Know Your Customer

2000-10-11 Thread Marcel Popescu



 from http://www.nytimes.com/2000/10/10/national/10PESO.html


 October 10, 2000

 U.S. Companies Tangled in Web of Drug Dollars
 By LOWELL BERGMAN


 On a rainy day last June, a group of corporate executives gathered in a
 conference room at the Justice Department for a meeting with Attorney
 General Janet Reno and other top government officials.

 The executives represented some of the pillars of corporate America -
 Hewlett-Packard, Ford Motor Company, Whirlpool. The session was not
 publicized because those at the meeting shared an unlikely and potentially
 embarrassing problem: their companies, they feared, were being singled out
 in the nation's war on drugs, and neither they nor the government was
quite
 sure what to do.

 With the intensifying federal crackdown on money laundering, agents had
been
 tracking drug money into the accounts of American corporations and their
 distributors and dealers. In fact, federal officials said, about $5
billion
 a year in Colombian drug money is used to buy goods and services - from
 cigarettes to computer chips - from American companies.

 What makes that possible is a system known as the black-market peso
 exchange, a complex money trade that law enforcement officials say has
 become increasingly important to the Colombian narcotics trade.

 The system - really a network of currency brokers with offices in New
York,
 Miami, the Caribbean and South America - is essentially an underground
money
 market that lets the traffickers exchange American dollars for Colombian
 pesos. Those dollars, which stay in the United States, are then bought by
 Colombian companies that use them to buy American goods for sale back
home.

 But the government's efforts to seize that money have put it on a
collision
 course with corporations, which say they are victims with no way of
knowing
 that they and their distributors are being paid with drug money.

 As they met on June 6, those executives, lawyers and law enforcement
 officials found themselves grappling with a conundrum: when does drug
money
 stop being drug money? How far does a company's responsibility go?

 The questions have been confronting law enforcement officials for years.

 "What are we going to do?" asked Greg Passic, a former drug enforcement
 agent who now advises the government on the economics of the narcotics
 industry. "We've got the Fortune 500 involved in our drug- money
laundering
 process."

 For a long time, because of lax enforcement of United States currency
laws,
 the drug traffickers were able to launder billions of dollars through
 American financial institutions. A crackdown in the 1980's pushed
 traffickers to what they saw as a virtually fail-safe system for getting
 back their profits - the black-market peso exchange.

 Their growing reliance on that system shows how deeply the drug trade has
 become entwined in the legitimate economies of the United States, Colombia
 and other nations.

 Colombian officials said that as much as 45 percent of their country's
 imported consumer goods are bought with money laundered through the peso
 exchange.

 On the American side, law enforcement officials said the exchange has
 largely eliminated the trade deficit with Colombia. The market, said the
 customs commissioner, Raymond W. Kelly, "is the ultimate nexus between
crime
 and commerce, using global trade to mask global money laundering."

 So far, no large American company has faced criminal charges. And
companies
 have almost always been able to prevent federal officials from keeping
money
 that has been seized.

 But in the last few years, as frustration has risen, the government has
 taken a tougher line. There have been Congressional hearings intended to
put
 companies on notice by name. Prosecutors have issued warnings and stepped
up
 efforts to seize laundered money.

 At the same time, the government has encouraged companies to institute
"know
 your customer" policies similar to those used in the financial industry.
The
 policies gave dealers and distributors techniques for recognizing money
 laundering. Thus educated, the government thought, the companies would be
 less able to argue that they simply could not have known.

 In drawing the line between legitimate and illegitimate profits, the
 government must not only prove that the money came from drug deals; it
must
 show that the recipient "knew or should have known" its source.

 In the war on drugs, that line has proved very fuzzy.

 Trading Dollars for Pesos

 Congress passed the first money- laundering laws in the early 1970's -
 requiring, among other things, that banks report any cash transaction over
 $10,000 - but the laws were loosely enforced. By 1979, the Federal Reserve
 Bank in Miami had more cash than the other federal reserve banks combined.

 It took the uproar over the cocaine epidemic in the early 80's for banks
to
 comply with the law. And with the resulting crackdown, traffickers
resorted
 to the black market, which for 

Its called Staballoy(possible mispelling) in sail boat keels

2000-10-11 Thread cyphrpnk

Hi Lucky,
   went looking myself once so I could machine some .308 bt  in DU
found it in an industrial catalogue catering to the large oceangoing
sailboat industry... this was circa 1986... if I would still interested that
is where I would start my research...(i.e. lee lapin and scott french(
"whole spy cataloge, bigbrother game" etc ) is where I got that hint...

 cheers
  a cypherpunk




beOutdoors spam scam exposed

2000-10-11 Thread Michelle

I know the beOutdoors spamming incedent is an old
issue, but I thought you might be interested in
reading this message I posted on n.a.n.e. Also, I got
the original lie they told mixed up, but please note
that no one was fired as a result. (The original
beOutdoors lie is at the bottom as a refresher.)


 Hello!
 
 Boy are you going to be glad that you are reading
 this. I used to work at beOutdoors.com until very
 recently.
 
 I know the real story about what happened with that
 whole spamming incident.
 
 There was never a young IT guy who was fired and
 broke
 into the building and spammed a bunch of people, but
 I
 think you already knew that.
 
 Karla Story is the Director of Business Development,
 but more importantly,  she is the best friend of the
 wife of Randy Hoffman, President of beOutdoors.com
 and
 former Republican candidate for the U.S. House of
 Represenstatives. Karla purchased a CD containing 30
 million names and email addresses for $110 for the
 express purpose of spamming them. Apparently, it
 seemed like a viable advertising campaign at the
 time.
 
 Geng (James) Qu, formerly of KPMG, now Director of
 IT
 at beOutdoors.com, wrote a program for Randy that
 would automatically send a mass email to batches of
 about 25,000 addresses at a time. They specifically
 pulled out AOL addresses since they were a Gold
 Anchor
 tenant in AOL Shopping.
 
 Randy would come into the back room (Oh, I forgot to
 mention that at the time they were located in a
 strip
 mall and 14 people worked there - so much for their
 "very secure location". Also, some of the servers
 were
 down in the LA area at a place where there is no way
 in hell this would happen.) and say, "Let's run off
 the next 25,000." The rest of us knew they were
 doing
 a big mailing, but we thought that they were sending
 things only to registered users. Besides, the
 Director
 of IT was our entire IT department at the time.
 
 Later when James noticed that we were getting a lot
 of
 bounce backs, he attributed it to server problems.
 Another employee showed him the thread (yours)
 regarding this spamming incident.
 
 James had no idea that Randy had put out that bogus
 story about a break-in. Right away he knew that it
 would come back to haunt them. As I mentioned, they
 had no IT people other than the Director of IT.
 Also,
 the only person who had been fired prior to that was
 a
 graphics person, and it hadn't been a recent firing.
 
 I know that this is an old issue, but as you are the
 self-proclaimed blight upon all spammers, or
 something
 similar, I thought that you might still be
 interested.
 
 By the way, just so that you don't think I am a
 disgruntled employee who is making this up, I wasn't
 fired. I gave them a full two weeks notice like a
 good
 employee would.
 
 However, if you are interested in hearing many more
 examples of the lack of integrity at beOutdoors.com,
 I
 would be more than happy to oblige. I never signed a
 non-disclosure agreement.
 
 Enjoy!


From Exodus:

We have contacted our customer regarding your
"beoutdoors.com" spam complaint.  Below is their
explanation describing the
situation. 

Between Friday evening May 5, 2000 and Monday morning,
May 8, 2000 there was unauthorized use of beOutdoors
assets and its
Internet access that resulted in the sending of
unsolicited commercial email to an unknown number of
email addresses.  This
was done without any authorization or knowledge of any
company manager.

Specifically sometime Friday evening May 5 one of our
young technical employees (now ex-employee) and a
friend of his entered
the beOutdoors facility (without authorization) and
set up an email program on an internal server to send
our cash sweepstakes
announcement to email addresses contained on a CD the
employees friend had acquired.

We are unable to determine the number of emails sent
or to whom they were sent since three of our internal
servers crashed as
a result of the individuals unauthorized use.  Based
upon complaints we do know that many individuals
received several copies
of the email.

Due to the crash of our internal servers it has taken
us a little over a week to become fully operational
again and complete
our investigation to determine if there was criminal
intent.  After a discussion with the District
Attorney’s office and the
individuals who perpetrated the email disaster it
appears that there was no criminal intent just
misguided, unauthorized
actions by two very immature individuals.  The
employee was terminated but not prosecuted.

We want to apologize to Exodus and any others that may
have been impacted in anyway by the unauthorized
actions of a now
former employee.

 ---

 
--  Eric Uratchko 
Policy Enforcement Specialist
Exodus Communications, Inc. 
1-888-2EXODUS, Ext. 7700  
 
-- Kathleen 
Policy Enforcement Manager 
Exodus Communications, Inc. 
1-888-2EXODUS, Ext. 3984 



__
Do You Yahoo!?
Get Yahoo! Mail - Free email you can 

Damn its good having you back Jim!!

2000-10-11 Thread cyphrpnk

Its good to have you back Jim...

   one of your anonymous fans...
BTW in a small startup I worked for for 2 years(it never came to fruition)
developing anonymous digital cash technologies with chaumian technologies,
the expression "good enough for Assasination Politics" came to be regarded
as high praise for digital cash systems that were tight enough for
privacy/anonymity...




Re: Burglar Politics, Tempesting PC's that watch TV and DVD regions

2000-10-11 Thread Ray Dillinger



On Wed, 11 Oct 2000, jim bell wrote:

 A popular, but false, myth. The video cards radiate more than the CRT's.
 Laptops tend to be the worst offenders.

 --Lucky Green [EMAIL PROTECTED]

As to the video cards...
Sorry, Lucky, but you're going to have to support this a little better.
Emissions are a function of  the signal voltage in a conductor, and the
extent that this conductor is free to emit.  

Given that a laptop uses an LCD display, there's really no good 
reason, electronically speaking, why its video hardware should 
have to do the ((scan+horizontal_retrace)*+vertical_retrace) 
sequence that the technology for getting a coherent signal 
relies upon. 

But the fact is, laptop hardware does write bits in a predefined 
order, (in fact the same order as CRT-based machines) so it's a 
worthwhile question whether anyone can figure the order and pick 
up the emissions from the video hardware.  

This looks like the sort of thing that can be resolved by experiment 
though; Anybody got enough DSP smarts to put an induction coil next 
to a laptop monitor and *see* whether they can read the darn thing? 

Also, it looks like the sort of thing that could be designed around. 
If someone were building a "secure laptop" they could make a video 
system and drivers that wrote the bits in a different, randomized 
order each time, and which only wrote the changed bits.  If anybody 
is actually making a product like this, it would be a strong 
indication that *somebody* with money to spend on RD considers 
it a valid threat model, because nobody makes products without a 
market.

Bear







RE: Non-Repudiation in the Digital Environment (was Re: First Monday August 2000)

2000-10-11 Thread Mike Just
Title: RE: Non-Repudiation in the Digital Environment (was Re: First  Monday   August 2000)





I'll add two words to the list: support (as opposed to provide), and accountability. I prefer to say that a digital signature is a tool that supports accountability. I suppose that supports non-repudiation would be fine as well. My concern is when the phrase provides non-repudiation is used it implies that complete non-repudiation can be provided technically (which I don't believe is the case). 

Mike J. 


 


 -Original Message-
 From: David Jablon [mailto:[EMAIL PROTECTED]]
 Sent: Wednesday, October 11, 2000 10:29 AM
 To: Arnold G. Reinhold
 Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED]
 Subject: Re: Non-Repudiation in the Digital Environment (was Re: First
 Monday August 2000)
 
 
 Anti-repudiation sounds good to me.
 
 ... even if does remind me of antidisestablishmentarianism.
 Come to think of it, now even that term sounds appropriate here -- as
 our belief in the value of methods that deter key dis-establishment.
 Pretty scary.
 
 -- dpj
 
 At 09:08 AM 10/11/00 -0400, Arnold G. Reinhold wrote:
 My concern is that the vast majority of informed lay people, 
 lawyers, 
 judges, legislators, etc. will hear non-repudiation and hear 
 absolute proof. If you doubt this, read the breathless articles 
 written recently about the new U.S. Electronic Signatures Act.
 
 I don't think technologists should be free to use evocative 
 terms and 
 then define away their common sense meaning in the fine print. 
 Certainly a valid public key signature is strong evidence and 
 services like that described in the draft can be useful. I simply 
 object to calling them non-repudiation services. I would 
 not object 
 to anti-repudiation services, counter-repudiation services or 
 repudiation-resistant technology. Would the banking 
 industry employ 
 terms like forgery-proof checks, impregnable vaults or 
 pick-proof locks to describe conventional security measures that 
 were known to be fallible?
 
 





RE: Think cash

2000-10-11 Thread Trei, Peter



 --
 Marcel Popescu[SMTP:[EMAIL PROTECTED]] wrote:
 An interesting idea has surfaced on the freenet-chat list: is it possible
 to
 build a program that creates some sort of a puzzle, whose answer the
 generating computer knows (and can verify), but which can only be answered
 by a human being, not by a computer? [Additional requirement: it should be
 easy for the human to answer the puzzle.]
 
 My proposal was to randomly create an image, which should be 1) easily
 recognizable by a human (say the image of a pet), but 2) complex enough so
 that no known algorithm could "reverse-engineer" this. [You need a
 randomly-generated image because otherwise one could build a large
 database
 of all the possible images and the correct answers.] Background
 information
 would also be very useful - see
 http://www.digitalblasphemy.com/userg/images/969403123.shtml - it's easy
 for
 a human being to identify the animal in the picture, but (AFAIK)
 impossible
 to write a program to do the same thing.
 
 Ideas?
 
 Mark
 
That's a really interesting question. My off-the-cuff answer 
would be 'no'. The constraints which say that the problem is 
randomly generated by a computer and the answer also evaluated 
by a computer are the killers. Any problem which one computer 
can create, and solve, can also be solved by another.

Perhaps one could generate the solution, and find a problem 
which is solved by that solution, but finding a type of 
problem which humans will always solve one way, and
computers another is the rub.

You refer the the problem of recognizing a photo of an animal. 
It used to be said that no computer program could reliably 
distinguish between a dog and a cat, but I'm not sure that's 
the case since the development of neural networks.

Almost any question which has a solution which is clear, 
unambiguous, and easy determined by a human can probably 
also be solved by either a regular program or a neural net.

What you are really attempting to find is a reliable, fast, 
single-question Turing test. I'm far from sure this is 
possible.

Peter Trei 






Re: Rijndael Hitachi

2000-10-11 Thread Derek Atkins

No, you're right.  Medeco should certainly work on a better lock.
Except there comes a point at which, relatively speaking, ALL doors
are "glass" doors compared to the security of this new medeco++ lock.
At which point no, it doesn't make sense to develop an even better
lock until you come up with better doors. :)

-derek

"Arnold G. Reinhold" [EMAIL PROTECTED] writes:

 Derek Atkins adds:
 
 
 Why try to pick a Medeco when it's locking a glass door?  :-)
 
 The fact that some people put Medeco's in glass doors, doesn't mean 
 Medeco should never develop a better lock.
 
 
 Arnold Reinhold

-- 
   Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
   Member, MIT Student Information Processing Board  (SIPB)
   URL: http://web.mit.edu/warlord/PP-ASEL-IA N1NWH
   [EMAIL PROTECTED]PGP key available




RE: New OLD cryptograph patent for NSA

2000-10-11 Thread raze

My question is this; why would they patent something that is 64 year old technology?  
This is like the Enigma machine no?!

On Wednesday, October 11, Bo Elkjaer Wrote:
Yesterday oct. 10 NSA was granted another patent for a cryptographic device invented 
by William Friedman. The application for the patent was filed oct. 23 1936 -- 64 
years ago.




Re: Rijndael Hitachi

2000-10-11 Thread Ray Dillinger



On Wed, 11 Oct 2000, Arnold G. Reinhold wrote:

The fact that some people put Medeco's in glass doors, doesn't mean 
Medeco should never develop a better lock.

I don't have a problem with people who manufacture locks.  
I have a problem with the people who sell them.  

A sign of irrational fear is when the thing that is the 
*symbol* of security -- in this case the lock, or the cipher, 
is made very strong -- but used in a way that does not afford 
good *actual* security.  

If the fear of being burgled weren't at least partly 
irrational, meaning if it were based mostly on experience 
rather than mostly on fear -- we'd be seeing doors with 
half-inch thick steel plates in them to provide the same 
level of security as the medeco lock -- and reinforced 
concrete walls to provide the same level of security as 
the door.

Ditto ciphers.  A strong cipher is like that Medeco 
lock, or even better - but if the "door" is a dumb 
key management policy, or the key is easily guessable, 
then what has been gained?  

Because what is a lock, really?  It makes it harder to 
get in *without breaking anything*.  But actual burglars 
could really care less whether they break some of your 
stuff -- provided it's stuff they can't steal.  So if 
actual burglars were as common as the people who sell 
these fancy locks tend to make out in their sales pitches, 
most folks would know, from experience, that burglars 
who break a window or a door are far more common than 
burglars who pick a lock -- and would be demanding 
*actual* security, meaning windows, doors and walls made 
of unbreakable stuff, rather than just *symbolic* security, 
of a strong lock or a strong cipher. 

If you want to propose a "Paranoid Encryption Standard", 
IE, a system for people who actually *DO* expect people 
to spend several million bucks and hundreds of man-years
and thousands of CPU-years trying to break it, then it's 
going to have to encompass a hell of a lot more than 
ciphers.  Start with physical machine security -- put 
the box in a concrete bunker with armed guards, give it 
a flat-panel monitor and roll your own drivers and video 
hardware. Stick a thermite grenade with a photosensitive 
fuse in the hard drive box. Make a continuous circuit 
through all the case components, that will detect anybody 
taking the case off, and blow the HD if the circuit's 
broken. Do a couple dozen other things along this line, 
and you'll have the physical security thing covered about 
as well as your cipher protects the data. 

But you're not through yet -- you've got the lock and the 
door, but burglars can still come in through the windows 
and the walls.  You've got to do some real serious data 
security as well. 

First of all, nothing unencrypted is EVER written to the 
hard drive except a bootstrap loader that prompts for a 
cipher key.  When it gets the cipher key, it reads and 
attempts to unencrypt the rest of the boot record.  

There is NO swap partition, and no swapping OS is to be used. 

The system computes a new cipher key every day using a 
cryptographically strong random number generator, and notifies 
you of it in a pencil-and-paper cipher that you can solve. 
(on high-entropy binary data, pencil-and-paper ciphers are 
actually quite strong)  That's the key you would need to 
use the following day.  If you don't log on for one day, 
you will not have the key for the following day, period. 
Thus, if someone seizes your box and you can hold out for 
*one* day, the data is GONE. 

But the burglars can still come in, maybe, through the roof.

So just to make sure of it, put a timer in there that blows 
the HD if it's ever been more than 24 hours since you were 
last logged on.  

*There's* your paranoid encryption standard.  Use blowfish for 
the cipher, and the cipher won't be the weakest point. 

Bear




Re: CDR: RE: New OLD cryptograph patent for NSA

2000-10-11 Thread Bo Elkjaer

On 11 Oct 2000, raze wrote:

 My question is this; why would they patent something that is 64 year old technology? 
 This is like the Enigma machine no?!

Note that the patent-application was filed in 1936. Obviously they were
interested in keeping any info relating to the invention confidential. But
theres no need for that anymore, given that the technology in the patent
is completely obsolete by now.

Yours
Bo Elkjaer, Denmark


 
 On Wednesday, October 11, Bo Elkjaer Wrote:
 Yesterday oct. 10 NSA was granted another patent for a cryptographic device 
invented by William Friedman. The application for the patent was filed oct. 23 1936 
-- 64 years ago.
 

Bevar naturen: Sylt et egern.
URL: http://www.datashopper.dk/~boo/index.html
ECHELON URL:
http://www1.ekstrabladet.dk/netdetect/echelon.iasp 




Re: Burglar Politics, Tempesting PC's that watch TV and DVD regions

2000-10-11 Thread jim bell

- Original Message -
X-Loop: openpgp.net
From: Steve Furlong [EMAIL PROTECTED]
Subject: Re: Burglar Politics, Tempesting PC's that watch TV and DVD regions


 Lucky Green wrote:
  Sunder wrote, quoting
   It's my understanding that TV detector vans work by picking up
   the radiation emitted by cathode ray tube TVs - which should mean
   that, if you're rich enough to run an LCD monitor they'll never
   know you're a secret Paxman admirer.
 
  A popular, but false, myth. The video cards radiate more than the CRT's.
  Laptops tend to be the worst offenders.

 Cables are a problem, too. Video signals from a fully-shielded computer
 connected to a fully-shielded monitor by a regular, unshielded cable can
 be read. Effective snooping distance goes down, though I don't remember
 by what factor.

Which is a good reason to use a shielded cable, of the lowest practical
length..  (check the resistance from one cable-end-housing  to the other.
If it's open it's NOT properly shielded.  If it's shorted it MAY be properly
shielded.)   Further, whether or not the cable is shielded, putting one of
those snap-on ferrite core filters at each end of the video cable, plus one
each foot or so, does an excellent job preventing RF from propagating along
the cable shield and radiating.

Jim Bell, N7IJS.






InformIT Member Password Information

2000-10-11 Thread support


Dear cypher punk,

This message has been sent to you to ensure that you can take full advantage
of our new site. Please note the following change with regard to our log in
procedure, and keep this message for future reference.

When logging in to InformIT, you now need to use your *e-mail address* and
password instead of your user name and password.

Here is your current account information, for your reference.

First Name: cypher
Last Name:  punk
User Name:  cypherpunk
E-mail: [EMAIL PROTECTED]
Password:   cypherpunk

When asked to log in, please enter your *e-mail address* and password as
listed above.

We've already moved all of your account information and the content of your
MyInformIT page to the new site.

If you have any problems, please e-mail [EMAIL PROTECTED]


Thanks,
Mel




Are your bills too high?...we can help!!!

2000-10-11 Thread theforce18
Title: Click Here Now








  

  Click
  Here Now!

  GET OUT OF DEBT!!!
  
  THIS IS NOT A LOAN!!!

  
  YOU WILL NOT BE TURNED DOWN!!!
  
  Are you thinking about borrowing money to 
consolidate your bills?
  Are you approaching or already past due on your credit cards?
  Do you usually only pay the monthly minimum on your credit cards?
  Are your creditors harassing you about late payments?
  Are family disputes over money taking place on a daily basis?
  
  DON'T GO FURTHER INTO DEBT BY BORROWING MORE MONEY
  
  For FREE information CLICK
  HERE
  We can reduce your monthly 
payments by
  consolidating your unsecured debt.
  
  * credit cards * department store accounts
  * medical bills
  * collection accounts* unsecured loans
  
  IT'S TRUE!
  
  Save 20% - 60% on your debt by consolidating
  everything into one low monthly payment!
  
  THIS IS NOT A LOAN
  You must have at least $5,000 of
  unsecured debt
  
  For FREE 
information CLICK
  HERE
  
  How do we do it?  We reduce or eliminate the high interest that you 
are
  currently paying.
  Not only does this save you money, your debts will be paid off up

  to 70% sooner because of the reduction or elimination of the interest.

  
  
  a non-profit organization we believe in people, not the bottom line.

  
  Let us help you help yourself!!
  
  For FREE information CLICK
  HERE
  
  

  
  

  
  
  

  
  
  


  










Re: Think cash

2000-10-11 Thread Greg Broiles

At 12:59 PM 10/11/00 -0400, Marcel Popescu wrote:
Real-To:  "Marcel Popescu" [EMAIL PROTECTED]

An interesting idea has surfaced on the freenet-chat list: is it possible to
build a program that creates some sort of a puzzle, whose answer the
generating computer knows (and can verify), but which can only be answered
by a human being, not by a computer? [Additional requirement: it should be
easy for the human to answer the puzzle.]

My proposal was to randomly create an image, which should be 1) easily
recognizable by a human (say the image of a pet), but 2) complex enough so
that no known algorithm could "reverse-engineer" this. [You need a
randomly-generated image because otherwise one could build a large database
of all the possible images and the correct answers.] Background information
would also be very useful - see
http://www.digitalblasphemy.com/userg/images/969403123.shtml - it's easy for
a human being to identify the animal in the picture, but (AFAIK) impossible
to write a program to do the same thing.

I don't follow the other list you mentioned, so I don't know what the 
actual problem to solve is - my guess is that this is an anti-bot 
protection measure, intended to make sure that only human participants can 
engage in a conversation.

If that's the problem - or if it's similar - you'll also need to make the 
puzzle difficult enough that
it's hard to brute-force or solve statistically - let's say you provide the 
other party with 20 images,
19 cats and 1 dog, and ask them to identify the dog.

What keeps a bot from answering the question 20 times? Let's assume the 
first arms-race countermeasure prevents answering the question more than 
once by generating puzzles on-the-fly from known cat and dog images - so 
the bot just picks an answer randomly, and keeps doing that until they hit.

Can God create a rock so big he can't lift it?

I think you're barking up the wrong tree, thinking about "known algorithms" 
and such - just like with crypto, the real way in isn't to attack the 
strong front door, but to just go around it.

This sounds like maybe it's essentially a credentialling/ID problem, where 
you're generating credentials on the fly based on a short-form Turing test. 
Can you restate the problem so that instead of a Turing test it's a more 
familiar multi-channel authentication process? (e.g., require new 
participants to have "introductions" from existing participants, track 
introductions, and remove the access for accounts found to be bots, or 
found to have introduced bots .. or similar.)

--
Greg Broiles
[EMAIL PROTECTED]





Multi-part security solutions (Was: Re: Rijndael Hitachi)

2000-10-11 Thread Meyer Wolfsheim

-BEGIN PGP SIGNED MESSAGE-

Further thoughts on this matter...

I think that we should escalate the level of liability a potential
attacker has to face when attempting to compromise a security system.

We should have laptops equipped with high explosives, such that the laptop
detonates after a certain number of failed logins. Let's see how popular
laptop theft is then.

Booby-traps as a standard part of facility security. Let an intruder
bypass the retina scanner if he wants, but have him face a nail gun as
soon as he opens the door.

Cyanide gas enabled car alarms. (I'm flexible on whether it is actually
cyanide, or something better). Currently some cars won't start without a
specific ignition key with an embedded chip. I say, let the car start if
hot-wired... then a few minutes later, automatically roll the windows,
force the locks, and gas the fucker who stole the car. No damage to the
upholstery.

As for computer systems, we should have IDS systems that retaliate to
attacks. It seems to me to be perfectly rational to design a firewall/IDS
that determines the source of the attack, and then neutralizes it. And I
think this last suggestion would be the least likely to land people in
jail.

Though I still to see someone do a C4-enabled laptop with
corresponding Win2K GINA. :)


- -MW-


-BEGIN PGP SIGNATURE-
Version: GnuPG v1.0.3
Comment: No comment.

iQEVAwUBOeUJPisFU3q6vVI9AQFHYAf+PdrnTEviE5vt5swkjoj0iVNcJOpyeSub
NPEqy9HXOHp6nVJlPwrGHhlPTFzcAjWo/3uLx3tJ5XRvJG6IUhhzLqe4TLH7CstH
aLQ79tu87im+083XcmoF9U+P3YRm4HTbhG24CQ3m7QhSZJHoIhJatpTXZBdGOvJ0
WvsuVt9vOd1c1v0gL/g/exxSIRE05M30gmvJ/sHp0nEiCSzXShvTqh7olX77lRMm
y0DuMjlP2AyCbM38Kr8BdXyecRzJ9MV6ND1B+aaq5azu2ke6h1rIXlYGcbZHJF74
O488dxPEmTIcE5mXX9TqoTC3fpsL7JnPgXrokkXR2xt0oeAGP6q4FA==
=8EvB
-END PGP SIGNATURE-




Multi-part security solutions (Was: Re: Rijndael Hitachi)

2000-10-11 Thread Steve Furlong

Meyer Wolfsheim wrote:
 
 -BEGIN PGP SIGNED MESSAGE-
 
 Further thoughts on this matter...
 
 I think that we should escalate the level of liability a potential
 attacker has to face when attempting to compromise a security system.

I like where you're coming from, but there's one nit:

 Cyanide gas enabled car alarms. (I'm flexible on whether it is actually
 cyanide, or something better). Currently some cars won't start without a
 specific ignition key with an embedded chip. I say, let the car start if
 hot-wired... then a few minutes later, automatically roll the windows,
 force the locks, and gas the fucker who stole the car. No damage to the
 upholstery.

Their sphincters would probably release at some point. You still need
Scotchguard, or whatever replaced it.

Other than that, great ideas.

-- 
Steve Furlong, Computer Condottiere Have GNU, will travel
   518-374-4720 [EMAIL PROTECTED]





WHAT CAN YOU GET FOR $20???

2000-10-11 Thread BestFriend

What can you get for $20.00?
A pizza A tank of gas   A haircut
Lunch with a friendA parking place
How About
FINANCIAL INDEPENDENCE




 Looking for that extra something, to help your life have that 
little extra
comfort?
 Do you work to cover the bills? Fed up with paying out and not
receiving the
 rewards you wish for? Then have an open mind And read all of 
this,
before you
 make a decision- it will be worth your while.
 ___
 Subject:  MUST READ! ! ! ... TV Advertised! ! ! ... 
Fun-Lucrative

 Fellow Entrepreneur
 If you wish to learn about an exceptional
 opportunity in the Home Business arena...Read On.

 "Your living is determined not so much by what life brings to
 you as by the attitude you bring to life; not so much by what
 happens to you as by the way your mind looks at what happens."

 This is going to be a great New Year for you!

 Please read all of this!

 EARN $100,000 PER YEAR SENDING E-MAIL!!!

 

 You can earn $50,000 or more in the next 90 days sending e-mail,
 seem impossible? Read on for details (no, there is no
 'catch')...

 

 "AS SEEN ON NATIONAL TV"

 Thank you for your time and Interest. This is the letter you've
 been hearing about in the news lately.

 Due to the popularity of this letter on the internet, a major
 nightly news program recently devoted an entire show to the
 investigation of the program, described below, to see if it
 really can make people money.

 The show also investigated whether or not the program was legal.
 Their findings proved once and for all that there are,
 absolutely no laws prohibiting the participation in the program.
 This has helped to show people that this is a simple, harmless
 and fun way to make some extra money at home.

 The results of this show have been truly remarkable. Since so
 many people are participating now, those involved are doing much
 better than ever before. Everyone makes more as more people try
 it out. It is very, very exciting to be a part of this plan. You
 will understand once you experience it.

 "HERE IT IS, BELOW"

 
 

 *** Print This Now For Future Reference ***

 The following income opportunity is one you may be interested in
 taking a look at. It can be started with VERY LITTLE investment
 and the income return is TREMENDOUS!!!

 

 If you would like to make at least $50,000 in less than 90 days!
 Please read the enclosed program...THEN READ IT AGAIN!!!

 

 THIS IS A LEGITIMATE, LEGAL, MONEYMAKING OPPORTUNITY. It does
 not require you to come into contact with people, do any hard
 work and best of all, you never have to leave the house except
 to get the mail. If you believe that someday you'll get that big
 break that you've been waiting for, THIS IS IT! Simply follow
 the instructions, and your dreams will come true. This e-mail
 marketing program works perfectly...100%, EVERY TIME. E-mail is
 the sales tool of the future. Take advantage of this non-
 commercialized method of advertising NOW!!! The longer you wait,
 the more people will be doing business using e-mail. Get your
 piece of this program now!

 MULTI-LEVEL MARKETING (MLM) has finally gained respectability.
 It is being taught in the Harvard Business School, both Stanford
 Research and the Wall Street Journal have stated that between
 50% and 65% of all goods and services will be sold through
 multi-level methods by the late 1990's. This is a Multi-Billion
 Dollar industry and of the 500,000 millionaires in the U.S., 20%
 (100,000) made their fortune in the last few years in MLM.
 Moreover, statistics show 45 people become millionaires everyday
 through Multi-Level Marketing.

 You may have heard this story before, but over the summer Donald
 Trump made an appearance on the David Letterman Show. Dave asked
 him what he would do if he lost everything and had to start over
 from scratch. Without hesitating, Trump said he would find a
 good network marketing company and get to work. The audience
 started to hoot and boo him. He looked out at the audience and
 dead-panned his response - "That's why I'm sitting up here and
 you are all sitting out there!"

 With network marketing you have two sources of income. Direct
 commissions from sales you make yourself and commissions from
 sales made by people you introduce to the business.

 Residual income is the secret of the wealthy. It means investing
 time or money once and getting paid again and again and again.
 In network marketing, it also means getting paid for the work of
 others.

 The enclosed information is something I almost 

Gov. Bush links Columbine massacre to Internet use

2000-10-11 Thread Declan McCullagh



http://www.cluebot.com/article.pl?sid=00/10/12/0326212mode=nested

Bush Links Columbine Massacre to Internet Use
posted by cicero on Wednesday October 11, @10:25PM
from the sounds-a-lot-like-joseph-lieberman dept.

George W. Bush may have bested Al Gore in tonight's presidential
debate, but it sure wasn't because of the governor's tech-savviness.
Warned the Texas Republican, in response to a gun-control question:
"Columbine spoke to a larger issue, and it's really a matter of
culture. It's a culture that somewhere along the line we begun to
disrespect life, where a child can walk in and have their heart
turn dark as a result of being on the Internet and walk in and
decide to take somebody else's life." It was undeniably a good,
mushy, appeal-to-the-softhearted line, but the sheer schmaltziness of
it is in questionable taste. For instance: Was the Net really to
blame? Shouldn't even a "compassionate conservative" want to hold
miscreants responsible for their own actions? And would the guv have
offered the same warning to millions of Americans if the Columbine
killers had, say, been regulars at the public library?

Transcript is at:
http://www.cluebot.com/article.pl?sid=00/10/12/0326212mode=nested




Re: Gov. Bush links Columbine massacre to Internet use

2000-10-11 Thread Tim May

At 11:20 PM -0400 10/11/00, Declan McCullagh wrote:
http://www.cluebot.com/article.pl?sid=00/10/12/0326212mode=nested

Bush Links Columbine Massacre to Internet Use
posted by cicero on Wednesday October 11, @10:25PM
from the sounds-a-lot-like-joseph-lieberman dept.

George W. Bush may have bested Al Gore in tonight's presidential
debate, but it sure wasn't because of the governor's tech-savviness.
Warned the Texas Republican, in response to a gun-control question:
"Columbine spoke to a larger issue, and it's really a matter of
culture. It's a culture that somewhere along the line we begun to
disrespect life, where a child can walk in and have their heart
turn dark as a result of being on the Internet and walk in and
decide to take somebody else's life." It was undeniably a good,
mushy, appeal-to-the-softhearted line, but the sheer schmaltziness of
it is in questionable taste. For instance: Was the Net really to
blame? Shouldn't even a "compassionate conservative" want to hold
miscreants responsible for their own actions? And would the guv have
offered the same warning to millions of Americans if the Columbine
killers had, say, been regulars at the public library?

Transcript is at:
http://www.cluebot.com/article.pl?sid=00/10/12/0326212mode=nested

This was a very small, and inconsequential, part of the debate/discussion.

Had George Bush called for _Internet licensing_ in some concrete way, 
comparable to the way Al Gore called for gun licensing, I would be 
more concerned about Bush's comments. But he did not.

Throwing in a line about the Columbine creeps being influenced by the 
Internet (or by Quake and Doom and other games, or by "The Matrix," 
or by being spoiled suburban brats) is not the same as calling for 
unconstitutional abridgments of freedoms.

Normally I vote Libertarian. This year I may vote for Bush as a vote 
for who will do me, us, and the Constitution the lesser damage of the 
two. (All voting is about bang for the buck, about effectiveness of a 
vote...an election is not about "voting for the best man," it is 
instead about minimizing damage.)


--Tim May


-- 
-:-:-:-:-:-:-:
Timothy C. May  | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   831-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
"Cyphernomicon" | black markets, collapse of governments.




Re: Gov. Bush links Columbine massacre to Internet use

2000-10-11 Thread Mac Norton

Let me see if I understand this.  It's okay to blame the Net for
Columbine as long as you don't call for licensing.  So it's OK
to blame gunshows for gun murders as long as you don't call 
for licensing?  Right?
MacN
PS:  What part of this debate/discussion was *not* very small,
and inconsequential? 
M
On Wed, 11 Oct 2000, Tim May wrote:
 
 This was a very small, and inconsequential, part of the debate/discussion.
 
 Had George Bush called for _Internet licensing_ in some concrete way, 
 comparable to the way Al Gore called for gun licensing, I would be 
 more concerned about Bush's comments. But he did not.
 
 Throwing in a line about the Columbine creeps being influenced by the 
 Internet (or by Quake and Doom and other games, or by "The Matrix," 
 or by being spoiled suburban brats) is not the same as calling for 
 unconstitutional abridgments of freedoms.
 
 Normally I vote Libertarian. This year I may vote for Bush as a vote 
 for who will do me, us, and the Constitution the lesser damage of the 
 two. (All voting is about bang for the buck, about effectiveness of a 
 vote...an election is not about "voting for the best man," it is 
 instead about minimizing damage.)
 
 
 --Tim May
 
 
 -- 
 -:-:-:-:-:-:-:
 Timothy C. May  | Crypto Anarchy: encryption, digital money,
 ComSec 3DES:   831-728-0152 | anonymous networks, digital pseudonyms, zero
 W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
 "Cyphernomicon" | black markets, collapse of governments.