December 2003 - cypherpunks-legacy

CDT Policy Post No.34 - Victory for Zimmermann, Fundamental Privacy Issues Remain
by editor＠cdt.org 17 Dec '03

17 Dec '03

Apologies to those of you who are also on the CDT Policy Post distribution list, but I felt that this issue was sufficiently important to cc to the cypherpunks list. Hope you find this relevant, Jonah Seiger CDT editor ------------------------------------------------------------------------ ****** ******** ************** ******** ********* ************** ** ** ** *** POLICY POST ** ** ** *** ** ** ** *** January 12, 1996 ** ** ** *** Number 34 ******** ********* *** ****** ******** *** ------------------------------------------------------------------------ A briefing on public policy issues affecting civil liberties online ------------------------------------------------------------------------ CDT POLICY POST Number 34 January 12, 1996 CONTENTS: (1) A Victory for Phil Zimmermann, Fundamental Privacy Issues Remain (2) Press Release Announcing DOJ's Decision to Drop Case (3) Subscription Information (4) About CDT, Contacting Us This document may be re-distributed freely provided it remains in its entirety. Excerpts may be re-posted by permission (editor(a)cdt.org) ------------------------------------------------------------------------ (1) VICTORY FOR ZIMMERMANN, FUNDAMENTAL PRIVACY ISSUES REMAIN After 3 years of investigation, the United States Department of Justice Thursday (1/11) announced that it would not seek an indictment of Phil Zimmermann, the author of the widely popular encryption program known as Pretty Good Privacy (PGP). While this development is obviously good news for Zimmermann, who was the undeserved target of a long and arduous investigation, criminal threates against those who seek to protect their privacy remain in place. The Justice Department had been investigating Zimmermann for possible violations of Arms Control Regulations of after PGP was posted to Usenet newsgroups and subsequently distributed through the worldwide Internet in the spring of 1991. CDT wishes to extend heartfelt congratulations to Phil, who has demonstrated remarkable patience and perseverance in the face of harassment and intimidation by the Federal Government. Instead of laying low and waiting for the outcome of the investigation, Phil took the offensive and became the leading figure in the effort to provide easy to use, strong cryptographic applications to the masses. CDT hopes that Phil will remain active in the fight to encourage the relaxation of export restrictions and access to strong cryptography. FUNDAMENTAL ISSUES REMAIN -- EXPORT OF STRONG CRYPTOGRAPHY STILL PROHIBITED, FUTURE PROSECUTIONS OF CRYPTOGRAPHERS BY THE FEDERAL GOVERNMENT STILL POSSIBLE Although the announcement by the Justice Department is a tremendous personal victory for Phil Zimmermann, government restrictions on encryption exports remain firmly in place. As such, the current Administration policy is a major roadblock to privacy and security, as well as the future of commerce, on the Internet. The Clinton Administration continues to push for a national cryptography policy based on key-escrow and limited key lengths. In addition, the Administration's current policy proposal seeks to use export controls as a means to influence the domestic marketplace for cryptographic applications. The decision to drop the case against Zimmermann also leaves unresolved the question of whether posting materials on the Internet could result in the violation of export control regulations. Although Zimmermann's defense was based in part on the argument that the First Amendment protects such postings, that question remains undressed. As a result, developers of strong cryptographic applications who make their programs available on the Internet may in the future face harassment and indictments from the Federal Government. This issue is currently pending before Federal Judges in the Karn and Bernstein cases. BACKGROUND ON THE DISPUTE The export of cryptographic applications with key lengths above 40 bits is currently illegal under the International Trafficking in Arms Regulations (ITAR). The Government maintains that these restrictions are necessary in order to protect national security, and has successfully fought efforts to repeal or relax the export controls (including efforts by fmr. Rep. Maria Cantwell (D-WA) in 1994). Privacy advocates and the computer hardware and software industry argue that the export controls stifle the development of strong cryptography both domestically and internationally, undermining privacy and security on the global information infrastructure. When Zimmermann published PGP in 1990, it was among the first widely available and relatively easy to use cryptographic applications, and for the first time provided the average citizen with the ability to protect sensitive information on the relatively insecure Internet. In the eyes of the Government however, PGP represented a threat to national security and law enforcement. Although the government has announced that it will not prosecute Zimmerman, government efforts to restrict the distribution of strong cryptography will no dobut continue. As privacy advocates, we must not allow Zimmermann's victory to conceal the larger issues. Privacy, security, and commerce on the Internet remain hostage to export restrictions, the National Security Agency, and Clinton Administration efforts to impose an unworkable key-escrow regime. For more information on the Administration's current cryptography policy initiative and what CDT is doing to fight it, visit CDT's cryptography issues web page. URL:http://www.cdt.org/crypto.html For More Information Contact: Daniel J Weitzner, Deputy Director <djw(a)cdt.org> Center For Democracy and Technology +1.202.637.9800 ----------------------------------------------------------------------- (2) DOJ PRESS RELEASE ANNOUNCING THE DECISION TO DROP THE ZIMMERMANN CASE United States Attorney Northern District of California ______________________________________________________________________ San Jose Office (408) 535-5061 280 South First Street, Suite 371 San Jose, California 95113 FAX: (408) 535-5066 PRESS RELEASE FOR IMMEDIATE RELEASE January 11, 1995 Michael J. Yamaguchi, United States Attorney for the Northern District of California, announced today that his office has declined prosecution of any individuals in connection with the posting to USENET in June 1991 of the encryption program known as "Pretty Good Privacy." The investigation has been closed. No further comment will be made by the U.S. Attorney's office on the reasons for declination. Assistant U.S. Attorney William P. Keane of the U.S. Attorney's Office in San Jose at (408) 535-5053 oversaw the government's investigation of the case. ------------------------------------------------------------------------ (3) SUBSCRIPTION INFORMATION CDT Policy Posts, which is what you have just finished reading, are the regular news publication of the Center For Democracy and Technology. CDT Policy Posts are designed to keep you informed on developments in public policy issues affecting civil liberties online. In order to subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (4) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance constitutional civil liberties and democratic values in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1001 G Street NW * Suite 500 East * Washington, DC 20001 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post No. 34 1/12/96 -----------------------------------------------------------------------

1 0

(fwd) e$: Starting an Avalanche
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: e$(a)thumper.vmeng.com Mime-Version: 1.0 From: rah(a)shipwright.com (Robert Hettinga) Date: Fri, 12 Jan 1996 13:02:27 -0500 Precedence: Bulk To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: e$: Starting an Avalanche -----BEGIN PGP SIGNED MESSAGE----- e$: Starting an Avalanche 1/12/96 Boston, Massachusetts The most interesting thing I've read in quite a while is a reprint of the March 31,1995 issue of Esther Dyson's Release 1.0, which, I understand, was the first time someone other than Esther herself edited an issue. The editor was none other than Eric Hughes, of cypherpunks fame, and the topic was, of course, e$. Well, he didn't up and say "e$" anywhere, exactly, the title of the whole issue was "A Long-Term Perspective on Electronic Commerce", but he was talking about e$ just the same. Eric told me about this magnum opus when he came to help me talk about e$ at Apple in December. It was the first time I had heard of it, and when I talk to people who are interested in these things, it's the first they've heard of it, too. Blink once, and you miss the good stuff, I guess.. I won't go too much into what he said there, as I'm still digesting it, and it's frightfully copyrighted, but I'm sure you can get reprints from EDventure Holdings, Esther's company, by sending e-mail to their circulation and fulfillment manager, Robyn Sturm, robyn(a)edventure.com . You can definitely tell Eric wrote it, though. When Eric's really cooking, it's like he invents this whole language to describe what he's talking about. In this case, that's a good thing, because most of what he talks about he has to invent as he goes along. Anyway, it's 28 single-spaced elite-pitched pages of pure Eric, and it's manditory reading for anyone who wants to sit in on an advanced e$ colloquium from the comfort of their own living room... I'm taking, as my text for today's sermon (say "amen!", somebody), the following, from Eric's Release 1.0 issue, page 19: "Multiparty compatibility. "A software product launch is a two-party negotiation. Software vendors write products for a given operating system and persuade consumers to buy it. This is a standard retail transaction. Prospective sellers of a money system, however, have a four-party negotiation: the money system vendor, consumers, merchants and financial intermediaries. That is, there is one seller and three buyers, each of which has different system requirements. "Consumers have microcomputers or PDAs or smart cards. Merchants vary widely by size; each will hve different requirements for operations size. Banks and other intermediaries require extremely reliable transaction processing systems. No single vendor will be able to meet all these requirements. Anybody who expects to provide the entire technology infrastructure for a new money system will fail outrightly and completely. Success will require partnerships at the very least. Open standards will be even more likely to succeed. "This criterion against isolation cuts out several would-be contenders from my book right away: Netbank, Digicash and the academic projects NetBill and NetCheque. This is not to say that these companies won't have businesses, but rather that their ventures will always remain small." Now, this was written in, say, February of last year. A year ago. What amazed me was that it was exactly what I was talking to someone about last week. I love this stuff... Now I'm not bashing any of the above payment schemes, here, but there is a lot of the old industrohierarchical (see, Eric, I do neologism too!) mindset in what a lot of e$ protocol developers are doing out there. With that in mind, I'm going to step into *my* version of e$-Life, - -the-Universe and -Everything, and I'm going to do it with a model for distributing digital bearer certificates of various kinds, starting with digital cash, but easily extensible to any kind of digital bearer certificate. Definitions As Eric said, there are at least 4 players in any money system. I hope I may be excused if I tweak this a bit... Consumer The first player is the consumer. This is the person who purchases a digital bearer certificate for some reason. In the case of a digital cash certificate, this person is buying a piece of digital cash from someone else, for some other kind of money, in order to effect a transaction on the net later. Merchant It gets more complicated a little later, but, for the time being, this is a person who accepts a digital bearer certificate in exchange for something else. Usually this person is a commercial entity, and thus needs to be able to test the certificate, on-line with the underwriter, before accepting it, in order to prevent double-spending and reduce the risk of the transaction. Underwriter This is the entity which issues the certificates, and is responsible for exchanging them into other forms of money or certificates of other kinds. The second most important thing an underwriter does is to verify that certificates haven't been double-spent. The most important thing an underwriter does is to market its certificates. Trustee A trustee holds the money for the underwriter while it's on the net. Like bond trustees, the trustee works for "shareholders", the holders of the digital certificates, according to an agreement between the underwriter and the certificate holders. Typically, the trustee is a bank, since certificates are usually settled for money. Software Developer Off of the net, there are consumers, underwriters and trustees of physical certificates. We haven't really introduced any really net-specific features. Here's where we do. Since digital certificates are digital objects, they're created and handled by software and moved around on networks. The second most important thing that developers of digital bearer certificate software do is to write software which issues, verifies, and handles digital bearer certificates. The most important thing that developers of digital bearer certificate software do is to market their software to consumers, to trustees, and to underwriters. A software developer can develop all kinds of different software and market that code to any market that's out there: vertical, functional, or any niche that makes money. A developer can make wallets, which can do peer-to-peer or client-server transactions, or cash registers, which do on-line transactions involving the underwriter to validate certificates against double spending, or mints, which produce and validate the digital certificates themselves. A developer can even subdivide those major software objects into smaller peices, if there's a market for it. Protocol Inventor Protocol inventors are the people who had the idea to begin with. They figured out how to generate, handle, verify, and transmit this particular type of digital bearer certificate, and typically have patents on the process. The second most important thing a protocol inventor does is design cryptographic protocols, licence them, and validate their implementation. The most important thing a protocol inventor does is market their protocols to software developers, to underwriters, and, in the early stages, to trustees. A prima facie retread Yes, it's time for Hettinga to trot out his now-threadbare (I'll say "time-tested") business model for digital cash, and show how this all works. Of course, you can use digital bearer certificates for all kinds of things besides cash, and I contend in my more unrestrained moments, that *any* security can be issued as a digital bearer certificate, but's let's stick with digital cash here, for the time being. The protocol inventor is a cryptographer who has a brainwave one day and invents a digital bearer certificate protocol. He announces it, patents it if possible, lots of other cryptographers vet it, and it works. Potential underwriters, software developers, and even trustees blow apart his e-mail server asking him when he's going to let them build code, businesses, or whatever it is they want him to let them build. The inventor convenes a group of interested developers, and they start working out how to implement the protocol into code. The inventor makes deals with all of them. When they've finished their code, he'll certify that their code adheres to the protocol, and they'll pay him a licence, or a certification fee, or whatever. The inventor also starts to chum the water for underwriters, even though the developers are the people who're going to be actually closing deals with them, and trustees, even though the underwriters are going to be actually closing deals with *them*. So, the day comes, and people are actually buying these certificates. The consumer buys, from one of many software developers, or is given, by one of many underwriters, a wallet, which allows the storage and disbursement of digital bearer certificates, either on-line or off-line. I personally believe that there will be off-line transactions between people who trust each other enough, caveat vendor ;-). The consumer goes to a web page. Think of this web page as the equivalent of an automatic teller machine. As such, it has at least link-, and hopefully internet-level encryption to the user's machine. Not only that, but the consumer's account information is probably encrypted so that not even the underwriter sees it, in the same way that the Cybercash protocol works now. If the consumer's machine has a card swiper, then he swipes a card and enters a pin number. He could also store this information encrypted on his hard drive, and just type a passphrase to release it. He could also have all this on a smart card. Software and hardware vendors will build what consumers, underwriters, and trustees want to use. The request and authorization for cash goes over the net, through the underwriter and the ATM network to the consumer's bank, who sends an authorization message back to the underwriter to disburse digital cash certificates in the amount of the consumer's request. At least that's the way it would work for the time being. It's easy to see that, if the consumer's bank was on the net, the transmission authorizing disbursement to the underwriter could just go over the net itself. The bank and the underwriter settle with a fed funds wire. For the time being, anyway. ;-). The underwriter then issues the certificates to the consumer in the desired denominations, in addition to whatever fee the underwriter charges, in the same way traveller's checks are sold at a premium at the time of sale. The money from the consumer's bank goes to the underwriter's account at his trustee bank, collecting interest, payable to the underwriter, until the money comes back off of the net someday, payable to the redeemer at par (the value of the denomination of the certificate). The consumer then buys something on-line from a merchant, or off-line from another consumer (or a merchant who can't afford the security of an on-line transaction, and believes the risks are worth it), who then either spends the cash certificate somewhere else or redeems the certificate through the underwriter, who in turn has his trustee wire the money to the merchant's bank. Wearing too many hats When you break the world up the way I have above, you see the world of digital certificates in very interesting terms. First of all, you can see what Eric was talking about. Lots of people in the digital cash business are trying to wear too many hats. Underwriters who are also trustees, protocol inventors developing software, merchants who are software developers. Remember my contention elsewhere that the worst thing you can do in a geodesic market is to create industrial scale-economy hierarchies. The more independent entities you have, doing different things in as market-driven a fashion, the better. The instantaneity of communication and the multiplicity of information processors continually lowers the cost to entry and makes markets very competitive, forcing lots of innovation and product evolution. Concentrations of information, or any other resource, get "surfacted" into the lowest possible reaches of the network as processor prices fall. In InfoWorld a couple of months ago, I compared Microsoft to a dog in the manger in this regard, and you can see what they're trying to do now that they figured out that their monopolistic desktop strategy won't hunt on the internet. Now What? So. You've developed the be-all, end-all digital bearer certificate protocol. What do you do? The most important thing you can do is to develop, validate, and above all, promote your protocol. Anything else is not only inefficient, but, in the worst scenario, it can be considered a threat to one or more of the other players in the system, and no one will adopt it. Your protocol is stillborn. The thing you want to do is to create as many software developers, as many underwriters, and as many trustees as possible. Why? The more underwriters you have, the more people are using your protocol. Remember, the underwriters are charged with actually marketing the certificates themselves. Also, the more underwriters there are, the more robust your certificate system is, because there is no single point of failure -- economic, operational, or otherwise -- in the system. The more trustees you have, the more faith everyone has in the system. The social and legal parts of your protocol are enforced by the trustees. They're there to hold the stakes and keep everyone honest. To prevent repudiation of the certificates by the underwriters themselves by making them hold a respectable reserve against the certificates outstanding, for instance. In addition, the trustees could be used to settle certificates from one underwriter against those of others. That's already built into the banking system, with various central bank wires and clearing associations. In the model above, the trustee is the link to the non-net economy. It is the ultimate settlement mechanism because, for the time being, digital cash has to be denominated in other currencies. Certainly, like any method of abstracting value, digital cash cannot exist if it is not immediately convertable into other things of value, so there will always be those who are responsible for guaranteeing those conversions. In my model, and in non-net securities markets, those people are the trustees. The more developers you have, the more competition there is to build software which creates, handles, and verifies the certificates as efficiently and reliably as possible. Like underwriters, software developers are responsible for marketing *their* products -- the wallets, the cash registers, the mints, that your protocol requires in order to function -- to the various participants in the digital certificate market. That means that you have to be as open with your protocol as possible. You have to create a set of reference documents which everyone can read and understand. You have to promote the hell out of the protocol by hosting conferences of current and potential underwriters. Then, when you have lots of developers, underwriters, trustees, and, by extension, users, of your certificate protocol, you have to keep the protocol honest by cryptographically validating the various software parts so that the market's participants can trust that the protocol is being adhered to. That means *not* writing software, paradoxically. The reason you have this great protocol is because you're a great cryptographer: not a great underwriter/marketer, not a great developer, not a great trustee/banker. The entire market can't function without you, and, in a geodesic market, you can add significant value and get paid for that value without owning all the other components of the system to get it. The great unwashed avalanche There's great benefit to having this great unwashed horde of people helping you put all this together. Most of that benefit comes from creating a large chaotic emergent system, a market. People can specialize in some small piece of the system and optimize it without you having to tell them what to do, for instance. In addition, very small investments yield rewards way out of proportion to the money invested. My favorite example for this is the prize that was offered for flying non-stop from New York to Paris. Many times the prize money was spent in achieving the feat by all the contenders, and some single teams probably spent more than the prize money all by themselves. The rewards to the person who finally completed the trip greatly exceeded the prize money he won. Finally, the rewards to aviation the aviation as a whole were much greater than all the money spent by all the teams trying to be first. That's the great thing about creating an emergent process like a digital certificate market. It's like kicking some snow down on top of an avalanche zone. You release all that stored energy, ambition, and talent. All at once. Cheers, Bob Hettinga -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPagTfgyLN8bw6ZVAQHmqQP/RaD/2XPxO2Gx2otHjAPI8+H+xkT85JSX BqVyYEYo/8ilbf/bmZC9YDIhmi0vDpEODkj+7LJ0zsm8AX0LAOLj8N23f3R5LXX0 2QNvPczNN8v+9T1M2r4bhgtRUfy7OPFkOpvfbrJkkWT4XNL8PwojAA3UMVQ8UgYJ A0nLC/z+78s= =5TRr -----END PGP SIGNATURE----- -------------------------------------------------- The e$ lists are brought to you by: Making Commerce Convenient (tm) - Oki Advanced Products - Marlboro, MA Value-Checker(tm) smart card reader= http://www.oki.com/products/vc.html Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk See your name here. Be a charter sponsor for e$pam, e$, and Ne$ws! See http://thumper.vmeng.com/pub/rah/ or e-mail rah(a)shipwright.com for details... ------------------------------------------------- --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: bad PGP signatures
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- An entity calling itself Bob Hettinga is alleged to have written: > > How 'bout this one, Bryce? > > ;-) Yep. That one (mine, for those watching at home) verifies. My first guess is that it is because my messages are formatted for 64 columns and all the other messages that are failing to verify (like: To: mix-l(a)vishnu.alias.net, remailer-operators(a)c2.org, \ cypherpunks(a)toad.com Subject: New Mailing List (encrypted) Date: Sat, 13 Jan 1996 13:42:49 -0600 From: John Perry <perry(a)vishnu.alias.net> which just came through) are formatted for 80 or 79 or 78. Perhaps thumper is chewing on lines longer than 78 or 76 or something. Just a guess. Bryce PGP sig (New! With cleartext timestamp!) follows Sat Jan 13 15:26:48 MST 1996 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMPgxzfWZSllhfG25AQFu8QQAj/kc4jgYaKV4QAtvQDiZFIVSBPcgY1qR 4yJWNhlAioQ1I9g0WYiZjxUfa0hl+B77slSM362uaZxvotU1E440bpiZGMcaItBb ebUDW0UxyhLnUEgcMqo5S8B9mY8eVKiV8j/VASt4bu7RexTyCuRU7VM8FDxj8Vpv If1nqAsWTNg= =Hilf -----END PGP SIGNATURE-----

1 0

c4 cellphones
by Brad Dolan 17 Dec '03

17 Dec '03

Israeli news sources report: PLO security authorities have prohibited the use of cellular telephones in public buildings. In addition, no person is permitted within 200 meters of Arafat's office with a cellular phone. Paranoia abounds. How safe is *your* cellphone?

1 0

Re: Novel use of Usenet and remailers to mailbomb from luzskru@cpcnet.com
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:25 PM 1/12/96 GMT, John Lull wrote: >On Fri, 12 Jan 1996 10:55:12 -0800, you wrote: > >> Cypherpunks: is there any way to respond to, or prevent, this sort of >> attack short of actually shutting down the remailer? > >Yes, very simply. > >The remailer could calculate a hash for the body of each encrypted >message received (the same portion which will be decrypted by PGP), >tabulate the last few thousand hashes, and simply discard any messages >with a duplicate hash. The target of the attack would receive only >the first copy of the message. I am afraid it is not that simple. Remember that the mailbombing consists of many, many horny little geeks responding to a single message. They are replying to the same message (and probibly adding a few "me too!" lines), not mailing the same one over and over again. Another idea would be to keep a md5 (or other) hash list of the reply block used and have a disabled list for such spam attacks. (Unfortunatly this requires code, thus time.) Pretty nasty variation on a "denial of service" attack. What next? Fake "David Rhodes does e-cash" messages with the target's e-mail address? Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

3 2

AP Article on Zimmerman Case
by Weld Pond 17 Dec '03

17 Dec '03

http://www.boston.com/globe/ap/cgi-bin/retrieve?%2Fglobe%2Fapwir%2F011%2Fna… Excerpt for the web impaired: ``Zimmermann never exported Pretty Good Privacy, so the U.S. Attorney seemed to be missing the point. Unfortunately there still is no clear ruling from our government as to whether or not making software available on the Internet counts as exporting it,'' said Simson Garfinkel, who wrote a book about the program. Zimmermann's supporters argued that without encryption, government could do widespread eavesdropping, perhaps for political reasons, scanning for words and phrases it considers subversive. They acknowledge that a few criminals may use programs like PGP to hide out in cyberspace, but believe that concern is outweighed by free speech and privacy rights. ``The case was part of the government effort to crack down on good technologies for privacy. We hope the government's decision signals a rethinking of federal policy in this very important area,'' said Marc Rotenberg of the Electronic Privacy Information Center in Washington, an on-line civil rights watchdog group. Others see the 2-year investigation of Zimmermann as intimidation. ``It seems to me is that all the U.S. Attorney is saying is that they don't want the public relations nightmare of prosecuting Philip Zimmermann, but they still want everyone scared so that they won't exercise their Constitutional rights,'' Garfinkel said. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/~weld L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

1 0

Re: Mail to news gateways
by Gordon Campbell 17 Dec '03

17 Dec '03

At 11:35 AM 1/12/96 -0800, you wrote: > >Could someone point me to a _current_ list of mail to news gateways? > >From ethe help file for Private Idaho 2.6b: You can get the most current USENET gateway information (as well as additional remailer info such as PGP keys) by: E-mailing mg5n+remailers(a)andrew.cmu.edu (no subject or text in the message body required) ----- Gordon R. Campbell, Owner - Mowat Woods Graphics P.O. Box 1902, Kingston, Ontario, Canada K7L 5J7 Ph: (613) 542-4087 Fax: (613) 542-1139 2048-bit PGP key available on request.

2 1

Re: PRZ "battle lost"
by Gordon Campbell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:00 PM 1/12/96 -0800, "Vladimir Z. Nuri" <vznuri(a)netcom.com> wrote: > >is there an alternative? yes, but it involves fewer lawyers than are >in the US today. > >however I don't see lawyers as the problem, but a symptom of something >deeper: the tendency of people to resort to legal action to settle >even trivial disputes. Very true. Up here (Canada), we have _much_ less of the "use the courts as a weapon of harrassment" phenomenon. But, I don't believe we have a (much) lower percentage of lawyers than you do. It's part of the mindset. Somehow, over the course of several generations, you folks have become an entirely too litigious lot for your own good. The result is was PRZ just came through and the multitude of cases that the Church of Sceintology is involved in. How to fix it? Beats me. However, I think it will probably have to start with the judiciary. Justices from all levels of your court system will have to put their collective feet down and stop allowing this kind of nonsense. I don't know enough about the inner workings of the legal systems to know if this would be all that's needed. Perhaps some new legislation would also be required. Whatever happens, it can only be for the better. In the meantime, could you get your damn lawyers off my tv? ;-) We don't let our lawyers do that. They've only been able to advertise at all in the last 10 years or so. -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Help! Help! The paranoids are after me! iQEVAwUBMPcDkXNDC2/K0TjxAQHLaAf/Q4d3CUrcANLozJGR/uv5JsVyq8c+uhxy cKvsA/oxHPVTUynvUkqG8av0zhXl0t9hdOoi5RC7Q6jmNrYGvj3cSEXY/VN2EDR8 +4wVPxHQ7Mt3G4ffeR6Qe3hPU3Q/fHXGL7rLoJOD3IDI3LgC+K57Com5KJfXQVGe 7lpbnKSoCiny3pEbanCMMhrp8sZVM00B6oH2Hh6hIMaVEFpBao/ncyGUBiZLkmSr PLqlU7bTk81BicrMka0ep28KQwOF8lyGYCN1dxq64UCuBe02VATIZ/GnStQFa/YZ dwTpZtqM7SgDibkEnRwuKeonXd06oyWba0/f1QQm/Y1Cjglw8YAwXA== =VB/L -----END PGP SIGNATURE----- ----- Gordon R. Campbell, Owner - Mowat Woods Graphics P.O. Box 1902, Kingston, Ontario, Canada K7L 5J7 Ph: (613) 542-4087 Fax: (613) 542-1139 2048-bit PGP key available on request.

1 0

Offshore Banks and Asset Protection
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:57 PM 1/12/96, Rich Graves wrote: >Every issue of The Economist (and I'm sure lots of other publications) >has ads for this kind of thing. > >Anyone know a reference for ranking the "legitimacy" of these services >and seminars? I'd assume that many of them are scams that will gladly >take your money overseas, but you might never see it again. > >Probably follow up offline, because cpunk relevance is a bit tenuous. I'll follow up on the list, because it's a topic of interest (or curiousity) to several, and I favor writing for the list. I looked into "asset protection" [see note below] using offshore banks (Carribean, Channel Islands, Europe, etc.), and bought a couple of books on this. And I subscribed to some Net newsletters. I'm not an expert, and have not chosen (yet) to "protect" my assets by moving them offshore. I think the assumption that most of the ads in the back of "The Economist" are scams which will take your money is wrong. The banks will take your money, but most probably will return it on demand. And the seminar companies will in fact teach some things. However, they may be "scams" in a gentle sense: they won't provide easy solutions that many of us will feel fully comfortable with. By this I mean that one is hit with dozens of competing claims, by reports that the IRS and FinCen are infiltrating these banks, that treaty negotiations will soon close these tax havens, and all sorts of stuff like this. Things which do not inspire confidence. (In fact, the report that these back-of-the-Economist ads are "scams" is perhaps part of this disinformation/rumor campaign.) Like a lot of things, it may all be clearer once one has actually gone ahead and done something with these offshore banks. I don't personally know anyone who has, which adds to my uncertainty. [Note: Many advisors call their schemes "asset protection," rather than "tax sheltering" (or "tax evasion"). The idea is to put assets beyond the reach of tort judgments. For example, a doctor may fear the incredibly large "deep pockets" lawsuits that American society encourages, so he transfers a large fraction of his net worth to an offshore bank. He reports income from these assets to the IRS, so he is not a tax evader, just someone who has partially "judgment-proofed" himself (to use the term Duncan and Sandy use). This is not illegal, currently. Lots of issues to consider.] --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Microsoft's papers on NT C2 thang
by Rich Graves 17 Dec '03

17 Dec '03

[Oops, signature is only valid if the > 80 column line is preserved] -----BEGIN PGP SIGNED MESSAGE----- I'd appreciate it if someone could critique these papers for me, probably off the list. [Note that 198.105.232.5 is just one of the IP addresses being load-balanced by www.microsoft.com. The servers seem to crash a lot with the current Gibraltar beta, so if one IP address doesn't work (like .5 isn't responding to pings right now), try another and it will work.] - -rich - ---------- Forwarded message ---------- Date: 12 Jan 1996 11:22:38 -0600 From: Richard P. Bainter <pug(a)arlut.utexas.edu> Newgroups: comp.security.misc, alt.security, comp.os.ms-windows.networking.misc, comp.os.ms-windows.networking.windows, comp.os.ms-windows.nt.admin.networking Subject: Re: Microsoft continues to mislead public about Windows security bugs (a bit long, with references) In article <t6d9w0JfFigb089yn(a)oslonett.no>, Rune Moberg <mobergru(a)oslonett.no> wrote: >>This is true. In fact NT was never C2-certified as any kind of network >>server at all, but only as a standalone workstation. >I read a statement made by MS, that it doesn't matter, because if NT is >proved to be C2 secure in a standalone configuration, then it's secure >on the network as well. You believe everything MS tells you?! How naive. >C2 security, AFAIK, also requires that the server is protected (controlled >access). Once you have physical access to a machine, you could open it, >put in a floppy or hard drive, and access anything you'd like to on the >machine in question (with a disk editor, or with a fresh installation of >the OS in question). Atleast that's the only way I can think of to break in >on a NT Server. Otay, let me see. The server is protected if you aren't hooked up to a network. That implies *nothing* about the fact when a network is plugged into it. If I'm sitting at the console and have to enter a password to do things, doesn't mean I have to enter one from the network when I mount the entire disk. (Even if that is not the true case.) There are orange, red and blue books. This is all well pointed out on: http://www.windows.microsoft.com/TechNet/boes/bo/winntas/technote/security.… What has Microsoft actually passed? I had heard it was only Orange book C2 and not Red book C2. Micrsoft also points it out on: http://198.105.232.5/NTServer/c2bltn.htm Ciao, - -- Richard Bainter Mundanely | OS Specialist - OMG/CSD Pug Generally | Applied Research Labs - U.Texas pug(a)arlut.utexas.edu | pug(a)eden.com | {any user}(a)pug.net Note: The views may not reflect my employers, or even my own for that matter. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPcRpI3DXUbM57SdAQFbWgP9HrpdsuC/p3iURubYobgXRXlvlmrRgJot 5kDBCOrDHRtyjXQj7n0CLU6TsEpTLR2ZfTGNUrKoc2lE1q0+PSzF4WpOyywNKULw StB8d+0n0NPuN2Bcbb7mO0M0VbE9khL5CYrcfWB5FR6JPfXU18cfSTXCROgGu4U9 ASvbxOkVLeM= =L7so -----END PGP SIGNATURE-----

1 0

Reminder, Jan 13 noon-6 p.m. Bay Area CA mtg
by mrm＠netcom.com 17 Dec '03

17 Dec '03

Name: monthly Bay Area Cypherpunks meeting Date: Saturday January 13 Time: 12 p.m. - 6 p.m. Spot: Sparcy's, Building 21, Sun Microsystems Food: Bagels provided; feel free to bring lunch to munch The agenda is still forming. So far, there are two speakers lined up to talk about Mark Twain ECash. (Lucky Green and Sameer.) It might be interesting to have general discussions of ... CompuServe, where the censorship wave is going, and what to do in response Timing attacks on RSA algorithms So, can we all now band together and invest in PGP, The Company? What's needed in crypto APIs? What do you love or hate about current sets of APIs? (your favorite topic here ...) See you tomorrow, Marianne p.s. directions to Sun's B21: Take 101 South to Amphitheater Exit. Go to the end of the ramp and turn left on Charleston. This road is also known as Garcia. After about 1/3 mile, turn right onto the first city street on your right. In about 2 long blocks or so, you'll see purple signs for Building 21 of Sun Microsystems. The meeting is held in the cafeteria.

1 0

Re: Novel use of Usenet and remailers to mailbomb from luzskru@cpcnet.com
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 18:22 1/12/96, Alan Bostick wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >If "digital postage" is ever implemented, this sort of >distributed-origin mailbomb-through-a-remailer would be stopped >immediately. All the messages that the horny net geeks send would >necessarily contain the same postage stamp, and the remailer would >notice this right away -- and throw away messages containing the used >postage stamp. > >One more motivation for e$-like digital postage for remailers. I am not sure that postage would solve this problem. The geeks would individually pay for it. Still, nominal postage would solve a lot of the problems that plague remailnet. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 3

News Release
by Philip L. Dubois 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Yesterday morning, I received word from Assistant U.S. Attorney William Keane in San Jose, California, that the government's three-year investigation of Philip Zimmermann is over. Here is the text of Mr. Keane's letter to me: "The U.S. Attorney's Office for the Northern District of California has decided that your client, Philip Zimmermann, will not be prosecuted in connection with the posting to USENET in June 1991 of the encryption program Pretty Good Privacy. The investigation is closed." The U.S. Attorney also released this to the press: "Michael J. Yamaguchi, United States Attorney for the Northern District of California, announced today that his office has declined prosecution of any individuals in connection with the posting to USENET in June 1991 of the encryption program known as "Pretty Good Privacy." The investigation has been closed. No further comment will be made by the U.S. Attorney's Office on the reasons for declination. Assistant U.S. Attorney William P. Keane of the U.S. Attorney's Office in San Jose at (408) 535-5053 oversaw the government's investigation of the case." On receiving this news, Mr. Zimmermann posted this to the Cypherpunks list: - -----BEGIN PGP SIGNED MESSAGE----- My lead defense lawyer, Phil Dubois, received a fax this morning from the Assistant US Attorney in Northern District of California, William Keane. The letter informed us that I "will not be prosecuted in connection with the posting to USENET in June 1991 of the encryption program Pretty Good Privacy. The investigation is closed." This brings to a close a criminal investigation that has spanned the last three years. I'd like to thank all the people who helped us in this case, especially all the donors to my legal defense fund. Apparently, the money was well-spent. And I'd like to thank my very capable defense team: Phil Dubois, Ken Bass, Eben Moglen, Curt Karnow, Tom Nolan, and Bob Corn-Revere. Most of the time they spent on the case was pro-bono. I'd also like to thank Joe Burton, counsel for the co- defendant. There are many others I can thank, but I don't have the presence of mind to list them all here at this moment. The medium of email cannot express how I feel about this turn of events. -Philip Zimmermann 11 Jan 96 - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPDy4WV5hLjHqWbdAQEqYwQAm+o313Cm2ebAsMiPIwmd1WwnkPXEaYe9 pGR5ja8BKSZQi4TAEQOQwQJaghI8QqZFdcctVYLm569I1/8ah0qyJ+4fOfUiAMda Sa2nvJR7pnr6EXrUFe1QoSauCASP/QRYcKgB5vaaOOuxyXnQfdK39AqaKy8lPYbw MfUiYaMREu4= =9CJW - -----END PGP SIGNATURE----- I'd like to add a few words to those of my client. First, I thank Mr. Keane for his professionalism in notifying us of the government's decision. It has become common practice for federal prosecutors to refuse to tell targets of investigations that the government has decided not to prosecute. I appreciate Mr. Keane's courtesy. Let me add my thanks to the other members of the defense team-- Ken Bass in Washington D.C. (kbass(a)venable.com) Curt Karnow in San Francisco (karnow(a)cup.portal.com) Eben Moglen in New York (em21(a)columbia.edu) and Tom Nolan in Palo Alto (74242.2723(a)compuserve.com) Bob Corn-Revere in D.C. (rcr(a)dc1.hhlaw.com) was a great help on First Amendment issues. These lawyers are heroes. They donated hundreds of hours of time to this cause. Each is outstanding in his field and made a contribution that nobody else could have made. It has been an honor and a privilege to work with these gentlemen. Mr. Zimmermann mentioned a lawyer named Joe Burton (joebur(a)aol.com) of San Francisco. Mr. Burton deserves special mention. He represented another person who was under investigation. To have made this other person publicly known would have been an invasion of privacy, so we didn't. We still won't, but we can finally acknowledge Mr. Burton's enormous contribution. Whether we were getting paid or not, the rest of us at least received some public attention for representing Phil Zimmermann. Mr. Burton labored quietly on behalf of his client. He took the case pro bono and did an extraordinary job. He is a lawyer who exemplifies the finest traditions of the Bar and the highest standard of integrity. I am proud to know Joe Burton. The warriors at the Electronic Privacy Information Center (EPIC)-- Marc Rotenberg, David Sobel, and David Banisar-- and at the Electronic Frontier Foundation (EFF), Computer Professionals for Social Responsibility (CPSR), and the American Civil Liberties Union (ACLU) provided financial, legal, and moral support and kept the public informed. They continue to do so, and we all owe them thanks for it. Those members of the press who recognized the importance of this story and told the world about it should be commended. Undeterred by the absence of sex and violence, these reporters discussed the real issues and in so doing served the public well. Many other people, lawyers and humans alike, made invaluable contributions. My assistants Alicia Alpenfels, Suzanne Turnbull Paulman, and Denise Douglas and my investigator Eli Nixon kept us organized. Rich Mintz, Tom Feegel, and Nathaniel Borenstein of First Virtual put up a Web site and aggressively supported the Zimmermann Legal Defense Fund. Another site was built by Michael Sattler of San Francisco, and he and Dave Del Torto (also of S.F.) let me stay in their homes. Thanks also to MIT and The MIT Press: Hal Abelson, Jeff Schiller, Brian LaMacchia, Derek Atkins, Jim Bruce, David Litster, Bob Prior, and Terry Ehling. And there were many others. Finally, I offer my thanks to everyone who contributed to the Zimmermann Legal Defense Fund. People all over the world gave their hard-earned money to support not only Phil Zimmermann's defense but also the cause of privacy. It is impossible to be too pessimistic about our future when there are so many of you. Now, some words about the case and the future. Nobody should conclude that it is now legal to export cryptographic software. It isn't. The law may change, but for now, you'll probably be prosecuted if you break it. People wonder why the government declined prosecution, especially since the government isn't saying. One perfectly good reason might be that Mr. Zimmermann did not break the law. (This is not always a deterrent to indictment. Sometimes the government isn't sure whether someone's conduct is illegal and so prosecutes that person to find out.) Another might be that the government did not want to risk a judicial finding that posting cryptographic software on a site in the U.S., even if it's an Internet site, is not an "export". There was also the risk that the export-control law would be declared unconstitutional. Perhaps the government did not want to get into a public argument about some important policy issues: should it be illegal to export cryptographic software? Should U.S. citizens have access to technology that permits private communication? And ultimately, do U.S. citizens have the right to communicate in absolute privacy? There are forces at work that will, if unresisted, take from us our liberties. There always will be. But at least in the United States, our rights are not so much stolen from us as they are simply lost by us. The price of freedom is not only vigilance but also participation. Those folks I mention in this message have participated and no doubt will continue. My thanks, and the thanks of Philip Zimmermann, to each of you. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPdHw7Z7C+AHeDONAQFR+QP/SJFD1DsIqUZhl5s8dtnUfe8l5a0YAWsa jOGvaK6gNpi1L4McEkb8Y4hOlI4n+X8HuRnzHai0UmSjAT6zHQmfN9UVbP27fYBR xKw1nTzEziHsbmHTua+fDvsWrsWa+A5hBxS7UAQkepDWtlc2EUCB1v5aOyGwnuco ppXLLSDHh1g= =N8iF -----END PGP SIGNATURE-----

1 0

Re: Zimmermann case is dropped.
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Julian Assange wrote: > >The more important point being missed of course that Phil has and no >doubt will continue to make certain elements of the U.S government >quite miserable indeed. ...and I'm sure they'll be watching VERY closely to see how version 3.0 will be distributed....

1 0

Re: News Release
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:37 PM 1/12/96 -0700, you wrote: [stuff from Phil Zimmermann deleted for space.] [other stuff by Dubois, Zimmermann's lawyer, deleted for space.] >There are forces at work that will, if unresisted, take from us our >liberties. There always will be. But at least in the United States, our >rights are not so much stolen from us as they are simply lost by us. The >price of freedom is not only vigilance but also participation. Those >folks I mention in this message have participated and no doubt will >continue. My thanks, and the thanks of Philip Zimmermann, to each of >you. Dear Mr. Dubois, Thank you for your efforts on the behalf of Phil Zimmermann. You are to be praised. However, you should recognize that at best, all you have done is to reduce the harm done to him (or would otherwise have been done to him), which admittedly is a good and right thing for you to have done. However, I refer you to the 1964 movie, "Dr. Strangelove," whose title character stated that "deterrence is the art of making the enemy FEAR to attack." In my opinion, we (the ordinary members of the public) cannot consider ourselves to have won this encounter until the REAL enemy here, the government employees who targeted Zimmermann, FEAR to attack ("legally" or otherwise) people like Zimmermann. Ask Mr. Zimmerman about my essay, or I'd be happy to email it to you. Sadly, he did not appreciate its simplicity and potential effectiveness, and maybe you won't either, but someday it may protect your freedom in ways you can't currently even imagine. Jim Bell -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPg1cvqHVDBboB2dAQGv7wP+JTKihlMH0zeDGq1bsWK04nTe6zAkpemL 1jMbl7/6J8MSbPQPVgL7fzP3TfQHRmIwAhAZzd7cf440jAgQ4MvQxsDqMkrESky6 jTL+h3j79Lnt8WMd63cCWa2mn++2etMy4XRCkiK59ft187qGGpwitsHIzF8tKsQL mm2K084tpO0= =PY58 -----END PGP SIGNATURE-----

1 0

Reach out! Update 01 (CypherPurists trash this)
by Sudduth, Larry 17 Dec '03

17 Dec '03

(I know this is way off topic, but I wanted to apologize to all anyway for my last posting with the RTF crap in it. I tried unsuccessfully to correct the RTF problem as a result of previous list discourse, and fervently believe that it is fixed now. If not, I guess I'll find out about it. Anyway, thanks for your forbearance, and now for some noise.) The merchant must have been so impressed by the pent-up market demand for the "How to Beat and Kill Your Ex-Wife and an Unlucky Innocent . . . And Get Away With It" video, that the ordering procedure has been changed to a toll number. I'm sure the merchant desires potential customers to call collect, after all who in the world would pay money for the privilege of buying a product? I believe the new number is 0-818-879-0614, remember to say "operator" when prompted, so you can request a collect call. I have up to now always been greeted by a busy signal, so fear that I could have to validate the above number by calling the toll-free number (see original noise below) again. If one wants to directly dial the toll number, one can suppress one's phone number from being reported to the merchant via Caller ID by dialing *67 prior to the call, at least here in Bell Atlantic land. Check with your telco to be sure. (Interstate support for Caller ID is currently spotty so this could be a non-issue.) This strategy should be employed if one is leery of being on the receiving end of future direct mail campaigns offering products similar to the "How to Beat and Kill Your Ex-Wife and an Unlucky Innocent . . . And Get Away With It" video, just for discussing the particulars of the video with one of the merchant's staff. Direct mail campaigns target people who've previously inquired (and not necessarily bought) by phone. As an aside, I know y'all knew that your number (i.e., the number dialed from) is always reported to the recipient at an 800 number, and that this cannot be suppressed. After calling the toll-free number several times, I was able to write down the new telephone number for ordering the "How to Beat and Kill Your Ex-Wife and an Unlucky Innocent . . . And Get Away With It" video. It took several attempts because I kept encountering pens with no ink in them in my desk. The recording doesn't really describe the video at all, just refers to the oh-jay video. I haven't heard the actual title of the video, since I couldn't get through to a human at the merchant's telephone number. Since calling it the oh-jay video sounded so darned impersonal, I took a stab at a seemingly appropriate title. >William T. Rainbird wrote January 12, 1996 2:12 AM >I know this isn't a typical posting for this group, but I thought I'd >point out that O.J. Simpson has a video for sale, to further exploit his carnage. >You can buy it by dialing 1-800-OJTELLS 1-800-658-3557 it is a FREE CALL >(for you). I guess that means the MERCHANT PAYS for the calls, even if >NOTHING IS ORDERED... > >Please repost and tell your friends! -=-=-=-=-=-=-=-=-=-=-=-=-= SudduthLM(a)SecureC2.com The views expressed herein are the personal views of the author only, etc. y, etc.

1 0

Re: (none) [httpd finding your identity]
by doclulu＠infobahnos.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: Rich Graves <llurch(a)networking.stanford.edu> Cc: cypherpunks(a)toad.com Subject: Re: (none) [httpd finding your identity] At 11:28 96-01-12 -0800, you wrote: >On Fri, 12 Jan 1996, sameer wrote: > >> > > control what information is passed out to the other end. >> > > Specifically, I'd like http://anonymizer.cs.cmu.edu:8080/prog/snoop.pl >> > > to come up nearly blank.) >> > >> > We do not send the HTTP 'From:' header. I will look into where >> > they are getting the user name and location from. There is really >> > nothing I can do in the Navigator to stop them from getting your >> > IP address or DNS name. >> >> I beleive that it uses finger. If you really want to prevent >> people from finding out where you're coming from, use the >> anonymizer. Not at CMU? Don't worry. > >On most UNIX machines or a Mac or PC running most common talk clients? >Worry. Not just finger, but also identd will identify you. I think Eudora >Pro has an identd option, too. > >-rich > > On Win 3.1 using Netscape 1.22, you can improve your 'lack of output' by removing in the PREFERENCES menu: Your Name: Your Email: Your Organization: The bad side is that you cannot mail from Netscape without filling the Email entry with a valid Email address and putting an anonymous address (ex.:an123456@anon.penet.fi) would cause http://anonymizer.cs.cmu.edu:8080/prog/snoop.pl to report your REAL hostname with your anonymous username (ex.:an123456@myhost.com) so if privacy is a must and you cannot use the anonymizer, this could reduce your output to your computer type and operating system and your browser and version number. For my part, after removing my Email, it was all that was left (-: ( It will stay that way... ) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPhL8l0tVeSYE8qJAQFN9AQAgXcbJzhqbExyvVA+5VZXojCuUGxJsH0e qhmSmn9I6vInIzfJNoUi1I5tdwVqOFaheFTh6XPYjVIRnCNx4g0u3z2Mjx8V2B0a O66XsFFX3tgCHizIVFkXJ1rzOXRDXCBb4joo+500MOWi77GgfHBMd1F3IBTcS2i6 8QZshD4gF0U= =9rLo -----END PGP SIGNATURE----- ------------------------------------------------------------------------- Eric Francoeur | "One of the things Adolf Hitler E-Mail: doclulu(a)infobahnos.com | and Bill Clinton have in common http://www.infobahnos.com/~doclulu | is that both were democratically PGP Public key available at website | democratically elected leaders." | -Dr. Dimitri Vuli 1995.

7 7

Subscribing to cypher-list
by John Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello Everyone, First, the response to the PGPdomo list has been better than I expected. But I see some clarification is required. 1. I have had several inquiries as to why the list is closed. Not having a good reason as to why, I've opened the list. Anyone can subscribe that wants to. 2. In order to subscribe, you must encrypt your subscription request to: majordomo(a)vishnu.alias.net. You will NOT be auto-subscribed if it isn't encrypted. That's the whole point of the security. Other than the encryption, the subscription method is the same as most majordomos. 3. Please send you subscription requests to cypher-list-request(a)vishnu.alias.net rather than majordomo(a)vishnu.alias.net. I was willing to add the subscriptions that failed by hand, but the number of requests has made this a time-consuming job. 4. What is the PGP public key for majordomo(a)vishnu.alias.net? It's available by anonymous FTP from vishnu.alias.net as ftp://vishnu.alias.net/pub/majordomo.pgp. I'm also listing the key below. If you have any problems or questions, please feel free to send email to perry(a)vishnu.alias.net. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzD33YoAAAEEAJ7dUgVGfaj9V+aV3HMtr2D8tgWlMSDveh5zlzfYrOm6Yv65 p3aWSpQPdoEN16UbCrUUy0AItnFwDkdfYBu8Q7jtL3VCiHo3h8UT+VtdTEN7DT5O juUhSWuh7BBpmMbtnVvdQ3k1rx4ayh1SLufkgISy/HwP6A9VCdOhMeHnnvxhAAUR tEVNYWpvcmRvbW8gTGlzdCBTZXJ2ZXIgLSBWaXNobnUuQWxpYXMuTmV0IDxtYWpv cmRvbW9AdmlzaG51LmFsaWFzLm5ldD6JAJUDBRAw+Dpr06Ex4eee/GEBAd1eA/4y GJBATAR9yIcgYEUVwbWiJbBPSbjx0jUviTJmkJc0RY3CaDrUTIoJKLYJgc5x52N9 aH8zgULIjqDcxx9N1wBHyRjE3ZoDgCt4+7gY0GsUHezvaBph2Z6kSitQOIEgO/Os I7mOphPw6qgQLo0pnx6JWz6F1OqHTPDJW6QcvJA1wIkAlQMFEDD38cxTk6RE4a7Y bwEB6SID/iQXhleyRH2Ekeumg+kndjfJ60JLa+psrSReHvmOGGwDUdwtTphgSWkK p/LtLk6UGxjhcCOoXuRiAzolTl4inGbYewlclLKrV3wNm6XWM9NK5a8sfHkB40j2 wdnRiMrNrPDTH/ZDcpgW0z8AX8HkdNYFrISAFtPuxlL9eILHspfwiQEVAwUQMPfx naghiWHnUu4JAQHyGAf6AySIiVtFGXdMXmuZ+1AxhUoo/8ZaskLFbm1E6/sc+/8q ScBUAVcK8Ul/RVvL6dDv2th+lmgytZrsQ3FsiR6CDCXNoWG3t8QfuZn+zTt+vucw +WaiRVdqry6Gl411rgGSyYeYjp4YcScWG0TB+y4Urzc126OJstKJcYyJdqs6kB6z Vh0FHFPerWYzEvLjSiM/xxmTkRtUTaMH4qJ5txTnQlko4MxytUsi93Jz2cM46EWc YY+OgBT3Vi6kvBrl8qPqos263A8GfMsGJKAOF2FjsxjPMG/tyXijn2xZcHZyw7jG v6D4lLEhmW6zx2ki2AGvxZ82dc9yVkRafsYkW7SOsA== =YIvQ - -----END PGP PUBLIC KEY BLOCK----- John Perry - KG5RG - perry(a)vishnu.alias.net - PGP-encrypted e-mail welcome! Packet Radio - KG5RG(a)WA4IMZ.#SETX.TX.USA.NA WWW - http://www.alias.net PGP 2.62 key for perry(a)vishnu.alias.net is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMPhMvKghiWHnUu4JAQHanQf+NdXGKkZWRGh6xYD+Vms526JjNTotgcEH 2aLoAWICOrLmPF/KbxhixG7YLBht8zXdnRWBjpAoNw9Uv19Sat7URE8NbVUyww12 0fHYLkGZUAb0gK6khH3rAMcciKHJWxfoY/LuObTxoVOX827ffvBEPO4M5p0HOcmP w6ieHzp9SphC9kMaj/Vpf+Kc3gYZjYfnn5xRCzexEiMrz/+EPKNUKyErl70TdLH6 KtoUnrSW5bQVyTmloSzBDYhkPxORWu3soQO3tC0UvUptAEpdl7z9zlLolpEYzlyk HxWNdtGgitMeUO+c4OlKG1tJuKLxJ09nkH/bWerkohFnBxS67IUDwA== =Q7Ft -----END PGP SIGNATURE-----

1 0

Re: Zimmermann case is dropped.
by Bill Stewart 17 Dec '03

17 Dec '03

Congratulations, Phil! And to all the EFF folks, Phil's lawyers, et al. At 07:00 PM 1/11/96 -0600, ecarp(a)netcom.com wrote: >Mike Godwin can speak to this a lot better than I can, but I believe that >by abandoning their case against PRZ, they have seriously weakened their >case against anyone else that they feel has violated the ITAR in a >similar manner - it's called "selective enforcement" and courts have been >taking a dim view of that sort of thing. They've weakened it far less than if they'd indicted Phil and lost, and they _would_ have lost if they'd had a trial. Indicting him would have done _him_ far more damage, of course, so I'm glad for his sake they dropped it. (Dan Bernstein may disagrees on whether they'd lose, and his suit against the government is the next chance to test this in court.) Prosecuting Kelly Goen would have been far more interesting; they _might_ have been able to win something against him, though the statute of limitations is probably about to cover him. Meanwhile, they've demonstrated that you can tie up a person for years, and cause him to spend huge legal expenses, without being stopped by the Constitutional right to a speedy trial, and by not prosecuting they're preserving the powers of Fear, Uncertainty, and Doubt. And while they've given PGP some extra publicity, they've also slowed down the adoption of high-quality privacy tools for several years; while they can't prevent hard-core privacy-addicts from getting it, but they can make sure that it's not included in everybody's first computer for a couple of years at least, until they get Clipper 2 or Exon 3 or Freeh-base Wire Taps or _something_ in place. And they can always argue that "Well, the case against Phil didn't have quite enough direct evidence to prosecute, but we caught SAMEER and three of his customers Red-handed, and plan to prosecute those crypto-narco-anarco-porno-terrorist Commie-sympathizing Nazi-protecting Foreign-looking money-laundering EEEVIL conspirators from BERKELEY to the fullest extent of the law!*" and spend a couple of years harassing them, and then find another victim after that. Enough of those cases in a row could eventually annoy a judge or two, but if it gets them a few more years, it gets them a few more years. ==== * Oh, "and your little dog, too!" ==== #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "The price of liberty is eternal vigilance" used to mean us watching # the government, not the other way around....

1 0

Re: Theory Question: Why isn't RSA a 0-knowledge Proof
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 06:01 PM 1/13/96 -0500, you wrote: > >Zero knowledge means that the recipient obtains no information that they could >not have obtained without knowing the secret information corresponding to the >key. > >If I authenticate myself to you by giving a signature on a nonce you chose you >have obtained information that you could not have obtained otherwise. Seems right enough. Still pondering though... [1] If I (the signer) choose the series of messages to sign, this still demonstrates that I have a secret without telling you the secret (and without giving you the information you might have been fishing for..) You do get information you would not have been able to create otherwise,(whatever it is I choose to sign) ...but it doesn't matter if you wanted the information or not, what matters is that you got it??? You could get random information (entropy) as part of a protocol, would this destroy the 0-knowledge aspect as well (and make it merely a min-disclosure proof...?)) (if you aren't directly challanging me, there could be a replay or man in the middle attack or whatnot, but the man in the middle attack also applies to 0KP.) What I was thinking of, was a hamiltonian cycle example: [2]where the person that wants to see the proof is getting information regarding the iso-morphism between the various graphs... (For instance, say G is the real graph, Alice knows the path, and Bob wants proof that Alice knows it...) So in the first instance Alice produces H1 and shows it to Bob and proves it is iso-morphic, in the second example she produces H2 and shows the cycle, in the third instance, she provides H3 and it's isomorphism to G... Bob can then conclude that H1 and H2 are isomorphic... I'm not sure about this (this must be where I am in error) but I don't think Bob could have derived the fact easily (if it is plausible for him to believe H1~=H2 based on this protocol) that H1 and H2 are isomorphic without Alice's help here... So in this case, Bob picked up some info he would have not otherwise known for free (similar to the first example) even though this information isn't of any use to him with regard to the solution to G. >If it wasn't for the fact that it is IAP and you apear to be a grad student I >might wonder about somone doing their course assignments via the net... :-) The effect of the eggnaugh hasn't worn off and trying to vamp up... <smile> _______________________ Regards, Is this true or only clever? -Augustine Birrell Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu 0C 69 D4 E8 F2 70 24 33 B4 5E 5E EC 35 E6 FB 88

1 0

Re: Shimomura on BPF, NSA and Crypto
by John Gilmore 17 Dec '03

17 Dec '03

Tsutomu says the NSA is inept rather than inherently evil. I think he concluded this because they declined to fund his work. An ept and evil NSA would want Tsutomu on the payroll. Tsutomu's stealth version of the Berkeley packet filter did a lot more than modload into the kernel. He was paid by the Air Force to design one that could patch itself into SunOS kernels invisibly, even into kernels with no modload support at all. It had special code that would search through the kernel binary for references to the address of the Ethernet chip, and patch itself in during the very low level interrupt handling. It was highly optimized so it wouldn't show up by loading down the machine, and it did things like decrement the interrupt counter so that even the extra interrupts caused by running the Ethernet chip in 'receive every packet on the wire' mode wouldn't be visible. He talked about enhancements that would automatically forward packets of interest back out onto the Internet, so the whole shebang would hide in kernel memory, never visible to users, never running any processes or altering any files. Think of it as Digital Telephony wiretap technology for the Internet. The idea was to design something that you could run on a machine without the owner ever finding out about it. To break into that person's network. It's a tool customized for crackers. It's one of the tools that Mitnick was after when he broke into Tsutomu's machine. Tsutomu actually wrote and ran this stealth BPF code (as well as designing it) and got into a tiff with the Air Force. They wanted the code, not just the design paper they'd commissioned. He countered by offering to post the code to the net, with a copyright that let anyone EXCEPT the government use it, if they wouldn't pay him for the paper. I don't know how the situation was eventually resolved. Tsutomu has lots of glib rhetoric about how he just builds tools and they can be used for good or evil. This tool is custom-designed for evil. Maybe in wartime the Air Force will want to inflict evil on an opponent. Or maybe instead they'll pass it to a latter-day J. Edgar Hoover. Either way, it's evil. It doesn't become good when you inflict it on someone you dislike. -- John Gilmore gnu(a)toad.com -- gnu(a)eff.org Don't introduce that Tsutomu to your girlfriend.

4 3

Re: Zimmermann case is dropped.
by John Young 17 Dec '03

17 Dec '03

Responding to msg by nobody(a)REPLAY.COM (Anonymous) on Fri, 12 Jan 2:50 PM > ...and I'm sure they'll be watching VERY closely to >see how version 3.0 will be distributed.... AUSA William Keane in today's WSJ: "This decision shouldn't be interpreted as meaning anything. I caution people against concluding the Internet is now free for export."

4 3

PGP replay attack
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There has been some discussion on using replay attacks against PGP recently. However, a timestamp is stored in the signature packet and is signed along with the plaintext intended to be signed. This eliminates the need to include a timestamp in clear-signed data. Someone can still send a signed e-mail to a third party that was not the original recipient and make it appear as though the sender did actually send the message to the third party (e.g. Alice sends signed message to Bob Bob sends message with faked headers signed by Alice to Carol Carol believes Alice actually sent the message to her) Such an attack would have to executed shortly after the message was originally clear-signed. However, including timestamps in text to be signed is not necessary. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPhourZc+sv5siulAQHTTAP/XBlrV7nHd5pR9aTXr2Uk0M0fw4I6IjZZ xeCx++vuIjcQuo/k8xH9YvBbn+MuoE11xbVLD58xYbELuVSdMUzCQ1mpQMho8mzs O0ALr8dahq0N0Gl5kLwb97MzgJOgTwy6NSIK6883NCktAWJMsFoADpdzmDGWQbTc ZzXJ3w5OiAQ= =fWJb -----END PGP SIGNATURE----- -- finger -l markm(a)voicenet.com for PGP key http://www.voicenet.com/~markm/ Fingerprint: bd24d08e3cbb53472054fa56002258d5 Key-ID: 0xf9b22ba5 "The NSA can have my private key when they pry it from my cold, dead neurons." Unknown

1 0

DEC AltaVista Closer To Commercialization [NOISE]
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Digital's Samuel H. Fuller, VP of corporate research for Digital, and Alan Jennings, Digital's manager of advanced technology business development, also told Newsbytes that Alta Vista has "re-started its Web crawling," to add even more pages to the total of 60 million Web pages -- representing half of all pages on the Web -- that were already indexed by December 15, when the new "super spider" Web facility opened to the public. "And as Alta Vista took off as the fastest growing Web site, we have quadrupled the capacity of our AlphaServer 8400 system from two to eight processors, and doubled the memory," noted Fuller. This leaves a "factor of two headroom" in terms of both processing power and memory, meaning that a single 8400 system should be able to host and accommodate an index for the entire Web, the VP added. The Alta Vista site also uses a smaller Alpha server to house the "super spider" itself. As reported in Newsbytes on December 15, Jennings previously said that Alta Vista is able to search up to 2.5 million Web pages a day. Lycos, Alta Vista's closest competitor, had searched only 7 million Web pages up to that time, and the World Wide Web Worm about 3 million Web pages, in comparison to Alta Vista's 60 million pages, Newsbytes was told. Alta Vista's high search speeds are made possible by the ability of the super spider to algorithmically "breed" batches of smaller Web crawlers, together with the use of Alpha processing power and high-speed ATM (asynchronous transfer mode) networks, according to Jennings. Fuller and Jennings told Newsbytes this week that Digital is currently assessing Alta Vista usage patterns and the half dozen- or-so "business inquiries" received each day to decide where to take Alta Vista on a commercial basis. On Friday, December 15, Alta Vista received 300,000 hits, a number that grew to 600,000 on Monday, December 18, 1.5 million by Wednesday, December 20, and 2 million per day following the December holidays, according to Fuller. In earlier beta testing, some 10,000 users employed Alta Vista to look up references to themselves and their families, to locate old friends and college roommates, and to access market research, information about the Web, and facts about corporate travel destinations. Like their counterparts within Digital, many Web users among the public at large have been employing Alta Vista for genealogically search purposes, Jennings said. Alta Vista is also emerging as "a real solid research tool covering the breadth of the Web," he asserted. In addition to obtaining an index of all Web sites containing a specified search term, and being able to move to those sites through hotlinks, users can obtain "reasonably good information regarding the characteristics of Web sites," such as "how frequently (the sites) are referenced, and the number of pointers." You can also employ can also employ case-sensitive matches, and limit searches to titles or other specified sections of a document. Digital officials have been impressed by Web users' "ingenuity" in inventing applications for Alta Vista. One company, for example, wanted to get in touch with all other firms with links to its site, he illustrated. Upon learning that Alta Vista is able to search for URLs (user resource locators), or pointers, the user conducted a URL search, and then proceeded to send out a broadcast e-mail message over the Internet to all linked sites. Business inquiries, he reported, have fallen into three main categories: users who want to use Alta Vista internally, license the search engine, or advertise their goods and services on the Alta Vista home page. "We'll start to make decisions on these within the next 30 days, and by the end of the quarter, (the decisions) will be part of our general business plans," Jennings told Newsbytes. "Digital is inching toward decisions on what they're going to do," pointed out Jim Green, an analyst at Summit Strategies. "Clearly, this Web site has met with astounding success. Alta Vista lets you start to make sense of the Internet. It makes you think about exactly what you want, because it will give you everything," the analyst told Newsbytes. "I see Alta Vista as a very useful tool for competitive analysis," observed Greg Kline, director, Network Integration and Management Research, at the Business Research Group (BRG). "I think that as Digital gets closer to finalizing their plans, they'll be speaking more about Alta Vista's most sophisticated search capabilities. And as Web servers become the corporate infrastructure through the "IntraNet,' users will be seeing the need for a tool to index their information assets," Kline told Newsbytes. You can access the Alta Vista home page on the Web at http://www.digital.com . A.E.N.

1 0

exposure=deterence?
by cmerritt＠intellinet.com 17 Dec '03

17 Dec '03

jimbell(a)pacifier.com (Jim Bell) wrote in part: >In my opinion, we (the ordinary members of the public) cannot consider >ourselves to have won this encounter until the REAL enemy here, the >government employees who targeted Zimmermann There is a group of government employees that decided to put William Keane on this case. Someone(s) started sending customs agents around the country. Someone(s) is responsible for making several defenders of privacy miserable. These government employees SHOULD NOT be allowed to hide in their government holes in complete privacy. We need the credits now that the movie is over. How much money was spent? [FOI anyone?] I am afraid that all I could provide is the name of one Customs Special Agent. I dont think she is responsible for anything - she was told go interview so-and-so and off she goes. Who sent her? ---> How could we find out? <--- It seems correct that the NAMES of the government employees and HOW MUCH MONEY THEY SPENT be made public. Deterent enough. I feel that public exposure is enough to put fear into these anonymous government employees. You will note that when they get the mad_bomber some FBI guy jumps right up and takes credit, live, on TV. But when the Air Force orders a $300 toilet seat NO ONE is credited. Boy! Am I pissed! ...cm

7 7