November 2000 - cypherpunks-legacy

CDR: RE: The Market for Privacy
by auto107640＠hushmail.com 02 Nov '00

02 Nov '00

--Hushpart_boundary_iWCDbgAikNCcbLlDAWpLjBKeDnioBxsF Content-type: text/plain WOW - well I have to start out this post with a REALLY STRONG sense of vindication!! DAMN it feels good to be right!! 4 months ago (circa July) I made (using a differnet hushmail nym - forgot the password to that one so I had to make a new one..) a number of posts to this list of the subject of: (1) why ZKS doesn't really protect privacy in the first place, (2) why privacy is a MAJOR ecnomic issue, and (3) why, (b/c of (2)) the real market for privacy is on the business side of the equation, not in wimpy pieces of consumer client software like Freedom.. At the time I equated privacy with the Code of Fair Information Practices (CFIP), and explained at a NUMBER of businesses would be MORE THAN WILLING to put these principles into practice at their enterprise b/c of the massive REVENUE potential this could create.. At the time, I was pretty much totally dismissed.. every point I made was ridiculed as being short-sighted or a pipe dream and, esp concerning the fact that businesses would be willing to put in place CFIP, I was told that I was f***ing out of my mind and that that made no sense whatsoever.. How DELICIOUS to watch (in FOUR SHORT MONTHS) ZKS TRY to turn around their whole business to basically the same principles that I outlined in those earlier postings!! Enough w/ the revenge, though -- let's proceed to dismantle Tim May's inept, knuckle-dragger arguments on these issues.. >This is a recurring theme, and one we've talked about many times. >Fact is, most people don't think they need security. Most people >don't even think they need backups. Until their hard disk crashes. >And so on. It's a tough sell in either case. >This is why the market for crypto and security and anonymity has >tended to be at the "margins" of society: porn, warez, freedom >fighting, etc. Such has it always been, such shall it always be. >Targetting the mainstream is a tough sell. No, completely wrong, as usual. The REAL market for crypto and security has ALWAYS BEEN and WILL ALWAYS BE in the financial services sector. These people have absolutely enormous amounts of money at stake, and in so far as cryptography and security can reduce the risk of bad loans, of theft, of a gazillion other risks that financial services companies face, these companies will continue to operate at the forefront of global cryptography technology.. Anonymity has NO MARKET in this world outside of free speech.. (I'm sure I'll be ridiculed for this again too, but in 4 short months something else will happen to vindicate me.. I'll let you guys know when it does..) >(The most widely-deployed bits of crypto are in places where huge >deals were cut with browser makers, e.g., SSL,Verisign, etc. The >customer is only vaguely aware that such things are happening. No >sale to Joe Average is needed. Probably this is the way Web proxies >will ultimately be sold.) Good security should be so seamless the user doesn't even know it's there. SSL satisfies this design requirement. So does Verisign. Freedom doesn't. Freedom sux.. it's like, it's always there and I can't uninstall that hideous piece of software off my machine fast enough.. >ZKS was just one of many companies attempting to sell privacy tools >to "Joe Average," and his little daughter Suzy Average (pictured in >ZKS Freedom ads...). Well, Joe doesn't do much with his home computer >except check some sites and maybe download a few porn images from >Danni's Hotbox when Suzy has gone to bed and the wife is passed out >on the sofa. >_Could_ ZKS Freedom help Joe a little? Maybe, but it's not something >even on his radar screen to worry about. His bigger concern is having >Suzy or the wifey find the paltry pieces of porn he purloined. Privacy can and is an enormously powerful tool for global consumers, and like Garfinkel says, maybe it will take years to realize this economic reality, but it will be realized, sooner or later.. just not in the form that Tim May thinks.. >Or he's at work and his boss has just announced that several >employees have been fired for using the company's networks for >checking sports scores, downloading porn, usng Napster, etc. >These are Joe Average's _real_ concerns about privacy. Cute ads about >little girls needing their privacy probably won't sell ZKS Freedom to >Joe Average. I agree - I've always found the ZKS ad campaign to be rather distasteful in fact.. (the bar codes on people.. esp since the Internet doens't really operate by bar coding people and even if it did, ZKS wouldn't be able to do anything about it.. it's called FALSE ADVERTISING.. the FTC might have a thing or two to say about that..) >ZKS may do better by bundling Freedom with Danni's Hard Drive >accounts! "Your porn is downloaded to you in "Plain, Brown Wrapper" >format, disguised to look like a marketing report containing the key >words you specify. Your boss will think it's business, your wife will >be bored." >(No, I'm not suggesting this as any kind of real product. The market >is just too small, and downloading porn or Napster songs at work is a >lose for many good reasons. The proper solution is even more >straightforward: only fools download porn at company sites, and they >deserve to be fired. And if Joe Average doesn't have his own >_personal_ computer at home, they're cheap enough. No reason Little >Suzy should be doing her homework on the machine he has his porn on. >And even if he does, encrypted partitions are trivial to set up. >Plus, removable CD-RWs and Zips. "Zip--for when you don't want your >porn discovered by your wife!") >The second major use for privacy tools is preventing the "dossier >society" effect, where one's words in alt.sex.gerbils are archived >for all time and are seen by prospective employers, Senate >confirmation panels, etc. This is a likely market for ZKS Freedom. >Ah, except that utterly free and easy to use services like MyDeja and >MyYahoo and suchlike are dominant in this application area ("space"). Everything up to here is basically the ravings of a madman, so I'll leave it alone.. >It is routine to see "aardvaark42(a)mydeja.com" posts in nearly all >newsgroups. While these are not cryptographically robust, it's >unlikely these will ever be linked to true names. Especially as they >may be set up on the fly, through proxies, etc. That's a good point and that's basically what I've always said about "nyms".. you don't really need ZKS for a nym (Hushmail works fine for me), and even when you DO get one, the only thing it's good for is free speech, never for privacy. (Ever notice how privacy discussions are always framed in the context of commerce? Like what are the privacy policies of that bank or HMO? Or what is Amazon doing w/ my purchasing profile? AND YES, there are privacy threats from government, but you're never going to be able to *make money* by battling the government (like ZKS was trying to).. since we're talking about a business here (ZKS), I'll keep the discussion limited to commerce..) >Still, some fraction of people will pay for Freedom-type nyms. >Probably not $50 a year, as that is a significant fraction of their >entire ISP bill. But not a lot of people. And they won't pay much. >The real market for robust security and privacy tools is, as always, elsewhere. Financial services.. >The _interesting_ market has always been for those who >are--demonstrably!--willing to pay big bucks to get on >a plane to fly to the Cayman Islands or Luxembourg to open an >offshore account. For those who are actively interested in untraceable VISA >cards. For those selling arms. For those trafficking in illegal >thoughts. >In short, for crypto anarchy. No, this market is actually really really boring. It's too tiny and the opportunity for recurring revenue streams is too small and ... no.. I won't rip it apart any further.. >Not for fluff. >Will the new ZKS business model work? Maybe. But as Simson Garfinkel >points out in the article Declan wrote, this may take years to >develop. Until then, tough sledding. >MojoNation seems to be a lower burn-rate run at the real low hanging fruit. It's (vaguely) the right approach to privacy (going after the enterprise), and I'm sure ZKS has been pursuing for some time now (probably since I made those postings back in July). But in terms of being delivering privacy tools to the enterprise, they're already behind companies like Privada and PrivacyRight. I mean, granted I slammed Privada earlier for their weenie knock-off of Freedom, but at least they've been pursuing the enterprise market for some time now in earnest.. and as for PrivacyRight, it seems they've already made substantial inroads into the health care and financial services markets that ZKS claims it wants to pursue.. So what is ZKS really selling to enterprises? Is it anonymity software like Freedom? No business will ever buy this.. is it fancy, schmancy cryptography software? Again, I've sold security products to enterprises for years, and every CIO in America knows that security is not isomorphic to cryptography. No hacker in the world bothers trying to crack 40-bit encryption when he knows there are users on the enterprise network dumb enough to have username "Tim" and password "May".. this is a much easier way to subvert the network.. Security starts with good cryptography, but encompasses a great deal more (lots of policy, for one). Privacy starts w/ good security, but also encompasses a great deal more than plain, old vanilla security.. For this reason, if all ZKS is selling is cryptography, then good luck! you're already way behind the times.. And if ZKS is selling consulting hours, then thanks, but I think I'll take my budget to a place where they already have the whole privacy picture in focus (like PriceWaterhouse Cooper or Ernst & Young), not to a place where they just brag about cryptography all day long.. --Hushpart_boundary_iWCDbgAikNCcbLlDAWpLjBKeDnioBxsF-- IMPORTANT NOTICE: If you are not using HushMail, this message could have been read easily by the many people who have access to your open personal email messages. Get your FREE, totally secure email address at http://www.hushmail.com.

1 0

CDR: Implementing DSA in HArdware
by Brian Phillips 01 Nov '00

01 Nov '00

I am implementing DSA in Hardware and I was wondering if anyone knows about implementing very large dividers and multipliers in hardware. I am talking 160 bit here. Any help is appreciated. Thanks, Brian

1 0

CDR: Minesweeper could hold key to Net security
by An Metet 01 Nov '00

01 Nov '00

http://digitalmass.boston.com/news/daily/11/01/minesweeper.html By Gareth Cook, Boston Globe Staff, 11/1/2000 The key to solving one of the most vexing and profound problems of modern mathematics could lie in a most unusual place: Minesweeper, a simple computer game that rivals solitaire as an office time-waster. The math problem, called the "P versus NP conjecture," asks why some questions are so difficult to answer with computers. It is considered so important that in May the Clay Mathematics Institute in Cambridge offered a $1 million prize for a solution. Proving the conjecture false would mean that modern encryption technology, the foundation of electronic commerce, would be open to easy attack. In the spring issue of the journal Mathematical Intelligencer, a British specialist in mathematical logic demonstrated that the conjecture would be false if someone can crack Minesweeper, a game in which players race to clear a path through a sea of explosives. Mathematicians hope the insight, the topic of an open lecture tonight at Harvard University, would bring the public in on a drama that, among specialists, has generated the same fervor that mariners of another age once brought to their search for a passage around the world. ''I have sometimes dreamt that someone found a solution,'' said Michael Sipser, an MIT math professor who has spent two decades and ''about 15,000 hours'' searching for the secret. The dreams ''filled me with an intense mixture of curiosity and envy,'' he said. Engineers are already building processors that run faster than a previous generation could imagine, powering computers that can conquer chess or generate directions from Boston to Walla Walla, Wash., in an instant. But the ''P versus NP conjecture,'' Sipser said, is an attempt to draw, with mathematical certainty, the boundary beyond which computers, no matter how powerful, cannot cross. ''This is enormously fundamental,'' said Ian Stewart, who is delivering the Harvard lecture and is a columnist for the magazine Scientific American and professor at the University of Warwick in England. Minesweeper, which is included free with the Windows operating system, does not look like the kind of game that would fascinate theorists. The gamer clicks squares of a grid on which mines have been hidden. Numbers then appear, indicating the number of mines in surrounding squares. Using these clues, the aim is to find all the mines. Intrigued by the kind of logic puzzles the game generates, Richard Kaye of the University of Birmingham in England posed ''the minesweeper consistency problem'': Given a board of numbers, is it possible to determine whether the clues are consistent with the rules? This question took him to outer reaches of computer science and to the essence of the ''P versus NP conjecture.'' Many common problems, including multiplying large numbers or putting a list in alphabetical order, are what computer scientists call ''P'' problems, readily solvable by computer. On the other hand, ''NP'' problems seem far more difficult; the only known solution is to break the problem into a large, often prohibitively large, number of P problems. One example is the classic ''traveling salesman'' question: If a salesman has to visit certain cities, what is the fastest route? Breaking the codes used to protect Internet communications is also an NP problem. But perhaps, some mathematicians have suggested, the NP problems are actually no more difficult than P problems; they just look that way because nobody has been inventive enough to find an easy way to solve them. Although mathematicians assume this is wrong, they still have not been able to prove the resulting ''P versus NP conjecture'' true after more than two decades of intense labor and several false alarms. Kaye's contribution, scrawled on loose sheets of paper during his daily train ride to work, was showing that the ''minesweeper consistency problem'' is ''NP complete,'' that a solution would mean that all NP problems are easily solvable. So, write a program that can decode Minesweeper for any size board, and you will join the pantheon of mathematical greats, alongside Euler and Pythagoras. And, of course, there is that million-dollar prize. The prize offered for the ''P versus NP conjecture'' is one of seven different million-dollar prizes for what the Clay Mathematics Institute considers to be the most important mathematical challenges of the new millennium, according to Clay president Arthur Jaffe. In the meantime, word that minesweeper has attained a new veneer of respectability will no doubt be treated with caution by recovered addicts. ''The first night I started playing it, my wife woke up at 3 in the morning and said, `What are you doing?''' said Rick Kane, an orthopedic surgeon at Noble Hospital in Westfield. ''Now,'' he said with a tentative laugh, ''I'm going to have to start playing again.''

1 0

CDR: Re: California bars free speech of those cutting deals on votes
by Nomen Nescio 01 Nov '00

01 Nov '00

On Wed, Nov 01, 2000 at 05:26:09PM -0800, Greg Broiles wrote: > a la _Bivens v. Six Unknown Agents_, a Supreme court case whose citation > eludes me at the moment. Bivens v. Six Unknown Named Agents of Federal Bureau of Narcotics, 403 U.S. 388, 91 S.Ct. 1999, 29 L.Ed.2d 619 (U.S.N.Y. Jun 21, 1971). The remand is: Bivens v. Six Unknown Named Agents of Federal Bureau of Narcotics, 456 F.2d 1339 (2nd Cir.(N.Y.) Mar 08, 1972).

1 0

CDR: RE: digital angel (tracking device)
by Trei, Peter 01 Nov '00

01 Nov '00

> Sampo A Syreeni[SMTP:ssyreeni@cc.helsinki.fi] wrote > On Sun, 29 Oct 2000, Eric Murray wrote: > > >>The unit can be turned off by the wearer, thereby making the monitoring > >>voluntary. It will not intrude on personal privacy except in > applications > >>applied to the tracking of criminals. > > > >Heh. > > > >>Digital Angel[tm] measures bodily parameters. It does not interact with > >>the body chemically or biologically. Designed to be completely harmless, > >>Digital Angel will not interfere with bodily functions in any way... > > > >at least in this version. > > And pulling the last two together, we have Digital Angel/IE (Instant > Execution), for those really Bad Seeds. The plus model will zap the > offender if brought near Digital Angel/FC (For Children). > > Sampo Syreeni <decoy(a)iki.fi>, aka decoy, student/math/Helsinki university > Go check out Harlan Ellison's short story "Repent Harlequin! cried the Tick Tock Man". This is really life imitating art. Peter Trei

2 1

CDR: RE: California bars free speech of those cutting deals on votes
by Fisher Mark 01 Nov '00

01 Nov '00

>Radio is cheap and hot. When was the last time you heard a Libertarian >sentiment on radio (except talk radio). The closest I've heard are the "Vote >Freedom" ads by Charleton Heston. Last week I heard 2 different ads for Indiana LP candidates on a station that plays hip-hop, alternative, and pop music (Radio Now FM 93.1, Emmis Communications). The ads were paid for locally, IIRC. =============================================== Mark Leighton Fisher fisherm(a)tce.com Thomson Consumer Electronics Indianapolis IN "Display some adaptability." -- Doug Shaftoe, _Cryptonomicon_

1 0

CDR: RE: Zero Knowledge changes business model (press release)
by Carskadden, Rush 01 Nov '00

01 Nov '00

I remember running into a case where there was a system in place that worked somewhat like an encrypted CVS system. There was a central document czar, like you said, and when he left, the company realized how foolish it was to put a single employee in charge of the key. So then (not seeming to have truly learned from their mistakes) they gave copies of the new private key to members of the executive team. Then an executive left. I will not soon forget hearing of thousands of pages of documentation being systematically decrypted with the old key, and re-encrypted with a new key. The process apparently took quite an amount of time. I also remember my squeamishness about the fact that the CVS-like system was designed to encrypt and decrypt on the fly based on some cheesy authentication, so as to provide a way to maintain this system without having to talk to the key holders every time you needed to make a change. The entire system was a big messy nightmare, and when considered carefully, really didn't provide much in the way of security. It would have been much easier for them to put a system in place that required multiple people to sign off on a document for it to be encrypted or decrypted. I took a lot of notes at the time on how I thought this sort of system could be implemented... I should dig it up and see what I was thinking. ok, Rush -----Original Message----- X-Loop: openpgp.net From: Eric Murray [mailto:ericm@lne.com] Sent: Wednesday, November 01, 2000 3:21 PM To: Multiple recipients of list Subject: Re: Zero Knowledge changes business model (press release) On Wed, Nov 01, 2000 at 03:56:56PM -0500, David Honig wrote: > > At 12:13 PM 10/31/00 -0500, Tim May wrote: > >How about: > > > >-- no key escrow, no split keys, no trusted third parties > > I don't see any way around the fact that some companies will want to have > key escrow of some form for employees who disappear, e.g., car accident, > pickpocket stole the key-carrier, etc. I think companies will want this > because of the risks of financial damage to the company. > > Although its hazardous if done wrong [cf recent PGP problems], is > tarnished by the Fedz/Denning/etc, and might have no use in a personal > privacy tool (your diary dies with you), isn't it too dogmatic to rule out > key escrow for tools intended for use by groups? > > Are there equivalent methods which don't use escrowed keys, which I > am unaware of? I beleive it was Eric Hughes who at a Cypherpunks meeting about four years ago, said "the solution isn't key escrow, it's document escrow". Which makes sense- a business doesn't (or shouldn't) allow employees to keep a single copy of an important document on their hard drive. It should be replicated in other known places in case of disaster (drive failure, stolen computer, employee hit by bus, etc). Just because documents are encrypted doesn't mean that this practice is abandoned. One can envision a system where there's a corporate "document czar" who is regularly given docs from various employees and who then encrypts them in his own key. When and where the docs get decrypted is determined by corporate policies. No key escrow required. I don't know of any existing system like this, but formal corporate document control isn't my field. -- Eric Murray Consulting Security Architect SecureDesign LLC http://www.securedesignllc.com PGP keyid:E03F65E5

1 0

CDR: RE: nsa watch
by Carskadden, Rush 01 Nov '00

01 Nov '00

"Netsec differs from its competitors in that it designs and builds its own hardware- and software-management systems, and it produces its own crypto-acceleration cards, Mr. Harold says. The company installs, monitors, and runs the systems for fees starting at $12,000 per solution." Hrmm.... do I really want a crypto solution built and managed by NSA guys? ok, Rush -----Original Message----- X-Loop: openpgp.net From: David Honig [mailto:honig@sprynet.com] Sent: Wednesday, November 01, 2000 3:49 PM To: Multiple recipients of list Subject: nsa watch from elsewhere: FORMER NSA EMPLOYEES LAUNCH CYBER SECURITY BUSINESS http://www.redherring.com/vc/2000/1019/vc-spies101900.html MEANWHILE, NSA SEEKS NEW EMPLOYEES ON-LINE. (submitted by Jeremy Compton) http://www.nsa.gov/programs/employ/index.html

1 0

CDR: nsa watch
by David Honig 01 Nov '00

01 Nov '00

from elsewhere: FORMER NSA EMPLOYEES LAUNCH CYBER SECURITY BUSINESS http://www.redherring.com/vc/2000/1019/vc-spies101900.html MEANWHILE, NSA SEEKS NEW EMPLOYEES ON-LINE. (submitted by Jeremy Compton) http://www.nsa.gov/programs/employ/index.html

1 0

CDR: Re: California bars free speech of those cutting deals on votes
by Anonymous 01 Nov '00

01 Nov '00

Tim May wrote: > (In that I'll feel better in coming years being able to think to > myself: "I didn't vote for that Bush clown...I voted my principles!") > However, as any vote is of marginal importance, as with the > amelioration issue you mention, I'm still undecided. Needless to say, > neither Gore nor Nader are in my universe of choices, however. Aside from whatever emotional gains you might make by voting for Browne on grounds of principle, that action has the added (albeit marginal) benefit of increasing Libertarian party legitimacy in the public eye. Admittedly, a single vote will have no effect on percentages in a national election, but in the local arena, helping the party achieve 5% or even 1% of the vote will frequently secure ballot access next time around.

2 1