|
This file is available on a Cryptome DVD offered by Cryptome. Donate $25 for a DVD of the Cryptome 10-year archives of 35,000 files from June 1996 to June 2006 (~3.5 GB). Click Paypal or mail check/MO made out to John Young, 251 West 89th Street, New York, NY 10024. Archives include all files of cryptome.org, cryptome2.org, jya.com, cartome.org, eyeball-series.org and iraq-kill-maim.org. Cryptome offers with the Cryptome DVD an INSCOM DVD of about 18,000 pages of counter-intelligence dossiers declassified by the US Army Information and Security Command, dating from 1945 to 1985. No additional contribution required -- $25 for both. The DVDs will be sent anywhere worldwide without extra cost. | |||
1 March 2000
Date: Wed, 01 Mar 2000 16:12:10 -0500
To: politech@vorlon.mit.edu
From: Declan McCullagh <declan@well.com>
Subject: FC: I-Gear blocking software blacklist cracked and available online
Date: Wed, 1 Mar 2000 15:05:04 -0600
From: bennett@peacefire.org
Subject: I-Gear list cracked; privacy violations and error rate
One week after our report on the decryption of X-Stop's blocked site list, Peacefire has released a program that can decrypt the list of 437,000 sites blocked by I-Gear, another "censorware" program now owned by Symantec. The codebreaker program can be downloaded from:
http://peacefire.org/censorware/I-Gear/igdecode/
(This page also has instructions on how to obtain I-Gear's encrypted list without having to download and install I-Gear.)
We performed an experiment similar to our X-Stop test: we extracted student pages in the ".edu" domain that were blocked in the "Sex/Acts" category, looked at the first 50 URL's that were still working, and found that 76% of the blocked pages were obviously errors! This sounds ridiculously high, but I saw the blocked pages myself, otherwise I wouldn't believe it. The list of 50 examined sites is at:
http://peacefire.org/censorware/I-Gear/igear-blocked-edu.html
We also discovered that when you install I-Gear, it scans in your real name and company name from your computer and uploads this information to Symantec. Not the "real name" that you give the program during the registration process -- your actual real name that you used to register your copy of Windows. (This is the name that shows up on the "General" tab of the System applet in Control Panel.) Symantec's privacy policy, on the other hand, states:
http://www.symantec.com/legal/privacy.html"The choice of how much personally identifiable information you disclose to Symantec is completely at your discretion."
Again, we believe these discoveries will bear on the ongoing debate over the Digital Millennium Copyright Act, UCITA (the law strengthening the force of draconian "license agreements" that prohibit users from examining products by reverse engineering) and the DVD codebreaking court cases. Reverse engineering I-Gear and decrypting the list was the *only* way to obtain a reliable figure for the error rate of their product, rather than just coming up with a list of blocked sites. Even the discovery that I-Gear retrieves and uploads your real name to the manufacturer, was discovered through reverse engineering. If such reverse engineering becomes illegal, it will become very difficult for third parties to criticize software in general, other than the user interface and other aspects that are visible without "looking under the hood".
-Bennett
bennett@peacefire.org
http://www.peacefire.org
(425) 649 9024
--------------------------------------------------------------------------
POLITECH -- the moderated mailing list of politics and technology
To subscribe: send a message to majordomo@vorlon.mit.edu with this text:
subscribe politech
More information is at
http://www.well.com/~declan/politech/
--------------------------------------------------------------------------