October 2000 - cypherpunks-legacy

CDR: At last!
by clubbers chat 26 Oct '00

26 Oct '00

Hi, At last clubberschat has arrived! Some time ago we contacted you with news of a forthcoming service Clubberschat. Clubberschat is a site that is linked up to hundreds of other clubbing sites worldwide, which should solve that age-old problem of empty chat rooms! We are having three main rooms at first with a view to add more when necessary, chill out room, dance floor room and on the pull room! We are now live and are in a promotional fortnight of signing up affiliates. Within these two weeks, signup is free. If you do decide to join us you will get your own personalised page with your logo and background colours to blend in with your site. This is a great way to offer YOUR COMMUNITY more value from your site, plus your hits will increase as people come back time and time again to use the chat, they will also tell their friends. You will get your own personalised page linking directly into the chat. If you are interested in signing up or want to see how the chat works then please visit: www.globalchatlink.com for more details plus a sign up procedure! Affiliates and their link pages are done on a first come, first served basis. Can you really afford not to be part of this unique opportunity? Add chat, add value, add hits, add Clubberschat! If this is not for you, or we have your mail address in our database by mistake, please accept our apologies we will not send this mail out again. Richard Howlett Business Development Clubberschat is a service offered by www.globalchatlink.com

2 1

CDR: Al Gore goes cypherpunk?
by Declan McCullagh 26 Oct '00

26 Oct '00

http://www.rollingstone.com/sections/magazine/text/excerpt.asp?afl=rsn&lngF eatureID=120&lngStyleID What's in your top five from the past year? Being John Malkovich; East Is East; Shall We Dance? I liked Gladiator a lot - I thought that was an excellent movie. I loved The Matrix. I loved the metaphor. Somebody gigged me in the mainstream media for not liking too much violence in the movies but simultaneously liking that movie. Well, you know, it was rated for adults. It was very violent, but it was a terrific movie. And I can hardly wait for the sequel.

8 14

CDR: Re: Non-Repudiation in the Digital Environment (was Re: First Monday August 2000)
by Ed Gerck 26 Oct '00

26 Oct '00

"Arnold G. Reinhold" wrote: > In public-key cryptography "Non-Repudiation" means that that the > probability that a particular result could have been produced without > access to the secret key is vanishingly small, subject to the > assumption that the underlying public-key problem is difficult. If > that property had be called "the key binding property" or "condition > Z," or some other matheze name, we would all be able to look at this > notion more objectively. "Non-repudiation," has too powerful a > association with the real world. Your definition is not standard. The Cryptography Handbook by Menezes defines non-repudiation as a service that prevents the denial of an act. The same is the current definition in PKIX, as well as in X.509. This does not mean, however as some may suppose, that the act cannot be denied -- for example, it can be denied by a counter authentication that presents an accepted proof. Thus, non-repudiation is not a stronger authentication -- neither a long lived authentication. Authentication is an assertion that something is true. Non- repudiation is a negation that something is false. Neither are absolute. And they are quite different when non-boolean variables (ie, real-world variables) are used. They are complementary concepts and *both* need to be used or we lose expressive power in protocols, contracts, etc.. Cheers, Ed Gerck > > > To transfer the cryptographic meaning of "non-repudiation" to a legal > presumption against repudiation requires legislative acceptance four > things: > > 1. the mathematically unproven assumptions in public key cryptography > > 2. the binding of a particular public key to a person > > 3. the ability of an ordinary individual to keep a private key secret > > 4. holding the individual responsible for failure to do so. > > As for 1, note that at the moment there is not even consensus as to > the long term security of , say, a 1024-bit RSA key. As to 2., read > the Verisign certification practice statement. As to 4. not that in > the US we do not presently hold individuals responsible for loss of a > credit card. > > The most problematic assumption is 3. McCullagh lists a couple of > attacks, but there are many more. Here is my incomplete list: > > 1. Planting a program on the user's computer to capture their keyring > and passphrase. > > 2. Replacing the users copy of the cryptographic program with a > doctored version > > 3. Planting a bug in their keyboard to capture key strokes > > 4.* Using a microTV camera to capture passwords and PIN numbers > > 5.* Substituting documents. (You think you are buying a pizza but you > are actually signing a deed to your house. > > 6. Public/private key pairs generated by a third party who's security > is less than perfect > > 7. Poor or deliberately weak random number generation at key creation > > 8.* Algorithm substitution (e.g. multiprime) that weakens security to > reduce computation times > > 9. Guessable passphrases and PINs > > 10.* Allowing someone else to use your key (does the president of > World Wide Widget really hold the key token, or does he give it to > his secretary?) > > 11.* Con artist techniques ("I'm an field agent from CyberSec -- > here's my ID card -- and we'd like your help in tracking down child > pornography dealers on the Internet. We'll need your key token and > PIN. ") > > 12.* Finding ways to penetrate "tamper proof" mechanisms, e.g. power > fluctuation attacks. > > McCullagh believes that "trusted systems," which he defines as "at > least Bl (TCSEC)/E3(ITSEC)/ or even possibly B2(TCSEC)/E4( ITSEC)" > can provide a basis for non-repudiation in the legal sense. He is > under the apprehension that "A trusted computing system performs in > accordance with its documented specification and will prevent any > unauthorised activity." Since Mr. McCullagh background is in law, > let me provide an equivalent statement: "Laws reflect the public's > consensus of what is right and wrong and the judicial system fairly > and accurately enforces those laws." Both are statements of a lofty > goal, not a reality that anyone has been able to achieve. > > Well designed cryptographic tokens can counter some of the attacks I > listed, but not all. The ones I marked with an asterisk are still > applicable and there is still the problem of verifying and auditing > the token manufacturer, a lucrative target for organized crime. > > I can't address the legal arguments he makes since he is in > Australia, but my understanding of the recently enacted electronic > signature law in the US is that it attempts to put electronic > signatures on exactly the same legal footing as paper signatures. It > has no special status for PKC signatures. Clicking an http "I Accept" > button is just as valid, as I understand the law. > > The term "non-repudiation" should be retired. The best that one can > say about public key signature systems for use by the general public > is that they can make forgery much more difficult. That difficulty > should result in reduced rates of attempted fraud, but should never > be a valid pretext for changing the legal burden of proof. > > Arnold Reinhold

12 25

CDR: RE: Denver Judge rules Cops can seize bookstore records
by Carskadden, Rush 26 Oct '00

26 Oct '00

How do they subpoena records from garden supply stores looking for people who buy too many grow lamps or hydroponic setups? Do they just subpoena all of these stores on a regular basis? What do they claim they are looking for in the subpoenas? My understanding is that you pretty much have to know what you are looking for and be fairly specific about it in the subpoena. If you do not already know who is buying "too many" grow lamps or hydroponic setups, how do you structure the subpoena? The only signed subpoenas that I have seen that were grossly general and unsure of what was needed were either A) Internet related (taking advantage of a seeming lack of knowledge on the part of judges) or B) a case where the person who is being subpoena'd is actually a victim of the crime being investigated. Do you have more information on the garden supply store thing? ok, Rush Carskadden -----Original Message----- From: Greg Broiles [mailto:gbroiles@netbox.com] Sent: Wednesday, October 25, 2000 2:45 PM To: cypherpunks(a)cyberpass.net Subject: Re: Denver Judge rules Cops can seize bookstore records Interesting - the article is a little confused on a few points - specifically, this is not the first time this has happened, the DEA subpoena'd records from a publisher of mushroom growing books back in the mid 90's. They also subpoena records from garden supply stores looking for people who buy too many grow lamps or hydroponic setups. Also, it doesn't sound like they're talking about a search warrant - those aren't issued by DA's, nor do their targets have an opportunity to argue about what's searched prior to the search, because the searches take place without notice and at gunpoint. It sounds like they're talking about a subpoena, which does afford the recipient a chance to get an attorney and argue about it prior to releasing information. Still, it's a good reminder that it can be dangerous to trust even good people with sensitive information - the good people may not willingly betray you, but they may be forced to divulge the information on pain of losing money, property, or their life, or it may simply be stolen by armed gangs. At 12:45 PM 10/25/00 -0500, No User wrote: >Real-To: No User <no.user(a)anon.xg.nu> > >"If we can save but one child from the awful scourge of drugs..." > >Of course, the real issue here is why the bookstore was keeping such >personalized records in the first place. > >-------- >Judge: Cops can seize bookstore records >http://www.denverpost.com/news/news1021b.htm > >By Susan Greene >Denver Post Staff Writer > >Oct. 21, 2000 - Police will be allowed to search customer purchase records >at the Tattered Cover Book Store to investigate a narcotics case, a Denver >judge ordered Friday. > >Civil libertarians decried the order - believed to be the first of its >kind nationwide - for protecting law enforcement's ability to obtain >evidence over individual rights to read without interference from >authorities. > >Tattered Cover owner Joyce Meskis said the order could have a "chilling >effect" on the First Amendment and on store patrons, who might hesitate to >buy books knowing that police have access to their purchase records. She >is considering an appeal. > >"A bookstore is a house of ideas," she said. "We certainly have the >responsibility to protect customers' rights to those ideas, and the right >to privacy that goes along with that." > >Law enforcers hailed the order as a victory. > >"If it only takes one or two records from a bookstore to help us eliminate >drugs on the street, then so be it," said Lt. Lori Moriarty, commander of >the North Metro Drug Task Force, which is seeking the Tattered Cover >records. "We need all the tools possible to help law enforcement do its >job." > >The controversy stems from a March 14 raid on an Adams County mobile home >in which task force members found a methamphetamine lab and two books: >"The Construction and Operation of Clandestine Drug Laboratories" by "Jack >B. Nimble," and "Advanced Techniques of Clandestine Psychedelic and >Amphetamine Manufacture" by "Uncle Fester." > >Investigators also found a bookshipping envelope containing an invoice >number from the Tattered Cover in Lower Downtown Denver. They are hoping >bookstore records will help pinpoint which of the six people who >frequented the mobile home bought the books and, presumably, operated the >lab. > >The task force first sought a search warrant from the Adams County >district attorney's office, which rejected the request partially on >grounds that executing it would give police a public relations "black >eye." > >Task force members then turned to the Denver DA's office, which granted >the warrant. > >Meskis blocked police from going through her store's records, saying they >should instead use other investigative measures such as fingerprinting to >find their suspect. > >Denver District Court temporarily blocked the task force from seizing the >records, pending the outcome of a hearing before Judge Stephen Phillips. > >Most states have laws protecting public libraries from police searches >except under exceptional circumstances, but there is no special law that >protects bookstores. > >The issue made headlines in 1998, when independent counsel Kenneth Starr >subpoenaed two Washington, D.C., bookstores for information on gifts >exchanged between President Clinton and White House intern Monica >Lewinsky. Barnes & Noble and Kramerbooks hired lawyers and challenged the >subpoena in federal court. > >A federal judge quashed Starr's request for the records. Lewinsky, >meantime, agreed to testify in exchange for immunity, rendering the whole >issue moot. > >Still, the case was a watershed for bookstore owners and privacy >advocates, who have been watching the Tattered Cover's legal battle with >intense interest. > >Phillips, in his order, recognized the First Amendment right to "receive >information and ideas, regardless of social worth," but he cited a legal >balancing test weighing such rights against the importance of law >enforcement to investigate crimes. > >Phillips ruled that the identity of the drug lab operators is "of >significant public interest" and that "the purchase of how-to books is a >highly important piece of evidence." > >The judge wrote that there's no other reasonable way, aside from seizing >store records, for investigators to obtain the information they're >seeking. He lauded the task force for asking only for specific invoices, >not "stumbl(ing) through other private records." > >Phillips deemed the Tattered Cover case "dramatically different" than the >Lewinsky case, about which he wrote: "The subpoenas were exploratory in >nature, and the government was unable to show any need nor any nexus to a >criminal event." > >And so Phillips denied investigators' broad request for a month's worth of >records that might show all titles purchased by the unnamed suspects. >Still, he granted police access to the specific invoice whose number >appeared on the book mailer. > >Meskis has 15 days to appeal before the task force seizes her records. > >Moriarty insists it was never her unit's intent to comb through reading >records of the general public. Rather, she said, Phillips' order will give >investigators "an important piece of a puzzle" needed to nab their >suspect. > >Critics say one arrest is a high price to pay for allowing a war against >drugs to chip away at civil rights. > >"Key principles of the right to privacy and freedom of speech have >ultimately been compromised in the decision," said Sue Armstrong, >executive director of the American Civil Liberties Union in Colorado. > >Judith Krug, director of the Office for Intellectual Freedom at the >American Library Association, said she worries that drug investigators >unfairly are "making the connection between what people read and what they >do." > >"Just because you read a book on homosexuality, for example, doesn't mean >you're gay. And reading a book on the symptoms of cancer doesn't mean you >have the disease," Krug said. > >"Our concern is that what people read, what goes into their heads will no >longer remain private." > > >KEY QUESTIONS: > >Denver District Judge Stephen Phillips posed four key questions as part of >a legal balancing test in his ruling: > >1. Is there a legitimate and significant government interest in acquiring >the information? > >2. Is there a strong nexus between the matter being investigated and the >material being sought? > >3. Is the information available from another source? > >4. Is the intrusion limited in scope so as to prevent exposure of other >constitutionally protected matters? > >Copyright 2000 The Denver Post. All rights reserved. > >Related: >Bookstore fights search warrant >http://www.denverpost.com/news/news1018d.htm -- Greg Broiles gbroiles(a)netbox.com

1 0

CDR: Fwd: Wen Ho Lee Petition for Blue Ribbon Investigation & Presidential Pardon - Discussion Zaplet
by WenHoLee.org 25 Oct '00

25 Oct '00

WenHoLee.org has sent you an interactive Zaplet about 'Wen Ho Lee Petition for Blue Ribbon Investigation & Presidential Pardon '. Based on the email software you are using, the best way to access your Zaplet is on the web. <a href="http://zaplet.zaplet.com/servlet/Z?m=2_QA_ilcQHUVhK2PZCHF68CjKC">Click here to view this Zaplet</a> Thank You WenHoLee.org ---------------- If you are unable to reach the link above, go to the following address using your web browser: http://zaplet.zaplet.com/servlet/Z?m=2_QA_ilcQHUVhK2PZCHF68CjKC If you require assistance, please email us at support(a)zaplet.com To learn more about Zaplets, visit us at www.zaplet.com Thank you for using Zaplets!

1 0

CDR: For small values of "Ideal" (was: Re: why should it be trusted?)
by Secret Squirrel 25 Oct '00

25 Oct '00

Nathan Saper wrote: > Having socialized healthcare would be ideal. However, I think that "Having total gun control would be ideal," "Having self censorship would be ideal," "Having salary standardization would be ideal," and now: "Having socialized healthcare would be ideal." What next? "Having crypto export controls would be ideal"? If I set up a Killfilepunks list, will you migrate?

1 0

CDR: Re: I created the "Al Gore created the Internet" story
by Craig Brozefsky 25 Oct '00

25 Oct '00

Tim May <tcmay(a)got.net> writes: > >>By 1986, numerous clones of the IBM PC and AT existed. > > > >Its quite simple. In 1995 MS released a version of Windoze which > >included a TCP/IP stack by default. Previously you had to acquire > >one and figure out how to install it. While fortunes were made > >on this, the collection of routers known as the Net was unavailable > >to Joe Sixpack until then. > > I don't buy this at all. Maybe there is some subtlety I am missing > completely. I don't buy it either. Prior to that release of Windows I was doing tech support for an ISP in Chicago using MacPPP for the mac and WinSock on Windows. We had several thousand subscribers prior to the time that TCP/IP came installed with Windows, and we had already hit the major upswing in our growth curve at that point. The explosion had more to do with Mosaic and Netscape than with the TCP/IP stack. The default stack in MS just allowed MS to strike deals with bigger ISPs, it didn't significantly streamline our installation process for new customers. The difference between installing from a cab file on your HD or CDROM, and installing from our CDROM, which came with a browser and the other applications that people were actually interested in, is trivial. I suppose one could say that the bundling of ISP services with the default Windows install increased the rate of new internet users significantly, but the explosive growth has already started by then. -- Craig Brozefsky <craig(a)red-bean.com> "the sacrifice of real, immediate life is the price paid for the illusory freedom of an apparent life." Vaneigem

2 1

CDR: RE: why should it be trusted?
by Trei, Peter 25 Oct '00

25 Oct '00

> ---------- > From: Ken Brown[SMTP:k.brown@ccs.bbk.ac.uk] > Reply To: k.brown(a)ccs.bbk.ac.uk > Sent: Wednesday, October 25, 2000 11:21 AM > To: Trei, Peter > Cc: Cypherpunks; 'Nathan Saper' > Subject: Re: why should it be trusted? > > "Trei, Peter" wrote: > > > Nathan, have you ever actually looked at socialized medicine? It's > > fine for some things, but not for others. Illnessess which can be > > cured and which curing will return a person to productive labour > > get treated - after a while. Illnessess which strike late in life and/or > > require expensive treatment get much shorter shrift. > > This isn't really true. The NHS tends to be quite good at big stuff, > serious interventions. The UK is also quite good for fixing small 1-off > problems (the poor wait in line, the less poor just pay same as anywhere > else). What it isn't so good at is chronic but not life-threatening > problems. In other words, just the ones "which curing will return a > person to productive labour". Of course these are also the exact same > health problems that private health insurance is worst at. > I've read various stories (mostly in New Scientist and The Economist) about people being refused expensive chemotherapy by the NHS. > > Why do you > > think Austin Power's teeth were a running joke?[...] > > Dentistry in the UK is almost entirely private & sometimes used as an > example of why publicly provided healthcare is supposed to be better! > Except for the poorest, we pay for it out of our own pockets (as adults > anyway, there is a certain amount of public provision for children). > Same applies to opticians & so on. > I stand corrected. The fact remains that bad teeth are part of the American stereotype of Britons. > There are a lot of problems (particularly local ones in London because > nationally set budgets don't reflect the cost of provision here - the > district I'm in has over 20% shortfall in the number of nurses on the > staff because they aren't paid enough), but on the whole I think you'll > find few Brits who would give up the idea of the NHS. After all we live > longer than you do, on average (assuming you are USAn), are slightly > poorer to start with & spend a *lot* less on healthcare per head, public > & private combined. In fact you spend almost as much on "socialised" > medicine as we do, far less cost-effectively. > ... and you have a continuous brain drain of doctors to the greener fields of the US. > Ken > Peter Trei

1 0

CDR: Nathan's fear of nothingness
by mmotyka＠lsil.com 25 Oct '00

25 Oct '00

Amusing. >Here is my last post in this thread, because I feel that it is going >nowhere: > Isn't that a CP thread hallmark? Is this a preview of item 2) ? >My views are irreconcilable with those of the libertarians on this >list. Here's the way I view the world: > > 1) Life has no inherent value. Our being here is random, and > there is no purpose to our lives. > All 100% true and anyone who disagrees is full of shit but you seem to have missed subparagraph a) where people in their wonderful and surprising variety have filled the void by assigning their own personal values to their lives and the world around them. Values which they hold dearly and do not have to justify to anyone unless they choose to. > 2) "Human progress" is bullshit. We are no further along as a > species now than we were in Plato's time. Basically, we're > going nowhere fast. > Again, an accurate but useless observation. At least the accomodations are good and we don't usually have to work on weekends and can get out to the occasional ballgame or fishing trip while we wait for the confirmation of our ultimate meaninglessness. > 3) People have no essential "rights." Rights don't exist. > This is a theme often found in the work of many modern > philosophers, such as Foucault. > Here we go again. 100% true and 100% useless. People have those rights which they choose and are able to guarantee themselves either individually or as a tribal group. > 5) Taking all three premises above, the only way I can find to > evaluate what is right and what is wrong is "do what causes the > least pain." > Aha! Now we see the arbitrary values inherent in the system. Fleeing from nihilism you have arrived at your current Pain Avoidance Value Set. It is one of many possible sets. You would impose impose these values on others as far as possible ( power thing ). Standard human behavior. Nothing new or profound. > I guess this is basically pragmatism. For > example, if raising taxes to 95% would feed everyone in the > world (I'm just speaking hypothetically), then I would advocate > this, because this would lead to less pain in the world. (And > I don't consider some people having to sell their Ferraris > "pain." ;-) Someone here said that each time taxes are raised, > we lose freedom. So what? First of all, what is "freedom"? > Second of all, what is so great about it that it should be > evaluated before everything else? > Arbitrary value set #1 vs. Arbitrary value set #2. Actually more of a continuum where self-interest, and community interest ( and sometimes looniness ) defines the camps and the players are free to choose. >So I guess when people say "but by making the insurance companies pay >for the medical care, you are stealing from them," my answer is "So >what?" > Steal from them if you can but keep in mind that they will try to protect themselves from your attempts to impose your arbitrary values on them. >I understand that this way of viewing the world is not shared by many >on this list, so it seems that it would be damn near impossible for us >to reach agreement. > yawn. Since when has Agreement of any sort been a desired outcome? Mike

1 0

CDR: vmware
by Alan David Zoldan 25 Oct '00

25 Oct '00

Hello, Do you know how I can get a valid license for my vmware for linux? Alan.

2 1