- cypherpunks-legacy@lists.ogf.org

Re: Spooking of neural nets and image recognition...
by smb＠research.att.com 13 Aug '93

13 Aug '93

Insofar as monitoring passage of people, I noted a few hours ago a new installation of cameras at the tollbooths on the George Washington Bridge, positioned to be under a meter from people's faces when they stop to fork over their $4.00. The police density at this toll plaza makes additional surveillance of would-be toll booth robbers unnecessary; while traffic analysis on the matching of facial patterns is probably out of their scope right now, it *is* a precedent, and food for thought... Well -- the cameras may have been prompted by the fact that the toll booths at the GWB have been the targets of armed robberies several times of late... FYI, the George Washington Bridge carries much, probably most, of the traffic into Manhattan and New York City...) Most? Hardly. Don't forget the bridges and tunnels from Brooklyn and Queens, and the two tunnels from New Jersey, and...

1 0

Re: >Clipper trapdoor?
by cme＠ellisun.sw.stratus.com 13 Aug '93

13 Aug '93

>Message-Id: <00541.2828009147.4718(a)washofc.cpsr.org> >From: David Sobel <dsobel(a)washofc.cpsr.org> >Date: Thu, 12 Aug 1993 14:01:54 EST >Subject: Re: >Clipper trapdoor? David, You wrote: >[...] I think the question you raise is a critical one -- under what >guidelines will the escrow agents determine the validity of an NSA >request for the key without a FISA warrant? If I were the NSA, I would *never* permit a key request to leave the building at Ft. Meade. The fact that it wanted a given key is, itself, intelligence. I am one person who believes that the gov't would never be able to establish a key escrow agency secure enough even for my customers (Stratus customers: already extra-careful purchasers of high priced fault tolerant equipment: banks, large funds transfer people, stock brokers, hospitals, ...). It's too cheap for organized crime to bribe or break in at the escrow agencies. Therefore, I'm on record as a commercial crypto consultant recommending against any customer of ours using any escrowed-key mechanism, no matter how strong the algorithm or how trustworthy the key generation process. If the agency is too flaky for me, they're bound to be too flaky to be trusted with a paper trail of NSA's eavesdropping targets. The traffic analysis of that trail would be worth an absolute fortune. I'd give it a week before it was compromised. So: I wouldn't go to the escrow agencies in any way at all. ---------- Now, there was an interesting thing from DERD the other day -- that the original key generation mechanism is out, replaced by one which is classified (for nat'l security reasons, I assume). ---------- As I mentioned in alt.privacy.clipper the other day, if I were the NSA I would: 1. pick a *very* secure block cryptosystem (secure enough for them to use to send top secret crypto keys around the world, where the enemy is sure to intercept the message) 2. encrypt the chip's serial number in that algorithm, using a single key which only the agency knows 3. use the output of that encryption as the chip's key [that output will look totally random to the outside observer, because the encryption algorithm is so good] 4. make the two escrow copies, as before, and deliver them to the escrow agencies 5. keep the key generation process secret, for fear of inciting rebellion among civil liberties groups ----------- - Carl P.S. One of my questions for CSSPAB was why the key generation procedure didn't just use a hardware random number generator. That's the accepted practice and there's no reason to classify it. P.P.S. Is there any way to get NIST to answer my list of 22 questions?

1 0

Re: anonymous contact ser
by M..Stirner＠f0.n0.z1.FIDONET.ORG 13 Aug '93

13 Aug '93

-=> Quoting Uucp to All <=- Uu> Apologies for replying on the list.... That's OK with me. This probably answers some questions for a few others, too. Uu> Here's why. I can't reply directly to your message, as some gateway on Uu> the way barfs on the ".." in your name. This seems to come and go. Uu> This is probably also what screws up anon.penet.fi. This is extremely interesting! This "problem" was supposedly fixed some time ago, but this is why I have alternate accounts elsewhere with more common names. In any event, I will pass this information along to the proper persons. > repl: bad addresses: > "M. Stirner" <M..Stirner(a)f0.n0.z1.fidonet.org> -- no mailbox in > local-part (.) This is yet another problem that was supposedly repaired - it should read m..stirner(a)f28.n125.z1.fidonet.org, but a curious glitch in the BBS reply software that handles conversions of mailings to conferences & automatic routing of replies periodically enters all zeroes in the "f" & "n" fields. I will pass this along, also. Uu> Another problem is that your address keeps changing. Thus you have Uu> several ID's on anon.penet.fi, some with passwords, some without. Your Uu> message was from m..stirner(a)f0.n0.z1.fidonet.org, but in your sinature Uu> you claim you are also m..stirner(a)f28.n125.z1.fidonet.org (or Uu> ...!uunet!kumr!shelter!0!0!M..Stirner). Yes, the zeros are wrong & were inserted by software out of my control. I also have different addresses, true enough, but there is no f0.n0.z1 in fido; that address is a software error. I suspect it'll be on this message, too. STILL....the problem I have is not addressed: I cannot make a multi-line header (as in the required "X-Anon-Password: password" line) work through this UUCP gate, as far as I can tell. I have been attempting to route my mail to the penet remailer via other cypherpunks remailers with the syntax: :: Request-Remailing-To: anon(a)anon.penet.fi From: anXXXXXX(a)anon.penet.fi X-Anon-Password: password X-Anon-To: alt.foolishness But I am not sure if the cypherpunk remailer's address conflicts with my From: field or not - I _think_ it does. If so, I cannot use password header lines unless anon.penet.fi can handle having blank lines between the header fields: To: anon(a)anon.penet.fi From: anXXXXX(a)anon.penet.fi X-Anon-Password: password X-Anon-To: alt.foolishness The above header will pass the UUCP gate here. Without the blank lines, the header gets grunged after the To: anon(a)anon.penet.fi line. . Thank you for your personal attention to this vexing problem. . ~ . M. ___ Blue Wave/QWK v2.12 -- M. Stirner - via FidoNet node 1:125/1 UUCP: ...!uunet!kumr!shelter!0!0!M..Stirner INTERNET: M..Stirner(a)f0.n0.z1.FIDONET.ORG

1 0

Home Banking Patent
by Jin S Choi 13 Aug '93

13 Aug '93

I'm surprised I haven't seen any discussion of this at all. Is anyone else just a little surprised at this patent? I was using a home banking system in the early 80s; when did this Online Resources & Communications Corp. file for their patent? Does anyone know where I can find more info on this patent? What it covers, and so forth? Is anyone gearing up to fight this?

1 0

Second Tier remailers ...
by kelly＠netcom.com 13 Aug '93

13 Aug '93

To All, The idea of second tier remailers may be MUCH more palatable to all to run as they add more hops in the chain... as they dont introduce such a visible liability to the operator they could possibly be a LOT easier to propagate than first tier remailers. One additional facility neede is the ability to recognize a signed and/or encrypted control message to update their remailer maps from a periodic posting...maybe this last needs a lot of thought. cheers kelly --

1 0

NSA Requests Delay in CPSR Clipper Lawsuit
by L. Detweiler 13 Aug '93

13 Aug '93

Tidbits: NSA has classified an `entire Federal program in substantial part' surrounding Clipper. Also, CPSR filed similar suit over NSA secrecy & classification of DES. Note: This is a standard NSA tactic, evasion by delay. They don't respond to FOIA requests in the legislated time frame (1-2 weeks) using the same delay technique. Maybe if we send nasty email to the laywers all will be well =) ===cut=here=== From: Dave Banisar <banisar(a)washofc.cpsr.org> Organization: CPSR, Washington Office Subject: NSA Asks For One Year Delay in Clipper Case NSA Seeks Delay in Clipper Case The National Security Agency (NSA) has asked a federal court for a one-year delay in a lawsuit challenging the secrecy of the government's "Clipper Chip" encryption proposal. The suit was filed by Computer Professionals for Social Responsibility (CPSR) on May 28 and seeks the disclosure of all information concerning the controversial plan. In an affidavit submitted to the United States District Court for the District of Columbia on August 9, NSA Director of Policy Michael A. Smith states that NSA's search for records responsive to [CPSR's] request is under way, but is not yet complete. Because the Clipper Chip program is a significant one involving the participation of organizations in four of NSA's five Directorates and the Director's staff, the volume of responsive documents is likely to be quite large. Moreover, because the Clipper Chip program is highly complex and technical and is, in substantial part, classified for national security purposes, the review process cannot be accomplished quickly. CPSR called for the disclosure of all relevant information and full public debate on the proposal on April 16, the day it was announced. While NSA has insisted from the outset that the "Skipjack" encryption algorithm, which underlies the Clipper proposal, must remain secret, the Smith affidavit contains the first suggestion that the entire federal program is classified "in substantial part." In the interest of obtaining timely judicial review of the agency's broad classification claim, CPSR intends to oppose NSA's request for delay in the court proceedings. In another case involving government cryptography policy, CPSR has challenged NSA's classification of information concerning the development of the Digital Signature Standard (DSS). The court is currently considering the issue and a decision is expected soon. CPSR is a national public-interest alliance of computer industry professionals dedicated to examining the impact of technology on society. CPSR has 21 chapters in the U.S. and maintains offices in Palo Alto, California, and Washington, DC. For additional information on CPSR, call (415) 322-3778 or e-mail <cpsr(a)cpsr.org>.

1 0

Making the World Safe for Steganography
by hfinney＠shell.portal.com 13 Aug '93

13 Aug '93

I agree with Tim's suggestion that it would be good if steganography and cryptography tools were widely available, especially in light of the government's obvious hostility towards cryptography. But I can't agree that these tools will be sufficient to bring about Tim's concept of "crypto anarchy", of "libertaria in cyberspace". If we really want to achieve these goals I think it will be necessary to take political action. Technology alone will not be enough. After all, even today techniques exist which would in principle allow a digital cash system to develop. Yet no such system exists. There needs to be an infrastructure, a network of bankers, sellers, users, and other participants. All this will take time to develop even in the best of cases. But if the government is actively fighting such technology, I don't see how Tim's proposed subterfuges with DAT's and CD's are going to be enough to overcome this additional barrier. Without the ability to publically negotiate the tricky issues of standards and contracts, I don't see how a financial infrastructure of the sophistication needed for digital cash could arise. As another example, suppose the government banned non-Clipper cryptography. Despite the brave comments of some, I think it would be very hard to overcome such a ban. Look at the problems PGP has had, faced merely with the relatively weak threat of patent suits (patents which have not, to my knowledge, been tested in court). PGP is constantly being taken off FTP sites based just on letters from the patent holders. Even Tim himself suggested some time back that Cypherpunks should rethink support for PGP given the patent situation. Imagine how much worse it would be if the government actually could put people in jail for using PGP. My main point is that we cannot rely on the technology to save us. A concerted government effort could, in my opinion, stifle the growth of individual liberties that cryptography may offer. Clipper is just one battle in this longer war. We can't afford to fall victim to a smug confidence that victory will inevitably be ours. If we get to the point that steganography is the only way to communicate privately, we will have lost. Hal Finney hfinney(a)shell.portal.com

2 1

ATM AND IMAGE RECONGITION
by Sandy 13 Aug '93

13 Aug '93

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Just a minor quibble to Tim May's otherwise excellent post on ATM cameras and image recognition. Tim said: Comment: The case of banks having cameras doesn't bother me much at all, as the bank already knows exactly who its customers are. That is, the surveillance is not used to gather any information the bank does not already have immediate and complete access to. Not quite true. One very good privacy technique is to use an ATM or credit card issued to someone else. How can this be done? Well, a friend (preferably a visiting foreigner) could do it for you. Or you could hire a bum (pardon; "hygienically challenged person") to do the honors. At any rate, you wouldn't want to get busted by an image recognizing ATM, now would you? S a n d y "Privacy Consultation and Services since 1978" (Sorry Duncan, got you beat by a mile) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Anonymous contact service
by M..Stirner＠f0.n0.z1.FIDONET.ORG 13 Aug '93

13 Aug '93

Uu> Maybe all penet users on the list should activate passwords on Uu> penet.fi. Penet may search back along the chain of addresses for any Uu> familiar address to check against it's list of password-enabled Uu> addresses. Something is way screwy with Penet lately. I have found that I have had passwords required when I had no recollection of installing them. On top of this, I am unable to use the password provision due to header grunging at the UUCP gate, in any case. . I have requested to admin(a)anon.penet.fi that the accounts by number be deleted in order that I can start over with fresh accounts, & despite three requests, this has not been done. Bloody annoying, but I suppose when we give Julf a big raise, _then_ I can start bitching, huh? 8-) . Speaking of related remailers, what is the status of Charcoal? ********************************************************************* * <m..stirner(a)f28.n125.z1.fidonet.org> - PGP Key D30909 via servers * * > What country can preserve its liberties if its rulers are not <* * > warned from time to time that their people preserve the spirit <* * > of resistance? Let them take arms!" - Thomas Jefferson, 1787 <* ********************************************************************* ___ Blue Wave/QWK v2.12 -- M. Stirner - via FidoNet node 1:125/1 UUCP: ...!uunet!kumr!shelter!0!0!M..Stirner INTERNET: M..Stirner(a)f0.n0.z1.FIDONET.ORG

2 1

Re: Spooking of neural nets and image recognition...
by tcmay＠netcom.com 13 Aug '93

13 Aug '93

>On Thu, 12 Aug 93 18:02:06 PDT, szabo(a)netcom.com (Nick Szabo) said: > >>Are the pictures taken by ATMs good enough for automated >>recognition? >>Nick Szabo szabo(a)netcom.com > >Do atm's usually have real cameras? I always figured most of them >were fakes. > >Mike I'll comment on both questions. First, Nick's question. Yes, the resolution is sufficient, especially since the faces are right in front of the camera. They're black-and-white (so far, but this will change, and the costs of small surveillance cameras will drop further), and of limited res (probably not full NTSC). But adequate for image recognition (though I've not heard of this being done, just archiving of videotapes for some time period....see the movie "Rising Sun" for some insights). Second, Mike's question. I have no idea what fraction are real cameras, but I suspect many if not most are real. Robberies and killings near ATMs are often accompanied with video footage from the ATMs, shown on television. Some of the cameras may now be dummies, but this will likely change as the costs drop further and as local communities push for more surveillance. (Speculatively, I would not be very surprised to see private companies--banks, convenience stores, daycare centers--forced to install surveillance cameras. Big Brother arrives throught the corporate liability laws? Orwell missed this one, though he got so much of it right.) Comment: The case of banks having cameras doesn't bother me much at all, as the bank already knows exactly who its customers are. That is, the surveillance is not used to gather any information the bank does not already have immediate and complete access to. A much more serious situation will arise when convenience stores, gas stations, and the like adopt the same camera systems--maybe they already are--and begin to compile customer dossiers, purchasing preferences, etc. (Credit card and check purchases are already being used, according to a CNN report I recently saw, to compile such dossiers, so that customers can be sent "customized" advertisements reminding them or making special offers. Cypherpunks can avoid using checks and credit cards, for the time being.) Understand that I don't support bans on such surveillance cameras--it is always my choice to patronize a store--but I do object to situations where the State mandates that stores have cameras or outlaws masks and other efforts to hide one's features. -Tim -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: by arrangement Note: I put time and money into writing this posting. I hope you enjoy it.

3 2