- cypherpunks-legacy@lists.ogf.org

Re: Patent Infringement
by pmetzger＠shearson.com 18 Dec '92

18 Dec '92

> From: yanek(a)novavax.nova.edu (Yanek Martinson) > > > "I'm sorry to say that yes, it *IS* illegal to reinvent the wheel and > > apply it yourself. In the US it is called "Patent Infringement"." > > > > Only if you attempt to sell it ... > > No. The patent law prohibits anyone from "making, using, or selling" > anything covered under the patent. Selling it makes it more likely > that the patent holder will come after you, as they have a greater > chance of getting some money from you. > > I am not a lawyer, I am sure someone here can explain all this in > greater detail, or correct me if I'm wrong. This is one of the sillier threads I've seen in a while. Is anyone here arguing seriously that RFI shielding your equipment is a patented technology? Perry

1 0

So you want a wide-spectrum signal analyzer ?
by Richard Childers 18 Dec '92

18 Dec '92

Here's what HP's catalog says : Spectrum Analyzers Spectrum analyzers take advantage of the frequency-conversion properties of the swept-tuned heterodyne receiver to make sig- -nificant contributions to frequency-domain signal analysis. The following are some of the measurements that can be made with spectrum analyzers : (1) Absolute and relative frequency. (2) Absolute and relative amplitude. (3) Noise. (4) Distortion products. (5) AM, FM & pulsed RF modulation. (6) Stimulus response. ( biofeedback ? ed. ) (7) Electromagnetic compatibility (EMC). These measurements are possible because spectrum analyzers have the following characteristics : (1) Broad frequency coverage from 5 Hz to 325 GHz. (2) Wide amplitude range from -138 dBm to +30 dBm. (3) Excellent sensitivity for low-signal detection. (4) Excellent frequency stability. (5) High resolution of frequency and amplitude. These capabilities allow spectrum analyzers to provide frequency- domain signal analysis for numerous applications, including the manufacture and maintenance of microwave communication links, radar, telecom equipment, CATV systems, and broadcast equipment ; EMI diagnostic testing ; and signal surveillance. ( I can't believe they actually said that. Gee, I wonder if They're going to classify test & measurement equipment next. )-: Prices for these puppies run from @ $ 20,000 to @ $ 50,000. They are very modularized, and, for the paranoids amongst you, these things are portable. They are probably devilishly heavy, like most test equipment is, and look a lot like an oscilloscope, when the cover is off. For information about any Hewlett Packard product or service, or for additional copies of this catalog, call the Customer Infor- -mation Center (CIC) at 800-752-0900 between 6:00 am and 5:00 pm PST. What you want is their 'Test & Measurement Catalog'. One small tip - if you're calling them up and want to get a catalog sent to you, you want to make an effort to look like a valid customer. These catalogs are large and expensive and they may be less inclined to pay for what is probably a few dollars' shipping if you come across as a college student ( with apologies to college students :-). Give an address if you can, give yourself a title - R&D engineer is good - a department - R&D - and, if they ask for a box or mail dept code, you can make one up or say that you don't have one. ( Using different box numbers going to a same address is a great way to see who's sharing their mailing list with whom else, BTW ). I'm not encouraging you to spoof these folks, merely noting that it is a regrettable necessity. If you don't present yourself as a prospect, they may blow you off, and if you give any hint that you don't represent some sort of company, you are sure to be blown off, presumed to be a waste of their time. ( Of course, this posting may lead to three or four analyzers, $ 100-200 thousand worth of sales, but try to persuade a salescritter of this. :-) -- richard ===== -- richard childers rchilder(a)us.oracle.com 1 415 506 2411 oracle data center -- unix systems & network administration "If Life is a drama, then, surely, the hardest parts go to the most skillful."

2 1

New remailer
by miron＠extropia.wimsey.com 18 Dec '92

18 Dec '92

-----BEGIN PGP SIGNED MESSAGE----- I've set up a new remailer. I am currently working on extensions. Here are the details: Address: remail(a)extropia.wimsey.com Contact: miron(a)extropia.wimsey.com Encryption: PGP 2.1 Syntax: Compatible with Hal-standard remailers, except for a couple of things: - Encryption MUST be used. - Syntax can be simplified. The pasting operator is assumed. The "Encrypted:" header is optional. Accordingly, you can just encrypt plaintext of the following form (without the cut-here lines): --- cut here --- To: <recipient> <body> --- cut here --- In any case, one should be able to use the scripts posted on cypherpunks without change. Availability: continuous, approx 2 hr turnaround or better. (The keys follow this signed message.) -----BEGIN PGP SIGNATURE----- Version: 2.1 iQCVAgUBKzGfiZNxvvA36ONDAQHs0AP9EO5eiynLcTZumU7l4I+uLTvwROHR+DVv LfFDV5/dKtSaISQpYvj2RSKYK3NHi2JiCM5vnkNYUWFW1uHcX/BpdOte8IJr2zML /lpEEOYgbi56OGqg2bYhBCbJuh2wY71Ibs5Z5C/1HHsJ8hC334nbOV8pKC+gr+Mi Am+tEzExRyM= =Af9o -----END PGP SIGNATURE----- Remailer Key: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.1 mQCNAisrAP0AAAEEAJr3OwIfOIOoh9JndwwqFg+VyWFTAyM8S0B7wyGKI+A9sMAB mbSOIU52EszvLdZk8NH8mrOD9m3EZlt9gXOjln881RMilAunnzdXaJ6ffBKqPL+l yiefCbCo6wScVNfMSV6Di/2HMoFzVqukwRjTx8lqKt6hgy0uedtwcCemtaMvAAUR tCVSZW1haWxlciA8cmVtYWlsQGV4dHJvcGlhLndpbXNleS5jb20+iQCVAgUQKysE i5NxvvA36ONDAQF2AAP+IQlQxQ9MxuO6WDzIPsuzTxOS5LVrdh3MLWeAkbk+QN3l hrRvEneULh82xOEvZg9whZ+/W8WYtFA4a8g/HbAhuHh4gqQHGakr0SUpKYGpnUWl EBzZjMb+YKMR4UXpusF6ysWUDZ+f0tDbUDq0ukCoRZRq8wyIf9mndSfaqcsyfyGJ AEUCBRArKwPUS60iYsR4D/cBATXBAXsFqc8sCpP0gQ8KHF3myZrE+s7oP2nu/FP3 LvZE1+ttF3I9c6jncfWPT6cHpvWEoWk= =ZZ5t -----END PGP PUBLIC KEY BLOCK----- My key: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.0 mQCNAiqvJ10AAAED/jXfntqmsRjJRYoxYTxLO7obzMfzgUNtSDEawb3Suj4UO1xq uARc25PJNAHQhIa83Yxf9z/R/3AjwmYrZqxvB2RkLPTjTmzQd04fypsZToiR/TlM 5F43JCuCM779mAir9Idy1CQzXQ2bn89eUZaVhOUJzNgndl+wLpNxvvA36ONDAAUR tCxJbW1vcnRhbCBGcmVlZG9tIDxtaXJvbkBleHRyb3BpYS53aW1zZXkuY29tPokA lQIFECsXPLSTcb7wN+jjQwEBv20D/jIKu8z9DP+wTLLWYZZax9wnJJzRkD9//kFA C0is6LMNMSSX0yGwOPmqEI710BSovuTAlNBmqBrMrl0Bp5bsxpCN8Fw3Mc0ex5fe 1efockVjXNLMP0G4plr0AFMA4KXNE+MfwLFMd+Gcdxufro0yKoBygsHwQ+om+rut RPIy89/PiQBFAgUQKwxwHUutImLEeA/3AQGQnQF8D0Zdrrz+kMAguOANBhbnxm5t zak4TWg37hp/iU2CEfIbW/IUVIPEjNhvM6cjZ1jQ =/SVk -----END PGP PUBLIC KEY BLOCK----- -- Miron Cuperman <miron(a)extropia.wimsey.com> | NeXTmail/mime ok <miron(a)cs.sfu.ca> | Public key avail AMIX: MCuperman | cybercomputingimmortallaissezfaire |

1 0

TEMPEST/Van Eyck data
by mark＠coombs.anu.edu.au 18 Dec '92

18 Dec '92

From: strat(a)intercon.com (Bob Stratton) >It's weird stuff, and some people would rather not have the world >learning how to do this. In fact, Van Eck's original article is known >to have some deliberate misinformation in it, as the author didn't >want to make it "too easy" to learn how to do this kind of ELINT. Ever realised that some things come along that just tickle your curiosity nerve and you wont let go until your satisfied? Im sure there are individuals and organisations out there that would love an excuse to shut down lists of this type, especially considering the type of information and the implications in the not too distant future if people start implementing half the concepts that are presented here. I would like to see indepth technical information, or at least pointers to said information presented here. Does anyone know of mailing lists out there that concentrate on levels of computer emissions and methods of diminishing them to negliable amounts? Where would one obtain copies of articles on the subject? I have saved the article posted by treason@gnu as it does contain a lot of references which give one something to go on. I commend him for posting it for it's informational content. It wasnt his fault it may have contained obselete or inaccurate information. So, anyone have lists of books, periodicals, email lists or papers that discuss the topic of computer RF emissions and how to protect a machine *AND* monitor the levels of others? Mark mark(a)coombs.anu.edu.au P.S. That NASA guy had better watch for list members waiting for the postie so they can collect the goodies before he can :)

1 0

Positive reps.
by Hal 18 Dec '92

18 Dec '92

-----BEGIN PGP SIGNED MESSAGE----- I was thinking about the idea of positive reputations and thought I'd mention a few thoughts while waiting to see Dean's notes. As I understand it, a positive reputation is basically some kind of recomendation or endorsement of a person by someone else. It might be fairly specific, like "so-and-so paid a debt of $50 to me within the agreed-upon two-week period." Or it could be more general, like "so-and-so is, in my opinion, an honest person." I was thinking of positive reputations that might be relevant to the problem mentioned of anonymous posting to mailing lists and newsgroups. As Dean mentions, we can envision a system which uses the opposite of kill files. Instead, messages would only be displayed from people who met certain criteria in terms of their reputation credentials. What would I want to see in the way of such credentials that would help me decide whether I wanted to read the message? (The issue of judging the validity of credentials is discussed below.) Maybe recommendations in favor of the poster's intelligence, knowledge, judgment, temperance (i.e. reluctance to flame), etc. would be useful. Imagine a system in which a person was rated from 1 to 10 in each of these categories. A person's positive reputation would consist of (digitally) signed statements from various "endorsers" (or "introducers"), each giving their numeric judgements about the person in question. With this system, I could set my ideal mail/news reader to only display postings from people whose scores met some standards. Maybe I would average them; maybe I would weight the different categories according to my own tastes. But this would let me filter out time-wasters like the random poster who was causing problems. Now, this still leaves open the problem of judging the validity of various credentials. This problem is very similar to the problem of accepting key signatures in PGP. If I receive a PGP key loaded with signatures, that doesn't mean much unless I know at least one of the people involved (either directly, or through the net). Only then can I judge how valid the signatures are. In the same way, if a new person posts on a newsgroup, and includes his credential loaded with 10/10/10/10's, that doesn't mean anything unless I know some of these people who are vouching for him. In the most extreme case, he could have created a bunch of false identities and had them provide all the endorsements. So an endorser unknown to me is not useful. It's interesting that the PGP key "web of trust" may have application to this more general problem. I wonder if the PEM folks will push for a centralized "email posting quality" hierarchy in which agencies rate each person's quality of postings and assign them an official score. :-) This would be the analog of their solution to the key-signature problem. That's about as far as I've gotten. A few more general comments: Such a system requires an infrastructure of public-key encryption and digital signatures. Only in that way will signed credentials be secure enough to be meaningful. Since so few people use these tools today, a positive-credential system would filter out almost everyone, throwing out the baby with the bath water. But, remailers are springing up everywhere. It is an idea whose time has come, it seems. So the problem exists today, but the solution can't be practically applied for at least another year or two, even assuming rapid acceptance of PGP, RIPEM, PEM, or some other cryptographic standard. That means that there may be some political pressure against remailers during this interval. Perhaps we can turn this to our advantage by describing the advantages of a credential system, and using that to further encourage widespread use of cryptographic programs. Hal Finney 74076.1041(a)compuserve.com -----BEGIN PGP SIGNATURE----- Version: 2.1 iQCVAgUBKzFI+KgTA69YIUw3AQEdCQP8DbPD9jrlR1MhlLOOQrSUc8Svcue2DZsj +DIXiC50bpv+C5pZYtoCa5SuOXX8W6XmZRSkZW3gilvEKDQ2Zt7hH0ol+tFnn8cs q05T1bYJIZqdMdqia6PZkVyvs+DQLuQSog5rZxAja1XfC/Rq59RnbPp2IViLqDiD OfiasXA4Egs= =GVH7 -----END PGP SIGNATURE----- Distribution: CYPHERPUNKS >INTERNET:CYPHERPUNKS@TOAD.COM

1 0

They have to find you first!
by yanek＠novavax.nova.edu 18 Dec '92

18 Dec '92

> I would guess that all efforts towards creating secure, encrypted email > would only cause surveillance groups to focus their efforts more upon > what's showing up on your screen in plaintext before encryption and To do that, they need to know who you are and where you are located. They can't bug everyone. If a pseudonymous system is used, then it would be your top priority to make it impossible to connect your pseudonym with your legal identity. If you have not already, read Vinge's _True_Names_. If "they" know who you are and where you are located, many techniques are available, TEMPEST eavesdropping being only one of them. Others are confiscating your equipment, arresting you, threatening you and using you to track down other people. So, instead of concentrating on how to shield yourself from surveilannce once you have been found, concentrate instead on not being found. You can maintain a usual identity that you use for normal conversation, but for anything dangerous use an alternate identity, secure remailers, etc. You might want SOME shielding, in case "they" take up the practice of routinely driving up and down the streets looking to randomly find something (someone) interesting. It should be much easier to protect against a casual search. It may be nearly impossible, and/or useless to protect oneself from a determined physical attack by a resourceful enemy. It is much more profitable to prevent the attack. -- Yanek Martinson mthvax.cs.miami.edu!safe0!yanek uunet!medexam!yanek this address preferred -->> yanek(a)novavax.nova.edu <<-- this address preferred Phone (305) 765-6300 daytime FAX: (305) 765-6708 1321 N 65 Way/Hollywood (305) 963-1931 evenings (305) 981-9812 Florida, 33024-5819 (not in hiding yet :-)

1 0

Re: TEMPEST Question
by Doug.Brightwell＠Corp.Sun.COM 18 Dec '92

18 Dec '92

>> Cpu signal is the easiest to detect, but not the only >> one. Other possible sources of emissions are all >> kinds of communications cables. Unshielded RS-232 to >> the modem, possibly even the connections to the disk >> drives. Synching up to monitor signals, I can understand. But as a non-technical person, what I'm struggling to understand is how a surveillance team could monitor the emmisions from such cables and have any clue as to what they are. Let's say they zeroed in on my poorly shielded modem cable and were able to tune into a stream of 0's and 1's. How could they then resolve that digital data into anything meaningful? It could be one of any number of documents created by one of any number of programs on one of any number of platforms. How do the spies know they're dealing with a Frame page layout document created on a Sun workstation versus a spreadsheet created on a Mac? Even if it's just a plain text file how could the surveillance team read it? Does each member of the ASCII character set have specific and identifiable radiation signatures? For example, does the letter "k" as it passes through my modem cable have a characteristic EMR that is the same for all machines? Sorry if this query is too basic, but I would appreciate any enlightenment... Doug

2 1

abusing the system?
by UFLTAI%MEMSTVX1.bitnet＠CUNYVM.CUNY.EDU 18 Dec '92

18 Dec '92

Hiya, One of the newsgroups I was reading have this persistant "tester" who uses the anon service in Finland. Anyway, there were several different postings, all with different ids, but same kinds of "this is a test, nyah nyah" contents. As I was one of those "stop it" people, and seeing more of the same bullshit by that guy, I got slightly pissed off, and started thinking. Already that person is using about 3 different anonymous ids. If he is introduced to the remailers here, conceivably he could generate more anonymous ids for himself (ie, kill files won't work then, unless you want to kill a whole site) by routing his mail thru the remailers. Each remailer would give him another userid at that anon service. And if he uses it to loop back to the remailers... And then loop to that Australian anon service... and so on. He could "legitimately" have a hundred or so different anon_ids, from one original userid. What if someone who realises this was to use that capability to post some really "colorful" material to news? Suddenly you have a hundred or so weirdos posting "I want nude pictures of a gerbil, please" to alt.binaries. pictures.erotica... you get the idea. Is there anyway to stop this from happening? And this is on top of the real weirdos (ie, those who know how to post anonymously, like most of the readers of this list... :)) So far, the net has functioned as it's own sieve with regards to the "weirdos" but if the remailers is generally available (as it should be!), the potential for abuse is much much greater. Any way to slow it down? "Hey, look, a flame war, let's join in..." Of course, if someone was to forge a mail to the anon service... don't even need to know about the remailers... but with forged mail, the anon service can at least "check" to see the validity of your address. I realise that this is probably not important in the overall scheme of things... but I am curious about what can be done to reduce such potential abuse. Ciao. -Tai ps: Any tips on tracing anonymous mail and newspostings? I mean beyond the "from" and "path" things... ie, trace to the userid... Someone tried to forge a posting in my name... (yes, that's what got me thinking :))

4 3

Re: Treason's bile spewing
by Richard Childers 18 Dec '92

18 Dec '92

"Treason's posts, for the past week, have been like the rantings of a third grader." This is in itself rather derogatory and does nothing to quell the flames. "I'm glad some people on this list have the resources to prove him wrong." I suspect the gentleman in question was not displeased to learn something new, and, by contributing material that _was_ a few years out of sync, he was not trying to lower the quality of the discussion ... or dominate it ... he was trying to contribute. Easy does it, folks. -- richard ===== -- richard childers rchilder(a)us.oracle.com 1 415 506 2411 oracle data center -- unix systems & network administration "If Life is a drama, then, surely, the hardest parts go to the most skillful."

1 0

TEMPEST Question
by Doug.Brightwell＠Corp.Sun.COM 18 Dec '92

18 Dec '92

Am I correct in understanding that what's actually detected and reconstructed by TEMPEST surveillance is the EMR having to do with screen drawing, and not the CPU and other internal components involved in processing data? If that's the case, would computers without CRT-type displays still be succeptible to TEMPEST surveillance? Such as headless servers that might be running a BBS without a video card inside or a monitor. Or laptops, such as a Mac PowerBook with an active-matrix screen? Thanks, Doug

2 2