- cypherpunks-legacy@lists.ogf.org

MEET: Boston area Cypherpunks Meeting
by Derek Atkins 04 Apr '93

04 Apr '93

-----BEGIN PGP SIGNED MESSAGE----- The FIRST Boston-area cypherpunks meeting: Date: Saturday, April 10, 1993 Time: 12 noon - ~5 pm Where: MIT Room 1-115 If you need better directions, please feel free to send me e-mail, or you can call me at 617 868-4469. Hope to see people there! - -derek PGP 2 key available upon request on the key-server: pgp-public-keys(a)toxicwaste.mit.edu - -- Derek Atkins, MIT '93, Electrical Engineering and Computer Science Secretary, MIT Student Information Processing Board (SIPB) MIT Media Laboratory, Speech Research Group warlord(a)MIT.EDU PP-ASEL N1NWH -----BEGIN PGP SIGNATURE----- Version: 2.2 iQBuAgUBK76hsTh0K1zBsGrxAQHD7ALFExaf+JQ3l21P1c5Tuxx2RdKy/AsLLZo1 D6Y0LsaPe7YEW9bofbQr0HKdW08KvZgDHowUomjCFgLRVJPtwyTJkqWuL4424/XU cuSe+LWeNJ+llrbosFgsk/o= =wZJR -----END PGP SIGNATURE-----

1 0

PGP help and comments.
by J. Michael Diehl 04 Apr '93

04 Apr '93

I am really learning to love PGP, and I haven't even used it much yet! I'm insisting that all my friends get keys. But.... I would like to set up two secret keys for myself. One 512 bits long and another 1024 bits long. I'll distribute the short one. I'll give the long one to trusted and close friends. I'm having difficulty setting it up so that pgp defaults to using the short key to encrypt stuff. Note that I want the same user id for both, but perhapse with a "secure" flag in the user id of the large key. How can I do this? Can we get someone to compile and distribute pgp for the amoeba, er, I mean Amiga? ;^) My friend has one, but no C compiler. Some suggestions for future versions... Is there any chance of pgp cloaking it's ascii armoured output to look like uuencoded data? I would like to use pgp on the mainframes, but don't want to store my secret key on their disks. Would it be possible to have pgp accept it's secret key via stdin. I could do an ascii upload of my secret key and never expose my key to disk-storage. How about password protecting pgp itself. No one could use my copy of pgp unless they knew my password. And only my copy of pgp could decrypt my secret key. Just a thought. How about a -wn option that would wipe the original file 'n' times. Like pgp -wen10 very_secret_stuff cohort. That should keep even Big Brother from prying. Is it possible to have pgp develope a third key that looks just like a regular key except that when it is used in place of your secret key, it produces an alternate plaintext. This way, if Big Brother "requested" you'r key, and you needed to dissavow all of you'r messages, you could exchange the third key for you'r secret key. When someone used this key, they'd get some insulting message that may or may not have been the original message...and there'd be no way of knowing. I kinda doubt it on this one, but wouldn't it be nice! Geez, have I really gone on for 40 lines? Sorry about that, but any comments? Hope to hear from you. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.2 mQBNAiu21SIAAAECAMKkKKP4JIxSPR7rOUZ7mbi6yDPfFa7T6zOtOBX8iI939tIU 9JFTxdyvTejK3qmYDGozNaqySQ/0++nGqZgikcsABRG0LUouIE1pY2hhZWwgRGll aGwsIG1lLCA8bWRpZWhsQHRyaXRvbi51bW4uZWR1Pg== =YquS -----END PGP PUBLIC KEY BLOCK-----

3 3

jarthur remailer has PGP
by Eli Brandt 04 Apr '93

04 Apr '93

Snarfed PGP 2.2 and found it more successful on a Symmetry than 2.1, which I couldn't get to stop dumping core on keygen. So the remailer on jarthur now supports encryption, I think. Bang on it and see if you agree. The jarthur remailer's key: (512 bits only, it's on an insecure box) -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.2 mQBNAiu+hVUAAAECAMVjEfl2IMNgSOJ+/fx1V6EbH50ofa6K4r1PBKMmkcHQextP ghwC4lXIgaAWUlLJ9x61+qf4jB5fpNUZLrF9FUsABRG0NWphcnRodXIgcmVtYWls ZXIgIGMvbyA8ZWJyYW5kdEBqYXJ0aHVyLmNsYXJlbW9udC5lZHU+ =Zxy7 -----END PGP PUBLIC KEY BLOCK----- The makefile paragraph: symmetry_gcc: $(MAKE) all CC=gcc LD=gcc OBJS_EXT=_80386.o \ CFLAGS="-O -I. -DNOTERMIO -D_BSD -DUNIX -DUSE_NBIO $(BYTEORDER) -Di386" Logging is turned back on until the glitches are out. Enjoy. PGP 2 key by finger or e-mail Eli ebrandt(a)jarthur.claremont.edu

1 0

MEET: I'm going West! (Bay Area)
by Marc Horowitz 04 Apr '93

04 Apr '93

I'm going to be at a meeting at the Westin hotel in Milbrae, CA. I'm taking an early-morning (ugh) flight out on Tuesday, and I'm red-eye'ing back Friday night/Saturday morning (to be back for the Boston Area Cypherpunks meeting :-) I should be free in the evenings, namely, Tuesday, Wednesday, and Thursday nights. I'd be interested in getting together with people to exchange signatures, talk about stuff, eat dinner, or whatever. I can be reached by email at <marc(a)mit.edu>, which I should be reading remotely, or you can leave a message for me at the hotel at 415-692-3500. Marc

1 0

Re: TEMPEST in a teapot
by karn＠qualcomm.com 04 Apr '93

04 Apr '93

A few minor comments on a pretty comprehensive and well written article. Although TEMPEST is closely related to EMI shielding, remember that TEMPEST is concerned only with *information bearing* radiations, not interference. In particular, the switching power supply, a potentially prodigious source of EMI, is not a significant TEMPEST issue because power supply emissions carry little if any information. (Varying loads might cause minor modulations of switching frequencies, etc, but this is probably something that only the paranoid "covert channel" types worry about. Maybe you coull tell when the floppy drive motor starts and stops, but I doubt you could do much else.) Who knows, cutting down on power supply radiation might make it easier to extract information from the emissions that remain, because of the jamming effect of power supply noise. But don't let that stop you. It's your duty to your neighbors to emit as little RF noise as possible. When I lived in New Jersey, I learned to my chagrin that my two PC clones made my next door neighbor's AM radio useless. Only 25 miles from New York, he was unable to listen to WABC, a 50KW clear channel AM station! The problem disappeared completely when I installed some inline AC RFI filters in the power supplies. Since we shared a pole transformer, I theorize that the noise was conducted from my computer to his radio directly over the power lines. Which brings me to my next point. I have not seen *any* clone-grade PC power supplies with adequate power line filtering. They have a minimal LC lowpass network on the power supply board itself, but this is usually inadequate. Whenever I buy a new power supply, the first thing I do when I get it home is to replace the IEC power connector with an integrated, shielded power connector/RFI line filter. These devices are widely available for several dollars from electronics surplus houses and amateur radio "hamfests". I also use power cords with built-in ferrite "lumps" but these are probably harder to find (one particular hamfest vendor had a lot of them a few years ago, but I haven't seen them since.) Modern monitors are *much* better shielded than the early PC monitors, especially those no-name Korean or Taiwanese copies of the original IBM PC monochrome monitor. If you have the misfortune of owning one of those old monitors, as I do on one of my systems, chances are the lion's share of its emissions are coming from the +70V power lead that runs from the main circuit board to the video output stage on the base of the CRT. (Note! Do NOT confuse this with the high voltage lead going to the anode of the CRT!) The +70V power line to the video output driver acts as an antenna for radiated video signals that can be *quite* strong. I suspect that the reports we've seen of successfully picking up the image on a computer display were taking advantage of this. To fix the problem, just replace the plain wire with a piece of shielded coax, bypass the ends with .01 or .1 uF capacitors of sufficient working voltage, and ground the shields to circuit board ground on both ends. Phil

1 0

WB: public kiosks
by Eric Hughes 03 Apr '93

03 Apr '93

One of the necessities of a truly effect whistleblowing system is the existence of public kiosks where anybody can post from--the equivalent of public telephones for the net. This is useful when the sending of any encrypted message at all will be grounds for reprisal. (It is, of course, useful for paranoids as well...) Last night I spoke with Wayne Gregori, who runs a system called sfnet (with some variant of capitalization) here in the Bay Area. sfnet is a coffeehouse network, with public terminals located in various locations in SF, Berkeley, Oakland, etc. There is the equivalent of IRC and private mail for the users, almost all of whom use handles. there is also dialup service available. sfnet just got their internet hookup. It's not integrated into the rest of the software yet; that is being worked on. Wayne is supportive of the idea of putting a whistleblowers interface into the sfnet public terminals. New slogan: Drop the dirty quarter! Eric

1 0

Re: could someone
by kieran2101＠aol.com 03 Apr '93

03 Apr '93

I'd also like a copy of the Phrack article, since my account here clipped off a big chunk of the article at the end. If someone could forward a copy to my account at kieran(a)mindvox.phantom.com, I'd appreciate it. --Aaron

1 0

Anonymity, accountability, and control
by greg＠ideath.goldenbear.com 03 Apr '93

03 Apr '93

With respect to recent discussion about anonymous posts/mail, and the wishes of some to avoid passing anonymous traffic .. I guess I've really got to wonder just how difficult people think it is to get onto the net, anyway. I've got my net access becuase I pay UUNET roughly $50/month for it - and I get my own domain name, with as many hosts (and as many users on those hosts) as I care to set up. I set up 'fake' accounts on a regular basis - not becuase I'm trying to trick anyone, per se, but becuase it's the easiest way I know of to tweak the flow & storage of mail on disparate subjects & topics. I can post a message and say "Please E-mail to me, and I'll summarize with a post", and do so easily - I just set up a special account that I'd like replies to go to, and then I post from that account. (Usually, just to be polite, I'll use the same 'real name', but multiple account names - 'gb(a)goldenbear.com' vs 'greg(a)goldenbear.com' vs 'gbroiles(a)goldenbear.com', and so forth.) Then, a few days/weeks later, it's no big deal to concatenate the replies in those different mailboxes into different summary messages for posting. This seems like the sort of thing everyone ought to be able to do - such that you could request (or command) that replies to a message be directed into a particular E-mail folder owned by your account. What all of this brings home to me is how easily I could just create an entirely fictitious 'person', and use it for posting & mailing - it'd be totally anonymous, provide me with easy way to receive replies & carry on conversations .. *and* nobody would even know they were talking to a real person via a fake name. I don't do this because it seems impolite to converse with people under false pretenses; if I wanted or needed to post/mail anonymously, I'd probably use a redirector (if I could find one) because it seems more polite to be clear about my desire for discretion & privacy. Apparently, however, some of the powers that be would rather see folks like me using fake but real-sounding names when we want privacy, instead of being clear about what's going on. I think that's a shame, because it seems like lying. The Internet has already had to deal with the fact that it's not possible to trust a user simply because they're root on their local machine - it may well be that 'root' (as in my case) is just some guy with a '386 who likes to play on the net. There is, I think, still some expectation that user names are what they appear - if you see a post from "cjones(a)leviathan.com (Chris Jones)" there's some expectation that there really is a human being out there named "Chris Jones", who's probably got a job and a desk and a boss, or at least some form of accountability. It's this slippery notion of 'accountability' that is perhaps at the root of this 'anonymity' problem - the idea that there's gonna be some hell to pay if somebody writes to 'postmaster(a)leviathan.com', and complains about Chris Jones. The fact is, you can mail to 'postmaster(a)goldenbear.com' and whine all you like, it's just another alias for the same damn person (me). I think there are going to be more & more people like me in the future - I *am* my boss, the postmaster, and the sysadmin - and if people don't like what I do or say on the net, that's just too damn bad. This illusion of accountability and control can't last much longer .. can it? As I see it, these "net gods" who don't like anonymity have two choices - anonymity they can detect, or anonymity they can't. I'd much prefer to be polite and straightforward about things, and post clearly marked anonymous posts/mail when that's what I want to do - but if that traffic is going to be suppressed, I'll resort to more clandestine anonymous transmissions. The days when it was possible to make any assumptions at all about human to "real name" to net address correspondences and mappings have passed, if they ever existed at all. I think about my E-mail address(es) as ways to direct the flow of mail such that it's convenient for me; I know other people do this too. My E-mail address isn't a license plate, it's a file folder. -- Mail to pgpserv(a)goldenbear.com, subject="Greg Broiles" for PGP public key. Greg Broiles greg(a)goldenbear.com Golden Bear Consulting +1 503 465 0325 Box 12005 Eugene OR 97440 BBS: +1 503 687 7764

4 5

list ping; ignore
by robichau＠lambda.msfc.nasa.gov 02 Apr '93

02 Apr '93

[ sorry to do this; listmail is only reaching us sporadically and I'm trying to find out why. ] -- Paul Robichaux, KD4JZG | May explode if disposed of improperly. NTI Mission Software Development Div. | RIPEM key on request.

1 0

could someone
by trump＠pluto.ee.cua.edu 02 Apr '93

02 Apr '93

could someone please re mail me the letter that contains the Phrack 42 article and comentary... my mail was lost and i would like to see this one Clovis

1 0