October 2000 - cypherpunks-legacy

Request for Web Browser Information
by dstoler＠globalpac.com 17 Dec '03

17 Dec '03

I would like to know the information my browser makes available to web sites. I use both Netscape and Internet Explorer. Obviously web sites can determine my IP address for any given session; they can also look at cookies left by themselves and other sites. Can anyone point me to where I can learn exactly what other information is made available (browser version?, OS version?, system name?, user name?, etc.)? Thanks in advance. David

2 1

Re: CHAUM CHIMES IN
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

>Date: 08 Sep 93 16:30:55 EDT >From: Sandy <72114.1712(a)CompuServe.COM> >Subject: CHAUM CHIMES IN >Message-Id: <930908203054_72114.1712_FHF95-2(a)CompuServe.COM> ..From: > SANDY SANDFORT Reply to: ssandfort(a)attmail.com [ . . . ] >Of course, the next letter to the editor calls for the adoption >of systems to track every vehicle at all times. The genius who >wrote the letter, thinks it would be a good way to prevent >nuclear, biological or chemical terrorism. Geeeeez. It was signed by Dorothy Denning, right? Actually, they should take that to its full conclusion. We need implants in every individual, broadcasting to the local surveillance agency, giving not only location but also every word spoken in the vicinity. It could also do a chemical analysis of the air in the neighborhood. It should also have a radiation counter. It should also monitor the host body, looking for signs of anger or sexual arousal? How else will we be guaranteed safe from mad bombers, rapists and child molesters? How else will our big budget LE agencies be able to protect us? I know. When it's finally adopted, worldwide, they'll call it the Ellison Plan. :-( - Carl

2 1

Stegno and DAT and digital music...
by Peter Wayner 17 Dec '03

17 Dec '03

In this week's Sunday NYT, Hans Fantel, their music guy, writes at length about the new "dithered" CD's and how the guys have improved the sound. He says that the original CD format was limited to 16 bits of sound because of costs. But many audiophiles reacted very negatively to the tinny, metalic quality to the music. For this reason, the companies have developed 20 bit DAT recording tape and then come up with ways to "dither" this into 16 bits. I am curious if anyone knows the details of these algorithms. Also, his point suggests that flipping the least significant bit of 16 bit music may not be imperceptable to some ears. If the classical music starts to sound tinny then there might be something subversive in the least significant bits. -Peter Wayner

2 1

Remail: errors
by HFinney＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have been out of town for the last week, so I missed some CP mail. It looks like some good things are happening with remailers, though. Kudos to Karl, Sameer, and the others for their work! I have received many messages to my remailer in the last week which came from remail(a)tamsun.tamu.edu, which were PGP-encrypted apparently in an effort to get my remailer to send them. They did not work, though, because there was no "Encrypted: PGP" header to trigger the remailer's decryption. This can be arranged by creating the message something like this: ======================================================== :: Request-Remailing-To: hfinney(a)shell.portal.com :: Encrypted: PGP - -----BEGIN PGP MESSAGE----- <rest of message> - -----END PGP MESSAGE------ ======================================================== This would then be sent to remail(a)tamsun.tamu.edu. I don't know whether the multiplicity of such erroneous messages is just due to one person stubbornly re-trying, or whether there is an error in one of the new programs for creating chained remailer messages. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLJaNuKgTA69YIUw3AQHrNwQAowMEQwuH6YyHoj6T7AqZFLNdTf+eqJ9L LhAatHS94nmC1smkfVNq0dZmigmkvBdMNEPlBZemmxALz+KJw6OSY/ULSBmuVNEq 5rJANh3XimoJWqLISy2lZiuC5Fw2R7UvRadcdM94pncSVvev92Fyf7CqEOOtrGAK PUzRds7BVNo= =FpLa -----END PGP SIGNATURE-----

2 1

more than spread spectrum
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

There are alternatives to spread spectrum, if we're threatened with loss of freedom to communicate. We could lay our own wires/fibers. We could set up a mesh network of infrared lasers through the air. Last time I looked, there were no laws against shining lights out your window as long as they didn't bother anyone. An infrared laser could hardly bother anyone. We could produce a line of cheap cards to plug into a PC which would do packet routing, using a variety of physical links -- our own wires, lasers, very low range radio, .... Each card would connect to three or more neighbors and become part of the global mesh. Adaptive routing with no global map would suffice for the card and would keep the whole system peer-to-peer with no need for central control and no chance for central tapping. Of course all of these solutions require a high density of users. A college campus might be the right place to start. We could then branch out to cities. I suspect that a place like Chicago or NYC with high rise apartments might be the place to start -- many options for line-of-sight communications. The benefit isn't just for Cypherpunks. It's a free network for the masses -- like the original USENET (with each user donating routing and store/forward) but with unrestricted, low-range, continuously operating physical links. I'll volunteer to do the software for the node card. Does anyone have hardware design/fab to donate to the effort? - Carl

4 3

None
by Anonymous 17 Dec '03

17 Dec '03

2 1

Colorado Cypherpunks meeting
by nates＠netcom.com 17 Dec '03

17 Dec '03

2 1

Welcome to cypherwonks
by Majordomo＠Lists.EUnet.fi 17 Dec '03

17 Dec '03

Welcome to the cypherwonks mailing list! If you ever want to remove yourself from this mailing list, send the following command in email to "Majordomo(a)Lists.EUnet.fi": unsubscribe cypherwonks Stanton McCandlish <mech(a)eff.org> Here's the general information for the list you've subscribed to, in case you don't already have it: This is the Cypherwonks mailing list Below is The Cypherwonk Charter, by L. Detweiler, Cypherwonk Janitor The cypherwonks are a splinter group from the cypherpunks also interested in promoting and implementing cryptographic technology. However, we have unique ideas on how to successfully implement these radical new capabilities to ensure privacy without encouraging criminal behaviors like forgery and `online predation'. We are also interested in a far more ambitious goal of `technological progress' that transcends a mere obsession with privacy and anonymity. The cypherwonks believe that many aspects of a identification and government are necessary and crucial for any social stability (particularly related to judicial and law enforcement systems), and are quite alarmed at talk about a `cryptoanarchy' resulting from the mere implementation of software protocols -- although we realize that radical new forms of government may appear with these new technologies, embodied in one term `Electronic Democracy'. We believe that while sometimes the `majority' can become a `tyranny', in general the idea of voting as a civilized way of resolving proposals and `one person, one vote' are sacred, and we are interested in implementing systems that promote interaction and collaboration among motivated and enthusiastic members, whether within the cypherwonk organization or within their nations (cypherwonks, of course, try to think free of local prejudices, and globally). Cypherwonks understand that *trust* and *honesty* are inherent in all human endeavors, *particularly* communication. We recognize that people trust others not to reveal our private email unless given permission, we trust others not to use information from our mail or about their identities to adverse aims, we trust that systems delivering mail will not be corrupted by criminals, or if they get caught there will be serious consequences, and many other explicit and implicit variations. We know that there are many ingenious ways of minimizing the amount of trust required in unknown components such as with the use of cryptography or pseudonyms, and we seek passionately to invent and use them, but at the root level, email is an exchange between human beings who trust each other. Therefore, we hold a sense of ethics and morality in strong reverence, and even though we're not always precisely sure what they entail, we know that they exist and we strive for the right ideal. We abhor the idea that `it's not wrong if you can get away with it' or other variations of moral relativism. Cypherwonks are also extremely interested in promoting and implementing `digital cash', but believe that while invariably the state's taxes tend to become burdensome, few civilized, technological societies are free of them, and certainly we do not advocate tax evasion, `black marketeering', or any other subversive or illegal activities through cryptographic techniques, and even beyond this we seek design protocols that discourage these subversive aims in general, because of their toxic, fragmentary effect on social unity. Cypherwonks recognize that our mailing list is extremely critical in coordinating our movement and our fellow members. It is our central nervous system. While the list is informal, we demand a professional atmosphere, and will privately object to people who are publicly rude or belligerent. But we are also extremely careful about what we say to each other in private, because people can be extremely influenced by what they receive in mail. We would be aghast and horrified to find that somebody viciously criticized someone in private mail based on public postings, for example. We place high value on being courteous to each other and minimizing disagreement where possible, forging consensus, and the art of diplomacy in surmounting political barriers. We trust each other on the list and in personal email. We wish to have an open, uplifting, inspiring, honest, representative, polite, respectful, egalitarian dialogue. We will never use the mailing list for personal or selfish reasons -- we strive to serve our fellow cypherwonks through our postings. We are what we claim to be. We abhor secrecy, `security through obscurity', and conspirational cliques. Cypherwonks are extremely interested in promoting some forms of anonymity. However, we do not necessarily believe that others are required to read anonymous postings. To the contrary, we believe that the individual should have the tools and freedom to filter his or her own mail based on real identities. In particular, we condemn the practice of `pseudospoofing,' the dangerous deception where a person builds up a pseudonym and misrepresents it as being that of a real person's identity. We police each other on the list to prevent it, and require a promise that our members refrain from it. While our trust can be betrayed, only those that are honest are true cypherwonks, and anyone who betrays our trust we consider a dishonist hypocrite, or worse, a tra *itor. Cypherwonks are extremely interested in building tangible systems. Engineers who love to discuss the nitty-gritty details of some scheme are at home on the cypherwonks list. We like to impress each other with our knowledge but at the same time state it in relevant and humble terms. We are not trying to win popularity contests with our postings. We are trying to accomplish ambitious endeavors. We are especially ecstatic to make connections with other cypherwonks interested in the same projects we are, and cooperating to build useful tools. We like to give status reports of our intermittent real-world meetings and

2 1

moderated cryptography list
by pmetzger＠lehman.com 17 Dec '03

17 Dec '03

Hello, all. I'm looking for a site willing to host a high-quality moderated cryptography mailing list which I am thinking of starting up. The list would be designed as a low volume, high readership, high quality source for 1) In-depth technical discussions of cryptography 2) Announcements of cryptographic products 3) Announcements of news items of interest to the cryptography community. 4) VERY limited numbers of postings on the social implications of cryptography, and I mean VERY limited. All postings would be explicitly approved by the moderator before going out to assure quality. Yes, that means fascistic restriction of your capacity for free speech, in exchange for not being overwhelmed with garbage every day. It is ultimately envisioned that should the list be a success I would try to move it to a moderated Usenet newsgroup. If you think that such a list is a Good Thing, and you can host it (which requires that you have a good internet connection and root access or similar on the machine in question), please let me know. I'll do all the work, and the crypto community will thank you tremendously. Perry Metzger

2 1

Re: Anarchy Gone Awry (fwd)
by Black Unicorn 17 Dec '03

17 Dec '03

This post is a perfect example why the two lists should be kept seperate and not merged. This sounds to me like it belongs on alt.politics.data- highway. -uni- (dark)

2 1

CDR: RE: Re: Anonymous Remailers cpunk
by Trei, Peter 09 Jan '01

09 Jan '01

> ---------- > From: Jim Choate[SMTP:ravage@einstein.ssz.com] > Reply To: Jim Choate > Sent: Thursday, October 12, 2000 7:09 PM > To: cypherpunks(a)einstein.ssz.com > Subject: CDR: Re: Anonymous Remailers cpunk > > > On Tue, 3 Oct 2000, Steve Furlong wrote: > > > <<Proposal to limit spam sent through anon remailers by requiring that > > the traffic be encrypted>> > > > Perhaps we're talking at cross purposes. This subthread came along > > because some people have noticed that anonymous remailers are used for > > an awful lot of spam. Peter Trei proposed that remailers could pass > > along only encrypted mail. My understanding was that Alice, the > > message's author, would encrypt the message with Bob's public key; Bob > > is the end recipient: a person or a mailing list or whatever. Alice > > would send the message through Ramona, the anonymous remailer. Ramona is > > requiring that messages be encrypted as a means of filtering out spam. > > Ramona does not need to know Bob's public or private keys; Ramona cares > > only that the message is encrypted. > > So? I set up a email address that I offer to the spammers to sign up to > the anonymous remailers and then it proxies their email into the encrypted > network. I figure this baby'll stop'em for about six months. > Jim: A spammer (or your spammer's proxy) is not going to individually encrypt messages to thousands or millions of end-recipients, each with their own public key - the time factor makes this uneconomical, and the hassle factor of finding all the recipient public keys makes it impractical. Thus, only remailers which send out plaintext are useful to spammers as exit remailers. It is only exit remailers (ie, the remailer which sends to the final recipient) which get hassled for sending spam. The goal is to make remailer operators life easier by preventing them from being used to spam random lusers, who may initiate complaints against the remailer operator. It is not to prevent spam passing through a remailer somewhere in mid-cloud. While such encrypted spam will increase the volume of traffic, for most remailers that is a Good Thing - more material to confuse the traffic analysis. As long as it gets dropped before leaving the remailer network, no harm is done. Steve understands this, as does every one else but you. What's the problem? > For it to really stop spam it would need to be well distributed. So how do > you offset the increased sys admin issues this raises? > Any remailer operator can decide not to pass along plaintext. So long as the message sender is aware of this property, nothing more needs to be distributed. There are no increased sysadmin issues. > Then there is the old key management problem. > > James Choate > No, there is not, beyond the fact that the message originator must know the final recipient's public key. Jim, do you really understand how remailer chaining works? Peter Trei > Vizzini: HE DIDN'T FALL? INCONCEIVABLE! > Inigo Montoya: You keep using that word. I do not think it means what you > think it means. > - The Princess Bride > > >

7 9

CDR: Complete Guidebook and Workplace Violence Prevention Video series
by WBNixon＠aol.com 22 Nov '00

22 Nov '00

Good Morning! I am Barry Nixon, Executive Director, The National Institute for the Prevention of Workplace Violence and am creating a workplace violence superstore on line with the intent to have a wide array of workplace violence prevention products for sale. Your video series would be an excellent addition to the online superstore so could you please send me information about the steps necessary to make this happen. I can be contacted via email at WBNixon(a)AOL.com, telephone at 949-770-5264 and fax 949-597-0977.

3 2

CDR: re:Tim May's anti-semitic rants
by auto9950013＠hushmail.com 06 Nov '00

06 Nov '00

Tim's anti Jewish sentiments are obvious in his current posts and in the past. If he had any guts he would admit what he really feels instead of using sarcasm and obfuscation. Tim May writes >Nowhere in my article did I mention Jews or Judaism.

8 11

CDR: why should it be trusted?
by Jordan Dimov 05 Nov '00

05 Nov '00

I don't know much about crypto politics, but... isn't it utterly obvious that the mere fact that the NSA suggest a certain algorithm (say Rijndael) for a national standard and recomends its use internationally imply that they have a pretty darn good idea (if not actual technology) on how to break it efficiently? I just don't see why else they would advocate its use. After all isn't the fact that NSA could break DES since the 70's the reason for the 'success' of DES?

29 147

CDR: Zero Knowledge changes business model (press release)
by Declan McCullagh 03 Nov '00

03 Nov '00

>From: kcory(a)redwhistle.com >To: declan(a)well.com >Date: Tue, 31 Oct 2000 06:55:11 -0800 >Subject: Zero-Knowledge Introduces Managed Privacy Services for Businesses > > > >Hi Declan, >Today, Zero-Knowledge Systems is introducing its Managed Privacy >Services (MPS) offering to solve the privacy challenges >that businesses face in today's privacy-conscious business >environment. > >Privacy is good business. Companies in every industry are >realizing they must institute the proper privacy policies, >practices and infrastructures in order to succeed in >today's digital economy. Zero-Knowledge Managed Privacy >Services provides the tools and strategies that enable >business to establish private customer relationships and >earn consumer trust while ensuring legislative compliance >and mitigating risk. > >As companies have become aware of the privacy risks and >legislative hurdles facing them, many have turned to Zero- >Knowledge for advice and solutions, and the MPS offering is >the natural response to companies' needs for comprehensive >privacy solutions. > >I've included the press release about MPS below. If you >have any questions about Zero-Knowledge's Managed Privacy >Services offering or would like to set up a conversation >with Zero-Knowledge President Austin Hill, please give me a >call at 503-552-3749. > >Best regards, >Kristy Cory >503-552-3749 > >ZERO-KNOWLEDGE SYSTEMS INTRODUCES MANAGED PRIVACY SERVICES >TO SOLVE THE PRIVACY CHALLENGES OF BUSINESSES > > >Montreal -- October 31, 2000 -- Zero-Knowledge(R) Systems, >the leading developer of privacy solutions, today >introduced its new Managed Privacy Services(TM) offering to >solve the privacy challenges of businesses and enable >enterprise to thrive in a privacy-conscious climate. >Delivering a unique combination of technology, policy and >strategy expertise, Zero-Knowledge Managed Privacy Services >(MPS) enables clients to turn privacy into a competitive >advantage by leveraging rich data resources while building >stronger and more profitable relationships with customers, >employees and partners. MPS is based on responsible and >ethical information management in accordance with relevant >legislation and industry standards. > >"Privacy is good business -- and Zero-Knowledge Systems is >the company that can deliver continued privacy value to >companies that want to succeed in today's digital economy," >said Austin Hill, president of Zero-Knowledge >Systems. "Through expert professional services and >technological solutions, Zero-Knowledge Systems works with >companies to leverage and develop the rich data resources >they need, while ensuring that their customers' personal >information will not be abused, misused or sold without >their permission." > >Employing a broad toolkit of privacy-enhancing technologies >that control and protect data, MPS brings privacy-based >services to a variety of markets for the first time. These >include: financial services, health care, wireless, >marketing, CRM and hosted solutions (ASPs). > >The Managed Privacy Services Process >Zero-Knowledge MPS fuses sophisticated infrastructure >design, advanced cryptographic systems and world-class >privacy expertise to deliver strong privacy integration to >a wide variety of business processes and system designs. >Following a period of assessment and design, MPS culminates >in the deployment of a tailored privacy layer that >integrates seamlessly with the client's existing enterprise >applications. > >* ASSESS AND ADVISE -- Managed Privacy Services begins with >a thorough assessment of each client's data storage and >usage patterns, as well as their business objectives. From >this assessment, recommendations are made regarding areas >where data can be better utilized through the addition of a >strong privacy layer, and areas of potential privacy risk >are identified. > >* DESIGN AND IMPLEMENT -- The assessment stage provides the >framework for all aspects of the infrastructure design, and >determines which Zero-Knowledge privacy technologies are >best suited to the client's needs. The result is a solution >that not only secures and protects the client's data, but >also allows for a wider array of data-driven activities. >Professional systems integration ensures that all the >client's business requirements are met, and guarantees the >final design will result in the most robust and flexible >system possible. > >* VERIFY AND MANAGE -- Zero-Knowledge is able to manage all >elements of the privacy infrastructure, allowing clients to >focus on their core competencies, and providing third-party >credibility to a client's privacy initiatives. Independent >audits ensure that the system deployed is in compliance >with stated policies, and that all controls are functioning >as per the design specifications. > >Zero-Knowledge is committed to deploying systems that are >transparent and accountable. In keeping with this policy, >MPS will incorporate third party verification and split >encryption key structures, as well as provide consumers >with access to white papers, independent auditors' reports >or other materials that assure a company is doing what it >claims. With MPS Zero-Knowledge strengthens its commitment >to building responsible systems that empower consumers to >control the disclosure and use of their personal >information, while still enabling businesses to thrive in a >data and relationship-driven marketplace. > >Zero-Knowledge Systems Leads Privacy Education >Zero-Knowledge Systems is also presenting the "Privacy by >Design: The Future of Privacy Compliance and Business" >conference sponsored by Royal Bank Financial Group, IBM, >Merrill Lynch, and PricewaterhouseCoopers. Incorporating >the privacy expertise of leading business, technology and >privacy figures, Privacy by Design will advise attendees on >how to develop, execute and market a successful privacy >strategy that will avoid regulatory breaches and >differentiate their business in the marketplace with a >demonstrable commitment to privacy. The conference will be >held at Le Chateau Montebello, Quebec from November 19 to >21, 2000. For more information on Privacy by Design, >including a detailed agenda, visit the conference Web site: >http://www.zeroknowledge.com/privacybydesign.html > >About Zero-Knowledge Systems, Inc. >Founded in 1997, Zero-Knowledge Systems >(http://www.zeroknowledge.com) is laying the digital >infrastructure for privacy-enabled communications and >commerce between individuals, companies, governments and >organizations. Zero-Knowledge creates products and services >that enable privacy through advanced mathematics, >cryptography and source code: the only reliable way to >ensure privacy. > >In December 1999, Zero-Knowledge launched Freedom(R), the >only privacy system that empowers Internet users to surf >the Web, send email, chat and post to newsgroups in total >privacy without having to trust third parties with their >personal information. Freedom can be downloaded at >http://www.freedom.net and Freedom source code is available >at http://opensource.zeroknowledge.com. In October 2000, >Zero-Knowledge launched its Managed Privacy Services(TM) >offering to provide expert consultation and privacy- >enhancing solutions that enable businesses to comply with >privacy legislation, maximize customer relationships and >build consumer trust without violating privacy. More >information about MPS can be found at >http://www.zeroknowledge.com/business. > >Journalists can visit the Zero-Knowledge pressroom at >http://www.zeroknowledge.com/media. > > (Freedom, Zero-Knowledge and Managed Privacy Services are >registered trademarks of Zero-Knowledge Systems, Inc. All >other names may be trademarks of their respective owners.) > >For more information >Dov Smith >Director of Public Relations >514.350.7553 >dov(a)zeroknowledge.com > >Kristy Cory >Red Whistle Communications >503.552.3749 >kcory(a)redwhistle.com > > > > > >

14 40

CDR: California bars free speech of those cutting deals on votes
by Tim May 03 Nov '00

03 Nov '00

California has "shut down"--through a threatening letter--a site which matches up folks who are willing to say they'll vote for Nader in states where Gore is sure to win if other folks who had hoped to vote for Nader will instead vote for Gore in order to help him in swing states. (Sounds complicated. But it's really simple. "I'll scratch your back if you scratch mine." No money is changing hands, no actual "ballots" are being traded.) The Web site doing this is/was: http://www.voteswap2000.com/ The article on California's actions is: http://dailynews.yahoo.com/h/nm/20001031/wr/campaign_traders_dc_1.html BTW, I just "expressed my preference" at the site: http://Winchell.com/NaderTrader/default.asp No doubt I am even now more of a speech criminal. I wonder if a raid is imminent. --Tim May -- ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 831-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, "Cyphernomicon" | black markets, collapse of governments.

8 14

CDR: RE: Paranoid Encryption Standard (was Re: Rijndael & Hitachi)
by Carskadden, Rush 02 Nov '00

02 Nov '00

Are you guys still talking about the feasibility of a cipher that implements each AES candidate in turn with the same key? I don't really get this idea. Provided you were actually using the same key with each stage of the encryption, then your system is only gong to be as secure as the key of the first algorithm. In fact, it seems that if the key is compromised at any one point, then the entire system is shot, given that you know the algorithm (Kerckhoff's principle IIRC). Maybe I am misunderstanding. ok, Rush Carskadden -----Original Message----- From: Arnold G. Reinhold [mailto:reinhold@WORLD.STD.COM] Sent: Friday, October 27, 2000 12:29 PM To: Damien Miller Cc: John Kelsey; Bram Cohen; cryptography(a)c2.net; cypherpunks(a)cyberpass.net Subject: Re: Paranoid Encryption Standard (was Re: Rijndael & Hitachi) At 4:16 PM +1100 10/27/2000, Damien Miller wrote: >On Thu, 26 Oct 2000, Arnold G. Reinhold wrote: > >> simple way to combine the AES finalists and take advantage of all the >> testing that each has already undergone. And, IMHO, it is an >> interesting theoretical question as well. Even if the answer is >> "yes," I am not advocating that it be used in most common >> applications, e.g network security, because there are so many greater >> risks to be dealt with. But it might make sense in some narrow, high >> value, applications. > >What threat model do you propose that would require this? o Your opponent has the cryptologic capabilities of the a major world power o The content has very high value (multi-billion dollar deal, could bring down a government, could start a war) o Long term protection is required (30+ years) o You are in a position to properly secure the terminals at both ends 0 Efficiency is not a concern For example, a chief of state's personal diary, an opposition leader's communications, best and final bids on large projects, etc. > >I can't think of anything that isn't contrived and couldn't be served >by using 3DES. > In a way I see this question as how one should manage the transition from 3DES to AES. Does one keep using DES until the big day and then switch to AES? Or does a blended solution make sense in some cases? While I think there may be a use for something like a Paranoid Encryption Standard in very unusual situations, I don't wish to waste more of people's time arguing with those who say there's no need for it at all. I don't have any compelling evidence. It's pure speculation. I am really more interested in the theoretical "why not?" question, i.e. is there any real downside in combining ciphers in this way, besides efficiency? Conventional wisdom seems to be more cautious than I think is justified and I am trying to prove that. Arnold Reinhold

3 3

CDR: Parties
by A. Melon 02 Nov '00

02 Nov '00

Rush rapped: > Glad to hear that all it takes to "get your vote" is a reckless executive > pardon of criminals that is designed to utilize executive > power to bypass the checks and balances system and negate the efforts of the > legislative and judicial branches of government Spoken like a true fascist. What the fuck do you think executive pardon is but just another "checks and balances"? The fact is that it's the criminal scum in power at the moment who are fucking the constitution with their dirty little "war on some drugs". Basic 1st Amemdment freedom of religion went right down the drain with the very first drug law. It's religious persecution pure and simple, nothing more, nothing less. Harry Browne should go further, if elected he should not only pardon every person ever convicted of a drug or gun offense, but he should order the immediate arrest of anyone who ever voted for a drug or gun law, and who ever enforced these despicable illegal laws. Take your stupid babbling about your phoney politics elsewhere -- it has no relativity to cypherpunks.

4 4

CDR: RE: digital angel (tracking device)
by Trei, Peter 01 Nov '00

01 Nov '00

> Sampo A Syreeni[SMTP:ssyreeni@cc.helsinki.fi] wrote > On Sun, 29 Oct 2000, Eric Murray wrote: > > >>The unit can be turned off by the wearer, thereby making the monitoring > >>voluntary. It will not intrude on personal privacy except in > applications > >>applied to the tracking of criminals. > > > >Heh. > > > >>Digital Angel[tm] measures bodily parameters. It does not interact with > >>the body chemically or biologically. Designed to be completely harmless, > >>Digital Angel will not interfere with bodily functions in any way... > > > >at least in this version. > > And pulling the last two together, we have Digital Angel/IE (Instant > Execution), for those really Bad Seeds. The plus model will zap the > offender if brought near Digital Angel/FC (For Children). > > Sampo Syreeni <decoy(a)iki.fi>, aka decoy, student/math/Helsinki university > Go check out Harlan Ellison's short story "Repent Harlequin! cried the Tick Tock Man". This is really life imitating art. Peter Trei

2 1

CDR: (no subject)
by ShamrockAgent＠aol.com 01 Nov '00

01 Nov '00

Could you posibly send me instructions on how to construct a bomb and what materials that are needed? Thank you~

5 4

CDR: Re: California bars free speech of those cutting deals ...
by Anonymous Remailer 01 Nov '00

01 Nov '00

>California has "shut down"--through a threatening letter--a site >which matches up folks who are willing to say theyll vote for Nader >in states where Gore is sure to win if other folks who had hoped to So now it is illegal to provide a public forum with specific capabilities. Is it also illegal for me to privately arrange this with a particular sheeHHHHvoter from the other state ? Gangs can legally call for voters to vote for them and not for the other gang, but voters themselves cannot talk to each other and make arrangements that they see fit. This is the official recognition of the brainwashing monopolies. Time to setup servers in Lybia and Iraq. Too bad their gangs are too stupid to do it themselves. Or maybe I am missing something.

3 2

CDR: Re: Visit a hacked site, loose your computers.
by mmotyka＠lsil.com 01 Nov '00

01 Nov '00

Wouldn't the time of the hack be pretty well known and wouldn't the RPI firewall logs be timestamped or am I naive? Is knowledge being used as evidence of guilt? Mike >Andres Salomon, a fairly clued in RPI student, heard on > IRC that the Yankees website had been hacked. He > checked it out, noted some well-known Red Hat > security holes, and came to the conclusion that > there had been a DNS redirect attack. Total time: > 5 minutes. > > The next day, the FBI raided his dorm room and > seized his computers (along with a copy of ORA's > DNS & BIND). > > Peter Trei >

2 1

CDR: Ho to KICK OUT Junkbusters users
by ichudov＠Algebra.Com 01 Nov '00

01 Nov '00

I have a website (www.algebra.com) that makes money from banners. I have a suspicion that a small percentage of my users uses Junkbusters proxy in order to avoid seeing my banners. I do not want to serve such users at all and I do not want them to use my bandwidth. Is there any way to detect a user of Junkbusters in a CGI/mod_perl script? Thanks - Igor.

13 22

CDR: public keyrings
by bob bob2 01 Nov '00

01 Nov '00

if you have the url for an active public keyring site please forward it. thanks, bob dobs _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com.

4 3

CDR: ZKS "Smart Privacy Policies"
by Adam Back 31 Oct '00

31 Oct '00

cypherpunk agent X wrote: > Here we get to the meat of the issue... the > item that NAI tried to force down our throats...Corporate Key Escrow.. > this time via key splitting... Shades of the NSA Key!! > > Sick em Adam!! This is referring to me right -- as I was involved in the big fight about NAI's corporate message key escrow proposal? Disclaimer: note I work for ZKS now, below are my personal opinions. It's not key escrow, and it's not building tools for key escrow. Greg wrote: > ZKS has been pretty aggressively and conspicuously hiring wild-eyed > cypherpunk types, who won't necessarily inspire a lot of confidence > or trust in accoutant and risk-manager types. Yeah but the company's goal should be to satisfy users that there is a reason to trust the solution, and ZKS has brand recognition for building "trust no-one" (or at least distributed trust) solutions. Tim wrote: > [...] >By building precisely the tools they and other governments would need >to implement such a system, you are making such a system more likely >to happen. I agree with this argument. I wrote up some GAK-resistant design principles during the NAI/PGP key escrow argument (http://www.cypherspace.org/~adam/grdesign/) in an attempt to get people thinking about the social implications of protocols they write -- and to show that actually crypto protocols are not neutral -- a protocol could even be deliberately designed to frustrate later imposition of GAK -- for example end-to-end forward secrecy. Not suprisingly trying to frustrate GAK typically increases the security of your protocol, because the GAK aspect is a kind of attack, which could be perpetrated by others. This is one of the conclusions of the 11 cryptographers report on the risks of key escrow (http://www.cdt.org/crypto/risks98/) Here's my personal take on the design of privacy systems. It's basically an elaboration of "trust no-one", and "write code not laws" (aka cypherpunks write code). The desired trust model for privacy in order of preferred solution: - best: don't reveal the information in the first place -- critically rexamine whether is it necessary to reveal the personal data in the first place - if it is necessary to do some processing on data, examine the users processing and storing their own profile (client side applications) - try to operate pseudonymously (persistent anonymous) - if you can't do that at least split the data up (think reply-blocks) -- this is what the "split-key" thing is talking about (more on this below). - if possible make the protocols publicly auditable (as in time-stamp servers where if a server lies the users get a signed transcript proving it cheated). - if you can't do that have ombudsmen and traditional auditing of processes. - government laws come into it in the sense that some governments have or are starting to try to regulate companies handling of data. The UK Data Protection Act would be one example, where companies are supposed to forget data. We've discussed in the past the demerits of government laws wrt "forgetting" data -- if there is a business need for the data, the data service will move off shore. Still some companies will try to comply. - only lastly rely on contract law. Even with contract law it's problematic -- you're asking the company to forget something. For contract law, even though private contracting is a nice way to approach it, in practice it may be pretty hard to prove the company broke a contract, and anyway it's always better to prevent than detect and then argue it out in court. It's all a bit vague to talk about this stuff without some concrete example -- the above is talking loosely about areas where the user would currently be asked to reveal some info to a company. There are other applications one could apply crypto to. Also bear in mind that currently often the situation is no privacy at all -- data mining, sharing, reselling data against claimed privacy policies, weak non-technical "privacy seals", etc. Technical steps to ensure the user doesn't have to trust the company privacy policy is a good thing -- if the privacy policy is implemented in the form of cryptographic prevention. If they have the code and the protocols and they can see that they aren't trusting the company because the data doesn't leave their own computer, or is given pseudonymously through a mix net is a good thing. Even if nothing else technical is possible, and they have to trust a few third parties not to collude and there is no way to conduct the business without revealing the info to someone, that's an improvement, as previously they would have trusted the company alone. Hence the subject line -- using crypto to make cryptographic prevention is analogous to Nick Szabo's "Smart Contracts". (http://www.best.com/~szabo/smart.contracts.2.html) Now specifically about "key-splitting" -- the press release includes that one odd semi-technical snippet kind of out-of-context and ambiguously. The context is a system which is pretty much a reply-block. So as Adam Shostack says: it's not key splitting, it's multiple layered encryption -- the onion skin analogy. But as I say IMO it's imbalanced and ambiguous to mention that one technical approach without explaining at all, and without mentioning any of numerous other approaches. Adam

1 0