HDTenEightyP/NetNews huggingface dataset:
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: CERT and the Dept. of Justice on keystroke monitoring
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Wed, 16 Dec 1992 08:33:22 GMT

In article <1992Dec14.133030.804@ualr.edu>, lindstrom@acs writes:
>I agree. I run a small system for solar research and curious about the
>problem here.  Our computer is for research use only. Period.  The work
>all belongs to the school (as does the machine) and all of the users are
>willing to be monitored.

I don't think there's necessarily anything wrong here, as long as the
users know what the situation is.  A very strict police of "research
use only" might be bad for the research, though, but it depends much
on the situation / environment.

>As for the phone, it is also for business. Sure, I use it for personal
>things (call my wife to find out what time to get home by) but if someone
>is making personal long distance calls, that's taking money from our
>already small budget and I want to know.

A question: do you think it would be an invasion of privacy if someone
from the company / agency listened to your calls to your wife to make
sure they're really to your wife and not long-distance running up
costs or leaking confidential information?

>Now I'm not for a police state, but it seems to me that those yelling
>about their "rights" are overlooking their responsibilaties. I have read
>alot about "they" (meaning the system, like me :-) should and should
>not do...what about users? What standards should a system user be held
>to, if any, and what measures should be allotted to insure compliance?

Threats, fear, uncertainty and doubt are often good and much-used
measures for this ;-).  Or, in other words, peer pressure.  Published
rules with input from users as well often are enough - most people are
reasonable, and when they know what the issues are there will be few
problems.

In certain critical environments I think even routine monitoring of
all activity by users is acceptable - for example a critical computer
system in a nuclear plant.

//Jyrki
Newsgroups: comp.security.misc
From: jd@parcival.nwc.navy.mil (John de la Garrigue)
Subject: Re: CERT and the Dept. of Justice on keystr
Reply-To: jd@parcival.nwc.navy.mil
Organization: Science Applications International Corporation
Date: Mon, 14 Dec 1992 17:02:21 GMT

In article 22164@news.Hawaii.Edu, newsham@wiliki.eng.hawaii.edu (Timothy Newsham) writes:
>In article <1992Dec12.043113.24232@lambda.msfc.nasa.gov> palmer@Trade_Zone.msfc.nasa.gov writes:
>>
>>
>>We must be careful not to confuse rights with privilege.

True statement.

<stuff deleted>

>
>ack!  if you think these are not rights I dont really know what
>to say..
>(1) drive a car - if it doenst infringe on the rights of others
>then it is entirely your own business...

Don't know about other states, but the State of California explicitly
states in thier driver's license policy that driving is a privilege, *not*
a right.  Just because we take it for granted does not mean we are entitled
to it.

>
>(2) come and go as we please  -  as long as we dont intrude on
>other peoples "property".  

Actually, I think this is a right guaranteed by the US government, but I could 
be wishful thinking.  Any lawyers care to confirm this?

>
>(3) drink alchohol, take drugs etc - again as long as it doesnt
>intrude on other peoples rights.   

Again, not a *right*.  The government clearly states drug use is illegal, and
which drugs can't be used or can only be used when properly prescribed.  As for
alcohol, the government restricts the age at which one can legally consume it.

>
>government should not be in the business of protecting
>people from theirselves...
>ack.. this is getting way off topic, what is this
>stuff even doing in comp.misc.sec ?
>

Good point.  Which group should this go to?

---
                __
           /  /   \
          /  /    /
   /     /  /    /
  /_____/  /____/

John de la Garrigue                              ||  Phone:  619/546-6192
Senior Unix System Administrator                 ||  Pager:  619/375-0500
Site Manager                                     ||  E-mail: jd@c3ot.saic.com
Science Applications International Corp. (SAIC)  ||  

My views are not necessarily those of my employer, the US government,
or anyone else for that matter.

Newsgroups: comp.security.misc,comp.sources.wanted,comp.unix.aix
From: jrh@jrh.uucp (James R. Hamilton)
Subject: Need encrypted communications communications software
Date: Thu, 17 Dec 1992 02:17:27 GMT
Organization: private system, Toronto, Ontario

    I'm interested in using high speed modems V.32 for company confidential
    communications.  One security option is hardware based security but this 
    can get expensive as the number of users increases and many such packages
    are not able to run much past 9600 bps.

    The planned environment will be DOS, OS/2, and UNIX clients running simple
    terminal emulation packages (ANSI or VT100 emulators) calling into a 
    central RISC System/6000 server using V32bis and V42bis modems.  In the 
    future we'll probably want to increase the line speed and might want to 
    move to X using SLIP or some faster IP transport over serial lines.

    Does anyone know of terminal emulators that can support encryption or 
    separate software encryption packages suitable to be grafted onto the 
    backed of a terminal emulator?  Public domain would be nice but we'll 
    look at commercial products as well.  Any non-hardware solution might 
    be interesting.  Thanks,

                         --jrh
-- 

James R. Hamilton                               inet: jrh@jrh.gts.org
telephone: +1 416 493 4162                      uunet: ...!uunet!jrh!jrh
Toronto, Canada                                 work: jrh@torolab.vnet.ibm.com
Newsgroups: comp.security.misc
Newsgroups: comp.security.misc
Subject: Re: CERT and the Dept. of Justice on keystroke monitoring
From: lindstrom@acs.harding.edu
Date: 14 Dec 92 13:30:29 -0500
Reply-To: lindstrom@acs.harding.edu
Organization: Harding University

In article <Bz9DB1.LHq@avalon.nwc.navy.mil>, jd@parcival.nwc.navy.mil (John de la Garrigue) writes:
>In article 3491@nic.csu.net, oleg@gd.cs.csufresno.edu () writes:
>>In article <q50qgdg@dixie.com> jgd@dixie.com (John De Armond) writes:
>>>strnlght@netcom.com (David Sternlight) writes:
>>>
>	<stuff about keystroke monitoring notice deleted>
>>
>>Huh? If I work for company X, X automatically has full rights to read
>>my mail or search my home? Or maybe only if it officially warns me
>>about this on it's front entrance? :). 
>>
>>Oleg
>
>No, and that's clearly not what the notice is saying.  If you work for company X,
>and use their equipment for whatever reason (notice many companies clearly state
>*anything* done using their equipment/software/other resources is their
>property, like it or no), the company has a right to make sure what you are doing
>is legal and ethical.  If you don't like this type of policy, the simple answer
>is to not use someone else' machine.

I agree. I run a small system for solar research and curious about the
problem here.  Our computer is for research use only. Period.  The work
all belongs to the school (as does the machine) and all of the users are
willing to be monitored.  This may be due to to a break-in a couple of
months ago where some files were erased (no biggie.. I had back-ups), but
I will take any action at my disposal to find out what is going on on this
machine [Q: Is running "w" to see who is on an invasion of your "rights"?]
and will drop every hammer I can find on an intruder.

As for the phone, it is also for business. Sure, I use it for personal
things (call my wife to find out what time to get home by) but if someone
is making personal long distance calls, that's taking money from our
already small budget and I want to know.

Now I'm not for a police state, but it seems to me that those yelling
about their "rights" are overlooking their responsibilaties. I have read
alot about "they" (meaning the system, like me :-) should and should
not do...what about users? What standards should a system user be held
to, if any, and what measures should be allotted to insure compliance?

Looking forward to *YOUR* reply,
Greg-
Newsgroups: comp.security.misc
From: bobley@aplcenmp.apl.jhu.edu (Brett Bobley)
Subject: DES Encryption Info
Summary: Is DES encryption in the public domain?
Keywords: DES, encryption, security
Organization: Johns Hopkins Continuing Professional Programs
Date: Thu, 17 Dec 1992 13:13:35 GMT

Hello,
A friend of my is a programmer who uses Unisys' CTOS OS.  He
is interested in writing a security program that people can
use to encrypt sensitive (but not classified) files.

He would like to use DES encryption, but needs to get more
information about it.  Is the algorithm for DES in the public
domain, or do you need a license to use it in a piece of 
software?  Where can my friend obtain the actual specification
for DES ?  Is it available on the internet?

thanks,

Brett Bobley
Internet:  bobley@aplcenmp.apl.jhu.edu

Newsgroups: comp.security.misc,comp.org.eff.talk,alt.society.civil-liberty
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: CERT and the Dept. of Justice on keystr
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Tue, 15 Dec 1992 22:23:34 GMT

In article <1992Dec12.043113.24232@lambda.msfc.nasa.gov>, palmer@Trade_Zone (Paul (Cliffy) Palmer) writes:
>If while visiting a friend, I used his phone and he listened in on the
>conversation, I would not feel that my rights had been violated.  I
>would think him very rude and would not use his phone again.

1) The "friend" in the case of the advisory is U.S. government - the
advisory was targetted to federal agencies.  For this reason, I think
the people have a right to say something about it.

2) Worker's rights are involved - the "consent" hardly is voluntary
consent when the computer system is required for one's work.  If a
public access system set up by John Doe with his own money had such a
login message, it would be more like the case you describe

3) I think privacy rights exist to some degree even when someone else
owns the "area" - though some limits set by the owner are acceptable.
For example, say Jill works for a software company, which has a policy
of letting the workers use the phone for private calls (within
reasonable limits), bill paid by the company.  In this situation I
think it is reasonable to expect that Jill's privacy is reduced at
least so that the company sees how much $ worth of calls Jill has
made, since the company pays the bill.  But it is unreasonable, ie. an
unacceptable invasion of privacy (both Jill's and the persons' Jill is
calling) for the company to listen/tape Jill's calls.

>I have a hard time understanding how guests can make demands of their
>hosts.

This was not the issue here.

>that it is our right. ie. the "legal right" to:
>	- drive a car
>	- come and go as we please
>	- drink alcohol

Howver, I do think these all are rights, when rights of other are not
infringed.

//Jyrki
From: smee@bristol.ac.uk (Paul Smee)
Newsgroups: comp.security.misc
Subject: Re: New "official" motd
Date: 16 Dec 92 10:31:21 GMT
Reply-To: P.Smee@bristol.ac.uk (Paul Smee)
Organization: University of Bristol

In article <1992Dec14.164652.13388@cc.ic.ac.uk> cmaae47@imperial.ac.uk writes:
>But maybe you display the notice BEFORE people log in, as we do here, viz:
>
>====================================================
>IRIX System V.3 (cscmgb)
>
>Imperial College of Science, Technology and Medicine
>
>          Centre for Computing Services
>
>    This computer system is operated on behalf of
>                 Imperial College
>
>Only authorised users are entitled to connect and/or 
>log in to this computing system. If you are not sure 
>  whether you are authorized, then you are not and 
>          should DISCONNECT IMMEDIATELY.
>
>====================================================
>
>It also comes out for ftp connects, and is meant to rob hackers of the
>excuse that they saw a "welcome to the xxxx system" and therefore assumed 
>they were authorised to use it.

We thought about this idea, then rejected it.  I favoured such a
banner, but our management glommed it on grounds that we've got a lot
of networked machines that cannot be made to display such messages, and
a lot of contexts (e.g. NFS exports) where you can't inject such a
message.  Their fear was that if, say 50% of machines/contexts put out
such a message, that might (in legal terms) allow crackers to 'assume'
that the unposted machines were explicitly fair game -- after all, if
they weren't fair game, they'd have put out a warning as well.  Anyone
know what the actual legal position is here?  (UK legal position most
useful, but others would be interesting.)

-- 
Paul Smee, Computing Service, University of Bristol, Bristol BS8 1UD, UK
 P.Smee@bristol.ac.uk - ..!uunet!uknet!bsmail!p.smee - Tel +44 272 303132
From: faigin@aero.org (Daniel P. Faigin)
Newsgroups: comp.security.misc
Subject: Re: Security Levels
Date: 15 Dec 92 07:51:48
Organization: The Aerospace Corporation, El Segundo, CA
Distribution: usa
NNTP-Posting-Host: soldan.aero.org
In-reply-to: jpw@lorelei.ece.drexel.edu's message of 14 Dec 92 23:22:20 GMT

On 14 Dec 92 23:22:20 GMT, jpw@lorelei.ece.drexel.edu (Joseph Wetstein) said:

> Could somebody be kind enough to post (or mail) the definitions (with
> examples, in clear english) of the NSCS security levels/criteria,
> i.e. D, C1, C2, B1, ... etc.

Unfortunately, if we had clear English, our job of evaluating to those levels
would be much easier!

In any case, let me try a summary. These funny digraphs (C2, etc.) are ratings
of commercial products that are evaluated by an *unclassified* branch of the
NSA, the Trusted Product Evaluation Program, with help from some Federal
Contract Research Centers: Mitre, IDA, and Aerospace. The digraphs specify a
particular level of security functionality and assurance in a product.

D is for products that have no security functionality

The C division is for products with discretionary protection (like Unix access
control ONLY) C1 really isn't used: it has minimal functionality. C2 provides
audit, discrationary controls, object reuse, and identification and
authentication. Assurance is primarily through testing.

The B division adds mandatory labels (UNCLASSIFIED, etc.) to the DAC
protection. B1 is basically C2 with training wheels. B2 increases assurance by
requiring the code to be highly modular; B3 increases the assurance by
requiring minimal kernels, and formal models.

The A division adds formal verification to the mix

> If there are any gov't publications available, how would I get them?

A good synopsis of the digraphs can be found in Debby Russell's book "Computer
Security Basics" from O'Reilly Press. You can also obtain the relevant NSA
publications:

To order them, call
301.766.8729 or 301.688.8742 or write:

  Department of Defense
  National Security Agency
  ATTN: S332
  9800 Savage Road
  Ft George G. Meade, MD 20755-6000

Daniel Faigin
Chair, ACM/SIGSAC



> -- 
> Joseph P. Wetstein                  __|__          "I may be Captain by
> jpw@coe.drexel.edu              ---o-(_)-o---       rank, but I never wanted
>                                                     to be anything else but 
> KA3VJY						    an engineer" - Scotty
--
[W]:The Aerospace Corp. M1/055 * POB 92957 * LA, CA 90009-2957 * 310/336-8228
[Email]:faigin@aerospace.aero.org              [Vmail]:310/336-5454 Box#13149
		    "And as they say, the rest is compost"
From: oleg@gd.cs.csufresno.edu
Newsgroups: comp.security.misc
Subject: Re: CERT and the Dept. of Justice on keystroke monitoring
Date: 15 Dec 92 01:25:16 GMT
Organization: Computer Science Departement of California State University in Fresno

In article <Bz9DB1.LHq@avalon.nwc.navy.mil> jd@parcival.nwc.navy.mil writes:
>In article 3491@nic.csu.net, oleg@gd.cs.csufresno.edu () writes:
>>In article <q50qgdg@dixie.com> jgd@dixie.com (John De Armond) writes:
>>>strnlght@netcom.com (David Sternlight) writes:
>>>
>	<stuff about keystroke monitoring notice deleted>
>>
>>Huh? If I work for company X, X automatically has full rights to read
>>my mail or search my home? Or maybe only if it officially warns me
>>about this on it's front entrance? :). 
>>
>>Oleg
>
>No, and that's clearly not what the notice is saying.  If you work for company X,
>and use their equipment for whatever reason (notice many companies clearly state
>*anything* done using their equipment/software/other resources is their
>property, like it or no), the company has a right to make sure what you are doing
>is legal and ethical.  If you don't like this type of policy, the simple answer
>is to not use someone else's machine.
>

Do traceroute to my host and think how fun a life would be if an owner of each
gateway would capure our packets to ensure that out use of Internet is legal and
ethical.

Oleg
From: M.Gream@uts.EDU.AU (Matthew Gream)
Newsgroups: comp.security.misc
Subject: Re: CERT and the Dept. of Justice on keystr
Date: 16 Dec 1992 10:41:54 GMT
Organization: University of Technology, Sydney
NNTP-Posting-Host: acacia.ccsd.uts.edu.au
X-Newsreader: TIN [version 1.1 PL8]

Paul (Cliffy) Palmer (palmer@Trade_Zone.msfc.nasa.gov) wrote:

: Possibly another helpful analogy to understanding the issue of keystroke
: monitoring is the steps taken by department stores against shoplifters in
: the U.S. (and possibly elsewhere).

: -  Detectors at the exits might be considered as a selective form of
: auditing.  When they go off, they trigger the activity of the
: appropriate security officers, who usually attempt to handle the
: situation politely and discreetly.  They will monitor you until they
: can determine whether you have actually tried to do something illegal.
: Sometimes false alarms do occur and the unfortunate (and usually
: embarrassed) individual is briefly monitored while they demonstrate
: their innocence.

: -  Some stores that have a high incidence of shoplifting occuring
: within the dressing rooms post observers to monitor the dressing rooms
: themselves.  Everyone is scrutinized...the observer pays special
: attention to what goes into the dressing room and what comes out  (this
: may be a little embarassing to the man trying on woman's underwear, but
: he can always shop elsewhere :-) This could be analogous to monitoring
: file activity for sensitive files.

: -  Most stores employ special security officers who patrol the store
: looking for suspicious activity.  Everyone is scrutinized to some
: degree, but the trained officer can generally spot the individuals who
: warrant closer scrutiny.  If he judges that a crime may have taken
: place, he can request that the individual subject their belongings to
: examination and if they refuse he can detain them until the legal
: authorities can be summoned (who will examine their belongings!)  This
: is roughly analogous to keystroke monitoring, when performed
: ethically.

 In all these cases, they do not look through your most personal 
belongings, (unlike capturing your keystrokes). In Australia, at least,
it is policy (though by legislation or a code of ethics developed
by the retail industry, im not sure), that your _personal_ belongings 
cannot be searched (ie, handbags ).
 Im sure that there are other ways to monitor suspicious activity
before resorting to keystroke monitoring of _everyone_'s activities,
and then with sufficient evidence start keystroke monitoring, but even
this should be selective in what it captures.
 If the police know that a burglar lives in your block of flats, they
can watch and monitor to their hearts content, but they _cannot_ intrude
on you unless they have evidence. No matter whether you own  your flat
or you are renting it from the government or you are living on social
benefits from the government.


Matthew.
--  ___
  Matthew Gream - rfc822-mail: M.Gream@uts.EDU.AU
    ---
Newsgroups: comp.security.misc
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: CERT and the Dept. of Justice on keystroke monitoring
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Tue, 15 Dec 1992 22:26:36 GMT

In article <Bz9DB1.LHq@avalon.nwc.navy.mil>, jd@parcival (John de la Garrigue) writes:
>No, and that's clearly not what the notice is saying.  If you work for company X,
>and use their equipment for whatever reason (notice many companies clearly state
>*anything* done using their equipment/software/other resources is their
>property, like it or no), the company has a right to make sure what you are doing
>is legal and ethical.

The notice didn't say anything about companies, was not targetted at
companies and has nothing to do with companies.  It was for U.S.
federal agencies.

//Jyrki
Newsgroups: comp.security.misc
From: vulture@imperial.ac.uk (Thomas Sippel - Dau)
Subject: Re: Hiding Unix processes?
Keywords: zsh hide mask processes
Reply-To: cmaae47@imperial.ac.uk
Organization: Imperial College of Science, Technology and Medicine
Date: Mon, 14 Dec 92 18:26:51 GMT

In article <1992Dec11.121346.24892@Princeton.EDU>, grweiss@phoenix.Princeton.EDU (Gregory Robert Weiss) writes:
- >In article <1g42e5INNoac@darkstar.UCSC.EDU>, speth@cats.ucsc.edu (James Gustave) writes:

- >   Is there a way to mask all of your running processes, similar to what the
- > execl command can do for a single process?  I don't really like having
- > everyone be able to see what I'm doing all the time.
- >   I'm running SunOS Release 4.1.1, and I don't have root privs.
.....
- Don't write your own shell!  Use zsh, a really fine shell combining the (IMHO)
- best features of tcsh, and ksh.  In zsh, you can hide the command-line
- arguments like the following:
- 
- zsh% ARGV0="Hey, stop snooping!" program
- 
- This can be made into an alias like so:
- 
- zsh% alias hide='ARGV0="None of your business.                               "'

While this may work under SunOS, it does not work (afaik) under IRIX, where 
the mechanism of storing command arguments is different. No, I fear tho only
foolproof method is:

        Buy your own unix system and don't give out logins to it.

:-) :-) :-(                           Thomas

-- 
*** This is the operative statement, all previous statements are inoperative.
*   email: cmaae47 @ ic.ac.uk (Thomas Sippel - Dau) (uk.ac.ic on Janet)
*   voice: +44 71 589 5111 x4937 or 4934 (day), or +44 71 823 9497 (fax)
*   snail: Imperial College of Science, Technology and Medicine
*   The Center for Computing Services, Kensington SW7 2BX, Great Britain
Newsgroups: comp.security.misc,comp.org.eff.talk
From: hansen@scr.slb.com (Ove Hansen)
Subject: Re: Fun things to do to RTM (was: Internet worm)
Organization: Schlumberger Cambridge Research Limited, England
Date: Mon, 14 Dec 92 17:52:34 GMT

In article <1992Dec14.093350.15979@glas.rtsg.mot.com> waider@glas.rtsg.mot.com (Ronan Waide) writes:
>mccall@mksol.dseg.ti.com (fred j mccall 575-3539) writes:
>
>>Ok, one more time.  Look, dipshit, in case you're too stupid to figure
>>it out, 

[MORE GARBAGE DELETED] 

>>Sorry your head is so far up your ass that you can't bear to hear
>>any opinions that differ with your own.  Perhaps you'll grow up one
>>day and we can talk then.
>
>Uh, pot, kettle, black, anyone? Mr. McCall [using his own tactic of addressing
>the net instead of his antagonists] seems to be compelled to shout loudly
>(sometimes even in *capital letters*!!) at anyone who sees holes in his
>arguments or bothers to disagree with him.
>
>Cool it, Fred. You're starting to look paranoid.
>

This is getting boring. Did somebody mention `grow up' somewhere...? Too
bad we have to waste bandwidth and time on this. 


-- 
----------------------------------------------------------------------------
Ove Hansen                               e-mail : hansen@scr.slb.com   
Schlumberger Cambridge Research          Tel/fax: 0223-325246 / 0223-315486
P.O.Box 153, Cambridge CB3 0HG, England  (International prefix for UK: 44)
Newsgroups: comp.security.misc,comp.org.eff.talk