I mean that his description of what conventional economics is all about bears no relation to what actual economists believe or say. Take, for starters, his assertion that "orthodox economics describes the 'economy as a machine.' " You might presume from his use of quotation marks that this is something an actual economist said, or at least that it was the sort of thing that economists routinely say. But no economist I know thinks of the economy as being anything like a machine--or believes, as Rothschild asserts a bit later, that because the economy is like a machine, it is possible to make precise predictions. (In fact, it was economists who came up with the famed "random walk" hypothesis about stock prices, which says that they are inherently unpredictable.) It gets better. Rothschild tells us, "I know this is hard for non-economists to believe, but orthodox economics essentially ignores technological change." That is even harder for economists to believe. In fact, I don't know how I'm going to break the news to the guy in the next office. You see, poor Bob Solow is under the impression that he got the Nobel Prize for his work on technological change, in particular for his demonstration that technology, not capital accumulation, historically has been the main driving force in economic growth. On a different subject, it's going to be a shock to environmental economists--who have spent decades arguing that one good way to control pollution is to create a market in emission permits--to learn that this is an idea unique to bionomics and totally at odds with orthodox economic thinking. And I'm not feeling too good myself: Rothschild insists that conventional economics depends on the assumption of diminishing returns and that, as a result, economists have completely ignored the possibility of increasing returns. Does this mean I have to give back that medal the American Economic Association gave me for my work on increasing returns and international trade? Well, all this is more or less the usual. Whenever a manifesto about economics contains a sentence that begins, "Orthodox economics assumes that ..." it almost always completes that sentence with something strange and unfamiliar. In just the last two years, I've learned that I believe that gross domestic product is the sole measure of economic welfare, that growth at more than 2.5 percent always causes inflation, and that sudden speculative attacks on currencies can't happen. I've also learned that the Nobel Memorial Prize in Economic Sciences keeps going to supply-siders--or should that be Marxists? What is surprising, however, is that a man who proposes to replace what he imagines to be the mechanistic worldview of conventional economics with a new view based on evolutionary biology should know so little about the discipline that supposedly inspires him. Rothschild's lack of familiarity with evolutionary theory may not be obvious to uninformed readers--his book bristles with ostentatious footnotes and seemingly learned references. It happens, however, that I am an evolution groupie. I started as a fan of great popularizers like Richard Dawkins and Steven Pinker, and I have since graduated not only to hero worship of the leading evolutionary theorists but also to reading textbooks and even journal articles. And so when I picked up a copy of Bionomics, the first thing I did was check out the author's treatment of my heroes and of what I knew to have been the important developments in evolutionary theory since Darwin. His record was perfect: Not one of the right people was mentioned, not one of the key developments discussed. The bionomics version of what evolutionary theory is about has as little to do with the real thing as its version of what economics is about does. What the bionomics guys apparently think evolution is about is constant, breathless change--strap yourself in!--change so rapid that everything is unpredictable, that the rules themselves are constantly changing. Rothschild seems, in particular, to view evolutionary thinking as the antithesis of "equilibrium economics." Apparently nobody told him that equilibrium thinking--the idea that in order to understand how individuals interact, it is often useful to ask what would happen if each individual was doing the best he or she could given what everyone else is doing--is almost as prevalent in evolutionary theory as it is in economics. In fact, the really funny thing is that for the most part the bionomics program has already been implemented: Economics already is very similar to evolutionary theory, and vice versa. However, neither field looks anything like bionomics. OK, enough already. The really interesting question is why the Cato Institute and other free-market conservatives should be willing to squander their intellectual credibility by associating their names with this sort of thing. After all, conventional economics already has lots of nice things to say about free markets. Why not stick with Adam Smith? Part of the answer, I suspect, is sociological. Traditional conservative causes like the gold standard tend to have a musty, old-fashioned feel. They sound like the sort of thing that appeals mainly to rich old men (and conservative think tanks are, of course, mainly funded by rich old men). Young, vigorous conservatives are therefore always looking for ways to seem more fashion-forward. Some of them parade their knowledge of pop culture, some make a point of being photographed wearing miniskirts, and some go for what we might call the Wired style of economic rhetoric--the continual assertion that things are changing! so fast! that we have to use lots! of exclamation points!!! But there is also a more serious reason that bionomics appeals to the free-market faithful: They find the conventional case for laissez-faire too modest, too conditional, for their tastes. Standard economic theory offers reasons to believe that markets are a good way to organize economic activity. But it does not deify the market system, and it even offers a number of fairly well-defined ways in which markets can fail, or at least could be helped with government intervention. And that, for some conservatives, is just not good enough. Bionomics doesn't actually provide any coherent argument in favor of free markets. In fact, Rothschild's original book seems to hedge its bets: It spends a full chapter ("Japan's Secret Weapon") explaining how government-business cooperation makes the Japanese economy invincible (remember, the book was published in 1990). But what the doctrine lacks in serious argument it makes up for in rhetoric. The economy is an ecosystem, like a tropical rain forest! And what could be worse than trying to control a tropical rain forest from the top down? You wouldn't try to control an ecosystem, wiping out species you didn't like and promoting ones you did, would you? Well, actually, you probably would. I think it's called "agriculture." What do we learn from the willingness of extreme free-market conservatives to associate themselves with crank doctrines like bionomics? I think the main lesson is that their faith in free markets is just that: a faith, which does not rest on either logic or evidence. Belief comes first; then they look for arguments to justify that belief. And they are therefore not too scrupulous about the quality of those arguments, or of those who produce them. Anyway, I guess I won't attend the conference. I would have liked to meet Benford; but I couldn't stand to watch the author of _Great Sky River_ demeaning himself by consorting with such disreputable company. Paul Krugman is a professor of economics at MIT whose books include _The Age of Diminished Expectations_ and _Peddling Prosperity_. --- end forwarded text ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: From kent at bywater.songbird.com Wed Oct 29 07:39:32 1997 From: kent at bywater.songbird.com (Kent Crispin) Date: Wed, 29 Oct 1997 23:39:32 +0800 Subject: [cpe:3185] Re: rescue Mrs Allen from the Feds In-Reply-To: <3456BE4E.3B3D@ppw.net> Message-ID: <19971029072956.23995@bywater.songbird.com> On Wed, Oct 29, 1997 at 11:17:43AM +0000, Adam Back wrote: > [...] > > > The Gandi style walk in, in numbers walk off with Mrs Allen :-) What are > they going to do, shoot 1000 unarmed citizens? The 100 citizens would probably be shot by Mrs Allen. -- Kent Crispin "No reason to get excited", kent at songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html From nobody at REPLAY.COM Wed Oct 29 07:41:08 1997 From: nobody at REPLAY.COM (Anonymous) Date: Wed, 29 Oct 1997 23:41:08 +0800 Subject: Freeh agitating again Message-ID: <199710291527.QAA11521@basement.replay.com> >From Infobeat (http://www.infobeat.com): *** FBI chief calls for computer crime crackdown FBI director Louis Freeh said Tuesday that criminals were moving increasingly into cyberspace and without new laws "drug dealers, arms dealers, terrorists and spies will have immunity like no other". Freeh told the International Association of Chiefs of Police that software manufacturers should be required by law to include a feature that allows police to descramble encrypted communications. Freeh said he supported a cyber surveillance law with these features which passed out of the House Intelligence Committee. For the full text story, see http://www.infobeat.com/stories/cgi/story.cgi?id=5663807-3cc From frissell at panix.com Wed Oct 29 08:14:31 1997 From: frissell at panix.com (Duncan Frissell) Date: Thu, 30 Oct 1997 00:14:31 +0800 Subject: Search warrants and Senate hearing on medical privacy In-Reply-To: Message-ID: <3.0.2.32.19971029101832.0386b788@panix.com> -----BEGIN PGP SIGNED MESSAGE----- At 11:15 AM 10/28/97 -0500, Declan McCullagh wrote: >Yesterday a senior Justice Department official told journalists (in a >background briefing at Main Justice) that requiring police to obtain a >search warrant could derail counter-terrorism efforts. "Imposing a probable >cause standard is something we would vehemently object to," he said. Which >explains why he doesn't vehemently object to the legislation this committee >is considering. The versions of the "medical privacy" bills I'm familiar >with don't include such strict safeguards. We require the FBI to obtain a >search warrant to enter your house or office: why shouldn't we require the >same for medical files? Those of us who pay cash for their medical treatment, or don't maintain any "insurance" policies (public or private), or seek treatment in other (cheaper) countries don't have to worry about those minor privacy violations since we're not in the database (with meaningful key fields). DCF -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNFdS0IVO4r4sgSPhAQEJjQP9FkSkbdXpBog7GH7vJgBn3JKVMiQLssN2 hQ/Xvlu1PT3qGp9I22AfozxpE7jzzHkf3zoy0prl5rnydZTe5iw/1+OEslYVJN70 9KrXf/VcS2aKnoAiY0obRNa7sv/4Pn6ol64FoJhUkgWBFt83qLYQfCKD693NHTlU lO8RI2Of+Ds= =fYT2 -----END PGP SIGNATURE----- From tcmay at got.net Wed Oct 29 08:16:08 1997 From: tcmay at got.net (Tim May) Date: Thu, 30 Oct 1997 00:16:08 +0800 Subject: apropos list talk and our culture In-Reply-To: Message-ID: At 5:38 AM -0700 10/29/97, Brad Dolan wrote: >"Michael Hays" is a new CBS series about a U.S. District Attorney. Last >night's episode was about how a radio talk-show host incited a listener >to kill a BATF agent and was brought to justice. DA convinced a jury >that some things were "more important" than the first amendment. > I was just about to mention this show, in connection with the Waco incident. I was truly disgusted by the show. None of the relative balance and realism that "Law and Order" has, by comparison. For starters, very unrealistic. Even Freeh and Company understand the role of the First (to give them their due). Just plain bad writers. Some of the slimy stuff: (all quotes are rough paraphrases) * references to Waco followers as crazies: "they seem to show up everywhere" * a black assistant to Hayes talks about the chat rooms and online discussion groups that the "extreme right wing" people are in: "And this stuff is completely unregulated!" * the First Amendment is seen as a minor obstacle to prosecution. Hayes congratulates his assistant at the end for finding a way around the First as a defense. * the talk show host has apparently done nothing more than many of us have done on this list * he is convicted because he claimed not to have ever met the murderer, but a tearful witness (girlfriend of the murderer) says they did meet, briefly. (No evidence is presented that the talk show host participated, supplied weapons, encouraged the murderer, etc.) * Oh, and to add to the sliminess, the DA's office promises the tearful girlfriend that her boyfriend will get a life sentence instead of death if she testifies, but "whoops." After the assistant to Hayes talks about the Net being "completely unregulated!," and after finding the "Pentium II with 48 megs of memory," I was expecting some mention of encryption. As a way to further show how evil the online community is. But I saw no mention. I will admit to a guilty pleasure: the opening scene, where the BATF agent gets shot in the face, was delicious. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From frissell at panix.com Wed Oct 29 08:40:02 1997 From: frissell at panix.com (Duncan Frissell) Date: Thu, 30 Oct 1997 00:40:02 +0800 Subject: Work In-Reply-To: <2328C77FF9F2D011AE970000F84104A74933DB@indyexch_fddi.indy.tce.com> Message-ID: <3.0.2.32.19971029112630.0369b4e8@panix.com> -----BEGIN PGP SIGNED MESSAGE----- >Harka wrote: >>The "just don't work for them if 'ya don't like it"-argument will >>last about 4 weeks...the approximate time a human can survive >>without eating. (or a couple of weeks less, if you have kids) >> >>I.e. unless you are the super-duper, three-times nobel-prize-winner >>(with lots of money in stocks), who can AFFORD to choose employers >>that freely, you will be DAMN GLAD to have a job AT ALL, regardless >>of their policies! What is it with the "LEFTovers"? Do they have problems grasping reality? Getting work is easier these days than it's ever been in the history of mankind. I've worked steadily for 20 years and in all that time never dealt with a personnel department or a job application (the joys of contingent employment). No firing or blackballing could possibly keep me from getting well-paid work somewhere. The only way I could be kept out of work is murder. Not even imprisonment could stop me from writing that privacy book I'm always meaning to do. DCF "Otium sine literas mors est." -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNFdjsIVO4r4sgSPhAQE7lgQArmn61UDVEHScgRl3PgBRvKLLhU0ONOan AZpSkQFi4zYw5+rWTXL634IFuKiqZ4/0ThA6CHxjE9M/UjseAA4QFk91Uvm2B6A3 a9mUBLDsomJy03cuL89FMs1P/m3yZ/MRhieGb+wyGaOWG/oJjNu3PTrWk2WS3Mw+ J5TbDEwqhbI= =IBll -----END PGP SIGNATURE----- From ericm at lne.com Wed Oct 29 08:52:47 1997 From: ericm at lne.com (Eric Murray) Date: Thu, 30 Oct 1997 00:52:47 +0800 Subject: Source code obfuscation In-Reply-To: Message-ID: <199710291645.IAA26435@slack.lne.com> Lucky Green writes: > > Is anyone familiar with tools that can be used to > obscure source code so that it builds, but no longer > contains comments or useful variable or procedure > names? cfront. -- Eric Murray Chief Security Scientist N*Able Technologies www.nabletech.com (email: ericm at lne.com or nabletech.com) PGP keyid:E03F65E5 From vznuri at netcom.com Wed Oct 29 09:39:55 1997 From: vznuri at netcom.com (Vladimir Z. Nuri) Date: Thu, 30 Oct 1997 01:39:55 +0800 Subject: digital cash & politics Message-ID: <199710291706.JAA14952@netcom7.netcom.com> ------- Forwarded Message Date: Thu, 16 Oct 1997 11:40:46 -0500 (CDT) To: believer at telepath.com From: believer at telepath.com Subject: IP: End of National Markets Forwarded: - ----------- >From the USIA Daily Washington File >http://www.usia.gov/products/washfile.htm > >15 October 1997 > >THE END OF NATIONAL MARKETS (Electronic cash makes regulation difficult) > >by Stephen J. Kobrin > >(Copyright (c) 1997 Carnegie Endowment for International Peace. >Reprinted with permission from FOREIGN POLICY magazine, Summer 1997. >Permission has been obtained covering >republication/translation/abridgment by USIS and the local press >outside the United States.) > >---------------------------- > >Twenty-six years ago, Raymond Vernon's "Sovereignty at Bay" proclaimed >that "concepts such as national sovereignty and national economic >strength appear curiously drained of meaning." > >Other books followed, arguing that sovereignty, the nation-state, and >the national economy were finished -- victims of multinational >enterprises and the internationalization of production. While >sovereign states and national markets have outlasted the chorus of >Cassandras, this time the sky really may be falling. The emergence of >electronic cash and a digitally networked global economy pose direct >threats to the very basis of the territorial state. > >Let us begin with two vignettes. Fact: Smugglers fly Boeing 747s >loaded with illicit drugs into Mexico and then cram the jumbo jets >full of cash -- American bills -- for the return trip. Fiction: Uncle >Enzo, Mafia CEO, pays for intelligence in the digital future of Neal >Stephenson's novel Snow Crash: "He reaches into his pocket and pulls >out a hypercard and hands it toward Hiro. It says 'Twenty-Five Million >Hong Kong Dollars.' Hiro reaches out and takes the card. Somewhere on >earth, two computers swap bursts of electronic noise and the money >gets transferred from the Mafia's account to Hiro's." > >The 747s leaving Mexico are anachronisms, among the last surviving >examples of the physical transfer of large amounts of currency across >national borders. Most money has been electronic for some time. >Virtually all of the trillions of dollars, marks, and yen that make >their way around the world each day take the form of bytes -- chains >of zeros and ones. Only at the very end of its journey is money >transformed into something tangible: credit cards, checks, cash, or >coins. > >Hypercards are here. Mondex, a smart card or electronic purse, can be >"loaded" with electronic money from an automatic teller machine (atm) >or by telephone or personal computer using a card-reading device. >Money is spent either by swiping the card through a retailer's >terminal or over the Internet by using the card reader and a personal >computer. An electronic wallet allows anonymous card-to-card >transfers. > >It is not just the current technology of electronic cash (e-cash) or >even what might be technologically feasible in the future that >presents policymakers with new challenges. Rather, policymakers must >confront directly the implications of this technology -- and, more >generally, the emergence of an electronically networked global economy >-- for economic and political governance. As the U.S. comptroller of >the currency, Eugene Ludwig, has noted, "There is clearly a freight >train coming down the tracks...Just because it hasn't arrived yet >doesn't mean we shouldn't start getting ready." > >ELECTRONIC MONEY > >Many different forms of "electronic money" are under development, but >it is useful to look at three general categories: electronic debit and >credit systems; various forms of smart cards; and true digital money, >which has many of the properties of cash. > >Electronic debit and credit systems already exist. When a consumer >uses an ATM card to pay for merchandise, funds are transferred from >his or her account to the merchant's. Credit cards are used to make >payments over the Internet. Computer software such as Intuit provides >electronic bill payment, and it is but a short step to true electronic >checks --authenticated by a digital signature -- that can be >transmitted to the payee, endorsed, and deposited over the Internet. > >Electronic debit and credit systems represent new, more convenient >means of payment, but not new payment systems. A traditional bank or >credit card transaction lies at the end of every transaction chain. >Smart cards and digital money represent new payment systems with >potentially revolutionary implications. Smart cards are plastic >"credit" cards with an embedded microchip. Many are now used as >telephone or transit payment devices. They can be loaded with currency >from an atm or via a card reader from a telephone or personal >computer, which can then be spent at businesses, vending machines, or >turnstiles that have been equipped with appropriate devices. At this >most basic level, a smart card is simply a debit card that does not >require bank approval for each transaction; clearance takes place each >day and the value resides in third-party accounts. There is no reason, >however, that smart cards have to be limited in this way. > >Banks or other institutions could provide value on smart cards through >loans, payments for services, or products. The immediate transfer of >funds between bank accounts is not necessary; units of value can >circulate from card to card -- and from user to user -- without >debiting or crediting third-party accounts. Assuming confidence in the >creating institution, "money" could be created on smart cards and >could circulate almost indefinitely before redemption. > >Finally, electronic money can take true digital form, existing as >units of value in the form of bytes stored in the memory of personal >computers that may or may not be backed up by reserve accounts of real >money. The money could be downloaded from an account, supplied as a >loan or as payment, or bought with a credit card over the Internet. As >long as digital cash can be authenticated and there is confidence in >its continued acceptance, it could circulate indefinitely, allowing >peer-to-peer payments at will. These are big "ifs," but they are well >within the realm of the possible. > >Imagine a world where true e-cash is an everyday reality. Whether all >of the following assumptions are correct or even immediately feasible >is unimportant; some form of e-cash is coming, and we need to begin >the process of thinking about its as-yet-unexplored consequences for >economic and political governance. > >The year is 2005. You have a number of brands of e-cash on your >computer's hard drive: some withdrawn from a bank in Antigua, some >borrowed from Microsoft, and some earned as payment for your services. >You use the digital value units (DVUs) to purchase information from a >Web site, pay bills, or send money to your daughter in graduate >school. Peer-to-peer payments are easy: You can transfer DVUs to any >computer anyplace in the world with a few keystrokes. > >Your e-cash is secure and can be authenticated easily. It is also >anonymous; governments have not been able to mandate a technology that >leaves a clear audit trail. Public-key encryption technology and >digital signatures allow blind transactions; the receiving computer >knows that the DVUs are authentic without knowing the identity of the >payer. Your e-cash can be exchanged any number of times without >leaving a trace of where it has been. It is virtually impossible to >alter the value of your e-cash at either end of the transaction (by >adding a few more zeros to it, for example). > >DVUs are almost infinitely divisible. Given the virtually negligible >transaction cost, it is efficient for you to pay a dollar or two to >see a financial report over the Internet or for your teenager to rent >a popular song for the few minutes during which it is in vogue. >Microtransactions have become the norm. E-cash is issued -- actually >created -- by a large number of institutions, bank and nonbank. >Electronic currencies (e-currencies) have begun to exist on their own; >many are no longer backed by hard currency and have developed value >separately from currencies issued by central banks. DVUs circulate for >long periods of time without being redeemed or deposited. Consumer >confidence in the issuer is crucial; as with electronic commerce >(e-commerce) in general, brand names have become critical. > >The early 21st century is described as a world of competing >e-currencies, a throwback to the 19th-century world of private >currencies. The better known brands of e-cash are highly liquid and >universally accepted. It is a relatively simple matter for you to set >up filters in your electronic purse to screen out e-currencies that >you do not want to accept. > >GOVERNANCE IN THE DIGITAL WORLD > >E-cash and the increasing importance of digital markets pose problems >for central government control over the economy and the behavior of >economic actors; they also render borders around national markets and >nation-states increasingly permeable -- or, perhaps, increasingly >irrelevant. In a world where true e-cash is an everyday reality, the >basic role of government in a liberal market economy and the relevance >of borders and geography will be drastically redefined. > >While at first glance this concern appears to reflect a traditional >break between domestic and international economic issues, in fact the >advent of e-cash raises serious questions about the very idea of >"domestic" and "international" as meaningful and distinct concepts. >The new digital world presents a number of governance issues, >described below. > >-- Can central banks control the rate of growth and the size of the >money supply? Private e-currencies will make it difficult for central >bankers to control -- or even measure or define -- monetary >aggregates. Several forms of money, issued by banks and nonbanks, will >circulate. Many of these monies may be beyond the regulatory reach of >the state. At the extreme, if, as some libertarians imagine, private >currencies dominate, currencies issued by central banks may no longer >matter. > >-- Will there still be official foreign exchange transactions? E-cash >will markedly lower existing barriers to the transfer of funds across >borders. Transactions that have been restricted to money-center banks >will be available to anyone with a computer. Peer-to-peer transfers of >DVUs across national borders do not amount to "official" foreign >exchange transactions. If you have $200 worth of DVUs on your computer >and buy a program from a German vendor, you will probably have to >agree on a mark-to-dollar price. However, transferring the DVUs to >Germany is not an "official" foreign exchange transaction; the DVUs >are simply revalued as marks. In fact, national currencies may lose >meaning with the development of DVUs that have a universally accepted >denomination. Without severe restrictions on individual privacy -- >which are not out of the question -- governments will be hard-pressed >to track, account for, and control the flows of money across borders. > >-- Who will regulate or control financial institutions? The U.S. >Treasury is not sure whether existing regulations, which apply to both >banks and institutions that act like banks (i.e., take deposits), >would apply to all who issue (and create) e-cash. If nonfinancial >institutions do not accept the extensive regulatory controls that >banks take as the norm, can reserve or reporting requirements be >enforced? What about consumer protection in the event of the >insolvency of an issuer of e-cash, a system breakdown, or the loss of >a smart card? > >-- Will national income data still be meaningful? It will be almost >impossible to track transactions when e-cash becomes a widely used >means of payment, online deals across borders become much easier, and >many of the intermediaries that now serve as checkpoints for recording >transactions are eliminated by direct, peer-to-peer payments. The >widespread use of e-cash will render national economic data much less >meaningful. Indeed, the advent of both e-cash and e-commerce raises >fundamental questions about the national market as the basic unit of >account in the international economic system. > >-- How will taxes be collected? Tax evasion will be a serious problem >in an economy where e-cash transactions are the norm. It will be easy >to transfer large sums of money across borders, and tax havens will be >much easier to reach. Encrypted anonymous transactions will make >audits increasingly problematic. Additionally, tax reporting and >compliance relies on institutions and intermediaries. With e-cash and >direct payments, all sorts of sales taxes, value-added taxes, and >income taxes will be increasingly difficult to collect. More >fundamentally, the question of jurisdiction -- who gets to tax what -- >will become increasingly problematic. Say you are in Philadelphia and >you decide to download music from a computer located outside Dublin >that is run by a firm in Frankfurt. You pay with e-cash deposited in a >Cayman Islands account. In which jurisdiction does the transaction >take place? > >-- Will e-cash and e-commerce widen the gap between the haves and the >have-nots? Participation in the global electronic economy requires >infrastructure and access to a computer. Will e-cash and e-commerce >further marginalize poorer population groups and even entire poor >countries? This widened gap between the haves and the have-nots -- >those with and without access to computers -- could become >increasingly difficult to bridge. > >-- Will the loss of seigniorage be important as governments fight to >balance budgets? Seigniorage originally referred to the revenue or >profit generated due to the difference between the cost of making a >coin and its face value; it also refers to the reduction in government >interest payments when money circulates. The U.S. Treasury estimates >that traditional seigniorage amounted to $773 million in 1994 and that >the reduction in interest payments due to holdings of currency rather >than debt could be as much as $3.5 billion per year. The Bank for >International Settlements reports that the loss of seigniorage for its >11 member states will be more than $17 billion if smart cards >eliminate all bank notes under $25. > >-- Will fraud and criminal activity increase in an e-cash economy? At >the extreme -- and the issue of privacy versus the needs of law >enforcement is unresolved -- transfers of large sums of cash across >borders would be untraceable. There would be no audit trail. Digital >counterfeiters could work from anywhere in the world and spend >currency in any and all places. New financial crimes and forms of >fraud could arise that would be hard to detect, and it would be >extremely difficult to locate the perpetrators. The task of financing >illegal and criminal activity would be easier by orders of magnitude. >E-cash will lower the barriers to entry and reduce the risks of >criminal activity. > >Most of the issues raised in the recent National Research Council >report on cryptography's role in the information society apply >directly to electronic cash. Secure, easily authenticated, and >anonymous e-cash requires strong encryption technology. Anonymous >transactions, however, cannot be restricted to law-abiding citizens. >Encryption makes it as difficult for enforcement authorities to track >criminal activity as it does for criminals to penetrate legitimate >transmissions. Should privacy be complete? Or should law enforcement >authorities and national security agencies be provided access to >e-cash transactions through escrowed encryption, for example? What >about U.S. restrictions on the export of strong encryption technology? >E-cash is global cash; how can governments limit its geographic >spread? Can they even suggest that strong encryption algorithms be >restricted territorially? > >GEOGRAPHIC SPACE VERSUS CYBERSPACE > >A recent U.S. Treasury paper dealing with the tax implications of >electronic commerce argues that new communications technologies have >"effectively eliminated national borders on the information highway." >It is clear from the paper's subsequent discussion, however, that the >more fundamental problem is that electronic commerce may "dissolve the >link between an income-producing activity and a specific location." >The source of taxable income, which plays a major role in determining >liability, is defined geographically in terms of where the economic >activity that produces the income is located. Therein lies the rub: >"Electronic commerce doesn't seem to occur in any physical location >but instead takes place in the nebulous world of 'cyberspace.'" In a >digital economy it will be difficult, or even impossible, to link >income streams with specific geographic locations. > >Digitalization is cutting money and finance loose from its geographic >moorings. The framework of regulation that governs financial >institutions assumes that customers and institutions are linked by >geography -- that spatial proximity matters. E-cash and e-commerce >snap that link. What remains are systems of economic and political >governance that are rooted in geography and are trying nonetheless to >deal with e-cash and markets that exist in cyberspace. The obvious >disconnect here will only worsen over time. > >The geographical rooting of political and economic authority is >relatively recent. Territorial sovereignty, borders, and a clear >distinction between domestic and international spheres are modern >concepts associated with the rise of the nation-state. Territorial >sovereignty implies a world divided into clearly demarcated and >mutually exclusive geographic jurisdictions. It implies a world where >economic and political control arise from control over territory. >The international financial system -- which consists of hundreds of >thousands of computer screens around the globe -- is the first >international electronic marketplace. It will not be the last. E-cash >is one manifestation of a global economy that is constructed in >cyberspace rather than geographic space. The fundamental problems that >e-cash poses for governance result from this disconnect between >electronic markets and political geography. > >The very idea of controlling the money supply, for example, assumes >that geography provides a relevant means of defining the scope of the >market. It assumes that economic borders are effective, that the flow >of money across them can be monitored and controlled, and that the >volume of money within a fixed geographic area is important. All of >those assumptions are increasingly questionable in a digital world >economy. > >Many of our basic tax principles assume that transactions and income >streams can be located precisely within a given national market. That >assumption is problematic when e-cash is spent on a computer network. >It is problematic when many important economic transactions cannot be >located, or may not even take place, in geographic space. > >The increasing irrelevance of geographic jurisdiction in a digital >world economy markedly increases the risks of fraud, money-laundering, >and other financial crimes. Asking where the fraud or money-laundering >took place means asking "Whose jurisdiction applies?" and "Whose law >applies?" We need to learn to deal with crimes that cannot be located >in geographic space, where existing concepts of national jurisdiction >are increasingly irrelevant. > >The term "disintermediation" was first used to describe the >replacement of banks as financial intermediaries by direct lending in >money markets when interest rates rose. It is often used in the world >of e-commerce to describe the elimination of intermediaries by direct >seller-to-buyer transactions over the Internet. Many observers argue >that e-cash is likely to disintermediate banks. Of more fundamental >importance is the possibility that e-cash and e-commerce will >disintermediate the territorial state. > >To be clear, I argue that we face not the end of the state, but rather >the diminished efficacy of political and economic governance that is >rooted in geographic sovereignty and in mutually exclusive territorial >jurisdiction. Questions such as: "Where did the transaction take >place?" "Where did the income stream arise?" " Where is the financial >institution located?" and "Whose law applies?" will lose meaning. >E-cash and e-commerce are symptoms, albeit important ones, of an >increasing asymmetry between economics and politics, between an >electronically integrated world economy and territorial nation-states, >and between cyberspace and geographic space. How this asymmetry will >be resolved and how economic and political relations will be >reconstructed are two of the critical questions of our time. > >WHAT IS TO BE DONE? > >The question asked here is not "What is feasible?" but "What are the >limits of the possible?" Whether the picture presented here is correct >in all -- or even some -- of its details is unimportant. A digital >world economy is emerging. Imagining possible scenarios is necessary >if we are to come to grips with the consequences of this revolution. >The purpose here is to raise problems rather than to solve them and to >imagine possible futures and think about their implications for >economic and political governance. A digital world economy will demand >increasing international cooperation, harmonizing national regulations >and legislation, and strengthening the authority of international >institutions. > >The harmonization of national regulations will help to prevent >institutions, such as those issuing e-cash, from slipping between >national jurisdictions or shopping for the nation with the least >onerous regulations. However, it will not address the basic problem of >the disconnect between geographic jurisdiction and an electronically >integrated global economy. > >If it is impossible to locate transactions geographically -- if the >flows of e-cash are outside of the jurisdictional reach of every >country -- then the harmonization of national regulations will >accomplish little. The basic problem is not one of overlapping or >conflicting jurisdictions; it stems from the lack of meaning of the >very concept of "jurisdiction" in a digitalized global economy. >The erosion of the viability of territorial jurisdiction calls for >strengthened international institutions. It calls for giving >international institutions real authority to measure, to control, and, >perhaps, to tax. The Basle Committee on Banking Supervision -- an >international body of bank regulators who set global standards -- >could perhaps be given the authority to collect information from >financial institutions wherever they are located and formulate and >enforce regulations globally. Interpol, or its equivalent, may have to >be given jurisdiction over financial crimes, regardless of where they >are committed. That does not mean a world government; it does mean a >markedly increased level of international cooperation. > >The questions we must face are whether territorial sovereignty will >continue to be viable as the primary basis for economic and political >governance as we enter the 21st century, and what the implications >will be for the American economy -- and Americans in general -- if we >refuse to cooperate internationally in the face of an increasingly >integrated global economy. > > --------------------- > >ELECTRONIC CASH: A GLOSSARY > >DIGITAL DATA: Information coded into a series of zeros and ones that >can be transmitted and processed electronically. > >DIGITAL SIGNATURE: A code that allows absolute authentication of the >origin and integrity of a document, check, or electronic cash that has >been sent over a computer network. A blind signature allows >authentication without revealing the identity of the sender. > >DISINTERMEDIATION: The substitution of direct transactions for those >that are mediated. The term originated when rising interest rates >caused savings to be withdrawn from banks -- whose interest rates were >capped -- and invested in money market instruments that were the >direct debts of borrowers. Banks were disintermediated. In electronic >commerce, the term refers to the rise of direct buyer-to-seller >relationships over the Internet, disintermediating wholesalers and >retail outlets. > >ELECTRONIC MONEY: Units or tokens of monetary value that take digital >form and are transmitted over electronic networks. Digital Value Units >are the basic units of denomination of electronic money; they may or >may not correspond to units of national currency. > >ENCRYPTION: The coding of information for security purposes, such as >credit card numbers or electronic cash used over the Internet. >Public-key encryption uses a mathematical algorithm comprising a pair >of strings of numbers to encrypt and decrypt the data. For example, >the sender would encrypt the data with the receiver's public key and >the receiver would decrypt with his or her private key. > >INTERNET: A global network of linked networks that allows >communication and the sharing of information among many different >types of computers. The World Wide Web is a graphical system on the >Internet that allows rapid movement between documents and computers >through the use of embedded (hypertext) links. > >SMART CARDS: A plastic card, similar to a credit card, containing a >microchip that can be used to retrieve, store, process, and transmit >digital data like electronic cash or medical information. > ----------------------- > >(Stephen J. Kobrin is the director of the Lauder Institute of >Management and International Studies and the William Wurster professor >of multinational management at the Wharton School of the University of >Pennsylvania. This paper develops themes raised at a discussion of >electronic money at the 1997 annual meeting of the World Economic >Forum in Davos, Switzerland.) ********************************************** To subscribe or unsubscribe, email: majordomo at majordomo.pobox.com with the message: subscribe ignition-point email at address or unsubscribe ignition-point email at address ********************************************** http://www.telepath.com/believer ********************************************** ------- End of Forwarded Message From nelson at crynwr.com Wed Oct 29 09:48:20 1997 From: nelson at crynwr.com (Russell Nelson) Date: Thu, 30 Oct 1997 01:48:20 +0800 Subject: Is mixmaster dead? Message-ID: <19971029172357.14375.qmail@desk.crynwr.com> Lance hasn't updated his mixmaster page in over a year. Is mixmaster dead? -- -russ http://www.crynwr.com/~nelson | Freedom is the Crynwr Software supports freed software | PGPok | primary cause of peace. 521 Pleasant Valley Rd. | +1 315 268 1925 voice | Taxes feed the naked Potsdam, NY 13676-3213 | +1 315 268 9201 FAX | and clothe the hungry. From frissell at panix.com Wed Oct 29 10:33:37 1997 From: frissell at panix.com (Duncan Frissell) Date: Thu, 30 Oct 1997 02:33:37 +0800 Subject: apropos list talk and our culture In-Reply-To: Message-ID: <3.0.2.32.19971029133032.006ae228@panix.com> -----BEGIN PGP SIGNED MESSAGE----- At 08:06 AM 10/29/97 -0700, Tim May wrote: >I will admit to a guilty pleasure: the opening scene, where the BATF agent >gets shot in the face, was delicious. BATF - still the highest death rate of any federal enforcement agency (because bootleggers are in it for real). DCF -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNFeAxIVO4r4sgSPhAQFPDAQAs82SonkbOlZlygBB66RqtGlnaUaumD+V xtFEw70GfhtbRRpf5DxeKjJQfOEpiAzKs/ru7N9HnLMHi7BIZZocqqx+EmtWqXik 8nyH8MSmPjGgkgBlx8ugbpcqlWevPlqW4+hNmy8+NoNqXhZch9RUfpwBAkfFKzYe pFm2qcis328= =r1rp -----END PGP SIGNATURE----- From tcmay at got.net Wed Oct 29 10:35:14 1997 From: tcmay at got.net (Tim May) Date: Thu, 30 Oct 1997 02:35:14 +0800 Subject: Protocols for Insurance to Maintain Privacy In-Reply-To: <199710291412.GAA29666@sirius.infonex.com> Message-ID: At 7:12 AM -0700 10/29/97, Monty Cantsin wrote: >And, because the medical market is tightly controlled, it is not >possible to legally enter the market as an outsider. IMNSHO, I should >be able to consult my drug dealer about ailments and their proper >medication. The fact is, many people have much greater rapport with >their drug dealers than with their doctors and there is often greater >concern by the drug dealer for his client's welfare, at least in terms >of obvious problems such as pain. Ditto for pharmacists. In the U.S. one can only buy "prescription drugs" by, well, getting a "prescription." This is a nice side-racket the doctors have, of course, as the prescription generates a tidy little fee for the prescribing doctor. A $75 office visit for less than a minute of actual doctor involvement. Nice work if you can get it. And of course in Mexico and other "backward" places, where such reimbursement f office visits is considerably different, so-called prescription drugs are available at nearly all corner pharmacies. Lots of Americans make the drive from San Diego to Tijuana to buy prescription drugs either too expensive (those doctors visits) or unavailable in the U.S. And the Customs department at the border has pretty much given up on stopping people from carrying personal-use quantities. (The gay lobby exerted a lot of influence on this, as gays travel to Tijuana to pick up medicines they think are effective, whether approved in the U.S. for gay cancers or not.) The FDA has probably killed more people in the last 30 years than all the wars the U.S. has been in during the same time. Mostly because of the game-theoretic nature of the system: all that matters to FDA officials is covering their ass so that promotion is ensured. No points for approving a controversial drug, but lots of demerits for approving a drug which hurts even one person (if the media reports it as "another FDA oversight"). Avoiding flipper children is the raison d'etre for these people. >Similar things can be said for health insurance companies. They are >very greatly constrained in the types of policies they can offer and >the sorts of agreements they can make with their customers. You could >imagine an anonymous policy which opens with a medical exam which is >repeated every so often for couple of years before taking effect. >After, say, two years of good health, full coverage on the policy >kicks in. There are interesting protocols which can be used to skirt statist laws about insurance. A la carte insurance, for specific illnesses, is one of the best examples. Thus, a heterosexual male who doesn't use IV needles can "opt out" of coverage for AIDS-related treatments, thus transferring the effective cost to those most worthy. (Probably why many legislators want such opt-outs banned.) This has similarities to crypto protocols. And anonymity. To wit, it is possible to arrange anonymous blood tests for various conditions. So, Alice arranges a distributed set of such tests, perhaps at multiple labs. When she finds she has no preconditions or precursors for Diseases A, B, C, and D, she opts out of being covered for these diseases. This is dramatically different from the way things are now supposed to be done: where Alice is given a suite of tests *by her insurer* to determine risks, premiums, etc. This approach, the tests by her insurer, almost immediately lead to potential privacy problems, as insurers (naturally enough) record such results in their records and may even "share" (or trade, or sell) results with other insurers, companies, etc. The "a la carte" approach allows Alice to "selectively disclose her preferences," by the coverage she buys. The insurer may still demand tests, of course, as is his right. But Alice may choose to pay higher rates for the limited things she wants covered, and so an overall privacy-maintaining balance should be possible. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From whgiii at invweb.net Wed Oct 29 10:39:16 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 30 Oct 1997 02:39:16 +0800 Subject: [cpe:3185] Re: rescue Mrs Allen from the Feds In-Reply-To: <19971029072956.23995@bywater.songbird.com> Message-ID: <199710291731.MAA09661@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <19971029072956.23995 at bywater.songbird.com>, on 10/29/97 at 07:29 AM, Kent Crispin said: >On Wed, Oct 29, 1997 at 11:17:43AM +0000, Adam Back wrote: >> >[...] >> >> >> The Gandi style walk in, in numbers walk off with Mrs Allen :-) What are >> they going to do, shoot 1000 unarmed citizens? >The 100 citizens would probably be shot by Mrs Allen. More like 1,000 citizens would be shot on orders from Jim (can believe they made that pick governor) Edgar and then blamed on Mrs Allen who also would be shot. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNFdyeI9Co1n+aLhhAQGCRAQAg4JEfEo0+GvYziWc+mkkBYafnnIdQ5Fc at6yigUnDTh025wqUAGxOrUp+V/by4bWBwVAU+JVSMiXahTNG10Y3RnIqXOxOSxl wZZk1pf+FzMPBpf84H0H/v9fMrAo2lX2gaLLKul7PERP/hN/tt+qLWqLwE5v3BJL FyMe1yQnYjg= =Ce7j -----END PGP SIGNATURE----- From aba at dcs.ex.ac.uk Wed Oct 29 10:46:13 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Thu, 30 Oct 1997 02:46:13 +0800 Subject: [cpe:3185] Re: rescue Mrs Allen from the Feds In-Reply-To: <19971029072956.23995@bywater.songbird.com> Message-ID: <199710291731.RAA00923@server.test.net> Kent Crispin writes: > On Wed, Oct 29, 1997 at 11:17:43AM +0000, Adam Back wrote: > > The Gandi style walk in, in numbers walk off with Mrs Allen :-) What are > > they going to do, shoot 1000 unarmed citizens? > > The 100 citizens would probably be shot by Mrs Allen. Heh, yeah. That's why you need to send in the spread spectrum phone first, to let her know what you're planning -- else she'll just think it's a ploy by the Feds. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 It seems that unknown Cypherpunks have yet again shown their disrespect of US export laws by exporting the latest version of PGP. The Windows version of PGP 5.5 is now available for your downloading pleasure at ftp://ftp.replay.com/pub/crypto/incoming/PGP55.zip PGP 5.5 features superior LDAP keyserver integration, multiple signature categories, and automatic decryption (set Preferences -> Email -> Automatically Decrypt). "You heard the rumors. Now try it yourself." :-) -- Lucky Green PGP encrypted email preferred. "Tonga? Where the hell is Tonga? They have Cypherpunks there?" From anon at anon.efga.org Wed Oct 29 12:13:26 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 30 Oct 1997 04:13:26 +0800 Subject: [URGENT] Secure checksums Message-ID: <4bce0368c6dca6472723bacbbd57dee7@anon.efga.org> Warning: if you fuck Timothy C[unt] May in the ass, a rabid tapeworm might bite your penis. \0/ \0/\ \ / / \0/ \0/ \0/\ \ / /\0/ \0/ Timothy C[unt] May | / /) | (\ | | / /) | (\ \ | / \__/\__/0\__/0\__/0\__/ \__/ \__/\__/0\__/0\__/0\__/\__/ \ From 1900 at qui.com Thu Oct 30 05:09:54 1997 From: 1900 at qui.com (1900 at qui.com) Date: Thu, 30 Oct 1997 05:09:54 -0800 (PST) Subject: WOMEN!! LIVE AND WAITING!! Message-ID: <199710301309.FAA07476@toad.com> GUYS! WE WANT TO HEAR FROM YOU!!! WE'RE LIVE AND WAITING!!! 1-900-407-2273 Extension 4688 24 hr hotline USA ONLY $3.99 per min Must be 18 yrs. Procall Co. (602)631-0615 To be removed from this mailing list, auto-reply with remove in the subject field From anon at anon.efga.org Wed Oct 29 13:13:23 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 30 Oct 1997 05:13:23 +0800 Subject: The Anti-Privacy Agenda of Gary Burnore/DataBasix (was: Re: Netcom ripped me off) Message-ID: <06beaedb8720e3b9f6dc40431f9c88b6@anon.efga.org> moonman3 at ix.netcom.com wrote: > > Close, except that you post under the pseudonym "moonman3" instead. > > So unless your "real name" is "Moonman", it's more of the typical > > hypocrisy that spews forth from Gary Burnore and the DataBasix gang. > > Since most of Gary's "supporters" (including you) seem to post from > > Netcruiser accounts with phony pseudonyms ("eridani", "moonman3", > > "wotan", "tweek", etc.) it's counter-productive for you to whine > > too loudly about posting with "real names". Could it be that Gary > > is pi**ed when he sees a post with which he disagrees and which > > doesn't have an address which he can "spam bait", mail bomb, etc.? > > moonman3 at ix.netcom.com is my legitimate address. > > Too bad for you that you have to hide behind the skirts of a remailer. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > Something about your childhood? > > > Gary Burnore could suddenly acquire even more "supporters" like you if he > > could only afford to pay for a few more throwaway Netcom accounts with > > cutesy "names". > > "eridani", "moonman3", "wotan", "tweek", etc. are all valid addresses. > We do not hide behind a remailer. More classic double-speak from the DataBasix Gang, I see... Nice try at changing the subject, but it's you, Gary Burnore , and Belinda Bryan that made such a pitiful whine about the need to post with "real names". It's irrelevant whether the pseudonyms you use at Netcom are "legitimate addresses" or not. Anonymity involves concealing your NAME, not your ADDRESS. Since your post does not contain your name, it's an ANONYMOUS post, just like mine is. Unless you're trying to claim that "moonman3" is your "real name", then you're a whining hypocrite. Personally, I don't care what your "real name" is. You have every right to "hide behind the skirts of" a pseudonym, if you so choose. But if you do so, you have no right to criticize someone who utilizes a remailer to protect his/her privacy rather than an ISP like Netcom. Like it or not, my e-mail address is my personal property. If I want someone to send e-mail to me, I'll give it to them. I need not broadcast it indiscriminately to accomplish that purpose. I need not subject myself to the abuse that seems to befall those who dare to publicly challenge Gary Burnore and his tactics as the price of free speech. Such abusive tactics are a form of de facto censorship. -- Without censorship, things can get terribly confused in the public mind. -- General William Westmoreland From ulf at fitug.de Thu Oct 30 05:26:06 1997 From: ulf at fitug.de (Ulf =?iso-8859-1?Q?M=F6ller?=) Date: Thu, 30 Oct 1997 05:26:06 -0800 (PST) Subject: Is mixmaster dead? In-Reply-To: Message-ID: <9710301325.AA72212@public.uni-hamburg.de> > > Lance hasn't updated his mixmaster page in over a year. Is mixmaster > > dead? > > On the contrary. http://www.thur.de/ulf/mix has the latest Mixmaster stuff. The thur.de web server is down until this week-end due to a hard disk failure. Everyone interested in Mixmaster development is invited to subscribe to the MIX-L mailing list at mix-l-request at jpunix.com From emc at wire.insync.net Wed Oct 29 13:45:36 1997 From: emc at wire.insync.net (Eric Cordian) Date: Thu, 30 Oct 1997 05:45:36 +0800 Subject: [cpe:3185] Re: rescue Mrs Allen from the Feds In-Reply-To: <199710291731.RAA00923@server.test.net> Message-ID: <199710292133.PAA00380@wire.insync.net> Adam Back writes: > Heh, yeah. That's why you need to send in the spread spectrum phone > first, to let her know what you're planning -- else she'll just think > it's a ploy by the Feds. Yes - it would very embarrassing if Mrs. Allen shot holes in her would-be Cypherpunk and Militia rescuers. We need to strap Sternlight to a metal pole and thrust him through the door until we are absolutely sure she is out of bullets. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law" From azur at netcom.com Wed Oct 29 14:03:51 1997 From: azur at netcom.com (Steve Schear) Date: Thu, 30 Oct 1997 06:03:51 +0800 Subject: apropos list talk and our culture In-Reply-To: Message-ID: At 8:06 AM -0700 10/29/1997, Tim May wrote: >At 5:38 AM -0700 10/29/97, Brad Dolan wrote: >>"Michael Hays" is a new CBS series about a U.S. District Attorney. Last >>night's episode was about how a radio talk-show host incited a listener >>to kill a BATF agent and was brought to justice. DA convinced a jury >>that some things were "more important" than the first amendment. Wouldn't it be interesting if someone incited a Net listener/reader to kill the producer of this "Michael Hays" episode in a "life immitates art" situation? --Steve From azur at netcom.com Wed Oct 29 14:05:11 1997 From: azur at netcom.com (Steve Schear) Date: Thu, 30 Oct 1997 06:05:11 +0800 Subject: Kyl S-474 Anti-Gambling Bill passes committee In-Reply-To: <3.0.3.32.19971029032045.007052b8@popd.ix.netcom.com> Message-ID: At 3:20 AM -0800 10/29/1997, Bill Stewart wrote: >>> SENATE JUDICIARY COMMITTEE APPROVED BILL (S-474) BY SEN. KYL > (R-ARIZ.) TO PROHIBIT GAMBLING OVER INTERNET.<> - Senate Judiciary > Committee approved bill by Sen. Kyl to prohibit gambling over > Internet. As proposed by Kyl to panel, bill would have allowed states > to allow Internet gambling, but provision was dropped when Sens. > Biden and Sessions objected. [TELEVISION DIGEST, 66 words] Prediction: this bill will be about as effective as outlawing spring. About 20% of gamblers are 'problem' types who now regularly game illegally and could careless about the penalties. Once all on-line casinos offer real and 'play-money' wagering and strong crypto it will be neigh impossible for the Feds to know or prove which players are wagering real money and therefore gambling. Once Onion and Crowds routers are operational and widespread the Feds won't even be able to find the casinos, and even if they do they may not be able to shut them down (especially if they are built in a distributed fasion). --Steve PGP mail preferred, see http://www.pgp.com and http://web.mit.edu/network/pgp.html RSA Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Steve Schear | tel: (702) 658-2654 CEO | fax: (702) 658-2673 First ECache Corporation | 7075 West Gowan Road | Suite 2148 | Las Vegas, NV 89129 | Internet: azur at netcom.com --------------------------------------------------------------------- From whgiii at invweb.net Wed Oct 29 14:30:23 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 30 Oct 1997 06:30:23 +0800 Subject: [cpe:3185] Re: rescue Mrs Allen from the Feds In-Reply-To: <199710292133.PAA00380@wire.insync.net> Message-ID: <199710292224.RAA12328@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <199710292133.PAA00380 at wire.insync.net>, on 10/29/97 at 03:33 PM, Eric Cordian said: >Adam Back writes: >> Heh, yeah. That's why you need to send in the spread spectrum phone >> first, to let her know what you're planning -- else she'll just think >> it's a ploy by the Feds. >Yes - it would very embarrassing if Mrs. Allen shot holes in her would-be >Cypherpunk and Militia rescuers. >We need to strap Sternlight to a metal pole and thrust him through the >door until we are absolutely sure she is out of bullets. I'll bring the pole & duct tape!! :) - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNFe29I9Co1n+aLhhAQEdxgQAu9thKOKKaIfJYsbOC6ftVYi4vSZ/pvt6 ls2ytaPeZS8WBXKZfdOwPmBFCAZF6zwg+R+tMK6iPr1Hnn8auxDk5X+KTt4JkZhh 1jwxbieYYN0Yp+5h1Nse21tI/x6ad9qfG4pQeCcUoZModFBDAFF2R92TtzBjWhvP /XWF9vRcTzM= =gDfR -----END PGP SIGNATURE----- From declan at well.com Wed Oct 29 15:07:40 1997 From: declan at well.com (Declan McCullagh) Date: Thu, 30 Oct 1997 07:07:40 +0800 Subject: Crypto-update: Magaziner on Clinton, Senate on crypto-czar Message-ID: [Reminder: There //is// a DC cypherpunks meeting this Sunday afternoon! Email me for details if you don't have 'em yet. --Declan] ---------- Forwarded message ---------- Date: Wed, 29 Oct 1997 14:53:07 -0800 (PST) From: Declan McCullagh To: fight-censorship-announce at vorlon.mit.edu Subject: Crypto-update: Magaziner on Clinton, Senate on crypto-czar Ira Magaziner, Clinton's Net-advisor, spoke today at the District of Columbia Bar Association, Computer and Telecommunications Law section conference. A brief report, as told to me by someone who was there: >Magaziner said Clinton and Gore specifically oppose mandatory >domestic key recovery. Said they're still fighting it >out within the administration and hope to work out a >reasonable compromise. Aligned himself pretty clearly >with the commercial, not the law enforcement side. Said >that when Freeh waves around the "four horsemen," he's >hard-pressed to come up with an informed answer. Said >NSA had been involved in lobbying on the Hill. Also, a Senate committee today approved the nomination of David "Crypto-Ambassador" Aaron to be Under Secretary of Commerce for International Trade. Aaron has been for the last year trying to export the FBI's crypto-proposals for mandatory Big Brother cryptoware. (And unconfirmed reports say he's been getting into fights not just inside the OECD in Paris, but outside: apparently he's tussled with Parisian cabbies more than once...) Aaron's nomination now goes to the full Senate; no vote has been scheduled yet. -Declan From yr at dev.null Wed Oct 29 15:17:27 1997 From: yr at dev.null (Yoshiwara Remailer) Date: Thu, 30 Oct 1997 07:17:27 +0800 Subject: John Young--NWO Schill / Re: EU E-Commerce Report In-Reply-To: <1.5.4.32.19971029111842.00b6b4b8@pop.pipeline.com> Message-ID: <3457BD4D.534D@dev.null> -----BEGIN 'I'M ALWAYS RIGHT AND I NEVER LIE' SIGNED MESSAGE----- John Young wrote: > The EU-based Global Internet Project has published a new > report on electronic commerce: > http://jya.com/gip-ecomm.htm (29K) > > An excerpt on crypto policy: > > 1.No nation's cryptography policy can stand alone. > > 2. Immediate steps should be taken to solve pressing > cryptographic needs that directly affect the global Internet. > > 3. Reliable and international systems for authentication > and integrity should be established. John Young, New World Order Schill (secret member of the New World Order of Schills), has cleverly and deceptively given us a pointer to the 'official release' version of the GIP report on electronic commerce, in which point #4 purports to be: > 4. Governments and industry must respond to legitimate user > concerns. In the triple-secret *real* GIP report, as JYA knows, point #4 is as follows: "4. No one shall buy or sell unless they have the digital implant of the New World Order in their right hand, or in their foreheads." > 5. Users should be permitted to decide whether and the degree > to which key escrow, trusted third party, or key recovery > technologies will be desirable in their environments or not. > > 6. Trade barriers should not be disguised as cryptographic > regulations. > > 7. Export controls on encryption should be made multilateral > in practice and when used, focused narrowly and genuinely on > national security threats. They should not be used as indirect > domestic controls. > > 8. Governments should establish and publish the process by > which keys will be obtained for government purposes. This > process should include independent judicial review, time limits > on access, reasonable notice to the key owner when this would > not interfere with the purposes of the decryption, and > opportunities for independent audit of compliance with legal > process. > > 9. Liability for misuse of escrowed keys should be the subject > of international understanding. > > 10. When key recovery is voluntarily chosen by the user, > self-retention of key recovery information should be encouraged. -----END 'I'M ALWAYS RIGHT AND I NEVER LIE' SIGNED MESSAGE----- From yr at dev.null Wed Oct 29 15:26:40 1997 From: yr at dev.null (Yoshiwara Remailer) Date: Thu, 30 Oct 1997 07:26:40 +0800 Subject: [cpx:709] Re: rescue Mrs Allen from the Feds (Re: Tim's worst nightmare.,..) In-Reply-To: <199710291117.LAA01288@server.test.net> Message-ID: <3457BEFD.4572@dev.null> Adam Back wrote: > graycastle at ppw.net > > > What is needed is several thousand well armed militia to go down there and > > > send the JackBooted thugs packing. I am willing to donate my time to such > > > a worthy cause. > > > > that is the type of answer that gets even more people killed. > > what good is developing privacy software if you are going to march out > > and invite uncle sam to put a bullet in you? > A robin hood style hack would be preferable -- rescue Mrs Allen > without killing any Feds, not that they might not deserve it, but it > makes for better PR. PR? Non-Violent? How about bombing the former site of the Murrah Federal Building in support of Ms. Roby of 1997? How much clearer and non-life threatening (for now) can a message be? Tim C. McVeigh "'Pull it, Sir.' prize winner of Cell Block 709." From anon at anon.efga.org Wed Oct 29 15:28:07 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 30 Oct 1997 07:28:07 +0800 Subject: poverty traps (Re: Sa Message-ID: <57f699d8a7c3b0c919bf94093536d1ba@anon.efga.org> -----BEGIN PGP SIGNED MESSAGE----- Harka wrote: > -=> Quoting In:anon at anon.efga.org (Monty Cantsin) to Harka <=- > > In> The government is not Janice's friend. It takes away $18,000 > In> from her each year and plunges her into poverty, sort of. If > In> you are appealing to the government to assist Janice, first > In> ask it to get the hell out of the way. (I realize you may > In> just be saying that Janice's plight is unavoidable, not that > In> she should be helped with government money.) > >Hmm, we all agree, that the government is not somebody to be trusted >to be your friend. However, we also know the amount of laws possible >to "violate" and the consequences that would have. And one of the >worst things you can do is evading taxes. At least when they clamp >down on you. Not something, I'd recommend to a mother of four kids >(that she really doesn't want to give up to >government-so-schill-workers). Jim Choate commented on that already, >so I save further words. Ignoring the ethical issues (Is it ethical to lie about your income? Is it ethical to break the law?), the consequences would probably not be too severe, if there were any consequences at all. We've seen several cabinet level people conspire to shield their employees from paying income tax and at least one of them (Ron Brown) did not even leave office. Nobody went to jail. Or, consider the record for prostitutes. How often do they go to jail for neglecting to pay income tax? Never, I believe. Prosecution would be hard after all, they receive cash and they spend cash. You could also do other low risk or even legal things like trading services. Maybe a discount is given to parents who will watch Janice's kids once in awhile. Maybe they trade services for food. Etc. Etc. > In> Janice should be baby sitting. Were she to take in 4 kids at > In> $500/month, she would make as much as her job and be able to > In> watch her own kids during the same time. > >True in short-term. But after 8 kids have been rummaging around in >your apartment every day (even without licence and off-the-books and >all that stuff) you can definitely expect to spend a couple of grands >on repairs in a matter of a month. You would be of more help to your friend Janice if you did not try to find reasons for her to fail. The reality is that 8 kids will not cause thousands of dollars of damage every month. Also, I left some play in my calculations. She doesn't actually have to make $2000 a month to break even because she already "makes" $1000 by watching her own kids. That means she only has to make $1000 each month to break even with her job. Let's say the tax rate is 50% (it's much lower), and she charges $500/month per kid. Then, 4 kids will result in an income of $1000/month. There's still some fat there. We haven't computed how much she'll save in work related expenses. You mentioned $120/month in mass transit costs. How much for clothing? If she has to dress professionally, $1000/year is quite a conservative figure. (Don't forget dry cleaning.) And we haven't considered the fact that she can charge more money because she is a babysitter and not a daycare center. > In> The food is generous because four of the five are kids, the > In> oldest only being 12. Kids don't each much. > >You're confirming my suspicion about not having kids :) Seriously, I don't think my figures are inaccurate. How much can a three year old eat? And, incidentally, I doubt very much that you or Janice even know with any accuracy what her actual expenses are. Janice should be tracking every expense to the penny. She should review her spending on a regular and scheduled basis to see where she could be spending it better. An adult who is not all that careful can comfortably buy enough food for $200/month. But, Janice should be more than careful. She should be fanatic about lowering this expense. This will work better if she looks at as an interesting puzzle to work out rather than a chore. She should practice vegetarianism. Not only that, she should be carefully studying other poor people for ideas on how to get by on just a little income. Peasants of India, Mexico, and China will all have interesting tricks. For instance, the stereotypical Mexican diet of corn and beans just turns out to be an optimal combination. The amino acids missing from the corn are found in the beans and vice versa. (How a bunch of "ignorant" peasants figured this out is a mystery to me.) There are many books on living inexpensively on a vegetarian diet. They tend to have titles like "Chinese Cooking on 25 Cents a Day". These books may be found at the library, or at a used bookstore, or even be borrowed. It is somewhat ironic that you can spend much less money and eat better than most Americans. Also, she should hunt up a food coop. I am sure there is one in her area. Usually you can volunteer some nominal amount of time and receive at least a 10% discount. Sometimes more. Also, buying staples in bulk can dramatically lower costs. (Best to make sure you like lentils before buying a fifty pound sack, though.) Food coops usually have people around who know a whole lot about living inexpensively. They may also have a lending library. Anyway, you will find (hopefully) that there are thousands of ways to improve one's situation. They (usually) aren't painful - when you find a new one it's fun. After awhile you discover you are not in a bad situation any more. Isn't that exciting? >Talking about freedom at the same time then is an oxymoron and you're >confirming my "criticisms about the free market" (Yes Tim, I have >re-considered my position without changing my perspective in the >end). Capitalism in it's current form does not allow for individual >freedom for most people (exceptions apply), because they have to make >the money to be free (independent). If that requires doing for >years, what you don't want to do (working in computers, although you >hate them and all you really want to do is paint and live as an >artist but can't afford to, for example), then that means by >definition, that freedom has to be given up. At least temporarely and >as mentioned before, that can be a _very_ long time for most people >(who have been born into the "wrong" families, for example). But of course you have to do things you don't want to do to put food on the table! This is true everywhere. The key question is this: why should somebody else labor all summer so you'll have food in the winter? All a "free market" advocate is saying is that you should not force the other guy to raise your food. You have to persuade him to do it for you, perhaps by doing something for him in return. If you think about it for awhile you will realize that this is a profoundly pacifistic belief. And a very reasonable and realistic one. If nobody else values your natural painting talent it won't be of much use getting food on the table. You'll have to find something else you can do for other people which they want and which you don't mind doing. How could this possibly be unjust? >Cypherpunks sometimes tend to become somewhat theoretical about >things, neglecting the possibility, that it may not apply on a >larger (real-life)scale. No, you don't understand the idea. You are looking at it like this: "How can we engineer this system so that everybody will do just fine (by my definition.)" The Cypherpunk point of view, to the extent there is such a thing, is something like this: "It is not right to dictate to other people what their life choices should be." People will make mistakes. People will get unlucky. Some people will get very unlucky and die (early). Most Cypherpunks prefer this to a world where we all live in little cells and have food brought every day. One way to solve the problems of the Janices in the world is to tell them what to do: Do not raise four kids. Do not get a lame degree. Do not get divorced. This would solve Janice's "problems". So what's wrong with the picture? Well, Janice apparently wanted four kids. She apparently wanted a degree in education instead of computer science. How can we judge whether getting married wasn't a worthwhile risk? How can we judge the value Janice places on her children? The answer is: we can not and should not. But, likewise, just because Janice took some chances and it led to minor problems, that does not mean that anybody else is obligated to worry about them. The problems Janice has are called "real life". Things may not be what she wants right now, but they result from her choices and her decisions. To me, and most Cypherpunks, that is preferable. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFOteJaWtjSmRH/5AQFy4Qf9FwMV1Swp0YSwuaSNhaSnaUGpIe9B6Ndf m3eaSiiOhcQXaJH88CUUYUz2RvYqxqFpjfDp7Wzik9yncwuOHR1sd+LKzcAcD437 5DehzEhxnRSLBwVGVXy94FmLUXaEJCw5woedEhOa9GOPw2e8LUYkKOjG074Od1V1 Gs6XnBMnx/oa0lI1RNBi2oWbfBFzNSCiv24pp5PeMZVkb4e/MB51HOhv8FhH/f2J Te1SF/w2awXbv0BU8B4bZAc660DMVaXgi+uqMs2gUB6HRqmOjek3fuVK0cS8YRzC TMJSMehCZJbcoPEI+RkK2mnTqoivqdRdnYD4CnjiJ4KuSsqmGDWVNw== =oSqR -----END PGP SIGNATURE----- From anon at anon.efga.org Wed Oct 29 15:39:00 1997 From: anon at anon.efga.org (Anonymous) Date: Thu, 30 Oct 1997 07:39:00 +0800 Subject: Choices Message-ID: -----BEGIN PGP SIGNED MESSAGE----- >However, having a choice in matters does not imply the guarantee of >making the _right_ choices. That is exactly correct. >In fact, even society acknowledges that fact by making certain >choices available only after a certain point in life, such as voting, >marriage, driving, drinking etc.etc on the ground, that making such >decisions requires a certain level of insight and maturity. FYI, these discussions are about free adults. Not about dependents like children. >But there's _still_ no guarantee for making right choices even after >the "magical" age of 18 (or 21). Yep! >The only thing one can do is to gather enough information in order to >make the best choice based on available information and conditions >_known_ to you _at that time_. Right on! >And here's also the catch. By making a certain choice, one does >usually _not_ choose the consequences of his/her actions consciously! >In fact, the possible consequences may not even be foreseeable, >predictable or expected in any way! I guess we have to do our best anyway! But, seriously, most of the possible outcomes we are aware of. You gave the example of driving. Everybody knows that having an accident is a possible outcome of driving. >Let's take the example of Janice one more time (violins for Monty:)): >certainly her decision to get married and have 4 kids was her >personal and free choice at that time. >But it was not foreseeable nor expectable for her, that her husband >would take off after a while for another chick, leaving her with the >kids and a bunch of bills to pay! She obviously knew it was a possibility. I mean, look around you! It happens all the time. This used to be the reason people formed marriage contracts. They used to be respected and when not respected enforced. (Incidentally, Janice's child support payment is absurdly low. This is a situation where a marriage contract would really have some value. Funny how the government isn't protecting women and children anymore - you would almost think they didn't really care.) >Thus she married him and later did what every wife would do: >supporting him while he went to school instead of keeping the money >for herself as a backup-cushion in case he leaves. Her decision, though. Too bad it didn't work out better. It is a great tragedy of our society that marriage contracts cannot be freely made and that the terms and conditions are not enforced. For the most part women and children pay the price. (Also, the fact that pre-nuptial agreements are not consistently followed by the courts is tragic. Obviously, if you are wealthy you should be able to marry without exposing yourself to gold diggers.) >Is that really so out of the ordinary a choice?? Just because you go with the herd does not mean you did not make a mistake. But, really, I'm not convinced that Janice did make a mistake. Some people really want to have children. Some people really want to have a nice stable marriage which lasts decades. To get that you have to take chances. Sometimes it won't work out. That's life. But that doesn't mean that it wasn't worth a try. >But even if one is able to make fairly good decisions overall in >life: you may not have previous conditions necessary to make certain >choices. > >If you're born into a poor family, who just can't afford to send you >to College, how much of a choice to study will you have in that >event? More likely is, that you'll have to work and aid in the >support of the family instead of going to College. > >But are you to be held responsible for the conditions that you are >born into or grow up under? Ummm....who else should be responsible? >Clearly not. As you go along in life, one's personal ability to >influence your surroundings, conditions and overall life increase >(with right effort). But to expect everybody to be able to make >certain choices in a certain (right) way, or even expecting those >choices being available, is not based on the realities of life but a >mere projection from _your_ reality onto "theirs". But, what you are on your way to imposing is your reality on everybody else. This is implied by your skepticism of the "free market". If people are not allowed to freely make choices and arrangements with each other, it is implied that somebody else will be making choices and arrangements for them. >So is the statement of "screw 'em all" (if they weren't able to make >certain choices for reasons we don't know about). The "screw 'em all" statements usually arise when people begin to claim that because somebody has done well they should help other people who have done poorly. Often, perhaps in Tim's case for example, the person making the statement also started in a less than ideal situation and through stubborness and years of hard work, investing, and luck managed to do quite well. To have some worthless rotter come along and claim they are somehow entitled to your hard work and perseverance can be known to cause great anger. Try putting yourself in somebody else's shoes. >Not only does it lack basic notions of humanity, such as caring for >other people,... Actually, most of humanity only mildly cares, at best, about people they do not know. Consider those poor people. Many of them spend many tens of hours each week watching television when they could be learning new skills, fixing up the house, or making their lives better. They could also be cleaning up their neighborhood, helping the people that live around them, or just volunteering in the soup kitchens. For the most part, poor people don't spend any time to speak of helping out other people. It isn't because they can't - it's because they are not inclined to do so. >...but also devalues the human ability to learn and change. I completely disagree with this. The "screw 'em all" statement is actually an exhortation for these people to take responsibility for their own lives. It's a recognition that people do have the ability to learn and change but that other people can't do it for them. It's also a recognition that if they will not learn and change that they better not show up at the May house looking for handouts! >Just because you were young and careless (out of lack of >understanding at that time) or you were born in a slum in Rio de >Janeiro (or NYC) shouldn't mean, that you should still get "screwed" >for it when you're fifty or you now deserve the dis-respect of >society and no chances anymore. You may have never had them... There are very few people who never had a chance. But, let's say you do manage to find somebody who fits that description. Who do you believe should help them? In my opinion, since you claim to care, you should help them. >While technically it is probably correct to say, that current >conditions are caused by previous actions (different people have >different expressions for that: karma, choices, fate etc.), there's >no justification for suffering and certainly none for watching it >passively and saying "they deserve it", IMHO. BTW, do you actually express your care for other people by helping them in any way? My guess is that you don't. (By "help" I mean actual help such as giving them food or shelter or something like that. I do not mean helping by belonging to some political party or other.) >While technically it is probably correct to say, that current >conditions are caused by previous actions (different people have >different expressions for that: karma, choices, fate etc.), there's >no justification for suffering and certainly none for watching it >passively and saying "they deserve it", IMHO. There is plenty of pain and suffering in the world and instead of working hard every day from morning to night alleviating it you are living in New York City and sending messages to the cypherpunks list. Wrong? By your standards it should be. In my case, I prefer writing these little essays to helping poor people. Most people make this sort of choice all the time. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFPBeJaWtjSmRH/5AQHAzgf+LlwFk/ZuRwhF02fcnfmHqGyd5477FIkC FSYCdVBPX/g6270tgCJw0sGbJTOrpVncPWNQzVCQp8tQZAsWMfWDO6rMFmCthWQy CAnjA4xWbh6GlcV28wEGlv55C134FAin9GiJU+D87Zn+p1WRVzPKBPOAe8AXQtde a467+TGJtBDVLEcgI5GdjD2VLlo600oNti2kWSyr9G5yRTKhOglm9F0y8antP5Hq td9bjXEUX7Debd8Vb5Y4DJfkdQnYXQztsMDfdgr7XRLZKhdIVbrMbkXBcCVsyP7m Y7S2h3p/fdyDD8gPXrJWr3Dhm393MGW8BraO6zONz0TBf9cJI0Wsug== =jgE6 -----END PGP SIGNATURE----- From jellicle at inch.com Wed Oct 29 15:40:18 1997 From: jellicle at inch.com (Michael Sims) Date: Thu, 30 Oct 1997 07:40:18 +0800 Subject: (off-topic--delete now) Re: Search warrants and Senate heari In-Reply-To: <34568F07.6F0B@dev.null> Message-ID: <199710292329.SAA14535@arutam.inch.com> Truthmonger (wombat.sk.sympatico.ca [142.165.5.136]) wrote: > Do not pass GoFuckYourself. Do not collect 200 Reputation Capital > Credits. Now let's see here. You've posted to this list (F-C) a half dozen times in the last few months, each time with a different name and with a different and invalid return address. And you speak of reputation capital? Go tell your mommy you've been bad. > The totality of today's medical profession and health care system > *is* 'government-caused.' I see you've succumbed to the tunnel vision, selective blindness of the libertarian sect. Repeat after me: just because we live in a society with a government, doesn't mean that everything you don't like is the government's fault and that all problems will be solved by the mythical free-market beast if only the evil government would leave it alone. > > The US has the closest to a free-market in health-care information of > > any of the industrialized nations. > > Earth to Michael! Earth to Michael... Feel free to point out a counter-example. I wrote quickly, and without research - perhaps I'm wrong. -- Michael Sims From yr at dev.null Wed Oct 29 16:24:11 1997 From: yr at dev.null (Yoshiwara Remailer) Date: Thu, 30 Oct 1997 08:24:11 +0800 Subject: Kent Square and TiennaChinc State Message-ID: <3457CC93.75EC@dev.null> BillyJ, the sex criminal, picking up where RichardM, the B&E artist, left off, is badmouthing the Chinese over their version of Kent State. Our Ambassador to the Home of the Orange Mennace (Led + Yarrow) is badmouthing the Chinese forced-labor camps, ignoring the US pigmentation criminals working for the Telecos and the Silicos for dimes on the dollar of what they would have to pay non-prison labor. In private conferences, these world fuckers/leaders are undoubtedly sharing a monstrous laugh over their public rhetoric. BillyJ: "See, first we kick them off welfare. Then, after Sprint turns down their job application and they turn to dealing drugs to feed their children, we put them in prison. Then we sell their labor to Sprint for a fraction of what their work is worth. "Everyone wins! Except for the taxpayer....HAHAHAHAHA!" Bonus Question: "What do you call a fat Chink?" Bonus Answer: "A 'Chunk'!" RacistLibertarianMonger From nobody at REPLAY.COM Wed Oct 29 16:28:42 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 30 Oct 1997 08:28:42 +0800 Subject: Location of PGP 5.0 Message-ID: <199710300015.BAA22927@basement.replay.com> Where can I find a copy of PGP 5.0 which handles this "SHA1" hash extension, and the new forced incompatabilities? I'm looking for a Linux distribution. All I've found are Windoze versions, really old betas which break *everything* which calls PGP from a script or command line, and betas which have a lame expired timebomb in them. Source is prefered for obvious reasons. Any ideas? (Yes, I'm in the U.S.) From nobody at bureau42.ml.org Wed Oct 29 16:30:01 1997 From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer) Date: Thu, 30 Oct 1997 08:30:01 +0800 Subject: Clinton's Bigger Gun Ban Message-ID: This is the intro from: http://www.nra.org/pub/ila/1997/97-10-24_faxalert_bigger_gun_ban THE BIGGER CLINTON GUN BAN As reported in Wednesday's Special FAX Alert, the Clinton- Gore Administration is planning to issue a directive to ban certain types of foreign-made firearms from coming into this country. We believe the White House will move to stop all commerce in certain semi-automatic firearms that conform in every way to the legal requirements set forth in both the Clinton Gun Ban of 1994 and the 1989 import ban. Sources also suggest that the directive will order the Bureau of Alcohol, Tobacco, and Firearms to convene a study group to further narrow the scope of firearms that qualify for importation under the "sporting purposes" test. Given past action, a ban on all imported handguns is not unlikely. In response to this directive, Congressman Bob Barr (R-Ga.) held a press conference on Capitol Hill today with NRA Executive Vice President Wayne LaPierre, NRA-ILA Executive Director Tanya K. Metaksa, and other pro-Second Amendment congressmen, including, Jim Barcia (D-Mich.), Pete Sessions (R-Tex.), Virgil Goode (D-Va.), and Wes Watkins (R-Okla.) "The Clinton Administration is introducing the Bigger Clinton Gun Ban of 1998 - still another prohibition that bans more guns and shows more hypocrisy than ever before," emphasized Mrs. Metaksa. She added, "From the White House to Handgun Control, Inc., every gun ban advocate in America is busy confirming everything NRA has ever said about the 1994 gun ban." Basically, that it's an ineffective cosmetic ban and that Clinton's efforts to ban guns in 1994 was only a precursor to bigger, more restrictive bans. All NRA members are encouraged to contact your U.S. Representative at (202)224-3121, to urge him to oppose the President's attempt to ban more semi-automatic firearms -- semi-autos that his 1994 ban previously ok'd! In the meantime, NRA-ILA will continue to update our members as we learn more about Clinton's latest attack on America's law-abiding gun owners. From business at mail.t-1net.com Thu Oct 30 08:36:24 1997 From: business at mail.t-1net.com (business at mail.t-1net.com) Date: Thu, 30 Oct 1997 08:36:24 -0800 (PST) Subject: Get Paid To Advertise! Message-ID: <199710301636.IAA08496@toad.com> Hello! If you would like to find out how you can get paid to advertise your own product, service or business on the Internet, please reply to and type 'info' in the subject line. If this has been sent to you in error, please accept my apology and reply to the forementioned address and type 'remove' in the subject line to be taken off my mailing list. From ravage at ssz.com Wed Oct 29 17:11:05 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 30 Oct 1997 09:11:05 +0800 Subject: 6 weeks in jail for carrying vitamins [CNN] Message-ID: <199710300106.TAA15382@einstein.ssz.com> > MAN SPENDS 6 WEEKS IN JAIL AFTER VITAMINS MISTAKEN FOR HEROIN > > October 29, 1997 > Web posted at: 7:21 p.m. EST (0021 GMT) > > NORTH CHARLESTON, South Carolina (AP) -- For six weeks, Malvin > Marshall sat in jail because police thought he was carrying heroin > in his pocket. Police didn't believe him when he said it was mushy > vitamins. > > On Monday, the charges were dropped. Lab tests showed he was > carrying mushy vitamins. [remainder deleted] From shamrock at cypherpunks.to Wed Oct 29 17:12:16 1997 From: shamrock at cypherpunks.to (Lucky Green) Date: Thu, 30 Oct 1997 09:12:16 +0800 Subject: Location of PGP 5.0 In-Reply-To: <199710300015.BAA22927@basement.replay.com> Message-ID: On Thu, 30 Oct 1997, Anonymous wrote: > > Where can I find a copy of PGP 5.0 which handles this "SHA1" hash extension, > and the new forced incompatabilities? I'm looking for a Linux distribution. > All I've found are Windoze versions, really old betas which break > *everything* which calls PGP from a script or command line, and betas which > have a lame expired timebomb in them. Source is prefered for obvious reasons. http://www.pgpi.com/ -- Lucky Green PGP encrypted email preferred. "Tonga? Where the hell is Tonga? They have Cypherpunks there?" From mtc at dev.null Wed Oct 29 17:13:46 1997 From: mtc at dev.null (McTruthChinc) Date: Thu, 30 Oct 1997 09:13:46 +0800 Subject: Want to see something *REALLY* scary?!!? / Was: World Peace! (of the action) / Was: Our Bum Buddies in Bejing / Was: Was: Kent Square and TiennaChinc State In-Reply-To: <3457CC93.75EC@dev.null> Message-ID: <3457DC5F.7B0E@dev.null> Yoshiwara Remailer wrote: > > BillyJC, the sex criminal, picking up where RickyMN, the B&E artist, > left off (trying to pry open the Chinese Market for American business), > is badmouthing the Chinese over their version of Kent State. > > Our Ambassador to the Home of the Olange Menace (Led + Yarrow) is > badmouthing the Chinese forced-labor camps, ignoring the US use of > pigmentation criminals working for the Telecos and the Silicos > for dimes on the dollar of what they would have to pay non-prison > labor. > > In private conferences, these world fuckers/leaders are undoubtedly > sharing a monstrous laugh over their public rhetoric. > > BillyJ: "See, first we kick them off welfare. Then, after Sprint turns > down their job application and they turn to dealing drugs to feed > their children, we put them in prison. Then we sell their labor to > Sprint for a fraction of what their work is worth. > "Everyone wins! Except for the taxpayer....HAHAHAHAHA!" > > Bonus Question: "What do you call a fat Chink?" > Bonus Answer: "A 'Chunk'!" > > RacistLibertarianMonger Want to see something *REALLY* scary?!!? A lady friend of mine was showing me today how to use my computer and my VCR to edit/change the contents of audio/video recordings. She took the American/Chinese news conference by Bad BillyC and A Chinc To Be Spelled Correctly Later and transposed the words of BBC and his guest, ACTBSCL onto the virtual lips of one another. Watching our beloved PRES state, "The concept of freedom is relative..." sent shivers down my spine. Why? Because it didn't seem in the least out of joint with any of the other pronouncements from on high that have come down from the mount upon which our elected 'usual suspects' stand feeding at the public trough. Now we know that "The best way to influence Chinese policy is to work with them." Worked pretty good with the Nazi's, didn't it? Working with the Nazis certainly influenced American policy. (At least) Half of our Presidents since the second World War have been elected thanks mostly to the backing of money made by doing business with those wonderfolks who gave us the Holocaust. BBC: "Don't you feel just a *little* bad about murdering those students at Kent Square...I mean, TiennaChinc State...I mean..." ACTBSCL: "Nope." BBC: "OK. Now that we've cleared that up, would you like to buy a bunch of our airplanes, and a pile of nuclear reactors after we rehabilitate your image a bit more?" ACTBSCL: "Yep." At least the Israeli/Arab/Canadian foiled assassination, hostage trading, forged passport debacle was humorous. All of the players stuck to the comedy script: "We emphatically deny what everyone knows to be true. Duuhhh..." It was positively frightening to watch our beloved leader of the freeh world sticking to his comedy lines, despite the fact that A Chinc To Be Spelled Correctly Later continued to play the straight man, refusing to do a pretentious song and dance for the American public, such as our homegrown clowns are wont to do. Tomorrow's News Today: [Bienfait, Saskatchewan, CNN (Canadian Nutly News)] - Lying Jackoff Fuck, Louis J. Freeh, told a double-secret government committee, in a triple-secret meeting today at the CoalDust Saloon, that Federal Law Enforcement Agencies would need the power to monitor all of the activities and communications of every single citizen, in order to protect them from the threat posed by the Communist Chinese selling our nuclear technology to terrorists, after the mainstream media has helped to rehabilitate A Chinc To Be Spelled Correctly Later by showing pictures of him at DisneyWorld, kissing babies, so that we can sell them hundreds of billions of dollars worth of nuclear power plants which the US industry can't sell at home. God Bress Amelica McTruthChinc ~~~~~~~~~~~~ "JIANG ZEMIN! _That's_ the name!" From tcmay at got.net Wed Oct 29 17:30:54 1997 From: tcmay at got.net (Tim May) Date: Thu, 30 Oct 1997 09:30:54 +0800 Subject: Killing those who need killing In-Reply-To: <199710300106.TAA15382@einstein.ssz.com> Message-ID: At 6:06 PM -0700 10/29/97, Jim Choate wrote: >> MAN SPENDS 6 WEEKS IN JAIL AFTER VITAMINS MISTAKEN FOR HEROIN >> >> October 29, 1997 >> Web posted at: 7:21 p.m. EST (0021 GMT) >> >> NORTH CHARLESTON, South Carolina (AP) -- For six weeks, Malvin >> Marshall sat in jail because police thought he was carrying heroin >> in his pocket. Police didn't believe him when he said it was mushy >> vitamins. >> >> On Monday, the charges were dropped. Lab tests showed he was >> carrying mushy vitamins. And he doesn't stand a chance of suing them successfully. No wonder some people support Assassination Politics. (Personally, were I to be arrested and held on such false charges, I'd consider it necessary to kill those who illegally held me. Preferably from a safe distance, with a sniper rifle. But then I'm a right wing libertarian whacko.) --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From tcmay at got.net Wed Oct 29 18:07:21 1997 From: tcmay at got.net (Tim May) Date: Thu, 30 Oct 1997 10:07:21 +0800 Subject: Clinton's Bigger Gun Ban In-Reply-To: Message-ID: At 1:30 PM -0700 10/29/97, bureau42 Anonymous Remailer wrote: >This is the intro from: >http://www.nra.org/pub/ila/1997/97-10-24_faxalert_bigger_gun_ban > > THE BIGGER CLINTON GUN BAN > > As reported in Wednesday's Special FAX Alert, the Clinton- >Gore Administration is planning to issue a directive to ban >certain types of foreign-made firearms from coming into this >country. We believe the White House will move to stop all >commerce in certain semi-automatic firearms that conform in every >way to the legal requirements set forth in both the Clinton Gun >Ban of 1994 and the 1989 import ban. Sources also suggest that >the directive will order the Bureau of Alcohol, Tobacco, and >Firearms to convene a study group to further narrow the scope of >firearms that qualify for importation under the "sporting >purposes" test. Given past action, a ban on all imported handguns >is not unlikely. The Klinton Klan has already effectively banned imported SKS ammo (7.62x29, as I recall, given that I don't have any rifles chambering this popular round). Those with any sense are racing to stock up before a Full Ban is enacted (via Executive Order, the easiers form of enactment of laws in these post-constitutional years). So many targets, so little time. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From psychokiller at d.null Wed Oct 29 18:10:54 1997 From: psychokiller at d.null (Killfile Remailer) Date: Thu, 30 Oct 1997 10:10:54 +0800 Subject: Killing those who need killing Message-ID: <199710300155.TAA05985@harrier.sasknet.sk.ca> Tim May wrote: > (Personally, were I to be arrested and held on such false charges, I'd > consider it necessary to kill those who illegally held me. Preferably from > a safe distance, with a sniper rifle. But then I'm a right wing libertarian > whacko.) Been there..done that...stole the T-shirt...got out of Dodge, without getting killed or caught. The Usual Suspect From nobody at neva.org Wed Oct 29 18:13:50 1997 From: nobody at neva.org (Neva Remailer) Date: Thu, 30 Oct 1997 10:13:50 +0800 Subject: [cpe:3185] Re: rescue Mrs Allen from the Feds (Re: Tim's worst nightmare.,..) Message-ID: <199710300205.SAA23234@mail-gw3.pacbell.net> -----BEGIN PGP SIGNED MESSAGE----- Adam Back wrote: >The Gandi style walk in, in numbers walk off with Mrs Allen :-) What are >they going to do, shoot 1000 unarmed citizens? You could probably do it with one church congregation's worth of people. >This kind of tactic works quite well for tyrants who have become too >civilised. Or, perhaps the basis of political power is a general acceptance of the rulers among the ruled and acts which would disrupt this acceptance are more dangerous to the government than you would think. Amnesty International has been successful just by organizing massive letter writing expressing disapproval of the treatment of particular political prisoners. The regimes affected could not reasonably be described as "civilized." For that matter, the U.S. and British governments have not always been so nice when they didn't think anybody was looking. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFeNCpaWtjSmRH/5AQFadgf+KpU2Vb9nvVH4HZVz4wuRo+NQ+Z4mH6DS Z7OKthsTnikIOINtApRCyq9OhmwvQ/5mJa5mVFBj/GTH90DCK/vyajjF/61AOFsC 6np45kDapHlYp1naCDi3WZwuthbOgJfsCN/66s/1ql9FsaoBoMn7MAn6K81SauOW duZ8QpSIFhighF1f717Pj2vnypswJIwIGwr6XIRoyNLYZBUh/mFvMbHSoq6TH9FG lNuOV7ZSNMqKJji7yNHylQ6PtOZvH1wNJqNplzyfBumq1yenQ9I1kbq8udruDcRt Snn6kVuDfRwMHZ3Bihro+QvLmd89jCcOFh25DJMTMJf8eKJ6207Sww== =Laph -----END PGP SIGNATURE----- From nobody at neva.org Wed Oct 29 18:14:48 1997 From: nobody at neva.org (Neva Remailer) Date: Thu, 30 Oct 1997 10:14:48 +0800 Subject: <>(October 28, 1997) The Power of Ecobabble Message-ID: <199710300204.SAA22887@mail-gw3.pacbell.net> -----BEGIN PGP SIGNED MESSAGE----- While I know nothing of Bionomics, Professor Krugman's ill-tempered essay intrigues me. Robert Hettinga wrote that VitaminB at bionomics.org wrote that Paul Krugman wrote in Slate: > Take, for starters, his assertion that "orthodox economics describes > the 'economy as a machine.' " You might presume from his use of > quotation marks that this is something an actual economist said, or > at least that it was the sort of thing that economists routinely > say. But no economist I know thinks of the economy as being anything > like a machine--or believes, as Rothschild asserts a bit later, that > because the economy is like a machine, it is possible to make > precise predictions. "Methinks the lady doth protest too much." While hard core economists may not describe the economy as a machine, the popular literature, such as that found in news stories on "the economy", almost always uses machine metaphors. "The economy was in danger of becoming overheated, so the Fed raised interest rates." The metaphors which people choose often have powerful political implications. After all, if the economy is sort of like a machine, then it makes sense to have trained professionals who tune that machine to operate with optimal efficiency. It is not hard to figure out why the ruling elite prefers this metaphor to some others that could be chosen. For instance, you could say the economy is an elaborate network of relationships based on trust. You could say that employment occurs when two or more people agree to exchange goods or services. Let's say unemployment figures are up. If you believe the economy is like a machine, then you will believe that there should be a central planning organization like the Fed that should lower interest rates. If you believe that the unemployment goes down when people form employment relationships, you may think about ways to remove obstacles to the formation of these relationships. Note that the second more reasonable approach does not promote the interests of a national ruling elite. > In just the last two years, I've learned that I believe that gross > domestic product is the sole measure of economic welfare... In popular economics GDP is used almost exclusively as a measure of success. I strongly suspect that when Krugman says he himself does not believe this, that he has some other set of statistical measures which he considers to be better measures of success. If this is the case, then he has completely missed the point. Such statistical measures are sensible when one accepts that the purpose of economics is to best instruct the rulers of a society in their economic policy decisions. In such a framework, the rulers decide what is good and then decide how to cause that good to increase. The only problem with this is that it neglects to consider the preferences of individual people. It is highly unlikely that their economic behavior is dictated by the authorities for their own best interest because the authorities have no way of knowing what that best interest might be. People have their own beliefs and preferences on that subject. For example, a small island nation in the Pacific is highly regarded as an "economic success". One of the features of this society is that government provided or subsidized housing is widely available. People who wish to spend their money on having a nice apartment like this. But, many people may prefer to live in less expensive surroundings and spend the money they save on other things, or to simply work less. Krugman supports my theory about his beliefs later when he says: > But it does not deify the market system, and it even offers a number > of fairly well-defined ways in which markets can fail, or at least > could be helped with government intervention. And that, for some > conservatives, is just not good enough. We do not see any examples of "market failures" and, indeed, the people Krugman refers to would probably not see them as failure at all. It seems highly likely that Krugman has committed the sin he accuses the Bionomicists of committing: he doesn't truly understand the philosophy he is criticizing. Also interesting is Krugman's obvious discomfiture with people who would explore the ideas of the Bionomicists. It may be the case that the Bionomics crowd does not thoroughly understand classical economics or evolutionary biology. This would not be the first time that people on the fringes of several disciplines came up with new ideas which transformed the field. (Take J. Kepler, the professional astrologer. Kepler had many totally wacked out theories. He believed completely in astrology. He believed the Earth was a living organism and the tides were related to its breathing. He believed the orbits of the planets were distributed in relationship to the Platonic solids. And, get this, he believed that the area a planetary radius swept out in time was constant.) Obviously, Bionomics might be fraught with errors, oversimplifications, and misrepresentations. In spite of this, there may be ideas that would interest an open minded professional. Even Marxists occasionally come up with an interesting observation, after all. So, Krugman's hostility to the exploration of ideas strikes me as a little odd for a professor. Take his final paragraph for an example: > Anyway, I guess I won't attend the conference. I would have liked to > meet Benford; but I couldn't stand to watch the author of _Great Sky > River_ demeaning himself by consorting with such disreputable > company. Somehow I can hear an upper class Victorian mother telling her son: "You should not be seen with that girl. She's much too common." Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFebtJaWtjSmRH/5AQEKUQf7B0XnUn1xwIbIcLFMDUDpL8HEaDb3bclO syR2QJCvMa4BsjPKHWGRa5pEDNLdXfiQt0bXYZ+9WzVrr18VlAFJ2pqWoxv3PW76 YqDbfhGCwmseo8EzoRen5PEnxkZuNN+KKN92dEaEfj8NJMwBVZ2V5443HlPXxTWA TXxZIeFYgldndpgIdqFxIc4qnVtrJbsGI1YrzbCNeeTgTKg8d1oZlDVDMbLDGeyx wyb3hwzTB2wiLiLsTjhlcONEdbu0bwGUu7F3l60+C9JZjn3DWgl/+y562kejfcKP LgdSplUSc8gFrR3bCFufpyOOGFDgp0keV3SRWOaO8i/N2N+l/XhI3w== =iy9O -----END PGP SIGNATURE----- From tcmay at got.net Wed Oct 29 18:14:48 1997 From: tcmay at got.net (Tim May) Date: Thu, 30 Oct 1997 10:14:48 +0800 Subject: Clinton's Bigger Gun Ban Message-ID: I wrote: --- The Klinton Klan has already effectively banned imported SKS ammo (7.62x29, as I recall, given that I don't have any rifles chambering this popular round). --- Before you rush to correct me, I _meant_ to write "7.62x39" of course. (A round used by the Chinese, Soviet, and East Bloc nations, and roughly equivalent to the American M-16 round, known either as the .223 or 5.56mm. The NATO "7.62" is in a longer case length. 7.62x54, as I recall. Known in America as .308. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From vznuri at netcom.com Wed Oct 29 18:26:32 1997 From: vznuri at netcom.com (Vladimir Z. Nuri) Date: Thu, 30 Oct 1997 10:26:32 +0800 Subject: new intel verification circuit & crypto Message-ID: <199710300215.SAA13323@netcom7.netcom.com> John Dvorak has an interesting column in a recent PC magazine on the possibility that Intel has created some new circuits in its new chips that would allow alteration by software. this is to deal with a "verification crisis" in which the complexity of their large chips is outstripping their ability to test for flaws and make them perfect. according to Dvorak the scheme would allow Intel to release a software program that would actually alter the circuitry of the chip. information at this point is very limited; Dvorak says that Intel doesn't want to announce the scheme for fear that it may not work in an embarrassing scenario. he says that the scheme is protected using cryptographic algorithms, so that hackers would be prevented from altering the chip. he raises the spectre of a virus that could do permanent, irreparable damage to the chip. however, I have some big red flags going off in my brain the more I think about this. it seems to me that no matter what kind of cryptography is used on the chip, there is the possibility of reverse engineering via dissassemblers & debuggers etc. if the software is distributed widely. hackers have long experience with this, and I suspect if a fix was released, the code could be cracked quite readily. the only other possibility is that Intel would require people to bring the chip into a service dealer. but this would decrease the utility and convenience of the fix feature, and I doubt they could protect the distribution of the software in this case either. anyway, an interesting topic of conversation for this list, no? From nobody at neva.org Wed Oct 29 18:52:15 1997 From: nobody at neva.org (Neva Remailer) Date: Thu, 30 Oct 1997 10:52:15 +0800 Subject: Infowar circa 1850 Message-ID: <199710300242.SAA01535@mail-gw2.pacbell.net> -----BEGIN PGP SIGNED MESSAGE----- "Blood Meridian: Or the Evening Redness in the West" by Cormac McCarthy The Reverend Green had been playing to a full house daily as long as the rain had been falling and the rain had been falling for two weeks. When the kid ducked into the ratty canvas tent there was standing room along the walls, a place or two, and such a heady reek of the wet and bathless that they themselves would sally forth into the downpour now and again for fresh air before the rain drove them in again. He stood with others of his kind along the back wall. The only thing that might have distinguished him in that crowd was that he was not armed. Neighbors, said the reverend, he couldnt stay out of these here hell, hell, hellholes right here in Nacogdoches. I said to him, said: You goin to take the son of God in there with ye? And he said: Oh no. No I aint. And I said: Dont you know that he said I will foller ye always even unto the end of the road? Well, he said, I aint askin nobody to go nowheres. And I said: Neighbor, you dont need to ask. He's a goin to be there with ye ever step of the way whether ye ask it or ye dont. I said: Neighbor, you caint get shed of him. Now. Are you going to drag him, *him*, into that hellhole yonder? You ever see such a place for rain? The kid had been watching the reverend. He turned to the man who spoke. He wore long moustaches after the fashion of teamsters and he wore a widebrim hat with a low round crown. He was slightly walleyed and he was watching the kid earnestly as if he'd know his opinion about the rain. I just got here, said the kid. Well it beats all I ever seen. The kid nodded. An enormous man dressed in an oilcloth slicker had entered the tent and removed his hat. He was bald as a stone and he had no trace of beard and he had no brows to his eyes nor lashes to them. He was close on to seven feet in height and he stood smoking a cigar even in this nomadic house of God and he seemed to have removed his hat only to chase the rain from it for now he put it on again. The reverend had stopped his sermon altogether. There was no sound in the tent. All watched the man. He adjusted the hat and then pushed his way forward as far as the crateboard pulpit where the reverend stood and there he turned to address the reverend's congregation. His face was serene and strangely childlike. His hands were small. He held them out. Ladies and gentlemen I feel it my duty to inform you that the man holding this revival is an imposter. He holds no papers of divinity from any institution recognized or improvised. He is altogether devoid of the least qualifications to the office he has usurped and has only committed to memory a few passages from the good book for the purpose of lending to his fraudulent sermons some faint flavor of the piety he despises. In truth, the gentleman standing here before you posing as a minister of the Lord is not only totally illiterate but is also wanted by the law in the states of Tennessee, Kentucky, Mississippi, and Arkansas. Oh God, cried the reverend. Lies, lies! He began reading feverishly from his opened bible. On a variety of charges the most recent of which involved a girl of eleven years - I said eleven - who had come to him in trust and whom he was surprised in the act of violating while actually clothed in the livery of his God. A moan swept through the crowd. A lady sank to her knees. This is him, cried the reverend, sobbing. This is him. The devil. Here he stands. Let's hang the turd, called an ugly thug from the gallery to the rear. Not three weeks before this he was run out of Fort Smith Arkansas for having congress with a goat. Yes lady, that is what I said. Goat. Why damn my eyes if I wont shoot the son of a bitch, said a man rising at the far side of the tent, and drawing a pistol from his boot he leveled it and fired. The young teamster instantly produced a knife from his clothing and unseamed the tent and stepped outside into the rain. The kid followed. They ducked low and ran across the mud toward the hotel. Already gunfire was general within the tent and a dozen exits had been hacked through the canvas walls and people were pouring out, women screaming, folk stumbling, folk trampled underfoot in the mud. The kid and his friend reached the hotel gallery and wiped the water from their eyes and turned to watch. As they did so the tent began to sway and buckle and like a huge and wounded medusa it slowly settled to the ground trailing tattered canvas walls and ratty guyropes over the ground. The baldheaded man was already at the bar when they entered. On the polished wood before him were two hats and a double handful of coins. He raised his glass but not to them. They stood up to the bar and ordered whiskeys and the kid laid his money down but the barman pushed it back with his thumb and nodded. These here is on the judge, he said. They drank. The teamster set his glass down and looked at the kid or he seemed to, you couldnt be sure of his gaze. The kid looked down the bar to where the judge stood. The bar was that tall not every man could even get his elbows up on it but it came just to the judge's waist and he stood with his hands placed flatwise on the wood, leaning slightly, as if about to give another address. By now men were piling through the doorway, bleeding, covered in mud, cursing. They gathered about the judge. A posse was being drawn to pursue the preacher. Judge, how did you come to have the goods on that no-account? Goods? said the judge. When was you in Fort Smith? Fort Smith? Where did you know him to know all that stuff on him? You mean the Reverend Green? Yessir. I reckon you was in Fort Smith fore ye come out here. I was never in Fort Smith in my life. Doubt that he was. They looked from one to the other. Well where was it you run up on him? I never laid eyes on the man before today. Never even heard of him. He raised his glass and drank. There was a strange silence in the room. The men looked like mud effigies. Finally someone began to laugh. Then another. Soon they were all laughing together. Someone bought the judge a drink. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFf3Xj7jyGKQlFZpAQFAVwgAnY5GGhOnj97T7fUzmNF1fSthVoVOSLr7 8pVFBUOdTXgKGtDmlr+TqaEzkdEzxJMUE+ACA6uGb/LwmyIhxnPYwRqfhWBjOHD3 /Y1uDVan81uVAtCgIZeOxOTskoM0hE3N3qxNSiITutbM2fxZiiUH1kWTs1+JuyLp h1sfwyzV4UL4sG6fZRKdf+4Mtg7jZvOJNbjKtzp7A19zxfLuLawM6DC31OlnDduw wdSWvv3CG/rOyExeCUtD/sTunPF4a7nsRb7mZQfj564ibvhbrKFcUv/z1lo7X06I yCC4JTOshBBmkzc6PNuUGc7hRGeghoXjHw1cClGjiOlr1HDoxdVVvg== =hKGE -----END PGP SIGNATURE----- From nobody at bureau42.ml.org Wed Oct 29 18:53:24 1997 From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer) Date: Thu, 30 Oct 1997 10:53:24 +0800 Subject: apropos list talk and our culture Message-ID: Steve Schear wrote: > At 8:06 AM -0700 10/29/1997, Tim May wrote: > >At 5:38 AM -0700 10/29/97, Brad Dolan wrote: > >>"Michael Hays" is a new CBS series about a U.S. District Attorney. Last > >>night's episode was about how a radio talk-show host incited a listener > >>to kill a BATF agent and was brought to justice. DA convinced a jury > >>that some things were "more important" than the first amendment. > > Wouldn't it be interesting if someone incited a Net listener/reader to kill > the producer of this "Michael Hays" episode in a "life immitates art" > situation? Has anyone on the list taken the time to estimate the percentage of TV shows (news/entertainment/etc.) which seem to mostly serve to help indoctrinate the masses with New World Order Speak? e.g. - Surveillance == Security / Police == Protection VideoCatchingCriminals III (or somesuch), is due out soon. C-16, Jag, Michael Hayes, Cops, ad infinituum, and not a one of them showing a citizen with a toilet plunger sticking out of his or her asshole. Even Jenny Jones, et al, are doing shows where parents video-spy on the babysitter, husbands video-spy on their wives, etc. If "Total Surveillance is your Friend!" then why were there no video cameras in the restroom of the NYC police precinct? Cypherpunk Action Project or just my insanity?: Are there any list members who were kicked out of the US Armed Forces after only one day and are now full-fledged members of the paramilitary? Why don't you go bomb a federal building with a day-care center in it, and see if the government and media blame it all on the US Armed forces? You know, kind of a "life imitates fascism" situation. ImitationMonger From nobody at REPLAY.COM Wed Oct 29 19:13:04 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 30 Oct 1997 11:13:04 +0800 Subject: new intel verification circuit & crypto Message-ID: <199710300256.DAA16626@basement.replay.com> The 'other' Deitweler, Vladimir Z. Nuri wrote: > John Dvorak has an interesting column in a recent PC > magazine on the possibility that Intel has created > some new circuits in its new chips that would allow > alteration by software. this is to deal with a > "verification crisis" in which the complexity of > their large chips is outstripping their ability > to test for flaws and make them perfect. according to > Dvorak the scheme would allow Intel to release a > software program that would actually alter the > circuitry of the chip. InfoWarriors around the globe have already been preparing for 'The Son of Clipper' and 'The Daughter of GAK'. The defenders of Freeh-Dumb know that the key to totalitarian access to communications/information is to slip in the back door of new technolgies via those who develop and produce that technology. The anti-trust actions against Intel are for the purpose of negotiating a foothold in programmable CPU's, etc. The anti-trust outrage against MicroSoft is meant to be a million-dollar-a-day punishment for reneging on their deal to provide GAK hooks in Internet Explorer 4.0. Look for MS and Intel to string the government along in this regard, while delaying long enough to let the Y2K problem force the government's hand in their desire for total control of the Information Highway Robbery system. The battle is for control of the New Electronic Jerusalem. Sincerely, Your 'other brother' Deitweler From whgiii at invweb.net Wed Oct 29 19:18:27 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 30 Oct 1997 11:18:27 +0800 Subject: Killing those who need killing In-Reply-To: Message-ID: <199710300311.WAA15200@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In , on 10/29/97 at 05:25 PM, Tim May said: >But then I'm a right wing libertarian whacko. It's not a matter that you are far right it's just that the rest of the country are so far left. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNFf6OI9Co1n+aLhhAQGrgQP/VJq41LpEFSuwNsRFdNe7k997ya56Po9E WPi4bcdnC8IBVRCEB5T3Yu5Hb0axUl0PA/7NRPoDMgmaQq1e4ZGwsqonJlHdp+LY Y4WCEBifHB1Q6YFr67OUU0YRtppQmnIOHh11tAn0MFsNawouiLqUjQJ9niuCKoBD stHTPiFQHK0= =yKKi -----END PGP SIGNATURE----- From ichudov at www.video-collage.com Wed Oct 29 19:36:30 1997 From: ichudov at www.video-collage.com (Igor Chudov @ home) Date: Thu, 30 Oct 1997 11:36:30 +0800 Subject: [ZOG] MARXIST COHEN WANTS 'CURTAILED FREEDOM': CALL TO ARMS WANTED In-Reply-To: <199710300254.DAA16306@basement.replay.com> Message-ID: <199710300320.DAA15154@manifold.algebra.com> fyi igor Anonymous wrote: * Defense Chief Says U.S. Freedom May Have To Be Curtailed * ___________________________________________________________ * Their inward part is destruction itself. Their throat is an * open grave; they flatter with their tongue. * Psalms 5:9 * ___________________________________________________________ * * Defense secretary calls for even more preventive measures. * * Terrorism is escalating to the point that Americans soon may have to choose * between civil liberties and more intrusive means of protection. Defense * Secretary William S. Cohen says. * * The nation's defense chief told the Army Times he once considered the * chilling specter of armored vehicles surrounding civilian hotels or * government buildings to block out terrorists as strictly an overseas * phenomenon. But no longer. * * It could happen here, Cohen said he concluded after eight months of studying * threats under the Pentagon microscope. * * Free-lance terrorists with access to deadly chemical and biological bombs * are "going to change the way in which the American people view security in * our own country, he predicted in a Sept. 10 interview. * * Cohen is calling for the government to step up its efforts to penetrate * wildcard terrorist organizations. * * "It's going to require greater intelligence on our part - much greater * emphasis on intelligence gathering capability, more human intelligence, and * it's going to take more technical intelligence," he said. * * But using the U.S. military in a domestic law enforcement role would require * revisions to laws in force for more than a century, cautions Shreveport * attorney John Odom Jr. "You can't do it from the the Defense Department side * unless Congress dramatically revises the Posse Comitatus laws," said Odom, a * colonel in the U.S. Air Force Reserve and a reserve judge advocate. * * The 1878 law specifically prohibits the use of the military in domestic law * enforce- ment unless authorized by Congress or the Constitution and does not * allow for military intervention through action by the secretary of defense * or even an executive order from the president, Odom said. * * "We're trained from the first day of judge advocate school to think of Posse * Comitatus !! Odom said. "If Secretary Cohen is suggesting that the * Department of Defense be involved, it may be part of a legislative package. * But it will not happen unilaterally without a lot of folks thinking long and * hard about it." * * Cohen said terrorism would be a top priority in five new areas he plans to * focus on now that he has wrapped up his first defense budget, the * quadrennial review of the military and a new, four-year defense strategy. * * Other goals include modernizing the military, improving troops housing and * other benefits, streamlining the defense bureaucracy and shaping new * military relationships and contacts across the globe. * * * >From Staff and Wire Reports * The Times of the Ark-La-Tex * 15 September 1997 * (Submitted by Danny Cox) * * -- - Igor. The average American spends a total of six (6) months in prison. From mitm at dev.null Wed Oct 29 19:38:27 1997 From: mitm at dev.null (Man in the Middle) Date: Thu, 30 Oct 1997 11:38:27 +0800 Subject: Killing those who need killing In-Reply-To: <199710300311.WAA15200@users.invweb.net> Message-ID: <3457FF5D.4D56@dev.null> William H. Geiger III deduced: > In , on 10/29/97 > at 05:25 PM, Tim May said: > > >But then I'm a right wing libertarian whacko. > > It's not a matter that you are far right it's just that the rest of the > country are so far left. >From the objective perspective of "the Shadow's nose," one quickly learns, from a lifetime spent riding the electronic MTA, that: "The one on the right is in the middle, the one on the left is on the right..." ...and the guy posting as Anonymous? He drives a garbage truck... Man in the Middle From tcmay at got.net Wed Oct 29 20:15:59 1997 From: tcmay at got.net (Tim May) Date: Thu, 30 Oct 1997 12:15:59 +0800 Subject: [ZOG] MARXIST COHEN WANTS 'CURTAILED FREEDOM': CALL TO ARMSWANTED In-Reply-To: <199710300254.DAA16306@basement.replay.com> Message-ID: At 8:20 PM -0700 10/29/97, Igor Chudov @ home wrote: >* Terrorism is escalating to the point that Americans soon may have to choose >* between civil liberties and more intrusive means of protection. Defense >* Secretary William S. Cohen says. And no doubt this means GMR for all crypto. And if we say "No thanks" to the no-knock searches, the street friskings, the "Papierren, bitte??" travel restrictions, what then? Not much of a choice, eh? The spinmeisters are laying the groundwork for martial law. Just what we've been hearing about for years. Get ready. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From nobody at REPLAY.COM Wed Oct 29 20:38:49 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 30 Oct 1997 12:38:49 +0800 Subject: No Subject Message-ID: <199710300431.FAA27663@basement.replay.com> Either Klintonkov, the congresscritters, and the directors of everyone's favorite TLAs have *COMPLETELY* lost their marbles, or the word 'constitution' is about to become very un-PC. Get your plane tickets to countries where sanity still remains (if there are any left) before international air travel is suddenly banned because of 'terrorist threats to national security'. War is Peace. Freedom is Slavery. Surveilance is Security. I'm from the government and I'm here to help you. ParanoiaMonger From shamrock at cypherpunks.to Wed Oct 29 20:55:03 1997 From: shamrock at cypherpunks.to (Lucky Green) Date: Thu, 30 Oct 1997 12:55:03 +0800 Subject: [ZOG] MARXIST COHEN WANTS 'CURTAILED FREEDOM': CALL TO ARMS WANTED In-Reply-To: Message-ID: On Wed, 29 Oct 1997, Tim May wrote: > > And if we say "No thanks" to the no-knock searches, the street friskings, > the "Papierren, bitte??" travel restrictions, what then? > > Not much of a choice, eh? No choice at all. My local 7/11 just installed a Verifone Tranz 330 for the sole purpose of checking the magstripes on the ID's of prospective alcohol buyers. See, the issue isn't if you are old enough to drink. The issue is do you have a government license to do so? Of course the new system will be hacked by enterprising juveniles. Which will only increase the calls for transponders to be implanted at birth. -- Lucky Green PGP encrypted email preferred. "Tonga? Where the hell is Tonga? They have Cypherpunks there?" From DaveL at classifiedcentral.com Thu Oct 30 13:29:15 1997 From: DaveL at classifiedcentral.com (Dave Legassi) Date: Thu, 30 Oct 1997 13:29:15 -0800 (PST) Subject: Just wanted to let you know Message-ID: <19971030200630906.AAA434@classifiedcentral.com> Hey there, For those of you that don't know, you can find the Global Advertising Inter-Network at http://www.gainads.com. Their classified ads are accessible from over 475 different member sites around the world. Check em out! Dave From mix at bear.apana.org.au Wed Oct 29 21:55:54 1997 From: mix at bear.apana.org.au (Rebel Remailer) Date: Thu, 30 Oct 1997 13:55:54 +0800 Subject: [ZOG] MARXIST COHEN WANTS 'CURTAILED FREEDOM': CALL TO ARMS WANTED Message-ID: <199710300535.PAA26984@bear.apana.org.au> * Defense secretary calls for even more preventive measures. * * Terrorism is escalating to the point that Americans soon may have to choose * between civil liberties and more intrusive means of protection. Defense * Secretary William S. Cohen says. * * The nation's defense chief told the Army Times he once considered the * chilling specter of armored vehicles surrounding civilian hotels or * government buildings to block out terrorists as strictly an overseas * phenomenon. But no longer. Heavy shit ...and now it begins From graycastle at ppw.net Wed Oct 29 22:39:40 1997 From: graycastle at ppw.net (graycastle at ppw.net) Date: Thu, 30 Oct 1997 14:39:40 +0800 Subject: [cpe:3265] Re: [ZOG] MARXIST COHEN WANTS 'CURTAILED FREEDOM': CALL TO ARMS WANTED In-Reply-To: <199710300535.PAA26984@bear.apana.org.au> Message-ID: <34582AB7.4363@ppw.net> Rebel Remailer wrote: > > * Defense secretary calls for even more preventive measures. > * > * Terrorism is escalating to the point that Americans soon may have to choose > * between civil liberties and more intrusive means of protection. Defense > * Secretary William S. Cohen says. > * > * The nation's defense chief told the Army Times he once considered the > * chilling specter of armored vehicles surrounding civilian hotels or > * government buildings to block out terrorists as strictly an overseas > * phenomenon. But no longer. > > Heavy shit > > ...and now it begins maybe, but its still a long way from the theory that it is all orchestrated by israeli bankers in new york (zog) . . . From nobody at REPLAY.COM Wed Oct 29 22:42:53 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 30 Oct 1997 14:42:53 +0800 Subject: PGP 5.5 available outside US Message-ID: <199710300633.HAA11606@basement.replay.com> Lucky Green wrote: > > It seems that unknown Cypherpunks have yet again shown their disrespect of > US export laws by exporting the latest version of PGP. The Windows version > of PGP 5.5 is now available for your downloading pleasure at > ftp://ftp.replay.com/pub/crypto/incoming/PGP55.zip No it is not! From wendigo at ne-wendigo.jabberwock.org Wed Oct 29 23:05:06 1997 From: wendigo at ne-wendigo.jabberwock.org (Mark Rogaski) Date: Thu, 30 Oct 1997 15:05:06 +0800 Subject: Killing those who need killing (fwd) Message-ID: <199710300656.BAA11573@deathstar.jabberwock.org> An entity claiming to be wendigo wrote: >From wendigo Thu Oct 30 01:56:09 1997 Subject: Re: Killing those who need killing To: tcmay at got.net Date: Thu, 30 Oct 1997 01:56:09 -0500 (EST) In-Reply-To: from "Tim May" at Oct 29, 97 05:25:33 pm Content-Type: text Content-Length: 773 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 An entity claiming to be Tim May wrote: : : (Personally, were I to be arrested and held on such false charges, I'd : consider it necessary to kill those who illegally held me. Preferably from : a safe distance, with a sniper rifle. But then I'm a right wing libertarian : whacko.) Right wing, left wing, friggin' wingless ... the above comment still indicates a sociopath. Mark - -- [] Mark Rogaski "That which does not kill me [] wendigo at pobox.com only makes me stranger." -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNFgviMHFI4kt/DQOEQI3TgCdEOML5s68dD/K850lbUtfUa7LQkoAoNp0 rKwN4YjssiKHobsYQ9qqBJR+ =24To -----END PGP SIGNATURE----- -- [] Mark Rogaski "That which does not kill me [] wendigo at pobox.com only makes me stranger." From dave at bureau42.ml.org Wed Oct 29 23:50:01 1997 From: dave at bureau42.ml.org (David E. Smith) Date: Thu, 30 Oct 1997 15:50:01 +0800 Subject: Location of PGP 5.0 In-Reply-To: <199710300015.BAA22927@basement.replay.com> Message-ID: On Thu, 30 Oct 1997, Anonymous wrote: > Where can I find a copy of PGP 5.0 which handles this "SHA1" hash extension, > and the new forced incompatabilities? I'm looking for a Linux distribution. > All I've found are Windoze versions, really old betas which break > *everything* which calls PGP from a script or command line, and betas which > have a lame expired timebomb in them. Source is prefered for obvious reasons. The MIT site has a precompiled Linux ELF binary of PGP5. Source is, they say, coming RSN. And yes, all versions of PGP5 will, for the time being, break just about all your old scripts. Eventually, they'll finish the pgp2 emulator (they claim it, too, will be out RSN) and most of your old scripts should work again. dave -- Today's pseudorandom quote: Not tonight dear, I installed Linux. David E. Smith, P O Box 324, Cape Girardeau MO USA 63702 Keywords: SciFi bureau42 Wicca Pez Linux PGP single! ;-) From dave at bureau42.ml.org Wed Oct 29 23:50:03 1997 From: dave at bureau42.ml.org (David E. Smith) Date: Thu, 30 Oct 1997 15:50:03 +0800 Subject: Is mixmaster dead? In-Reply-To: <19971029172357.14375.qmail@desk.crynwr.com> Message-ID: On 29 Oct 1997, Russell Nelson wrote: > Lance hasn't updated his mixmaster page in over a year. Is mixmaster > dead? On the contrary. http://www.thur.de/ulf/mix has the latest Mixmaster stuff. dave -- Today's pseudorandom quote: I'm on crack! (http://www.rc5.cyberian.org/ for info.) David E. Smith, P O Box 324, Cape Girardeau MO USA 63702 Keywords: SciFi bureau42 Wicca Pez Linux PGP single! ;-) From mix at anon.lcs.mit.edu Thu Oct 30 00:04:01 1997 From: mix at anon.lcs.mit.edu (lcs Mixmaster Remailer) Date: Thu, 30 Oct 1997 16:04:01 +0800 Subject: PGP 5.0: What were they thinking? (revisited) Message-ID: <19971030080001.18658.qmail@nym.alias.net> >On Thu, 30 Oct 1997, Anonymous wrote: > >> >> Where can I find a copy of PGP 5.0 which handles this "SHA1" hash extension, >> and the new forced incompatabilities? I'm looking for a Linux distribution. >> All I've found are Windoze versions, really old betas which break >> *everything* which calls PGP from a script or command line, and betas which >> have a lame expired timebomb in them. Source is prefered for obvious reasons. > >http://www.pgpi.com/ I went and took a look at this. They've broken the PGP functionality into several different psuedo-binaries which are just symlinks which point to the same binary. Invoking just 'pgp' gives this: >PGP is now invoked from different executables for different operations: > >pgpe Encrypt (including Encrypt/Sign) >pgps Sign >pgpv Verify/Decrypt >pgpk Key management >pgpo PGP 2.6.2 command-line simulator (not yet implemented) > >See each application's respective man page or the general PGP documentation >for more information. Now this, of course, breaks all matter of things. Some of this may be wrong, so feel free to correct it: Phil releases PGP. It rapidly becomes a standard for personal privacy and is used all over the world. Various versions come about including several international versions. Finally PGP 5.0 is released. It uses a completely new scheme, including DH keys. The Windows version purposefully excludes RSA key generation, in effect forcing people to generate DH keys. There is no UNIX version released. Weeks or months later, after incompatabilities were introduced into the system, UNIX versions begin to filter out. Instead of keeping command line compatability so scripts and programs which call PGP still work, they decide to break the functions up into several different invocations, all of which point to the same binary anyway. The README-BIN file for the "beta 11" Linux distribution says: >Rest assured, we WILL be releasing a source Unix distribution. >Unfortunately, licensing and export issues make this difficult; the >beta process for Linux will be completed on a binary basis. We >understand the difficulty this causes, and will be working to find a >solution in the future. They also take the liberty of coding in a timebomb: $ ./pgp This beta evaluation version of PGP has expired. $ pwd /pgp50b11-linux-i386/apps/pgp "lnx-b11" is the version currently handed out by http://www.pgpi.com, by the way. The "PGP 5.0 beta for Linux Intel (US version)" selection on their download page leads to a link to: ftp://ftp.ifi.uio.no/pub/pgp/5.0/usa_only/linux/PGP50-lnx-b11.tgz The current source distribution from that site is b8a. One of the README files from that reads: >Welcome to the PGP beta test program! > >Before reporting any bugs, please check the pgp(1) man page to ensure >that they are not already known. > >Bugs should be reported on the beta test web page at: > > http://beta.pgp.com/ However when one goes to http://beta.pgp.com they're confronted with a legal agreement. Of course the link to it from the front page won't work in Lynx 2.7.1 because it uses something called an "https" link, so the user has to type in the URL manually as "http://www.pgp.com/beta/license.cgi". After reading this license and agreeing to it, the user is allowed to reach the "BetaWeb" page. However the "public bug reports" link yields this: > Sorry, the bug report form is not available yet. > Please be patient as we get things ready. > > Please see the PGP BetaWeb for further information, or contact the > Beta Manager with specific questions. > > For now, please use the "Back" button in your browser to return to the > previous page. So maybe you can at least get whatever the current beta is and hope it works, right? Wrong. "PGP Personal v5.5.1 BetaHome"'s "Beta Software & ReadMe Download Button" wants a user name and password, but it's doubtful they have a UNIX distribution in there anyway considering the rest of this mess. Well, at least maybe the user can suggest a new "feature" for PGP 6 and that feature be "Release a source distribution which when installed doesn't break anything which calls PGP," right? Wrong. You have to have a username and password for that too. Well, obviously they want you to register as a "Registered PGP Beta Tester" to get this clearance. However "Beta Registration" yields: > Sorry, we are not currently accepting new beta testers. > We will be shortly, however, so please check back if you are interested. > > Please see the PGP BetaWeb for further information, or contact the >Beta Manager with specific questions. > For now, please use the "Back" button in your browser to return to the > previous page. And of course my 2.6.3i breaks on this "Hash: SHA1" stuff. So correct me if I'm wrong but the way I see it is like this: A new version of PGP was released. It was incompatable with previous versions. They release a Windows version but don't release a version which works under UNIX. Of course Windows users now start using the "latest and greatest," sending messages and keys all over the place which are completely incompatable with the version of PGP everybody else is using. They claim to be working on a UNIX version, granted, but that should have been released at the same time as the Windows version and *AFTER* there was an international version of PGP 5.0 available. Their UNIX version of PGP 5.0 also seems to be completely incompatable with anything which calls PGP from a script or program. In addition their UNIX versions are purposefully crippled so that they don't work after a certain time period, don't provide an override for this that I can see, and they insist on releasing binary-only distributions for Linux which prevents people from commenting that out. They have no method to get new up to date versions, nor do they have a method to report bugs like they say they do. Further the "PGP50-lnx-b11-6126098-1.src.rpm" contains the *BINARY* distribution, *not* the source. I've also been informed that PGP 5.0 encrypts to the CMR key without even bothering to ask and there's no way to override that short of hacking the key record. What the hell are these people thinking? Did they get into bed with Microsoft to try to get people to say "screw this" and go use Windows? From cyber at dis.org Thu Oct 30 01:06:17 1997 From: cyber at dis.org (Evil Erik) Date: Thu, 30 Oct 1997 17:06:17 +0800 Subject: Crypto FTP for NT? Message-ID: <199710300852.AAA17812@merde.dis.org> Anyone know of a crypto based FTP for NT? At this point, freeware, shareware, commercial is fine.. We'd prefer not to have to roll our own.. (Yes, I know about F-Secure's SFTP, but that is still a few months off..) Thanks, -=erik. From aba at dcs.ex.ac.uk Thu Oct 30 03:27:36 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Thu, 30 Oct 1997 19:27:36 +0800 Subject: PGP Inc PR cover-up Message-ID: <199710301011.KAA01067@server.test.net> I wonder about the sudden lull in the pgp5.5 CMR argument: have PGP Inc enforced a blanket ban on participation in list discussion of the topic by their employees? Even our anonymous PGP employees posting via remailers on cypherpunks seem to have stopped. PGP Inc seemed to me to be heavily losing the argument where ever employees have spoken on the topic. Unfortunately this doesn't seem to be translating into rejection of the CMR feature, nor of adoption of less dangerous alternatives such as forward secret transport level security, shorter lived encryption keys, and separate storage keys. Perhaps it will take an official government snoop endorsement of pgp5.5 before the danger is acknowledged; by then the damage will have been done. Meanwhile over on ietf-open-pgp: The ietf-open-pgp forum for discussion of development of the now IETF controlled OpenPGP standard seems to have undergone a coo. Cypherpunk Lutz Donnerhacke had pre-empted Rodney Thayer and PGP's Jon Callas draft which had been slow coming by producing a competing draft before them. Lutz's draft was not sympathetic with PGP Inc's CMR, and even included SHOULD features encouraging separate storage keys. John Noerenberg (appointed IETF chair) over-ruled Lutz, and wrested editing of the draft from him, and demonstrated some petty power wielding in over ruling a vote on terminology Lutz had set up -- Lutz had already said he didn't care about the outcome, and just called the vote as a quick way to resolve argument. Now we are waiting for Jon Callas to release the new draft. Wonder whether it will include CMR or not :-) Join in the battle: subscribe by sending email with body "subscribe ietf-open-pgp" to . The list address for posting articles is Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 There are some remarkable similarities between pgp5.5 and the hugely unpopular original clipper chip design. Both encrypt the communication key so it can be snooped by third parties thus creating a backdoor. I suspect that part of the reason there has been less outcry over pgp5.5 than for clipper is that people have a high regard for PGP Inc, and allow this to lull their fears -- "if PGP Inc have done it, it can't be evil." This is really insidious, and it is reprehensible for PGP Inc to use their reputation capital to give clipper like systems a positive spin. pgp5.5 is basically a software implementation of clipper: In PGP the backdoor is the second crypto recipient -- the message key encrypted to the CMRK (Corporate Message Recovery Key) as requested by the ARR (Additional Recipient Request); in clipper the backdoor is the LEAF (Law Enforcement Access Field). Both systems make attempts to enforce the presense of this backdoor field: PGP Inc's policy enforcer can be configured to bounce mail not encrypted to the corporate backdoor key; in Clipper it is the checksum included in the LEAF which allows the receiving chip to reject LEAFs which have been tampered with. Both systems are "optional" -- you don't have to use clipper chips, they will be "voluntary" (or so the politicians claim), and governments aren't currently using the backdoor feature of pgp5.5, and PGP Inc argue this won't happen (we'll see how this works out). Both systems can be bypassed in very analogous ways: They can both be bypassed by super encrypting traffic. With pgp5.5 the sender can send garbage in the CMRK encrypted field; with clipper Matt Blaze found you could brute force the checksum and send garbage in the LEAF field. Both systems can be improved to make them harder to bypass, something one suspects may happen if too many people routinely bypass them, and law enforcement views this as a problem (which they surely will if their snooping attempts are foiled -- don't forget Freeh is already on record calling for mandatory key escrow, and outlawing of non-escrowed crypto). Clipper can be made harder to bypass by increasing the size of the checksum. pgp5.5 can be made harder to bypass by using binding cryptography (allows untrusted agents to be deputised as policemen in ensuring the same key is included inside the CMRK field as in the recipients PKE field). It is easy for the government snoop to detect cheating with either system -- they attempt to decrypt the traffic, and find the LEAF/CMRK field is tampered with, or find the contained message is super encrypted. One suspects that an additional 5 year sentence will be given to people who are detected tampering with snoop fields. (This is not far fetched I don't think -- already we have heard proposals for 5 year additional sentencing for "use of encryption in a crime". If non-escrowed encryption is outlawed, surely this is the logical next step on the part of Freeh, and cohorts). PGP Inc cries: "oh but we have to meet corporate user requirements". For corporate disaster recovery of stored data? For corporate message snooping? For either requirement many of us have documented far less dangerous techniques to enable corporate message snooping, and storage recovery. Techniques which aren't likely to be adopted by governments as their snooping architecture. PGP should fix this quickly before the reputational damage is increased by more government statements about the usefulness of pgp5.5. and CMR. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 � Georg Josef UphoffStud.iur.georg.uphoff at uni-konstanz.de <<<<<<>>>>>>> From stewarts at ix.netcom.com Thu Oct 30 03:29:47 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Thu, 30 Oct 1997 19:29:47 +0800 Subject: Location of PGP 5.0 In-Reply-To: <199710300015.BAA22927@basement.replay.com> Message-ID: <3.0.3.32.19971030022512.006f7db0@popd.ix.netcom.com> At 01:15 AM 10/30/1997 +0100, Anonymous wrote: >Where can I find a copy of PGP 5.0 which handles this "SHA1" hash extension, >and the new forced incompatabilities? I'm looking for a Linux distribution. >All I've found are Windoze versions, really old betas which break >*everything* which calls PGP from a script or command line, and betas which >have a lame expired timebomb in them. Source is prefered for obvious reasons. There's a Linux beta on www.pgpi.com which you may or may not consider to be "really old", and I think I heard there's now a Linux version on www.pgp.com or mit.edu. However, it's likely that it will still break command-line versions that think they know too much about the 2.6.2 output format, unless the PGP porting folks did a spectacular and annoyingly hard job. Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From stewarts at ix.netcom.com Thu Oct 30 03:29:57 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Thu, 30 Oct 1997 19:29:57 +0800 Subject: PGP Employee on MKR In-Reply-To: <877948732.5974.193.133.230.33@unicorn.com> Message-ID: <3.0.3.32.19971030025716.006cdf80@popd.ix.netcom.com> At 02:38 AM 10/27/1997 -0800, mark at unicorn.com wrote: >Really? I seem to recall Jon Callas saying my system 'redesigned CMR' >but was simpler than theirs. The mere fact that CMR requires an enforcer >implies that it's a convoluted and hasty design. Not true - you can't implement CMR without a mail enforcer unless you can stop your employees from using non-CMR versions of PGP, which is nearly impossible. Even with an enforcer, of course, you can't stop the determined employee from double-encrypting and steganizing and otherwise getting their outbound bits past your enforcer looking like the baseball game narrative from Wayner's Mimic Functions or Pointy-Haired-Boss randomness, but they could also carry a floppy disk out the door or beam infrared out the window from their Newton. Similarly, on incoming mail, you can't stop people from sending your employees non-CMRed mail without an inbound-mail enforcer and can't stop your employees from reading it with their own warez. More importantly, though, PGP isn't a mail program, it's an encryptor, and if you're trying to stop people from sending encrypted mail back and forth, you've got to control the mail system as well as the encryptors, and you probably already _do_ control the mail system. Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From lutz at taranis.iks-jena.de Thu Oct 30 03:32:03 1997 From: lutz at taranis.iks-jena.de (Lutz Donnerhacke) Date: Thu, 30 Oct 1997 19:32:03 +0800 Subject: Is mixmaster dead? In-Reply-To: Message-ID: * David E. Smith wrote: >On the contrary. http://www.thur.de/ulf/mix has the latest Mixmaster stuff. www.thur.de is dead till Monday due to hard disk crash. Use http://www.fitug.de/ulf/ instead. From stewarts at ix.netcom.com Thu Oct 30 03:33:20 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Thu, 30 Oct 1997 19:33:20 +0800 Subject: apropos list talk and our culture In-Reply-To: Message-ID: <3.0.3.32.19971030012222.0070f588@popd.ix.netcom.com> At 07:38 AM 10/29/1997 -0500, Brad Dolan wrote: >"Michael Hays" is a new CBS series about a U.S. District Attorney. Last >night's episode was about how a radio talk-show host incited a listener >to kill a BATF agent and was brought to justice. DA convinced a jury >that some things were "more important" than the first amendment. It's nice not to spend my evenings staring at a tube :-) The radio talk-show host who talked about killing BATF agents really _did_ deserve to be brought to justice. No, not the fictional one, and not for that - the real one, G.Gordon Liddy himself, Watergate Plumber and Republican Henchperson, the kind of sleazy statist propagandist who'd love to be putting on a TV show like that if it wasn't about him.* (Actually he did do some time, and he deserved it. His fellow conspirator, Chuck Colson, has at least rehabilitated himself.) [I've been reading Esther Dyson's new book "Release 2.0"; she's got a nice line in there about the Net being a great place for conspiracy, while television is better for propaganda.] Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From whgiii at invweb.net Thu Oct 30 04:03:40 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 30 Oct 1997 20:03:40 +0800 Subject: Terrorism is a NON-THREAT In-Reply-To: Message-ID: <199710301155.GAA20273@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In , on 10/29/97 at 08:03 PM, Tim May said: >At 8:20 PM -0700 10/29/97, Igor Chudov @ home wrote: >>* Terrorism is escalating to the point that Americans soon may have to choose >>* between civil liberties and more intrusive means of protection. Defense >>* Secretary William S. Cohen says. >And no doubt this means GMR for all crypto. >And if we say "No thanks" to the no-knock searches, the street friskings, >the "Papierren, bitte??" travel restrictions, what then? >Not much of a choice, eh? >The spinmeisters are laying the groundwork for martial law. Just what >we've been hearing about for years. >Get ready. Lock-N-Load!! I wish for once one of the spineless members of the press would ask: "How many people have died from Terrorism in the last 10yrs?" Let's be generious and say 10,000 world wide (more like 2,000 but lets not quibble over numbers). So we are at 1,000/year world wide. Now only a fraction of those are actually Americans say 50-100/year. Now how do they justify the establishment of a police state to save 50-100 lives?!? More Americans die every year from slipping on bars of soap! Our problem here is not that Assholes are running Washington (Washington has always been run by assholes) are problem is the Press has turned into the sphincter of the powers that be. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNFh1Go9Co1n+aLhhAQGksAQAm3/8QSINev69Uj6Fr9OPuEXy22uZ1eOU KUmtrbPeJdRINf0LoEx9kpb24k1Yi/aArKUoamHS6KqcfczhZm36j6hVhuMv9sR4 TwUy3qHc2lk7BmGHLw2OIzBdhMqJ5194C/xJUOIZAnynA7aHi0Nl7koLz9sBSIOJ nDJmkiF0abg= =VRA3 -----END PGP SIGNATURE----- From mark at unicorn.com Thu Oct 30 05:17:43 1997 From: mark at unicorn.com (mark at unicorn.com) Date: Thu, 30 Oct 1997 21:17:43 +0800 Subject: PGP Employee on MKR Message-ID: <878217099.27123.193.133.230.33@unicorn.com> stewarts at ix.netcom.com wrote: > Not true - you can't implement CMR without a mail enforcer unless > you can stop your employees from using non-CMR versions of PGP, > which is nearly impossible. No, you can't enforce corporate snooping without a mail enforcer. You can meet the corporate demands which PGP claim to be supporting without a mail enforcer. There's a difference. The only real benefit of CMR over the alternate systems suggested is that the corporation can snoop on all email sent to their employees. Yet PGP Inc have claimed on several occasions that this is not their intention. Odd, that. Mark From ravage at ssz.com Thu Oct 30 05:22:17 1997 From: ravage at ssz.com (Jim Choate) Date: Thu, 30 Oct 1997 21:22:17 +0800 Subject: Terrorism is a NON-THREAT (fwd) Message-ID: <199710301318.HAA17701@einstein.ssz.com> Forwarded message: > From: "William H. Geiger III" > Date: Wed, 29 Oct 97 22:46:45 -0600 > Subject: Terrorism is a NON-THREAT > I wish for once one of the spineless members of the press would ask: > > "How many people have died from Terrorism in the last 10yrs?" > > Let's be generious and say 10,000 world wide (more like 2,000 but lets not > quibble over numbers). Bill, more than 2,000 people have dies from planes being blown up by terrorist in the last 10 years alone. Old Prince Ferdinand, you know the bloke whose death started WWI allegedly, had an attempt on his life the morning of his death via bomb. He shrugged it off and got shot. Stalin had millions killed for political reasons. The Isrealis have killed tens of thousands in their expanionisitic, non-survivalist motivated actions. The US backed Central American death squads have killed hundreds of thousands if not millions. People kill for religion, politics, insanity, and fun. Terrorism has a long history in human culture. Yours is a unreasoned view. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From nobody at REPLAY.COM Thu Oct 30 05:22:17 1997 From: nobody at REPLAY.COM (Anonymous) Date: Thu, 30 Oct 1997 21:22:17 +0800 Subject: [cpe:3185] Re: rescue Mrs Allen from the Feds In-Reply-To: <199710291731.RAA00923@server.test.net> Message-ID: <199710301317.OAA29530@basement.replay.com> Adam Back wrote: >Kent Crispin writes: >> On Wed, Oct 29, 1997 at 11:17:43AM +0000, Adam Back wrote: >> > The Gandi style walk in, in numbers walk off with Mrs Allen :-) What are >> > they going to do, shoot 1000 unarmed citizens? >> >> The 100 citizens would probably be shot by Mrs Allen. > >Heh, yeah. That's why you need to send in the spread spectrum phone >first, to let her know what you're planning -- else she'll just think >it's a ploy by the Feds. Perhaps she just wants to be left alone??? From ccs at dev.null Thu Oct 30 05:34:38 1997 From: ccs at dev.null (Chief CypherPunks Spokesperson) Date: Thu, 30 Oct 1997 21:34:38 +0800 Subject: [cpe:3185] Re: rescue Mrs Allen from the Feds In-Reply-To: <199710301317.OAA29530@basement.replay.com> Message-ID: <34588B26.66C9@dev.null> Anonymous wrote: > Adam Back wrote: > >Kent Crispin writes: > >> On Wed, Oct 29, 1997 at 11:17:43AM +0000, Adam Back wrote: > >> > The Gandi style walk in, in numbers walk off with Mrs Allen :-) What are > >> > they going to do, shoot 1000 unarmed citizens? > >> The 100 citizens would probably be shot by Mrs Allen. > >Heh, yeah. That's why you need to send in the spread spectrum phone > >first, to let her know what you're planning -- else she'll just think > >it's a ploy by the Feds. > Perhaps she just wants to be left alone??? "We're from the CypherPunks, and we're here to help you. Aarrrgghhhh..." From jya at pipeline.com Thu Oct 30 05:51:25 1997 From: jya at pipeline.com (John Young) Date: Thu, 30 Oct 1997 21:51:25 +0800 Subject: Cpunk Hots: E-Cash Message-ID: <1.5.4.32.19971030134345.00b58944@pop.pipeline.com> Village Voice reviews "Close to the Machine: Technophilia and Its Discontents," by Ellen Ullman, City Lights, 189 pp. $12.95 paper. Ullman, a Silicon Valley programmer, "describes having an affair with a young cypherpunk: 'we sat with our legs extended across the sofa, not quite touching, and we were going to talk about electronic cash.' " From mark at unicorn.com Thu Oct 30 06:00:49 1997 From: mark at unicorn.com (mark at unicorn.com) Date: Thu, 30 Oct 1997 22:00:49 +0800 Subject: PGP Employee on MKR Message-ID: <878219801.29664.193.133.230.33@unicorn.com> I wrote: > stewarts at ix.netcom.com wrote: > > > Not true - you can't implement CMR without a mail enforcer unless > > you can stop your employees from using non-CMR versions of PGP, > > which is nearly impossible. > > No, you can't enforce corporate snooping without a mail enforcer. You can > meet the corporate demands which PGP claim to be supporting without a > mail enforcer. There's a difference. Actually, that's not entirely true. My suggested CMR replacement will work happily with non-CMR versions of PGP; they would simply encrypt to the default key, regardless of whether that was a group key or an individual's key. Hence the corporation can choose how non-CMR versions will interact by choosing whether to make the group key or the individual key the default choice. This even gives users an incentive to upgrade, rather than the current disincentive to downgrade to snoopware. Of course it still doesn't enforce snooping, since you could just seperate the individual key from the default group key and encrypt to that. Mark From whgiii at invweb.net Thu Oct 30 06:56:13 1997 From: whgiii at invweb.net (William H. Geiger III) Date: Thu, 30 Oct 1997 22:56:13 +0800 Subject: Terrorism is a NON-THREAT (fwd) In-Reply-To: <199710301318.HAA17701@einstein.ssz.com> Message-ID: <199710301451.JAA23256@users.invweb.net> -----BEGIN PGP SIGNED MESSAGE----- In <199710301318.HAA17701 at einstein.ssz.com>, on 10/30/97 at 07:18 AM, Jim Choate said: >Forwarded message: >> From: "William H. Geiger III" >> Date: Wed, 29 Oct 97 22:46:45 -0600 >> Subject: Terrorism is a NON-THREAT >> I wish for once one of the spineless members of the press would ask: >> >> "How many people have died from Terrorism in the last 10yrs?" >> >> Let's be generious and say 10,000 world wide (more like 2,000 but lets not >> quibble over numbers). >Bill, more than 2,000 people have dies from planes being blown up by >terrorist in the last 10 years alone. >Old Prince Ferdinand, you know the bloke whose death started WWI >allegedly, had an attempt on his life the morning of his death via bomb. >He shrugged it off and got shot. >Stalin had millions killed for political reasons. >The Isrealis have killed tens of thousands in their expanionisitic, >non-survivalist motivated actions. >The US backed Central American death squads have killed hundreds of >thousands if not millions. >People kill for religion, politics, insanity, and fun. >Terrorism has a long history in human culture. >Yours is a unreasoned view. Well THANK YOU Jim for joining forces with the Government NewSpeakers in bastardising the language. Military and Police actions by governments is NOT Terrorism!! Everything bad that happens is NOT Terrorism!! Just because it is politically expediant to call somthing Terrorism does not make it so! If you have a point then do so and let it stand on it's merrits rather than trying to win brownie points by stealing emotional value from an established lable. This is a shallow debating technique of a weak mind. Now back to the featured program: Exactly how many have died from Terrorist acts?? I contend that it is below 10,000 in the past ten years and more than likely closer to 2,000. Even at 10,000 we are only looking at most 50-100 Americans a year!! The whole point of my orriginal message that you seem unable to grasp ("no suprise") is that 50-100 deaths/year does not justify turning this country into a police state!! - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNFieS49Co1n+aLhhAQEwmgP9HA1/iTnarX3NC9pjlWcCrvzsYxH/Cy5Z cRd3N/H0uFDcgIeInYZR4a1mjEDkjqRkHLUD6vBHmYm0gaxTQQMzxrroKlxWPTPD PypVaATowFBPAh9YAjH+dwFJax/pzyN1BMlXb5iqB1t6+p0K69+IgXvXEu0R68hL Ce6E9fNftf8= =pfxA -----END PGP SIGNATURE----- From T.G.Griffiths at exeter.ac.uk Thu Oct 30 07:24:28 1997 From: T.G.Griffiths at exeter.ac.uk (Tim Griffiths) Date: Thu, 30 Oct 1997 23:24:28 +0800 Subject: Terrorism is a NON-THREAT (fwd) In-Reply-To: <199710301451.JAA23256@users.invweb.net> Message-ID: Bill wrote: > The whole point of my orriginal message that you seem unable to grasp ("no > suprise") is that 50-100 deaths/year does not justify turning this country > into a police state!! > > - -- > - --------------------------------------------------------------- > William H. Geiger III http://www.amaranth.com/~whgiii Yup, I don't disagree with that. But, I have trouble answering the obvious question, 'well, how many lives _does_ it take before something is done?'. Is there any way to quantify this kind of thing? We hear on TV etc people saying "If this draconian measure saves the life of one innocent child its worth the loss of my right to walk in the park, or whatever". This is clearly shit, but can people suggest a sensible measure of when new legistlation is justified? Tim G -- Tim Griffiths 'There are no honourable agreements that involve the exchange of a quantifiable object, like a sum of money, for qualitative object such as a human soul'. - Bill Burroughs From ichudov at Algebra.COM Thu Oct 30 07:57:57 1997 From: ichudov at Algebra.COM (Igor Chudov @ home) Date: Thu, 30 Oct 1997 23:57:57 +0800 Subject: DEA trying to subpoena book dealers In-Reply-To: Message-ID: <199710301543.PAA19111@manifold.algebra.com> Tim May wrote: > > And so it goes. This is why I have 3000 rounds of .223 stashed away, and > several loaded weapons readily available. And an early warning system in > case the night ninjas decide my house needs to be raided before dawn. What kind of early warning system is it, technically? Another question about home defense: it must be really inconvenient to perform all these self-defense actions naked, which would obviously happen during these night raids and robberies. Is that a problem, and if yes, what are the solutions? - Igor. From nobody at secret.squirrel.owl.de Thu Oct 30 08:09:38 1997 From: nobody at secret.squirrel.owl.de (Secret Squirrel) Date: Fri, 31 Oct 1997 00:09:38 +0800 Subject: Protocols for Insurance to Maintain Privacy Message-ID: <7433f6e11aa46cf7b903a8251c3e35b5@squirrel> -----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: > The FDA has probably killed more people in the last 30 years than > all the wars the U.S. has been in during the same time. Mostly > because of the game-theoretic nature of the system: all that matters > to FDA officials is covering their ass so that promotion is > ensured. No points for approving a controversial drug, but lots of > demerits for approving a drug which hurts even one person (if the > media reports it as "another FDA oversight"). Avoiding flipper > children is the raison d'etre for these people. Tim no doubt already knows this, but I'm going to mention it anyway. The FDA has other reasons for existing such as protecting the major drug cartels from competition and providing wonderful employment opportunities for former FDA employees in said drug cartels. The choice of medical products and services as a choke point to exploit is a particularly evil one as the link between government imposed oligopoly profits and people's lives is very clear. And, of course, this is worst of all for poor people because they are least able to manage their situation. I have my doubts as to whether it is possible to set up a really good anonymous insurance scheme. At some point the customer must physically be matched up with the policy. The damage may be minimized by putting a hash of the customer's DNA markers in the policy instead of the markers themselves. But, when the customer wishes to draw on the policy, his or her markers will have to be taken. If there were a way for the representative of the insurance company to absolutely verify the DNA markers such that the customer could be absolutely certain the information didn't leave the room, a really good anonymous policy would be feasible. But, I can't think of a way to do this. The really good way to protect your medical privacy is to self insure. Most people are happy with policies that tap out at $1 million. If you would be happy with such a policy, then all you need is $1 million to protect your privacy. It is likely that this $1 million will not ever be consumed by health care costs. (Probably much less likely than that a policy holder will hit that limit. People tend to spend their own money more responsibly than somebody else's.) One of the most important criteria for issuing insurance must be age. Is there anyway to unambiguously determine somebody's age? I know how to do it with trees, but it doesn't work with people. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFgp6ZaWtjSmRH/5AQES/wf+Ijrvktr6VxOxFRKZsad19G6fLuotWLTx /kGEncb+3cAHg26Pxn2FRjt8FO4fdqNp/adaEtCmaVDJeJavhhiqW+XyXuLb1Iy4 5YrvG/xIbbPIIYdVeZ5coATNAIaKZvQu0UWrbDQzbmyxi0bIHmaixxx53isc14w1 qn+4PrlV7jVyKCPf/BMw7Mv7L33v8ZR3r3iS15L/OjIxBtvpVDvnBv8BdKwMA7C+ S5HBSYhiYjSGi1CnisnKI0POD9BqXXr5LwNA+407hPWDTkSGZ4iRqY3koiO0e/Je eEvfbcSBEazaXcqlMtuI5xkFhLOY3L9oF+BtRjAfc9TRocFTTzZwHA== =VcKo -----END PGP SIGNATURE----- From vipul at best.com Thu Oct 30 08:27:07 1997 From: vipul at best.com (Vipul Ved Prakash) Date: Fri, 31 Oct 1997 00:27:07 +0800 Subject: GOST Message-ID: <199710302129.VAA00222@fountainhead.net> I have compiled some links related to GOST at http://www.fieo.org/gost/ vipul -- Powell lingered. "How's Earth?" It was a conventional enough question and Muller gave the conventional answer, "Still spinning." -- "Reason", Asimov. ================================================================== Vipul Ved Prakash | - Electronic Security & Crypto vipul at best.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Virtual Spaces From rah at shipwright.com Thu Oct 30 08:41:13 1997 From: rah at shipwright.com (Robert Hettinga) Date: Fri, 31 Oct 1997 00:41:13 +0800 Subject: Victim Ordered to Surrender Computer and Passwords Message-ID: --- begin forwarded text Resent-Date: Thu, 30 Oct 1997 10:11:33 -0500 X-Authentication-Warning: qnx.com: localhost [127.0.0.1] didn't use HELO protocol To: 0xdeadbeef at substance.abuse.blackdown.org Cc: bostic at bsdi.com Subject: Victim Ordered to Surrender Computer and Passwords Date: Thu, 30 Oct 1997 10:04:22 -0500 From: glen mccready Resent-From: 0xdeadbeef at substance.abuse.blackdown.org X-Mailing-List: <0xdeadbeef at substance.abuse.blackdown.org> archive/latest/2399 X-Loop: 0xdeadbeef at substance.abuse.blackdown.org Precedence: list Resent-Sender: 0xdeadbeef-request at substance.abuse.blackdown.org Forwarded-by: Peter Tonoli Date: Mon, 27 Oct 1997 03:02:58 -0500 From: David Kennedy <76702.3557 at compuserve.com> Subject: Victim Ordered to Surrender Computer and Passwords Approved: proff at suburbia.net Cyber Allegations (AP US & World 21 Oct 1997) > PONTIAC, Mich. (AP) -- A woman who said she was sexually assaulted by a > man she met through an on-line "chat room" has been ordered to turn over > her computer for examination by the defendant's lawyer. Circuit Judge > Alice Gilbert issued the order Oct. 8 after the defendant said another > computer user told him that the woman had bragged on-line -- in a chat > room called "Man Haters" -- about making up the story. The woman was > also ordered to reveal her password and on-line aliases. o The accused, a 26-year old is alleged to have pulled a knife and attacked the victim after a date on Feb 28th. Prosecutors have said they will appeal. > "In my view, turning over somebody's computer these days is the same as > asking to go through their diary or mail," said prosecutor John > Pietrofesa. Inspecting computer records from the opposing side, while > relatively new in criminal cases, has become common in civil cases, said > Michigan lawyer and computer law expert Robert A. Dunn. In civil cases, a > judge will institute safeguards such as making both sides sign a > confidentiality agreement that information gleaned from computer records > will not be disclosed outside of court, he said. Dave Kennedy CISSP, National Computer Security Assoc --- end forwarded text ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: From rah at shipwright.com Thu Oct 30 08:41:43 1997 From: rah at shipwright.com (Robert Hettinga) Date: Fri, 31 Oct 1997 00:41:43 +0800 Subject: Swallow all liquids before reading this... Message-ID: ... as you may blow it all out your nose... Cheers, Bob Hettinga --- begin forwarded text Resent-Date: Wed, 29 Oct 1997 18:38:23 -0800 (PST) X-Authentication-Warning: weber.ucsd.edu: procmail set sender to rre-request at weber.ucsd.edu using -f X-Authentication-Warning: weber.ucsd.edu: Processed from queue /usr/spool/mqueue/rqueue Date: Wed, 29 Oct 1997 18:31:31 -0800 (PST) From: Phil Agre To: rre at weber.ucsd.edu Subject: Appraising Microsoft and Its Global Strategy Conference Resent-From: rre at weber.ucsd.edu Reply-To: rre-maintainers at weber.ucsd.edu X-URL: http://communication.ucsd.edu/pagre/rre.html X-Mailing-List: archive/latest/1714 X-Loop: rre at weber.ucsd.edu Precedence: list Resent-Sender: rre-request at weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help at weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= [I don't have the original header.] Appraising Microsoft and Its Global Strategy Conference November 13 and 14, 1997 The Omni Shoreham Hotel Washington, D.C. Please join Scott McNealy, CEO of Sun Microsystems, Roberta Katz, General Counsel for Netscape Communications and Christine Varney, Former Federal Trade Commissioner among others at the Appraising Microsoft and Its Global Strategy Conference cosponsored by Ralph Nader and Essential Information. The following is a list of confirmed speakers: Garth Saloner, Stanford University Morgan Chu, Irell & Manella Roberta Katz, General Counsel for Netscape Communications Audrie Krause, NetAction Bill Wendel, The Real Estate Cafe Scott McNealy, CEO of Sun Microsystems Christine Varney, Former FTC Commissioner Ralph Nader, Consumer Advocate Steve Susman, Susman and Godfrey Gary L. Reback, Esq., Wilson, Sonsini, Goodrich & Rosati Financial services: Bill Randle, VP Huntington Bancshares Consumer products: CEO and President Philip Monego, NetChannel Bryan Sparks, CEO Caldera, Inc. James P. Love, Consumer Project on Technology Graham Lea, Principal Analyst of Heterodox (London) Andrew Schulman, Consulting Editor O'Reilly and Association Steve Hill, Esq., Snow Christensen Rick Ross, Java Lobby Daniel Nachbar, Public Software Institute John Perry Barlow, Co-founder of the Electronic Frontier Foundation Sam Goodhope, Texas Attorney General's Office. Wendy Goldman Rohm, author Please see our web page for more information and registration materials. If more than five people from your organization/company would like to attend, we will give a 30% registration discount. http://www.appraising-microsoft.org/ For more information please call Caroline Jonah or Donna Colvin at (202)387-8030. --- end forwarded text ----------------- Robert Hettinga (rah at shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: From real at freenet.edmonton.ab.ca Thu Oct 30 08:49:50 1997 From: real at freenet.edmonton.ab.ca (Graham-John Bullers) Date: Fri, 31 Oct 1997 00:49:50 +0800 Subject: [URGENT] Secure checksums In-Reply-To: <4bce0368c6dca6472723bacbbd57dee7@anon.efga.org> Message-ID: On Wed, 29 Oct 1997, Anonymous wrote: I think Vulis needs each of us to send ten copies of this back to him. > Warning: if you fuck Timothy C[unt] May in the ass, a > rabid tapeworm might bite your penis. > > \0/ \0/\ \ / / \0/ \0/ \0/\ \ / /\0/ \0/ Timothy C[unt] May > | / /) | (\ | | / /) | (\ \ | > / \__/\__/0\__/0\__/0\__/ \__/ \__/\__/0\__/0\__/0\__/\__/ \ > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Graham-John Bullers Moderator of alt.2600.moderated ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ email : : ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.freenet.edmonton.ab.ca/~real/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From tcmay at got.net Thu Oct 30 08:50:23 1997 From: tcmay at got.net (Tim May) Date: Fri, 31 Oct 1997 00:50:23 +0800 Subject: DEA trying to subpoena book dealers In-Reply-To: Message-ID: At 8:43 AM -0700 10/30/97, Igor Chudov @ home wrote: >Tim May wrote: >> >> And so it goes. This is why I have 3000 rounds of .223 stashed away, and >> several loaded weapons readily available. And an early warning system in >> case the night ninjas decide my house needs to be raided before dawn. > >What kind of early warning system is it, technically? Well, now that wouldn't be very smart of me, would it, to tell the world where my defensive measures are? (I'm willing to let would-be ninjas know that I won't take a no-knock raid without fighting back, as this may deter them, in classic game-theoretic terms, but not to tell them precise details of my defenses.) Check the ads in the gun and survival mags for ideas. Seismic (footfall, vehicle) detectors are affordable, but hard to monitor on a 24/7 basis. Simple photolectric vehicle detectors are useful. In my case, I have a private driveway about 100 meters long as the only access to my house. Not to hard to rig up methods to warn of vehicles approaching...harder to warn of men approaching on foot. And even harder if they come up through the brush and chapparal on the other 3 sides. The main thing is to provide a minute or so of warning of vehicles approaching in the middle of the night. >Another question about home defense: it must be really inconvenient >to perform all these self-defense actions naked, which would obviously >happen during these night raids and robberies. > >Is that a problem, and if yes, what are the solutions? The usual advice is to secure one's bedroom for immediate invasion. (My bedroom is on the second floor, too.) This helps with burglars as well as with ninjas. For example, lock the bedroom door. This will slow down attackers, who first have to gain access to the main house, then have to get in the bedroom. The noise from the first step should provide valuable seconds of awakening, grabbing a gun, etc. I don't think a locked bedroom door will stop an entry team from getting inside in a matter of seconds, but every second helps. (Experts also advise that homeowners facing such assaults "stay put," unless, of course, they have to defend other family members in other rooms.) And ignore the advice from the Consumer Protection Safety Commission, etc., to lock all guns up in safes or vaults or closets. A gun locked up in a gun safe can't be gotten to when it's really needed, can it? Oh, and loading a gun takes far too long, especially in the dark and in a crisis situation. (And keeping ammo out of the gun is only a minor speed bump to inquistive children, so it's not even much protection there.) "What about the children?" For children too young to understand orders, come up with an access solution that gives you fast access but keeps little Suzie from finding the gun. For children old enough to understand orders, and what guns are, tell them exactly what a gun does, show them, educate them, and warn them to NEVER touch the gun or show it to their friends (this is exactly where many accidental shootings happening, with Johnny showing his friends Dad's gun). --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From tm at dev.null Thu Oct 30 09:13:07 1997 From: tm at dev.null (TruthMailer) Date: Fri, 31 Oct 1997 01:13:07 +0800 Subject: Request For Cash: TruthMailer services at dev.null Message-ID: <199710301656.KAA24695@harrier.sasknet.sk.ca> The TruthMailer service at dev.null has become very unpopular. So unpopular, in fact, that we are now approaching limitations in what our abuse department can handle. The great outrage this weekend and subsequent delays in spamming various mailing lists are the result of this. For our immediate needs, we could sure use some more DRUGS, ALCOHOL, and BROADS. If a million people could donate $1,000 apiece, this would be great. If one million people donate $100,000 apiece, we can buy Micro$oft. Anonymous snail mail with anonymous cash (US dollars or money order) would be appreciated. If you want to be acknowledged as a donor on our arrest sheets, we can do that too. The address to send to is: Electronic Forgery Foundation Box 281, Bienfait, Saskatchewan CANADA S0C 0M0 A thousand bucks or whatever you can afford. We'll take drug, alcohol and loose women donations, too. Contact Louis J. Freeh if you have something to donate. It might be a sting operation, but I'm not sure; Louis will know. PCP DustMan / Home Drug Lab for Molecular Structure and Design For an anti-reality drug recipe, send me mail with subject "Hi(gh)". Append "+realitysucks" to my abusername to ensure entrapment. Decryption is too important to leave to the recipient--Louis J. Freeh O "I'm from BassMasters, and I'm here to help you." |/------o -\______|___/- | ~~~~~~~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~ | |/ <}+++< *===================================================================* To unsuscribive or scrivibe send a message of UNSCRIVE or SUBRIVE to the email address _fuck_you_morons_ at whitehouse.gov From azur at netcom.com Thu Oct 30 09:14:27 1997 From: azur at netcom.com (Steve Schear) Date: Fri, 31 Oct 1997 01:14:27 +0800 Subject: Killing those who need killing (fwd) In-Reply-To: <199710300656.BAA11573@deathstar.jabberwock.org> Message-ID: >An entity claiming to be wendigo wrote: >:An entity claiming to be Tim May wrote: > >: >: (Personally, were I to be arrested and held on such false charges, I'd >: consider it necessary to kill those who illegally held me. Preferably from >: a safe distance, with a sniper rifle. But then I'm a right wing libertarian >: whacko.) > >Right wing, left wing, friggin' wingless ... the above comment still >indicates a sociopath. Perhaps, but is being a sociopath that bad? When those who administer the justice system in society are out-of-control, or have consciously decided to ignore the constitutional protections they are charged with upholding then strong, extra-legal, measures may be called for in order to right the apple cart. "Those who prefer security over liberty deserve neither." --Steve From azur at netcom.com Thu Oct 30 09:17:28 1997 From: azur at netcom.com (Steve Schear) Date: Fri, 31 Oct 1997 01:17:28 +0800 Subject: Terrorism is a NON-THREAT (fwd) In-Reply-To: <199710301451.JAA23256@users.invweb.net> Message-ID: > Yup, I don't disagree with that. But, I have trouble answering the > obvious question, 'well, how many lives _does_ it take before something > is done?'. Is there any way to quantify this kind of thing? > > We hear on TV etc people saying "If this draconian measure saves the > life of one innocent child its worth the loss of my right to walk in > the park, or whatever". This is clearly shit, but can people suggest a > sensible measure of when new legistlation is justified? > No amount of deaths are adequate cause for suspending the constitutional rights of our citizens. If the Feds can't adequately protect our citizens from criminal activities w/o trampling on our rights then its time for us to reorganize into different geo-political structures which may. Once solutions offered from D.C. include suspension of our civil rights its time to put allt he options on the table, including considering the abandonment of the entire compact. --Steve From tcmay at got.net Thu Oct 30 09:23:28 1997 From: tcmay at got.net (Tim May) Date: Fri, 31 Oct 1997 01:23:28 +0800 Subject: Terrorism is a NON-THREAT (fwd) In-Reply-To: <199710301451.JAA23256@users.invweb.net> Message-ID: At 8:11 AM -0700 10/30/97, Tim Griffiths wrote: > We hear on TV etc people saying "If this draconian measure saves the > life of one innocent child its worth the loss of my right to walk in > the park, or whatever". This is clearly shit, but can people suggest a > sensible measure of when new legistlation is justified? Is this a trick question, or sumpin'? If not, then the answer is "the Constitution." (I see that T.G.Griffiths at exeter.ac.uk is not an American. I apologize for my U.S.-centric response. Consult your local Charter or whatever to see if similar rights are spelled out. I suspect most adhocracies do not have rights clearly spelled out, modulo the irony that several people's republics have had nominally more rights-ensuring constitutions than the U.S. has had.) The longer version being that the Constitution and especially the Bill of Rights clearly enumerates rights held by the people, and there is no mention that such basic rights are to be stripped away because the "life of one innocent child" can be saved. Examples of cases where restricting religions, books, guns, 4th and 5th and nth Amendment rights would save the lives of some children are obvious to all. And yet such restrictions remain unconstitutional. Sure, there are _some_ limits. A church, for example, cannot practice ritual bloodletting, on children or on adults. Nor can a church hand out drugs (the Native American Church and peyote case resolved this). And so on. (And many of us disagree with some or all of these limitations.) In the "right to walk in the park" issue cited above, this gets into distracting issues about whether the park is open at all hours, the rules established by whomever built the park, etc. Curfews are a cleaner example. And courts have generally held curfews unconstitutional, when they've been challenged. Travel permits are also unconstitutional in the U.S. People may travel wherever they wish, associate with whomever they wish, etc. (A very few exceptions, such as felons and child molestors.) When in doubt about trading off rights for security, consult the Constitution. (Yes, I'm aware that it's falling into disrepute and tatters. But it beats most alternatives.) --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From frantz at netcom.com Thu Oct 30 09:31:50 1997 From: frantz at netcom.com (Bill Frantz) Date: Fri, 31 Oct 1997 01:31:50 +0800 Subject: DEA trying to subpoena book dealers In-Reply-To: Message-ID: At 7:43 AM -0800 10/30/97, Igor Chudov @ home wrote: >Another question about home defense: it must be really inconvenient >to perform all these self-defense actions naked, which would obviously >happen during these night raids and robberies. > >Is that a problem, and if yes, what are the solutions? Wear underwear to bed. Then you won't be naked when the alarm goes off. (At night it will help if you are naturally dark complexioned.) ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz at netcom.com | nation it is today. | Los Gatos, CA 95032, USA From nobody at REPLAY.COM Thu Oct 30 09:32:58 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 01:32:58 +0800 Subject: CAUTION: This *could* be a TROLL / Re: Request For Cash: TruthMailer services at dev.null Message-ID: <199710301721.SAA28652@basement.replay.com> TruthMailer wrote: > > O "I'm from BassMasters, and I'm here to help you." > |/------o > -\______|___/- | > ~~~~~~~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~ > | > |/ <}+++< > From shamrock at cypherpunks.to Thu Oct 30 09:35:23 1997 From: shamrock at cypherpunks.to (Lucky Green) Date: Fri, 31 Oct 1997 01:35:23 +0800 Subject: DEA trying to subpoena book dealers In-Reply-To: <199710301543.PAA19111@manifold.algebra.com> Message-ID: On Thu, 30 Oct 1997, Igor Chudov @ home wrote: > > Another question about home defense: it must be really inconvenient > to perform all these self-defense actions naked, which would obviously > happen during these night raids and robberies. > > Is that a problem, and if yes, what are the solutions? It really depends on the quality of the early warning system. If you have a good one, you have plenty of time to put on the Kevlar outfit. [Make sure to buy the kind with ceramic plate inserts if your threat model includes rifles]. -- Lucky Green PGP encrypted email preferred. "Tonga? Where the hell is Tonga? They have Cypherpunks there?" From tcmay at got.net Thu Oct 30 09:43:57 1997 From: tcmay at got.net (Tim May) Date: Fri, 31 Oct 1997 01:43:57 +0800 Subject: Protocols for Insurance to Maintain Privacy In-Reply-To: <7433f6e11aa46cf7b903a8251c3e35b5@squirrel> Message-ID: At 8:50 AM -0700 10/30/97, Secret Squirrel wrote: >The really good way to protect your medical privacy is to self insure. >Most people are happy with policies that tap out at $1 million. If >you would be happy with such a policy, then all you need is $1 million >to protect your privacy. It is likely that this $1 million will not >ever be consumed by health care costs. (Probably much less likely >than that a policy holder will hit that limit. People tend to spend >their own money more responsibly than somebody else's.) I used to think this was so, too. But there's a certain kind of market failure at work. (Actually, it's not a market failure at all....it's a manifestation of the market. Read on.) It turns out that if I have to go to the local hospital, the daily rate for a hotel room will be something like $2000 a day. Exclusive of whatever treatments I'm receiving, of course. Turns out that Blue Cross and Blue Shield have negotiated, through enormous buying power, daily rates of about $700 a day. (These numbers come from my memory of a "60 Minutes" report a few years ago. Details and current figures may vary.) Listed prices are the "sucker rates," kind of like the posted prices for out-of-towners, with locals getting a discount. And these pricing differences apply to the whole range of procedures. For example, an insurance company might have negotiated--over many years of intense negotiations--a fee of $100,000 for a liver transplant, but a "cash-paying customer" (a victim, a mark, a sucker) would pay the list price, e.g., $300,000. Could I negotiate a lower room rate, and lower fees for a spectrum of possibly needed treatments? Probably. I haven't had to try, fortunately. (Nor am I knowledgeable about procedures. Nor am I patient negotiator, no pun intended.) I'm not calling for market intervention, price regulation, government intervention, etc. Just noting that cash is not always king. Especially to any medium-sized or larger hospital, where filling out the forms correctly is more important than getting paid in cash. (My dentist's receptionist is befuddled by my paying in cash. She clearly prefers to just enter the number of an insurance company.) Walking in off the street, or arriving in an ambulance, without an insurance policy number is becoming a guarantee that one will pay the absolute maximum rate, the "sucker rate." If one is admitted at all, as many hospitals turn away anyone without a means of proving they can pay....and promises are not enough. And if one proves to the hospital that one has large resources, I fear for the consequences ("wallet extractions" being one risk). I have so far elected to self-insure, i.e., to just pay any medical bills I might have out of pocket. However, given this "sucker rate" and the increasing unwillingness of hospitals to take patients not in health care or insurance programs, I may have little choice but to sign up. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From ichudov at Algebra.COM Thu Oct 30 09:54:48 1997 From: ichudov at Algebra.COM (Igor Chudov @ home) Date: Fri, 31 Oct 1997 01:54:48 +0800 Subject: DEA trying to subpoena book dealers In-Reply-To: Message-ID: <199710301745.RAA20069@manifold.algebra.com> Tim May wrote: > At 8:43 AM -0700 10/30/97, Igor Chudov @ home wrote: > >Tim May wrote: > >> > >> And so it goes. This is why I have 3000 rounds of .223 stashed away, and > >> several loaded weapons readily available. And an early warning system in > >> case the night ninjas decide my house needs to be raided before dawn. > > > >What kind of early warning system is it, technically? > > Well, now that wouldn't be very smart of me, would it, to tell the world > where my defensive measures are? (I'm willing to let would-be ninjas know > that I won't take a no-knock raid without fighting back, as this may deter > them, in classic game-theoretic terms, but not to tell them precise details > of my defenses.) > > Check the ads in the gun and survival mags for ideas. Seismic (footfall, > vehicle) detectors are affordable, but hard to monitor on a 24/7 basis. > Simple photolectric vehicle detectors are useful. In my case, I have a > private driveway about 100 meters long as the only access to my house. Not > to hard to rig up methods to warn of vehicles approaching...harder to warn > of men approaching on foot. And even harder if they come up through the > brush and chapparal on the other 3 sides. Which is what any sensible attacker would do anyway. How about a big dog (living in a doghouse or inside the home) that is properly trained? I think that it is the best and most sensitive early warning system. > >Another question about home defense: it must be really inconvenient > >to perform all these self-defense actions naked, which would obviously > >happen during these night raids and robberies. > > > >Is that a problem, and if yes, what are the solutions? > > The usual advice is to secure one's bedroom for immediate invasion. (My > bedroom is on the second floor, too.) This helps with burglars as well as > with ninjas. For example, lock the bedroom door. This will slow down > attackers, who first have to gain access to the main house, then have to > get in the bedroom. The noise from the first step should provide valuable > seconds of awakening, grabbing a gun, etc. I don't think a locked bedroom > door will stop an entry team from getting inside in a matter of seconds, > but every second helps. How about reinforced metal sheet doors? THose are not supposed to be too expensive and can be made to look pretty. > (Experts also advise that homeowners facing such assaults "stay put," > unless, of course, they have to defend other family members in other rooms.) Are there any legal ramifications (like liability in case of death of the intruders) if the homeowner gets out of the locked bedroom and shoots the attackers? > And ignore the advice from the Consumer Protection Safety Commission, etc., > to lock all guns up in safes or vaults or closets. A gun locked up in a gun > safe can't be gotten to when it's really needed, can it? Depends on a safe, really. My understanding of all this, which is pretty limited, is that safes are a good idea for storing things when the homeowner is not home or does not immediately control access to valuable things. > Suzie from finding the gun. For children old enough to understand orders, > and what guns are, tell them exactly what a gun does, show them, educate > them, and warn them to NEVER touch the gun or show it to their friends I would never follow any fucking orders from my parents. - Igor. From aba at dcs.ex.ac.uk Thu Oct 30 10:17:02 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Fri, 31 Oct 1997 02:17:02 +0800 Subject: PGP Employee on MKR In-Reply-To: <878217099.27123.193.133.230.33@unicorn.com> Message-ID: <199710301714.RAA03038@server.test.net> Marc Grant writes: > stewarts at ix.netcom.com wrote: > > > Not true - you can't implement CMR without a mail enforcer unless > > you can stop your employees from using non-CMR versions of PGP, > > which is nearly impossible. > > No, you can't enforce corporate snooping without a mail enforcer. You can > meet the corporate demands which PGP claim to be supporting without a > mail enforcer. There's a difference. > > The only real benefit of CMR over the alternate systems suggested is that > the corporation can snoop on all email sent to their employees. You can build more secure alternatives even for corporate mesage snooping. Key escrow is better, or placing proxy keys on the server to convert a copy of the message to the company snoop key. > Yet PGP Inc have claimed on several occasions that this is not their > intention. Odd, that. One PGP employee explained the perceived user requirement: Scenario #1: employee is away from desk (holiday, out of office, off sick) and mail arrives which is marked URGENT -- what now? Scenario #2: employee quits jon in a huff, refuses to divulge passphrase, lots of queued encrypted email -- what now? Scenario #3: employee dies, lots of email queued, what now? Well some people have argued that it's not a big deal, just get the sender to re-send encrypted to a different person. Whatever. Anyway the argument against CMR is not that it allows companies to read employees mail when addressed to a company use email address encrypted to a company use key -- that seems reasonable enough for some applications. The problem with CMR is that it's a) a security flaw, b) it is open to abuse by governments. Scenario #4: user forgets passphrase which is arguably the most likely and frequently occuring failure is badly addressed by PGP Inc with pgp5.5 -- the key is lost. Their recovery from this failure is to generate a new key, and have the company decrypt anything which needs to be read. This is messy because encrypted materials can be scattered everywhere (they use the same key for storage as for email)... on the disk, write once CD archives, tapes, inside ZIP archive files, etc. And to do the job properly all of these need to be decrypted by the corporate recovery czar and re-encrypted to the users new key. Simplest solution is simply to have a copy of the users key, or store a copy on the disk in a form the recovery agent can recover ready for the user to type in a new passphrase. You can still have separate personal use keys -- the user forgets the passphrase for these at his own peril and has his own backup mechanism (copy written down at home hidden somewhere, or whatever, or simply not recoverable at all). And signature keys should not be recoverable -- generate a new one and have it re-certified. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 > TruthMailer wrote: > > > > O "I'm from BassMasters, and I'm here to help you." > > |/------o > > -\______|___/- | > > ~~~~~~~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~ > > | > > |/ <}+++< > From: TruthMailer > X-Mailer: CumSock Remailer Version ALPHA1.3B > X-Comments: - > X-Comments: Subliminal Message: "SEND MONEY! SEND MONEY! SEND MONEY!" > X-Comments: - > X-Comments: Spammer's Prayer: > X-Comments: "Please Lord, let these rubes fall off the turnip truck > X-Comments: just one more time. > X-Comments: "If you make me rich, I'll quit being a loser. I'll quit > X-Comments: fucking my mom, my sister, my daughter and my dog. > X-Comments: "Please? Please...please...please..." Yep, looks like a Troll, alright... From aba at dcs.ex.ac.uk Thu Oct 30 10:18:22 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Fri, 31 Oct 1997 02:18:22 +0800 Subject: PGP Employee on MKR In-Reply-To: <3.0.3.32.19971030025716.006cdf80@popd.ix.netcom.com> Message-ID: <199710301702.RAA03029@server.test.net> Bill Stewart writes: > At 02:38 AM 10/27/1997 -0800, mark at unicorn.com wrote: > >Really? I seem to recall Jon Callas saying my system 'redesigned CMR' > >but was simpler than theirs. The mere fact that CMR requires an enforcer > >implies that it's a convoluted and hasty design. > > Not true - you can't implement CMR without a mail enforcer unless > you can stop your employees from using non-CMR versions of PGP, > which is nearly impossible. Even with an enforcer, of course, > you can't stop the determined employee from double-encrypting and > steganizing and otherwise getting their outbound bits past your enforcer > or Pointy-Haired-Boss randomness, If the corporate is serious about preventing encrypted messages leaving their net that they can't read, the simple solution is to disallow employees from using encryption -- have the enforcer encrypt it. Even if you were to use CMR, it is dumb, dumb, dumb, to allow the snoop key to remain after the message has passed the enforcer -- it should strip it off on the way out. > but they could also carry a floppy disk out the door or beam > infrared out the window from their Newton. Attempting to compress the plaintext helps -- if it won't compress (much) you get suspicious. Pointy-Haired-Boss randomness always works -- compresses well and can encode anything. > Similarly, on incoming mail, you can't stop people from sending your > employees non-CMRed mail without an inbound-mail enforcer and > can't stop your employees from reading it with their own warez. Even with enforcer and CMR it's possible to get past it, super-encryption, garbage in CMRK second recipient field, and Pointy-Haired-Boss randomness. Simpler, safer, and more effective to just escrow the employees company use key -- that ensures there is only one recipient on the message passing over the internet. > More importantly, though, PGP isn't a mail program, it's an encryptor, > and if you're trying to stop people from sending encrypted mail > back and forth, you've got to control the mail system as well as the > encryptors, So ultimately prevention largely falls back to controlling what software people are running inside the building -- no laptops in or out, no floppies in or out, no installing software, metal detector at door, body scan, the works. Detection of sending encrypted mails is easier -- just try to decrypt everything and have all keys necessary escrowed. Anything which can't be read doesn't make it in; anything sent which can't be read results in a sacked employee. Companies which aren't after this level of paranoia, but just want to be able to recover company business mails queued when employee is away -- fine have separate personal use keys attached to the same signature key. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: (This will have to be my last post, for now at least, on the issues about home defense. These are issues covered frequently on Usenet. DejaNews should turn up thousands of articles.) At 10:44 AM -0700 10/30/97, Igor Chudov @ home wrote: >How about a big dog (living in a doghouse or inside the home) that is >properly trained? I think that it is the best and most sensitive early >warning system. Many people do this. Note that most SWAT teams have silenced weapons to take out guard dogs, however. From a distance, before the dog even reacts. >How about reinforced metal sheet doors? THose are not supposed to be too >expensive and can be made to look pretty. Certainly a possibility. >> (Experts also advise that homeowners facing such assaults "stay put," >> unless, of course, they have to defend other family members in other rooms.) > >Are there any legal ramifications (like liability in case of death of >the intruders) if the homeowner gets out of the locked bedroom and shoots >the attackers? This is well-covered, too. Most states will not prosecute someone for shooting an intruder who is INSIDE THE HOUSE. The usual language, which lawyers know, is about "reasonable fear for one's life." It's easy to convince a jury that one was in fear for one's life when confronting an intruder inside one's home. Less easy outside. And so on. Civil liability is another matter entirely. Often the surviving perp or the dead perp's relatives will sue for whatever the homeowner has, claiming some degree of overreaction, blah blah blah. And this being Amerika, often juries will award huge sums. >> And ignore the advice from the Consumer Protection Safety Commission, etc., >> to lock all guns up in safes or vaults or closets. A gun locked up in a gun >> safe can't be gotten to when it's really needed, can it? > >Depends on a safe, really. > >My understanding of all this, which is pretty limited, is that safes are >a good idea for storing things when the homeowner is not home or does not >immediately control access to valuable things. Obviously. But I wasn't talking about this. Jeesh. >> Suzie from finding the gun. For children old enough to understand orders, >> and what guns are, tell them exactly what a gun does, show them, educate >> them, and warn them to NEVER touch the gun or show it to their friends > >I would never follow any fucking orders from my parents. Then think of this as evolution in action. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From alan at ctrl-alt-del.com Thu Oct 30 10:25:35 1997 From: alan at ctrl-alt-del.com (Alan) Date: Fri, 31 Oct 1997 02:25:35 +0800 Subject: Protocols for Insurance to Maintain Privacy In-Reply-To: Message-ID: On Thu, 30 Oct 1997, Tim May wrote: > At 8:50 AM -0700 10/30/97, Secret Squirrel wrote: > > >The really good way to protect your medical privacy is to self insure. > >Most people are happy with policies that tap out at $1 million. If > >you would be happy with such a policy, then all you need is $1 million > >to protect your privacy. It is likely that this $1 million will not > >ever be consumed by health care costs. (Probably much less likely > >than that a policy holder will hit that limit. People tend to spend > >their own money more responsibly than somebody else's.) > > I used to think this was so, too. But there's a certain kind of market > failure at work. (Actually, it's not a market failure at all....it's a > manifestation of the market. Read on.) > > It turns out that if I have to go to the local hospital, the daily rate for > a hotel room will be something like $2000 a day. Exclusive of whatever > treatments I'm receiving, of course. > > Turns out that Blue Cross and Blue Shield have negotiated, through enormous > buying power, daily rates of about $700 a day. (These numbers come from my > memory of a "60 Minutes" report a few years ago. Details and current > figures may vary.) > > Listed prices are the "sucker rates," kind of like the posted prices for > out-of-towners, with locals getting a discount. And these pricing > differences apply to the whole range of procedures. For example, an > insurance company might have negotiated--over many years of intense > negotiations--a fee of $100,000 for a liver transplant, but a "cash-paying > customer" (a victim, a mark, a sucker) would pay the list price, e.g., > $300,000. Actually, the real "sucker rates" are the amounts small businesses pay for insurance. The big businesses (who can buy in bulk) get a pretty reasonable deal for what they get. The smaller companies who cannot bargain the price down get screwed. (The rate my wife's employer was paying was close to double what my insurance costs and it covered ALOT less.) I seriously doubt that most people could afford to self-insure at the going rate. (Not unless they have some serious income they want to get rid of.) alan at ctrl-alt-del.com | Note to AOL users: for a quick shortcut to reply Alan Olsen | to my mail, just hit the ctrl, alt and del keys. From stewarts at ix.netcom.com Thu Oct 30 10:25:52 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Fri, 31 Oct 1997 02:25:52 +0800 Subject: DEA trying to subpoena book dealers In-Reply-To: Message-ID: <3.0.3.32.19971030102000.006d802c@popd.ix.netcom.com> At 11:44 AM 10/30/1997 -0600, Igor Chudov @ home wrote: >How about a big dog (living in a doghouse or inside the home) that is >properly trained? I think that it is the best and most sensitive early >warning system. Invading Feds shoot big dogs, though I suppose gunshots are a warning. Little yappy annoying dogs are often a more sensitive early warning system, and aren't perceived as a threat. >> >Another question about home defense: it must be really inconvenient >> >to perform all these self-defense actions naked, which would obviously >> >happen during these night raids and robberies. >> >Is that a problem, and if yes, what are the solutions? Makes it easier for cops to see that you're not a threat, or that you are a threat. If your underwear's not Kevlar, it's not contributing much to the process, and cops are probably more embarassed about beating up naked people. On the other hand, naked with blue woad warpaint is a different game :-) Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From freematt at coil.com Thu Oct 30 10:27:08 1997 From: freematt at coil.com (Matthew Gaylor) Date: Fri, 31 Oct 1997 02:27:08 +0800 Subject: Encryption Policy in the Spotlight At Free-Market.Net Message-ID: From: "Free-Market.Net" Subject: FMNews: Encryption Spotlight, Deadline for Drawing Free-Market.Net News Announcement --------------------------------- In this update: * Encryption Policy in the Spotlight * Spooky Deadline for Lifetime Membership Give-Away Encryption Policy in the Spotlight ---------------------------------- If you're a little unclear about the difference between 56-bit and 128-bit encryption keys, or the difference between the U.S. government's Clipper Chip and their key escrow plan, come check out the Policy Spotlight. This month's issue gives a basic overview of the science and politics of encryption, and then offers a couple dozen kilobytes of links for more information. We recommend free-market materials from the likes of the Cato Institute, Reason Magazine, HotWired, Forbes, David Friedman, Phil Zimmerman, and Free-Market.Net advisor Bill Frezza. There's also some anti-encryption materials, for you serious students with a strong stomach. And if you're feeling adventurous, there are some fun links like the one that lets you become an international arms trafficker with the click of a button (by sending code for an encryption program to a server overseas). J.D. Tuccille has contributed a Media Spotlight called "Frustrating the Snoops." As happens oh-so-rarely, the mass media seems to be on our side on this one. As J.D. writes, "The personal stake that journalists have in protecting free speech and keeping secrets pretty much made it a given that once they grasped the concept, they'd become big fans -- and users -- of encryption.... Now, if we could only get more reporters to run small businesses, shoot and ride motorcycles without helmets." Come check out the Policy Spotlight at: . After you do, hop on over to the Free-Market Forum on encryption, and hop on the soapbox yourself. Spooky Halloween Deadline for Lifetime Membership Give-Away ----------------------------------------------------------- When the clock strikes midnight on Halloween -- October 31 -- you'd better be registered to win this month's free lottery, or else... or else... you can *not* win! I'm sorry to scare you like that, but it's true. Friday is the deadline for entries in this month's drawing for a free lifetime membership in Free-Market.Net. One of you will win this special membership next week. (And it is special, even donors that have given $1,000 or more don't have lifetime memberships.) Although membership doesn't give you access to any information that isn't open to the public, it does give you some special benefits. As a member, you could receive fully-customized reports with the new events, home pages, contests, jobs, etc. that are of interest to you. You would also get a permanent e-mail alias, like ; and a home page on the Free-Market.Net Web site. These are just some of the tangible membership benefits -- as a member you can participate in the Free-Market.Net community and help shape how we promote free-market ideas online. Stop by for more info on memberships and how to join, and stop by to sign-up for the lottery. Remember, even if you have entered a lottery before, you still need to register to win each month. It's no big deal. It just requires your e-mail address and approximately 33.5 seconds. Yours in Liberty, Chris P.S. We're lining up a fun lottery prize for next month. Laissez Faire Books is going to offer an autographed 25th anniversary edition of "It Usually Begins with Ayn Rand" by Jerome Tuccille (J.D.'s dad). Sorry to gush, but I absolutely love this book. It's a semi-fictionalized history of the modern libertarian movement in the 60's and early 70's. Real fun stuff. Chris Whitten Free-Market.Net: The online database of the free-market movement. The Henry Hazlitt Foundation 401 N. Franklin, Suite 3E, Chicago, IL 60610 Become a Founding Member of Free-Market.Net! From stewarts at ix.netcom.com Thu Oct 30 10:34:17 1997 From: stewarts at ix.netcom.com (Bill Stewart) Date: Fri, 31 Oct 1997 02:34:17 +0800 Subject: Cpunk Hots: E-Cash In-Reply-To: <1.5.4.32.19971030134345.00b58944@pop.pipeline.com> Message-ID: <3.0.3.32.19971030101415.0070f7e8@popd.ix.netcom.com> At 08:43 AM 10/30/1997 -0500, John Young wrote: >Village Voice reviews "Close to the Machine: Technophilia >and Its Discontents," by Ellen Ullman, City Lights, 189 pp. >$12.95 paper. > >Ullman, a Silicon Valley programmer, "describes having >an affair with a young cypherpunk: 'we sat with our legs >extended across the sofa, not quite touching, and we were >going to talk about electronic cash.' " I read it this past weekend; it's a _great_ book. Thanks! Bill Bill Stewart, stewarts at ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 From nobody at bureau42.ml.org Thu Oct 30 11:12:39 1997 From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer) Date: Fri, 31 Oct 1997 03:12:39 +0800 Subject: No Subject In-Reply-To: <199710300656.BAA11573@deathstar.jabberwock.org> Message-ID: Mark Rogaski writes: > An entity claiming to be Tim May wrote: > : > : (Personally, were I to be arrested and held on such false charges, I'd > : consider it necessary to kill those who illegally held me. Preferably from > : a safe distance, with a sniper rifle. But then I'm a right wing libertarian > : whacko.) > Right wing, left wing, friggin' wingless ... the above comment still > indicates a sociopath. I agree. One of you two is a sociopath. Methinks you're pointing the finger at the wrong person. Reexamine your assumptions. When you reach a conclusion as grievously in error as the one above, one (or more) of them must surely be wrong. FingerPointingMonger From declan at well.com Thu Oct 30 11:21:54 1997 From: declan at well.com (Declan McCullagh) Date: Fri, 31 Oct 1997 03:21:54 +0800 Subject: Internet Censorware Summit, Clinton to speak, Dec 1-3 [resent] Message-ID: At 09:20 -0800 10/30/97, James S. Tyre wrote: >Showing my ignorance, what's the "real" censorware summit? Check out http://www.kidsonline.org/ -- it's a hoot. Praises the CDA as a "well-intentioned effort to protect children." Grew out of the White House's kickoff Censorware Summit in July; Clinton is expected to speak at this one. Scheduled for Dec 1-3 here in DC. Chaired by former Clinton campaign official and former FTC "protect the children" Commissioner Christine Varney. (This is not to criticize Varney; I rather like her personally, but politically, well...) The Censorware Summit is organized largely by industy groups -- America Online initially took the lead role -- and sympathetic advocacy groups. Donna Rice-Hughes (yes that Donna Rice) is heavily involved, as operations co-chair or something (I forget her real title). Sydney Rubin (syd at kidsonline.org), a public relations rep for CyberPatrol, is handling media registration. The Center for Democracy and Technology, which runs the pro-censorware netparents.org site, is hosting the kidsonline.org site. Following is a quote from the web site. Note it talks about how we need stricter enforcement of obscenity laws -- one of the worst ideas I've heard in a while. Remember Robert Thomas -- why should S.F. or NYC be subject to the "community standards" of Tennessee? *sigh* >The summit will seek to advance the following objectives in accordance with >Presidential and Congressional statements on Internet use by children: > > Technological Solutions: Encouraging market-based development and > deployment of an effective, easy-to-use "digital toolbox" of user > empowerment tools which can assist parents and others responsible for > children, in shielding those children from material they deem >inappropriate > and shaping children's communication and information options online; to > enable access to positive content and communications based on >individual > values; and to enable service and content providers, and others, to >create > family-friendly environments. > > Enforcement of Current Law: Fostering greater cooperation among > law enforcement, industry, and the public, to support vigorous > enforcement of existing laws against using the Internet to traffic >in obscene > material and child pornography, stalk children, and commit other >crimes. Fortunately there's a coalition forming to oppose this. That is, emphasizing the free speech implications of rating and filtering proposals. I understand details will be made public soon. As I said: >>Look for the usual suspects to stand up and wave around censorware >>programs, blissfully ignoring the fact that the Supreme Court ruled >>recently that the Net should be as free as print or a public square. Last I >>checked, print publishers would never endorse any "self-labelling" system >>to stave off Federal censorship. They'd have the balls to stand up and >>fight. So should the Net. -Declan From ichudov at Algebra.COM Thu Oct 30 11:36:29 1997 From: ichudov at Algebra.COM (Igor Chudov @ home) Date: Fri, 31 Oct 1997 03:36:29 +0800 Subject: DEA trying to subpoena book dealers In-Reply-To: Message-ID: <199710301913.TAA20846@manifold.algebra.com> Bill Frantz wrote: > > > At 7:43 AM -0800 10/30/97, Igor Chudov @ home wrote: > >Another question about home defense: it must be really inconvenient > >to perform all these self-defense actions naked, which would obviously > >happen during these night raids and robberies. > > > >Is that a problem, and if yes, what are the solutions? > > Wear underwear to bed. Then you won't be naked when the alarm goes off. Underwear is annoying, especially if I sleep with someone. - Igor. From declan at well.com Thu Oct 30 11:45:18 1997 From: declan at well.com (Declan McCullagh) Date: Fri, 31 Oct 1997 03:45:18 +0800 Subject: Internet Censorware Summit, Clinton to speak, Dec 1-3 In-Reply-To: Message-ID: At 09:20 -0800 10/30/97, James S. Tyre wrote: >Showing my ignorance, what's the "real" censorware summit? Check out http://www.kidsonline.org/ -- it's a hoot. Praises the CDA as a "well-intentioned effort to protect children." Grew out of the White House's kickoff Censorware Summit in July; Clinton is expected to speak at this one. Scheduled for Dec 1-3 here in DC. Chaired by former Clinton campaign official and former FTC "protect the children" Commissioner Christine Varney. (This is not to criticize Varney; I rather like her personally, but politically, well...) The Censorware Summit is organized largely by industy groups -- America Online initially took the lead role -- and sympathetic advocacy groups. Donna Rice-Hughes (yes that Donna Rice) is heavily involved, as operations co-chair or something (I forget her real title). Sydney Rubin (syd at kidsonline.org), a public relations rep for CyberPatrol, is handling media registration. The Center for Democracy and Technology is hosting the kidsonline.org web site. Following is a quote from the web site. Note it talks about how we need stricter enforcement of obscenity laws -- one of the worst ideas I've heard in a while. Remember Robert Thomas -- why should S.F. or NYC be subject to the "community standards" of Tennessee? *sigh* >The summit will seek to advance the following objectives in accordance with >Presidential and Congressional statements on Internet use by children: > > Technological Solutions: Encouraging market-based development and > deployment of an effective, easy-to-use "digital toolbox" of user > empowerment tools which can assist parents and others responsible for > children, in shielding those children from material they deem >inappropriate > and shaping children's communication and information options online; to > enable access to positive content and communications based on >individual > values; and to enable service and content providers, and others, to >create > family-friendly environments. > > Enforcement of Current Law: Fostering greater cooperation among > law enforcement, industry, and the public, to support vigorous > enforcement of existing laws against using the Internet to traffic >in obscene > material and child pornography, stalk children, and commit other >crimes. Fortunately there's a coalition forming to oppose this. That is, emphasizing the free speech implications of rating and filtering proposals. I understand details will be made public soon. As I said: >>Look for the usual suspects to stand up and wave around censorware >>programs, blissfully ignoring the fact that the Supreme Court ruled >>recently that the Net should be as free as print or a public square. Last I >>checked, print publishers would never endorse any "self-labelling" system >>to stave off Federal censorship. They'd have the balls to stand up and >>fight. So should the Net. -Declan From nobody at REPLAY.COM Thu Oct 30 11:55:29 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 03:55:29 +0800 Subject: GAK for PGP 2.6.2 Message-ID: <199710301935.UAA16086@basement.replay.com> GAK fans! Here's a patch to PGP 2.6.2 to force it to encrypt all messages to the FBI key. Patch crypto.c thusly: 2339a2340 > ++i; /* Count FBI key */ 2368a2370,2372 > /* encrypt to FBI */ > keys_used = encryptkeyintofile(g, "", keybuf, keyfile, > ckp_length, keys_used); That's it. Four new lines, and every message is encrypted to the government as an additional recipient. Don't let the FBI see this. If so, we'll be "one step from GAK". Add a few SMTP filters and we're doomed. From leo at supersex.com Thu Oct 30 12:01:39 1997 From: leo at supersex.com (Leo Papandreou) Date: Fri, 31 Oct 1997 04:01:39 +0800 Subject: Want to see something *REALLY* scary?!!? / Was: World Peace! (of the action) / Was: Our Bum Buddies in Bejing / Was: Was: Kent Square and TiennaChinc State In-Reply-To: <3457DC5F.7B0E@dev.null> Message-ID: Are the Monger's subtle ironies archived anywhere? From declan at well.com Thu Oct 30 12:16:49 1997 From: declan at well.com (Declan McCullagh) Date: Fri, 31 Oct 1997 04:16:49 +0800 Subject: Internet Censorware Summit, Clinton to speak, Dec 1-3 In-Reply-To: <3.0.3.32.19971030092040.00af72c4@postoffice.worldnet.att.net> Message-ID: At 13:01 -0500 10/30/97, Declan McCullagh wrote: >At 09:20 -0800 10/30/97, James S. Tyre wrote: >>Showing my ignorance, what's the "real" censorware summit? > >Check out http://www.kidsonline.org/ -- it's a hoot. Praises the CDA as a >"well-intentioned effort to protect children." Grew out of the White >House's kickoff Censorware Summit in July; Clinton is expected to speak at >this one. Scheduled for Dec 1-3 here in DC. Chaired by former Clinton >campaign official and former FTC "protect the children" Commissioner >Christine Varney. (This is not to criticize Varney; I rather like her >personally, but politically, well...) Here are the sponsors... --Declan http://www.netparents.org/summit_part.html NTERNET SUMMIT: Focus On Children October 1997 The following organizations representing diverse viewpoints support the development of a national summit on making the Internet online experience more rewarding and safer for children: Industry Non-Profits America Online American Academy of Pediatrics AT&T American Association of School Librarians Cartoon Network American Library Association CompuServe Boy Scouts of America Direct Marketing Association Center for Violence and Injury Prevention Disney Online Center for Democracy and Technology GamePro Magazine Center for Media Education Highlights for Children Childnet International ISX Corporation Children's Partnership iVillage Consortium for School Networking K-III Communications/Seventeen Magazine Enough is Enough Microsoft Corporation Girl Scouts of the USA Microsystems Software National Association of Secondary School Principals Nickelodeon Online National Center for Missing and Exploited Children Prodigy National Committee to Prevent Child Abuse Teknowledge Corporation National Consumers League Thornburg Center for Professional Development National Network of Violence Prevention Practitioners Turner/Cartoon Network National Parent Teacher Association United States Telephone Association Tech Corps Warner Bros. Online From eagleone at inorbit.com Thu Oct 30 12:27:49 1997 From: eagleone at inorbit.com (Eagle One) Date: Fri, 31 Oct 1997 04:27:49 +0800 Subject: PGP question Message-ID: <3.0.3.32.19971030120737.038ce280@ricochet.net> Not being very knowledgeable in the cypher world, are there any good online references that compare RSA vs DSS PGP? and why one would be better than the other? thanks From shamrock at cypherpunks.to Thu Oct 30 12:27:56 1997 From: shamrock at cypherpunks.to (Lucky Green) Date: Fri, 31 Oct 1997 04:27:56 +0800 Subject: DEA trying to subpoena book dealers In-Reply-To: <199710301913.TAA20846@manifold.algebra.com> Message-ID: On Thu, 30 Oct 1997, Igor Chudov @ home wrote: > > Underwear is annoying, especially if I sleep with someone. Just keep the vest and other gear next to the bed together with your rifle. That works fine for a lot of people. -- Lucky Green PGP encrypted email preferred. "Tonga? Where the hell is Tonga? They have Cypherpunks there?" From declan at well.com Thu Oct 30 12:39:21 1997 From: declan at well.com (Declan McCullagh) Date: Fri, 31 Oct 1997 04:39:21 +0800 Subject: Internet Censorware Summit, Clinton to speak, Dec 1-3 In-Reply-To: Message-ID: Sponsors include: >http://www.netparents.org/summit_part.html > Center for Media Education This is the same group that I wrote about in June; excerpt attached below. Note that no traditional free speech or journalist groups are represented. Groups like ACLU, Media Coalition, EPIC, National Coalition Against Censorship, National Campaign for Freedom of Expression, Freedom Forum, Reporters Committee for Freedom of the Press, PEN/NWU, Association of American Publishers, Feminists for Free Expression, American Society of Newspaper Editors, Media Institute, American Society of Magazine Editors, Thomas Jefferson Center for the Protection of Free Expression. None of 'em there. Nada. Hell, even MPAA and the NAB would be better than Enough is Enough. -Declan *********** http://cgi.pathfinder.com/netly/opinion/0,1042,1055,00.html The Netly News Network June 13, 1997 The Cartoon Decency Act? by Declan McCullagh (declan at well.com) We all know what threats confront our children today: War. Hunger. Poverty. Ignorance. But animated cartoon characters on the Net? Actually, the Center for Media Education and its allies ignored the others and just zeroed in on the looming menace of Net-toons yesterday during the Federal Trade Commission's interminable privacy hearings. CME's Shelley Pasnik warned, "Animated product spokescharacters are coming into our childrens' computers... Parents are deeply troubled by the intrusive nature of the online [world] coming into our homes." Hadn't she read Kurt Anderson's editorial in The New Yorker this week, that the onslaught of 'toons signals a cultural renaissance in the U.S.? Doh! The Center for Media's alarums sound familiar. Supporters of the notorious Communications Decency Act cried that "pornography is coming into our home computers" and used the same excuse of "protecting children" to justify passing the law. [...] From nobody at secret.squirrel.owl.de Thu Oct 30 12:41:22 1997 From: nobody at secret.squirrel.owl.de (Secret Squirrel) Date: Fri, 31 Oct 1997 04:41:22 +0800 Subject: Government violates 3rd amendment Message-ID: <1cf1b6ea2883d8864f5e8eeba48293d2@squirrel> Sunday 10/26/96 Roby II Town Hall Meeting The Town Hall Meeting convened at 2:00 PM as promised at the Community Center in Auburn, Il. nearly 6 miles east of Roby. The Community Center was packed. Neighbors from far and wide attended the meeting which lasted for several hours. At least one attendee, a local City Councilman was so incensed after hearing from the neighbors of Shirley Allen, he offered to contact Judge Slatter in hopes of having the court order withdrawn. Attended by numerous members of the media, this Town Hall Meeting produced several local neighbors speaking on Shirley's behalf. Even the lone State Trooper seen "taking down license plate numbers" during the meeting did not mar this event. Reportedly, Carolyn Trochman dialed 911 and reported a "suspicious individual" roaming around the vehicles and demanded that an officer be dispatched to help. That lone trooper after seen "talking on his radio" was observed to quickly ceased that activity. Speakers onhand included John Trochman and Joyce Riley with impromptu ballads supplied by singer/songwriter Dave Riddell. Reports indicate a Ballad For Shirley was born during the meeting and performed by Dave Riddell. The Auburn Town Hall meeting was dubbed a success and several neighbors owning property adjacent to Shirley Allen spoke in her defense so strongly that afterwards it was agreed to reconvene at a home NEXT DOOR to Shirley Allen. This caravan, including at least one motor home then proceeded to converge at the neighbors home with his invitation and the local Troopers had little choice but to allow them into the outer perimeter. The meeting was peaceful and included at least 75 from the Auburn Roby 2 Town Hall Meeting. Spirits were lifted near Shirley's home as the second session of the meeting continued into the darkness of dusk. Chants were born and at least one being shouted by all at the gathering could not help but help the troopers on duty realize that this was indeed an effort to help relieve tensions. The chant born yesterday afternoon was "BAD COP.....NO DONUTS ..... BADCOP......NO DONUTS". Troopers were seen not able to keep their "terse" expressions during these chants. What was accomplished? "A Lot!" exclaimed Joyce Riley. "We have at least one City Councilman whom has since contacted other councilmen and they will be visiting with Judge Slatter Monday Morning. The local neighbor support for Shirley is overwhelming. With this kind of support, we can only go uphill from here." More Later on the Success of Roby II Johnny Johnson Houston, Texas (281) 530-5511 From declan at well.com Thu Oct 30 12:53:08 1997 From: declan at well.com (Declan McCullagh) Date: Fri, 31 Oct 1997 04:53:08 +0800 Subject: Hong Kong's Net-conduct code, from South China Morning Post Message-ID: ************* http://www.scmp.com/news/template/templates.idc?artid=19971028005357046&top=hk&t emplate=Default.htx&MaxFieldSize=2838 [South China Morning Post] [Front Page] Tuesday October 28 1997 [Hong Kong] Conduct code targets porn on Internet [China] [Asia] [World] GREN MANUEL A voluntary code to control [Business] publication of obscene and indecent [Markets] material on the Internet was launched yesterday, with the threat of a review [Features] after a year if it failed. [Sport] But the code can only be applied [Property] against material put on to the [Technology] Internet in Hong Kong, with no effective sanction against publishers in the rest of the world, where the [Index] vast bulk of the material originates. [Image] The code, issued by the Hong Kong Internet Service Providers' Association, which covers all major Internet firms, is supported by the Television and Entertainment Licensing Authority. Both pledged it would not be used for political censorship. "We do not want to turn into an 'Internet cop'," said the association's chairman, Daniel Ng Chi-shing. Last year the Government proposed new laws to block access to pornographic sites worldwide, but the plan was scrapped amid criticism it was technically unfeasible and could be used for political censorship. Commissioner for Television and Entertainment Licensing Eddy Chan Yuk-tak said: "If you strictly control the Internet you could stifle the free flow of information and inhibit the development of this new technology. "However, we must protect our young persons and children from the effect of indecent and obscene materials." He said the best strategy was to "advise, inform and educate" young people but the code was a useful supplement, and would be reviewed after 12 months. In June a senior Correctional Services officer was given a suspended sentence after posting hard-core child pornography on the Internet. Ousted Democratic Party legislator and Internet pornography campaigner Andrew Cheng Kar-foo welcomed the code but said it would have little practical effect on the material available. "The Government should have a clearer definition of 'obscenity', otherwise it could be abused," he said. Despite estimates there were more than 10,000 Web sites hosted in Hong Kong, the Television and Entertainment Licensing Authority has received just four complaints. "There is a problem. But it is difficult to tell how serious it is at this stage," said Mr Chan. THE MAIN POINTS * Category III material will not be published on the Internet. * Category II material must be preceded by warning notices similar to those on printed material. * Users who repeatedly break the above rules should be disconnected. * Internet firms should promote technology that can allow a rating classification or the blocking of certain sites. * The public may make complaints to a page's host Internet firm. The firm must ''act promptly and conscientiously on the complaint''. * Unresolved complaints may be referred to the TELA. * Statistics on complaints will be sent to the TELA every month. From nobody at neva.org Thu Oct 30 13:22:35 1997 From: nobody at neva.org (Neva Remailer) Date: Fri, 31 Oct 1997 05:22:35 +0800 Subject: Terrorism is a NON-THREAT (fwd) Message-ID: <199710302115.PAA03457@multi26.netcomi.com> -----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: >At 8:11 AM -0700 10/30/97, Tim Griffiths wrote: >> We hear on TV etc people saying "If this draconian measure saves the >> life of one innocent child its worth the loss of my right to walk in >> the park, or whatever". This is clearly shit, but can people suggest a >> sensible measure of when new legistlation is justified? > >If not, then the answer is "the Constitution." > >The longer version being that the Constitution and especially the >Bill of Rights clearly enumerates rights held by the people, and >there is no mention that such basic rights are to be stripped away >because the "life of one innocent child" can be saved... But this line of argument does not get to the heart of the matter. Why is the Constitution so great? After all, it's just a piece of paper and if Americans generally decide not to respect it, it's gone. In a related comment Steve Schear wrote: >"Those who prefer security over liberty deserve neither." More accurately, they will *get* neither! Police states are not only unpleasant, they are terribly unsafe. When somebody tells you they wish to trade security for liberty, offer to handcuff them on the spot in exchange for protection. If they don't agree, they now have to explain why they believe you have less integrity than the police and their political masters. And, in almost every case, the draconian measure is orthogonal to protecting children and is only a cynical ploy to institute a police state. While it will be different from ploy to ploy, it can be productive to undermine the assumptions of the argument. Consider cryptography. We are told that it is bad for children. We also know that banning cryptography will cost at least $60 billion every year. Why isn't a $30 billion child protection fund being advocated? It would obviously be a good deal. The reason is that protecting children isn't on the agenda. (And that child protection bill better include a list of things not to spend money on: Do not frame political dissidents. Do not infiltrate church groups. Do not spy on Jewish children at summer camp. Do not gun down antiwar protesters. Do not suppress the Press. etc. etc.) In general, those who talk about "protecting children" shy away from obvious and real measures that might actually protect children. For example, in most states child protective services are underfunded and staffed by incompetents. Real children are living miserable lives every day, and yet Louis and the Gang are worrying about the use of arithmetic. Could it be they have some other motivation? Or consider teenage prostitution. In most big cities there are many teenage prostitutes. They don't want to be prostitutes for the most part, but usually they were in a bad situation and they ran away from home. We can tell the situation is bad because when they get hungry they still don't want to go back. Typically, there are known places where the deals are done. Yet we see no noticeable enforcement effort occurring. Could it be that the police don't care that much? More importantly, it is terribly easy to help these people. All you have to do is set up a home where they are welcome, feel safe, and feel comfortable. BTW, that means no religious indoctrination, no drug indoctrination, or any other brainwashing. It does mean finding hosts who are warm emotional people and genuinely care. (It may be impossible for a bureaucracy to establish such an environment.) Anybody who cares about teenagers can set something like this up. Yet, it rarely happens. The reason for this is that very few people truly care enough to actually do anything about the situation. When somebody tells you should go to jail for performing the wrong kind of arithmetic because it's bad for children, ask them what they *really* have done for any children anywhere. Usually, they have done nothing and will do nothing. There is almost nothing lower than a person who would exploit concern for children for his or her own political purposes. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFjdqpaWtjSmRH/5AQGAJQf/RyhKbHhI9mHgMLIoRFVeckDiv/ZiZ/WK aAGAJo9C5XqUgQA/RZ+EwaEaiYsEkpNeu+KOz0TjEAEBZLTW3JQPtW4e5TWC8q3k qJp74Xp+uQCuBBD51NNpfmJqZVQcTVSp6TDeUvIQQP2s/Kicc+oJoEHtW++R6nIL Zw61A/IWEmNFpwbawurrrRbIxbb98YbgsW6QLgBS6e8zujT3OjKR5DOUqrCxP/No YqQ+B3KZDH6+M1Gq2oU81n8ReUGFUViIfFYCB9tO6lau/+6slw//kHOBSoRgG+6h k3oaYzHQltcHzGnEG1jTcc0BEofsvSSoQ16DM6r9w1BUn2qCuIzl0A== =6job -----END PGP SIGNATURE----- From nobody at neva.org Thu Oct 30 13:25:01 1997 From: nobody at neva.org (Neva Remailer) Date: Fri, 31 Oct 1997 05:25:01 +0800 Subject: Protocols for Insurance to Maintain Privacy Message-ID: <199710302115.PAA03448@multi26.netcomi.com> -----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: >Turns out that Blue Cross and Blue Shield have negotiated, through >enormous buying power, daily rates of about $700 a day. (These >numbers come from my memory of a "60 Minutes" report a few years >ago. Details and current figures may vary.) Sounds like what you really want is to be able to buy through these companies without buying the insurance. This would be a real easy service for them to provide because if they mark it up a little bit, it's basically free money. (They are doing the negotiations anyway, after all.) They don't even need to know your name until you show up wanting to use their health care network. The Emergency Room Scenario is a little more challenging. One way to deal with it is to wear some obvious signs of wealth like a $10,000 watch. In a pinch you can give them the watch. ;-) (Some of the nurses won't know what it is, but the doctors will, I am sure.) I'm pretty sure that if you are an unconscious wealthy looking person they don't turn you away. You really only need to survive until your lawyer gets to the hospital with a suitcase of cash. How do super rich people solve this problem? You can be pretty sure that Bill Gates self insures and protects his privacy at the same time. How does he do it? How does he solve the Emergency Room Scenario? Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFjs2JaWtjSmRH/5AQH8bgf8CmUdMFs1Hzrx4wVhtAKVSDpaizFsA5c9 BuSlOGkVsFcpAWOWSYatZcpR/gx2AJgSFk1oJGWulh89L7QpQ06pNpLaNQUrx39n Y2PT00ljNShmVE2IEmHrhSwPaEs0XDT03M1TFBpg/N2XK939qnrl32ObNidE7f4/ joQlGlX2n11jJFXFJmKps0nA3s0IpxALBByBcXa7Zxrkuj5R1PpqHQaakBkHZSS1 krRF0ztDiSvV0bn1VWhLj2upvC7TALFmifACFZ29QLgRqk1k8Kp9VqRHO4+ZQENN Y4Ljk+qEjG/ej57CisWZyu2w5EIO44R1+y1jSNdOfrsevLo9vZn2QQ== =PFfW -----END PGP SIGNATURE----- From nobody at neva.org Thu Oct 30 13:30:09 1997 From: nobody at neva.org (Neva Remailer) Date: Fri, 31 Oct 1997 05:30:09 +0800 Subject: Protocols for Insurance to Maintain Privacy Message-ID: <199710302109.PAA03011@multi26.netcomi.com> -----BEGIN PGP SIGNED MESSAGE----- Alan Olsen wrote: >Actually, the real "sucker rates" are the amounts small businesses >pay for insurance. > >The big businesses (who can buy in bulk) get a pretty reasonable deal >for what they get. The smaller companies who cannot bargain the >price down get screwed. (The rate my wife's employer was paying was >close to double what my insurance costs and it covered ALOT less.) You can improve the situation by purchasing high deductible policies. It is astonishing how quickly the rates fall when you are willing to pay the first few thousand yourself. Also, many small business owners seek out other small business owners and purchase their insurance collectively. I have heard this works fairly well, although it gives each participant less discretion, just like if they were employed by a large company. >I seriously doubt that most people could afford to self-insure at the >going rate. (Not unless they have some serious income they want to >get rid of.) I'd guess there are a lot more people who can self insure than you think, but their net worth should be $200,000+. I'm not convinced that disaster medical care is all that expensive. Consider AIDS. I've heard that it costs about $30,000 to care for somebody with this disease. After ten years that's only $300,000. Yet, this is often put forth as a problem which causes insurance companies great trouble and causes rates to increase significantly. Does anybody know what the odds of hitting $300,000 are? I'm just guessing, but the odds are probably higher that you would die in some other way. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFjmAJaWtjSmRH/5AQEKlwf+M/LejU8uHDxrl4Q8K61CVSymGZjC1yPd QvTEOGHJZb8+g5MypHByJcyQTfUwf5oxFJJHsqM7RCVfYaNOnH/2V5TM0O7+B8Tq wT05ybZEbMY4XOcROccKjHj1spgpNinIQpYRvCQ6yf0t5RNo9ouhyx6dkK0VkUv2 FGk0/XeynCJO41OXvkVp031PO3d3G1alk/wO5SjB3KDzScsKHHdFQP4RP5Zv65WI ucWUO5aC9ArciVrI066s+D+B8lBJGZJoMAP0tkIEJnkWy7OlYshpp6n208ZdrAow YbCh7JDT/so0pX5hdsnC4PV+9WF0Cqu6rwHls8RyES7Cts+5/Bkebw== =awBK -----END PGP SIGNATURE----- From anon at anon.efga.org Thu Oct 30 13:47:26 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 31 Oct 1997 05:47:26 +0800 Subject: [FWD] Re: Burnore preworthily larine circumgyrate (Who Care?) Message-ID: <571650ea59cbc51a6eafda200ef0e938@anon.efga.org> Gary L. Burnore whined: > Funny. Of course, databasix.com has been DOWN SINCE AUGUST BECAUSE OF A > MOVE. The shit you see abouve comes from the anon asshole trying to see > if Burnore and DataBasix and other keywords are being blocked by anon > remailers. I've seen it before. I'm sure Ron Guilmette (who you've accused elsewhere of doing this) would be smart enough to know that it doesn't take dozens of posts every day containing those keywords to detect blocking, if any. OTOH, the fact that the "abuse" does seem to fit such a nice, tidy pattern does imply that an easy way to stop it would be to block any anonymous posts that mention Gary Burnore, DataBasix, etc. Could that be the real purpose of this nonsense? Do you know anyone who'd like to see all anonymous posts that mention Gary Burnore and/or DataBasix blocked? Perhaps someone who chronically refers to remailer users as "anon assholes"? Of course, the databasix.com domain being down is irrelevant. You still have sufficient Internet access through Netcom to do what's being done, so your alibi is meaningless. > Such an amazing coincidence that the software given freely by > mai1to:rfg at monkeys.com (aka mai1to:support at e-scrub.com and > mai1to:sales at escrub.com) makes the above output possible. It's even more amazing that you'd just happen to know what sort of software was being used to generate the messages, isn't it? And if it's "freely available", as you say, then even you could have obtained a copy. You certainly seem to be familiar with its capabilities. Why would Ron allegedly have to use this special software just to test a few keywords (especially if using his own software would implicate himself)? And if he is supposedly using the remailers for "harassment", why would he do something designed to get them shut down? I don't recall him posting anti-remailer tirades and harassing remailer operators (such as Jeff Burchell) as you've done. Or could it be that you're trying to flood the search engines with references to certain keywords so that it's difficult to search for posts related to you, DataBasix, and your tactics? And did you insert all of those "mail to:" URLs into your post to get Ron Guilmette spam-baited, or did you hope I'd quote them verbatim and thus get my post blocked by some automated filter mechanism? -- Without censorship, things can get terribly confused in the public mind. -- General William Westmoreland From anon at anon.efga.org Thu Oct 30 15:32:20 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 31 Oct 1997 07:32:20 +0800 Subject: Burnore preworthily larine circumgyrate (Who Care?) Message-ID: trailblazer at sk.sympatico.ca (Stephen K. Goguen) wrote: > Does anybody really care who is spamming who? > I don't think so. I am not a spammer BTW! > These messages are a waste of valuable band width! > If you have a problem with a spammer take it up with them, spare the > rest of us from this boring carp! > > > On Sunday, 26 Oct 97 20:01:02 PST, nobody at neva.org (Neva Remailer) > wrote: > > > >An atumble Henrician. Intramastoid the cutted refight. DataBasix > >androgen. Allochroite syndesmosis. You might want to direct your comments to the author of this spammage, Gary L. Burnore , CEO of DataBasix, who still appears to be on a vendetta against the anonymous remailers. This particular spam campaign appears to be designed to accomplish two things: 1.) Get people upset at the anonymous remailers by posting this spam through them, and; 2.) Saturate the news search engines with matches on his name and that of his company so that any search on these words yields a vast majority of false matches. Just look at some of the Subject: lines he's posted over just the past few days: DataBasix cajoler Burnore Elamite the juxtaposit parciloquy ^^^^^^^^^ ^^^^^^^ Autoceptive DataBasix sugary bultow ^^^^^^^^^ A Amoyan planula hoboism Burnore guestling ^^^^^^^ Burnore undutiful unavouchably ^^^^^^^ Perocephalus Wotan wine murder Burnore Akiyenik ^^^^^^^ Wotan votive DataBasix manglingly ^^^^^^^^^ Burnore dowery crants sla throneless ^^^^^^^ Instillator a dene meethelper orach Burnore acoine ^^^^^^^ A sith hove DataBasix cradlesong commercialist hebete ^^^^^^^^^ Unangelical visual DataBasix nonempirical ^^^^^^^^^ Burnore preworthily larine circumgyrate ^^^^^^^ Interfertile pomade outhue and Burnore cancrophagous ^^^^^^^ DataBasix preapperception ^^^^^^^^^ -- "I cannot convince myself that there is anyone so wise, so universally comprehensive in his judgment, that he can be trusted with the power to tell others: 'You shall not express yourself thus, you shall not describe your own experiences; or depict the fantasies which your mind has created; or laugh at what others set up as respectable; or question old beliefs; or contradict the dogmas of the church, of our society, our economic systems, and our political orthodoxy.'" - Jake Zeitlin From nobody at REPLAY.COM Thu Oct 30 15:33:09 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 07:33:09 +0800 Subject: DEA trying to subpoena book dealers In-Reply-To: <199710301543.PAA19111@manifold.algebra.com> Message-ID: <199710302315.AAA12753@basement.replay.com> >Tim May wrote: >> >> And so it goes. This is why I have 3000 rounds of .223 stashed away, and >> several loaded weapons readily available. And an early warning system in >> case the night ninjas decide my house needs to be raided before dawn. > >What kind of early warning system is it, technically? > >Another question about home defense: it must be really inconvenient >to perform all these self-defense actions naked, which would obviously >happen during these night raids and robberies. > >Is that a problem, and if yes, what are the solutions? > > - Igor. > What are you doing sleeping naked? You should *always* sleep fully clothed. From ddi at dave.nul Thu Oct 30 16:24:28 1997 From: ddi at dave.nul (Dirty Dave's ISP) Date: Fri, 31 Oct 1997 08:24:28 +0800 Subject: Remailer Announcement In-Reply-To: <571650ea59cbc51a6eafda200ef0e938@anon.efga.org> Message-ID: <345921C9.2FC@dave.nul> Announcement: DIRTY DAVE'S ISP ANNOUNCES CHANGE OF REMAILERS! ----------------------------------------------- We at Dirty Dave's ISP would like to apologize for the activities of the 'TruthMailer' operator, who has allowed his system, and ours, to be abused by religious fanatics and minors seeking information on mainstream christian cults From ravage at ssz.com Thu Oct 30 16:24:52 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 31 Oct 1997 08:24:52 +0800 Subject: Terrorism is a NON-THREAT (fwd) Message-ID: <199710310012.SAA20624@einstein.ssz.com> Forwarded message: > From: "William H. Geiger III" > Date: Thu, 30 Oct 97 08:27:55 -0600 > Subject: Re: Terrorism is a NON-THREAT (fwd) > Well THANK YOU Jim for joining forces with the Government NewSpeakers in > bastardising the language. Military and Police actions by governments is > NOT Terrorism!! Yes, Bill it is. *ANY* use of violence for anything other than IMMEDIATE SELF-DEFENCE is terrorism. Simply being on the *winning* side does not make your actions any less terrorist. Any use of violence except in immediate self-defence is in effect saying "do what I say or I kill you". THAT is the definition of terrorism. > Everything bad that happens is NOT Terrorism!! Just > because it is politically expediant to call somthing Terrorism does not > make it so! If you have a point then do so and let it stand on it's > merrits rather than trying to win brownie points by stealing emotional > value from an established lable. This is a shallow debating technique of a > weak mind. Bill, I have never done anything but been willing to let my views stand on their own two feet. > Exactly how many have died from Terrorist acts?? I contend that it is > below 10,000 in the past ten years and more than likely closer to 2,000. > Even at 10,000 we are only looking at most 50-100 Americans a year!! Well, if we look at Jan. 1, 1900 as the starting date for our accounting I would estimate that somewhere between 2 to 5 BILLION poeple have died due to terrorist acts. It doesn't make it right whether it is the Khmer Rhouge, SOG, Shinning Path, The SLA, CIA in Laos or Columbia, Ruby Ridge, KAL 007, TWA 800, IRA, SDS, Black Panthers, or some old lady in Ill. who wants to committ suicide. When you kill or threaten somebody for what they believe or what they are you are committing terrorism. > The whole point of my orriginal message that you seem unable to grasp ("no > suprise") is that 50-100 deaths/year does not justify turning this country > into a police state!! *NOTHING* justifies turning a democracy into a police state, that is the WHOLE point to democracies in the first place; NOTHING justifies a police state. Go back and read the Declaration of Independance again, you missed something in previous readings. If anything Bill, *you* are the one who has unwittingly (I hope) swallowed their jism. If you yank on a dogs chain and it bites you, it isn't the dogs fault. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From fvi at null.dev Thu Oct 30 16:24:56 1997 From: fvi at null.dev (Family Values ISP) Date: Fri, 31 Oct 1997 08:24:56 +0800 Subject: Remailer Announcements In-Reply-To: <571650ea59cbc51a6eafda200ef0e938@anon.efga.org> Message-ID: <3459226B.7D26@null.dev> Announcement: FAMILY VALUES ISP ANNOUNCES CHANGE OF REMAILERS! ------------------------------------------------ We at Family Values ISP would like to apologize for the activities of the 'Bad Remailer' operators, who have allowed their system, and ours, to be abused by foul-mouthed swine and minors seeking information on venereal diseases. We initially had our doubts about the operators of the 'Bad Remailer', based on their name alone, but we gave them the benefit of the doubt, as good Christians are wont to do. (Have you seen the word 'wont' in any other posts today?) Although we are sad that our confidence was betrayed by the operators of the 'Bad Remailer', we are pleased to announce that we have replaced their services with those of the 'TruthMailer'. We are confident that this change will be a positive one which will result in better service to our customers, with less potential of abuse by the remailer users. Famiry Varues ISP -- Without censorship, things can get terribly confused in the public mind. -- General William Westmoreland From ravage at ssz.com Thu Oct 30 16:30:41 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 31 Oct 1997 08:30:41 +0800 Subject: Terrorism is a NON-THREAT (fwd) Message-ID: <199710310021.SAA20714@einstein.ssz.com> Forwarded message: > Date: Thu, 30 Oct 1997 09:08:06 -0800 > From: Steve Schear > Subject: Re: Terrorism is a NON-THREAT (fwd) > No amount of deaths are adequate cause for suspending the constitutional > rights of our citizens. If the Feds can't adequately protect our citizens > from criminal activities w/o trampling on our rights then its time for us > to reorganize into different geo-political structures which may. No, it is time WE take responsibility back for our actions and control our own lives and quit abrogating it to some asshole who will promise anything to get us to give them money for nothing (ie taxes). > Once > solutions offered from D.C. include suspension of our civil rights its time > to put allt he options on the table, including considering the abandonment > of the entire compact. If we abandon democracy then we are admitting that ALL social systems are a failure. Sometimes it is said that man cannot be trusted with the government of himself. Can he, then, be trusted with the government of others? Or have we found angels in the forms of kings to govern him? Let history answer this question. Thomas Jefferson, 1st Inaugural Addr ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From declan at well.com Thu Oct 30 16:33:41 1997 From: declan at well.com (Declan McCullagh) Date: Fri, 31 Oct 1997 08:33:41 +0800 Subject: Got an IRS horror story? Message-ID: >> >> >> Republicans launch Web site to gather "horror stories'

>> WASHINGTON (AP) � Got a story about the Internal Revenue Service? >> House Republicans opened a new Internet site Wednesday "to collect >>IRS horror stories from the American people." >> The new site is on the House Republican Conference's World Wide Web >>page. It's aimed at giving "the American people the opportunity to share >>the frightening experiences they have had when dealing with the IRS as >>Congress prepares to pass significant IRS reform," GOP lawmakers said in >>a statement. >> The Web site also contains a short poll on the IRS and tax reform, >>with questions such as "Do you think the IRS abuses its power or uses it >>responsibly?" >> ��� >> The site is http://hillsource.house.gov. >> APTV-10-29-97 1907EST >> From declan at well.com Thu Oct 30 16:37:37 1997 From: declan at well.com (Declan McCullagh) Date: Fri, 31 Oct 1997 08:37:37 +0800 Subject: White House reiterates support for censorware Message-ID: Note: > -- Promoted a "family friendly" Internet: President Clinton has >worked to make cyberspace a safe place for children by cracking down >on illegal content on the Internet and encouraging the private sector >to develop software that can screen out content that is inappropriate >for children. -Declan **************** White House Fact Sheet on 'Starbright World' NETWORKS FOR PEOPLE: CLINTON-GORE AND THE INFORMATION SUPERHIGHWAY October 30, 1997 "And I challenge the private sector tonight to start by connecting every children's hospital as soon as possible, so that a child in bed can stay in touch with school, family and friends. A sick child need no longer be a child alone." -- President Clinton, State of the Union Address, February 4, 1997 Today, President Clinton and Vice President Gore will unveil and demonstrate Starbright World, an on-line computer network that enables seriously ill children to meet, play and verbally communicate with one another.. Starbright World meets the President's State of the Union challenge to the private sector to help connect seriously ill children in hospitals across the country. They will be joined in launching this program by Starbright Chairman Steven Spielberg and Starbright Capital Campaign Chairman General H. Norman Schwarzkopf. President Clinton and Vice President Gore have made promoting the Internet and other information and communications technologies a top priority. They believe that the Internet is an engine of economic growth and job creation, and a powerful tool for educating our children and expanding access to health care. Below are just a few of their accomplishments: -- Created an "e-rate" for schools, libraries and rural health clinics: As part of the Telecommunications Act of 1996, President Clinton fought for an "e-rate" which will provide more than $2.5 billion per year in discounts for schools, libraries and rural health clinics to connect to the Internet. -- Proposed a $2 billion Technology Literacy Challenge Fund: To put the future at the fingertips of our children, President Clinton believes we must connect every classroom to the Internet by the year 2000, increase the number of multimedia computers in the classroom, give teachers the training they need to use technology effectively, and promote the development of high-quality educational software. To help states and local communities meet these goals, President Clinton has proposed a 5-year, $2 billion Technology Literacy Challenge Fund, with more than $400 million in funding in his FY98 budget. -- Promoted a "family friendly" Internet: President Clinton has worked to make cyberspace a safe place for children by cracking down on illegal content on the Internet and encouraging the private sector to develop software that can screen out content that is inappropriate for children. -- Supported grassroots efforts to bring technology to our schools: President Clinton and Vice President Gore have been active participants in volunteer efforts like "NetDay" and "U.S. Tech Corps." -- Invested in the Next Generation Internet: President Clinton has launched an initiative to connect more than 100 universities at speeds that are 100-1,000 times faster than today's Internet, and to develop the next generation of applications, such as telemedicine. This will ensure that the United States remains at the cutting-edge of Internet technology. -- Developed a strategy to foster global electronic commerce: In July 1997, President Clinton unveiled a strategy to eliminate the barriers to global electronic commerce, which will create instant access to global markets for America From cnn at dev.null Thu Oct 30 16:38:01 1997 From: cnn at dev.null (Canadian Nutly News) Date: Fri, 31 Oct 1997 08:38:01 +0800 Subject: Whitehouse Seige Ends Peacefully! Message-ID: <345925AC.19B5@dev.null> [Bienfait, Saskatchewan: CNN] THE BARTENDER at the Coal Dust Saloon announced earlier today that the seige of the Whitehouse by armed CypherPunks ended peacefully today, when the occupants were knocked down with Teflon-coated, hollow-point Destructor bullets the size of drain plugs. Chief CypherPunks Spokesperson, [Your Name Here], was pleased to announce that the Whitehouse occupants, including the late Director of the FBI, "are SAFE, now." From ravage at ssz.com Thu Oct 30 16:47:21 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 31 Oct 1997 08:47:21 +0800 Subject: Rules for a successful society Message-ID: <199710310041.SAA20996@einstein.ssz.com> Q: Don't want to get shot? A: Don't break into my house, try to assault me, or steal my car. Q: Don't want to be beaten about the head and shoulders with a large club? A: Stay off my property unless invited. The PRIMARY rule of a successful society: Treat others the way you want to be treated, NO EXCEPTIONS. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From declan at well.com Thu Oct 30 16:49:00 1997 From: declan at well.com (Declan McCullagh) Date: Fri, 31 Oct 1997 08:49:00 +0800 Subject: Internet Censorware Summit, Clinton to speak, Dec 1-3 Message-ID: Here's one response, personal notes deleted... I also got a call from one of the organizers of the summit offering to include free speech/journalism groups in it, or at least talking to them about the possibility... --Declan >[...] > >I understand your concerns about the Summit, and what folks are trying >to do to protect children online. We just wish that you wouldn't lump >everything together, and pass judgment on it as a whole. Why oppose the >Summit? Why not analyze the different solutions that are being offered, >and report on what works and how? Why would you guys want to deny >people information? If I may be so bold, aren't you employing your own >form of censorship if you don't tell the whole story? There are some >good tools on the market, but often times they get lost in the crowd. > >[...] > >Shouldn't parents be able to use these tools in their own >homes if they see a need? Why not give people the facts, and let them >decide for themselves? If a parent would like to prevent a child from >giving address, credit card, and other information out to "just anybody" >on the Internet, what's wrong with that? If a parent would like to log >his 8 year old's Internet activity, what's wrong with that? If a parent >wants to screen out the word "sex" for every incoming transmission, >what's wrong with that? Isn't it up to the individual to decide whether >or not they want to buy this software?\ > >[...] > >Would you reconsider your opposition of the Summit? I think there is a >lot of opportunity to weed through the "b.s." and give the public some >good information about what is available, what works, and what solution >best supports free speech while protecting children. > >[...] From cnn at dev.null Thu Oct 30 17:04:30 1997 From: cnn at dev.null (Canadian Nutly News) Date: Fri, 31 Oct 1997 09:04:30 +0800 Subject: Seige of Ramsey Household Ends Peacefully! Message-ID: <34592A05.3B54@dev.null> [Bienfait, Saskatchewan: CNN] AN UNKNOWN murderer announced today that his seige of the Ramsey household ended peacefully, with the dead, limp body of Jon Bonet Ramsey being knocked down with a penis the size of a drainplug. The unknown murderer was pleased to announce that "Jon Bonet, is SAFE, now." From mixmaster at remail.obscura.com Thu Oct 30 17:26:21 1997 From: mixmaster at remail.obscura.com (Mix) Date: Fri, 31 Oct 1997 09:26:21 +0800 Subject: Protocols for Insurance to Maintain Privacy Message-ID: <199710310111.RAA01731@sirius.infonex.com> -----BEGIN PGP SIGNED MESSAGE----- I wrote: >I have my doubts as to whether it is possible to set up a really good >anonymous insurance scheme. At some point the customer must >physically be matched up with the policy. The damage may be >minimized by putting a hash of the customer's DNA markers in the >policy instead of the markers themselves. But, when the customer >wishes to draw on the policy, his or her markers will have to be >taken. > >If there were a way for the representative of the insurance company >to absolutely verify the DNA markers such that the customer could be >absolutely certain the information didn't leave the room, a really >good anonymous policy would be feasible. But, I can't think of a way >to do this. I've thought about this some more and there is a way to do this that at least works in theory. Let's say there are 30 DNA markers to be used to uniquely identify a physical person. When creating the contract, the customer creates 30 hashes based on each marker. Prior to the time the customer has a health problem, privacy is well assured assuming he or she doesn't have a blood sample taken forcibly. When the customer goes in for treatment, the insurer selects at random one of the 30 markers and verifies it. If it checks out, treatment is provided. The way to prevent people from trying to get lucky on the markers is for the customer and the insurer to make a bet before the test. This is a safe bet for the customer - he or she knows the outcome. If the odds and payoff are set correctly, it's a good deal for the insurer, too, because he or she will make money on fraud attempts. Let's take the worst case: only one of the 30 marker is different. Let's say the insurance contract consists of a health bet with a payoff of $100,000 if the ailment insured for is found. If the customer is willing to bet $3 million that any marker selected will be correct, the insurer breaks even. However, since the customer knows with certainty the outcome of the bet, he or she is safe betting (theoretically) any amount. This can be set arbitrarily high so that the insurer actually stands to make a substantial amount of money off fraud attempts. In practice some provision will have to be made for people who can't arrange the $3 million, such as taking fraud artists out to the parking lot and shooting them. And there still needs to be a way for one DNA marker to be tested for in a way which guarantees that none of the others are studied. Perhaps when the customer goes in, he or she takes samples of DNA with all thirty markers. When the insurer selects a particular marker, a blood sample is drawn, and the customer puts in DNA with the 29 other markers so that it will not be possible to study any marker other than the one intended. If each insurance contract is linked to only one type of illness, then the only information revealed is that somebody with one particular DNA marker had such and such an illness. This seems pretty secure. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFjP6JaWtjSmRH/5AQGwjgf/SIMSKV3prkmD3WDaiwojOhgxA+V0iLeY UAwHUKoOgIQAZ+5SKz2SsP6219jyi4i1mGbQFwXc8kydeEuia81/gAReo+63wZgB S6hlh9bUc4lp//S/ql5YISypNEKWXE6o7hE3IvdAeUrRlxEyU04fLmwW2UcejeFB rTdqFQLsTbONf1bvevJ4MplnhG/O7fRUDF3jneRxDZuib60EO8zUvbvpvDhaYM/e TMeuK5OywHOCX6EQc5eZ7ER1pIWgxR1cXwm428Qvk07z8VoTDJyy6QMLs+EzPcp6 Es94M2JezFmDAfD6nDGdLzrs8h4IJITdjWujLL4VQeJi6LwP7RB5NQ== =eHkn -----END PGP SIGNATURE----- From cnn at dev.null Thu Oct 30 17:38:05 1997 From: cnn at dev.null (Canadian Nutly News) Date: Fri, 31 Oct 1997 09:38:05 +0800 Subject: Seige of Mayonnaise Mountain Ends Peacefully! Message-ID: <3459338A.673E@dev.null> [Bienfait, Saskatchewan: CNN] TIM C. MAY, CYPHERPUNKS PHILOSOPHER KING, announced earlier today that the seige of Mayonnaise Mountain by local, state, federal, and global assault teams ended peacefully when the heavily armed members of the NWO forces were knocked down with a wide variety of projectiles the size of drainplugs, ranging from lead elephant-shotgun pellets to homemade nuclear slingshot ammunition. Mr. May was pleased to announce that the scattered body parts of his assailants, "are SAFE, now." When informed by members of the news media that he could be subject to a fine of up to a hundred dollars by EPA officials for using lead shot in his elephant gun, Mr. May smiled, and said, "Well, they know where to find me." From die at pig.die.com Thu Oct 30 17:57:06 1997 From: die at pig.die.com (Dave Emery) Date: Fri, 31 Oct 1997 09:57:06 +0800 Subject: Protocols for Insurance to Maintain Privacy In-Reply-To: <7433f6e11aa46cf7b903a8251c3e35b5@squirrel> Message-ID: <19971030201124.46048@pig.die.com> On Thu, Oct 30, 1997 at 09:33:52AM -0700, Tim May wrote: > Turns out that Blue Cross and Blue Shield have negotiated, through enormous > buying power, daily rates of about $700 a day. (These numbers come from my > memory of a "60 Minutes" report a few years ago. Details and current > figures may vary.) > My wife is a pathologist, and she tells me that some of the more aggressive HMOs get away with paying 15-20% of the posted "official" prices for procedures and tests. The difference between what insurance organizations pay and the nominal price is usually 2 to 3 to 1 for most things these days. And for many years Medicare has set defined prices for medical reimbursement that less than the gold plated bill amount as well. -- Dave Emery N1PRE, die at die.com DIE Consulting, Weston, Mass. PGP fingerprint = 2047/4D7B08D1 DE 6E E1 CC 1F 1D 96 E2 5D 27 BD B0 24 88 C3 18 From cnn at dev.null Thu Oct 30 18:23:54 1997 From: cnn at dev.null (Canadian Nutly News) Date: Fri, 31 Oct 1997 10:23:54 +0800 Subject: Siege Update! Message-ID: <34593DAC.D1D@dev.null> [COAL DUST SALOON, Bienfait, Saskatchewan: CNN] A BAR WHORE donated to the TruthMailer operator by the local chapter of "Ladies Against Women" announced to gathered reporters, after showing them her tits for ten dollars, that the bodies of the Whitehouse occupants and the scattered body parts of the members of the Mayonnaise Mountain assault teams had been examined by the Coal Dust Saloon bar owners, who had declared, "Those fuckers were crazy, alright, messing with the CypherPunks." Chief CypherPunks Spokesperson, Anonymous, declared that the merry band of anarchists was happy to be exonerated in the face of claims by the head of the American Medical Association that those slain by the CypherPunks were mentally stable. "We were certain that the opinion of our own psychiatric specialists, Dr. Dimitri Vulis, KOTM, and the world-renounced Dr. Grubor, would be upheld by the Circle of Eunuchs schills who count on the Last Canadian Outlaw to singlehandedly keep their bar operating in the black." When asked about the Coal Dust Saloon bar owners' decision in regard to the mental stability of Jon Bonet Ramsey, Anonymous leaned over and whispered to the Canadian Nutly News reportwhore, "If anybody asks, I was with _you_ when the little tart 'bought it', OK? Can I buy you a beer?" From mix at anon.lcs.mit.edu Thu Oct 30 18:25:01 1997 From: mix at anon.lcs.mit.edu (lcs Mixmaster Remailer) Date: Fri, 31 Oct 1997 10:25:01 +0800 Subject: PGP question Message-ID: <19971031022001.7119.qmail@nym.alias.net> >Not being very knowledgeable in the cypher world, are there any good online >references that compare RSA vs DSS PGP? and why one would be better than >the other? > >thanks If you use PGP 5.0 many people will refuse to read your messages and send them to you. They won't be able to decrypt your messages, verify your signatures, or use your keys. In general, using 5.0 just pisses people off. 5.0 is purposefully incompatable with all previous versions of PGP, they purposefully haven't released usable versions except for Windows and possibly Mac, they've purposefully broke any scripts and programs which invoke PGP, they purposefully made command-line versions of PGP many times more annoying to use, and PGP 5.x encrypts to a "CMR key" without having the decency to ask. Generally the PGP 5.x folks are being complete and total assholes about this entire thing and haven't done anything to improve the state of cryptography today and a whole lot to worsen it. Somebody recently posted a large rant about this titled "PGP 5.0: What were they thinking? (revisited)." CompatabilityMonger From aba at dcs.ex.ac.uk Thu Oct 30 18:52:52 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Fri, 31 Oct 1997 10:52:52 +0800 Subject: democracy?! (Re: Terrorism is a NON-THREAT (fwd)) In-Reply-To: <199710310021.SAA20714@einstein.ssz.com> Message-ID: <199710310142.BAA00797@server.test.net> Jim Choate writes: > > No amount of deaths are adequate cause for suspending the constitutional > > rights of our citizens. If the Feds can't adequately protect our citizens > > from criminal activities w/o trampling on our rights then its time for us > > to reorganize into different geo-political structures which may. > > No, it is time WE take responsibility back for our actions and control our > own lives and quit abrogating it to some asshole who will promise anything > to get us to give them money for nothing (ie taxes). Right on. Worried about childrens security? Protect them yourself, organise neighborhood watch, arm the little tykes to the teeth, pay private security firms, whatever. > > Once > > solutions offered from D.C. include suspension of our civil rights its time > > to put allt he options on the table, including considering the abandonment > > of the entire compact. > > If we abandon democracy then we are admitting that ALL social systems are a > failure. I fail to see the inference there. Democracy doesn't work that well. Probably no government at all would be better. Let me quote yourself: > No, it is time WE take responsibility back for our actions and control our > own lives and quit abrogating it to some asshole who will promise anything > to get us to give them money for nothing (ie taxes). Same thing applies to most government functions. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <199710310242.VAA15800@deathstar.jabberwock.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 An entity claiming to be Steve Schear wrote: : >: : >: (Personally, were I to be arrested and held on such false charges, I'd : >: consider it necessary to kill those who illegally held me. Preferably from : >: a safe distance, with a sniper rifle. But then I'm a right wing libertarian : >: whacko.) : > : >Right wing, left wing, friggin' wingless ... the above comment still : >indicates a sociopath. : : Perhaps, but is being a sociopath that bad? When those who administer the : justice system in society are out-of-control, or have consciously decided : to ignore the constitutional protections they are charged with upholding : then strong, extra-legal, measures may be called for in order to right the : apple cart. While being an eloquent statement of support for gang warfare, it still disagrees with the old adage of "two wrongs don't make a right" [1]. It does indicate that this concept of justice causes any traces of "law" to go right down the drain anytime one person oversteps the boundary. If Tim were justified in breaking the law because a (hypothetical) LEO broke his end of the Constitutional bargain, wouldn't that make the "law" in question moot? I'm not attacking your ideals, or Tim's, I'm just wondering if this sort of reactionary violence is valid. If Tim were arrested on some bogus charge [2] and were held as a political prisoner, let's say he does as he says he would ... leaving a corpse in jackboots. Wouldn't that add more fuel to the fires of the political reptiles, resulting in more oppresive law enforcement? I'm not saying that he should just turn the other cheek, I'm just wondering if there aren't more effective ways of dealing with an out of control government. The American public won't be roused to open revolution quite so easily. They have jobs, cars, houses, kids, dogs, digital watches [3] and lots of other things that they do not want to lose. Revolution is untidy, and Americans know this, so does the government ... this gives them a BIG advantage, it makes the citizenry very compliant. How do you see Tim's stance as being practical? : : "Those who prefer security over liberty deserve neither." I agree. [1] but three rights make a left. [2] plenty to pick from here. [3] well, most of them do. - -- [] Mark Rogaski "That which does not kill me [] wendigo at pobox.com only makes me stranger." -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNFlFnMHFI4kt/DQOEQKUMwCfYU7TczSd/kX7Wb6Xfz+hWYMty+EAoLQQ T5yekWt0iy+PdFHc2p0+v4qt =tTYi -----END PGP SIGNATURE----- From wendigo at ne-wendigo.jabberwock.org Thu Oct 30 18:55:18 1997 From: wendigo at ne-wendigo.jabberwock.org (Mark Rogaski) Date: Fri, 31 Oct 1997 10:55:18 +0800 Subject: Rules for a successful society In-Reply-To: <199710310041.SAA20996@einstein.ssz.com> Message-ID: <199710310248.VAA15839@deathstar.jabberwock.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 An entity claiming to be Jim Choate wrote: : : Q: Don't want to be beaten about the head and shoulders with a large club? : : A: Stay off my property unless invited. I just had the laugh of my life imagining Jim shouting this through a bullhorn on a South Dakota Indian Reservation. : : The PRIMARY rule of a successful society: : : Treat others the way you want to be treated, NO EXCEPTIONS. That would be why it was considered Golden, eh? Mark - -- [] Mark Rogaski "That which does not kill me [] wendigo at pobox.com only makes me stranger." -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNFlHDcHFI4kt/DQOEQIGrwCg2LnB/MOBreHlvMHPLNj39XZBSgAAoNuM hdk/Lc+wxYGJv5iH3W0vztIx =lYA8 -----END PGP SIGNATURE----- From nobody at REPLAY.COM Thu Oct 30 19:05:08 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 11:05:08 +0800 Subject: North CA cops skip preliminaries, get straight to torture Message-ID: <199710310259.DAA12926@basement.replay.com> #Subject: North CA cops skip preliminaries, get straight to torture CBS news tonight showed cops in a northern CA town use swabs to apply "pepper spray" directly to the eyes of demonstrators in some Congressman's office. One cop administered headlocks, another pried eyelids open and a third administered discipline. That's the ticket. Skip the judge and jury, just let the cops torture the perps. Why stop at pepper spray? Why not bamboo shoots? Electric shocks to the genitals? We must have order. Glad none of those human-rights protestors in DC will care. And none of those left-wing-commie-pinko llllliberals. And none of those right-wing Christians. FedUpMonger From ravage at ssz.com Thu Oct 30 19:23:42 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 31 Oct 1997 11:23:42 +0800 Subject: democracy?! (Re: Terrorism is a NON-THREAT (fwd)) (fwd) Message-ID: <199710310315.VAA21770@einstein.ssz.com> Forwarded message: > Date: Fri, 31 Oct 1997 01:42:37 GMT > From: Adam Back > Subject: democracy?! (Re: Terrorism is a NON-THREAT (fwd)) > > > If we abandon democracy then we are admitting that ALL social systems are a > > failure. > > I fail to see the inference there. If we as individuals can't make our own decisions about what is best for us, what makes you think some stranger will do any better? By our initial assumption we are assured that they can't make adequate decisions about their own life. Every form of government other than democracy assumes a priori that noble oblige is prima facia. To paraphrase an old questions of politics, who governs the governors? Or do you feel we have found angels in the form of kings? Democracy says, you don't need a governor (in that sense). You ARE held responsible for your actions AFTER your actions, not for simply thinking about them or even speaking them. Juries are supposed to be composed of your peers, not who the prosecution or defence believe will best support their case. It should be that the first 12 poeple called who don't have a valid excuse to be excused are the jury, the next 12 are the back-ups. This would guarantee that getting a conviction for anything other than the most heinous crime with the most explicit and incontrovertible evidence will be well nigh impossible, as it should be in a democracy. It should be a mother fucker to put somebody in jail in this country. Judges should not be able to tell someone they need permissio to file a legal complaint. Nor should a judge be able to refuse a juries request to have testimony transcribed because it costs too much. That isn't justice, that is systemic expediency and criminal indiference. Which means we should have the lowest number of incarcerated individuals instead of the most. > Democracy doesn't work that well. Probably no government at all would > be better. Doesn't work what way? Consider, other than democracy, that every form of government has an implicit assumption that there is some base sets of activities that citizens should be permitted and they will be happy. Those activities are determined, except in democracies, by those in power who are NOT elected or otherwise responsible to the people as a whole. In a democracy the people are given the opportunity to make up their mind what to do with their lives and property without having to obtain permission from some authority. Why? Because there isn't such an authority to get permission from in the first place. > > No, it is time WE take responsibility back for our actions and control our > > own lives and quit abrogating it to some asshole who will promise anything > > to get us to give them money for nothing (ie taxes). > > Same thing applies to most government functions. In what way? Paying a government to keep the park clean and mowed and the lights on at night or my streets well paved and de-iced in winter is not quite the same thing as having black-suited ninja wann-be's kicking my door in at 2AM because I choose to smoke a joint or even grow my own weed; or spend six weeks in jail for possessing vitamins that some cop THINKS is drugs; or perhaps because I happen to be a doctor and know how to read and might take exception to being told what I can or can't say; or because I might be of Jewish decent or a Muslim or a Catholic or Anglo or Negro; or etc. etc. There is a reason behind the madness of "Congress shall make no law...". ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From tcmay at got.net Thu Oct 30 19:26:45 1997 From: tcmay at got.net (Tim May) Date: Fri, 31 Oct 1997 11:26:45 +0800 Subject: Protocols for Insurance to Maintain Privacy In-Reply-To: <199710302115.PAA03448@multi26.netcomi.com> Message-ID: At 2:15 PM -0700 10/29/97, Neva Remailer wrote: >The Emergency Room Scenario is a little more challenging. One way to >deal with it is to wear some obvious signs of wealth like a $10,000 >watch. In a pinch you can give them the watch. ;-) (Some of the >nurses won't know what it is, but the doctors will, I am sure.) > >I'm pretty sure that if you are an unconscious wealthy looking person >they don't turn you away. You really only need to survive until your >lawyer gets to the hospital with a suitcase of cash. Read "The Millionaire Next Door" for tips on what millionaires (who are of course the "barely non-poor" these days) are likely to be wearing and flaunting. Turns out that most Yuppies driving BMWs and wearning Rolexes are doing so on _credit_. Driving a Mercedes or BMW has nothing to do with actual ability to pay bills. >How do super rich people solve this problem? You can be pretty sure >that Bill Gates self insures and protects his privacy at the same >time. How does he do it? How does he solve the Emergency Room >Scenario? I can't speak for what Gates does, but the 3rd or 4th richest man, Gordon Moore of Intel, was signed up for the company plan. As a fail-safe, emergency room plan, it's a winner. If grossly more expensive treatments are needed, more than the health care plan will pay for, he can always opt for this. (The "savings" by self-insuring are trivial, even to average folks. Given that a company health plan will not _stop_ patients from paying more, the company plan is valuable insurance against being turned away as an indigent.) --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From tcmay at got.net Thu Oct 30 19:41:17 1997 From: tcmay at got.net (Tim May) Date: Fri, 31 Oct 1997 11:41:17 +0800 Subject: Killing those who need killing (fwd) In-Reply-To: Message-ID: At 7:42 PM -0700 10/30/97, Mark Rogaski wrote: >While being an eloquent statement of support for gang warfare, it still >disagrees with the old adage of "two wrongs don't make a right" [1]. It does The essence of this country's founding, and of specific statements by Jefferson (tree of liberty watered with blood of patriots and tyrants), Franklin (those who seek security over liberty deserve neither), and many others, is that the people will seek vengeance in extra-legal ways if the law enforcers become corrupt. Thus we see the Militia Movement, the Posse Commitatus groups of years past, Assassination Politics, fragging of corrupt and incompetent commanders, and direct action taken against the Feds in their headquarters. Sounds predictable to me. >indicate that this concept of justice causes any traces of "law" to go right >down the drain anytime one person oversteps the boundary. If Tim were >justified in breaking the law because a (hypothetical) LEO broke his end of >the Constitutional bargain, wouldn't that make the "law" in question moot? I'm saying that vengeance for wrongs done and unrighted by the courts means the people are justified in acting against those who did them wrong. >I'm not attacking your ideals, or Tim's, I'm just wondering if this sort >of reactionary violence is valid. If Tim were arrested on some bogus charge >[2] and were held as a political prisoner, let's say he does as he says he >would ... leaving a corpse in jackboots. Wouldn't that add more fuel to the >fires of the political reptiles, resulting in more oppresive law enforcement? Yes, but bringing on the End Times is perhaps needed. Sometimes things have to get worse to get better. >I'm not saying that he should just turn the other cheek, I'm just wondering if >there aren't more effective ways of dealing with an out of control government. >The American public won't be roused to open revolution quite so easily. They >have jobs, cars, houses, kids, dogs, digital watches [3] and lots of other >things that they do not want to lose. Revolution is untidy, and Americans >know this, so does the government ... this gives them a BIG advantage, it >makes the citizenry very compliant. > >How do you see Tim's stance as being practical? I don't claim the herd, the sheeple, will join in this revolution. I'm saying that if I were to be imprisoned for months because I had squashed vitamins in my pocket, which some gung-ho cops and DAs thought were drugs, that I would then seek to kill all of those who falsely imprisoned me. Sounds fair to me. So long as they understand that they can't use toilet plungers on innocents, imprison people falsely, etc., they've got nothing to fear. But they have plainly lost sight of their responsibilities. Maybe their death has been earned. Might send a valuable lesson to the others. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From tcmay at got.net Thu Oct 30 19:42:43 1997 From: tcmay at got.net (Tim May) Date: Fri, 31 Oct 1997 11:42:43 +0800 Subject: North CA cops skip preliminaries, get straight to torture In-Reply-To: <199710310259.DAA12926@basement.replay.com> Message-ID: At 7:59 PM -0700 10/30/97, Anonymous wrote: >#Subject: North CA cops skip preliminaries, get straight to torture > >CBS news tonight showed cops in a northern CA town use swabs to apply >"pepper spray" directly to the eyes of demonstrators in some Congressman's >office. One cop administered headlocks, another pried eyelids open and a >third administered discipline. > >That's the ticket. Skip the judge and jury, just let the >cops torture the perps. Why stop at pepper spray? Why not bamboo shoots? >Electric shocks to the genitals? We must have order. Yep, it looked gruesome. And clinical. Just the slow application of capsaicum to the eyeballs. On the other hand, the perps were trespaassers in private offices. Me, I would've been inclined to fire up my Stihl and separate their little fairy circle at their wrists. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From JonWienk at ix.netcom.com Thu Oct 30 20:16:42 1997 From: JonWienk at ix.netcom.com (Jonathan Wienke) Date: Fri, 31 Oct 1997 12:16:42 +0800 Subject: Killing those who need killing In-Reply-To: <199710300106.TAA15382@einstein.ssz.com> Message-ID: <3.0.3.32.19971030200643.0313e0e0@popd.netcruiser> At 05:25 PM 10/29/97 -0700, Tim May wrote: >At 6:06 PM -0700 10/29/97, Jim Choate wrote: >>> MAN SPENDS 6 WEEKS IN JAIL AFTER VITAMINS MISTAKEN FOR HEROIN >>> >>> October 29, 1997 >>> Web posted at: 7:21 p.m. EST (0021 GMT) >>> >>> NORTH CHARLESTON, South Carolina (AP) -- For six weeks, Malvin >>> Marshall sat in jail because police thought he was carrying heroin >>> in his pocket. Police didn't believe him when he said it was mushy >>> vitamins. >>> >>> On Monday, the charges were dropped. Lab tests showed he was >>> carrying mushy vitamins. > >And he doesn't stand a chance of suing them successfully. > >No wonder some people support Assassination Politics. > >(Personally, were I to be arrested and held on such false charges, I'd >consider it necessary to kill those who illegally held me. Preferably from >a safe distance, with a sniper rifle. But then I'm a right wing libertarian >whacko.) Why screw around with a sniper rifle when you can get Chinese clones of the Stinger missile for $700-800? Besides, they can come in handy when they send in the helicopters with mounted machine guns a la Waco. Mrs. Shirley Allen has been captured and is getting her mandatory psychiatric exam. Her family is celebrating, according to ABC news. Anyone think she will be declared sane? If so, I have some excellent Florida swampland for sale... Reality is a symptom of alcohol deficiency! ObTongueInCheekFearmongeringThought: How many Cypherpunks are vulnerable to this "psychiatric imbalance allegation" attack? Tim May is obviously an anti-social survivalist gun freak, (like me, but with a bigger ammo stockpile--I'm jealous) Vulis is obviously a closet bisexual deviant/pedophile (especially if he posts those "Timmy Mayonnaise" ASCII art spams), Bill Geiger is a rabid anti-government extremist a la McVeigh, and TruthMonger--need I say more? It only takes one disgruntled relative to "Allen" somebody...which in itself is a powerful motivation to engage in anti-social behavior. Hint: Look up what happened to almost everyone who knew Stalin as a child... Jonathan Wienke PGP Key Fingerprints: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC "If ye love wealth greater than liberty, the tranquility of servitude greater than the animating contest for freedom, go home from us in peace. We seek not your counsel, nor your arms. Crouch down and lick the hand that feeds you. May your chains set lightly upon you; and may posterity forget that ye were our countrymen." -- Samuel Adams "Stupidity is the one arena of of human achievement where most people fulfill their potential." -- Jonathan Wienke RSA export-o-matic: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 From nobody at REPLAY.COM Thu Oct 30 20:22:53 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 12:22:53 +0800 Subject: North CA cops skip preliminaries, get straight to torture Message-ID: <199710310414.FAA21232@basement.replay.com> Tim May wrote: > At 7:59 PM -0700 10/30/97, Anonymous wrote: > >#Subject: North CA cops skip preliminaries, get straight to torture > > > >CBS news tonight showed cops in a northern CA town use swabs to apply > >"pepper spray" directly to the eyes of demonstrators in some Congressman's > >office. One cop administered headlocks, another pried eyelids open and a > >third administered discipline. > > > >That's the ticket. Skip the judge and jury, just let the > >cops torture the perps. Why stop at pepper spray? Why not bamboo shoots? > >Electric shocks to the genitals? We must have order. > On the other hand, the perps were trespaassers in private offices. Me, I > would've been inclined to fire up my Stihl and separate their little fairy > circle at their wrists. The manufacturer of the pepper spray used warns that it should be used from a minimum of three feet away, as closer use will result in tissue damage. Videos show the police spraying it directly in the non-violent demonstrators eyes from inches away. Naturally, even if they shot the non-violent demonstrators in the eye from inches away, with their guns, they would be provided with a taxpayer-supported legal team to claim that the officers were in fear for their lives from seated, handcuffed, unarmed, non-violent demonstrators. If I trespass on Tim's property, I would fully expect him to deal with me in a manner consistent with his declared intentions. I would expect the same from those who claim to be bound by the same rule of law that they _force_ on the citizens. This non-violent demonstrators were willing to accept the agreed upon punishment/cost of their actions in protest of the actions of their public servants. Their public servants, as usual, chose to to act in the manner of savages who are incapable of holding to the rule of law which they use to justify their confiscation of the citizen's right to bear arms in the face of tyranny. Twenty years or so ago, after seeing pictures of mothers and children in chains at a Livermore Labs protest, I wrote a song called "Don't Blame Me, I Voted For The Monkey." If more people had followed my example, we would be singing the praises of government, as Bozo sits in the Oval Office typing new legislation which would likely be far superior to anything we have seen in the last twenty years. "Time flies like an arrow...fruit flies like a banana." TruthMonger From nobody at bureau42.ml.org Thu Oct 30 20:29:28 1997 From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer) Date: Fri, 31 Oct 1997 12:29:28 +0800 Subject: Cypherspeak Message-ID: Canadian Nutly News wrote: > Canadian Nutly News reportwhore ^^^^^ The answer to InfoWar is more InfoWhore! From tcmay at got.net Thu Oct 30 20:45:47 1997 From: tcmay at got.net (Tim May) Date: Fri, 31 Oct 1997 12:45:47 +0800 Subject: What Will Revolution Look Like? Message-ID: Some of the questions by Mark Rogaski and others ask about the nature of the revolution I and others are predicting and encouraging. What will a just revolution, like those anticipated by Jefferson, Franklin, and others, look like? The British thought the colonial rebels were "playing dirty" by shooting from behind trees instead of marching in bright uniforms with drums and bugles to herald their way. Modern armies think freedom fighters are "terrorist scum" for not fighting honestly and fairly in their own M-1 Abrams tanks and aircraft carriers. So, too, will revolutionaries be seen as fighting "unfairly" and being unethical sneaks, child killers, and terrorists. (As if children and other innocents did not die in various incidents in past wars, on all sides.) When Jefferson predicted that a revolution was needed every 20 years or so, he surely was not saying that throwing one party out of leadership and putting the other party in was an example of such a revolution, or that "campaign reform" is such an example. Nor was he saying that the only valid revolution would be when a buch of citizens or states got together their own army and marched on Washington. (Actually, raising such an army is in violation of numerous laws about heavy weaons, licenses to carry weapons, etc. No doubt illegal. Ironically.) No, the revolution, when it comes, will likely be different from anything quite like we've seen to date. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From JonWienk at ix.netcom.com Thu Oct 30 20:55:34 1997 From: JonWienk at ix.netcom.com (Jonathan Wienke) Date: Fri, 31 Oct 1997 12:55:34 +0800 Subject: Killing those who need killing (fwd) In-Reply-To: <199710310242.VAA15800@deathstar.jabberwock.org> Message-ID: <3.0.3.32.19971030202210.03155da0@popd.netcruiser> At 07:32 PM 10/30/97 -0700, Tim May wrote: >I'm saying that vengeance for wrongs done and unrighted by the courts means >the people are justified in acting against those who did them wrong. Check out Tom Clancy's book "Without Remorse" for an excellent, although fictional, example. Jonathan Wienke PGP Key Fingerprints: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC "If ye love wealth greater than liberty, the tranquility of servitude greater than the animating contest for freedom, go home from us in peace. We seek not your counsel, nor your arms. Crouch down and lick the hand that feeds you. May your chains set lightly upon you; and may posterity forget that ye were our countrymen." -- Samuel Adams "Stupidity is the one arena of of human achievement where most people fulfill their potential." -- Jonathan Wienke RSA export-o-matic: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 From nobody at REPLAY.COM Thu Oct 30 21:11:31 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 13:11:31 +0800 Subject: North CA cops skip preliminaries, get straight to torture Message-ID: <199710310504.GAA26761@basement.replay.com> > The manufacturer of the pepper spray used warns that it should be > used from a minimum of three feet away, as closer use will result > in tissue damage. http://www.tscm.com/mace.html On the third page of Brisbane's Courier Mail yesterday, "Policeman Accused of Assaulting Rape Witness Promoted." ::Boots "Any weapon must be kept concealed until the exact moment of its use" From tcmay at got.net Thu Oct 30 21:26:16 1997 From: tcmay at got.net (Tim May) Date: Fri, 31 Oct 1997 13:26:16 +0800 Subject: Killing those who need killing In-Reply-To: Message-ID: At 9:06 PM -0700 10/30/97, Jonathan Wienke wrote: >Mrs. Shirley Allen has been captured and is getting her mandatory >psychiatric exam. Her family is celebrating, according to ABC news. >Anyone think she will be declared sane? If so, I have some excellent >Florida swampland for sale... Reality is a symptom of alcohol deficiency! > >ObTongueInCheekFearmongeringThought: >How many Cypherpunks are vulnerable to this "psychiatric imbalance >allegation" attack? Tim May is obviously an anti-social survivalist gun >freak, (like me, but with a bigger ammo stockpile--I'm jealous) Vulis is >obviously a closet bisexual deviant/pedophile (especially if he posts those >"Timmy Mayonnaise" ASCII art spams), Bill Geiger is a rabid anti-government >extremist a la McVeigh, and TruthMonger--need I say more? It only takes >one disgruntled relative to "Allen" somebody...which in itself is a >powerful motivation to engage in anti-social behavior. Hint: Look up what >happened to almost everyone who knew Stalin as a child... Don't any of you get any ideas here, but in California it is ridiculously easy to get someone committed for a 72-hour observation period. All one has to do is convince one of the various agencies that a person is a possible danger to himself or to others. So, 72 hours playing head games with a shrink doesn't sound so bad, does it? For starters, expect a regimen of antipsychotic and antidepressant drugs, sort of a reduced version of "One Flew Over the Cuckoo's Nest." Then, expect shrinks who are looking for antisocial behavior, not organic psychoses. Worst of all, the mere fact of having been committed, regardless of the eventual outcome, can mean a complete loss of rights to own a handgun, rifle, or shotgun for a long period (10 years, I think). Failure to let the Thought Police in for a look around one's home is almost ipso facto grounds for committment. "I'm having fantasies, doctor, about spraying a vanload of shrinks trespassing on my property." Enough to get me committed? Go ahead, make my day. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From tcmay at got.net Thu Oct 30 21:29:59 1997 From: tcmay at got.net (Tim May) Date: Fri, 31 Oct 1997 13:29:59 +0800 Subject: North CA cops skip preliminaries, get straight to torture In-Reply-To: <199710310414.FAA21232@basement.replay.com> Message-ID: At 9:14 PM -0700 10/30/97, Anonymous wrote: > This non-violent demonstrators were willing to accept the agreed >upon punishment/cost of their actions in protest of the actions >of their public servants. Their public servants, as usual, chose >to to act in the manner of savages who are incapable of holding >to the rule of law which they use to justify their confiscation >of the citizen's right to bear arms in the face of tyranny. Excuse me, but this modern notion that protestors get to "make a deal" about the fines they'll eventually pay is bogus. If they're trespassing, they're trespassing. They don't get to take over Intel's factory, chain themselves to the Evil Factory doors, and then make a deal to pay some token fine. Like the AIDS protestors who "arrange" a deal whereby they'll shut down the Golden Gate Bridge for several hours and then pay their arranged $50 tickets. Well, what's wrong with me driving up to the head of the sit-down protest and saying to the cops standing idly by, "Hey, there are some queers in the middle of the road, blocking my trip to Marin. If you're just gonna let em sit there for hours, putting my business and plans at risk, I'm just gonna gun my engine and drive right over their fairy asses." Crimes are crimes, not "guerilla theater." Not "performance art." (And I was one of the organizers of "Critical Smash," a counter-rally of truck drivers and fed up motorists who met the "Critical Mess" bicyclists planning to "shut down" major intersections.) > > Twenty years or so ago, after seeing pictures of mothers and >children in chains at a Livermore Labs protest, I wrote a song >called "Don't Blame Me, I Voted For The Monkey." I had a much better idea back then. Leave the mothers and childrens chained to the fences and gates. Pull back from them, erect a cordon around them, and block anyone from approaching. They wanted to be chained to the fence, sans keys, so let them have their wish. Others could show up to throw stuff at them, and place bets on who would be the last to die. And, as the flesh dripped off and the bones whitened, it might be a nice object lesson for the others. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From tm at dev.null Thu Oct 30 21:35:56 1997 From: tm at dev.null (TruthMonger) Date: Fri, 31 Oct 1997 13:35:56 +0800 Subject: Self-proclaimed judge and jury. Message-ID: <34596AEB.67F1@dev.null> After my success in predicting the outcome of the 'au pair' trial, which is but one of my astonishing string of legal predictions, I have decided to offer my services as self-proclaimed judge and jury, in order to spare the government and its taxpayers the increasingly outrageous cost of incarcerating or freeing the innocent and the guilty, seemingly at random. A bar-table conference of lawyers and judges agreed wholeheartedly with me that the *evidence* presented in the 'au pair's' trial in no way supported a verdict of first, or even second, degree murder. > To convict Woodward of second-degree murder, the jury found > that she intentionally killed the baby with malice, but without > atrocity or premeditation. My panel, to a person, agreed with Barry Scheck that the prosecution had not even "come close" to proving the above, based on the evidence. None of them were foolish enough, however, to believe that the decision of the jury would be based on the evidence and the law. I announced, with an air of certitude, that the verdict would be guilty. My reasoning? 1. Morning talk shows show that the sheeple want *somebody* to pay for each and every perceived wrong done on the face of the media-lit earth. 2. The sheeple don't really give a fat rat's ass about finding the *right* villain, but only the best media-promoted candidate. 3. The obvious target is whoever is 'the least like *me*'! 4. The parents are media friendly, the 'au pair' has British reserve. In short, the British are emotional cryptographers, who obviously have something to hide. Outgoing Americans, who look like us, dress like us and act like us, need only to 'leave us laughing' in order to skip out the door to freedom while pigmentation and/or non-photographic criminals go to the gallows. Guilty! My other successful predictions, in a nutshell: Kennedy Rapist - "White-bread is going to walk." Boxer Rapist - "Nigger's going to jail." Simpson-Brown Murderer: "We were climbing over the fence to OJ's estate hollering, 'We're from the government, and we're here to help you.'" ~My Verdict~ "If the police are shit, blacks will acquit." OJ Civil Trial - Right...like *anyone* is going to brag about predicting the outcome of a black man in front of a rigged jury... In case you think I am *bragging* about my remarkable skill in making correct predictions about the outcome of almost all trials that I take an interest in...guess again. I am a cynical, pessimistic person with low self-esteem, who is able to egoistically consider himself 'superior to the sheeple' only by virtue of the fact that their repetitive echoing of whatever the media 'bleats' in their direction places them in the animal/vegetable/mineral kingdoms which I believe I have risen ever so slightly above in my quest for consciousness. I am, in fact, totally *horrified* that I am able to correctly predict the outcome of what is supposed to be a process of rational judgement by basing my analysis on the supposition that the legal system exists mostly for the purpose of perpetuating its own position of authority, and that its members chief aim is to WIN--at the cost of justice, if need be, and often even out of the interests of mere expediency. From my experience, legal resolution to criminal charges has been quickened more over the years by golf clubs who have 'moved up' an attorney's tee-time, than by any 'right to a speedy trial' legislation has ever done. I would like, deep down inside, to believe that I am full of shit in this regard, but I just keep successfully predicting the outcome of trials by being an irreverent, cynical asshole. Go figure... TruthMonger From azur at netcom.com Thu Oct 30 21:58:56 1997 From: azur at netcom.com (Steve Schear) Date: Fri, 31 Oct 1997 13:58:56 +0800 Subject: Protocols for Insurance to Maintain Privacy In-Reply-To: <7433f6e11aa46cf7b903a8251c3e35b5@squirrel> Message-ID: >I have so far elected to self-insure, i.e., to just pay any medical bills I >might have out of pocket. However, given this "sucker rate" and the >increasing unwillingness of hospitals to take patients not in health care >or insurance programs, I may have little choice but to sign up. Why not establish an offshore insurance company (e.g., in the Caribbean so the area code doesn't make it appear outside our boarders) which knows you true ID, but let's you use a pre-agreed upon pseudo-ID. They could even have URLs on their pages to services which could help you out obtaining realistic hardcopy. Doctors don't much care as long as they are getting paid and all will accept out-of-state, many even knowingly out-of-the-country, insurers. They really don't care about the IDs as long as they match something insurance company says they'll pay. --Steve From nobody at REPLAY.COM Thu Oct 30 22:27:41 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 14:27:41 +0800 Subject: Thanks to AnonyMace, we know: / Re: North CA cops skip preliminaries, get straight to torture Message-ID: <199710310616.HAA05016@basement.replay.com> Boots wrote: > Anonymous wrote: > > The manufacturer of the pepper spray used warns that it should be > > used from a minimum of three feet away, as closer use will result > > in tissue damage. > > http://www.tscm.com/mace.html Chemical Mace�, A trademark for a mixture of organic chemicals used in aerosol form as a weapon to disable with intense burning pain, blepharospasm, acute bronchitis, and respiratory irritation. -- "American Heritage Dictionary", 1991 i.e. - The police in Humboldt county used 'weapons' against peaceful passive-resisters. Mace is an aerosol weapon (tear gas) that is used to disable violent attackers. i.e. - ibid. What Is Mace Made Of? (Formulations) CN (Original Mace) CS CN/OC Blend CS/OC Blend OC 5.5% OC 10% OC Foam CN -- Chloracetophenone (Lacrimator Agent) Relatively toxic Fast Acting (Upper Respiratory Tract, Lachrymatory, Eyes) Irritating to the Skin (burning and itching sensation) CS -- Orthochlorbenzalmalononitrle (Lacrimator Agent) Extreme burning of the eyes, and flowing tears Stinging sensation on all moist skin Tightness in the chest and throat (Lung and Bronchial Irritant) OC -- Oleoresin of Capsicum (Inflammation Agent) Severe involuntary closing of the eyes/Spasms of Eyelids Severe burning of the eyes, and flowing tears Intense pain on all exposed all skin i.e. - The police *sentenced* unconvicted citizens to receive the *punishment* of *severe* burning and *intense* pain by use of *chemical warfare*. How Does It Work? CN and CS are both irritants and lacrimator agents...if it gets into the respiratory tract is causes severe coughing and choking. ^^^^^^ For CN and CS to work effectively the person being sprayed must be able to feel pain ^^^^ OC on the other hand is a inflammation agent...it causes...the entire respiratory system to seize up and go into spasms. i.e. - Severe Pain and Spasms == Punishment Legalities Any time you use Mace (or any kind of weapon) be prepared to defend yourself in civil or criminal court. Spraying someone with Mace is (by legal definition) an assault, ^^^^^^^^^^^^^^^^^^^ ^^^^^^^ and you must be legally justified to spray someone. You can easily go to jail or get sued for misusing a defensive ^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^ *^^^^^^^^^* spray or any level of physical force. i.e. - If you are a *citizen-unit*. Keep in mind that the use of any kind of defensive weapon could result in death. i.e. - Do the police give a fat rat's ass if they kill the citizens by using *chemical warfare* when it is not necessary, except to perhaps 'teach someone a lesson' by sentencing them to be punished before trial? No. When to Use - Use of Force Ladder Confrontational Avoidance Physical Presence Key Verbal Skills Body Language - Assault is Imminent/Possible Defensive Tactics/Martial Arts/C&R/Open Hand Chemical Weapons Impact Weapons Edged Weapons Firearms i.e. - The word "defensive" is used, time and time again in this evaluation of the proper use of mace. The words *punishment* and *expediency* are, not surpsingly, absent from this discourse. [If you follow the links to the government material on the use of these deadly chemical weapons, you will find constant references to "restraint" of "aggressive" individuals, and as an "alternative" to "physical violence."] About the author: [BTW, he's is trained in "Cryptanalysis"] James M. Atkinson, is an internationally recognized leader and trainer in the field of Technical Surveillance Counter Measures (TSCM), Signals Intelligence (SIGINT), Electronic Surveillance Technology, Telecommunications, Intelligence Acquisition and Analysis, Covert and Tactical Operations, Counterintelligence, Computer and Communications Systems, High Speed Photonic Networking, High Security Locksmithing, Electronic Counterterrorism, Explosives Detection, Chemical Weapons, Security Evaluation, and Consulting. Mr. Atkinson has been trained by the U.S. Government in Intelligence, Covert Operations, Technical Surveillance, and Cryptanalysis. He is a graduate of the Defense Intelligence School and has extensive field experience in military, technical intelligence, and covert operations. He is a veteran with eight years of active duty military service, followed by two years of employment with a U.S. intelligence agency, and holds a Top Secret security clearance. He has completed advanced tactical training, and has been certified as both an Instructor and a Master Instructor of chemical weapons and is literally the person who "teaches the teachers". Mr. Atkinson is also the author of numerous books, including multiple titles related to chemical weapons. From nobody at bureau42.ml.org Thu Oct 30 23:17:28 1997 From: nobody at bureau42.ml.org (bureau42 Anonymous Remailer) Date: Fri, 31 Oct 1997 15:17:28 +0800 Subject: Self-proclamed judge and jury. Message-ID: TruthMonger wrote: > I am a cynical, pessimistic person with low self-esteem, who is able > to egoistically consider himself 'superior to the sheeple' only by > virtue of the fact that their repetitive echoing of whatever the media > 'bleats' in their direction places them in the animal/vegetable/mineral > kingdoms which I believe I have risen ever so slightly above in my > quest for consciousness. "Stupidity is the one arena of of human achievement where most people fulfill their potential." -- Jonathan Wienke From tm at dev.null Thu Oct 30 23:44:44 1997 From: tm at dev.null (TruthMonger) Date: Fri, 31 Oct 1997 15:44:44 +0800 Subject: Reputation Capital / Re: Killing those who need killing In-Reply-To: <199710300106.TAA15382@einstein.ssz.com> Message-ID: <345987E3.2C09@dev.null> Jonathan Wienke wrote: > ObTongueInCheekFearmongeringThought: > How many Cypherpunks are vulnerable to this "psychiatric imbalance > allegation" attack? Tim May is obviously an anti-social survivalist gun > freak, (like me, but with a bigger ammo stockpile--I'm jealous) Vulis is > obviously a closet bisexual deviant/pedophile (especially if he posts those > "Timmy Mayonnaise" ASCII art spams), Bill Geiger is a rabid anti-government > extremist a la McVeigh, and TruthMonger--need I say more? Question: Is it a sign of low reputation capital when people only have to mention your name to make their point? Answer: Crispin! Bonus Question: What kind of signature line would lessen the social stigma of being called a "sociopath" by Mark Rogaski? Answer: "That which does not kill me only makes me stranger." Robert Hettinga *loves* this list! TruthMonger From snow at smoke.suba.com Thu Oct 30 23:45:30 1997 From: snow at smoke.suba.com (snow) Date: Fri, 31 Oct 1997 15:45:30 +0800 Subject: Killing those who need killing (fwd) In-Reply-To: <199710300656.BAA11573@deathstar.jabberwock.org> Message-ID: <199710310740.BAA02029@smoke.suba.com> > An entity claiming to be Tim May wrote: > : (Personally, were I to be arrested and held on such false charges, I'd > : consider it necessary to kill those who illegally held me. Preferably from > : a safe distance, with a sniper rifle. But then I'm a right wing libertarian > : whacko.) > Right wing, left wing, friggin' wingless ... the above comment still > indicates a sociopath. And the problem with that is... You must live in such a nice world, where the sky is always blue, the grass always green, and the police eager and willing to serve a happy populace. Can I come live in your world? From nobody at REPLAY.COM Fri Oct 31 00:00:51 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 16:00:51 +0800 Subject: PGP 5.5 available outside US Message-ID: <199710310747.IAA13847@basement.replay.com> > It seems that unknown Cypherpunks have yet again shown their disrespect of > US export laws by exporting the latest version of PGP. The Windows version > of PGP 5.5 is now available for your downloading pleasure at > ftp://ftp.replay.com/pub/crypto/incoming/PGP55.zip > -- Lucky Green PGP encrypted email preferred. > "Tonga? Where the hell is Tonga? They have Cypherpunks there?" First, a PGP employee announces that PGP 5.5 is available for download. Second, I try to download it a dozen times, only to have the connection broken each time, after outrageously long periods of waiting for an extremely slow transfer. Third, PGP 5.5 disappears from the server. Fourth, everyone I talk to tells me their attempt to download the file failed. I don't _need_ PGP 5.5. I have a beta-test version of PGP 5.0 which serves me rudimentarily well for my purposes. I would like to check out PGP 5.5 in order to make a proper evaluation of the features and technology involved, but it seems that it is not available for this purpose. PGP will undoubtedly survive without my support, but I find it sad that after many years of supporting PGP products, I can no longer do so with any amount of integrity. Anonymous From lurker at ottoman.net Fri Oct 31 00:42:51 1997 From: lurker at ottoman.net (lurker at ottoman.net) Date: Fri, 31 Oct 1997 16:42:51 +0800 Subject: No Subject Message-ID: <199710310930.LAA11089@ankara.duzen.com.tr> October 30, 1997 Web posted at: 9:34 p.m. EST (0234 GMT) ROBY, Illinois (CNN) -- Shirley A. Allen, a mentally disturbed woman who held police off for 39 days with a shotgun and entertained herself by listening to public radio, was captured Thursday and taken to a hospital. "The good news is she's safe," said Terrance Gainer, Illinois state police director. "The great news is nobody got seriously hurt or killed." The standoff ended when Allen ventured out on the deck behind her home to throw away food and water left for her by the police. On her third trip, she stooped to cut a wire attached to a pail in which a police camera was hidden. A trooper fired six rubber bullets at her, striking her two or three times and knocking her to the deck, where she was captured. Gainer said that Allen, who wore a full camouflage suit padded with a pillow and magazines, was examined at a hospital and reported to be in good condition was feisty enough after the ordeal to scold police for their tactics during the standoff. Gainer said she is still in custody and will undergo a psychiatric examination. "I think she's probably as relieved right now as we are that this is over," said Allen's brother, Byron Dugger, who talked with her after she was captured. Gainer said Allen asked Dugger to open his mouth to prove he wasn't someone wearing a mask that looked like him. 'They have zapped my head with radar' The standoff in this small central Illinois town began September 22 when Allen, 51, brandished a shotgun as her brother and sheriff's deputies tried to take her in for a court-ordered evaluation. Allen's relatives were concerned because she had become increasingly depressed and paranoid since her husband died of pancreatic cancer in 1989. More recently, she had refused to see or talk to her brother or her 86-year-old mother. In a letter to her mother in May 1996, Allen wrote, "They have zapped my head with radar. I have swelling and inflammation of the brain." She did not say who "they" were, but when police offered her water after she was captured, she said "the helicopters" told her not to drink it. There were no helicopters in sight, but she finally drank the water after troopers drank some to prove it wasn't poisoned. She told them she hadn't eaten or had anything to drink in three days. Allen also talked to her daughter, Kate Waddell, after she was captured. "But she wasn't quite sure it was Mrs. Waddell," Gainer said. Allen's case attracted the sympathy of many neighbors and became a rallying point for some who called it "Roby Ridge," likening it to shootouts at Ruby Ridge, Idaho, and Waco, Texas, as an example of overzealous law enforcement. Standoff cost taxpayers about $1 million Others questioned the expense of the standoff. Gainer tackled that one head-on at a news conference Thursday, saying it was about $15,000 a day. He estimated the total cost of the operation at $750,000 to $1 million. Obviously relieved that Allen was taken alive, an unapologetic Gainer said, "But I don't think Mrs. Shirley Allen is worth a cent less than that." Police tried to get Allen out of her green frame farmhouse with tear gas, pepper spray and music. They also tried to coax her out with a visit from her favorite stepdaughter. This week, they began giving her food and restored her power, which had been shut off earlier, in a goodwill gesture they hoped would calm her down. Allen had fought off tear gas by smearing her face with petroleum jelly and withstood beanbag bullets by wearing heavy layers of clothing. She apparently slept in a sleeping bag in the living room -- the room where her husband died -- and had two transistor radios with earplugs. Gainer said the radios were tuned to a local public radio station. Protesters gathered daily to support her and criticized the police. 'Mrs. Allen is where she needs to be' "The good feeling is it's over for her. The bad feeling is how she's going to be trapped after this is over with," said John Powers, a neighbor and one of the protesters. "We don't know if they'll treat her as a person who is sane or as a person who tried to shoot their dog." Although Allen fired at state troopers and wounded a police dog sent into her home Sunday, "it would serve no useful purpose to charge her," Gainer said. "Given what we have known from Day 1, Mrs. Allen is where she needs to be right now." Reporter Lisa Price and The Associated Press contributed to this report. From lurker at ottoman.net Fri Oct 31 00:43:23 1997 From: lurker at ottoman.net (lurker at ottoman.net) Date: Fri, 31 Oct 1997 16:43:23 +0800 Subject: No Subject Message-ID: <199710310932.LAA11096@ankara.duzen.com.tr> October 30, 1997 Web posted at: 9:34 p.m. EST (0234 GMT) ROBY, Illinois (CNN) -- Shirley A. Allen, a mentally disturbed woman who held police off for 39 days with a shotgun and entertained herself by listening to public radio, was captured Thursday and taken to a hospital. "The good news is she's safe," said Terrance Gainer, Illinois state police director. "The great news is nobody got seriously hurt or killed." The standoff ended when Allen ventured out on the deck behind her home to throw away food and water left for her by the police. On her third trip, she stooped to cut a wire attached to a pail in which a police camera was hidden. A trooper fired six rubber bullets at her, striking her two or three times and knocking her to the deck, where she was captured. Gainer said that Allen, who wore a full camouflage suit padded with a pillow and magazines, was examined at a hospital and reported to be in good condition was feisty enough after the ordeal to scold police for their tactics during the standoff. Gainer said she is still in custody and will undergo a psychiatric examination. "I think she's probably as relieved right now as we are that this is over," said Allen's brother, Byron Dugger, who talked with her after she was captured. Gainer said Allen asked Dugger to open his mouth to prove he wasn't someone wearing a mask that looked like him. 'They have zapped my head with radar' The standoff in this small central Illinois town began September 22 when Allen, 51, brandished a shotgun as her brother and sheriff's deputies tried to take her in for a court-ordered evaluation. Allen's relatives were concerned because she had become increasingly depressed and paranoid since her husband died of pancreatic cancer in 1989. More recently, she had refused to see or talk to her brother or her 86-year-old mother. In a letter to her mother in May 1996, Allen wrote, "They have zapped my head with radar. I have swelling and inflammation of the brain." She did not say who "they" were, but when police offered her water after she was captured, she said "the helicopters" told her not to drink it. There were no helicopters in sight, but she finally drank the water after troopers drank some to prove it wasn't poisoned. She told them she hadn't eaten or had anything to drink in three days. Allen also talked to her daughter, Kate Waddell, after she was captured. "But she wasn't quite sure it was Mrs. Waddell," Gainer said. Allen's case attracted the sympathy of many neighbors and became a rallying point for some who called it "Roby Ridge," likening it to shootouts at Ruby Ridge, Idaho, and Waco, Texas, as an example of overzealous law enforcement. Standoff cost taxpayers about $1 million Others questioned the expense of the standoff. Gainer tackled that one head-on at a news conference Thursday, saying it was about $15,000 a day. He estimated the total cost of the operation at $750,000 to $1 million. Obviously relieved that Allen was taken alive, an unapologetic Gainer said, "But I don't think Mrs. Shirley Allen is worth a cent less than that." Police tried to get Allen out of her green frame farmhouse with tear gas, pepper spray and music. They also tried to coax her out with a visit from her favorite stepdaughter. This week, they began giving her food and restored her power, which had been shut off earlier, in a goodwill gesture they hoped would calm her down. Allen had fought off tear gas by smearing her face with petroleum jelly and withstood beanbag bullets by wearing heavy layers of clothing. She apparently slept in a sleeping bag in the living room -- the room where her husband died -- and had two transistor radios with earplugs. Gainer said the radios were tuned to a local public radio station. Protesters gathered daily to support her and criticized the police. 'Mrs. Allen is where she needs to be' "The good feeling is it's over for her. The bad feeling is how she's going to be trapped after this is over with," said John Powers, a neighbor and one of the protesters. "We don't know if they'll treat her as a person who is sane or as a person who tried to shoot their dog." Although Allen fired at state troopers and wounded a police dog sent into her home Sunday, "it would serve no useful purpose to charge her," Gainer said. "Given what we have known from Day 1, Mrs. Allen is where she needs to be right now." Reporter Lisa Price and The Associated Press contributed to this report. From lurker at ottoman.net Fri Oct 31 00:43:29 1997 From: lurker at ottoman.net (lurker at ottoman.net) Date: Fri, 31 Oct 1997 16:43:29 +0800 Subject: No Subject Message-ID: <199710310933.LAA11099@ankara.duzen.com.tr> October 30, 1997 Web posted at: 9:34 p.m. EST (0234 GMT) ROBY, Illinois (CNN) -- Shirley A. Allen, a mentally disturbed woman who held police off for 39 days with a shotgun and entertained herself by listening to public radio, was captured Thursday and taken to a hospital. "The good news is she's safe," said Terrance Gainer, Illinois state police director. "The great news is nobody got seriously hurt or killed." The standoff ended when Allen ventured out on the deck behind her home to throw away food and water left for her by the police. On her third trip, she stooped to cut a wire attached to a pail in which a police camera was hidden. A trooper fired six rubber bullets at her, striking her two or three times and knocking her to the deck, where she was captured. Gainer said that Allen, who wore a full camouflage suit padded with a pillow and magazines, was examined at a hospital and reported to be in good condition was feisty enough after the ordeal to scold police for their tactics during the standoff. Gainer said she is still in custody and will undergo a psychiatric examination. "I think she's probably as relieved right now as we are that this is over," said Allen's brother, Byron Dugger, who talked with her after she was captured. Gainer said Allen asked Dugger to open his mouth to prove he wasn't someone wearing a mask that looked like him. 'They have zapped my head with radar' The standoff in this small central Illinois town began September 22 when Allen, 51, brandished a shotgun as her brother and sheriff's deputies tried to take her in for a court-ordered evaluation. Allen's relatives were concerned because she had become increasingly depressed and paranoid since her husband died of pancreatic cancer in 1989. More recently, she had refused to see or talk to her brother or her 86-year-old mother. In a letter to her mother in May 1996, Allen wrote, "They have zapped my head with radar. I have swelling and inflammation of the brain." She did not say who "they" were, but when police offered her water after she was captured, she said "the helicopters" told her not to drink it. There were no helicopters in sight, but she finally drank the water after troopers drank some to prove it wasn't poisoned. She told them she hadn't eaten or had anything to drink in three days. Allen also talked to her daughter, Kate Waddell, after she was captured. "But she wasn't quite sure it was Mrs. Waddell," Gainer said. Allen's case attracted the sympathy of many neighbors and became a rallying point for some who called it "Roby Ridge," likening it to shootouts at Ruby Ridge, Idaho, and Waco, Texas, as an example of overzealous law enforcement. Standoff cost taxpayers about $1 million Others questioned the expense of the standoff. Gainer tackled that one head-on at a news conference Thursday, saying it was about $15,000 a day. He estimated the total cost of the operation at $750,000 to $1 million. Obviously relieved that Allen was taken alive, an unapologetic Gainer said, "But I don't think Mrs. Shirley Allen is worth a cent less than that." Police tried to get Allen out of her green frame farmhouse with tear gas, pepper spray and music. They also tried to coax her out with a visit from her favorite stepdaughter. This week, they began giving her food and restored her power, which had been shut off earlier, in a goodwill gesture they hoped would calm her down. Allen had fought off tear gas by smearing her face with petroleum jelly and withstood beanbag bullets by wearing heavy layers of clothing. She apparently slept in a sleeping bag in the living room -- the room where her husband died -- and had two transistor radios with earplugs. Gainer said the radios were tuned to a local public radio station. Protesters gathered daily to support her and criticized the police. 'Mrs. Allen is where she needs to be' "The good feeling is it's over for her. The bad feeling is how she's going to be trapped after this is over with," said John Powers, a neighbor and one of the protesters. "We don't know if they'll treat her as a person who is sane or as a person who tried to shoot their dog." Although Allen fired at state troopers and wounded a police dog sent into her home Sunday, "it would serve no useful purpose to charge her," Gainer said. "Given what we have known from Day 1, Mrs. Allen is where she needs to be right now." Reporter Lisa Price and The Associated Press contributed to this report. From shamrock at cypherpunks.to Fri Oct 31 00:58:23 1997 From: shamrock at cypherpunks.to (Lucky Green) Date: Fri, 31 Oct 1997 16:58:23 +0800 Subject: PGP 5.5 available outside US In-Reply-To: <199710310747.IAA13847@basement.replay.com> Message-ID: On Fri, 31 Oct 1997, Anonymous wrote: > > > It seems that unknown Cypherpunks have yet again shown their disrespect of > > US export laws by exporting the latest version of PGP. The Windows version > > of PGP 5.5 is now available for your downloading pleasure at > > ftp://ftp.replay.com/pub/crypto/incoming/PGP55.zip > > > -- Lucky Green PGP encrypted email preferred. > > "Tonga? Where the hell is Tonga? They have Cypherpunks there?" > > First, a PGP employee announces that PGP 5.5 is available for download. Let me state that I am not now, nor have I ever been, an employee of PGP. I simply noticed what I thought to be PGP 5.5 on a well known FTP site. Sorry if it was a dud. -- Lucky Green PGP encrypted email preferred. "Tonga? Where the hell is Tonga? They have Cypherpunks there?" From tm at dev.null Fri Oct 31 01:02:04 1997 From: tm at dev.null (TruthMonger) Date: Fri, 31 Oct 1997 17:02:04 +0800 Subject: democracy?! (Re: Terrorism is a NON-THREAT (fwd)) (fwd) In-Reply-To: <199710310315.VAA21770@einstein.ssz.com> Message-ID: <34599D8F.2856@dev.null> Jim Choate wrote: > Juries are supposed to be composed of your peers, not who the prosecution or > defence believe will best support their case. It should be that the first 12 > poeple called who don't have a valid excuse to be excused are the jury, the > next 12 are the back-ups. You're way off base here, Jim. As a matter of fact, the government goes to extraordinary lengths to make certain that we get a jury of our peers. For example, potential jurists in murder trials are required to admit to supporting the government murder of the defendant if he or she is convicted. God forbid they should ask what procedures are in place for bringing the defendant back to life if their verdict turns out to be in error. I like many others, have committed a wide variety of crimes for which I could be sentenced and punished, but the only two I was charged for and found guilty of were crimes of which I was completely innocent. Go figure... > This would guarantee that getting a conviction for > anything other than the most heinous crime with the most explicit and > incontrovertible evidence will be well nigh impossible, as it should be in a > democracy. It should be a mother fucker to put somebody in jail in this > country. 'Circumstantial evidence' has been twisted and perverted in the justice system to the point where it is synonymous with convicting the 'best guess' candidate for a crime. The problem with the '*someone* has to pay' school of jurisprudence in vogue today is that poorly paid, poorly trained street officers are often responsible for making the decisions as to *who* will be the person selected as the 'best guess' candidate. (At which point the wheels of law enforcement and the injustice system begin rolling over the back of the defendant, leaving tire marks suspiciously similar to those at the scene of the crime.) > Judges should not be able to tell someone they need permissio to file a > legal complaint. Nor should a judge be able to refuse a juries request to > have testimony transcribed because it costs too much. That isn't justice, > that is systemic expediency and criminal indiference. You have hit on what I regard as the single greatest evil in the justice system today--expediency. At the heart of 'expediency' lies the 'plea bargain.' Police and prosecutors are fully aware that their greatest chance of success in turning a potential 'loss' into a 'win' is with a person, guilty or innocent, who they can deal with as a first time offender. The prosecutor can use dire threats of 'maximum prosecution' to convince the person to take a 'slap on the wrist' to avoid taking a chance of suffering devastating consequences. What their victims don't realize is that they will now be a 'known offender', an automatic 'suspect' in the future, and subject to exceedingly more severe penalties in the future for their real or imagined crimes. I know a person who is serving a life sentence as a habitual offender for a 'third' felony because his legal aide attorney years ago had gotten him a 'helluva deal' on a DWI, only having to pay a small fine and no loss of license (back when this was still possible). Although the man was a non-drinker, having a liver condition that meant he would die if he consumed enough alcohol to be over the legal limit, he had never been 'diagnosed' as such, having no need to, since it was a known hereditary condition in his family. His legal aide lawyer pointed out the enormous expense of being diagnosed, etc, and the fact that a DWI was only a "small, insignificant" felony at the time. Many years later, the 'third felony', for which he was sentenced to life in prison, was for bouncing a $10.00 check, or some such. The irony is that he was always a big law and order supporter, and probably cheered when the 'third time loser' law was passed. (I wonder if the $10.00 bounced check was to the campaign of his favorite 'law and order' politician?) > Paying a government to keep the park clean and mowed and the lights on at > night or my streets well paved and de-iced in winter is not quite the same > thing as having black-suited ninja wann-be's kicking my door in at 2AM > because I choose to smoke a joint or even grow my own weed; or spend six > weeks in jail for possessing vitamins that some cop THINKS is drugs; or > perhaps because I happen to be a doctor and know how to read and might take > exception to being told what I can or can't say; or because I might be of > Jewish decent or a Muslim or a Catholic or Anglo or Negro; or etc. etc. Or you might be Timothy O'Leary, crossing the American border (in Texas?) with a couple of marihuana seeds in the ashtray. (40 years in the slam?) TruthMonger From nobody at REPLAY.COM Fri Oct 31 01:27:13 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 17:27:13 +0800 Subject: Archives? Message-ID: <199710310825.JAA18745@basement.replay.com> Is there an archive of various papers concerning such things as Assassination Politics, Eternity Servers, Reputation Capital, The Blowfish Cipher, CROWDS, encryption of IP traffic, etc.? From blancw at cnw.com Fri Oct 31 01:32:30 1997 From: blancw at cnw.com (Blanc) Date: Fri, 31 Oct 1997 17:32:30 +0800 Subject: What Will Revolution Look Like? Message-ID: <3.0.32.19971031012859.006c9b7c@cnw.com> Tim May wrote: >No, the revolution, when it comes, will likely be different from anything >quite like we've seen to date. .................................................... In the revolution against the British, the U.S. was a small colony sitting on a vast "new" land, with the Natives but a minor obstacle to expansion. Presently there is no such unoccupied place which could be claimed for the cause of liberty, and revolutionaries are sitting in the middle of the enemy camp, surrounded everywhere by people who "just want to save lives". You could temporarily send a political message and get your names in the news, but then totally lose the war from being outnumbered and overwhelmed by non-sympathizers. A long time ago it was possible, given the distance of water and land between peoples, to make a break with them physically. The enemy could be driven out, sent "home", and the winners could develop their new living arrangements in the new setting. But there is no new setting to go to, there is nowhere to send the infidels. The life of a new libertarian "society" would have to be created as a virtual one, existing among or in-between the others. Of course the basis of the original setup is still mentioned every once in a while, and so it is still in the minds of everyone, even if only as a dim reference, so it could be said that the most a current revolution could accomplish would be the return of the original ideal to the minds of the population. But I think that it would take much more than a few skirmishes to accomplish that, as it doesn't appear that it carries all that much support. It would be like getting a kid to take down some medicine; many don't really want to live so independently, nor feel the need to identify what kind of life would be the more ideal (i.e. they don't identify precisely the difference between a socialist atmosphere and a libertarian one, nor concern themselves with why they should spend any time worrying about the difference it makes.) An intentional revolution, I fear, would just look like an attempt to make people think. And therefore not taken too seriously. (And if the revolutionaires lose? tough luck. Oh, well. Gotta go to work in the morning.) .. Blanc From nobody at REPLAY.COM Fri Oct 31 02:27:39 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 18:27:39 +0800 Subject: North CA cops skip preliminaries, get straight to torture Message-ID: <199710311021.LAA29625@basement.replay.com> Tim May wrote: > > At 9:14 PM -0700 10/30/97, Anonymous wrote: > > > This non-violent demonstrators were willing to accept the agreed > >upon punishment/cost of their actions in protest of the actions > >of their public servants. Their public servants, as usual, chose > >to to act in the manner of savages who are incapable of holding > >to the rule of law which they use to justify their confiscation > >of the citizen's right to bear arms in the face of tyranny. > > Excuse me, but this modern notion that protestors get to "make a deal" > about the fines they'll eventually pay is bogus. If they're trespassing, > they're trespassing. They don't get to take over Intel's factory, chain > themselves to the Evil Factory doors, and then make a deal to pay some > token fine. Perhaps I was unclear, but I was refering to the _ancient_ notion that once one has crawled out of the primeval swamp and begun to walk upright, that they should work on controlling their animal passions to the extent that they abide by the agreements they have sworn to uphold, regardless of whether the people they are being paid to serve have pissed them off. Am I mistaken in my impression that they did not take over Intel's factory? How is your mind holding up, Tim? Can you remember details of your life that don't have to do with Intel? {Not that I haven't sunken in to remeniscing about my life during several posts today. I suppose it is only a matter of time until we are all Grouchy Old Cypherpunks inundating the list with posts about who died, who has prostrate cancer, and who broke their hip trying to close that darned new-fangled nuclear suitcase.} > Like the AIDS protestors who "arrange" a deal whereby they'll shut down the > Golden Gate Bridge for several hours and then pay their arranged $50 > tickets. Do you know about some 'deal' of which I am not aware in this situation or shall we discuss the _real_ events which took place in Humboldt? > Well, what's wrong with me driving up to the head of the sit-down protest > and saying to the cops standing idly by, "Hey, there are some queers in the > middle of the road, blocking my trip to Marin. If you're just gonna let em > sit there for hours, putting my business and plans at risk, I'm just gonna > gun my engine and drive right over their fairy asses." To tell the truth, I really don't have any problem with _you_ doing so. I _would_ have a problem with the cops doing so, however, which is a point I am trying to make. It may be the policeman's job and/or duty to arrest and imprison the people involved, but it is in no way their duty or right to _punish_ the people by invoking a level of violence which is not necessary to accomplish the job. I don't really care if it is _difficult_ for the policemen to deal with the physical details of imprisoning the people. And I don't have a lot of sympathy for the protesters if they get bumped and bruised in the process of the police honestly doing their job. However, it is unconscienable for officers to inflict pain and suffering on the protesters for no other reason than to punish them for making the policeman's job difficult and defying authority. > Crimes are crimes, not "guerilla theater." Not "performance art." Such as dumping tea in Boston harbor to protest oppressive taxation? > > Twenty years or so ago, after seeing pictures of mothers and > >children in chains at a Livermore Labs protest, I wrote a song > >called "Don't Blame Me, I Voted For The Monkey." > > I had a much better idea back then. Leave the mothers and childrens chained > to the fences and gates. > > Pull back from them, erect a cordon around them, and block anyone from > approaching. They wanted to be chained to the fence, sans keys, so let > them have their wish. Fucking eh! I wish you had been in charge back then. I thought it was ridiculous for LEA's to play to protesters desires by escalating situations beyond what was really needed because of some perceived threat to their authority. > Others could show up to throw stuff at them, and place bets on who would be > the last to die. > > And, as the flesh dripped off and the bones whitened, it might be a nice > object lesson for the others. Say, that's not a 'red bandana' on your neck, is it? WhiteSocksAndBlueRibbonBeerMonger From jya at pipeline.com Fri Oct 31 02:27:47 1997 From: jya at pipeline.com (John Young) Date: Fri, 31 Oct 1997 18:27:47 +0800 Subject: What Will Revolution Look Like? Message-ID: <1.5.4.32.19971031102712.00c3d2dc@pop.pipeline.com> Preindicators to revolution and anti-revolution in US: World's highest disparity between poor and rich population. World's highest military expenditures. World's highest justice expenditures. World's largest percentage of population in prison. World's largets percentage of population in law enforcement. World's largest percentage of work force as private guards. World's largest number of guns in private hands. World's largest number of guns in law enforcement hands. World's greatest number of lawyers. World's greatest number of laws. World's greatest number of lawbreakers. World's highest violent crime rate. World's highest "postals." World's highest homicide rate against family members. World's highest homicide rate against authority members. World's greatest percentage of unwed mothers (and absent fathers). World's greatest percentage of men who do not pay child support. World's highest divorce rate. World's highest multiple marriage rate. World's largest number of institutionalized children. World's largest number of psychiatric patients. World's largest number of legal drugs consumers. World's largest number of illegal drugs consumers. World's largest number of protestors. World's largest number of anti-protestors. World's largest percentage of unresponsive population. World's largest percentage of blind faith population. From tm at dev.null Fri Oct 31 02:28:56 1997 From: tm at dev.null (TruthMonger) Date: Fri, 31 Oct 1997 18:28:56 +0800 Subject: Ms. Roby Ridge of 1997 Crowned several times... In-Reply-To: <199710310933.LAA11099@ankara.duzen.com.tr> Message-ID: <3459A08E.77D@dev.null> lurker at ottoman.net wrote: > ROBY, Illinois (CNN) -- Shirley A. Allen, a mentally disturbed woman > who held police off for 39 days with a shotgun and entertained herself > by listening to public radio, was captured Thursday and taken to a > hospital. ... > Others questioned the expense of the standoff. > Gainer tackled that one head-on at a news conference Thursday, saying > it was about $15,000 a day. He estimated the total cost > of the operation at $750,000 to $1 million. ... > "...said John Powers, a neighbor and one of the > protesters. "We don't know if they'll treat her as a > person who is sane or as a person who tried to shoot > their dog." What are the chances of her being found 'sane' if it might result in a multi-million dollar lawsuit against the same government who assaulted her out of Choatian expediency instead of investing some 'quality time' in sharing a few cups of coffee with her in order to avert such a ludicrous scenarios? My guess is that whoever is chosen to declare her 'batty' has a bright, successful career ahead of them. (But I would love to be pleasantly surprised.) TruthMonger From nobody at REPLAY.COM Fri Oct 31 02:29:13 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 18:29:13 +0800 Subject: PGP 5.5 available outside US Message-ID: <199710311022.LAA29789@basement.replay.com> Lucky Green wrote: > Let me state that I am not now, nor have I ever been, an employee of PGP. I knew that! I must have eaten too many of the yellow ones tonight to keep track of my Crayola lines. I'd better eat a couple more of the red ones to get myself back on track. > I simply noticed what I thought to be PGP 5.5 on a well known FTP site. > Sorry if it was a dud. Thanks for the pointer, just the same. > -- Lucky Green PGP encrypted email preferred. > "Tonga? Where the hell is Tonga? They have Cypherpunks there?" Oh, I see my mistake! I had Caesar, wearing a 'Toga', connected to the anti-Christ with a red Crayola line, and mistook it for 'Tonga'. No problem, I'll just eat a couple of the brown Crayola's and throw three Hail Flutie's. Still Anonymous (except to Lucky) From jya at pipeline.com Fri Oct 31 02:41:14 1997 From: jya at pipeline.com (John Young) Date: Fri, 31 Oct 1997 18:41:14 +0800 Subject: Ashcroft on Crypto TV Message-ID: <1.5.4.32.19971031103720.00c641a4@pop.pipeline.com> News report: This weekend, Washington Watch, Court TVs public affairs program covering legal and judicial policy in the nations capital, will feature a discussion with Senator John Ashcroft (R-MO). The senator will discuss encryption, intellectual property on the internet, and his opposition to the nomination of Margaret Morrow, a Los Angeles business lawyer and former state bar association president selected by President Clinton for a federal judgeship. From gbroiles at netbox.com Fri Oct 31 03:11:55 1997 From: gbroiles at netbox.com (Greg Broiles) Date: Fri, 31 Oct 1997 19:11:55 +0800 Subject: Jim Bell sentencing delayed Message-ID: <3.0.2.32.19971031030811.006d3050@pop.sirius.com> According to PACER, Jim Bell's sentencing has been postponed yet again; the sentencing was originally scheduled for 9/17, which was continued to 10/31, which was continued (via an order on 10/24) until 11/21/97 at 9:00 AM. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles at netbox.com | Export jobs, not crypto. http://www.io.com/~gbroiles | http://www.parrhesia.com From jya at pipeline.com Fri Oct 31 03:16:12 1997 From: jya at pipeline.com (John Young) Date: Fri, 31 Oct 1997 19:16:12 +0800 Subject: Crypto Biz Message-ID: <1.5.4.32.19971031110817.00c6180c@pop.pipeline.com> Rep. Solomon hits SAFE and biz; BXA hits FBI and biz: http://jya.com/cn103197.txt From nobody at REPLAY.COM Fri Oct 31 03:18:11 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 19:18:11 +0800 Subject: Archives? Message-ID: <199710311108.MAA04659@basement.replay.com> Anonymous wrote: > > Is there an archive of various papers concerning such things as Assassination > Politics, Eternity Servers, Reputation Capital, The Blowfish Cipher, CROWDS, > encryption of IP traffic, etc.? Anonymous, worried that answering himself might lead to being incarcerated against his will for a mental evaluation, replies: Tim C. May is a living archive of these issues and technologies, but it is a bad idea to show up on his doorstep, unannounced. However, it is sometimes possible to sneak into a website to be found at http://jya.com/ and get out alive with as much information as you are capable of stuffing into your CyberPockets during your sojourn into the bowels of Cryptocracy. If you enjoy browsing leisurely through odd piles of obscure posts on all of the above, and more, the Infinity website CPUNX archive can be found at http://infinigy.nus.sg/cypherpunks (Of particular classical value are the many [ADMINISTRAVIUM] posts which contain valuable graphical representations of some of the more arcane CPUNX traditions.) AlwaysHappyToHelpMonger From frissell at panix.com Fri Oct 31 03:33:57 1997 From: frissell at panix.com (frissell at panix.com) Date: Fri, 31 Oct 1997 19:33:57 +0800 Subject: Protocols for Insurance to Maintain Privacy In-Reply-To: <199710291412.GAA29666@sirius.infonex.com> Message-ID: <3.0.2.32.19971031062509.03c35890@panix.com> -----BEGIN PGP SIGNED MESSAGE----- At 09:24 AM 10/29/97 -0700, Tim May wrote: >And of course in Mexico and other "backward" places, where such >reimbursement f office visits is considerably different, so-called >prescription drugs are available at nearly all corner pharmacies. Lots of >Americans make the drive from San Diego to Tijuana to buy prescription >drugs either too expensive (those doctors visits) or unavailable in the >U.S. And the Customs department at the border has pretty much given up on >stopping people from carrying personal-use quantities. (The gay lobby >exerted a lot of influence on this, as gays travel to Tijuana to pick up >medicines they think are effective, whether approved in the U.S. for gay >cancers or not.) > This can be done by mail as well. See: "How to Buy Almost Any Drug Legally Without a Prescription" by James Johnson. DCF -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNFnAE4VO4r4sgSPhAQEhHQP8C3WjwU4QIpRbAqvGBCNpPjALD2ux4FJS bC2Mt0FHy8XMyAlkpCPOwk5u9oXM5R83dc3y+wsmwW47oH5COEXZDQ6GFmgbe/49 Kp4GpLNF+DdcoSymN3gRSYXQhWMsnXNu10mUtYY4lg+mG/6D0xWRIeEFx4PrlAwC 1txzmME5qSs= =ZfZQ -----END PGP SIGNATURE----- From nobody at REPLAY.COM Fri Oct 31 03:55:31 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 19:55:31 +0800 Subject: The reason we need to give up our rights... Message-ID: <199710311146.MAA08928@basement.replay.com> We are told that we must give up our right to privacy in order for the government to protect us from the horrors of child molesters, et al. Recently, a Canadian man was charged with 572 instances of having individual and group sex with pre-teenage boys. He was sentenced to a 'duece-less' (two years less a day), which is 'soft time' in Canada, and is served in a provincial jail instead of a federal institution. We are expected to give up our right to privacy so that the sores on our children's bums can be healed just in time for this guy to get out and have another go at them? Would it be ridiculous to suggest that the government *needs* this man back out on the streets in 16 months (if he does 'good time') because there is a shortage of child molesters to hold over our heads for their next attack on our rights and liberties? Hell, give Tim McVeigh a pardon, and then use it for an excuse to make use of compost in the commission of a crime a felony. Personal not to FedUpMonger: I'm just OldAndTiredMonger. I don't need this shit anymore. From anon at anon.efga.org Fri Oct 31 03:57:42 1997 From: anon at anon.efga.org (Anonymous) Date: Fri, 31 Oct 1997 19:57:42 +0800 Subject: The reason we need to give up our rights... Message-ID: <2d531f1a3bd67fb025b10fe779f2bd10@anon.efga.org> We are told that we must give up our right to privacy in order for the government to protect us from the horrors of child molesters, et al. Recently, a Canadian man was charged with 572 instances of having individual and group sex with pre-teenage boys. He was sentenced to a 'duece-less' (two years less a day), which is 'soft time' in Canada, and is served in a provincial jail instead of a federal institution. We are expected to give up our right to privacy so that the sores on our children's bums can be healed just in time for this guy to get out and have another go at them? Would it be ridiculous to suggest that the government *needs* this man back out on the streets in 16 months (if he does 'good time') because there is a shortage of child molesters to hold over our heads for their next attack on our rights and liberties? Hell, give Tim McVeigh a pardon, and then use it for an excuse to make use of compost in the commission of a crime a felony. Personal not to FedUpMonger: I'm just OldAndTiredMonger. I don't need this shit anymore. From jya at pipeline.com Fri Oct 31 04:05:21 1997 From: jya at pipeline.com (John Young) Date: Fri, 31 Oct 1997 20:05:21 +0800 Subject: Jim Bell sentencing delayed Message-ID: <1.5.4.32.19971031120116.00c62d58@pop.pipeline.com> Greg, What's your take on repeated delay in Jim's sentencing: 1. A squeeze on Jim to finger co-conspirators. 2. Weak case, must use procedure to punish. 3. To let time served be the sentence. 4. Jim was up to something worse now being discovered (like 5 below). 5. Jim is a secret gov agent, now feet up in Tacoma IRS laughing at those who fell for suckerbait, screwball AP written by IRS as a sting (a recent book package to Jim was returned marked "Not in Jail"). 6. The court was hoodwinked by IRS, too, and the AUSA is preparing an indictment of the stingers and federal defenders and who knows who else that was in on it. 7. Secret Agent Jim is squealing on his double-crossing secret agents, cutting a deal with whoever else is double- crossing whomever. He's going down, they're going down, we're going down, the whole country's going down; Up the Revolution! From nobody at REPLAY.COM Fri Oct 31 04:32:37 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 20:32:37 +0800 Subject: Protocols for Insuran Message-ID: <199710311226.NAA13587@basement.replay.com> Monty Cantsin wrote: > The Emergency Room Scenario is a little more challenging. One > way to deal with it is to wear some obvious signs of wealth like > a $10,000 watch. In a pinch you can give them the watch. ;-) > (Some of the nurses won't know what it is, but the doctors will, > I am sure.) Except that very likely you'll be in the Emergency Room in the first place, because you got shot during the mugging for your watch -:) Does that count as "evolution in action" too? :) From frissell at panix.com Fri Oct 31 04:42:37 1997 From: frissell at panix.com (frissell at panix.com) Date: Fri, 31 Oct 1997 20:42:37 +0800 Subject: Protocols for Insurance to Maintain Privacy In-Reply-To: <7433f6e11aa46cf7b903a8251c3e35b5@squirrel> Message-ID: <3.0.2.32.19971031064814.03c38e18@panix.com> -----BEGIN PGP SIGNED MESSAGE----- At 09:33 AM 10/30/97 -0700, Tim May wrote: >Listed prices are the "sucker rates," kind of like the posted prices for >out-of-towners, with locals getting a discount. And these pricing >differences apply to the whole range of procedures. For example, an >insurance company might have negotiated--over many years of intense >negotiations--a fee of $100,000 for a liver transplant, but a "cash-paying >customer" (a victim, a mark, a sucker) would pay the list price, e.g., >$300,000. > >Could I negotiate a lower room rate, and lower fees for a spectrum of >possibly needed treatments? Probably. I haven't had to try, fortunately. >(Nor am I knowledgeable about procedures. Nor am I patient negotiator, no >pun intended.) You can negotiate in advance. Many doctors will cut their rates for surgery if you tell them you are uninsured. We actually called around to a number of hospitals recently to see if they would discount a birth for cash up front and we were able to find hospitals willing to cut their rates. A 50% cut seems the standard range. >Just noting that cash is not always king. Especially to any medium-sized or >larger hospital, where filling out the forms correctly is more important >than getting paid in cash. (My dentist's receptionist is befuddled by my >paying in cash. She clearly prefers to just enter the number of an >insurance company.) The magic words are "Hill-Burton Act." Most hospitals have accepted Hill- Burton Act funding and are required to admit people with or without insurance. Some resist of course. >I have so far elected to self-insure, i.e., to just pay any medical bills I >might have out of pocket. However, given this "sucker rate" and the >increasing unwillingness of hospitals to take patients not in health care >or insurance programs, I may have little choice but to sign up. Me too. In 20 years, however, you and I will be drafted into Medicare (against our wills) unless the system is substantially modified by then (the most likely outcome). DCF -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNFnFfIVO4r4sgSPhAQHRUgP/b9QZr/Z0UtKWCdEiOkfRaIQEnRMEWYKF FWEdiIjYmHldqsxTjtrICGsI4AQm/fyKEhGq5ED+vLt9rOeElz1j6IlmLCj+Hb1m QSFAUxyLpODYpPGs5+sofTnwHABHHW3fMk3aBSwqqHuh8BK7fSCIBOmAU3kLrJbp QkeAHQb6h3g= =KE8a -----END PGP SIGNATURE----- From T.G.Griffiths at exeter.ac.uk Fri Oct 31 04:44:47 1997 From: T.G.Griffiths at exeter.ac.uk (Tim Griffiths) Date: Fri, 31 Oct 1997 20:44:47 +0800 Subject: democracy?! (Re: Terrorism is a NON-THREAT In-Reply-To: <878300037.16771.193.133.230.33@unicorn.com> Message-ID: <43e6aee147%Tim@tim01.ex.ac.uk> Mark wrote: > > Jim Choate wrote: > Indeed. Yet in a democracy, any two other members are assumed to know > better than me, and any 51% to know better than the other 49%. > > Democracy is merely the scoundrel's last attempt to maintain the divine > right of kings by coverting it into the divine right of the elected. > > >Which means we should have the lowest number of incarcerated individuals > >instead of the most. Does it? Or does it mean that we potentially have 49% of the population in jail for any particular act, deemed to be a crime by the remaining 51%? Tim G. From frissell at panix.com Fri Oct 31 04:46:13 1997 From: frissell at panix.com (frissell at panix.com) Date: Fri, 31 Oct 1997 20:46:13 +0800 Subject: Protocols for Insurance to Maintain Privacy In-Reply-To: Message-ID: <3.0.2.32.19971031065319.03c39b24@panix.com> -----BEGIN PGP SIGNED MESSAGE----- At 08:11 PM 10/30/97 -0500, Dave Emery wrote: >On Thu, Oct 30, 1997 at 09:33:52AM -0700, Tim May wrote: > >> Turns out that Blue Cross and Blue Shield have negotiated, through enormous >> buying power, daily rates of about $700 a day. (These numbers come from my >> memory of a "60 Minutes" report a few years ago. Details and current >> figures may vary.) >> > My wife is a pathologist, and she tells me that some of the more >aggressive HMOs get away with paying 15-20% of the posted "official" prices >for procedures and tests. The difference between what insurance >organizations pay and the nominal price is usually 2 to 3 to 1 for most >things these days. And for many years Medicare has set defined prices >for medical reimbursement that less than the gold plated bill amount >as well. The WSJ had an article about a guy who found out that his HMO had negotiated a payment rate which was less than his *copay* on the procedure so the insurance company paid nothing for his hospitalization at all. DCF -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNFnGrYVO4r4sgSPhAQEBHQQAuHnkSWEtcwJbmOZqiPImpB7pHy0nTcI4 N0XPTiir5XYYS12f8hmbA9EuN266R/8nKbE2LR5hm5VqQ2Tagimo7gKwrWpfKYtK OxNVLHuEOF0AiB8H15+J2JNUnLECR5N7rhcMDsDNkZfxYK8wxHAMrFBVeVNfhdqA UaW7pG8IQFA= =qFrU -----END PGP SIGNATURE----- From frissell at panix.com Fri Oct 31 04:48:41 1997 From: frissell at panix.com (frissell at panix.com) Date: Fri, 31 Oct 1997 20:48:41 +0800 Subject: What Will Revolution Look Like? In-Reply-To: <1.5.4.32.19971031102712.00c3d2dc@pop.pipeline.com> Message-ID: <3.0.2.32.19971031070254.03c39b24@panix.com> -----BEGIN PGP SIGNED MESSAGE----- At 05:27 AM 10/31/97 -0500, John Young wrote: >Preindicators to revolution and anti-revolution in US: > >World's highest disparity between poor and rich population. You mean "in OECD countries other than Turkey" rather than in the "world", right? >World's largest percentage of population in prison. You mean "in OECD countries other than Turkey" rather than in the "world", right? >World's largets percentage of population in law enforcement. North Korea? >World's greatest number of laws. More laws lots of places (per capita, of course). >World's highest violent crime rate. You mean "in OECD countries other than Turkey" rather than in the "world", right? >World's highest homicide rate against family members. You mean "in OECD countries other than Turkey" rather than in the "world", right? >World's highest homicide rate against authority members. You mean "in OECD countries other than Turkey" rather than in the "world", right? -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNFnI7IVO4r4sgSPhAQHHNAP/aXoDb3dzNIJjkvoW128dpeIzu/8NJaG+ a+keUfYFGpc9nd+j+VsI1x26CFahjn4gstQ9wCTLCesuhBrrKdS1dktO1RSz3ZXT geZctbdHA3CHldcIMqzEl/V/BWDIqxRp6ZnnqGlfgRIqvUvBNZUZyTtOp/myevpI j61T6YfM/Pw= =OhKs -----END PGP SIGNATURE----- From nobody at REPLAY.COM Fri Oct 31 04:57:01 1997 From: nobody at REPLAY.COM (Anonymous) Date: Fri, 31 Oct 1997 20:57:01 +0800 Subject: Protocols for Insuran Message-ID: <199710311224.NAA13370@basement.replay.com> alan at ctrl-alt-del.com wrote: > Actually, the real "sucker rates" are the amounts small > > businesses pay for insurance. > The big businesses (who can buy in bulk) get a pretty reasonable > deal for what they get. The smaller companies who cannot > bargain the price down get screwed. (The rate my wife's > employer was paying was close to double what my insurance costs > and it covered ALOT less.) > I seriously doubt that most people could afford to self-insure > at the going rate. (Not unless they have some serious income > they want to get rid of.) Think of this as "evolution in action" From mark at unicorn.com Fri Oct 31 04:57:15 1997 From: mark at unicorn.com (mark at unicorn.com) Date: Fri, 31 Oct 1997 20:57:15 +0800 Subject: democracy?! (Re: Terrorism is a NON-THREAT Message-ID: <878300037.16771.193.133.230.33@unicorn.com> Jim Choate wrote: >If we as individuals can't make our own decisions about what is best for us, >what makes you think some stranger will do any better? Indeed. Yet in a democracy, any two other members are assumed to know better than me, and any 51% to know better than the other 49%. >Every form of government other than democracy assumes a >priori that noble oblige is prima facia. To paraphrase an old questions of >politics, who governs the governors? Or do you feel we have found angels in >the form of kings? Democracy is merely the scoundrel's last attempt to maintain the divine right of kings by coverting it into the divine right of the elected. >Which means we should have the lowest number of incarcerated individuals >instead of the most. Indeed, thereby proving that democracy *doesn't* work. >Doesn't work what way? Midnight raids, anti-drug laws, all the examples you just gave of the evils of democracy, etc, etc. >Consider, other than democracy, that every form of >government has an implicit assumption that there is some base sets of >activities that citizens should be permitted and they will be happy. Someone (Churchill?) once said that democracy is the best form of goverment. Amusingly he considered this a defence of democracy, not a damning indictment of the entire concept of government. >In a >democracy the people are given the opportunity to make up their mind what to >do with their lives and property without having to obtain permission from >some authority. Medical licensing, drivers licenses, pilots licenses, export restrictions, gun licenses (in various democracies), concealed weapons permits... do I have to go on? This doesn't seem to bear any resemblance to the reality of democracy. >Paying a government to keep the park clean and mowed and the lights on at >night or my streets well paved and de-iced in winter And a government does this better than a private corporation because? >is not quite the same >thing as having black-suited ninja wann-be's kicking my door in at 2AM >because I choose to smoke a joint or even grow my own weed; Again, this is a clear example of the failure of democracy. A big difference between democracy and anarcho-capitalism[1] is that in an anarcho-capitalist society the cops will be too busy making money to launch such raids on their customers, and most customers will be too self-interested to pay cops to raid their neighbors. >There is a reason behind the madness of "Congress shall make no law...". Indeed; such a shame they put all those other words into the Constitution. That phrase sounds like a pretty good conception of government to me. Mark [1] See, for example, 'The Machinery of Freedom', by David Friedman: excerpts on the Web at http://www.best.com/~ddfr/ From ravage at ssz.com Fri Oct 31 05:02:48 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 31 Oct 1997 21:02:48 +0800 Subject: democracy?! (Re: Terrorism is a NON-THREAT (fwd) Message-ID: <199710311257.GAA24473@einstein.ssz.com> Forwarded message: > Date: Fri, 31 Oct 1997 12:35:38 +0000 > From: Tim Griffiths > Subject: Re: democracy?! (Re: Terrorism is a NON-THREAT > Mark wrote: > > > > Jim Choate wrote: > > > Indeed. Yet in a democracy, any two other members are assumed to know > > better than me, and any 51% to know better than the other 49%. > > > > Democracy is merely the scoundrel's last attempt to maintain the divine > > right of kings by coverting it into the divine right of the elected. > > > > >Which means we should have the lowest number of incarcerated individuals > > >instead of the most. I didn't write any of this. Please be more careful with your quotes. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Fri Oct 31 05:02:54 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 31 Oct 1997 21:02:54 +0800 Subject: Terrorism is a NON-THREAT (fwd) Message-ID: <199710311300.HAA24571@einstein.ssz.com> Forwarded message: > Date: Fri, 31 Oct 1997 10:28:52 +0100 (MET) > To: Jim Choate > Subject: Re: Terrorism is a NON-THREAT (fwd) > > It doesn't make it right whether it is the Khmer Rhouge, SOG, Shinning Path, > > The SLA, CIA in Laos or Columbia, Ruby Ridge, KAL 007, TWA 800, IRA, SDS, > > Black Panthers, or some old lady in Ill. who wants to committ suicide. > > Suicide is hardly a terrorist action. [Names withheld to protect the terminaly stupid] It isn't the act your moron, sorry; more-off, it's the reason. Pay attention and quit napping, this isn't television. There are no commercials. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Fri Oct 31 05:03:50 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 31 Oct 1997 21:03:50 +0800 Subject: democracy?! (Re: Terrorism is a NON-THREAT (fwd) Message-ID: <199710311256.GAA24440@einstein.ssz.com> Forwarded message: > Date: Fri, 31 Oct 1997 04:13:59 -0800 (PST) > From: mark at unicorn.com > Subject: Re: democracy?! (Re: Terrorism is a NON-THREAT > Jim Choate wrote: > >If we as individuals can't make our own decisions about what is best for us, > >what makes you think some stranger will do any better? > > Indeed. Yet in a democracy, any two other members are assumed to know > better than me, and any 51% to know better than the other 49%. No, it doesn't - your definition of democracy is a simplistic if not childish view intended to cast democracy in the worst possible light imaginable. What you describe is a democracy which has no bill of rights or explicit limitations on the issues that the democratic body can vote on. Obviously there is nothing in the definition of a democracy that prevents those founding the democracy from stating: "Congress shall make no law respecting ..." or "The rights of the people to .... shall not be infringed." Grow up. > Indeed, thereby proving that democracy *doesn't* work. You've proved nothing except your a priori dislike for democracy because you want to convince others you are an angel. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From T.G.Griffiths at exeter.ac.uk Fri Oct 31 05:04:43 1997 From: T.G.Griffiths at exeter.ac.uk (Tim Griffiths) Date: Fri, 31 Oct 1997 21:04:43 +0800 Subject: Terrorism is a NON-THREAT (fwd) In-Reply-To: Message-ID: <6f5aafe147%Tim@tim01.ex.ac.uk> Tim May wrote: > At 8:11 AM -0700 10/30/97, Tim Griffiths wrote: > > > We hear on TV etc people saying "If this draconian measure saves the > > life of one innocent child its worth the loss of my right to walk in > > the park, or whatever". This is clearly shit, but can people suggest a > > sensible measure of when new legistlation is justified? > > Is this a trick question, or sumpin'? > > If not, then the answer is "the Constitution." I was trying to start from somewhere more fundamental than the Constitution, but if I understand you, you're saying that an arbitary, allbeit 'self-evident', set of limitations are set down (i.e. the US Constitution) at some point in time and no new laws should be made that contradict this set of rules. By doing this, aren't we putting a dictatorial limit on whatever democracy we come up with? In effect saying "we're all equal under God, and God wrote the Constitution"? > (I see that T.G.Griffiths at exeter.ac.uk is not an American. I apologize for > my U.S.-centric response. Consult your local Charter or whatever to see if > similar rights are spelled out. I suspect most adhocracies do not have > rights clearly spelled out, modulo the irony that several people's > republics have had nominally more rights-ensuring constitutions than the > U.S. has had.) No, this is the UK, we don't get rights here. Well, not quite true - for example we do get the right to bear arms (1888 - can't recall the Act offhand, but can find it). However, Her Maj. Gov reserves the right to tell us exactly _which_ arms we can bear, which is why I've just handed my beloved handguns in. What we do get is more and more US-style laws being passed here, but without the protection of a Constitution, e.g. looks like we'll get Megan's Law shortly, but without a constitutionally-given right to privacy. Tim G. From ravage at ssz.com Fri Oct 31 05:05:54 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 31 Oct 1997 21:05:54 +0800 Subject: democracy?! (Re: Terrorism is a NON-THREAT (fwd)) (fwd) Message-ID: <199710311303.HAA24618@einstein.ssz.com> Forwarded message: > Date: Fri, 31 Oct 1997 02:57:51 -0600 > From: TruthMonger > Subject: Re: democracy?! (Re: Terrorism is a NON-THREAT (fwd)) (fwd) > Jim Choate wrote: > > > Juries are supposed to be composed of your peers, not who the prosecution or > > defence believe will best support their case. It should be that the first 12 > > poeple called who don't have a valid excuse to be excused are the jury, the > > next 12 are the back-ups. > > You're way off base here, Jim. As a matter of fact, the government > goes to extraordinary lengths to make certain that we get a jury of > our peers. No, I just hit a home run. The fact is that if the defendant is facing a charge that can result in the death penalty *NO* juror will sit on that jury who will a priori eliminate the death penalty as a potential verdict. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From kent at bywater.songbird.com Fri Oct 31 05:38:42 1997 From: kent at bywater.songbird.com (Kent Crispin) Date: Fri, 31 Oct 1997 21:38:42 +0800 Subject: Jim Bell sentencing delayed In-Reply-To: <1.5.4.32.19971031120116.00c62d58@pop.pipeline.com> Message-ID: <19971031052741.36421@bywater.songbird.com> On Fri, Oct 31, 1997 at 07:01:16AM -0500, John Young wrote: > Greg, > > What's your take on repeated delay in Jim's sentencing: > > 1. A squeeze on Jim to finger co-conspirators. > > 2. Weak case, must use procedure to punish. > > 3. To let time served be the sentence. > > 4. Jim was up to something worse now being discovered > (like 5 below). > > 5. Jim is a secret gov agent, now feet up in Tacoma IRS > laughing at those who fell for suckerbait, screwball AP > written by IRS as a sting (a recent book package to Jim was > returned marked "Not in Jail"). > > 6. The court was hoodwinked by IRS, too, and the AUSA > is preparing an indictment of the stingers and federal defenders > and who knows who else that was in on it. > > 7. Secret Agent Jim is squealing on his double-crossing > secret agents, cutting a deal with whoever else is double- > crossing whomever. He's going down, they're going down, > we're going down, the whole country's going down; Up the > Revolution! 8. Jim is in a hospital somewhere. -- Kent Crispin "No reason to get excited", kent at songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html From ravage at ssz.com Fri Oct 31 05:39:51 1997 From: ravage at ssz.com (Jim Choate) Date: Fri, 31 Oct 1997 21:39:51 +0800 Subject: Terrorism is a NON-THREAT (fwd) Message-ID: <199710311335.HAA24707@einstein.ssz.com> Forwarded message: > Date: Fri, 31 Oct 1997 12:40:35 +0000 > From: Tim Griffiths > Subject: Re: Terrorism is a NON-THREAT (fwd) > > > We hear on TV etc people saying "If this draconian measure saves the > > > life of one innocent child its worth the loss of my right to walk in > > > the park, or whatever". This is clearly shit, but can people suggest a > > > sensible measure of when new legistlation is justified? > > > > Is this a trick question, or sumpin'? > > > > If not, then the answer is "the Constitution." > > I was trying to start from somewhere more fundamental than the > Constitution, but if I understand you, you're saying that an arbitary, > allbeit 'self-evident', set of limitations are set down (i.e. the US > Constitution) at some point in time and no new laws should be made that > contradict this set of rules. > By doing this, aren't we putting a dictatorial limit on whatever > democracy we come up with? In effect saying "we're all equal under God, > and God wrote the Constitution"? No, that is not the way it works at all. [Geesh] Let's start from the beginning, shall we. Our government does *NOT* start with the Constitution [one spin-doctor approved lie down]. It starts with the Declaration of Independance. It defines those self-evident issues of a democracy we are speaking of. Further, the founding fathers [NOT just the framers of the Constitution; second spin-doctor approved lie down] felt those rights were God given because they were inherent in being a human being, not something like a drivers license you had to prove you were responsible enough for and could be taken away [third spin-doctor lie down]. You got those rights (barring social institutions to the contrary, which are a challenge to overcome for democracies - and we fail miserably) because you breath and shit - period. [fourth spin-doctor lie down] Even my being a pantheist, and hence rejecting the concept of divinity, allow that we have rights which are inherent in our existance (Nature's God, which for me are synonymous). Rights that can only be taken at the pain of death or continued violence [fifth spin-doctor lie down]. That violence abrogates the social contract between myself and others (ie society) because it does not allow me the latitude that is mine by simple existance [sixth spin-doctor lie down]. Allow me to quote the first and part of the second initial paragraphs of that founding document: When in the Course of human Events, it becomes necessary for one People to dissolve the Political bands which have connected them with another, and to assume among the Powers of the Earth, the separate and equal station to which the Laws of Nature and of Nature's God entitle them, a decent respect to the Opinions of Mankind requires that they should declare the causes which impel them to the Separation. We hold these Truths to be self-evident, that all Men are created equal, that they are endowed by their Creator with certain unalienable rights, that among these are Life, Liberty, and the Pursuit of Happiness--That to secure these Rights, Governments are instituted among Men, deriving their just Powers from the Consent of the Governed, that whenever any Form of Government becomes destructive of these Ends, it is the Right of the People to alter or to abolish it, and to institute new Government, laying its foundation on such Principles and organizing its Powers in such Form, as to them shall seem most likely to effect their Safety and Happiness. Prudence, indeed, will dictate that Governments long established should not be changed for light and transient Causes; and accordingly all Experience hath shewn, that Mankind are more disposed to suffer, while evils are sufferable, than to right themselves by abolishing the Forms to which they are accustomed. But when a long train of Abuses and Ursurpations, pursuing invariably the same Object, evinces a Design to reduce them under absolute Despotism, it is their Right, it is their Duty, to throw off such Government, and to provide new Guards for their future Security. *THAT* is the definition of democracy, *NOT* some bullshit definition that a government spin-doctor spews forth in a government spin-doctor institution better known as a school telling you that some ephemeral 'rule-of-law' is the ultimate authority in this country [seventh spin-doctor lie down]. Political oppressors are like the Terminator, you can't reason with them and it will kill you. They're meat-bop (thanks Rudy!) machines with faulty processors. Democracies should be based on cooperation, NOT compromise (ie giving up rights to make sombodies elses job easier). [eighth spin-doctor lie down] Tim and others predict a revolution, while I agree in principal that a social and political revolution and hence an accounting (hopefuly with about another 50 amendments to the Constitution) is coming I disagree that it will or needs to be violent. This ilk of 'patriot' hates so much they have become what they hate - users of violence to get their way and to hell with the consequences. They're simply the next wave of oppressors if we let them. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From T.G.Griffiths at exeter.ac.uk Fri Oct 31 05:46:28 1997 From: T.G.Griffiths at exeter.ac.uk (Tim Griffiths) Date: Fri, 31 Oct 1997 21:46:28 +0800 Subject: democracy?! (Re: Terrorism is a NON-THREAT (fwd) In-Reply-To: <199710311257.GAA24473@einstein.ssz.com> Message-ID: Jim Choate: > I didn't write any of this. Please be more careful with your quotes. Except, of course, for the bit credited to you: Which means we should have the lowest number of incarcerated individuals instead of the most. which was originally posted by you (or a spoof) in message <199710310315.VAA2177 at einstein.ssz.com>, and later quoted by Mark in his reply, which I responded to. I admit the aknowledgements weren't too clear, a mixture of mine and Mark's editing. Tim G. From T.G.Griffiths at exeter.ac.uk Fri Oct 31 06:24:58 1997 From: T.G.Griffiths at exeter.ac.uk (Tim Griffiths) Date: Fri, 31 Oct 1997 22:24:58 +0800 Subject: Terrorism is a NON-THREAT (fwd) In-Reply-To: <199710311335.HAA24707@einstein.ssz.com> Message-ID: <6d2cb7e147%Tim@tim01.ex.ac.uk> I wrote: > > ...[a] set of limitations are set down (i.e. the US > > Constitution) at some point in time and no new laws should be made that > > contradict this set of rules. > > By doing this, aren't we putting a dictatorial limit on whatever > > democracy we come up with? In effect saying "we're all equal under God, > > and God wrote the Constitution"? and Jim Choate (for it is he) replied: > No, that is not the way it works at all. [Geesh] > [snip prefectly good potted history of birth of a nation etc, and > correction of me using 'Constitution' rather than 'Dec. of Indep'] > Further, > the founding fathers felt those rights were God given because they > were inherent in being a human being, not something like a drivers license > you had to prove you were responsible enough for and could be taken away. > You got those rights... ...because you breath and shit - period. > Even my being a pantheist, and hence rejecting the concept of divinity, > allow that we have rights which are inherent in our existance. But the bit I'm trying to get at. Doesn't the idea of what those rights are change from social group to social group? Furthermore, doesn't having a irrefutable set of laws place a fundamental (ist) limit on a democracy that exists under them? Is it possible to have a true democracy without the assumption of a 'higher authority'? Of course there is the 'go along with it, or go somewhere else' arguement, but that's not much of a solution. Tim G. From opportunity at anywhere.com Fri Oct 31 22:41:44 1997 From: opportunity at anywhere.com (opportunity at anywhere.com) Date: Fri, 31 Oct 1997 22:41:44 -0800 (PST) Subject: $36,000 in 3 months!! Message-ID: <> << Just what you needed, just when you needed it! >> The main reason for this letter is to convince you that this system is honest, lawful, extremely profitable, and is a way to get a large amount of money in a short time. I was approached several times before I checked this out. I joined just to see what one could expect in return for the minimal effort and money required. Initially I let no one in the organization know that I was an attorney and, to my astonishment, I received $36,470.00 in the first 14 weeks, with money still coming in. Sincerely yours, Phillip A. Brown "Please Read This Twice!" Dear friend, ========================================================= ========================================================= This is a "ONE-TIME MESSAGE" you were randomly selected to receive this. There is no need to reply to remove, you will receive no further mailings from us. If you have interest in this GREAT INFORMATION, please do not click reply, use the contact information in this message. Thank You! :-) ========================================================= ========================================================= *** Print This Now For Future Reference *** The following income opportunity is one you may be intersested in taking a look at. It can be started with VERY LITTLE investment and the income return is TREMENDOUS!!! $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ You are about to make at least $50,000 in less than 90 days! Please read the enclosed program...THEN READ IT AGAIN!!! $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ This is a MONEY-MAKING PHENOMENON. PRINT this letter, read the program... THEN READ IT AGAIN !!! You are looking at the most profitable and unique program you may ever see. It has demonstrated and proven ability to generate large sums of money. This program is showing fantastic appeal with a huge and ever growing population which needs additional income. This is a legitimate LEGAL money-making opportunity. It does not require you to come in contact with people, do any hard work, and best of all, you never have to leave the house, except to get the mail. If you believe that some day you will get that lucky break that you have been waiting for, THIS IS IT! Simply follow the easy instructions, and your dream will come true! This electronic multi-level marketing program works perfectly...100% EVERY TIME! Thousands of people have used this program to raise capital to start their own business, pay off debts, buy homes, cars, etc., even retire! This is your chance, so don't pass it up. OVERVIEW OF THIS EXTRAORDINARY ELECTRONIC MULTI-LEVEL MARKETING PROGRAM Basically, this is what we do: We sell thousands of people a product for $5.00 that costs us next to nothing to produce and e-mail. As with all multi-level businesses, we build our business by recruiting new partners and selling our products. Every state in the U.S. allows you to recruit new multi- level business online (with your computer). The product in this program is a series of four businesses and financial reports. Each $5.00 order you receive by "snail mail" will include the e-mail address of the sender. To fill each order, you simply e-mail the product to the buyer. THAT'S IT!...the $5.00 is yours! This is the GREATEST electronic multi-level marketing business anywhere! FOLLOW THE INSTRUCTIONS EXACTLY! Let's face it, the profits are worth it! THEY'RE TREMENDOUS!!! So go for it. Remember the 4 points and we'll see YOU at the top! ******* I N S T R U C T I O N S ******* This is what you MUST do: 1. Order all 4 reports listed and numbered from the list below. For each report send $5.00 CASH, YOUR E-MAIL ADDRESS and YOUR RETURN POSTAL ADDRESS (in case of a problem) to each person listed. When you order, make sure you request each SPECIFIC report. You will need all four reports, because you will be saving them on your computer and reselling them. 2. IMPORTANT--DO NOT alter the names, or their sequence other than instructed in this program! Or you will not profit the way you should. Replace the name and address under REPORT #1 with yours, moving the one that was there down to REPORT #2. Move the name and address under REPORT #2 to REPORT #3. Move the name and address under REPORT #3 to REPORT #4. The name and address that was under REPORT #4 is dropped off the list and is NO DOUBT on the way to the bank. When doing this, please make certain you copy everyone's name and address ACCURATELY!!! Also, DO NOT move the Report/Product positions! 3. Take this entire program text, including the corrected names list, and save it on your computer. 4. Now you're ready to start a massive advertising campaign on the WORLDWIDE WEB! Advertising on the WEB is very, very inexpensive, but there are HUNDREDS of FREE places to advertise also. Another avenue which you could use is e-mail mailing lists. You can buy these lists for under $20/1,000 addresses. START YOUR AD CAMPAIGN AS SOON AS YOU CAN. ALWAYS PROVIDE SAME-DAY SERVICE ON ALL ORDERS!!! REQUIRED REPORTS ***Order each REPORT by NUMBER and NAME*** ALWAYS SEND $5 CASH (concealed) FOR EACH ORDER REQUESTING THE SPECIFIC REPORT BY NAME AND NUMBER. ALWAYS SEND FIRST CLASS OR PRIORITY MAIL AND PROVIDE YOUR E-MAIL ADDRESS FOR QUICK DELIVERY. ___________________________________________________ REPORT #1 "HOW TO MAKE $250,000 THROUGH MULTILEVEL SALES" ORDER REPORT #1 FROM: Pammy Group P.O. Box 460123 St. Louis, MO 63146-7123 ___________________________________________________ REPORT #2 "MAJOR CORPORATIONS AND MULTI-LEVEL SALES" ORDER REPORT #2 FROM: MAKIN-MOOLA P.O. BOX 271926 Fort Collins, CO 80527-1926 U.S.A. ___________________________________________________ REPORT #3 "SOURCES FOR THE BEST MAILING LISTS" ORDER REPORT #3 FROM: MY-TURN P.O. BOX 272453 Fort Collins, CO 80527-2453 U.S.A. ____________________________________________________ REPORT #4 "EVALUATING MULTI-LEVEL SALES PLANS" ORDER REPORT #4 FROM: CPS P.O.Box 50173 PROVO, UT 84605-0173 ____________________________________________________ HERE'S HOW THIS AMAZING PLAN WILL MAKE YOU $MONEY$ Let's say you decide to start small just to see how it goes. Assume your goal is to get 10 people to participate on your first level. (Placing a lot of FREE ads on the internet could EASILY get a better response.) Also assume that everyone else in YOUR BUILDING ORGANIZATION gets ONLY 10 downline members. Follow this example for the STAGGERING results below. 1st level -- your 10 members with $5 ($5 x 10) $ 50 2nd level -- 10 members from those 10 ($5 x 100) $ 500 3rd level -- 10 members from those 100 ($5 x 1,000) $ 5,000 4th level -- 10 members from those 1,000 ($5 x 10,000) $50,000 ------- THIS TOTALS-----------> $55,550 ------- Remember friends, this is assuming that the people who participate only recruit 10 people each. Dare to think for a moment what would happen if everyone got 20 people to participate! Some people get 100's of recruits! THINK ABOUT IT! By the way, your cost to participate in this is practically nothing. You obviously already have an internet connection and email is FREE!!! REPORT#3 will show you the best methods for bulk emailing and purchasing email lists. REMEMBER: Approx. 50,000 new people get online monthly! ORDER YOUR REPORTS NOW!!! *******TIPS FOR SUCCESS******* TREAT THIS AS YOUR BUSINESS! Send for the four reports IMMEDIATELY, so you will have them when the orders start coming in because: When you receive a $5 order, you MUST send out the requested product/ report to comply with the U.S. Postal & Lottery Laws, Title 18, Sections 1302 and 1341 or Title 18, Section 3005 in the U.S. Code, also Code of Federal Regs. vol. 16, Sections 255 and 436, which state that "a product or service must be exchanged for money received." * ALWAYS PROVIDE SAME-DAY SERVICE ON THE ORDERS YOU RECEIVE. * Be patient and persistent with this program. If you follow the instructions exactly the results WILL undoubtedly be SUCCESS! * ABOVE ALL, HAVE FAITH IN YOURSELF THAT YOU CAN SUCCEED! *******YOUR SUCCESS GUIDELINE******* The check point that guarantees your success is simply this: You MUST receive 10 to 20 orders for REPORT #1! THIS IS A MUST! If you don't within two weeks, advertise more and send out more programs until you do. Then, a couple of weeks later you should receive at least 100 orders for REPORT #2. If you don't, advertise more and send out more programs until you do. Once you have received 100, or more orders for REPORT #2, YOU CAN RELAX, because you will be on your way to the BANK! -OR- You can DOUBLE your efforts! REMEMBER: Every time your name is moved down on the list you are in front of a DIFFERENT report, so you can KEEP TRACK of your PROGRESS by what report people are ordering from you. IT'S THAT EASY!!! NOTE: IF YOU NEED HELP with starting a business, registering a business name, how income tax is handled, etc., contact your local office of the Small Business Administration (a Federal agency) for free help and answers to questions. Also, the Internal Revenue Service offers free help via telephone and free seminars about business taxes. ******* T E S T I M O N I A L S ******* This program does work, but you must follow it EXACTLY! Especially the rule of not trying to place your name in a different position, it won't work, you'll lose a lot of money. I'm living proof that it works. It really is a great opportunity to make relatively easy money, with little cost to you. If you do choose to participate, follow the program exactly, and you'll be on your way to financial security. If you are a fellow Christian and are in financial trouble like I was, consider this a sign. I DID! Good Luck & God Bless You, Sincerely, Chris Johnson P.S. Do you have any idea what 11,700 $5 bills ($58,500) looks like piled up on the kitchen table?...IT'S AWESOME! My name is Frank. My wife Doris and I live in Bel-Air, MD. I am a cost accountant with a major U.S. Corporation and I make pretty good money. When I received the program I grumbled to Doris about receiving "junk mail"! I made fun of the whole thing, spouting my knowledge of the population and percentages involved. I "knew" it wouldn't work. Doris totally ignored my supposed intelligence and jumped in with both feet. I made merciless fun of her, and was ready to lay the old "I told you so" on her when the thing didn't work... well, the laugh was on me! Within two weeks she had received over 50 responses. Within 45 days she had received over $147,200 in $5 bills! I was stunned. I was sure that I had it all figured and that it wouldn't work...I AM a believer now. I have joined Doris in her "little" hobby. I did have seven more years until retirement, but I think of the "rat race" and it's not for me...We owe it all to MLM. Frank T., Bel-Air, MD I just want to pass along my best wishes and encouragement to you. Any doubts you have will vanish when your first orders come in. I even checked with the U.S. Post Office to verify that the plan was legal. It definitely is! IT WORKS!!! Paul Johnson, Raleigh, NC This is the only realistic money-making offer I've ever received. I participated because this plan truly makes sense. I was surprised when the $5.00 bills started filling my mail box. By the time it tapered off I had received over 8,000 orders with over $40,000 in cash. Dozens of people have sent warm personal notes too, sharing the news of their good fortunes! It's been WONDERFUL. Carl Winslow Tulsa, OK The main reason for this letter is to convince you that this system is honest, lawful, extremely profitable, and is a way to get a large amount of money in a short time. I was approached several times before I checked this out. I joined just to see what one could expect in return for the minimal effort and money required. Initially I let no one in the organization know that I was an attorney and, to my astonishment, I received $36,470.00 in the first 14 weeks, with money still coming in. Sincerely yours, Phillip A. Brown This plan works like GANG-BUSTERS!! So far I have had 9,735 total orders OVER $48,000!!! I hope I have sparked your own excitement, if you follow the program exactly, you could have the same success I have, if not better. Your success is right around the corner, but you must do a little work. Good Luck! G. Bank Not being the gambling type, it took me several weeks to make up my mind to participate in this plan. But conservative that I am I decided that the initial investment was so little that there was just no way that I wouldn't get enough orders to at least get my money back. Boy I was surprised when I found my medium-size post office box crammed with orders. After that it got so over-loaded that I had to start picking up my mail at the window. I'll make more money this year than any 10 years of my life before. The nice thing about this deal is that it doesn't matter where in the U.S. the people live. There simply isn't a better investment with a faster return. Mary Rockland, Lansing, MI I had received this program before. I deleted it, but later I wondered if I shouldn't have given it a try. Of course, I had no idea who to contact to get another copy, so I had to wait until I was e-mailed another program...11 months passed then it came...I didn't delete this one!...I made $41,000 on the first try!! D. Wilburn, Muncie, IN This is my third time to participate in this plan. We have quit our jobs, and quite soon we will buy a home on the beach and live off the interest on our money. The only way on earth that this plan will work for you is if you do it. For your sake, and for your family's sake don't pass up this golden opportunity. Remember, when you order your four reports, SEND CASH. Checks have to clear the bank and create too many delays. Good luck and happy spending! Charles Fairchild, Spokane, WA Typically when I look at a money-making deal I want to know if the company is strong, will it be here when it's time for my big pay off. In this crazy thing there is no company intervention for management to blow it. Just people like me ordering directly from the source! Interesting...I had a couple of projects I'd been trying to fund to no avail so I thought; Why not give it a try? Well 2 1/2 weeks later the orders started coming in. One project is funded and I'm sure the other will be soon! Marilynn St. Claire, Logan, UT ==================================================== We could be printing YOUR testimonial next!!! ORDER YOUR REPORTS TODAY AND GET STARTED DOWN THE ROAD TO YOUR FINANCIAL FREEDOM!!! From opportunity at anywhere.com Fri Oct 31 22:41:44 1997 From: opportunity at anywhere.com (opportunity at anywhere.com) Date: Fri, 31 Oct 1997 22:41:44 -0800 (PST) Subject: $36,000 in 3 months!! Message-ID: <> << Just what you needed, just when you needed it! >> The main reason for this letter is to convince you that this system is honest, lawful, extremely profitable, and is a way to get a large amount of money in a short time. I was approached several times before I checked this out. I joined just to see what one could expect in return for the minimal effort and money required. Initially I let no one in the organization know that I was an attorney and, to my astonishment, I received $36,470.00 in the first 14 weeks, with money still coming in. Sincerely yours, Phillip A. Brown "Please Read This Twice!" Dear friend, ========================================================= ========================================================= This is a "ONE-TIME MESSAGE" you were randomly selected to receive this. There is no need to reply to remove, you will receive no further mailings from us. If you have interest in this GREAT INFORMATION, please do not click reply, use the contact information in this message. Thank You! :-) ========================================================= ========================================================= *** Print This Now For Future Reference *** The following income opportunity is one you may be intersested in taking a look at. It can be started with VERY LITTLE investment and the income return is TREMENDOUS!!! $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ You are about to make at least $50,000 in less than 90 days! Please read the enclosed program...THEN READ IT AGAIN!!! $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ This is a MONEY-MAKING PHENOMENON. PRINT this letter, read the program... THEN READ IT AGAIN !!! You are looking at the most profitable and unique program you may ever see. It has demonstrated and proven ability to generate large sums of money. This program is showing fantastic appeal with a huge and ever growing population which needs additional income. This is a legitimate LEGAL money-making opportunity. It does not require you to come in contact with people, do any hard work, and best of all, you never have to leave the house, except to get the mail. If you believe that some day you will get that lucky break that you have been waiting for, THIS IS IT! Simply follow the easy instructions, and your dream will come true! This electronic multi-level marketing program works perfectly...100% EVERY TIME! Thousands of people have used this program to raise capital to start their own business, pay off debts, buy homes, cars, etc., even retire! This is your chance, so don't pass it up. OVERVIEW OF THIS EXTRAORDINARY ELECTRONIC MULTI-LEVEL MARKETING PROGRAM Basically, this is what we do: We sell thousands of people a product for $5.00 that costs us next to nothing to produce and e-mail. As with all multi-level businesses, we build our business by recruiting new partners and selling our products. Every state in the U.S. allows you to recruit new multi- level business online (with your computer). The product in this program is a series of four businesses and financial reports. Each $5.00 order you receive by "snail mail" will include the e-mail address of the sender. To fill each order, you simply e-mail the product to the buyer. THAT'S IT!...the $5.00 is yours! This is the GREATEST electronic multi-level marketing business anywhere! FOLLOW THE INSTRUCTIONS EXACTLY! Let's face it, the profits are worth it! THEY'RE TREMENDOUS!!! So go for it. Remember the 4 points and we'll see YOU at the top! ******* I N S T R U C T I O N S ******* This is what you MUST do: 1. Order all 4 reports listed and numbered from the list below. For each report send $5.00 CASH, YOUR E-MAIL ADDRESS and YOUR RETURN POSTAL ADDRESS (in case of a problem) to each person listed. When you order, make sure you request each SPECIFIC report. You will need all four reports, because you will be saving them on your computer and reselling them. 2. IMPORTANT--DO NOT alter the names, or their sequence other than instructed in this program! Or you will not profit the way you should. Replace the name and address under REPORT #1 with yours, moving the one that was there down to REPORT #2. Move the name and address under REPORT #2 to REPORT #3. Move the name and address under REPORT #3 to REPORT #4. The name and address that was under REPORT #4 is dropped off the list and is NO DOUBT on the way to the bank. When doing this, please make certain you copy everyone's name and address ACCURATELY!!! Also, DO NOT move the Report/Product positions! 3. Take this entire program text, including the corrected names list, and save it on your computer. 4. Now you're ready to start a massive advertising campaign on the WORLDWIDE WEB! Advertising on the WEB is very, very inexpensive, but there are HUNDREDS of FREE places to advertise also. Another avenue which you could use is e-mail mailing lists. You can buy these lists for under $20/1,000 addresses. START YOUR AD CAMPAIGN AS SOON AS YOU CAN. ALWAYS PROVIDE SAME-DAY SERVICE ON ALL ORDERS!!! REQUIRED REPORTS ***Order each REPORT by NUMBER and NAME*** ALWAYS SEND $5 CASH (concealed) FOR EACH ORDER REQUESTING THE SPECIFIC REPORT BY NAME AND NUMBER. ALWAYS SEND FIRST CLASS OR PRIORITY MAIL AND PROVIDE YOUR E-MAIL ADDRESS FOR QUICK DELIVERY. ___________________________________________________ REPORT #1 "HOW TO MAKE $250,000 THROUGH MULTILEVEL SALES" ORDER REPORT #1 FROM: Pammy Group P.O. Box 460123 St. Louis, MO 63146-7123 ___________________________________________________ REPORT #2 "MAJOR CORPORATIONS AND MULTI-LEVEL SALES" ORDER REPORT #2 FROM: MAKIN-MOOLA P.O. BOX 271926 Fort Collins, CO 80527-1926 U.S.A. ___________________________________________________ REPORT #3 "SOURCES FOR THE BEST MAILING LISTS" ORDER REPORT #3 FROM: MY-TURN P.O. BOX 272453 Fort Collins, CO 80527-2453 U.S.A. ____________________________________________________ REPORT #4 "EVALUATING MULTI-LEVEL SALES PLANS" ORDER REPORT #4 FROM: CPS P.O.Box 50173 PROVO, UT 84605-0173 ____________________________________________________ HERE'S HOW THIS AMAZING PLAN WILL MAKE YOU $MONEY$ Let's say you decide to start small just to see how it goes. Assume your goal is to get 10 people to participate on your first level. (Placing a lot of FREE ads on the internet could EASILY get a better response.) Also assume that everyone else in YOUR BUILDING ORGANIZATION gets ONLY 10 downline members. Follow this example for the STAGGERING results below. 1st level -- your 10 members with $5 ($5 x 10) $ 50 2nd level -- 10 members from those 10 ($5 x 100) $ 500 3rd level -- 10 members from those 100 ($5 x 1,000) $ 5,000 4th level -- 10 members from those 1,000 ($5 x 10,000) $50,000 ------- THIS TOTALS-----------> $55,550 ------- Remember friends, this is assuming that the people who participate only recruit 10 people each. Dare to think for a moment what would happen if everyone got 20 people to participate! Some people get 100's of recruits! THINK ABOUT IT! By the way, your cost to participate in this is practically nothing. You obviously already have an internet connection and email is FREE!!! REPORT#3 will show you the best methods for bulk emailing and purchasing email lists. REMEMBER: Approx. 50,000 new people get online monthly! ORDER YOUR REPORTS NOW!!! *******TIPS FOR SUCCESS******* TREAT THIS AS YOUR BUSINESS! Send for the four reports IMMEDIATELY, so you will have them when the orders start coming in because: When you receive a $5 order, you MUST send out the requested product/ report to comply with the U.S. Postal & Lottery Laws, Title 18, Sections 1302 and 1341 or Title 18, Section 3005 in the U.S. Code, also Code of Federal Regs. vol. 16, Sections 255 and 436, which state that "a product or service must be exchanged for money received." * ALWAYS PROVIDE SAME-DAY SERVICE ON THE ORDERS YOU RECEIVE. * Be patient and persistent with this program. If you follow the instructions exactly the results WILL undoubtedly be SUCCESS! * ABOVE ALL, HAVE FAITH IN YOURSELF THAT YOU CAN SUCCEED! *******YOUR SUCCESS GUIDELINE******* The check point that guarantees your success is simply this: You MUST receive 10 to 20 orders for REPORT #1! THIS IS A MUST! If you don't within two weeks, advertise more and send out more programs until you do. Then, a couple of weeks later you should receive at least 100 orders for REPORT #2. If you don't, advertise more and send out more programs until you do. Once you have received 100, or more orders for REPORT #2, YOU CAN RELAX, because you will be on your way to the BANK! -OR- You can DOUBLE your efforts! REMEMBER: Every time your name is moved down on the list you are in front of a DIFFERENT report, so you can KEEP TRACK of your PROGRESS by what report people are ordering from you. IT'S THAT EASY!!! NOTE: IF YOU NEED HELP with starting a business, registering a business name, how income tax is handled, etc., contact your local office of the Small Business Administration (a Federal agency) for free help and answers to questions. Also, the Internal Revenue Service offers free help via telephone and free seminars about business taxes. ******* T E S T I M O N I A L S ******* This program does work, but you must follow it EXACTLY! Especially the rule of not trying to place your name in a different position, it won't work, you'll lose a lot of money. I'm living proof that it works. It really is a great opportunity to make relatively easy money, with little cost to you. If you do choose to participate, follow the program exactly, and you'll be on your way to financial security. If you are a fellow Christian and are in financial trouble like I was, consider this a sign. I DID! Good Luck & God Bless You, Sincerely, Chris Johnson P.S. Do you have any idea what 11,700 $5 bills ($58,500) looks like piled up on the kitchen table?...IT'S AWESOME! My name is Frank. My wife Doris and I live in Bel-Air, MD. I am a cost accountant with a major U.S. Corporation and I make pretty good money. When I received the program I grumbled to Doris about receiving "junk mail"! I made fun of the whole thing, spouting my knowledge of the population and percentages involved. I "knew" it wouldn't work. Doris totally ignored my supposed intelligence and jumped in with both feet. I made merciless fun of her, and was ready to lay the old "I told you so" on her when the thing didn't work... well, the laugh was on me! Within two weeks she had received over 50 responses. Within 45 days she had received over $147,200 in $5 bills! I was stunned. I was sure that I had it all figured and that it wouldn't work...I AM a believer now. I have joined Doris in her "little" hobby. I did have seven more years until retirement, but I think of the "rat race" and it's not for me...We owe it all to MLM. Frank T., Bel-Air, MD I just want to pass along my best wishes and encouragement to you. Any doubts you have will vanish when your first orders come in. I even checked with the U.S. Post Office to verify that the plan was legal. It definitely is! IT WORKS!!! Paul Johnson, Raleigh, NC This is the only realistic money-making offer I've ever received. I participated because this plan truly makes sense. I was surprised when the $5.00 bills started filling my mail box. By the time it tapered off I had received over 8,000 orders with over $40,000 in cash. Dozens of people have sent warm personal notes too, sharing the news of their good fortunes! It's been WONDERFUL. Carl Winslow Tulsa, OK The main reason for this letter is to convince you that this system is honest, lawful, extremely profitable, and is a way to get a large amount of money in a short time. I was approached several times before I checked this out. I joined just to see what one could expect in return for the minimal effort and money required. Initially I let no one in the organization know that I was an attorney and, to my astonishment, I received $36,470.00 in the first 14 weeks, with money still coming in. Sincerely yours, Phillip A. Brown This plan works like GANG-BUSTERS!! So far I have had 9,735 total orders OVER $48,000!!! I hope I have sparked your own excitement, if you follow the program exactly, you could have the same success I have, if not better. Your success is right around the corner, but you must do a little work. Good Luck! G. Bank Not being the gambling type, it took me several weeks to make up my mind to participate in this plan. But conservative that I am I decided that the initial investment was so little that there was just no way that I wouldn't get enough orders to at least get my money back. Boy I was surprised when I found my medium-size post office box crammed with orders. After that it got so over-loaded that I had to start picking up my mail at the window. I'll make more money this year than any 10 years of my life before. The nice thing about this deal is that it doesn't matter where in the U.S. the people live. There simply isn't a better investment with a faster return. Mary Rockland, Lansing, MI I had received this program before. I deleted it, but later I wondered if I shouldn't have given it a try. Of course, I had no idea who to contact to get another copy, so I had to wait until I was e-mailed another program...11 months passed then it came...I didn't delete this one!...I made $41,000 on the first try!! D. Wilburn, Muncie, IN This is my third time to participate in this plan. We have quit our jobs, and quite soon we will buy a home on the beach and live off the interest on our money. The only way on earth that this plan will work for you is if you do it. For your sake, and for your family's sake don't pass up this golden opportunity. Remember, when you order your four reports, SEND CASH. Checks have to clear the bank and create too many delays. Good luck and happy spending! Charles Fairchild, Spokane, WA Typically when I look at a money-making deal I want to know if the company is strong, will it be here when it's time for my big pay off. In this crazy thing there is no company intervention for management to blow it. Just people like me ordering directly from the source! Interesting...I had a couple of projects I'd been trying to fund to no avail so I thought; Why not give it a try? Well 2 1/2 weeks later the orders started coming in. One project is funded and I'm sure the other will be soon! Marilynn St. Claire, Logan, UT ==================================================== We could be printing YOUR testimonial next!!! ORDER YOUR REPORTS TODAY AND GET STARTED DOWN THE ROAD TO YOUR FINANCIAL FREEDOM!!! From aba at dcs.ex.ac.uk Fri Oct 31 07:25:47 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Fri, 31 Oct 1997 23:25:47 +0800 Subject: democracy?! (Re: Terrorism is a NON-THREAT In-Reply-To: <43e6aee147%Tim@tim01.ex.ac.uk> Message-ID: <199710311328.NAA02878@server.test.net> Tim Griffiths writes: > > Jim Choate wrote: > > >Which means we should have the lowest number of incarcerated individuals > > >instead of the most. > > Does it? Or does it mean that we potentially have 49% of the population > in jail for any particular act, deemed to be a crime by the remaining 51%? Sounds about a reasonable an outcome as can be expected from a distortion of market economics such as democracy. Probably it would stabilize somewhere below 49% unless methods can be found to extract enough money from people in jail by having them work. The real problem as I see it with democracy is that not only do your neighbours get to vote to have you locked up for something which is none of their business, and has no conceivable effect up on them; but they actually get to vote for you to be charged for the "service" of being locked up to protect you from yourself. There is a trend of making the "criminal" (the real victim in many cases) finance his own persecution. For example we have licensing regimes which are not in our interests, and you know what, they charge for a license, and they lock people up for not buying licenses. And what is really galling is that the poor sods who get locked up actually fund the process, lose money by being locked up and pay two or three times for someone elses control freakish whims. The wild west was better than this state of affairs -- people didn't have the energy or inclination to waste their own resources being nosy parkers, and those that did were apt to wind up full of lead. Perfect. (Crime rate was reportedly pretty damn low too.) Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Message-ID: <3.0.3.32.19971031072954.0315c320@popd.netcruiser> At 09:55 AM 10/31/97 +0100, Lucky Green wrote: >On Fri, 31 Oct 1997, Anonymous wrote: > >> >> > It seems that unknown Cypherpunks have yet again shown their disrespect of >> > US export laws by exporting the latest version of PGP. The Windows version >> > of PGP 5.5 is now available for your downloading pleasure at >> > ftp://ftp.replay.com/pub/crypto/incoming/PGP55.zip >> >> > -- Lucky Green PGP encrypted email preferred. >> > "Tonga? Where the hell is Tonga? They have Cypherpunks there?" >> >> First, a PGP employee announces that PGP 5.5 is available for download. > >Let me state that I am not now, nor have I ever been, an employee of PGP. >I simply noticed what I thought to be PGP 5.5 on a well known FTP site. >Sorry if it was a dud. > >-- Lucky Green PGP encrypted email preferred. > "Tonga? Where the hell is Tonga? They have Cypherpunks there?" I downloaded it successfully, although I did have to try several times. If at first you don't succeed... Jonathan Wienke PGP Key Fingerprints: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC "If ye love wealth greater than liberty, the tranquility of servitude greater than the animating contest for freedom, go home from us in peace. We seek not your counsel, nor your arms. Crouch down and lick the hand that feeds you. May your chains set lightly upon you; and may posterity forget that ye were our countrymen." -- Samuel Adams "Stupidity is the one arena of of human achievement where most people fulfill their potential." -- Jonathan Wienke RSA export-o-matic: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 From aba at dcs.ex.ac.uk Fri Oct 31 07:59:51 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Fri, 31 Oct 1997 23:59:51 +0800 Subject: democracy?! (Re: Terrorism is a NON-THREAT (fwd) In-Reply-To: <199710311257.GAA24473@einstein.ssz.com> Message-ID: <199710311553.PAA03866@server.test.net> Jim Choate writes: > I didn't write any of this. Please be more careful with your quotes. Not to get pedantic here, but you did write the bit you're quoted as writing; you're not reading quotes properly. This is what was quoted: Mark wrote: > Jim Choate wrote: > [...] > >Which means we should have the lowest number of incarcerated individuals > >instead of the most. Where the [...] was what Mark wrote, this is fairly normal quoting which results from most software. Hand editing might perhaps have improved it by moving the "Jim wrote:" down to just before your quote, but that's what happens when people edit quotes. Anyway democracy sucks dead bunnies through straws, so there. And since when is the definition of a democracy stated to have constitutional-like limitations on government power. And since when has any democratic country upheld principles stated in such constitutions. eg. US constitution says you have right to bear arms (good, excellent), but your government is eroding those rights fast in spite of your constitution. (Not that UK government isn't worse you understand -- another example of democracy not working well.) Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Fill out and email me, and I'll tabulate results, and post here and on ietf-open-pgp: ==============================8<============================== mini straw poll on pgp2.x and 5.x usage: 1. What are you currently using for everyday use: 2.x or 5.x [ 2 or 5 ] 2. What proportion of people you use PGP to communicate with are using 5.x [ x / y ] 3. How many of the 5.x users you communicate with are cypherpunks [ z ] ==============================8<============================== The question has come up on ietf-open-pgp as to how important it is for the OpenPGP standard to support backwards compatibility with pgp2.x. The tension arises because 2 of the 3 cryptographic algorithms used in pgp2.x are patented in some parts of the world. (IDEA being patented in Europe, and US; and RSA being patented in the US and Canada). The IETF generally likes to steer clear of patented algorithms as MUSTs in standards. This encourages implementations, etc. (Personally I'm pretty keen on this point, though I would like more backwards compatible pgp5.x implementations -- I've already received emails I can't read without resorting to the pgp5 command line app, which doesn't work with my mailer integrated system.) So the question arises, just how many pgp2.x users are there. PGP Inc are pointing to the ratio of RSA keys to DSA/EG keys on keyservers as showing that pgp2.x users are in the minority. However that ratio is something like 20,000 to 75,000, and I'm sure we've heard statistics in the past about there being literally millions of pgp 2.x users. One suspects that either many pgp 2.x users aren't using keyservers (I know several cypherpunks who have something against key servers and avoid them for perceived security or privacy reasons), and/or the pgp2.x user base is exaggerated. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 Jim Choate (ravage at ssz.com) wrote: >No, it doesn't - your definition of democracy is a simplistic if not >childish view intended to cast democracy in the worst possible light >imaginable. I don't need to cast dumbocracy in a bad light; one look at the news does far more than I ever could to show the evils of government. >Obviously there is nothing in the definition of a democracy that prevents >those founding the democracy from stating: >"Congress shall make no law respecting ..." Indeed. And such statements are almost totally worthless; the US Constitution includes such statements, yet it is rapidly becoming the world leader in repression and spreading that to other countries as fast as it can. The best such limits can do is slow the spread of government, not stop it. Perhaps you should try a few games of Hofstadter's 'Nomic', which is based around this problem? >Grow up. I have grown up; I come from a strongly socialist family, yet I soon learnt that my and my family's political beliefs were wrong. Most people just continue to parrot the same beliefs all their lives. I could live with a libertarian minarchy, or even the US Constitution if it were upheld, but neither society would be as stable as anarchy. >You've proved nothing except your a priori dislike for democracy because you >want to convince others you are an angel. Sorry? I have no desire to govern others, so I don't have to be an angel. Indeed, the fact that there are no angels is another strong argument for anarchy over government. If power corrupts, then eliminate the power. If self-rule is good, then government is bad. If you believe in both self-rule and government, you've proven nothing but that your beliefs are contradictory. Mark From FisherM at exch1.indy.tce.com Fri Oct 31 09:52:02 1997 From: FisherM at exch1.indy.tce.com (Fisher Mark) Date: Sat, 1 Nov 1997 01:52:02 +0800 Subject: North CA cops skip preliminaries, get straight to torture Message-ID: <2328C77FF9F2D011AE970000F84104A74933FC@indyexch_fddi.indy.tce.com> Tim May ('>') wrote: >> This non-violent demonstrators were willing to accept the agreed >>upon punishment/cost of their actions in protest of the actions >>of their public servants. Their public servants, as usual, chose >>to to act in the manner of savages who are incapable of holding >>to the rule of law which they use to justify their confiscation >>of the citizen's right to bear arms in the face of tyranny. > >Excuse me, but this modern notion that protesters get to "make a deal" >about the fines they'll eventually pay is bogus. If they're trespassing, >they're trespassing. They don't get to take over Intel's factory, chain >themselves to the Evil Factory doors, and then make a deal to pay some >token fine. I think you're overreacting here (or I am misreading the above '>>'). If the sentence is life, with a chance for parole after 15 years, or if the sentence is death, that is what all those who practice civil disobedience should face -- what the actual sentence is. Applying pepper spray directly to eyes of _non-violent_ demonstrators is "cruel and unusual punishment", not just normal arrest procedures. (Violent demonstrators must deal with the consequences of their actions, including death.) [as usual -- just my own views...] ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm at indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'" From FisherM at exch1.indy.tce.com Fri Oct 31 09:54:57 1997 From: FisherM at exch1.indy.tce.com (Fisher Mark) Date: Sat, 1 Nov 1997 01:54:57 +0800 Subject: PGP Employee on MKR Message-ID: <2328C77FF9F2D011AE970000F84104A74933FD@indyexch_fddi.indy.tce.com> >Scenario #2: employee quits jon in a huff, refuses to divulge >passphrase, lots of queued encrypted email -- what now? Or lots of encrypted old email that contains useful information. Especially in a larger corporate environment, where an email system is deployed that uses a proprietary message store (like Microsoft Mail or Microsoft Exchange), people tend to use the mailboxes as storage containers. It gets worse if these isn't a way to get the messages out of the vendor's message store conveniently -- if you want to keep old messages around, they _have_ to be stored in the vendor's message store. ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm at indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'" From FisherM at exch1.indy.tce.com Fri Oct 31 10:02:45 1997 From: FisherM at exch1.indy.tce.com (Fisher Mark) Date: Sat, 1 Nov 1997 02:02:45 +0800 Subject: Protocols for Insurance to Maintain Privacy Message-ID: <2328C77FF9F2D011AE970000F84104A74933FE@indyexch_fddi.indy.tce.com> >You can improve the situation by purchasing high deductible policies. >It is astonishing how quickly the rates fall when you are willing to >pay the first few thousand yourself. This is almost a necessity nowadays, as many employers don't start your health coverage until you have been employed for 6 months. A high deductible makes self-insurance (at least for engineers) affordable when in-between corporate health insurance policies. ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm at indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'" From tcmay at got.net Fri Oct 31 10:10:55 1997 From: tcmay at got.net (Tim May) Date: Sat, 1 Nov 1997 02:10:55 +0800 Subject: Jim Bell sentencing delayed In-Reply-To: <1.5.4.32.19971031120116.00c62d58@pop.pipeline.com> Message-ID: I'm not Greg, but I think the repeated delays in Bell's sentencing have obvious reasons. At 5:01 AM -0700 10/31/97, John Young wrote: >Greg, > >What's your take on repeated delay in Jim's sentencing: > >1. A squeeze on Jim to finger co-conspirators. Yep. This seemed apparent when he was remanded to the custody of U.S. Marshals after his brief trial. Why was he not sentenced that very day, of the verdict, or the day after? How can holding a person for six or more months without a sentence possibly by justified, even in Amerika's fucked up judicial system? His incarceration is itself the best justification for his ideas. (The au pair in Cambridge, MA was sentenced the day after the verdict, and could've been sentenced the day of the verdict had it not been so late at night. So why does it take six or more months to decide on Bell's sentence? Because he's a political criminal.) >2. Weak case, must use procedure to punish. Weak case or not, he was already found guilty, so this is moot. If the judge thought the case was so weak that he could not give jail time, then why would the same judge effectively "give jail time" by the act of continuance for so many months? It doesn't compute. >4. Jim was up to something worse now being discovered >(like 5 below). > >5. Jim is a secret gov agent, now feet up in Tacoma IRS >laughing at those who fell for suckerbait, screwball AP >written by IRS as a sting (a recent book package to Jim was >returned marked "Not in Jail"). Probably just a screw-up in processing. I admit that I haven't tried to contact Bell, or send him books, or visit him. Bell might have _turned_, a possibility (which I doubt) one must always consider. But he was almost certainly not an agent all those years he was doing other things. For one thing, he didn't recruit others into doing the things he was eventually charged with doing....kind of a non-starter for an agent provacateur. I hope that if and when I am ultimately charged, arrested, raided, shot, declared insane, committed, whatever, that I have the decency to stand my ground. I don't know Jim Bell, except through his posts on Cypherpunks, but if the recent letters reprinted here on the list are really his, he appears to be a changed, or broken, man. I'd say the real reason for his six-month stay of sentencing is this: Real Reason: Psychological pressure, with the prospect of release for time served held constantly over his head, and the prospect of heavy prison time also held constantly over his head. Instead of sentencing him and being done with it, letting Bell then adjust to what was ahead of him, and probably remaining a supporter of his own ideas, they instead subject him to the well-known psychological pressure (even torture) of never telling him what's ahead. Kafka's "The Trial" comes to mind. No wonder the people are having their own trials of the criminals in the judicial system. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From anon at anon.efga.org Fri Oct 31 10:42:04 1997 From: anon at anon.efga.org (Anonymous) Date: Sat, 1 Nov 1997 02:42:04 +0800 Subject: Remailer hating Nazis (was Re: The BIG Lie (Jesus Confesses)) Message-ID: <051a566c9691cfdb21332a9987029971@anon.efga.org> dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM) wrote: > > The remailer hating Nazi called Patrick Oonk wrote: > > >At least I don't hide behind a remailer. I'll bet he wears a badge with his full name, street address, and home phone number when he walks down the street so as not to "hide behind" his otherwise anonymous clothing! (Everyone is entitled to know the identity of everyone else, right?) > > If so, then burn in hell, Nazi scum-sucking weasel! > > > Ditto for Paul Pomes and Gary Burnore. I'm familiar with the role of Gary Burnore and that of his DataBasix associates Belinda Bryan and Billy McClatchie (aka "Wotan") in getting the Mailmasher and Huge Cajones remailers shut down. Jeff Burchell posted a public expose' of their harassment to Usenet back in June, apparently catching the DataBasix folks off-guard. But what's the story with Paul Pomes? What has he done? Perhaps the best thing that can be done with people like Burnore is to put together an FAQ about their tactics, similar to what his "fans" have done for the "Rev." Steve Winter. Then when Burnore tries to stir up trouble by first fabricating anonymous "abuse" and then demanding that it either be stopped and the culprit(s) identified (knowing in advance that's impossible), or else that the remailer be shut down, someone can forward that FAQ to the remailer's upstream provider, or whoever is being pressured to pull the plug. And if Paul Pomes engages in the same dishonest tactics, that needs to be done with him as well. -- "I cannot convince myself that there is anyone so wise, so universally comprehensive in his judgment, that he can be trusted with the power to tell others: 'You shall not express yourself thus, you shall not describe your own experiences; or depict the fantasies which your mind has created; or laugh at what others set up as respectable; or question old beliefs; or contradict the dogmas of the church, of our society, our economic systems, and our political orthodoxy.'" - Jake Zeitlin From tcmay at got.net Fri Oct 31 10:45:05 1997 From: tcmay at got.net (Tim May) Date: Sat, 1 Nov 1997 02:45:05 +0800 Subject: North CA cops skip preliminaries, get straight to torture In-Reply-To: <2328C77FF9F2D011AE970000F84104A74933FC@indyexch_fddi.indy.tce.com> Message-ID: At 10:45 AM -0700 10/31/97, Fisher Mark wrote: >I think you're overreacting here (or I am misreading the above '>>'). >If the sentence is life, with a chance for parole after 15 years, or if >the sentence is death, that is what all those who practice civil >disobedience should face -- what the actual sentence is. Applying >pepper spray directly to eyes of _non-violent_ demonstrators is "cruel >and unusual punishment", not just normal arrest procedures. (Violent >demonstrators must deal with the consequences of their actions, >including death.) This whole "non-violent demonstrators" stuff is the conceptual flaw. If I return to my home or place of business and find that "demonstrators" have placed a 700-pound tree trunk in the center of my living room or office and have chained themselves to it, or surrounded it with a human chain, as a form of "protest," my response will be simple: "I'm going to go get my assault pistol and a couple of other guns. If you're gone by the time I get back, we'll settle in civil court for the damage you just did to my front door, my carpet, and my peace of mind. If you're not gone, I'll consider you intruders in my home or business, and probable threats. Take your choice." Sounds fair to me. "Non-violent demonstrators" are still trespassers, and possible security threats. This is what guns are for. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From tcmay at got.net Fri Oct 31 10:50:58 1997 From: tcmay at got.net (Tim May) Date: Sat, 1 Nov 1997 02:50:58 +0800 Subject: Protocols for Insurance to Maintain Privacy In-Reply-To: <2328C77FF9F2D011AE970000F84104A74933FE@indyexch_fddi.indy.tce.com> Message-ID: At 10:52 AM -0700 10/31/97, Fisher Mark wrote: >>You can improve the situation by purchasing high deductible policies. >>It is astonishing how quickly the rates fall when you are willing to >>pay the first few thousand yourself. > >This is almost a necessity nowadays, as many employers don't start your >health coverage until you have been employed for 6 months. A high >deductible makes self-insurance (at least for engineers) affordable when >in-between corporate health insurance policies. (Personal caveat: I haven't visited a doctor for any reason since 1970, and that was for a required college physical. Oh, and a 10-minute "physical" in the late 70s for a life insurance policy, which I later let lapse. Saying this probably means I'll be hospitalized in the next few months.) I had an engineer working for me who cheerfully used the company medical plan for all it was worth. If his kid had a cold, off to the doctor. If his wife felt feverish, off to the doctor. If he had an upset stomache after lunch (understandable considering the state of company food and burrito-vending machines in 1980), off to the doctor. He may have paid $5 per visit. Of course, he took off a lot of time to make these various treks to have his kids, himself, and his wife "treated" (given aspirin, told to drink plenty of fluids, whatever). A nice racket for the hospitals. If something is made free, people tend to use more of it. This is the health care crisis in America, and a slightly different one in Canada. Details vary, but the problems have the same root cause: distortions in markets. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From mskala at swindle.csc.UVic.CA Fri Oct 31 11:00:41 1997 From: mskala at swindle.csc.UVic.CA (mskala at swindle.csc.UVic.CA) Date: Sat, 1 Nov 1997 03:00:41 +0800 Subject: The reason we need to give up our rights... In-Reply-To: <2d531f1a3bd67fb025b10fe779f2bd10@anon.efga.org> Message-ID: On Fri, 31 Oct 1997, Anonymous wrote: > Recently, a Canadian man was charged with 572 instances of having > individual and group sex with pre-teenage boys. He was sentenced to > a 'duece-less' (two years less a day), which is 'soft time' in Canada, > and is served in a provincial jail instead of a federal institution. It's also the longest sentence they can give with no possibility for parole. You neglected to mention that, and I think it's highly relevent. I'm not familiar with the particular case you describe, but I used to know a man who ended up going to jail for two years less a day for raping his daughter, and in the decision, the judge said he really wanted to give him a much longer sentence, but considered it more important to be certain he'd be kept away from the family as long as possible. From aba at dcs.ex.ac.uk Fri Oct 31 11:16:52 1997 From: aba at dcs.ex.ac.uk (Adam Back) Date: Sat, 1 Nov 1997 03:16:52 +0800 Subject: PGP Employee on MKR In-Reply-To: <2328C77FF9F2D011AE970000F84104A74933FD@indyexch_fddi.indy.tce.com> Message-ID: <199710311817.SAA05405@server.test.net> Fisher Mark writes: > >Scenario #2: employee quits jon in a huff, refuses to divulge > >passphrase, lots of queued encrypted email -- what now? > > Or lots of encrypted old email that contains useful information. > Especially in a larger corporate environment, where an email system is > deployed that uses a proprietary message store (like Microsoft Mail or > Microsoft Exchange), people tend to use the mailboxes as storage > containers. Absolutely. However it is better where this is possible to decrypt the message (and optionally re-encrypt the messages to a long-lived storage key) prior to storing in the mail folder. I am lead to understand this is relatively easy to do with the plugin APIs pgp are implementing within. The advantage of using separate storage encryption keys is that you can give the communications only encryption keys appropriate expiry periods. > It gets worse if these isn't a way to get the messages out of the > vendor's message store conveniently -- if you want to keep old > messages around, they _have_ to be stored in the vendor's message > store. PGP Inc already has this problem with their CMR approach -- when the user forgets his passphrase there is no backup of the key. So to retain data availability they must have the recovery czar decrypt the lot, and re-encrypt it to the users new key. Messy. I'm also not sure that they have automated this for the sorts of plug environments you are talking about (eg. with monolithic 100Mb microsoft exchange sent/received mail databases). Which tends to suggest corporate users who are worried about the password forgetting problem will copy the private keys on floppies. This is bad because pgp5.x is not designed for this -- they will get private signature keys too allowing forgeries. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 >If I return to my home or place of business and find that "demonstrators" >have placed a 700-pound tree trunk in the center of my living room or >office and have chained themselves to it, or surrounded it with a human >chain, as a form of "protest," my response will be simple: Hmmm... must have missed the part about their trespassing. If demonstrators trespass (or break any other laws), then they must bear the consequences of their actions. To me, the only truly peaceful demonstrator is one who does not break any laws while demonstrating (other than laws that stipulate that no demonstrations are permitted (First Amendment and all)). ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm at indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'" From ryan at michonline.com Fri Oct 31 11:44:02 1997 From: ryan at michonline.com (Ryan Anderson) Date: Sat, 1 Nov 1997 03:44:02 +0800 Subject: [NTSEC] Security Alert (fwd) Message-ID: ****************************************************************** WARNING, CAUTION, DANGER, AND BEWARE! Gullibility Virus Spreading over the Internet! ****************************************************************** WASHINGTON, D.C.--The Institute for the Investigation of Irregular Internet Phenomena announced today that many Internet users are becoming infected by a new virus that causes them to believe without question every groundless story, legend, and dire warning that shows up in their inbox or on their browser. The Gullibility Virus, as it is called, apparently makes people believe and forward copies of silly hoaxes relating to cookie recipes, email viruses, taxes on modems, and get-rich-quick schemes. "These are not just readers of tabloids or people who buy lottery tickets based on fortune cookie numbers," a spokesman said. "Most are otherwise normal people, who would laugh at the same stories if told to them by a stranger on a street corner." However, once these same people become infected with the Gullibility Virus, they believe anything they read on the Internet. "My immunity to tall tales and bizarre claims is all gone," reported one weeping victim. "I believe every warning message and sick child story my friends forward to me, even though most of the messages are anonymous." Another victim, now in remission, added, "When I first heard about Good Times, I just accepted it without question. After all, there were dozens of other recipients on the mail header, so I thought the virus must be true." It was a long time, the victim said, before she could stand up at a Hoaxees Anonymous meeting and state, "My name is Jane, and I've been hoaxed." Now, however, she is spreading the word. "Challenge and check whatever you read," she says. Internet users are urged to examine themselves for symptoms of the virus, which include the following: The willingness to believe improbable stories without thinking. The urge to forward multiple copies of such stories to others. A lack of desire to take three minutes to check to see if a story is true. T. C. is an example of someone recently infected. He told one reporter, "I read on the Net that the major ingredient in almost all shampoos makes your hair fall out, so I've stopped using shampoo." When told about the Gullibility Virus, T. C. said he would stop reading email, so that he would not become infected. Anyone with symptoms like these is urged to seek help immediately. Experts recommend that at the first feelings of gullibility, Internet users rush to their favorite search engine and look up the item tempting them to thoughtless credence. Most hoaxes, legends, and tall tales have been widely discussed and exposed by the Internet community. Courses in critical thinking are also widely available, and there is online help from many sources, including Department of Energy Computer Incident Advisory Capability at http://ciac.llnl.gov/ciac/CIACHoaxes.html Symantec Anti Virus Research Center at http://www.symantec.com/avcenter/index.html McAfee Associates Virus Hoax List at http://www.mcafee.com/support/hoax.html Dr. Solomons Hoax Page at http://www.drsolomons.com/vircen/hoax.html The Urban Legends Web Site at http://www.urbanlegends.com Urban Legends Reference Pages at http://www.snopes.com Datafellows Hoax Warnings at http://www.Europe.Datafellows.com/news/hoax.htm Those people who are still symptom free can help inoculate themselves against the Gullibility Virus by reading some good material on evaluating sources, such as Evaluating Internet Research Sources at http://www.sccu.edu/faculty/R_Harris/evalu8it.htm Evaluation of Information Sources at http://www.vuw.ac.nz/~agsmith/evaln/evaln.htm Bibliography on Evaluating Internet Resources at http://refserver.lib.vt.edu/libinst/critTHINK.HTM Lastly, as a public service, Internet users can help stamp out the Gullibility Virus by sending copies of this message to anyone who forwards them a hoax. ****************************************************************** This message is so important, we're sending it anonymously! Forward it to all your friends right away! Don't think about it! This is not a chain letter! This story is true! Don't check it out! This story is so timely, there is no date on it! This story is so important, we're using lots of exclamation points! Lots!! For every message you forward to some unsuspecting person, the Home for the Hopelessly Gullible will donate ten cents to itself. (If you wonder how the Home will know you are forwarding these messages all over creation, you're obviously thinking too much.) ****************************************************************** ACT NOW! DON'T DELAY! LIMITED TIME ONLY! NOT SOLD IN ANY STORE! From nobody at REPLAY.COM Fri Oct 31 12:14:12 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sat, 1 Nov 1997 04:14:12 +0800 Subject: Jim Bell sentencing delayed Message-ID: <199710311947.UAA04649@basement.replay.com> John Young wrote: > Greg, > What's your take on repeated delay in Jim's sentencing: > > 1. A squeeze on Jim to finger co-conspirators. Aleady confirmed, upon researching a theory that Jim's 'letter of pennance' was calculated to warn anyone with half-a-brain that it would be unwise to put a lot of trust in either himself or anyone working with information gleaned from the search/seizure and/or prosecution of James Dalton (Gang?) Bell. It is standard procedure to delay punishment in cases where: a) The narcs are *hoping* to 'turn' the individual, and need to string out their control over them (which diminishes rapidly once their fate is confirmed). b) The narcs *already have* turned the individual and are unsure if the person is yanking their chain, trying to get a done deal without giving up conspirators yet-to-be-born, as promised. (Known as "the unborn" by the spook-oriented.) c) The narcs have a 'done deal' with the individual, and need to postpone any signs of a 'sweetheart deal' so as not to spook (pardon the pun) the targets of an ongoing investigation. d) The warrants are in the mail and the individual's sentencing is dependent on future testimony/cooperation. e) The spooks are having trouble finding the right combination of chemicals to twist the individual's mind into a willing vessel of their mind-control plans for them as a suitcase salesman. > 2. Weak case, must use procedure to punish. Delay is usually used when they've gotten some backwoods legal aide dupe to sell their client down the river unwittingly, and they want the individual to spend as much time as possible in jail before finding out at his or her sentencing that they have gotten totally screwed and they go out and get themselves a good lawyer. Not the case, here. Jim's lawyer knew where his future career was buttered. Nobody unwittingly lets their client get stomped on that badly and refuses offers of outside assistance, without being a part of the plan. > 3. To let time served be the sentence. Nope. > 4. Jim was up to something worse now being discovered Nope. But they could very well be trying to manipulate him into turning on others, OR (listen closely...) 'pretending' to turn on others without really giving them up, and turning his own past non-crimes into real-crimes in the process. e.g. - "I don't know if John Young was *serious* about what he said in that email to me, but I could find out, once I am out of here." This is a true toilet-plunger maneuver, with the individual led to 'making' his past actions criminal with the statements he makes today. 'Wise guys' are susceptible to this, being too smart for their own good, and thinking they can walk with the Devil as far as the Bridge. > 5. Jim is a secret gov agent, now feet up in Tacoma IRS > laughing at those who fell for suckerbait, screwball AP > written by IRS as a sting (a recent book package to Jim was > returned marked "Not in Jail"). a) A definite possibility, but extremely difficult to confirm. McVeigh, for instance, did everything but wave a red flag to get his ass picked up. Tough to tell a 'death wish' from personal involvement in 'the plan.' b) Jim and Tim were both 'led to believe' that they were 'part of the plan' and will continue to believe so until it becomes obvious that the burning coals being prepared in the pit are for them, at which time it is a little late to start saying, "Actually, the *real* story is..." > 6. The court was hoodwinked by IRS, too, and the AUSA > is preparing an indictment of the stingers and federal defenders > and who knows who else that was in on it. Not *that* court. That one, like the one in Denver, is a *home* court, with *home* referees and officials. It's tough to win in Vegas, unless you're *from* Vegas. (Nobody calls from Vegas just to say "Hello.") > 7. Secret Agent Jim is squealing on his double-crossing > secret agents, cutting a deal with whoever else is double- > crossing whomever. He's going down, they're going down, > we're going down, the whole country's going down; Up the > Revolution! We can only dream... 9. 'C'hoate, 'C'hudov and 'C'ottrel are actually running the CDR list from a cell adjoining 'B'ell's, and those whose names begin with a 'D' will be the next to join them. (The narcs are saving the 'A's for last, because they can't figure out who the hell 'Anonymous' is.) From declan at well.com Fri Oct 31 12:32:04 1997 From: declan at well.com (Declan McCullagh) Date: Sat, 1 Nov 1997 04:32:04 +0800 Subject: Washington-area cypherpunks party this weekend Message-ID: If you haven't heard already, there's a Washington, DC-area cypherpunks meeting this weekend. It's Sunday, November 2 at 4 pm in the NW portion of the city. Topics sure to be discussed include what's happening in Congress, PGP and message recovery, and the government's key-escrow-fest scheduled for next week. Simon Davies and Peter Neumann are likely to show up as well. Marc Rotenberg and his wife are hosting. Their home is near the National Cathedral, between Connecticut and Wisconsin avenues. Plenty of parking. Walk is 12-15 mins from the Woodley Park/Nat'l Zoo Metro stop on the red line. Email me for directions if you're interested. -Declan From ravage at ssz.com Fri Oct 31 12:58:56 1997 From: ravage at ssz.com (Jim Choate) Date: Sat, 1 Nov 1997 04:58:56 +0800 Subject: update.344 (fwd) Message-ID: <199710312053.OAA26144@einstein.ssz.com> Forwarded message: > From physnews at aip.org Fri Oct 31 12:24:51 1997 > Date: Fri, 31 Oct 97 09:57:13 EST > From: physnews at aip.org (AIP listserver) > Message-Id: <9710311457.AA04491 at aip.org> > To: physnews-mailing at aip.org > Subject: update.344 > > PHYSICS NEWS UPDATE > The American Institute of Physics Bulletin of Physics News > Number 344 October 31, 1997 by Phillip F. Schewe and Ben > Stein > > THE PHYSICS OF TRAFFIC JAMS. German scientists have > shown that the changeover from free-flowing traffic to a traffic jam > (in which cars on a highway are greatly slowed or halted, at least > temporarily) conforms to the well-known physics of phase > transitions, an example of which is the transition from water to ice. > In other words, traffic jams are not random patterns, but are > deterministic in nature; that is, when a parameter exceeds a > threshold value---such as the flux of cars---then local perturbations > can grow, possibly leading to jams, analogous to the nucleating > effect of tiny ice grains in a body of water being frozen. Once > formed the jam moves along the highway as if it were a kind of > "solid," with identifiable edges and with a "vapor" of comparatively > free cars in front of and behind it. The information gained in this > sort of research, the researchers believe, might lead to more > accurate traffic forecasts and could be used in future "intelligent" > transport systems. (B.S. Kerner and H. Rehborn, Physical Review > Letters, 3 Nov. 1997; contact Boris Kerner, Daimler-Benz AG, > kerner at dbag.stg.daimlerbenz.com.) > INDUCED TRANSPARENCY IN A SOLID OBJECT. [deleted] > PRODUCING ELEMENT 114 [deleted] > THE MOON FORMED IN ABOUT A YEAR [deleted] From tcmay at got.net Fri Oct 31 13:06:59 1997 From: tcmay at got.net (Tim May) Date: Sat, 1 Nov 1997 05:06:59 +0800 Subject: Bell sentencing timed to coincide with raids on militia members? In-Reply-To: <199710311947.UAA04649@basement.replay.com> Message-ID: At 12:47 PM -0700 10/31/97, Anonymous wrote: >c) The narcs have a 'done deal' with the individual, and need to > postpone any signs of a 'sweetheart deal' so as not to spook > (pardon the pun) the targets of an ongoing investigation. >d) The warrants are in the mail and the individual's sentencing > is dependent on future testimony/cooperation. By the way, I trust you have all seen the newswire report about a fax being accidentally sent to a Washington (state) newspaper, advising FBI field offices of possible militia activity in the Spokane and Washington state areas? Many of us believe this memo, apparently sent to the wrong address when an FBI clerk hit the wrong button on the autosend FAX, is a hint that a series of raids is coming. Could it be tied to information provided by Bell? Maybe. Mabye not. But the sentencing of Bell, now delayed to November 21st, fits with the likely timing of raids. (Thought the screwup with the fax could delay things....) I am including the AP text below, the key paragraphs (for "fair use"). --- Classified FBI fax sent by mistake - Oct. 27, 1997 SPOKANE, Washington (AP) -- A classified FBI document warning that militia-linked terrorists may be plotting to bomb government agencies during the holidays was sent by mistake to a movie memorabilia shop. Eric DuBois found the 11-page report on his fax machine October 9. He called the FBI and also showed a copy to The Spokesman-Review newspaper, which reported on the security breach Sunday. ... The document, which bears the FBI logo and is marked "confidential," was apparently intended to alert field agents in the West. Based on the allegations of an informant, the report names radicals who are believed to have stockpiled assault rifles, handguns and explosives. ... Copyright 1997 The Associated Press --- Want to bet that the November 21st sentencing of Bell, right before this very same holiday period, and in the very same region, has something to do with the likely raids on the "radicals" "believed to have stockpiled" these items? Except for the explosives part, the rest of it sounds like what a lot of us are doing. What laws are being broken by these "stockpilers"? Get ready, folks. By the way, I'll be at the gun show at the Cow Palace in San Francisco on the weekend of November 8-9, probably Saturday, the 8th. Seems I'm running low on certain types of ammo, and I may want to pick up a couple more assault rifles before Swinestein succeeds in completely banning them. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From tm at dev.null Fri Oct 31 14:51:13 1997 From: tm at dev.null (TruthMonger) Date: Sat, 1 Nov 1997 06:51:13 +0800 Subject: Tough On 49% of the Crime / Re: democracy?! (Re: Terrorism is a NON-THREAT In-Reply-To: <43e6aee147%Tim@tim01.ex.ac.uk> Message-ID: <345A5D48.6090@dev.null> Tim Griffiths wrote: > Does it...mean that we potentially have 49% of the population > in jail for any particular act, deemed to be a crime by the remaining 51%? Take $100.00 to a gambling hall every day where the slot machine payout is 96% and you come home with an average of $96.00, right? Government power grows via the same types of mechanisms at work in gambling, pea-shell games, pyramid schemes, etc. The 51% of Green citizens vote the 49% of other-colored citizens into imprisonment. The 51% of Lime-Green citizens... ...... You and the other Left-Handed, Brown-eyed, Red-Haired, Lime-Green citizen flip a coin to see which one of you is imprisoned and which one remains free. Politicians now run on 'slogans' instead of 'platforms' because then they don't really even have to bother much with pretending to fulfill any particular so-called 'voter mandate.' Nobody runs on a platform of imprisoning all citizens with names beginning with 'B' through 'L'. They run behind a vague 'Tough On Crime' slogan. Then... "We're putting all people who have names beginning with 'B' in jail... blah...blah...blah...Tough On Crime! "We're putting all people who have names beginning with 'C'... ...... "We're putting all people who have names beginning with 'L'... Next Election: "I have never stated I am in favor of imprisoning people whose names begin with 'N', but I *do* promise to be 'Tough On Crime'!" Your Plan: To confiscate all of the citizens' money. Your Platform: Promise not to raise taxes. Your Plan: To murder all of the citizens. Your Platform: Promise to be 'Tough On Crime.' Campaign Plan: Show 1 picture of paroled murderer killing again. Show it 100,000 times. After Elected: Vote on hundreds upon hundreds of laws which have absolutely nothing to do with anything you mentioned in your election campaign, or are issues which you blah-blah-blahed before showing 'the picture' once again, working the crowd of 'N' people into another frenzy. Next Week: The Line Item Veto Interpreted by the Supreme Court to Approve Congressional Amendment Veto Powers for the Whitehouse Janitor. TRUTHMONGER is an out of work comedian who couldn't get a job with CNN because he couldn't keep a straight face when reporting the 'regular' news. He plans to change his name to ZRUTHMONGER before the next elections. From wendigo at ne-wendigo.jabberwock.org Fri Oct 31 15:13:18 1997 From: wendigo at ne-wendigo.jabberwock.org (Mark Rogaski) Date: Sat, 1 Nov 1997 07:13:18 +0800 Subject: Killing those who need killing (fwd) In-Reply-To: <199710310740.BAA02029@smoke.suba.com> Message-ID: <199710312304.SAA20208@deathstar.jabberwock.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 An entity claiming to be snow wrote: : : > Right wing, left wing, friggin' wingless ... the above comment still : > indicates a sociopath. : : And the problem with that is... : : : You must live in such a nice world, where the sky is always blue, : the grass always green, and the police eager and willing to serve a happy : populace. : : Can I come live in your world? : Get a grip. My world is just has the same ugly grey patina of reality as yours. I should have qualified my comment a bit more. Ranting about sniper rifles in a public forum is only going to set you up for a losing battle. I actually agree with Tim about the justification for extreme measures, I just don't necessarily think that setting yourself up as a target for some gung-ho BATF agents is a good way to see justice served. "Eagles may soar, but weasels never get sucked into jet engines" -- Anonymous Mark - -- [] Mark Rogaski "That which does not kill me [] wendigo at pobox.com only makes me stranger." -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNFpkF8HFI4kt/DQOEQLOzgCeItRjExLIpXTZfSbBTEPZcX6edmkAoPma svnB7Kx7XOkOhBopVai3Zh7/ =H9jp -----END PGP SIGNATURE----- From nobody at REPLAY.COM Fri Oct 31 15:13:22 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sat, 1 Nov 1997 07:13:22 +0800 Subject: Infinigy? Message-ID: <199710312259.XAA23914@basement.replay.com> > Anonymous wrote: > > > > Is there an archive of various papers concerning such things as Assassination > > Politics, Eternity Servers, Reputation Capital, The Blowfish Cipher, CROWDS, > > encryption of IP traffic, etc.? > > Anonymous, worried that answering himself might lead to being > incarcerated against his will for a mental evaluation, replies: > > Tim C. May is a living archive of these issues and technologies, but > it is a bad idea to show up on his doorstep, unannounced. > > However, it is sometimes possible to sneak into a website to be > found at http://jya.com/ and get out alive with as much information > as you are capable of stuffing into your CyberPockets during your > sojourn into the bowels of Cryptocracy. > If you enjoy browsing leisurely through odd piles of obscure posts > on all of the above, and more, the Infinity website CPUNX archive > can be found at http://infinigy.nus.sg/cypherpunks ** OK, would you believe -- http://infinity.nus.sg/cypherpunks ? ** > (Of particular classical value are the many [ADMINISTRAVIUM] > posts which contain valuable graphical representations of > some of the more arcane CPUNX traditions.) > > AlwaysHappyToHelpMonger From tm at dev.null Fri Oct 31 15:45:12 1997 From: tm at dev.null (TruthMonger) Date: Sat, 1 Nov 1997 07:45:12 +0800 Subject: Got an IRS horror story? In-Reply-To: Message-ID: <345A690A.2EEB@dev.null> Declan McCullagh wrote: > >> House Republicans opened a new Internet site Wednesday "to collect > >>IRS horror stories from the American people." > >> The new site is on the House Republican Conference's World Wide Web > >>page. It's aimed at giving "the American people the opportunity to share > >>the frightening experiences they have had when dealing with the IRS as > >>Congress prepares to pass significant IRS reform," GOP lawmakers said in > >>a statement. > >> The site is http://hillsource.house.gov. > >> APTV-10-29-97 1907EST Anybody notice that the Big Grey is putting the screws to many of the agencies, etc. which aren't already under their control? Has anyone noticed a common denominator between those whom Big Grey is maneuvering into key power positions? Anyone going to be terribly surprised, now that the Line-Item Veto has been passed, if our next President is from the ranks of the Big Grey? Question: "Who will be the most important government figure in the U.S. if the Y2K problem leads to financial chaos?" Tongue in cheek Answer: Inspector #7. [Mattress Division] TruthMonger From ryan at michonline.com Fri Oct 31 16:22:59 1997 From: ryan at michonline.com (Ryan Anderson) Date: Sat, 1 Nov 1997 08:22:59 +0800 Subject: [NTSEC] New browser security hole (fwd) Message-ID: In the interests of furthering the virus alerts we've seen today, I offer this, from: http://www.browse.net/techfelch/ -------------------------------------------------------------------------- The Internet Engineering Taskforce (IETF) today announced they had discovered a "far-reaching and fundamental" security flaw in many of the web browsers currently available, including the new 4.0 versions of Netscape's and Microsoft's flagship browser products. "This loophole could seriously compromise the integrity of user data, if exploited by an unscrupulous webmaster." said Bill Robinson, a consultant and advisor to the IETF. The details of the possible attack were announced in the usual way in usenet newsgroups by the IETF. The bulletin states that "any browser that displays HTML pages" may be vulnerable to the loophole. "An unscrupulous webmaster may exploit this loophole by placing a message on any HTML page which instructs the user to format their system's hard disk." says the announcement. Robinson stated that the code preys on users that don't take strict security precautions, and that have trouble breathing with their mouths closed. +----------------------------------------------+ | | | | |

IMPORTANT!

| |

Format your hard disk immediately

| | | | | +----------------------------------------------+ One possible version of the 'rogue' code The IETF recommended that Netscape users tick the "Disable Java" option in the Netscape preferences dialog. "It won't do a damn bit of good," said Robinson, "but it's about the only piece of Netscape user interface that you can use without causing the damn thing to crash and burn, so what the hell - it gives them something to do." Microsoft claimed they would have a fix for MSIE available within 48 Microsoft hours. Linux users remain unaffected by the security threat as they don't have any data anyone gives a toss about anyway. From kent at songbird.com Fri Oct 31 16:27:23 1997 From: kent at songbird.com (Kent Crispin) Date: Sat, 1 Nov 1997 08:27:23 +0800 Subject: Small is beautiful Message-ID: <19971031160824.37907@songbird.com> -----Forwarded message from /nev/dull at cats.ucsc.edu----- 1997-10-04 Million Microbe March We are proud to announce the Million Microbe March. On December 29, 1997, a crowd of one million microbes will converge on Bethesda, Maryland. They will meet there on the lawn of the National Institutes of Health, and spend the entire day expressing solidarity, atonement, and genes. This is NOT going to be a celebration of diversity. While it is true that microbes have participated in the Million Man March, the Million Woman March, the Promisekeepers' March, and other anthropocentric marches, the Million Microbe March is just for microbes. There is a large spiritual aspect to the March. Too long have too many denied the spiritual nature of the microbial community. Too often have microbes been tormented or killed because otherwise compassionate beings denied the simple fact that microbes have souls. We ask you to please remember the official slogan of the Million Microbe March. If you or one near to you is going on the March, please chant the slogan long, loud, and often: Small is beautiful. Small is beautiful. Small is beautiful. -----End of forwarded message----- -- Kent Crispin "No reason to get excited", kent at songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html From ravage at ssz.com Fri Oct 31 17:02:40 1997 From: ravage at ssz.com (Jim Choate) Date: Sat, 1 Nov 1997 09:02:40 +0800 Subject: Terrorism is a NON-THREAT (fwd) Message-ID: <199711010053.SAA26870@einstein.ssz.com> Forwarded message: > Date: Fri, 31 Oct 1997 14:06:00 +0000 > From: Tim Griffiths > Subject: Re: Terrorism is a NON-THREAT (fwd) > But the bit I'm trying to get at. Doesn't the idea of what those rights > are change from social group to social group? Do they? My thesis is that people are people and the basic things that make them satisfied and productive are the same: life, liberty, and the pursuit of happiness. Prove that people over time change their base behaviour or that that base behaviour is fundamentaly linked to the societial more's that they are exposed to. Note, that there is a distinct difference between these base behaviours and how they express them. > Furthermore, doesn't having > a irrefutable set of laws place a fundamental (ist) limit on a > democracy that exists under them? Who, other than you, has said that there was a such thing as irrefutable laws? Laws or not rights, if your assertion is this please be so kind as to demonstrate that as well. Demonstrate that such a concept as irrefutable laws has an existance as anything other than idle mental mechanations. > Is it possible to have a true > democracy without the assumption of a 'higher authority'? Where in a democracy is there the assumption there is a higher authority than the governed? ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ravage at ssz.com Fri Oct 31 17:21:31 1997 From: ravage at ssz.com (Jim Choate) Date: Sat, 1 Nov 1997 09:21:31 +0800 Subject: democracy?! (Re: Terrorism is a NON-THREAT (fwd) Message-ID: <199711010114.TAA26954@einstein.ssz.com> Forwarded message: > Date: Fri, 31 Oct 1997 13:28:22 GMT > From: Adam Back > The real problem as I see it with democracy is that not only do your > neighbours get to vote to have you locked up for something which is > none of their business, and has no conceivable effect up on them; but > they actually get to vote for you to be charged for the "service" of > being locked up to protect you from yourself. Exactly what kind of democracy are you speaking of? Sounds like you are lumping them all into one big bucket, a disservice to all involved in this discussion and a popular spin-doctor tactic. If so, please be so kind as to demonstrate how a representative, constitutional, and majority democracy are the same? And for the record, we have a constitutional representative democracy. Personaly, I figure you must be one of those folks with a cognitive disfunction. What part of "Congress shall make no law..." do you not understand? > The wild west was better than this state of affairs -- people didn't > have the energy or inclination to waste their own resources being nosy > parkers, and those that did were apt to wind up full of lead. Boy, you history is simply fucked. If you seriosly think the west was like television you should spend more time reading books and period newspapers and less time looking at the boob-tube. At the height of the range wars there were only 9 murders associated with the conflict, not hundreds as the popular entertainment media and spin-doctor culture would have you believe. Get your fucking facts straight. Face off's at high-noon simply didn't happen and poeple didn't run around having gun fights all the time. I would suggest *strongly* that if nothing else you review the western history series by Time*Life, should be at your local library, and UT Press put out a book called "The Texas Rangers". I have both of them but unfortunately they are in my shop 30 miles away. A lookup at your local bookstore should get them if you are truly interested in how it was. "The Quick & The Dead" was a movie, not a historical documentary. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From ichudov at www.video-collage.com Fri Oct 31 17:54:37 1997 From: ichudov at www.video-collage.com (Igor Chudov @ home) Date: Sat, 1 Nov 1997 09:54:37 +0800 Subject: [ZOG] FBI MEMO FROM MSP SPEC OPERATIONS DIV In-Reply-To: <199710311954.UAA05302@basement.replay.com> Message-ID: <199711010133.BAA30862@manifold.algebra.com> Anonymous wrote: * ADMINISTRATIVE MESSAGE FROM MSP SPEC OPERATIONS DIV * * From: FBI NATIONAL SECURITY DIVISION * To: ALL LAW ENFORCEMENT AGENCIES * * * Internal Revenue Service {IRS} offices open on * selective Saturdays, beginning 11/15/97--POTENTIAL * FOR VIOLENCE. * * This communication is not an FBI terrorist threat, * alert, or advisory; it is for information only. Although * unclassified, this communication should be handled as * law enforcement sensitive. This communication should not * be furnished to the media or other agencies outside the * law enforcement/U.S. Government counterrorism community * without the permission of the F.B.I. * * A reported in the media, the IRS recently * announced that all IRS District Headquarters Offices will * be open on selective Saturdays, beginning 11/15/97, to * handle taxpayer complaints and problem cases. Due to the * recent publicity surrounding allegations of IRS abuses * against taxpayers, the offices may attract individuals * intent on disrupting business or committing violent acts * against IRS employees. As a result, IRS is planning to * heighten security at all offices. At this time, the FBI * has no information indicating a terrorist attack * or violence directed at IRS facilities or personnel. * * Should recipients receive any information regarding * violence directed against the IRS, contact the IRS and * your local FBI office immediately. * * Following is the list of the 33 IRS District * Headquarters Offices: * * FROM: FBI NATIONAL SECURITY DIVISION * Pacific Northwest District--Seattle, WA * Northern California District--Oakland, CA. * Central California District--San Jose, CA. * Los Angeles District--Los Angeles, CA. * Southern California District--Laguna Niguel, CA. * Southwest District--Phoenix, AZ * Rocky Mountain District--Denver, CO * Arkansas-Oklahoma District--Oklahoma City, OK * North Texas District--Dallas, TX * South Texas District--Austin, TX * Houston District--Houston, TX * Illinois District--Chicago, IL * -- - Igor. The average American spends a total of six (6) months in prison. From tm at dev.null Fri Oct 31 18:00:02 1997 From: tm at dev.null (TruthMonger) Date: Sat, 1 Nov 1997 10:00:02 +0800 Subject: Vote for Nym C. May! Message-ID: <345A8642.2A68@dev.null> * In March in Huntsville, Tenn., the wife of state Rep. Les Winningham was indicted for assault. During the election campaign in November 1996, according to police, the Winninghams pulled over in their van to confront a woman who was wearing a shirt that indicated support for Winningham's opponent. After a heated argument, according to the victim, Mr. Winningham instructed his wife to rough her up, whereupon Mrs. Winningham punched her three times and kicked her. ~~~ Send a message to notw-request at nine.org with the Subject line of Subscribe. To read these News of the Weird newspaper columns from the past six months, go to http://www.nine.org/notw/notw.html (That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it.) From tm at dev.null Fri Oct 31 18:01:18 1997 From: tm at dev.null (TruthMonger) Date: Sat, 1 Nov 1997 10:01:18 +0800 Subject: Vote for the TruthMonger of your choice...but VOTE! Message-ID: <345A8889.7531@dev.null> * Maria DiGiulio and Mohamed Sead became the latest criminal suspects not to beat around the bush when arrested. When DiGiulio was booked in July for robbing the Everett (Mass.) Co-op Bank, she answered police Lt. Robert Bontempo forthrightly. "Occupation?" he asked. "Bank robber," she said. Sead, 47, was booked for fraud last October in Toronto, Ontario (and convicted this year). Occupation? "Con artist," he said. (Sead's scheme was to deceive girlfriends that he was the now-deceased Dodi Fayed.) ~~~ Send a message to notw-request at nine.org with the Subject line of Subscribe. To read these News of the Weird newspaper columns from the past six months, go to http://www.nine.org/notw/notw.html (That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it.) From tm at dev.null Fri Oct 31 18:09:00 1997 From: tm at dev.null (TruthMonger) Date: Sat, 1 Nov 1997 10:09:00 +0800 Subject: Vote CypherPunk! Message-ID: <345A84BD.2C4B@dev.null> * In August, the Boston Globe profiled the Taiwan National Assembly (which specializes in constitutional issues), where it is fairly common for the minority New Party to filibuster by merely grabbing the microphone and physically restraining majority-party members so that they cannot call for votes. Fights break out, sometimes bloody ones. Said a local political science professor, "It may not be civilized, but it's efficient" because citizens respond by re-electing the aggressive legislators. ~~~ Send a message to notw-request at nine.org with the Subject line of Subscribe. To read these News of the Weird newspaper columns from the past six months, go to http://www.nine.org/notw/notw.html (That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it.) From tm at dev.null Fri Oct 31 18:09:36 1997 From: tm at dev.null (TruthMonger) Date: Sat, 1 Nov 1997 10:09:36 +0800 Subject: Proof that Free Market Works! Message-ID: <345A86C4.9E5@dev.null> * In May, police raided a construction site in Oporto, Portugal, and discovered that 12 drug addicts were working dawn to dusk on an apartment building in exchange for employer-provided heroin shoot-ups at breakfast, lunch, and dinner. According to police, the doses were just enough so that the men would remain employed to get the next fix. ~~~ Send a message to notw-request at nine.org with the Subject line of Subscribe. To read these News of the Weird newspaper columns from the past six months, go to http://www.nine.org/notw/notw.html (That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it.) From tm at dev.null Fri Oct 31 18:11:04 1997 From: tm at dev.null (TruthMonger) Date: Sat, 1 Nov 1997 10:11:04 +0800 Subject: Vote Carol Anne Cypherpunk! Message-ID: <345A8520.6C8D@dev.null> * While her colleagues were debating, in July, whether the New Life Massage Parlor was a front for prostitution, Oak Grove, Ky., City Councilwoman Patty Belew, 26, said she already had enough information to decide. She said she knows for sure that the massage parlor paid bribes to some police officers to ignore prostitution because she used to work there. ~~~ Send a message to notw-request at nine.org with the Subject line of Subscribe. To read these News of the Weird newspaper columns from the past six months, go to http://www.nine.org/notw/notw.html (That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it.) From tm at dev.null Fri Oct 31 18:13:20 1997 From: tm at dev.null (TruthMonger) Date: Sat, 1 Nov 1997 10:13:20 +0800 Subject: FW: Oh God I'm An Ocean Buoy]fwd: FW: Oh God I'm An Ocean Buoy Message-ID: <345A80AD.5DC3@dev.null> An embedded message was scrubbed... From: unknown sender Subject: no subject Date: no date Size: 2584 URL: From tm at dev.null Fri Oct 31 18:18:28 1997 From: tm at dev.null (TruthMonger) Date: Sat, 1 Nov 1997 10:18:28 +0800 Subject: CypherPunk HMO / Dr. Vulis & Dr. Grubor Presiding... Message-ID: <345A8380.6F5F@dev.null> --- Forwards have been surgically removed ----- A collection of medical interview and medical record remarks written by various paramedics, emergency room receptionists, and doctors at major hospitals. The baby was delivered, the cord clamped and cut and handed to the pediatrician, who breathed and cried immediately. Exam of genitalia reveals that TruthMonger is circus sized. The skin was moist and dry. Rectal exam revealed a normal size thyroid. The patient had waffles for breakfast and anorexia for lunch. She stated that she had been constipated for most of her life until 1989 when she got a divorce. Between you and me, we ought to be able to get this lady pregnant. The patient was in his usual state of good health until his airplane ran out of gas and crashed. I saw your patient today, who is still under our car for physical therapy. The patient lives at home with his mother, father, and pet turtle, who is presently enrolled in day care three times a week. Bleeding started in the rectal area and continued all the way to Los Angeles. Both breasts are equal and reactive to light and accommodation. She is numb from her toes down. Exam of genitalia was completely negative except for the right foot. While in the emergency room, she was examined, X-rated and sent home. The lab test indicated abnormal lover function. The patient was to have a bowel resection. However he took a job as a stockbroker instead. Occasional, constant, infrequent headaches. Coming from Detroit, this man has no children. Examination reveals a well-developed male lying in bed with his family in no distress. Patient was alert and unresponsive. When she fainted, her eyes rolled around the room. By the time he was admitted, his rapid heart had stopped and he was feeling better. Patient has chest pain if she lies on her left side for over a year. On the second day the knee was better and on the third day it had completely disappeared. She has had no rigors or shaking chills, but her husband states she was very hot in bed last night. The patient has been depressed ever since she began seeing me in 1983. I will be happy to go into her GI system, she seems ready and anxious. Patient was released to outpatient department without dressing. I have suggested that he loosen his pants before standing, and then, when he stands with the help of his wife, they should fall to the floor. The patient is tearful and crying constantly. She also appears to be depressed. Discharge status: Alive but without permission. The patient will need disposition, and therefore we will get Dr. Blank to dispose of him. Healthy-appearing, decrepit 69 year old male, mentally alert but forgetful. The patient refused an autopsy. The patient has no past history of suicides. The patient expired on the floor uneventfully. Patient has left his white blood cells at another hospital. Patient was becoming more demented with urinary frequency. The patient's past medical history has been remarkably insignificant with only a 40 pound weight gain in the past three days. She slipped on the ice and apparently her legs went in separate directions in early December. The patient experienced sudden onset of severe shortness of breath with a picture of acute pulmonary edema at home while having sex which gradually deteriorated in the emergency room. The patient left the hospital feeling much better except for her original complaints. From tm at dev.null Fri Oct 31 18:22:11 1997 From: tm at dev.null (TruthMonger) Date: Sat, 1 Nov 1997 10:22:11 +0800 Subject: From Russia, With Love (WAS: Why is the Commander in Chief always the last to know?) (WAS: Weekday Workers--Weekend Terrorists] (NEVER WAS: Right...like I'm going to use my _real_ name...) Message-ID: <345A8BE6.3577@dev.null> Subject: [ZOG] FBI MEMO FROM MSP SPEC OPERATIONS DIV Date: Sat, 1 Nov 1997 01:33:10 GMT From: "Ceegar Chewed-Off" To: cypherpunks at www.video-collage.com * ADMINISTRATIVE MESSAGE FROM MSP SPEC OPERATIONS DIV * * From: FBI NATIONAL SECURITY DIVISION * To: ALL LAW ENFORCEMENT AGENCIES * * * Internal Revenue Service {IRS} offices open on * selective Saturdays, beginning 11/15/97--POTENTIAL * FOR VIOLENCE. * * This communication is not an FBI terrorist threat, * alert, or advisory; it is for information only. Although * unclassified, this communication should be handled as * law enforcement sensitive. This communication should not * be furnished to the media or other agencies outside the * law enforcement/U.S. Government counterrorism community * without the permission of the F.B.I. * * A reported in the media, the IRS recently * announced that all IRS District Headquarters Offices will * be open on selective Saturdays, beginning 11/15/97, to * handle taxpayer complaints and problem cases. Due to the * recent publicity surrounding allegations of IRS abuses * against taxpayers, the offices may attract individuals * intent on disrupting business or committing violent acts * against IRS employees. As a result, IRS is planning to * heighten security at all offices. At this time, the FBI * has no information indicating a terrorist attack * or violence directed at IRS facilities or personnel. * * Should recipients receive any information regarding * violence directed against the IRS, contact the IRS and * your local FBI office immediately. * * Following is the list of the 33 IRS District * Headquarters Offices: * * FROM: FBI NATIONAL SECURITY DIVISION * Pacific Northwest District--Seattle, WA * Northern California District--Oakland, CA. * Central California District--San Jose, CA. * Los Angeles District--Los Angeles, CA. * Southern California District--Laguna Niguel, CA. * Southwest District--Phoenix, AZ * Rocky Mountain District--Denver, CO * Arkansas-Oklahoma District--Oklahoma City, OK * North Texas District--Dallas, TX * South Texas District--Austin, TX * Houston District--Houston, TX * Illinois District--Chicago, IL * -- - Ceegar. The average American spends a total of six (6) months in prison. From nobody at REPLAY.COM Fri Oct 31 18:50:00 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sat, 1 Nov 1997 10:50:00 +0800 Subject: You *know* what this means, don't you? / Re: [ZOG] FBI MEMO FROM MSP SPEC OPERATIONS DIV Message-ID: <199711010226.DAA20618@basement.replay.com> This is the FBI's way of informing the IRS that the everyday working citizen is now an enemy of the government, and likely to lay seige to any government office foolish enough to stay open during hours when the regular American Joe and Jane has time to do a quick drive-by on the way to pick up the kids at the Saturday afternoon movie at the mall. Igor Chudov @ home wrote: > Anonymous wrote: > * ADMINISTRATIVE MESSAGE FROM MSP SPEC OPERATIONS DIV > * > * From: FBI NATIONAL SECURITY DIVISION > * To: ALL LAW ENFORCEMENT AGENCIES > * > * > * Internal Revenue Service {IRS} offices open on > * selective Saturdays, beginning 11/15/97--POTENTIAL > * FOR VIOLENCE. > * > * This communication is not an FBI terrorist threat, > * alert, or advisory; it is for information only. Although > * unclassified, this communication should be handled as > * law enforcement sensitive. This communication should not > * be furnished to the media or other agencies outside the > * law enforcement/U.S. Government counterrorism community > * without the permission of the F.B.I. > * > * A reported in the media, the IRS recently > * announced that all IRS District Headquarters Offices will > * be open on selective Saturdays, beginning 11/15/97, to > * handle taxpayer complaints and problem cases. Due to the > * recent publicity surrounding allegations of IRS abuses > * against taxpayers, the offices may attract individuals > * intent on disrupting business or committing violent acts > * against IRS employees. As a result, IRS is planning to > * heighten security at all offices. At this time, the FBI > * has no information indicating a terrorist attack > * or violence directed at IRS facilities or personnel. > * > * Should recipients receive any information regarding > * violence directed against the IRS, contact the IRS and > * your local FBI office immediately. > * > * Following is the list of the 33 IRS District > * Headquarters Offices: > * > * FROM: FBI NATIONAL SECURITY DIVISION > * Pacific Northwest District--Seattle, WA > * Northern California District--Oakland, CA. > * Central California District--San Jose, CA. > * Los Angeles District--Los Angeles, CA. > * Southern California District--Laguna Niguel, CA. > * Southwest District--Phoenix, AZ > * Rocky Mountain District--Denver, CO > * Arkansas-Oklahoma District--Oklahoma City, OK > * North Texas District--Dallas, TX > * South Texas District--Austin, TX > * Houston District--Houston, TX > * Illinois District--Chicago, IL > * > > -- > - Igor. > > The average American spends a total of six (6) months in prison. From nobody at REPLAY.COM Fri Oct 31 18:55:01 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sat, 1 Nov 1997 10:55:01 +0800 Subject: Jim Bell--Mercetan Visionary / Re: [ZOG] FBI MEMO FROM MSP SPEC OPERATIONS DIV Message-ID: <199711010241.DAA23160@basement.replay.com> Igor Chudov @ home wrote: > * A reported in the media, the IRS recently > * announced that all IRS District Headquarters Offices will > * be open on selective Saturdays, beginning 11/15/97, to > * handle taxpayer complaints and problem cases. Due to the > * recent publicity surrounding allegations of IRS abuses > * against taxpayers, the offices may attract individuals > * intent on disrupting business or committing violent acts > * against IRS employees. Clueless John Young was mystified as to why Jim Bell's sentencing has been delayed for such a long period of time. You fool! They plan to run him for President as a grass-roots candidate. Glad I could clear that up... Anonymous (Except to John Young, who is cc:'d and will know ~~~~~~~~~ I am TruthMonger) From tm at dev.null Fri Oct 31 18:58:28 1997 From: tm at dev.null (TruthMonger) Date: Sat, 1 Nov 1997 10:58:28 +0800 Subject: Vote for Pat Robertson! Message-ID: <345A8797.2171@dev.null> * Among the recent rules established by the Afghanistan Taliban office formerly known as the Department for Promoting Virtue and Preventing Vice: No paper bags (because the paper possibly could have been recycled from discarded Korans); no kite-flying; no clean-shaven men (unless they are prepared for a career of street- sweeping); no women employed in senior positions in hospitals, or seated in the front seats of ambulances, or riding with foreign citizens; women visiting hospitals must refrain from making noise with their shoes while walking; athletes must grow beards and wear full Islamic dress in the field; and sports-event spectators must not clap. However, the ban on watching television was lifted. ~~~ Send a message to notw-request at nine.org with the Subject line of Subscribe. To read these News of the Weird newspaper columns from the past six months, go to http://www.nine.org/notw/notw.html (That site contains no graphics, no photos, no video clips, no audio. Just text. Deal with it.) From ravage at ssz.com Fri Oct 31 19:12:13 1997 From: ravage at ssz.com (Jim Choate) Date: Sat, 1 Nov 1997 11:12:13 +0800 Subject: Technology 'secures' gunfire [CNN] Message-ID: <199711010306.VAA27799@einstein.ssz.com> Forwarded message: > TECHNOLOGY 'SECURES' GUNFIRE IN THE CITY > > Secures October 31, 1997 > Web posted at: 4:44 p.m. EST (2144 GMT) > > ARLINGTON, Virginia (CNN) -- If you heard gunshots ring out in your > neighborhood, you might be able to tell the general direction they > came from. And if you happened to glance at your watch, you could > say about what time. In maybe a minute, if you were so inclined, you > could call the police to report it. > > Now police have an electronic witness that can provide similar > assistance: a device called SECURES that pinpoints the time and > location of gunshots. From tm at dev.null Fri Oct 31 19:27:02 1997 From: tm at dev.null (TruthMonger) Date: Sat, 1 Nov 1997 11:27:02 +0800 Subject: FBI Provides Soft Target List! (WAS: Suitcase packed, and nowhere to go...) Message-ID: <345A9417.13FA@dev.null> * Following is the list of the 33 IRS District * Headquarters Offices: * * FROM: FBI NATIONAL SECURITY DIVISION * Pacific Northwest District--Seattle, WA * Northern California District--Oakland, CA. * Central California District--San Jose, CA. * Los Angeles District--Los Angeles, CA. * Southern California District--Laguna Niguel, CA. * Southwest District--Phoenix, AZ * Rocky Mountain District--Denver, CO * Arkansas-Oklahoma District--Oklahoma City, OK * North Texas District--Dallas, TX * South Texas District--Austin, TX * Houston District--Houston, TX * Illinois District--Chicago, IL * Republic of Texas District--Armadillo World Headquarters From PRESIDENT at WHITEHOUSE.COM Fri Oct 31 19:28:41 1997 From: PRESIDENT at WHITEHOUSE.COM (William J. Clinton) Date: Sat, 1 Nov 1997 11:28:41 +0800 Subject: NUKE TIM C. MAY!!! Message-ID: <345A9EC4.1CDF@WHITEHOUSE.COM> From nobody at REPLAY.COM Fri Oct 31 20:03:31 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sat, 1 Nov 1997 12:03:31 +0800 Subject: Hi! I'm only twelve years old! Message-ID: <199711010350.EAA00993@basement.replay.com> Hi. I'm only twelve, but I'm a real dork, and nobody will talk to me in the chat rooms. I was watching 20/20 tonight about sexual predators on the internet and they had some really cool tips about how to prey on young children. {If only one child is raped and murdered by sexual predators who learn how to use the internet effectively, it will be worth the time and trouble for those producing the show.} Anyway, I have a question for you. Would I get more people talking to me on the chat lines if I say that I am a twelve year old interested in sex, or if I say that I am a sexual predator interested in meeting young boys? I have never talked to a real FBI agent before and I know I would get to meet some if I said I am an old fart who wants to bunghole young boys but they would probably tell my parents, wouldn't they? I bet I could get a lot more people to talk to me if I told them how old I really am and that I want to do dirty stuff with old farts. I bet I could get a lot of free stuff, too. What do you think? I am asking you because my Doctor in Forest Hills says you guys know about that stuff. He's not a real doctor, but he meets me in the park, where I can smoke, so I like him. He says I don't have prostrate cancer. Boy is that a relief! I met him in a chat room. He said, "I'm from the cypherpunks, and I'm here to help you." I found out that his name isn't really John Gilmore, it's some kind of foreign name, I think. When I asked him if he was a "real" doctor, he said, "No, but I have an honorary Doctor of Love degree that was bestowed upon me by the grade four class at the Forest Hills pubic school." (I think he was making a joke. :?) I thought I could get people to talk to me on the cypherpunks list, since you guys are cool, but everyone there thinks I am an asshole, too. I think I am going to change my name from TruthMonger to something else. Do you think that would help? I spell pretty good for a twelve year old, don't I? Thanks, A Twelve Year Old Boy p.s. - What is fist fucking? Phillip Hallam-Baker wants my answer by tommorrow. From JonWienk at ix.netcom.com Fri Oct 31 20:08:13 1997 From: JonWienk at ix.netcom.com (Jonathan Wienke) Date: Sat, 1 Nov 1997 12:08:13 +0800 Subject: Halloween Humor Message-ID: <3.0.3.32.19971031195631.006f4604@popd.netcruiser> A Cypherpunk To Be Named Later purchases a new hunting rifle and moves to Alaska to try it out bear hunting. After a few days of hunting, he sees a moderately decent-sized black bear, and with one perfectly placed shot, kills it. Unfortunately, while watching the black bear collapse, he feels a tap on his shoulder; turning around, he sees a large brown bear. "I saw what you just did," says the bear. "You have two choices. Either I maul you to death, or you and I can step behind that rock over there and engage in the sort of activity Vulis usually attributes to Timmy Mayonnaise." Reluctantly, the Cypherpunk accepts the second alternative. Several days later, when the Cypherpunk is sufficiently recovered to sit comfortably, he decides to avenge his honor. After several hours of stalking, he centers the cross hairs of his riflescope on the brown bear's [deleted] and fires. While watching the brown bear die a slow and agonizing death, he feels a tap on the shoulder. Turning around, the Cypherpunk sees an enormous grizzly bear. "I saw what you just did," says the grizzly. "You have two choices. Either I eat you alive, or you and I can step behind that tree over there and I will show you what New York City Police officers really carry batons for." Reluctantly, the Cypherpunk accepts the second alternative. Several weeks later, after the bleeding stops and his toilet schedule returns to normal, the Cypherpunk once again enters the woods, this time seeking the grizzly bear. After searching for several days he finds the grizzly bear and shoots him. While he is cutting off the grizzly's [deleted], he once again feels a tap on the shoulder. Turning around, he sees a gigantic polar bear. The polar bear looks at him and says, "You don't come out here for the hunting, do you?" Jonathan Wienke PGP Key Fingerprints: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC "If ye love wealth greater than liberty, the tranquility of servitude greater than the animating contest for freedom, go home from us in peace. We seek not your counsel, nor your arms. Crouch down and lick the hand that feeds you. May your chains set lightly upon you; and may posterity forget that ye were our countrymen." -- Samuel Adams "Stupidity is the one arena of of human achievement where most people fulfill their potential." -- Jonathan Wienke RSA export-o-matic: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 >Well, what's wrong with me driving up to the head of the sit-down protest >and saying to the cops standing idly by, "Hey, there are some queers in the >middle of the road, blocking my trip to Marin. If you're just gonna let em >sit there for hours, putting my business and plans at risk, I'm just gonna >gun my engine and drive right over their fairy asses." Tim, I'm surprised at you. The issue isn't whether what they were doing is illegal. The issue isn't whether it would have been justified for you to run over their asses. The issue is government jack-booted thugs walking up, grabbing *non-violent*, *helpless* protesters by the heads and engaging in chemical warfare. I don't agree with the stance of the protesters, and I don't agree with their method of protesting. That does NOT mean that the government is justified in doing the equivelent of beating the shit out of non-violent protesters. Was China justified in running over non-violent protesters with tanks? From mixmaster at remail.obscura.com Fri Oct 31 20:37:05 1997 From: mixmaster at remail.obscura.com (Mix) Date: Sat, 1 Nov 1997 12:37:05 +0800 Subject: Protocols for Insuran Message-ID: <199711010421.UAA09257@sirius.infonex.com> -----BEGIN PGP SIGNED MESSAGE----- nobody at replay.com (Anonymous) wrote: >Monty Cantsin wrote: > > The Emergency Room Scenario is a little more challenging. One > > way to deal with it is to wear some obvious signs of wealth like > > a $10,000 watch. In a pinch you can give them the watch. ;-) > > (Some of the nurses won't know what it is, but the doctors will, > > I am sure.) > >Except that very likely you'll be in the Emergency Room in the >first place, because you got shot during the mugging for your watch >-:) Good point. A better play would be expensive looking designer firearms. Not only can you use them for collateral, but they allow the use of certain negotiating strategies with muggers - or doctors. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFqde5aWtjSmRH/5AQFeMwf7B1dzFvM5GAMD63fGy5O/SJtY3nXnjcGT ZTTGYSLv3Yvg+9AmoqWIGQzYFLJ/d5vTH2ciaCbPcF6iUArLohyATfD+oD+DM+nl m8ketoMhPcliq6xOGPcuYY4E3ZgdrI3TB1xcSJDuPXAHj0xJAr4u40A37Ft2RRaB +YDdMbuI7gTJEMyaxrwSOaeSBio0Tr1MpDgZTv1oHh8p+cn3nbTUFdUN119bPY5+ x6u6EATkNKV9PiD6uS9659gmPJUQlDWg2J/Qwi3Ge7jiCLRIRwNHxI+PLa+GSXVH JP7pt7YuyRWEZg6Gs+x4iFOdBUpsEAqDDOI8tGGRdvMcgOO0p/5VHw== =7Olq -----END PGP SIGNATURE----- From mixmaster at remail.obscura.com Fri Oct 31 20:39:14 1997 From: mixmaster at remail.obscura.com (Mix) Date: Sat, 1 Nov 1997 12:39:14 +0800 Subject: Killing those who need killing Message-ID: <199711010421.UAA09272@sirius.infonex.com> -----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: >Don't any of you get any ideas here, but in California it is >ridiculously easy to get someone committed for a 72-hour observation >period. All one has to do is convince one of the various agencies >that a person is a possible danger to himself or to others.... >...Worst of all, the mere fact of having been committed, regardless >of the eventual outcome, can mean a complete loss of rights to own a >handgun, rifle, or shotgun for a long period (10 years, I >think). Failure to let the Thought Police in for a look around one's >home is almost ipso facto grounds for committment. Use of remailers lessens this and other risks. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFqgYZaWtjSmRH/5AQHYBwf9HcENXxw+SD3wt3yRFLBmyFHmqNCuQP30 5JdzgfUuwAHBD2D/JkXm3X99vBFcoeouysgCj79yDYdzQeIWHAamO1pdlCcmgcVz 0vBGz7izWgaMioXQAIPU5cBpaEfac5yOleetKQwViq0cnV49aA309qOzi4QzufAD YJuV+hURnfmHPNrOmXRtlbPRzCwogo4pIZu8Vs5klxwSyRL/1G8KLzDERnSE4bFg +0D9MDV9lFmaaqiA2XRYZSEgsFyD3BKc2kgWceugnQl3UtSvLdXncoQPAJbcpE7Y OPIV2YS9S2qNTprtiTiMLV1dsZ+5QeXZoUKEztVRJXwGMYNLMQKqJg== =C2Wi -----END PGP SIGNATURE----- From anon at anon.efga.org Fri Oct 31 20:50:35 1997 From: anon at anon.efga.org (Anonymous) Date: Sat, 1 Nov 1997 12:50:35 +0800 Subject: No Subject Message-ID: <059ba8257a50981b642ca5005181f75d@anon.efga.org> I am a bit confused. A post to the list claimed that the fifteen year old who raped and murdered the eleven year old (both boys) had not met his victim on the internet, as initial media sources indicated, but on an 800 number phone-chat line. I vaguely recall doing a web search to find out the facts for myself and confirming the claim. Now I am watching Sixty Minutes on tv and they keep repeating the mantra, "met on the internet, met on the internet..." Does anyone have the so called real scoop on this? Thank You From ichudov at Algebra.COM Fri Oct 31 20:53:43 1997 From: ichudov at Algebra.COM (Igor Chudov @ home) Date: Sat, 1 Nov 1997 12:53:43 +0800 Subject: North CA cops skip preliminaries, get straight to torture In-Reply-To: Message-ID: <199711010440.EAA32646@manifold.algebra.com> Tim May wrote: > If I return to my home or place of business and find that "demonstrators" > have placed a 700-pound tree trunk in the center of my living room or > office and have chained themselves to it, or surrounded it with a human > chain, as a form of "protest," my response will be simple: > "I'm going to go get my assault pistol and a couple of other guns. If > you're gone by the time I get back, we'll settle in civil court for the > damage you just did to my front door, my carpet, and my peace of mind. If > you're not gone, I'll consider you intruders in my home or business, and > probable threats. Take your choice." > Sounds fair to me. And what if they closed a public driveway? Do you think that a private (ie, non-leo) person can shoot them? - Igor. From ravage at ssz.com Fri Oct 31 20:54:28 1997 From: ravage at ssz.com (Jim Choate) Date: Sat, 1 Nov 1997 12:54:28 +0800 Subject: Killing those who need killing (fwd) Message-ID: <199711010450.WAA28372@einstein.ssz.com> Forwarded message: > Date: Fri, 31 Oct 1997 20:21:23 -0800 (PST) > From: Mix > Subject: Re: Killing those who need killing > Tim May wrote: > >Don't any of you get any ideas here, but in California it is > >ridiculously easy to get someone committed for a 72-hour observation > >period. All one has to do is convince one of the various agencies > >that a person is a possible danger to himself or to others.... > > >...Worst of all, the mere fact of having been committed, regardless > >of the eventual outcome, can mean a complete loss of rights to own a > >handgun, rifle, or shotgun for a long period (10 years, I > >think). Failure to let the Thought Police in for a look around one's > >home is almost ipso facto grounds for committment. > > Use of remailers lessens this and other risks. Ok, Monty, explain how my use of remailers is going to help me when my son-in-law (for example) decides that he wants my property and decides to have me examined? The mere fact that he can prove I use anonymous remailers will only boost his assertion that I am a paranoid. If my hard drive is encrypted that is further proof of my 'illness'. Swords cut both ways. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage at ssz.com | | 512-451-7087 | |____________________________________________________________________| From tcmay at got.net Fri Oct 31 20:57:09 1997 From: tcmay at got.net (Tim May) Date: Sat, 1 Nov 1997 12:57:09 +0800 Subject: [NTSEC] Security Alert (fwd) In-Reply-To: Message-ID: At 12:38 PM -0700 10/31/97, Ryan Anderson wrote: >browser. The Gullibility Virus, as it is called, apparently makes people The word "gullibility" is not in any dictionaries. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." From nobody at REPLAY.COM Fri Oct 31 21:20:42 1997 From: nobody at REPLAY.COM (Anonymous) Date: Sat, 1 Nov 1997 13:20:42 +0800 Subject: Hlep Message-ID: <199711010509.GAA08766@basement.replay.com> Q. How many cypherpunks does it take to change a light bulb ? A. %5-3E,*5$%"4TE:10IA8F-D969G:6ML;6YP<7)S='5W.GA!0D-& From nobody at secret.squirrel.owl.de Fri Oct 31 22:28:36 1997 From: nobody at secret.squirrel.owl.de (Secret Squirrel) Date: Sat, 1 Nov 1997 14:28:36 +0800 Subject: Protocols for Insurance to Maintain Privacy Message-ID: <2d9fdee2822cc80bd98da311efbf2459@squirrel> -----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: >>I'm pretty sure that if you are an unconscious wealthy looking >>person they don't turn you away. You really only need to survive >>until your lawyer gets to the hospital with a suitcase of cash. > >Read "The Millionaire Next Door" for tips on what millionaires (who >are of course the "barely non-poor" these days) are likely to be >wearing and flaunting. Turns out that most Yuppies driving BMWs and >wearning Rolexes are doing so on _credit_. Driving a Mercedes or BMW >has nothing to do with actual ability to pay bills. Perception, not reality, is what is important here. A wealthy appearing person will generally fare better. It's true, however, that you are probably better off with proof of insurance than an expensive watch when being wheeled into the emergency room. (Except for your privacy, that is.) Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFqfBJaWtjSmRH/5AQER8Qf/TFHTzT30VZwgeVx8BShmDbmCCn1PnpEf x8f06xvldW0SQEKZRh31IjXI3SPorWxPoqI/wB0Qq/7hIp9qzKeI7xnGqyOKBbcg NrqPyxfELm0h5udBAUcVg94SDGcNyccYfSpyw1qoEBHhMLwmLdTsViWTPZcgUQLG qWgkPm8ZqVlsOkwQZU8QlzT8B/9e8QX1fP/d9Ai8Xwi5cCU+25go2O69a6bq/6Qw lqEvwUWCIG/6u789fozdS3rPvNjeMP5WFi92cy9MsnYu4I4kjVHsHV6Zwn/f+gZv 4oggD4OehPwSpUXhCbBcZ6FB/9JBWC8xTtjVz8TbGfazaoRG/vwolw== =dBa3 -----END PGP SIGNATURE-----