[Politech] Passport RFID tracking: a between-the-lines read [priv] (fwd from declan@well.com)
- Forwarded message from Declan McCullagh declan@well.com - From: Declan McCullagh declan@well.com Date: Tue, 03 May 2005 22:43:19 -0700 To: politech@politechbot.com Subject: [Politech] Passport RFID tracking: a between-the-lines read [priv] User-Agent: Mozilla Thunderbird 1.0 (Macintosh/20041206) Original Message Subject: Your RFID passport tracker is ready... Date: Mon, 2 May 2005 15:24:03 -0500 From: Parks [EMAIL PROTECTED] To: Declan McCullagh declan@well.com, politech@politechbot.com Declan, I think you might find this interesting. I confirms my vision of a future where entry points are wired and read your ID and identify your possessions through wireless RFID transmitters built into everything from passports, ID cards, credit cards, and products we buy off the shelves. - Drew From the EE-Times, a between the lines look at the future of RFID tracking: re: E-passport makers hail U.S. retreat Junko Yoshida [FAIR USE] EE Times (04/29/2005 1:38 PM EDT) PARIS - Global electronic passports suppliers hailed a decision by the U.S. State Department to drop a requirement for additional security measures in next-generation U.S. passports. The specifications have yet to be finalized. Neville Pattinson, director of technology development and government affairs for smart card provider Axalto Americas, said Friday (April 29) that adding security measures such as Basic Access Control and a metallic shield cover to U.S. passports could completely make the information [stored in the e-passport] undetectable. ME They can be read from an RFID reader while your passport is in your pocket by stealthy information miners. These RFID chips are the same kind that the stores are putting on products and they all may be read as you pass through an entry or exit point. The point is that THEY want to use these as tracking devices. Note the comment about metallic shields. You can put your future drivers license (when they put RFID in them too) or passport in tin foil or a metallic case. Pattison originally disclosed the results of a National Institute of Standards and Technology e-passport trial held last summer in which he said NIST testers were able to lift an exact copy of digitally signed private data from a contactless e-passport chip 30 feet away. A State Department official earlier this week acknowledged for the first time that information stored inside an e-passport chip could be read at a distance beyond 10 centimeters. ME Bull - they know its range is METERS not centimeters!!! ME GO TO EE-TIMES for the entire article but this should be proof enough Barry Steinhardt, director of the Technology Liberty Program at the American Civil Liberties Union, asked, Why do we need to have a contactless circuit at all in an identity document? ...e-passport chips provide a digital data payload,...basic information such as a digital photo is stored electronically, technologies like ***facial recognition*** can be used... ME Oh yah, get EVERYONES e-mug and store it in Big Brother's database so cameras can track you anywhere you go. ___ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) - End forwarded message - -- Eugen* Leitl a href=http://leitl.org;leitl/a __ ICBM: 48.07078, 11.61144http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net signature.asc Description: Digital signature
[Politech] Customs-proofing your laptop: Staying safe at border searches [priv] (fwd from declan@well.com)
- Forwarded message from Declan McCullagh declan@well.com - From: Declan McCullagh declan@well.com Date: Tue, 03 May 2005 22:42:03 -0700 To: politech@politechbot.com Subject: [Politech] Customs-proofing your laptop: Staying safe at border searches [priv] User-Agent: Mozilla Thunderbird 1.0 (Macintosh/20041206) Detecting whether the Feds or any government adversary has placed spyware on your computer when examining it at a border checkpoint is not entirely trivial. It is, however, important for your privacy and peace of mind -- especially because computer and PDA searches will likely become more popular in time. Here are some basic suggestions: http://www.politechbot.com/2005/04/21/update-on-alabama/ A more advanced one would be to perform a checksum of all the files on the hard drive before-and-after through something like this: % for i in `find / -print`; do md5 $i /tmp/new; done ; diff /tmp/new /tmp/old The problem is that even your diff utility could be modified so you'd need to use a known-good copy from archival media. Can anyone recommend a checksum'ing utility for Windows and OS X? It would be nicer than a command-line interface. Note, by the way, that Rep. Bono's anti-spyware bill exempts police: http://thomas.loc.gov/cgi-bin/bdquery/z?d109:h.r.00029: -Declan --- Declan, In response to the Alabama activist who was hassled at the border returning from Canada, here is some insight. However, I ask that you PLEASE WITHHOLD MY NAME; I know some people who do computer forensics for FBI and I would not want them to know it was me writing this Thanks. Feel free to use any of the below in the blog or in the listserv. + + + + + + + + + + + + + + + + + + + + + + + + Loretta's experience w/ US Customs is chilling. The fifteen minutes her notebook computer was out of view and in government custody is plenty of time for an agent to image the drive. Imaging, as you know, is the end-to-end bit-level copying of the drive. When properly done, imaging bypasses all OS controls, such as file permissions in Linux, BSD, and OS/X, and user ownership in Windows. A drive image affords an analyst plenty of time to examine the drive contents without the owner's awareness. The image can be mounted onto a device where other programs can reconstruct or reinterpret file systems structures of NTFS, ext, FAT, and so on. An analyst mounting an image as root or Administrator can see anything. Do not assume a BIOS password will protect you. The drive can be physically removed from a laptop in under a minute. If the file data is encrypted, a forensic analyst will need to use a password cracker to decode the data. This will slow them down, and in all but the most pressing cases, will prompt them to move on. However, a careless individual may leave their PGP (or similar) key on their drive in a text file or in slack or deleted space, giving the agent something to work with. Though encryption is a pain for the user to deal with, this is probably the best level of protection. Encryption raises your reasonable level of expectation of privacy. Legal issues raised by this incident potentially include illegal search and seizure. Even US Customs still needs a search warrant for your computer, and the warrant must state specifically what they are looking for. They cannot fish. If an image was taken of Loretta Nall's drive, there will be a chain of custody document for this supposed evidence. Her lawyer can advise as to how to file a motion for it. There might also be an incident report, which would describe the actions of the agents. None of the information stolen from Loretta's drive can be used directly in a court proceeding. Unfortunately, it probably could be used to confirm other intelligence. There is no device I know of that will allow you to determine if your drive has been scanned or imaged. Computer forensics is extremely careful not to taint evidence by writing to the drive. I'd like to see one of those warranty foil labels that fall apart when you tamper with them. There must be source for them. Place a label across the edges of the drive bay. That way, if the drive is removed, you can at least see that it was opened. The point about government installing bots is well-taken. You may be able to md5sum your drive before and after customs, but this capability is beyond 99%+ of users. If possible, do NOT carry a notebook across the border with you if you can avoid it. Junior G-Men maybe too tempted to prove their mettle with the boss when they see one. For data, pen drives and CD's can be comingled with other personal possessions, where they might attract less attention. Pen drives may be reformatted at will, removing the risk exposure that might come with a notebook's Internet cache, slack space, cookie list, website history, and so on. If you MUST take your computer, FLUSH ALL INTERNET CACHE, web site histories, search histories, cookies, temp files,
RE: [Politech] Customs-proofing your laptop: Staying safe at border searches [priv] (fwd from declan@well.com)
I checked out those links...hilarious! Check this out (remember, this gal is running for Senator of Alabama!): On the way to the hotel my cab driver, having heard the conversation with the Border Guard, expressed an interest in learning more about my work. So I filled him in as much as I could in the few minutes we had left. When we arrived at the hotel I had expected to meet my ride who had the cab fare, pay the cabbie and embark on my weekend adventure. She hadn't even brought cab fare, and was expecting another pot head to show up with it!!! However, my ride got a little lost and hadnt made it to our designated meeting point yet. I called the cell number I was given but got voicemail. I didnt have my credit card on me so I couldnt pay the cabbie. He decides that he will wait with me for a little bit and we continue our conversation about pot and drug policy. She went to a foriegn country without cab fare or a credit card! And now the guy with the money (another pot-smoker) is late, and she's suprised!!! I'm starting to wonder if this is a hoax. It IS funny, though. -TD From: Eugen Leitl [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: [Politech] Customs-proofing your laptop: Staying safe at border searches [priv] (fwd from declan@well.com) Date: Wed, 4 May 2005 10:58:22 +0200 - Forwarded message from Declan McCullagh declan@well.com - From: Declan McCullagh declan@well.com Date: Tue, 03 May 2005 22:42:03 -0700 To: politech@politechbot.com Subject: [Politech] Customs-proofing your laptop: Staying safe at border searches [priv] User-Agent: Mozilla Thunderbird 1.0 (Macintosh/20041206) Detecting whether the Feds or any government adversary has placed spyware on your computer when examining it at a border checkpoint is not entirely trivial. It is, however, important for your privacy and peace of mind -- especially because computer and PDA searches will likely become more popular in time. Here are some basic suggestions: http://www.politechbot.com/2005/04/21/update-on-alabama/ A more advanced one would be to perform a checksum of all the files on the hard drive before-and-after through something like this: % for i in `find / -print`; do md5 $i /tmp/new; done ; diff /tmp/new /tmp/old The problem is that even your diff utility could be modified so you'd need to use a known-good copy from archival media. Can anyone recommend a checksum'ing utility for Windows and OS X? It would be nicer than a command-line interface. Note, by the way, that Rep. Bono's anti-spyware bill exempts police: http://thomas.loc.gov/cgi-bin/bdquery/z?d109:h.r.00029: -Declan --- Declan, In response to the Alabama activist who was hassled at the border returning from Canada, here is some insight. However, I ask that you PLEASE WITHHOLD MY NAME; I know some people who do computer forensics for FBI and I would not want them to know it was me writing this Thanks. Feel free to use any of the below in the blog or in the listserv. + + + + + + + + + + + + + + + + + + + + + + + + Loretta's experience w/ US Customs is chilling. The fifteen minutes her notebook computer was out of view and in government custody is plenty of time for an agent to image the drive. Imaging, as you know, is the end-to-end bit-level copying of the drive. When properly done, imaging bypasses all OS controls, such as file permissions in Linux, BSD, and OS/X, and user ownership in Windows. A drive image affords an analyst plenty of time to examine the drive contents without the owner's awareness. The image can be mounted onto a device where other programs can reconstruct or reinterpret file systems structures of NTFS, ext, FAT, and so on. An analyst mounting an image as root or Administrator can see anything. Do not assume a BIOS password will protect you. The drive can be physically removed from a laptop in under a minute. If the file data is encrypted, a forensic analyst will need to use a password cracker to decode the data. This will slow them down, and in all but the most pressing cases, will prompt them to move on. However, a careless individual may leave their PGP (or similar) key on their drive in a text file or in slack or deleted space, giving the agent something to work with. Though encryption is a pain for the user to deal with, this is probably the best level of protection. Encryption raises your reasonable level of expectation of privacy. Legal issues raised by this incident potentially include illegal search and seizure. Even US Customs still needs a search warrant for your computer, and the warrant must state specifically what they are looking for. They cannot fish. If an image was taken of Loretta Nall's drive, there will be a chain of custody document for this supposed evidence. Her lawyer can advise as to how to file a motion for it. There might also be an incident report, which would describe the actions of the agents. None of the information stolen from Loretta's drive can be used directly in a court
Re: Secure erasing Info (fwd from richard@SCL.UTAH.EDU)
Just as a data point, PGPDisk works fine on CF devices. I use this for a CF card on which I keep a bunch of my work for movement between laptop and desktop machines. --John
[IP] Real ID = National ID (fwd from dave@farber.net)
- Forwarded message from David Farber [EMAIL PROTECTED] - From: David Farber [EMAIL PROTECTED] Date: Wed, 4 May 2005 11:12:58 -0400 To: Ip ip@v2.listbox.com Subject: [IP] Real ID = National ID X-Mailer: Apple Mail (2.728) Reply-To: [EMAIL PROTECTED] Begin forwarded message: From: Barry Steinhardt [EMAIL PROTECTED] Date: May 4, 2005 11:05:11 AM EDT To: [EMAIL PROTECTED] Subject: Real ID = National ID Dave, Congressional passage of the Real ID legislation is now all but a done deal, House and Senate conferees having agreed to inclusion of language in an appropriations bill that is all but certain to pass. The name Real ID is, if anything, too modest. Despite deep public opposition over the years to a national identity card, and Congress's unwillingness to even consider the idea directly, our security agencies have now gotten what they want as proponents have succeeded in pushing through Congress a National ID-in-disguise. The Real ID Act is indeed a real (national) ID. Although individual states' driver's licenses may continue to exhibit cosmetic differences, they will now contain a standardized set of information collected by all 50 states, which means that underneath each state's pretty designs they are really a single standardized national card - backed up not only by biometrics, but also by a standardized machine- readable zone and by a national database of ID information. Local DMV offices may continue to appear to be state offices, but they will now become agents acting on behalf of the federal government, charged with issuing a national identity document without which one will be unable to function in America. National database creates powerful tracking tool. Real ID requires the states to link their databases together for the mutual sharing of data from these IDs. This is, in effect, a single seamless national database, available to all the states and to the federal government. (The fact that the database is a distributed one, maintained on interconnected servers in the separate states, makes no difference.) National database creates security risks. The creation of a single interlinked database creates a one-stop shop for identity thieves and terrorists who want to assume an American's identity. The security problems with creating concentrated databases has recently been demonstrated by the rampant number of data breaches in recent months in which information held by commercial database companies has fallen into the hands of identity thieves or others. The government's record at information security is little better and that is especially true at state Motor Vehicle Departments that have routinely been the targets of both insider and outsider fraud and just plain larceny. The machine-readable zone paves the way for private-sector piggybacking. Our new IDs will have to make their data available through a common machine-readable technology. That will make it easy for anybody in private industry to snap up the data on these IDs. Bars swiping licenses to collect personal data on customers will be just the tip of the iceberg as every retailer in America learns to grab that data and sell it to Choicepoint for a dime. It won't matter whether the states and federal government protect the data - it will be harvested by the private sector, which will keep it in a parallel database not subject even to the limited privacy rules in effect for the government. This national ID card will make observation of citizens easy but won't do much about terrorism. The fact is, identity-based security is not an effective way to stop terrorism. ID documents do not reveal anything about evil intent - and even if they did, determined terrorists will always be able to obtain fraudulent documents (either counterfeit or real documents bought from corrupt officials). Negotiated rulemaking. Among the any unfortunate effects of this legislation is that it pre-empts another process for considering standardized driver's licenses that was far superior. That process (set in motion by the Intelligence Reform Act of 2004) included a negotiated rulemaking among interested parties - including the states and civil liberties groups - to create standards. Instead, the worst form of rules is being imposed, with the details to be worked out by security officials at DHS instead of through balanced negotiations among affected parties. Your papers, please. In the days after 9/11, President Bush and others proclaimed that we must not let the terrorists change American life. It is now clear that - despite its lack of effectiveness against actual terrorism - we have allowed our security agencies push us into making a deep, far-reaching change to the character of American life. Barry Steinhardt Director Technology and Liberty Project American Civil Liberties Union
Re: Pi: Less Random Than We Thought
[1]Autoversicherung writes Physicists including Purdue's Ephraim Fischbach have completed a study [2]comparing the 'randomness' in pi to that produced by 30 software random-number generators and one chaos-generating physical machine. After conducting several tests, they have found that while sequences of digits from pi are indeed an acceptable source of randomness -- often an important factor in data encryption and in solving certain physics problems -- pi's digit string does not always produce randomness as effectively as manufactured generators do. 1. https://autoversicherung.einsurance.de/ 2. http://news.uns.purdue.edu/UNS/html4ever/2005/050426.Fischbach.pi.html This doesn't really make sense. Either the digits are random or they are not. You can't be a little bit random. Well, you can be, but the point is that you either pass the test or you don't. If pi's digits fail a test of randomness in a statistically significant way, that is big news. If they pass it, then there is no meaningful way to compare them with another RNG that also passes. It's just a statistical quirk due to random variation as to which will do better than another on any given test. The bottom line is still that either an RNG passes the tests acceptably or it does not. From what they say (or don't say), pi does pass. It doesn't make sense to say that other RNGs do better. CP
Notification d'état de la distribution
- Ceci est une réponse automatique suite à votre message Cette boîte n'existe plus. Merci de mettre à jour votre carnet d'adresse. Reporting-MTA: dns; mx.laposte.net Received-from-MTA: dns; 10.150.9.59 Arrival-Date: Wed, 4 May 2005 23:06:20 +0200 Original-Recipient: rfc822;james@laposte.net Final-Recipient: rfc822; boite.inactive@laposte.net Action: Failed Status: 5.7.1 (delivery not authorized, message refused) Return-Path: cypherpunks@minder.net Received: from mx.laposte.net (10.150.9.59) by mx.laposte.net (7.0.028) id 425309D5011C5C00 for [EMAIL PROTECTED]; Wed, 4 May 2005 23:06:20 +0200 Received: from minder.net (194.3.40.11) by mx.laposte.net (7.0.028) id 42530AAC01C96303 for [EMAIL PROTECTED]; Wed, 4 May 2005 23:06:20 +0200 Message-ID: [EMAIL PROTECTED] (added by [EMAIL PROTECTED]) From: cypherpunks@minder.net To: [EMAIL PROTECTED] Subject: hi Date: Wed, 4 May 2005 22:56:54 +0200 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary==_NextPart_000_0005_CF3B91C2.1FA57B93 X-Priority: 3 X-MSMail-Priority: Normal
RE: [Politech] Customs-proofing your laptop: Staying safe at border searches [priv] (fwd from declan@well.com)
I checked out those links...hilarious! Check this out (remember, this gal is running for Senator of Alabama!): On the way to the hotel my cab driver, having heard the conversation with the Border Guard, expressed an interest in learning more about my work. So I filled him in as much as I could in the few minutes we had left. When we arrived at the hotel I had expected to meet my ride who had the cab fare, pay the cabbie and embark on my weekend adventure. She hadn't even brought cab fare, and was expecting another pot head to show up with it!!! However, my ride got a little lost and hadnt made it to our designated meeting point yet. I called the cell number I was given but got voicemail. I didnt have my credit card on me so I couldnt pay the cabbie. He decides that he will wait with me for a little bit and we continue our conversation about pot and drug policy. She went to a foriegn country without cab fare or a credit card! And now the guy with the money (another pot-smoker) is late, and she's suprised!!! I'm starting to wonder if this is a hoax. It IS funny, though. -TD From: Eugen Leitl [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: [Politech] Customs-proofing your laptop: Staying safe at border searches [priv] (fwd from declan@well.com) Date: Wed, 4 May 2005 10:58:22 +0200 - Forwarded message from Declan McCullagh declan@well.com - From: Declan McCullagh declan@well.com Date: Tue, 03 May 2005 22:42:03 -0700 To: politech@politechbot.com Subject: [Politech] Customs-proofing your laptop: Staying safe at border searches [priv] User-Agent: Mozilla Thunderbird 1.0 (Macintosh/20041206) Detecting whether the Feds or any government adversary has placed spyware on your computer when examining it at a border checkpoint is not entirely trivial. It is, however, important for your privacy and peace of mind -- especially because computer and PDA searches will likely become more popular in time. Here are some basic suggestions: http://www.politechbot.com/2005/04/21/update-on-alabama/ A more advanced one would be to perform a checksum of all the files on the hard drive before-and-after through something like this: % for i in `find / -print`; do md5 $i /tmp/new; done ; diff /tmp/new /tmp/old The problem is that even your diff utility could be modified so you'd need to use a known-good copy from archival media. Can anyone recommend a checksum'ing utility for Windows and OS X? It would be nicer than a command-line interface. Note, by the way, that Rep. Bono's anti-spyware bill exempts police: http://thomas.loc.gov/cgi-bin/bdquery/z?d109:h.r.00029: -Declan --- Declan, In response to the Alabama activist who was hassled at the border returning from Canada, here is some insight. However, I ask that you PLEASE WITHHOLD MY NAME; I know some people who do computer forensics for FBI and I would not want them to know it was me writing this Thanks. Feel free to use any of the below in the blog or in the listserv. + + + + + + + + + + + + + + + + + + + + + + + + Loretta's experience w/ US Customs is chilling. The fifteen minutes her notebook computer was out of view and in government custody is plenty of time for an agent to image the drive. Imaging, as you know, is the end-to-end bit-level copying of the drive. When properly done, imaging bypasses all OS controls, such as file permissions in Linux, BSD, and OS/X, and user ownership in Windows. A drive image affords an analyst plenty of time to examine the drive contents without the owner's awareness. The image can be mounted onto a device where other programs can reconstruct or reinterpret file systems structures of NTFS, ext, FAT, and so on. An analyst mounting an image as root or Administrator can see anything. Do not assume a BIOS password will protect you. The drive can be physically removed from a laptop in under a minute. If the file data is encrypted, a forensic analyst will need to use a password cracker to decode the data. This will slow them down, and in all but the most pressing cases, will prompt them to move on. However, a careless individual may leave their PGP (or similar) key on their drive in a text file or in slack or deleted space, giving the agent something to work with. Though encryption is a pain for the user to deal with, this is probably the best level of protection. Encryption raises your reasonable level of expectation of privacy. Legal issues raised by this incident potentially include illegal search and seizure. Even US Customs still needs a search warrant for your computer, and the warrant must state specifically what they are looking for. They cannot fish. If an image was taken of Loretta Nall's drive, there will be a chain of custody document for this supposed evidence. Her lawyer can advise as to how to file a motion for it. There might also be an incident report, which would describe the actions of the agents. None of the information stolen from Loretta's drive can be used directly in a court
Re: Secure erasing Info (fwd from richard@SCL.UTAH.EDU)
Just as a data point, PGPDisk works fine on CF devices. I use this for a CF card on which I keep a bunch of my work for movement between laptop and desktop machines. --John
Re: Pi: Less Random Than We Thought
[1]Autoversicherung writes Physicists including Purdue's Ephraim Fischbach have completed a study [2]comparing the 'randomness' in pi to that produced by 30 software random-number generators and one chaos-generating physical machine. After conducting several tests, they have found that while sequences of digits from pi are indeed an acceptable source of randomness -- often an important factor in data encryption and in solving certain physics problems -- pi's digit string does not always produce randomness as effectively as manufactured generators do. 1. https://autoversicherung.einsurance.de/ 2. http://news.uns.purdue.edu/UNS/html4ever/2005/050426.Fischbach.pi.html This doesn't really make sense. Either the digits are random or they are not. You can't be a little bit random. Well, you can be, but the point is that you either pass the test or you don't. If pi's digits fail a test of randomness in a statistically significant way, that is big news. If they pass it, then there is no meaningful way to compare them with another RNG that also passes. It's just a statistical quirk due to random variation as to which will do better than another on any given test. The bottom line is still that either an RNG passes the tests acceptably or it does not. From what they say (or don't say), pi does pass. It doesn't make sense to say that other RNGs do better. CP
