Re: Just to make your life more paranoid:) Re: Surreptitious Tor Messages?

2005-10-04 Thread alan
On Tue, 4 Oct 2005, Steve Furlong wrote:

 On 10/4/05, gwen hastings [EMAIL PROTECTED] wrote:
  Troll Mode on:
  TOR was originally developed as a result of CIA/NRL funding:)
 ...
  BTW running TOR makes you very visible that you are running tor even as
  a client.. its quite a noisy protocol
 
 Well, of course that feature is built in. The NSA wants to be able
 to easily find anyone who's running it.
 
 The noisy protocol has the added benefit of causing the network cable
 to emit lots of radiation, frying the brains of TOR users. The only
 defense is a hat made of flexible metal.

Don't do it! That acts as an antenna and only increases the damage!

-- 
Invoking the supernatural can explain anything, and hence explains nothing. 
  - University of Utah bioengineering professor Gregory Clark



Re: [EMAIL PROTECTED]: Re: [EMAIL PROTECTED]: Re: [EMAIL PROTECTED]: Re: Wikipedia Tor]]]

2005-09-28 Thread Alan Barrett
 - Forwarded message from Jimmy Wales [EMAIL PROTECTED] -
 We are not looking for a perfect solution.  Yes, Wikis will be
 vandalized.  We're prepared to deal with that, we do deal with that.
 But what I am seeking is some efforts to think usefully about how to
 helpfully reconcile our dual goals of openness and privacy.

Wikipedia should allow Tor users to register Wikipedia nyms.
Then they could block:
 Tor users trying to edit without a nym;
 Tor users trying to edit with a nym that has a bad reputation;
and they could rate-limit
 Tor users trying to edit with a nym that has insufficient history
 to be classified as good or bad;
while not blocking
 Tor users trying to edit with a nym that has a good reputation.

This will require some changes to the MediaWiki software that Wikipedia
uses.  AFAIK, there's currently no way to rate-limit nyms that have
insufficient history, and blocks on IP addresses are currently all or
nothing.

--apb (Alan Barrett)



RE: Researchers Combat Terrorists by Rooting Out Hidden Messages

2005-02-02 Thread Alan
On Tue, 2005-02-01 at 23:21 -0800, Steve Schear wrote:
 At 02:07 PM 2/1/2005, Tyler Durden wrote:
 
 Counter-stego detection.
 
 Seems to me a main tool will be a 2-D Fourier analysis...Stego will 
 certainly have a certain thumbprint, depending on the algorithm. Are 
 there certain images that can hide stego more effectively? IN other words, 
 these images should have a lot of spectral energy in the same frequency 
 bands where Stego would normally show.
 
 Images that ideal for hiding secret messages using stego are those that by 
 default contain stego with no particular hidden content.  A sort of Crowds 
 approach to stego.

If you really want to send secret messages, just send it in the chaff in
spam.  Everyone is programmed to ignore it or filter it out.

-- 
When a student reads in a math book that there are no absolutes,
suddenly every value he's been taught is destroyed. And the next thing
you know, the student turns to crime and drugs. - Mel Gabler - Censor



Re: This Memorable Day

2004-11-04 Thread alan
On Wed, 3 Nov 2004, Tyler Durden wrote:

 Well, this may actually be less hard than we thought. Indeed, it's the one 
 vaguely silver lining in this toxic cloud. Outsourcing to India will 
 actually add a lot to world stability. Of course, we'll loose a lot of jobs 
 in the process, but in the long run we'll eventually have another strong 
 trading partner like Japan or France or the Dutch. Bush will sell us out to 
 big business and all of the less-well-off will suffer like crazy in the 
 process, but it will actually make things better in the long run. The only 
 thing we need to worry about is not melting the ice caps in the process.

You forget that Bush and his cronies are Evangelical Christians.  They 
believe that the world is going to end *soon* and that it is a good thing. 

These are people who are doing everything they can to make the world a 
less stable place because in doing so they bring about armagedon.  (Then 
Jesus will come back and they will be rewarded for bringing about the 
deaths of billions.

Sometimes i wonder if they worship Jesus or Cthulhu.  (Maybe they are the 
same.  How else could he walk on water?)

-- 
Q: Why do programmers confuse Halloween and Christmas?
A: Because OCT 31 == DEC 25.



Re: US Retardation of Free Markets (was Airport insanity)

2004-10-27 Thread alan
On Wed, 27 Oct 2004, Roy M. Silvernail wrote:

 On Tue, 2004-10-26 at 21:10 -0700, James A. Donald wrote:
  --
  James A. Donald:
Moral equivalence, the rationale of those who defend 
tyranny and slavery.
  
  Roy M. Silvernail
   Moral superiority, the rationale of both sides of any given 
   violent conflict.  The winner gets to use the victory to 
   proclaim the correctness of their interpretation.
  
  A claim that presupposes that the west is just as totalitarian 
  as its enemies, that well known reality is not to be trusted, 
  that newsmen and historians are servants of the vast capitalist 
  conspiracy, 
 
 No claim in evidence.  Just the observation that any justificaton for a
 violent conflict is necessarily subjective.

It does not have to be *true*, you just have to get others to believe it.

Of course, the current administration has been handing them example after 
example to point to to make the point...

-- 
chown -R us ./base



Re: Cash, Credit -- or Prints?

2004-10-13 Thread Alan Barrett
On Tue, 12 Oct 2004, John Kelsey wrote:
 but there doesn't seem to be a clean process for determining how
 skilled an attacker needs to be to, say, scan my finger once, and
 produce either a fake finger or a machine for projecting a fake
 fingerprint into the reader.

.. or a replacement reader that fakes the signals to the rest of the
security system.

--apb (Alan Barrett)



Re: Cryptographers and U.S. Immigration

2004-07-23 Thread alan
On Fri, 23 Jul 2004, R. A. Hettinga wrote:

 
 
 http://www.schneier.com/crypto-gram-0407.html#3
 
 Cryptographers and U.S. Immigration
 
 Seems like cryptographers are being questioned when they enter the U.S.
 these days. Recently I received this (anonymous) comment: It seems that
 the U.S. State Department has a keen interest in foreign cryptographers:
 Yesterday I tried to renew my visa to the States, and after standing in
 line and getting fingerprinted, my interviewer, upon hearing that my
 company sells [a cryptography product], informed me that due to new
 regulations, Washington needs to approve my visa application, and that to
 do so, they need to know exactly which companies I plan to visit in the
 States, points of contact, etc. etc. Quite a change from my last visa
 application, for which I didn't even have to show up.
 
 I'm curious if any of my foreign readers have similar stories. There are
 international cryptography conferences held in the United States all the
 time. It would be a shame if they lost much of their value because of visa
 regulations.
 
 

It makes you wonder what they are going to do to cryptographers that try 
to leave the country.

Please step onto the square marked 'trap door'.




RE: Texas oil refineries, a White Van, and Al Qaeda

2004-07-20 Thread alan
On Tue, 20 Jul 2004, Trei, Peter wrote:

 
 
  -Original Message-
  From: [EMAIL PROTECTED]
  [mailto:[EMAIL PROTECTED] Behalf Of Thomas Shaddack
  Sent: Tuesday, July 20, 2004 3:48 PM
  To: Justin
  Cc: [EMAIL PROTECTED]
  Subject: Re: Texas oil refineries, a White Van, and Al Qaeda
  
  
  
  On Tue, 20 Jul 2004, Justin wrote:
  
   HOUSTON (Reuters) - Law enforcement officials said on 
  Monday they are
   looking for a man seen taking pictures of two refineries in 
  Texas City,
   Texas.
  
 
  
  The person in question was just somebody with a weakness for 
  industrial 
  architecture.
 
 Indeed. Among the endless variety of things people do with
 their spare time are trainspotters and planespotters. This
 seems to be more popular in Britain than in the US, but
 I wonder if even over there people who park themselves near
 airports railway statiions, obsessively noting the arrival
 and departure of each vehicle, attract the attention of 
 security?

Maybe the Patriot Act can get struck down because it violates the 
American's With Disablities Act.  It discriminates against 
obsesive-compulsives.




Re: USA PATRIOT Act Survives Amendment Attempt (fwd from brian-slashdotnews@hyperreal.org)

2004-07-09 Thread alan
On Fri, 9 Jul 2004, Thomas Shaddack wrote:

 
 On Fri, 9 Jul 2004, Steve Schear wrote:
 
  Quite a few book stores (including the local Half-Priced Books) now keep no
  records not required and some do not even automate and encourage their patron
  to pay cash.  In California book sellers to such used/remaindered stores must
  identify themselves for tax purposes.
 
 The Patriot gag orders lead me to a thought.
 
 Is it possible to write a database access protocol, that would in some 
 mathematically bulletproof way ensure that the fact a database record is 
 accessed is made known to at least n people? A way that would ensure that 
 either nobody can see the data, or at least n people reliably know the 
 record was accessed and by whom?
 
 When somebody comes with a paper and asks for the data, the one currently 
 in charge of the database has to give them out, and may be gag-ordered. 
 However, when way too many people know about a secret, which the protocol 
 should ensure, it's better chance it leaks out, and less likely to 
 identify the one person responsible for the leak, who could be jailed 
 then. Especially when at least one of n is outside of the reach of the 
 paws of the given jurisdiction.
 
 The question is this: How to allow access to a specific file/db record in 
 a way that it can't be achieved without a specified list of parties (or, 
 for added system reliability, at least m of n parties) reliably knowing 
 about who and when accessed what record? With any attempt to prevent the 
 parties from knowing about the access leading to access failure?
 
 Note a peculiarity here; we don't ask for consent of the parties (that 
 would be a different threat-response model), we only make sure they know 
 about it. (We can deny the access, when at least (n-m)+1 parties refuse to 
 participate, though.)

That would crash the system.




Re: For Liars and Loafers, Cellphones Offer an Alibi

2004-06-27 Thread Alan Barrett
On Sat, 26 Jun 2004, Major Variola (ret) wrote:
 Eventually the cellphones will be able to tell another phone approx
 where they are. [...] The marketing reason would be to help people
 find others geographically.

At least with GSM, the base station always knows the approximate
distance to the phone (this is needed by the GSM protocol, for reasons
related to time slot management in the presence of finite speed of
light, but it might be possible to hack the phone's firmware to fool it,
or to register with fewer base stations than usual).  The GSM network's
database knows the exact locations of all the base stations.  Add a
little software to do triangulation from multiple base stations, and the
GSM network knows the location of the phone, to an accuracy that depends
chiefly on the base station density.  Add a layer of user interface
software, and you're done.  No cooperation from the phone is necessary,
except what the phone would normally do in order to register itself with
base stations so that it can receive calls.  No GPS or other non-GSM
protocols are necessary.

This is already offered as an extra cost service (branded Look for me)
by Vodacom in South Africa.  It's targeted at parents who want to know
where their children are, and the phrase with their permission is
included in current advertising.  As the seeker, you send an SMS (text
message) to a special number to register your phone as a user of the
locator service, and to ask for the location of another phone.  The
network sends a message to the target phone, and the user must reply to
give permission to be located.  Then the network sends a text message
to the seeker, telling them the location of the target.  I don't know
whether the target's permission is asked every time, or just once per
seeker; I do know that it's not just once globally.  In any case, the
permission is just a flag in a database, and is not really needed by
anybody with back-door access to the GSM provider.

--apb (Alan Barrett)



Re: Citizen Chics Must Put Out

2004-06-21 Thread alan
On Mon, 21 Jun 2004, Jay Goodman Tamboli wrote:

 On Mon, Jun 21, 2004 at 01:45:19PM -0400, Tyler Durden wrote:
  OK...so say an officer is at the beach and spots some hot chick in a 
  bathing suit, with obviously no ID on her person. And let's say this 
  officer believes that this chick has a bag of pot at home. Can he just go 
  and arrest her?
 
 That doesn't sound like reasonable suspicion to me.  Police need
 reasonable suspicion to stop the person and ask their name.

Not anymore...




Re: [osint] Assassination Plans Found On Internet

2004-06-14 Thread alan
On Mon, 14 Jun 2004, Tyler Durden wrote:

 Remember too that terrorism is really a form of PR, rather than (in most 
 cases) an actual destruction of infrastructure or whatnot. Smart terrorists 
 will obviously leverage any channel available to cause a population to view 
 their world as unstable.
 
 Also remember too that plans such as this may be fishing...in other words, 
 communications in the hope that somebody out there (not directly known to 
 the issuer of the communique) will take the info and work out his own plans 
 for attacking the target.
 
 I'm sure our boys at the School of the Americas (or whatever it's called 
 now) use these mthods all the time. In fact, they're probably the ones who 
 taught the Mujahadin (and bin Laden) a lot of these techniques.

Also don't forget that by telling people where you plan to attack, you 
get them to spend a bunch of money that they would not have already spent.

Give them enough targets and they will be chasing shadows all over the 
place.  When they have done this enough, the oposition will not know what 
to believe.

A mind-fuck is a terrible thing to waste.

 
 -TD
 
 
 From: R. A. Hettinga [EMAIL PROTECTED]
 To: Thomas Shaddack [EMAIL PROTECTED]
 CC: [EMAIL PROTECTED]
 Subject: Re: [osint] Assassination Plans Found On Internet
 Date: Mon, 14 Jun 2004 17:05:53 -0400
 
 At 10:45 PM +0200 6/14/04, Thomas Shaddack wrote:
  It may be also a very cheap method of attack.
 
 True enough.
 
 Cheers,
 RAH
 
 --
 -
 R. A. Hettinga mailto: [EMAIL PROTECTED]
 The Internet Bearer Underwriting Corporation http://www.ibuc.com/
 44 Farquhar Street, Boston, MA 02131 USA
 ... however it may deserve respect for its usefulness and antiquity,
 [predicting the end of the world] has not been found agreeable to
 experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
 
 
 _
 Stop worrying about overloading your inbox - get MSN Hotmail Extra Storage! 
 http://join.msn.click-url.com/go/onm00200362ave/direct/01/
 



Re: Quantum Loop Gravity Be For Whitey

2004-01-16 Thread Alan
On Tue, 2004-01-13 at 22:20, bgt wrote:
 On Tue, 2004-01-13 at 10:48, cubic-dog wrote:
  in force, because, we finally get slave, indentured servants who
  will either take the 90 cents and hour or be deported. 
 
 This kind of rhetoric is extremely irritating.  If they can
 be deported, they are neither slaves or indentured servants. 
 
 If they voluntarily came to this country, and voluntarily accepted 90
 cents/hr, 

If they do it under threat, then it is not voluntary.  

They may have come here voluntarily, but that was probably due to the
false advertising that America is a Land of Opportunity(tm) and other
such rot that our country has used to sucker people to come here.

That is like saying that just because the kid got in your car
voluntarily, you are not responsible for what happened to him when you
molested him.

-- 
Push that big, big granite sphere way up there from way down here!
Gasp and sweat and pant and wheeze! Uh-oh! Feel momentum cease!
Watch it tumble down and then roll the boulder up again!
- The story of Sisyphus by Dr. Zeus in Frazz 12/18/2003



Re: Lunar Colony

2004-01-16 Thread Alan
On Thu, 2004-01-15 at 16:11, Justin wrote:
 Trei, Peter (2004-01-15 21:39Z) wrote:

  Interesting OpEd piece in the NYT today pointing out that
  a manned Mars expedition becomes *much* more affordable if
  no return trip is planned.
 
 This is obvious.  More affordable, but more risk.  We might end up with
 a bunch of dead Mars colonist-hopefuls.

Actually I can think of a number of people we could send.

The current administration comes to mind.

Mr. Cheney, we have a new undisclosed location for you.

Mars needs NeoCons.

-- 
Push that big, big granite sphere way up there from way down here!
Gasp and sweat and pant and wheeze! Uh-oh! Feel momentum cease!
Watch it tumble down and then roll the boulder up again!
- The story of Sisyphus by Dr. Zeus in Frazz 12/18/2003



Re: [camram-spam] Re: Microsoft publicly announces Penny Black PoW postage project

2004-01-04 Thread Alan Brown
On Tue, 30 Dec 2003, Bill Stewart wrote:

 The reason it's partly a cryptographic problem is forgeries.
 Once everybody starts whitelisting, spammers are going to
 start forging headers to pretend to come from big mailing lists
 and popular machines and authors, so now you'll not only
 need to whitelist Dave Farber or Declan McCullough if you read their lists,
 or Bob Hettinga if you're Tim (:-), you'll need to verify the
 signature so that you can discard the forgeries that
 pretend to be from them.

 You'll also see spammers increasingly _joining_ large mailing lists,
 so that they can get around members-only features.

This has already happened:

Krazy Kevin pulled this stunt 5 years ago on at least one list I was on,
joining the list to harvest the most common posters, then spamming using
them as sender envelopes after he'd been kicked off.

 At least one large mailing list farm on which I've joined a list
 used a Turing-test GIF to make automated list joining difficult,

..discrimination against blind users - this is legally actionable in
several countries. There is a blind group in the UK taking action
against a number of companies for this and the Australian Olympic
committee ended up being fined several million AU$ for the same offence
in 1999.

 and Yahoo limits the number of Yahoogroups you can join in a day,
 but that's the kind of job which you hire groups of Indians
 or other English-speaking third-world-wagers to do for you.

To underscore that point, I've _watched_ cybercafes full of SE asians(*)
doing exactly this kind of thing for the princely sum of US$5/day -
twice the average wage of the area, even after the cafe fees were
deducted.

(*) Philippines and east Malaysia.

AB



Re: [camram-spam] Re: Microsoft publicly announces Penny Black PoW postage project

2004-01-04 Thread Alan Brown
On Thu, 1 Jan 2004, Eric S. Johansson wrote:

  the easynet.nl list (recently demised) listed nearly 700K machines that
  had been detected (allegedly) sending spam... so since their detection
  was not universal it would certainly be more than 700K :(

 that is a nasty bit of news.  I'll run some numbers based on that and
 see what the ratio of spam to stamp engines would be.  gut sense is that
 it's still not horrible, just not as advantageous.  but you never know
 until you run the numbers.

Intelligence from DSBL indicated that there were _at least_ 350k
compromised machines in the USA Roadrunner network alone at one stage.

They are currently tracking around 1.5 million compromised machines.

The Swen and blaster worms install various spamware and backdoors. These
have been estimated to have infected millions of machines worldwide and
later versions removed characteristics which removed tellltale
compromise signs when scanned - now they mostly phone home, instead of
listening for commands.

The pool of infected machines is huge. I just hope you're right about
the CPUs burning up - it doesn't happen when machines are running OGR
calculations, so I suspect that you just ran into a particularly badly
built example.

AB



Re: [camram-spam] Re: Microsoft publicly announces Penny Black PoW postage project

2003-12-30 Thread Alan Brown
On Tue, 30 Dec 2003, Eric S. Johansson wrote:

  But using your spam size, , the slowdown factor becomes roughly
 73 times.  So they would need 73 machines running full tilt all the time
 to regain their old throughput.

Believe me, the professionals have enough 0wned machines that this is
trivial.

On the flipside, it means the machines are burned faster.

 unfortunately, I think you making some assumptions that are not fully
 warranted.  I will try to do some research and figure out the number of
 machines compromised.  The best No. I had seen to date was about 350,000.

It's at least an order of magnitude higher than this, possibly 2 orders,
thanks to rampaging worms with spamware installation payloads
compromising cablemodem- and adsl- connected Windows machines worldwide.

AB






Re: Spending a billion dollars an hour produces a hell of a lightshow!

2003-03-21 Thread alan
On Fri, 21 Mar 2003, Tyler Durden wrote:

 As the Iraqis themselves said, and I paraphrase (because the quote is  not 
 handy): If the U.S. says they know the locations of secret weapons  
 projects, of underground bunkers, etc., why don't they simply give the  
 locations to the U.N. weapons inspectors who can then go to those  sites?
 
 Come on now! The Iraqis should have proven that they DON'T have any nukular 
 weapons. They were unable to prove that they don't have any WMDs, so now 
 it's their fault they're getting invaded.

How do you prove non-existance of an item?  (Especially when the other 
party is willing to lie and forge evidence to the contrary.)

I don't believe that there was *anything* that Iraq could have done to 
stop the invasion.  If Saddam left with all his sons, we would have gone 
in to provide stability.  If they had bent over and lubed up, we would 
have still claimed that they were hiding something on mobile bases or 
had it hidden underground or some other excuse.

Because, in the end, all Bush wanted was an excuse.

But don't think it stops here.  

As it has been said before: Rome wasn't built in a day.




Re: Bush's Moment of Truth

2003-03-19 Thread alan
On Tue, 18 Mar 2003, Bill Stewart wrote:

 Bush said this was going to be the Moment of Truth.
 
 Well, we haven't had a moment of truth from his administration yet,
 so I guess that's a welcome change...

I wonder if it will be like a moment of silence?



Re: Brinwear at Benetton.

2003-03-14 Thread alan
On Fri, 14 Mar 2003, Adam Shostack wrote:

 On Fri, Mar 14, 2003 at 01:22:44PM -0500, Trei, Peter wrote:
 
 | You're not thinking this through. As the item goes through the door (in
 | either direction) the check is made Is this individual tag on this store's
 | 'unsold inventory' list?. If so, raise the alarm. The tags are not fungible;
 | they each have a unique number. When you purchase an item, it's tag
 | number is transfered from the 'unsold inventory' list to the 'Mike Rosing'
 | list, or, if no link to a name can be found, 'John Doe #2345'.
 | 
 | As you walk up to the counter, the tag in your jockey shorts is read,
 | and you are greeted by name, even if you've never been in that store
 | before.
 
 People will find this spooky, and it will stop, but how much you've
 spent over the last year will still be whispered into the sales
 clerk's ear bug, along with advice the woman in the green jacket 12
 feet from you spends an average of $1,000 per visit, go fawn on her.
 And remind her that the jacket is nearly a year old.  Very last
 season.

Day of the RIFDs

I can also see an even nastier probable RISKS article.

You buy an item.  The system is either down or crashes soon after the item 
is purchaced.  (Or better yet, gets wiped out after a restore from an old 
backup tape.)

It never makes it to the master database.

You are now marked as a probable shoplifter. 

Now prove that you are not.



Re: Brinwear at Benetton.

2003-03-12 Thread alan
On Wed, 12 Mar 2003, Tim May wrote:

  Regarding TEMPEST shielding - there is another, complementary approach 
  for
  shielding: jamming. There are vendors selling devices that drown the RF
  emissions of computer equipment in noise, so TEMPEST receivers get
  nothing. Are there any publicly available specs of such generators, or
  even building plans?
 
 Jamming is grossly less efficient than detection. If you want an 
 explanation, let me know and I'll spend 10 minutes writing a small 
 piece on it. But first, think deeply about why this is so. Think 
 especially about recovering signals from noise.

It sounds like there is an opertunity here for the right person.  Open up 
a place to clean your clothes of all those little RFID tags and other 
buglets people are so interested in attaching to any object (nailed down 
or not).



Re: M Stands for Moron? You gotta be kidding...

2003-02-13 Thread alan
On Thu, 13 Feb 2003, Tyler Durden wrote:

 The M in M-Theory stands for Moron.

I always thought it stood for Mescaline. ]:





Re: A Few Words About Palladium

2002-12-13 Thread alan
On Fri, 13 Dec 2002, Nomen Nescio wrote:

 According to the message below, Palladium will not include a serial
 number revocation list, document revocation list, or similar
 mechanism to delete pirated music and other unauthorized content.
 These claims have been made most vocally by Ross Anderson in his TCPA
 FAQ, http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html, and by Lucky Green
 in his DefCon presentation, http://www.cypherpunks.to/.
 
 Instead, the point of Palladium is to create a decentralized, trusted
 computing base... whose integrity can be audited by anyone.  This is
 accomplished, as has been discussed at length here and elsewhere,
 by hardware which can compute a secure hash of software as it loads,
 and which can attest to this hash via cryptographic signatures sent to
 remote systems.  This functionality allows software to prove to third
 parties that it is running unmolested, which is the basic functionality
 provided by Palladium.
 
 Unfortunately, the exaggerated and misleading claims in the links above
 are accepted as truth by most readers, and a false picture of Palladium
 is virtually universal on the net.  Isn't it time for security experts
 to take a responsible position on this technology, and to speak out
 against the spread of these falsehoods?

All of this is speculation until the system is actually implemented.

The questions are Who do you trust? and Do their interests coincide 
with yours?. 

I do not trust Microsoft as far as I can throw them.  They have 
demonstrated in the past that security for them means the check 
cleared.  There have been too many holes, backdoors, and outright 
sabotage of competitors that they have lost any credibility with me.  And 
since they are unwilling to publish source, the code is suspect from the 
start.  (I doubt if they will let a third party that i trust audit the 
software without 42 levels of NDAs and a lein on their immortal souls.)

There are other projects to insure that the software running at the kernel 
level is authorised via cryptographic checksums.  (Both in BSD and in 
Linux.) 

What users are (rightfully) afraid of is that this is yet another effort 
to remove control from the users over what software they can use and how 
they can use it.

Microsoft has already used this method to control just what types of 
protocols and video drivers could be used under Windows terminal server.  
(You had to have the app sighed by Microsoft in order to run and they 
wouldn't sign certain compeating protocols.)  This method was bypassed by 
some interesting hackery, BTW. (Thou shalt not split thy open calls.)

So far the only examples we have is that of Microsoft's past behaviour.  
It is not oriented for your security or mine, but of theirs.

The fear is justified. (And ancient.) 

 
 
  A Few Words About Palladium 
  By John Manferdelli, General Manager, Trusted Platform Technologies,
  Microsoft Corporation
 
  As you may know, I spent some time on the road in the UK in
  November. During my visit, I had the chance to meet some of you at
  the Meet the Technologists breakfast at the Microsoft Campus in
  Reading. Thanks to those of you who were able to attend. It was a great
  chance to engage in frank discussions about some of the more controversial
  topics surrounding Palladium.
 
  One of the issues we discussed was whether Palladium would include
  mechanisms that would delete pirated music or other content under remote
  control or otherwise disable or censor content, files, or programs running
  on Windows. The truth is, Palladium will not disable any content or file
  that currently runs. Palladium was designed so that no policy will be
  imposed that is not approved by the user. Microsoft is firmly opposed to
  putting policing functions into Palladium and we have no intention of
  doing so. The machine owners - whether an individual or enterprise - have
  sole discretion to determine what programs run under Palladium. Programs
  that run under Palladium, just like programs that run under Windows,
  will do whatever they are allowed to do, based on the security settings
  on the user's machine. Palladium not only respects existing user controls,
  it strengthens them.
 
  What Palladium does change is the ability for software to be protected
  from other software. Palladium will enable and safeguard a decentralized
  trusted computing base on open systems.  These security-oriented
  capabilities in Windows will be enabled by a relatively small change in
  hardware, and will help transform the PC into a platform that can perform
  trusted operations that span multiple computers under a trust policy that
  can be dynamically created and whose integrity can be authenticated by
  anyone. In addition, it will preserve the flexibility and extensibility
  that contributes so much to the entire PC ecosystem.
 
  I hope to have an opportunity to meet more of you in the New Year. We'll
  keep you posted about Palladium-related industry 

Re: Yodels, new anonymous e-currency

2002-11-12 Thread Alan Barrett
On Tue, 12 Nov 2002, Nomen Nescio wrote:
 According to this link,
 http://www.infoanarchy.org/?op=displaystory;sid=2002/11/11/4183/2039,
 a new form of digital cash called yodels is being offered anonymously:
  [...]
 Supposedly, then, this is cash which can be transferred anonymously via
 IIP or Freenet.  Leaving aside the question of trusting an anonymous bank
 (trust takes time), the sticking point for ecash is how to transfer
 between yodels and other currencies.  Without transferability, what
 gives yodels their value?

I believe that the Yodel bank does not have its own currency, but
uses DMT Rands.  DMT Rands are alleged to be backed by a basket
of gold plus a few fiat currencies issued by nation states.  See
http://www.orlingrabbe.com/rand.htm for information about the currency,
and http://www.orlingrabbe.com/dmt_guide.htm for information about the
DMT system and its companions ALTA and LESE.

--apb (Alan Barrett)




Re: Jamming camcorders in movie theaters

2002-10-11 Thread alan
I read how they plan on doing this.  I predict it will give a percentage 
of the movie-going public screaming headaches.  (Or at least make them 
very uncomfortable.)  These are the same people who are sensitive to the 
flicker of cheap 60 hz office lighting.

Not that a bit of discomfort was any concern to the MPAA.  Look at the 
movies they put out!


On Fri, 11 Oct 2002, Major Variola (ret) wrote:

 [They want to exploit human persistance-of-vision vs. camcorder pixel
 differences.
 Seems to me that one could process the captured frames to eliminate
 artifacts, though that
 *is* another step required.  In any case, insiders will have access to
 the playback codes
 opening the bits to duping.]
 
 
 Jamming camcorders in movie theaters
 
By Evan Hansen
Staff Writer, CNET News.com
October 10, 2002, 4:00 AM PT
 
As one of the key architects of the discontinued Divx
 DVD system, Robert
Schumann knows first hand how hard it can be to sell
 copyright protection to the
masses.
 
Still, some three years after Circuit City pulled
 financial support for the
limited-use DVD technology he helped build, Schumann
 and a group of
former Divx engineers are hoping for a second act in
 Hollywood with the
advent of digital cinema.
 
Herndon, Va.-based Cinea, the company Schumann
 co-founded after Divx
folded in 1999, is close to unveiling a beta for its
 Cosmos digital cinema
security system that will help movie distributors
 keep track of how their products are used
while protecting them from piracy.
 
Meanwhile, Cinea this week
scored a $2 million grant from the
National Institute of Standards
and Technology's (NIST)
Advanced Technology Program
to develop a system that it claims
will stop audience members from
videotaping digital movies off
theater screens.
 
The company will modify the
timing and modulation of the light
used to create the displayed
image such that frame-based
capture by recording devices is
distorted, according to an
abstract for the winning NIST grant application. Any
 copies made from these devices will
show the disruptive pattern.
 
In an interview, Schumann compared the process with
 distortions that appear in videotaped
images of computer screens, which may show lines that
 are invisible to the naked eye.
Rather than produce accidental disturbances, he said,
 Cinea plans to create specific
disturbances that it can control.
 
Machines see the world more closely to reality than
 humans do. In the case of computer
screens, if you track the energy from a phosphor
 coating (a light-emitting chemical used in
cathode-ray tubes), you find that it begins with a
 strong burst followed by a period of
decay and then another burst, and so on. But people
 see it as a single intensity, Schumann
said.
 
Cinea, a privately held company with backing from
 Tysons Corner, Va.-based venture
capital firm Monumental Venture Partners, expects to
 have a working prototype within two
years. It is partnering with Princeton, N.J.-based
 Sarnoff, which will conduct research on
image manipulation and analyze distortion and
 possible countermeasures. The University of
Southern California's Entertainment Technology Center
 in Los Angeles will evaluate the
system in testing with human subjects.
 
There's a difference in the way a camcorder and the
 human eye see the world, Schumann
said. We've figured out some ways to exploit that.
 The trick is to make sure there is no
negative impact on the viewing experience for the
 audience.
 snip
 http://news.com.com/2100-1023-961484.html?tag=fd_lede2_hed
 
 -
 Dear Mr Congressman, I am God
 -Jack Valenti




Re: Cryptogram: Palladium Only for DRM

2002-09-20 Thread Alan Braggins

 Of course, those like Lucky who believe that trusted computing technology
 is evil incarnate are presumably rejoicing at this news.  Microsoft's
 patent will limit the application of this technology.

In what way is in the desktop of almost every naive user a usefully
limited application?




Re: Backround checks are more important than education...

2002-09-03 Thread Alan Braggins

[EMAIL PROTECTED] wrote:
   Thousands of teachers will not be able to take classes at the start
   of the new term because character checks on them will not have been
   completed, the government has admitted.
[...]
 This is in the context of a knee jerk reaction to an apparent murder
 case of two young girls where one of the two accused worked in the
 girl's school.

The requirement for background checks was in place long before the murder
(and the local paper said both the accused had passed them - the man
accused of the murder worked as a caretaker at the village college, and
the woman accused of perverting the course of justice as a classroom
assistant at the girls' school). (I live in a village next to Soham).

The case has presumably influenced how seriously the checks are taken,
though there are reports of some schools trying to skip them to get
teachers working in time.
http://www.guardian.co.uk/child/story/0,7369,780573,00.html

-- 
Alan Braggins  mailto:[EMAIL PROTECTED]  http://www.ncipher.com/
nCipher Corporation Ltd.  +44 1223 723600  Fax: +44 1223 723601