October 2000 - cypherpunks-legacy

CDR: RE: Re: Anonymous Remailers cpunk
by Trei, Peter 09 Jan '01

09 Jan '01

> ---------- > From: Jim Choate[SMTP:ravage@einstein.ssz.com] > Reply To: Jim Choate > Sent: Thursday, October 12, 2000 7:09 PM > To: cypherpunks(a)einstein.ssz.com > Subject: CDR: Re: Anonymous Remailers cpunk > > > On Tue, 3 Oct 2000, Steve Furlong wrote: > > > <<Proposal to limit spam sent through anon remailers by requiring that > > the traffic be encrypted>> > > > Perhaps we're talking at cross purposes. This subthread came along > > because some people have noticed that anonymous remailers are used for > > an awful lot of spam. Peter Trei proposed that remailers could pass > > along only encrypted mail. My understanding was that Alice, the > > message's author, would encrypt the message with Bob's public key; Bob > > is the end recipient: a person or a mailing list or whatever. Alice > > would send the message through Ramona, the anonymous remailer. Ramona is > > requiring that messages be encrypted as a means of filtering out spam. > > Ramona does not need to know Bob's public or private keys; Ramona cares > > only that the message is encrypted. > > So? I set up a email address that I offer to the spammers to sign up to > the anonymous remailers and then it proxies their email into the encrypted > network. I figure this baby'll stop'em for about six months. > Jim: A spammer (or your spammer's proxy) is not going to individually encrypt messages to thousands or millions of end-recipients, each with their own public key - the time factor makes this uneconomical, and the hassle factor of finding all the recipient public keys makes it impractical. Thus, only remailers which send out plaintext are useful to spammers as exit remailers. It is only exit remailers (ie, the remailer which sends to the final recipient) which get hassled for sending spam. The goal is to make remailer operators life easier by preventing them from being used to spam random lusers, who may initiate complaints against the remailer operator. It is not to prevent spam passing through a remailer somewhere in mid-cloud. While such encrypted spam will increase the volume of traffic, for most remailers that is a Good Thing - more material to confuse the traffic analysis. As long as it gets dropped before leaving the remailer network, no harm is done. Steve understands this, as does every one else but you. What's the problem? > For it to really stop spam it would need to be well distributed. So how do > you offset the increased sys admin issues this raises? > Any remailer operator can decide not to pass along plaintext. So long as the message sender is aware of this property, nothing more needs to be distributed. There are no increased sysadmin issues. > Then there is the old key management problem. > > James Choate > No, there is not, beyond the fact that the message originator must know the final recipient's public key. Jim, do you really understand how remailer chaining works? Peter Trei > Vizzini: HE DIDN'T FALL? INCONCEIVABLE! > Inigo Montoya: You keep using that word. I do not think it means what you > think it means. > - The Princess Bride > > >

7 9

CDR: Complete Guidebook and Workplace Violence Prevention Video series
by WBNixon＠aol.com 22 Nov '00

22 Nov '00

Good Morning! I am Barry Nixon, Executive Director, The National Institute for the Prevention of Workplace Violence and am creating a workplace violence superstore on line with the intent to have a wide array of workplace violence prevention products for sale. Your video series would be an excellent addition to the online superstore so could you please send me information about the steps necessary to make this happen. I can be contacted via email at WBNixon(a)AOL.com, telephone at 949-770-5264 and fax 949-597-0977.

3 2

CDR: re:Tim May's anti-semitic rants
by auto9950013＠hushmail.com 06 Nov '00

06 Nov '00

Tim's anti Jewish sentiments are obvious in his current posts and in the past. If he had any guts he would admit what he really feels instead of using sarcasm and obfuscation. Tim May writes >Nowhere in my article did I mention Jews or Judaism.

8 11

CDR: why should it be trusted?
by Jordan Dimov 05 Nov '00

05 Nov '00

I don't know much about crypto politics, but... isn't it utterly obvious that the mere fact that the NSA suggest a certain algorithm (say Rijndael) for a national standard and recomends its use internationally imply that they have a pretty darn good idea (if not actual technology) on how to break it efficiently? I just don't see why else they would advocate its use. After all isn't the fact that NSA could break DES since the 70's the reason for the 'success' of DES?

29 147

CDR: Zero Knowledge changes business model (press release)
by Declan McCullagh 03 Nov '00

03 Nov '00

>From: kcory(a)redwhistle.com >To: declan(a)well.com >Date: Tue, 31 Oct 2000 06:55:11 -0800 >Subject: Zero-Knowledge Introduces Managed Privacy Services for Businesses > > > >Hi Declan, >Today, Zero-Knowledge Systems is introducing its Managed Privacy >Services (MPS) offering to solve the privacy challenges >that businesses face in today's privacy-conscious business >environment. > >Privacy is good business. Companies in every industry are >realizing they must institute the proper privacy policies, >practices and infrastructures in order to succeed in >today's digital economy. Zero-Knowledge Managed Privacy >Services provides the tools and strategies that enable >business to establish private customer relationships and >earn consumer trust while ensuring legislative compliance >and mitigating risk. > >As companies have become aware of the privacy risks and >legislative hurdles facing them, many have turned to Zero- >Knowledge for advice and solutions, and the MPS offering is >the natural response to companies' needs for comprehensive >privacy solutions. > >I've included the press release about MPS below. If you >have any questions about Zero-Knowledge's Managed Privacy >Services offering or would like to set up a conversation >with Zero-Knowledge President Austin Hill, please give me a >call at 503-552-3749. > >Best regards, >Kristy Cory >503-552-3749 > >ZERO-KNOWLEDGE SYSTEMS INTRODUCES MANAGED PRIVACY SERVICES >TO SOLVE THE PRIVACY CHALLENGES OF BUSINESSES > > >Montreal -- October 31, 2000 -- Zero-Knowledge(R) Systems, >the leading developer of privacy solutions, today >introduced its new Managed Privacy Services(TM) offering to >solve the privacy challenges of businesses and enable >enterprise to thrive in a privacy-conscious climate. >Delivering a unique combination of technology, policy and >strategy expertise, Zero-Knowledge Managed Privacy Services >(MPS) enables clients to turn privacy into a competitive >advantage by leveraging rich data resources while building >stronger and more profitable relationships with customers, >employees and partners. MPS is based on responsible and >ethical information management in accordance with relevant >legislation and industry standards. > >"Privacy is good business -- and Zero-Knowledge Systems is >the company that can deliver continued privacy value to >companies that want to succeed in today's digital economy," >said Austin Hill, president of Zero-Knowledge >Systems. "Through expert professional services and >technological solutions, Zero-Knowledge Systems works with >companies to leverage and develop the rich data resources >they need, while ensuring that their customers' personal >information will not be abused, misused or sold without >their permission." > >Employing a broad toolkit of privacy-enhancing technologies >that control and protect data, MPS brings privacy-based >services to a variety of markets for the first time. These >include: financial services, health care, wireless, >marketing, CRM and hosted solutions (ASPs). > >The Managed Privacy Services Process >Zero-Knowledge MPS fuses sophisticated infrastructure >design, advanced cryptographic systems and world-class >privacy expertise to deliver strong privacy integration to >a wide variety of business processes and system designs. >Following a period of assessment and design, MPS culminates >in the deployment of a tailored privacy layer that >integrates seamlessly with the client's existing enterprise >applications. > >* ASSESS AND ADVISE -- Managed Privacy Services begins with >a thorough assessment of each client's data storage and >usage patterns, as well as their business objectives. From >this assessment, recommendations are made regarding areas >where data can be better utilized through the addition of a >strong privacy layer, and areas of potential privacy risk >are identified. > >* DESIGN AND IMPLEMENT -- The assessment stage provides the >framework for all aspects of the infrastructure design, and >determines which Zero-Knowledge privacy technologies are >best suited to the client's needs. The result is a solution >that not only secures and protects the client's data, but >also allows for a wider array of data-driven activities. >Professional systems integration ensures that all the >client's business requirements are met, and guarantees the >final design will result in the most robust and flexible >system possible. > >* VERIFY AND MANAGE -- Zero-Knowledge is able to manage all >elements of the privacy infrastructure, allowing clients to >focus on their core competencies, and providing third-party >credibility to a client's privacy initiatives. Independent >audits ensure that the system deployed is in compliance >with stated policies, and that all controls are functioning >as per the design specifications. > >Zero-Knowledge is committed to deploying systems that are >transparent and accountable. In keeping with this policy, >MPS will incorporate third party verification and split >encryption key structures, as well as provide consumers >with access to white papers, independent auditors' reports >or other materials that assure a company is doing what it >claims. With MPS Zero-Knowledge strengthens its commitment >to building responsible systems that empower consumers to >control the disclosure and use of their personal >information, while still enabling businesses to thrive in a >data and relationship-driven marketplace. > >Zero-Knowledge Systems Leads Privacy Education >Zero-Knowledge Systems is also presenting the "Privacy by >Design: The Future of Privacy Compliance and Business" >conference sponsored by Royal Bank Financial Group, IBM, >Merrill Lynch, and PricewaterhouseCoopers. Incorporating >the privacy expertise of leading business, technology and >privacy figures, Privacy by Design will advise attendees on >how to develop, execute and market a successful privacy >strategy that will avoid regulatory breaches and >differentiate their business in the marketplace with a >demonstrable commitment to privacy. The conference will be >held at Le Chateau Montebello, Quebec from November 19 to >21, 2000. For more information on Privacy by Design, >including a detailed agenda, visit the conference Web site: >http://www.zeroknowledge.com/privacybydesign.html > >About Zero-Knowledge Systems, Inc. >Founded in 1997, Zero-Knowledge Systems >(http://www.zeroknowledge.com) is laying the digital >infrastructure for privacy-enabled communications and >commerce between individuals, companies, governments and >organizations. Zero-Knowledge creates products and services >that enable privacy through advanced mathematics, >cryptography and source code: the only reliable way to >ensure privacy. > >In December 1999, Zero-Knowledge launched Freedom(R), the >only privacy system that empowers Internet users to surf >the Web, send email, chat and post to newsgroups in total >privacy without having to trust third parties with their >personal information. Freedom can be downloaded at >http://www.freedom.net and Freedom source code is available >at http://opensource.zeroknowledge.com. In October 2000, >Zero-Knowledge launched its Managed Privacy Services(TM) >offering to provide expert consultation and privacy- >enhancing solutions that enable businesses to comply with >privacy legislation, maximize customer relationships and >build consumer trust without violating privacy. More >information about MPS can be found at >http://www.zeroknowledge.com/business. > >Journalists can visit the Zero-Knowledge pressroom at >http://www.zeroknowledge.com/media. > > (Freedom, Zero-Knowledge and Managed Privacy Services are >registered trademarks of Zero-Knowledge Systems, Inc. All >other names may be trademarks of their respective owners.) > >For more information >Dov Smith >Director of Public Relations >514.350.7553 >dov(a)zeroknowledge.com > >Kristy Cory >Red Whistle Communications >503.552.3749 >kcory(a)redwhistle.com > > > > > >

14 40

CDR: California bars free speech of those cutting deals on votes
by Tim May 03 Nov '00

03 Nov '00

California has "shut down"--through a threatening letter--a site which matches up folks who are willing to say they'll vote for Nader in states where Gore is sure to win if other folks who had hoped to vote for Nader will instead vote for Gore in order to help him in swing states. (Sounds complicated. But it's really simple. "I'll scratch your back if you scratch mine." No money is changing hands, no actual "ballots" are being traded.) The Web site doing this is/was: http://www.voteswap2000.com/ The article on California's actions is: http://dailynews.yahoo.com/h/nm/20001031/wr/campaign_traders_dc_1.html BTW, I just "expressed my preference" at the site: http://Winchell.com/NaderTrader/default.asp No doubt I am even now more of a speech criminal. I wonder if a raid is imminent. --Tim May -- ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 831-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, "Cyphernomicon" | black markets, collapse of governments.

8 14

CDR: RE: Paranoid Encryption Standard (was Re: Rijndael & Hitachi)
by Carskadden, Rush 02 Nov '00

02 Nov '00

Are you guys still talking about the feasibility of a cipher that implements each AES candidate in turn with the same key? I don't really get this idea. Provided you were actually using the same key with each stage of the encryption, then your system is only gong to be as secure as the key of the first algorithm. In fact, it seems that if the key is compromised at any one point, then the entire system is shot, given that you know the algorithm (Kerckhoff's principle IIRC). Maybe I am misunderstanding. ok, Rush Carskadden -----Original Message----- From: Arnold G. Reinhold [mailto:reinhold@WORLD.STD.COM] Sent: Friday, October 27, 2000 12:29 PM To: Damien Miller Cc: John Kelsey; Bram Cohen; cryptography(a)c2.net; cypherpunks(a)cyberpass.net Subject: Re: Paranoid Encryption Standard (was Re: Rijndael & Hitachi) At 4:16 PM +1100 10/27/2000, Damien Miller wrote: >On Thu, 26 Oct 2000, Arnold G. Reinhold wrote: > >> simple way to combine the AES finalists and take advantage of all the >> testing that each has already undergone. And, IMHO, it is an >> interesting theoretical question as well. Even if the answer is >> "yes," I am not advocating that it be used in most common >> applications, e.g network security, because there are so many greater >> risks to be dealt with. But it might make sense in some narrow, high >> value, applications. > >What threat model do you propose that would require this? o Your opponent has the cryptologic capabilities of the a major world power o The content has very high value (multi-billion dollar deal, could bring down a government, could start a war) o Long term protection is required (30+ years) o You are in a position to properly secure the terminals at both ends 0 Efficiency is not a concern For example, a chief of state's personal diary, an opposition leader's communications, best and final bids on large projects, etc. > >I can't think of anything that isn't contrived and couldn't be served >by using 3DES. > In a way I see this question as how one should manage the transition from 3DES to AES. Does one keep using DES until the big day and then switch to AES? Or does a blended solution make sense in some cases? While I think there may be a use for something like a Paranoid Encryption Standard in very unusual situations, I don't wish to waste more of people's time arguing with those who say there's no need for it at all. I don't have any compelling evidence. It's pure speculation. I am really more interested in the theoretical "why not?" question, i.e. is there any real downside in combining ciphers in this way, besides efficiency? Conventional wisdom seems to be more cautious than I think is justified and I am trying to prove that. Arnold Reinhold

3 3

CDR: Parties
by A. Melon 02 Nov '00

02 Nov '00

Rush rapped: > Glad to hear that all it takes to "get your vote" is a reckless executive > pardon of criminals that is designed to utilize executive > power to bypass the checks and balances system and negate the efforts of the > legislative and judicial branches of government Spoken like a true fascist. What the fuck do you think executive pardon is but just another "checks and balances"? The fact is that it's the criminal scum in power at the moment who are fucking the constitution with their dirty little "war on some drugs". Basic 1st Amemdment freedom of religion went right down the drain with the very first drug law. It's religious persecution pure and simple, nothing more, nothing less. Harry Browne should go further, if elected he should not only pardon every person ever convicted of a drug or gun offense, but he should order the immediate arrest of anyone who ever voted for a drug or gun law, and who ever enforced these despicable illegal laws. Take your stupid babbling about your phoney politics elsewhere -- it has no relativity to cypherpunks.

4 4

CDR: RE: digital angel (tracking device)
by Trei, Peter 01 Nov '00

01 Nov '00

> Sampo A Syreeni[SMTP:ssyreeni@cc.helsinki.fi] wrote > On Sun, 29 Oct 2000, Eric Murray wrote: > > >>The unit can be turned off by the wearer, thereby making the monitoring > >>voluntary. It will not intrude on personal privacy except in > applications > >>applied to the tracking of criminals. > > > >Heh. > > > >>Digital Angel[tm] measures bodily parameters. It does not interact with > >>the body chemically or biologically. Designed to be completely harmless, > >>Digital Angel will not interfere with bodily functions in any way... > > > >at least in this version. > > And pulling the last two together, we have Digital Angel/IE (Instant > Execution), for those really Bad Seeds. The plus model will zap the > offender if brought near Digital Angel/FC (For Children). > > Sampo Syreeni <decoy(a)iki.fi>, aka decoy, student/math/Helsinki university > Go check out Harlan Ellison's short story "Repent Harlequin! cried the Tick Tock Man". This is really life imitating art. Peter Trei

2 1

CDR: (no subject)
by ShamrockAgent＠aol.com 01 Nov '00

01 Nov '00

Could you posibly send me instructions on how to construct a bomb and what materials that are needed? Thank you~

5 4