September 2001 - cypherpunks-legacy

Re: FC: Op-ed on encryption: Privacy is no longer an argument
by Jim Warren 21 Sep '01

21 Sep '01

>http://www.wartimeliberty.com/article.pl?sid=01/09/21/0450203 > > Crypto Op-Ed: Privacy No Longer an Argument > posted by admin on Thursday September 20, @11:39PM > > M. W. Guzy has a provocative and not entirely coherent essay > in Wednesday's St. Louis Post-Dispatch. Excerpt: "(Then-Senator > John) Ashcroft wrote that mandating deciphering tools was tantamount > to requiring 'individuals to surrender the keys to their house... to > the FBI just in case they are someday suspected of breaking the law.' > Somehow, that argument rings a little hollow when viewed through the > smoldering ruins of the World Trade Center... SHEESH! Are these anti-secure-crypto advocates REALLY that INCREDIBLY stupid and naive?! The thing that continues to drive me bonkers about this kind of simplistic crap is that pretends aht Trade Center bombers, international terrorists, child molesters and murders will stop using globally-available strong crypto just because a law prohibits it, or give up ("escrow") their crypto keys just because a law requires it! EVERY time we circulate yet-another idiot's message like this -- calling for limits on secure crypto or forced key escrow -- ALL of us NEED to attach a head-note pointing out that terrorists et al, are HARDLY likely to obey that law ... that instead, it will ONLY be law-abiding businesses and citizens who will LOOSE the ability to protect their sensitive corporate and personal communications (*and* files!) from competitors, foreign spies, and nosy voyeurs. --jim Jim Warren; jwarren(a)well.com, Senior Contributing Editor, MICROTIMES Magazine 345 Swett Rd, Woodside CA 94062; voice/650-851-7075; fax/off due to spam-glut [self-inflating puffery: InfoWorld founder; Dr.Dobb's Journal founding editor; PBS-TV Computer Chronicles founding host; DataCast Magazine founder; John Dvorak Lifetime Achievement Award; Autodesk Board of Directors (1990-95); Electronic Frontier Foundation Pioneer Award (in its first year); Soc.of Prof.Journalists-Nor.Calif. James Madison Freedom-of-Information Award; Playboy Foundation's Hugh Hefner First-Amendment Award; blah blah blah] ************************************************************************** Subscribe to Freematt's Alerts: Pro-Individual Rights Issues Send a blank message to: freematt(a)coil.com with the words subscribe FA on the subject line. List is private and moderated (7-30 messages per week) Matthew Gaylor, (614) 313-5722 ICQ: 106212065 Archived at http://groups.yahoo.com/group/fa/ **************************************************************************

1 0

Re: FC: Op-ed on encryption: Privacy is no longer an argument
by Jim Warren 21 Sep '01

21 Sep '01

>http://www.wartimeliberty.com/article.pl?sid=01/09/21/0450203 > > Crypto Op-Ed: Privacy No Longer an Argument > posted by admin on Thursday September 20, @11:39PM > > M. W. Guzy has a provocative and not entirely coherent essay > in Wednesday's St. Louis Post-Dispatch. Excerpt: "(Then-Senator > John) Ashcroft wrote that mandating deciphering tools was tantamount > to requiring 'individuals to surrender the keys to their house... to > the FBI just in case they are someday suspected of breaking the law.' > Somehow, that argument rings a little hollow when viewed through the > smoldering ruins of the World Trade Center... SHEESH! Are these anti-secure-crypto advocates REALLY that INCREDIBLY stupid and naive?! The thing that continues to drive me bonkers about this kind of simplistic crap is that pretends aht Trade Center bombers, international terrorists, child molesters and murders will stop using globally-available strong crypto just because a law prohibits it, or give up ("escrow") their crypto keys just because a law requires it! EVERY time we circulate yet-another idiot's message like this -- calling for limits on secure crypto or forced key escrow -- ALL of us NEED to attach a head-note pointing out that terrorists et al, are HARDLY likely to obey that law ... that instead, it will ONLY be law-abiding businesses and citizens who will LOOSE the ability to protect their sensitive corporate and personal communications (*and* files!) from competitors, foreign spies, and nosy voyeurs. --jim Jim Warren; jwarren(a)well.com, Senior Contributing Editor, MICROTIMES Magazine 345 Swett Rd, Woodside CA 94062; voice/650-851-7075; fax/off due to spam-glut [self-inflating puffery: InfoWorld founder; Dr.Dobb's Journal founding editor; PBS-TV Computer Chronicles founding host; DataCast Magazine founder; John Dvorak Lifetime Achievement Award; Autodesk Board of Directors (1990-95); Electronic Frontier Foundation Pioneer Award (in its first year); Soc.of Prof.Journalists-Nor.Calif. James Madison Freedom-of-Information Award; Playboy Foundation's Hugh Hefner First-Amendment Award; blah blah blah] ************************************************************************** Subscribe to Freematt's Alerts: Pro-Individual Rights Issues Send a blank message to: freematt(a)coil.com with the words subscribe FA on the subject line. List is private and moderated (7-30 messages per week) Matthew Gaylor, (614) 313-5722 ICQ: 106212065 Archived at http://groups.yahoo.com/group/fa/ **************************************************************************

1 0

Re: Government credentials and picture IDs
by Meyer Wolfsheim 21 Sep '01

21 Sep '01

On Fri, 21 Sep 2001, Tim May wrote: > It's too bad so many people are so confused about what a "Web of Trust" > is. > > Do I need a "positive picture ID" of Lucky Green to communicate with him > securely? Black Unicorn? Pr0duct Cypher? Eric Hughes? Attila the Hun? > > The notion that a particular credential with a picture on it means > anything, or should be given weight, is one of the most dangerous ideas > there is. For the obvious reasons. > > As a hint, the people you _don't_ want to trust are a helluva lot more > likely to have nice, neat picture IDs than people like Lucky Green are. > > --Tim May (not my true name) To elaborate a little, In the PGP-style "Web of Trust", each user is effectively his own Certificate Authority. Likewise, each user has his own form of CPS. Some users will indiscriminately sign other people's keys. Some users will require "government issued ID". Some users will require that they personally know another person for some set amount of time before signing his key. By signing a key, you are, in effect, asserting to the world a belief in the identity of the key holder. One can communicate securely with other users even if he never signs another person's key. Signing is entirely optional -- a service, so to speak, to the other members of one's community. (Indeed, there are more than a few cypherpunks who do not sign keys at all, because of the information it reveals about their associations with others.) Those of us who know better would not rely on a simple picture ID to prove identity. Likewise, we would not put much faith in certifications made by someone who used that criteria for verification. But PGP users are free to use whatever means they like in "verifying" identities. The problem I see in "V Alex Brennen's" announcement is that he is requiring photo-ID for a key signing party. The *only* function a key signing party serves is to facilitate the pairing of keys (by their fingerprints) with bodies (either individuals, or organizations represented by the proper individuals). The key signing party organizer's responsibility ends there. He should not be dictating key signing policy to the end users. Picture IDs are just one of many methods of determining identity, and as Tim points out, a poor one, and useless for pseudonyms. In the case of a conference or other gathering of strangers where a large key signing party is planned, it is my recommendation that, rather than each individual signing keys of other conference attendees (unless there is an existing trust relationship between individual attendees), the conference organizers create a conference signing key with which to sign attendees' keys. This provides information about the key (it was presented at such-and-such a conference by a person calling himself so-and-so) and also clearly defines the limits of this information. Users can later take that into account when evaluating whether or not to "trust" the signed key. (Many of us will find this certification useless, and others will find it undesirable for the information it leaks about us. Which is why key signings are voluntary.) -MW-

1 0

IRS, Deceit, Rats, Narcs
by John Young 21 Sep '01

21 Sep '01

Ashcroft's anti-terrorism bill proposes allowing IRS data to be shared with law enforcement and intelligence agencies. As if that would be a new. The bill would also lift the stay of US attorneys taking part in illegal undercover work. As if that was new. Bush has asked citizens to inform on their neighbors, as if that was new. Narcs in the militia have called for defense of the homeland while the military is engaged elsewhere. Recall the IRS manual for undercover operations which states these strategems are already in use.

1 0

Conservative Forum: Threat is not FBI, cops need crypto-access
by Declan McCullagh 21 Sep '01

21 Sep '01

----- Forwarded message from Declan McCullagh <declan(a)well.com> -----

1 0

Government credentials and picture IDs not a useful thing for Cypherpunks to require
by Tim May 21 Sep '01

21 Sep '01

On Friday, September 21, 2001, at 11:04 AM, V Alex Brennen wrote: > A key-signing party is a get-together with PGP users for the purpose of > meeting other PGP users and signing each other's keys. This helps to > extend the "web of trust" to a great degree. Also, it sometimes serves > as > a forum to discuss strong cryptography, computer security, and related > issues. > > > Required Items? > > 1. Physical attendance > 2. Positive picture ID > 3. A printout of your PGP key's fingerprint information > 4. A pen/pencil or whatever you'd like to write with It's too bad so many people are so confused about what a "Web of Trust" is. Do I need a "positive picture ID" of Lucky Green to communicate with him securely? Black Unicorn? Pr0duct Cypher? Eric Hughes? Attila the Hun? The notion that a particular credential with a picture on it means anything, or should be given weight, is one of the most dangerous ideas there is. For the obvious reasons. As a hint, the people you _don't_ want to trust are a helluva lot more likely to have nice, neat picture IDs than people like Lucky Green are. --Tim May (not my true name)

1 0

Open Meeting: RAND Congressional Advisory Panel on WMD Terrorism
by auto301094＠hushmail.com 21 Sep '01

21 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Congressional Advisory Panel to Assess Domestic Response Capabilities for Terrorism Involving Weapons of Mass Destruction (The Gilmore Commission) Next meeting: Sept. 24th from 9:00 am until 4:00 pm at the RAND Washington Office - 1200 North Hayes Street. Boilerplate: "The Advisory Panel will assess the capabilities for responding to terrorist incidents in the U.S. homeland involving weapons of mass destruction. Response capabilities at the Federal, State, and local levels will be examined, with a particular emphasis on the latter two. The Secretary of Defense, in consultation with the Attorney General, the Secretary of Energy, the Secretary of Health and Human Services, and the Director of the Federal Emergency Management Agency, has entered into a contract with the National Defense Research Institute (NDRI), a federally funded research and development center (FFRDC) at RAND, to establish the Advisory Panel in accordance with Section 1405 of the National Defense Authorization Act for Fiscal Year 1999, Public Law 105-261 (H.R. 3616, 105th Congress, 2nd Session) (October 17, 1998)." Interesting background PDF: "Toward a National Strategy for Combating Terrorism" http://www.rand.org/nsrd/terrpanel/terror2.pdf RAND site: http://www.rand.org/nsrd/terrpanel/ -----BEGIN PGP SIGNATURE----- Version: Hush 2.0 wl8EARECAB8FAjurg90YHGF1dG8zMDEwOTRAaHVzaG1haWwuY29tAAoJEKadvsVlUK4P mV8AnRwIRyTYZpsFkPyHMNGYLahmtT53AJ9a9X3rVJc+GXPxPKdMSjpEjBrfAw== =I+NA -----END PGP SIGNATURE-----

1 0

ANNC: PGP Key-signing party @ ITSA Day in Gnv. Fl, USA
by V Alex Brennen 21 Sep '01

21 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In the interest of helping organizations attending the ITSA Security Day conference establish a best practices model of computer security policy, e-TechServices.com will be sponsoring a PGP Key-signing party. The PGP key-signing party held during the ITSA Security Day on Wednesday, September 26th, 2001 from 12:15pm - 12:45pm at the e-TechServices.com table at the Retiz Union in Gainesville, Florida. Full details at: http://www.e-techservices.com/events/key_signing_party.html What's a key-signing party? A key-signing party is a get-together with PGP users for the purpose of meeting other PGP users and signing each other's keys. This helps to extend the "web of trust" to a great degree. Also, it sometimes serves as a forum to discuss strong cryptography, computer security, and related issues. Required Items? 1. Physical attendance 2. Positive picture ID 3. A printout of your PGP key's fingerprint information 4. A pen/pencil or whatever you'd like to write with Why should I use PGP? You should use PGP, in order to protect your business and personal emails from being read by individuals or entities other than your intended recipient(s). You should also use PGP in order to protect against the forgery or alteration of official communications from your organization. PGP, when used correctly, can provide message privacy, message integrity, message authentication, and to some degree non-repudibility. OK. What are some good applications of PGP? Protection of email traffic of a sensitive nature, such as the coordination of response to ongoing security incidents, requests for DNS modifications, the exchange of passwords, requests for networking changes, and exchange of sensitive personal information like SSNs. At the very least, it would be useful to have all such messages signed, so the recipients could be sure that the notes were not forged. PGP can also be used to provide the same protection in the area of computer software distribution. For example PGP can be used in software distribution where security is critical, such as in the distribution of computer security patches or other security related software updates. Why should I participate in the ITSA Day keysigning party? The formation of a robust web of trust with a deep level of interconnectivity is the foundation for the security and utility of PGP. Participating in the key signing event will allow you to become integrated into the web of trust and thereby place your organization and yourself in a position to enjoy the benefits of the PGP technology. Participation will also help to promote the use of PGP and reinforce people currently using PGP resulting in a more safe and secure computing environment for us all. The more people who use PGP, the stronger PGP becomes. A graph of the Web of Trust formed at recent keysigning parties in Gainesville is available at: http://www.cryptnet.net/fdp/crypto/strong_distro/full-wot.png Please, forward this note to anyone who may be interested in attending. Also, please fee free to contact me for personal assistance with key generation or additional information on participating. Links: <A HREF="http://www.itsa.ufl.edu/">ITSA Security Day</A> <A HREF="http://www.e-techservices.com/">e-TechServices.com</A> - VAB - --- V. Alex Brennen [vab(a)cryptnet.net] [ http://www.cryptnet.net/people/vab/ ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQE7q20i+pIJc5kqSz8RAkfJAJ9nwZHJw0OzWf7IkP86I0VI4G62rwCgq9l5 rj3D7hWQSDa7nQkWCor0KlI= =+4s+ -----END PGP SIGNATURE-----

1 0

Re: Avoid hard targets tomorrow
by Nomen Nescio 21 Sep '01

21 Sep '01

>AMERICA and the West are bracing themselves for another potential >"Day of Infamy" this Saturday, when accomplices of the hijackers are >suspected of having plotted new outrages. It would be stupid to hit now. The terrorists will wait until after the U.S. takes overt action. Their counter-blow will then have the most impact. If Americans learn that every time their troops attack, American civilians die, it will increase pressure to end the campaign. Terrorists might have scheduled something for Saturday, on the assumption that the U.S. would have attacked by now. But the unexpected restraint on the part of the U.S. leadership will require a revision to the timetable. >The three, Ahmed Hanna, 33, Karim Koubriti, 23, and >Farouk Ali-Halmoud, 21, from Morocco and Algeria, worked at Detroit >Metropolitan Airport preparing food for airlines. Is this why the airlines are going to stop serving food?

1 0

invitation to a terrorist conspiracy
by mattd 21 Sep '01

21 Sep '01

Assasination politics was originally proposed for saddam,wasnt it? After several months of hard work and 1 arrest/computor confiscation(no charges) Operation soft drill just received what I believe was genuine pledge,this occured just prior to doomsday. The pledge was for the retirement of richard armitage,btw. Now its hung for shagging a sheep as a lamb time. Big time. I pledge 1$ for the closest prediction of the permanent retirement from politics of the honourable osama bin laden. The SS know where I live,so Im your canary in this coal mine. How about a little anon(of course)backup.I know your not all not plastic anarchists. And the US is a paper tiger.

1 0