December 2003 - cypherpunks-legacy

Re: Denning's Crypto Archy [LONG]
by Duncan Frissell 17 Dec '03

17 Dec '03

The Future of Cryptography Dorothy E. Denning Georgetown University Revised January 6, 1996 [Responses by Duncan Frissell in square brackets] Although May limply asserts that anarchy does not mean lawlessness and social disorder, the absence of government would lead to exactly these states of chaos. [Tim is rarely given to limp assertions. I haven't seen him spend much time arguing about the exact social arrangements of a free society following the crypto revolution. He has merely pointed out the results of the technology.] I do not want to live in an anarchistic society -- if such could be called a society at all -- and I doubt many would. [Whatever happens, there will always be plenty of cults around (perhaps even one called the Government of the United States of America) to which anyone will be free to belong and at the altars of which one will be free to worship. In fact the deregulation of human interaction will make it easier for more oppressive cults to exist than is possible today as long as they keep to themselves. There will be no shortage of people willing to tell their followers what to do. Nothing will stop anyone from joining such a society.] A growing number of people are attracted to the market liberalism envisioned by Jefferson, Hayek, and many others, but not to anarchy. Thus, the crypto anarchists' claims come close to asserting that the technology will take us to an outcome that most of us would not choose. [Still up for negotiation is how liberal a market we will want. The growing power of markets and (traditional) liberal ideas is the result of the growing wealth and power of individuals around the world. Crypto anarchists merely point out that the shape of future market societies is no longer in the hands of "The Authorities" but is rather in the hands of those trading on the market; i.e., everyone on Earth."] This is the claim that I want to address here. I do not accept crypto anarchy as the inevitable outcome. A new paradigm of cryptography, key escrow, is emerging and gaining acceptance in industry. [That is what remains to be seen.] The drawbacks of cryptography are frequently overlooked as well. The widespread availability of unbreakable encryption coupled with anonymous services could lead to a situation where practically all communications are immune from lawful interception (wiretaps) [My thoughts are immune from 'lawful interception' as are everyone else's and yet the world survives. Thought is communication within the brain. Communication is 'thought' between brains. The world which has survived private thoughts can survive private communications. The whole concept of controlling communications is a bit obsolete in any case. In past eras, the only social threat came from large masses of men (hence the desire to intercept and control communications) whereas today any individual can do more damage than a large group in the past.] and documents from lawful search and seizure, and where all electronic transactions are beyond the reach of any government regulation or oversight. The consequences of this to public safety and social and economic stability could be devastating. [See the recent joint study by the Cato Institute, the Fraser Institute, and 9 other think tanks world wide showing that there is a strong positive correlation between nations with free economies and nations with wealth. There seems little doubt that total economic deregulation is a good thing. We shall certainly have the chance to test that hypothesis in coming years. I haven't seen any nation harmed so far by having too free an economy.] With the government essentially locked out, computers and telecommunications systems would become safe havens for criminal activity. Even May himself acknowledges that crypto anarchy provides a means for tax evasion, money laundering, espionage (with digital dead drops), [That is, keeping your own money, transferring funds, and research. Sounds like activities that should not be the concern of others.] contract killings, [These may be easier although *government* killings will be harder since governments may lack the resources to do as much of that sort of thing as they have done before. (From 1917-1989, Communist governments murdered someone every 30 seconds -- a total of some 60 million people.) In addition, those who fear they may be the subject of contract killings can use pseudonyms, locational ambiguity, and untraceable communications to make themselves harder to find and thus to kill.] and implementation of data havens for storing and marketing illegal or controversial material. [Last time I looked, controversial material was legal to possess and transmit. Illegal information will no longer be illegal if its transmission can't be stopped since utterly unenforceable laws tend to go away (see Sodomy).] Encryption also threatens national security by interfering with foreign intelligence operations. The United States, along with many other countries, imposes export controls on encryption technology to lessen this threat. [Of course if the US is weakened by the growth of (really) free markets, its enemies will be as well so foreign threats will automatically diminish.] Cryptography poses a threat to organizations and individuals too. With encryption, an employee of a company can sell proprietary electronic information to a competitor without the need to photocopy and handle physical documents. [This is a threat from digitization, not from encryption.] The keys that unlock a corporation's files may be lost, corrupted, or held hostage for ransom, thus rendering valuable information inaccessible. [Or the computers can not be backed up, can crash, can be blown up, can be flooded, can experience disk failures, etc. This is not a problem unique to encryption. Backups and scattered sites are always necessary. High-speed networks, secure communications, and encryption make it easier to back up your systems at different locations all over the world. They help you avoid data loss, they don't contribute to it. Key splitting and private key escrow can easily protect keys.] When considering the threats posed by cryptography, it is important to recognize that only the use of encryption for confidentiality, including anonymity, presents a problem. [Of course confidentiality is the reason codes were invented in the first place. Additionally, the Supreme court has recognized that anonymity has First Amendment protection. We have already made the social decision that anonymity is OK in many circumstances. I'm sure that all of us engage in many anonymous transactions on a daily basis and yet the world survives.] Crypto anarchy can be viewed as the proliferation of cryptography that provides the benefits of confidentiality protection but does nothing about its harms. It is government-proof encryption which denies access to the government even under a court order or other legal order. [In countries that don't regularly practice torture, we have the power to disobey court orders in any case. Modern technology merely makes it easier and reduces the likelihood of punishment. Court orders are rare in any case. Seems like much ado about nothing.] It has no safeguards to protect users and their organizations from accidents and abuse. [This is the job of those who write software, not philosophers.] The crypto anarchist position is that cyberspace is on a non-stop drift toward crypto anarchy. [I usually argue that the spread of markets is driven more by cheap telecoms and the growth of a very efficient market infrastructure. Cryptography hasn't had much of an impact yet. I think that even without crypto, markets will swamp attempts to regulate them and since people can move as well, they are becoming harder to control even before any crypto revolution.] In addition to the free encryption programs being distributed on the net, encryption is becoming a basic service integrated into commercial applications packages and network products. The IP Security Working Group of the Internet Engineering Task Force has written a document that calls for all compliant IPv6 (Internet Protocol, version 6) implementations to incorporate DES cryptography. [The net belongs to its customers and as owners they will probably decide to secure their property. Sounds enormously democratic to me.] The potential harms of cryptography have already begun to appear. As the result of interviews I conducted in May, 1995, I found numerous cases where investigative agencies had encountered encrypted communications and computer files. These cases involved child pornography, [Possession of a bunch of zeros and ones.] customs violations [free trade] drugs [the retail pharmaceutical trade] espionage [research] embezzlement [finally a crime] murder [Another crime. Can you give us the details of a murder investigation blocked by cryptography? We don't need any names.] obstruction of justice [Refusal to make things easy for prosecutors. A *real* crime. This wasn't Hillary by any chance, was it?] tax protesters [You mean tax evaders, don't you? Far as I know, protesting taxes is a legal activity.] and terrorism. [State-sponsored or private?] At the International Cryptography Institute held in Washington in September, 1995, FBI Director Louis Freeh reported that encryption had been encountered in a terrorism investigation in the Philippines involving an alleged plot to assassinate Pope John Paul II and bomb a U.S. airliner [4]. [But the perp was caught anyway. Is this the same Louis Freeh who thinks that the loss (by him) of a government cellphone is just as bad as the FBI issuing shoot-to-kill orders against American citizens before even trying to arrest them (since he punished both with a letter of reprimand)?] AccessData Corp., a company in Orem, Utah which specializes in providing software and services to help law enforcement agencies and companies recover data that has been locked out through encryption, reports receiving about a dozen and a half calls a day from companies with inaccessible data. [Sounds like poor system design. I'm not sure that advising others how to safely store their business records has anything to do with law enforcement, however.] The idea is to combine strong encryption with an emergency decryption capability. This is accomplished by linking encrypted data to a data recovery key which facilitates decryption. This key need not be (and typically is not) the one used for normal decryption, but it must provide access to that key. The data recovery key is held by a trusted fiduciary, which could conceivably be a governmental agency, court, or trusted and bonded private organization. A key might be split among several such agencies. [Why would a government agency or a court be the best entity to provide business services? If I'm looking for someone to install a LAN in my office, I don't immediately think to call the Post Office and get them to bid on the job. Business services like data backup and recovery are much more likely to be efficiently accomplished by a private contractor.] Organizations registered with an escrow agent can acquire their own keys for emergency decryption. An investigative or intelligence agency seeking access to communications or stored files makes application through appropriate procedures (which normally includes getting a court order) and, upon compliance, is issued the key. [But what if it turns out that my chosen escrow agent is located outside the jurisdiction of the court. Surely you don't want to cause any NAFTA or GATT problems here. The WTO might declare your encryption policy to be an unfair trade practice.] Legitimate privacy interests are protected through access procedures, auditing, and other safeguards. [But what if some of us want better protection than bureaucratic promises and procedures. Some people in the past who relied on government promises and procedures ended up in crowded "shower" rooms trying to extract oxygen from diesel exhaust.]. In April, 1993, as response to a rising need for and use of encryption products, the Clinton Administration announced a new initiative to promote encryption in a way that would not prohibit lawful decryption when investigative agencies are authorized to intercept communications or search computer files [6]. [And a rousing success it was.] The IBAG principles acknowledge the right of businesses and individuals to protect their information and the right of law-abiding governments to intercept and lawfully seize information when there is no practical alternative. [Is a communist dictatorship a "law abiding government?"] The principles call for industry to develop open voluntary, consensus, international standards and for governments, businesses, and individuals to work together to define the requirements for those standards. The standards would allow choices about algorithm, mode of operation, key length, and implementation in hardware or software. Products conforming to the standards would not be subject to restrictions on import or use and would be generally exportable. [Gee, I thought that was what we were doing.] It is conceivable that domestic and international efforts will be sufficient to avoid crypto anarchy, particularly with support from the international business community. However, it is possible that they will not be enough. Many companies are developing products with strong encryption that do not accommodate government access, standards groups are adopting non-key escrow standards, and software encryption packages such as PGP are rapidly proliferating on the Internet, which is due, in part, to the crypto anarchists whose goal is to lock out the government. Since key escrow adds to the development and operation costs of encryption products, the price advantage of unescrowed encryption products could also be a factor which might undermine the success of a completely voluntary approach. [Sounds like the voluntary cooperation of human beings in international markets is just humming right along isn't it? It seems that a lot of market participants are "voting with their feet" for strong crypto. The System is the Solution.] Under this licensing program, commercial encryption products, including programs distributed through public network servers, would comply with government regulations. [Isn't a "public network server" just a server that is made world readable? Since there will be (conservatively) 100 million "public network servers" online in a few years, won't enforcement be a trifle difficult?] Such an approach would not prevent the use of government-proof encryption products by criminals and terrorists. They could develop their own or acquire the products illegally. But an approach of this type would make it considerably more difficult than it is at present. Had such controls been adopted several years ago -- before programs such as DES and PGP were posted on the Internet -- the encryption products on the market today would support key escrow or some other method for government access. [As I recall, wasn't public key encryption developed in spite of the fact that the NSA had in place an unofficial ban on cryptographic research? The NSA's ban failed. Since you are not proposing outlawing such research, what makes you think that mere distribution controls will work? ] It would not be possible to acquire strong, government-proof encryption from reputable vendors or network file servers. The encryption products available through underground servers and the black market would most likely not possess as high a quality as products developed through the legitimate market. [The Internet itself runs primarily on software developed on the open market from non-commercial sources without slick packaging. It seems to have met with some market acceptance in spite of the lack of shrink-wrap packaging.] Crypto anarchy is an international threat which has been stimulated by international communications systems including telephones and the Internet. Addressing this threat requires an international approach that provides for both secure international communications crossing national boundaries and electronic surveillance by governments of criminal and terrorist activity taking place within their jurisdictions. [It's nice to be noticed. How, exactly, is this voluntary, international, standards regime going to deal with the desire of different governments to control different communications. Look at the problems, some governments want to ban American movies, the Asian Wall Street Journal, books on the health of former heads of state, public records of sensational murder trials, phone calls made using callback services, financial wire services, novels by leftist co-religionists living in England, email containing the English word for sexual intercourse (if readable by children), directions on where to obtain an abortion in London, etc. And all these governments will want to crack private transmissions in order to find those responsible for these "crimes." This is going to be a hell of a challenge for a voluntary, international standards regime. I think it is probably beyond the capabilities of such an institution to mediate among all of these competing desires to control the communications of others.] DCF "BTW if one spellchecks the word unescrowed (as in unescrowed encryption) one is likely to encounter the suggested replacement "unscrewed" (as in unscrewed encryption).

2 1

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 14:49 1/24/96, Alex Strasheim wrote: >Big companies like Netscape, Sun, Microsoft, and IBM/Lotus, on the other >hand, will almost certainly achieve their objectives if they win the >political fight. They'll make buckets of money selling crypto software >abroad. And if they lose the fight, they're going to be handing big >opportunities to foreign competitors. The big companies are fighting? Where did you get that idea? IBM/Lotus just gave the feds the keys. Not a single one of the major players has challenged the government in any meaningful way. Sure, they make a lot of noise as to how they dislike the regulations, but they certainly aren't making a sincere effort of trying to change them. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Nym use in the real world
by peer＠alpha.c2.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > With the coming Internet restrictions and growing use of the > net by LEAs, it's become obvious to me that I shouldn't post > messages with my real name. My reasons for experimenting with nymdom are somewhat different. I have no intentions of using my nym for anything that I would not do using my True Name. I see it more as a tool for segmenting the knowledge the outside world has about me. With the expansion of information ubiquity and easy access to powerful search tools, nyms become a welcome tool to foil the dossier builders. > 1. reputation. My nym will need to build it's own reputation, I > know. But I currently get offers of work based on my reputation > and posts. I would like this to continue. When it comes time to > do the work and collect the pay, I need to tie my nym to me. While certainly useful, nyms have very definite practical limits. I see them as more useful and flexible once one discards the monolithic nym concept (ie my name is xxx and my nym is Peer). When one uses multiple nyms for multiple purposes, discarding the secrecy of one is less troublesome. This also allows the cultivation of positive reputation in diverse reputation markets. Of course, doing this to any great extent may be more trouble than it's worth. > 2. does it (a nym) really help? Police and governments are used to > dealing with people who change their names, use fake names, etc. I > get the impression that having multiple/fake names is considered by > police to be evidence or at least indication of guilt. "If you're > not guilty why're you hiding?". While there is certainly a stigmata associated with nymdom (even occasionally on Cypherpunks, of all places), I don't think it will provide any additional liability (assuming nyms themselves don't become illegal). If your nym is investigated and compromised, then your True Name has already been linked to your actions - they know you're guilty. And while using a nym may attract unwanted attention due to its nature, can it be worse than using your True Name? Perhaps. I keep forgetting about selective enforcement... Peer Aside: How many people here actually check signatures? For those who don't, does seeing a signed message inspire any additional confidence? For those who do, does seeing an incorrectly signed message inspire any less confidence? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQlwCKUvpX8WyJyxAQGUuAP/UZXCUbD9iJdmjOb9QGoZ8lD3j22bbeU0 04ucZ81EBMLB0rrOoaCihW7ywvm54/o5uJIw5QN68bkj5ZlM5MqCHn9j7Cowvyb6 VHY+5dhULDpT6GF5CRcxbYmdyYpbl0nHzO8PeaG0oX46+YJTEhDpXoywBxDcjHnP +YLtJ+7xUx4= =uesQ -----END PGP SIGNATURE-----

1 0

Re: "This post is G-Rated"
by Bruce Baugh 17 Dec '03

17 Dec '03

At 08:06 PM 1/25/96 -0800, Johnathan Corgan <jcorgan(a)aeinet.com> wrote: >This would allow to emerge a free market 'ecology' of ratings agencies, >similar to the system that has emerged in the PC technology >market for product reviews. This seems to me a task of crucial importance, as I listen to the conversations of relatively net-clueless folks. Their first reaction, upon learning about net abuse, is to demand that abusers be tracked down and punished. Privacy-enhancing tools make this more difficult. It seems to me that if we're to avoid a wholescale crusade against net privacy, we _really_ need to have a credible alternative to offer: both the software and the wetware :-) to let individuals screen out offending drek. Having canned solutions is especially important, since many of the people most susceptible to anti-privacy propaganda are precisely those who don't know and likely aren't going to know how to construct their own filters. I see this as a matter of enlightened self-interest, therefore. I can't write code worth squat, but I can write other things. I'm starting in on a Web-based guide to privacy tools, with screen shots and the like. If anyone has useful info to contribute about screening out crud for novices, write me! I need to hear from you! Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

1 0

Time codes for PCs (fromn German Banking)
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:11 PM 1/24/96 -0500, Dave Emery wrote: >> >> Was the person in the basement eavesdroping or actuall performing a >> man-in-the-middle attack? >> > Very much the easiest way of doing this is a classic man in the >middle attack with two vanilla off the shelf modems and a vanilla off >the shelf central office simulator. The modems would be tied more or >less back to back through two serial ports and software on a laptop in >the basement, one modem connected to the actual phone line to the central >office and the other connected to the local wires to the targets home >through the central office simulator. This way all traffic in both >directions would go through the modems and software on the laptop >allowing the connection to be taken over cleanly between packets, and >packets to be injected and deleted as needed. I beleive that it would >not be hard to make such a MITM decode the DTMF dialing from the target >and dial the same number on its outgoing modem thus enabling the >MITM to passively relay modem calls it wasn't interested in spoofing. >And incoming modem calls could be similarly handled. A peripheral I've long wanted to see, commonly available: ACCURATE time, broadcast to the millisecond/microsecond/nanosecond, available from sources as varied as TV VIR's, FM subcarriers, and other sources, available as an easy input (via a peripheral card) to a computer. I have a 12-year-old Heathkit "Most Accurate Clock" that I assembled myself, and had the foresight to install it with its computer interface option. (receives 5, 10, or 15 MHz signals broadcast from Boulder, Colorado, containing "exact" time.) While I've never taken the time to connect it to my PC, it provides (through an RS232 jack) correct time with a rated accuracy of about 5 milliseconds, as I vaguely recall. (Even has a dipswitch setup on the bottom to tell it how many 500 mile increments you are away from WWVB... corrects for delay to a first order of magnitude.) (BTW, if anybody knows how to easily connect it to the pc, or has the appropriate software, please tell me The task isn't difficult from a hardware standpoint; it's just RS-232 serial ASCII timecode at about 9600 bps which either continuously retransmits or on request. The problem is the software: How, exactly, do I INTERFACE such a serial input to the existing computer/RTC combination? (Don't tell me to plug it into an unused serial jack! I'm not stupid. I'm not a programmer, and I don't play one on TV! (I know gates, flops, op amps, A/D, D/A, microprocessor hardware design, even some Z-80 assy language, RF, and I've programmed in Fortran, Basic, APL, Algol, PL/1, Pascal, LISP, but not recently and I don't enjoy it!) (Then again, there are those "Receptor" watches which have (at least) similar accuracy, which as I understand it work on FM subcarrier principles.) Technology has now supplanted this old monstrosity: Even with CHEAP GPS receivers, they put out time which is rated in accuracy to well better than 1 microsecond, and probably better than 200 nanoseconds even with S/A turned on, and probably 100 nanoseconds with S/A off. Once GPS receivers contain equally cheap DGPS receivers, they'll be able to tell you your location to about 1 meter and corresponding time accuracy, about 3 nanoseconds. I'm not particularly familiar with TV VIR signals, but I'd imagine they are timecoded, or at least they COULD be without a lot of effort. Resolution would be FAR better than 1 microsecond, and accuracy would be primarily limited by knowledge of your location compared to the xmitter. MITM attacks would be far more difficult if both ends of the data conversation agreed on the "exact" time, and could detect transmission delays and CHANGES in transmission delays. While it would be possible to locally spoof the accurate timecode, a cheap version of a "disciplined oscillator" (which any GPS receiver is going to have, anyway) would detect such short-term spoofing trivially. Occasionally, I've speculated on whether it might be useful to be able to synchronize (or, at least, KNOW) to the PHASE of the 60 Hz power grid. True, I know that the HV grid is 3-phase and most people won't know which phase they're on anyway, but that wouldn't change (at least not frequently!) , and I would imagine that it might be useful. You wouldn't necessarily know which CYCLE you're on, either, but again that might be compensated for somehow. If your computer were talking, locally, to another computer at 4100 baud (? whatever) (7 bits per symbol(?); equals 28.8kbps) you could "easily" agree on a particular cycle relationship, which is going to be essentially constant over a distance of a few tens or even hundreds of miles. What I DON'T know (and some HV transmission engineer will probably be able to tell me, hint hint!) is how STABLE this phase is across the entire country? I realize that this will probably depend on who'se shipping excess power to whom at the moment, But I'd imagine the variability will be distinctly limited. The biggest attraction of such a system is that the interface would probably be trivial: Getting it from the P/S is out because they didn't anticipate such a thing. The easiest interface might be an AC wall xformer with a rectifying limiter and slicer (Okay, maybe just a resistor and a diode, possibly with the addition of a comparator for precision), driving a readable pin on an otherwise-unused RS-232 interface. (Possibly installed similar to a dongle.) Appropriate software (yucch!) would read the square waves, and record the phase at any one time. Such information could be used to verify the relative synchronization between two different computers, although it would be necessary to identify particular phases, as I mentioned before. BTW, if you're read this far, I think it would be appropriate to introduce myself, despite the fact that I've already been posting to this area for a few weeks. I'm James Dalton Bell (yes, THOSE Daltons!) and I'm in Vancouver, Washington, USA. I may talk like a EE, but am not; I have formal and/or informal backgrounds in Chemistry (BS Chemistry MIT 1980), electronics (analog and digital and RF (N7IJS) and uP), physics, and keep an eye on numerous other technical fields. Politically, I'm 120/120 on the Nolan chart (there's some questions they left out (that's a joke)) which means I'm a "extremist libertarian." I'm also rather newly anarchistic, and (with all due modesty) rather inventive. Current employment? None. Well, nothing to speak of. But you'll be hearing more about me. Jim Bell Klaatu Burada Nikto Remember this. It'll become important, soon. "Something is going to happen. Something....wonderful!" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQlyv/qHVDBboB2dAQHZvQP+IKeO508C7ZTA22DSELjvpWTYa0iGtTcX U486t+8P0iC9qxq346wzxm9USae4d8NOM9wBKrio095hrKnzAZQE1BETUKCx3BJv bywqin7Qjb87j6OECJ6S/eAh5t6LXMnDepGdUr7rw+gBxsNg7kzz10/TGh4pXKNu D5PuGPnTY34= =r4JO -----END PGP SIGNATURE-----

5 5

No Subject
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Jim Bell writes: >While this would normally be my cue to offer up my "Assassination Politics" >idea, which (if presumed to be correct) would stabilize "anarchy" and >prevent "lawlessness and social disorder" (at least as normally seen by the >average reader) I think that under the circumstances that would be redundant >here. I'm not *sure* that your Assassination Politics trip is the worst piece of tripe I've ever seen on the list, but if it's not, it's right up there. Those of us who are anarchists are often that way because we think the *means* the State uses are evil, not to be excused by any amount of mumbo-jumbo. And you gleefully propose to let us *all* in on the immoral game of murdering those who annoy us sufficiently. I'll pass. You know, if I were constructing an agent provacateur, I'd want a persona who's willing to be loudly clueless with ideas that show minimal or non-existent awareness of basic human hopes and fears, like security from random hit-squads. I'd have him go on and on with his ideas, until eventually they can splashed all over headlines and used to discredit the whole realm of privacy protection. But no, I don't think you're an agent. More fool you, you're willing to do the government's disinformation work for it without even thirty pieces of silver or a 401K. At this point I recommend to you the 12-step program I explained to Vladimir. Signed, A Friend

1 0

Can't be THAT Fred Cohen :-)
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

From: gary.schermerhorn(a)nyapps01.gsam.gs.com (Gary Schermerhorn) Date: Fri, 26 Jan 96 08:13:56 EST Message-Id: <960126080515.ZM21151@scherg> Subject: Question Does anybody know a consultant named Fred Cohen? I'm doing some background work. Please get back to me if you know him. -- Gary Schermerhorn (scherg(a)gsam.gs.com) Goldman Sachs Asset Management 1 New York Plaza, 42nd Floor (212) 902-3344 (phone), (212) 428-1008 (fax)

1 0

weak cryptoanarchy
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Some non-cypherpunks seem afraid of Tim May's cryptoanarchy, which, to quote Dr. Denning's recent paper, "suggest the impending arrival of a Brave New World in which governments, as we know them, have crumbled, disappeared, and been replaced by virtual communities of individuals doing as they wish without interference." Perhaps these people are worrying needlessly. I don't think cryptoanarchy (in this strong form) is a likely scenario for the future. Even if strong cryptography and anonymous transaction systems are used by everyone, governments can continue to control people's physical actions and properties. The physical world will continue to exist, even if it becomes relatively less important. I think a better prediction for the implications of strong crypto is what I would call "weak cryptoanarchy." That is, cryptography will allow virtual communities the option to exist without the possibility of inteference by force. Certainly some virtual communities, such as moderated discussion groups, will opt to have formal or informal governments. The key is that people will have the choice of participating in communities where physical violence will be absolutely powerless. Stated in this form, cryptoanarchy is hardly controversial. Plus, this weak form of cryptoanarchy has a much better chance of being realized, because it does not require the collapse of existing governments, only the creation of new communities without governments.

2 1

Windows PGP mail reader
by jims＠conch.aa.msen.com 17 Dec '03

17 Dec '03

Hi. Can anyone recommend a Windows based email/POP3 reader that can decrypt content? Please reply via email: Jim Schueler jims(a)msen.com

3 3

Edited Edupage
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)elanor.oit.unc.edu" 25-JAN-1996 23:36:37.75 Subj: Edupage, 25 January 1996 >***************************************************************** Edupage, 25 January 1996. Edupage, a summary of news items on information technology, is provided three times each week as a service by Educom, a Washington, D.C.-based consortium of leading colleges and universities seeking to transform education through the use of information technology. ***************************************************************** INSECURITY FEARS A North American study on Internet security by Ernst & Young says that companies fear doing business via the Internet. Companies with a direct Internet connection are concerned that outsiders can gain access to their systems and data bases, and companies that transmit sensitive financial information worry about the security of these transactions. (Toronto Globe & Mail 25 Jan 96 B5) -------------------- If they're actually seriously becoming paranoid about this, it's an opportunity to press cryptography. Anyone seen the original study? -------------------- >TELECOM "GIVEAWAY" CONTROVERSY MAY BE DEFERRED Senate Commerce Committee chair Larry Pressler (R., SD) is suggesting that a controversial provision of the telecommunications legislation be removed from that legislation and addressed in a separate bill. The provision has been attacked by Senator Bob Dole and other Republicans as a "giveaway" of valuable airwaive spectrum to TV broadcasters for uses such as high-definition television. (New York Times 25 Jan 96 C6) --------------------- Looks like another anti-"CDA" campaign may soon be neccessary. -Allen --------------------- Edupage is written by John Gehl (gehl(a)educom.edu) & Suzanne Douglas (douglas(a)educom.edu) Voice: 404-371-1853, Fax: 404-371-8057. *************************************************************** EDUPAGE is what you've just finished reading. (Please note that it's "Edupage" and not "EduPage.") To subscribe to Edupage: send a message to: listproc(a)educom.unc.edu and in the body of the message type: subscribe edupage John Lewis (assuming that your name is John Lewis; if it's not, substitute your own name). ... To cancel, send a message to: listproc(a)educom.unc.edu and in the body of the message type: unsubscribe edupage. (Subscription problems? Send mail to educom(a)educom.unc.edu.) ARCHIVES & TRANSLATIONS. For archive copies of Edupage or Update, ftp or gopher to educom.edu or see URL: < http://www.educom.edu/>. For the French edition of Edupage, send mail to edupage-fr(a)ijs.com with the subject "subscribe"; or see < http://www.ijs.com >. For the German edition, genugt eine E-Mail an: infomat(a)stern.de mit der Betreff- oder Textzeile "STERN Online Edupage". For the Hebrew edition, send mail to listserv(a)kinetica.co.il containing : SUBSCRIBE Leketnet-Word6 <name> or see < http://www.kinetica.co.il/newsletters/leketnet/ >. For the Hungarian edition, send mail to: send mail to subs.edupage(a)hungary.com. For the Italian edition : < http://dbweb.agora.stm.it/webforum/infotech > or send mail to: b.parrella(a)agora.stm.it. for info. For the Portuguese edition, contact edunews(a)nc-rj.rnp.br with the message SUB EDUPAGE-P Seu Primeiro Nome Seu Sobrenome. For the Spanish edition, send mail edunews(a)nc-rj.rnp.br with the message SUB EDUPAGE-E Su Primer Nombre, Su Apellido.

1 0

Re: weak cryptoanarchy
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:14 AM 1/27/96, Anonymous wrote: >I think a better prediction for the implications of strong >crypto is what I would call "weak cryptoanarchy." That is, >cryptography will allow virtual communities the option to exist ^^^^^^^^^^^^^^^^^^^ >without the possibility of inteference by force. Certainly some >virtual communities, such as moderated discussion groups, will >opt to have formal or informal governments. The key is that >people will have the choice of participating in communities >where physical violence will be absolutely powerless. > >Stated in this form, cryptoanarchy is hardly controversial. >Plus, this weak form of cryptoanarchy has a much better chance >of being realized, because it does not require the collapse of >existing governments, only the creation of new communities ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >without governments. ^^^^^^^^^^^^^^^^^^^ The paper which Prof. Denning was responding to was my paper, "Crypto Anarchy and Virtual Communities." Seems like I anticipated your point. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

FWD: Internet e-mail
by Lynne L. Harrison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The following was posted to another list. Has anybody heard about this? [Gee, I _wonder_ if there will be escrowed keys...] ******Begin Forwarded Message********* >I just read in "legal.online" that the Postal Service plans to provide >secure email service. It will include encryption plus offer U.S. mail fraud >protection. Of course there is no estimate on cost. Regards - Lynne -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQmOdj5A4+Z4Wnt9AQGKQQP+KRNFsI7DMk6nJwmWDpZkdX1RAtvJRdMo 38YL44AW4KxMO7SJdtkdAUhmWI6Y6bkWQ1+YXuRkG6wVN724k30vSui5vqO88GNF 0lvXyuJmL0z76yGbZmwf2l06L767MAX6P4hXuaMP67VZ5VRwScoNhlmPnb5L50rD v2ZLWyC0Rvw= =lhVA -----END PGP SIGNATURE----- ******************************************************* Lynne L. Harrison, Esq. | "The key to life: Poughkeepsie, New York | - Get up; E-mail: | - Survive; lharrison(a)mhv.net | - Go to bed." *******************************************************

3 2

Cypherpunk Elitism
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

This message has some components that may be deemed appropriate for the list, and some that will not; since Dr. May considered it an appropriate topic, I am following his lead. However, feel free to take it to private email. From: IN%"tcmay(a)got.net" 18-JAN-1996 08:09:37.98 >(Ironically, I brought up the new book, "The Winner Take All Society," at the last Cypherpunks meeting. No time to discuss it here, but it confirms my strong belief that we are heading for a economy in which a shrinking fraction of workers have really valuable things to contribute, and a growing fraction of the population does not. I had not recalled the authors, but Strick had a battery-powered laptop and Metricom wireless modem, and ran an Alta Vista search from where he was sitting: ROBERT FRANK & PHILIP COOK, The Winner-Take-All Society, New York: The Free Press.) ---------------------------- You might also find Robert Reich's _The Work of Nations_ interesting. He divides jobs up into Routine Producers (factory-line workers), In-Person Servers (McDonald's clerks), and Symbolic Analysts (innovative programmers, scientists, etcetera). His analysis does have some problems. He views the growing lack of Routine Producer jobs in the US as due to their export to low-wage countries; I would add automation as another cause. He also makes the error of regarding education as the primary (or even only) difference between those qualified for various jobs, completely ignoring IQ's genetic component. His policy suggestions for taking care of what he (incorrectly) believes is a problem are also ridiculous. ----------------------------- From: IN%"alano(a)teleport.com" "Alan Olsen" 19-JAN-1996 00:00:39.70 >I have seen a number of posts on "Cypherpunk Elitism". I have seen more examples of it here on the list. I think that this attitude will be more destructive to the list than noise in the long run. It has been said that "Cypherpunks write code". They must do more than that. Cypherpunks need to teach. All the cryptotools in the world are of no use if no one knows how to use them. (Or know how to use them correctly.) All of the protocols are of no use if no one knows how to impliment them correctly or WHY they need them in the first place. There are a lot of bogus security methods. Many of them exist because people do not know better. Without someone to instruct them in the ways of these things, they will continue to go on with bad crypto, not knowing any better. Not all of the non-cypherpunks are beyond hope. Many of them are teachable. If we leave them to flounder on their own, cryptography will be something used only by an elite. It will be of little or no threat to the powers that be because only a small amount of people will have the ability to use it. The TLAs will have less encrypted trafic to sort through. They will have won a big battle, not through force of arms but force of egos. ---------------------------- Part of this depends on the size of the "small number of people," and on whom those people are. If a hundred people are using the remailernet, governments can trace messages (and can easily shut the down). If a million people are using it, governments cannot trace messages nearly as easily, and there will be more protest if it is shut down. If the people who are needed for a society to function are in that group, then a government would need to be suicidal to attack them; these people can also much more easily leave for another country. If those with the most income to lose via income taxes are those who are using fully anonymous ecash, then most of the government's unneeded revenue goes away. In other words, while teaching about cryptography is important... certain people are more worth teaching than others. This fact is analogous to that certain people will be more competent after college than others. Such qualities as intellectual ability, income, and position make some people more worth convincing than others. Incidentally, there is a mailing list for the discussion (and promotion) of intellectual Elitism. Its Draft FAQ (including directions for signing on) is at http:/ils.unc.edu/~vreer/elitefaq. (The list in question is unfortunately currently more disorganized than cypherpunks). More information can also be found at http://weber.u.washington.edu/~lfletch/elitism.html and http://ils.unc.edu/~vreer/elitism.html. -Allen

1 0

An Enigma - Wrapped In a Circle
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In the January/February 1996 Mensa Bulletin on pages 9-10 is an article by Teresa Fisher titled "An Enigma Wrapped In a Circle." The article is about a phenomenon which has interested me for quite some time, "crop circles" or "pictograms." I have tried to find this excellent article on the web and failed, so I will quote a few parts of it I consider relevant. All typos are mine, Ms. Fisher is an excellent writer, and I have changed her well done presentation only for brevity and clarity. If you think that this post has "no cypherpunk relevance" you can: 1. Flame me, in *private* e-mail. [I'll happily ignore you.] 2. Go hump a tree. Article excerpts (in quotes) and my comments follow: "In the late 1970s, farmers over the world were finding unexplainable, perfectly round, flattened areas in their grain fields. The flattened crops made irreproducible, layered swirl patterns. As time went on and crop circle incidents increased tremendously, the outlines of the formations became more complex and came to be called pictograms." They appeared overnight, "[by 1990] some 2000 circles and pictograms had been formed all over the world. A large percentage...were showing up in a small area in southern England, mainly in Wiltshire Downs." "Then, in 1991, two retired Englishmen named Doug Bower and Dave Chorley announced that they had been responsible for the crop circle phenomenon for the past 13 years." The dim media swallowed this hook, line, and sinker; neglecting to question "how they created intricate, sometimes braided swirls, executed elaborate pictograms in the dark, and caused crop formations in 19 other countries besides England." Brittle plants in the (non-hoaxed) circles were also bent in a way "that no investigator has been able to duplicate." Recent tests, including some at the Oak Ridge National Laboratories, show isotope changes in the soil, and differing biophysical and biochemical properties of the grain within the pictograms when compared to adjacent grain in the field. Gerald Hawkins was not fooled. He did "a systematic study of the geometry of the circles, and found ratios of small whole numbers that precisely matched the ratios defining the diatonic scale. Further statistical analysis revealed three other geometric theorems in the circle patterns, and he realized that all four theorems had a common thread that led to a fifth, more general theorem. His inability to find any of these theorems in Euclidean geometry or any of the math books he consulted caused him to conclude that whoever is making the circles had to not only know how to prove a Euclidean theorem, but also to conceive of an original theorem. Hawkins says that proving a theorem is easy; conceiving it in the first place is quite another matter." ["FN 6 Ivars Peterson, "Euclid's Crop Circles," *Science News* 141, No. 5, pp. 76-77."] In late 1991 in Ickleton "a perfect depiction of the mathematical configuration known as the Mandelbrot Set" appeared. ["FN 9 Beth Davis, *Ciphers in the Crops,* (Bath, England: Gateway Books, 1992)pp. 9-15."] I am now experiencing Tim's wish that I could draw in e-mail, as there is a diagram here of "a circle inside a triangle inside a ring inside a hexagon inside a ring." Don't even *try* to imagine it. The article points out that "NASA will be promoting the space program with a crop circle image and the slogan, 'We need to be out there.'" [Agreed, but with *tax* money?] Back to Ms. Fisher. "I have been amazed at the need many people have to dismiss this mystery. They will ignore all of the evidence to claim that the circles are being formed by weather or hoaxers. Neither claim stands up to even minimal scrutiny. I don't know what is causing crop circles to appear, but I'm certain it isn't being done by the wind or by an old man with a board. What do you think?" I must add that anyone who has seen the cover of Robert Plant's "Now and Zen" album would have trouble believing that a couple of drunks from the pub down the street did _THAT_! I do not know if "extraterrestrials" or "UFOs" are responsible for these images. [In my long-held opinion, governments tend to lie about UFOs (surprise!).] I do feel that these pictograms, these "Ciphers in the Crops," cry out for cryptanalysis, by someone far more adept at complex mathematics than I am. Results might well be felt worldwide. Thoughts? JMR Regards, Jim Ray -- Boycott espionage-enabled software! "He that would make his own liberty secure, must guard even his enemy from oppression; for if he violates this duty, he establishes a precedent that will reach to himself." - T. Paine http://www.shopmiami.com/prs/jimray _______________________________________________________________________ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Public Key id. # E9BD6D35 <liberty(a)gate.net> IANAL _______________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMQmUiG1lp8bpvW01AQE+OwP/URevvKxeTnV75DfXm0+XM9JTWR9w2ZCn 9RbdwBmVK5WTw5228x2EBNrhAQeGeksFQX9z/YEZgLCbscX1vtAT1PydSf2JBruM jOBhRX/a4MJWo4l7UcyefQwK2NyB8YXwqGoDPQKYtC9dqY0X6wuDnRWP2SGVYkG4 pf28zVDk1Vc= =MxuH -----END PGP SIGNATURE-----

2 1

Denning's misleading statements
by Thomas Grant Edwards 17 Dec '03

17 Dec '03

I think the big bait-and-switch is her description of the various companies falling over themselves to get to _VOLUNTARY_ key escrow to avoid losing data and protecting themselves against employee problems versus _MANDATORY_GOVERNMENT_ key escrow to ensure that individuals cannot hide information from the government. Key escrow is good. Key escrow against your will is bad. -Thomas

2 1

Re: Crypto Exports, Europe, and Conspiracy Theories
by jim bell 17 Dec '03

17 Dec '03

At 01:06 PM 1/26/96 -0600, Alex Strasheim wrote: > >Digicash is probably the first significant crypto product to be exported >to America. It's not very popular yet, but I think that most of us here >agree that it is, in potential at least, as significant as >Mosaic/Netscape. It's important to note that this extremely important >product couldn't have been produced here, patents aside. Transaction >systems need to be international, and our rules make America an unsuitable >place from which to launch tranaction software. > >Will the NSA be able to stand up against growing economic pressures? I >don't know. But it does seem pretty clear that those pressures are >building all the time, and that the problem of supressing crypto in 1996 >is a much tougher one than it was in 1986. > >In general, it's myopic and ill advised to focus on one factor -- >economics, politcs, the national security establishment -- when trying to >predict what will happen. I've probably been guilty of placing too much >emphasis on money, and not enough on the NSA. > >We do seem to be winning, though. Agreed. However, we will all REALLY win when anonymous-payer/anonymous-payee digital cash appears and is in common usage. (or Digicash can be "munged" to make payee-anonymity possible, if not the norm.

1 0

re:Gentlemen do not read each other's mail
by Marc J. Wohler 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- "Gentlemen do not read each other's mail." Ben Franklin Original quote by Ben Franklin when the British government published (stolen?) private letters of John Adams to his wife critical of Franklyn and other members of the Continental Congress. The Britsh hoped to drive a wedge into the congress and especially between Adams % Franklin. Franklin was a gentleman. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQgVzmeikzgqLB7pAQGKOQQAr5nJo0L12l1Xd0EXpsExgZcztOkIKCQa j7Fhll8wx7dczUa5jJy+o4nfV8duk1MylzA386uO+kfNsCH+s5XlFobaeyc3Epk0 pERqFTzhcVf33egCRDlVqKjwa7uuwJXM2no++vwgGjy9hxSaWAIOAPcZf1Yi5mYj ZzVSTj8CQQ0= =gf0F -----END PGP SIGNATURE----- ***Preserve, Protect and Defend the private use of Strong Crypto*** * * * PGP for the masses * * * Finger mjwohler(a)netcom.com for Marc Wohler's public key fingerprint= F1 70 23 13 91 B5 10 63 0F CF 33 AD BE E6 7B B6

2 1

Re: The French do some things right...
by tim＠dierks.org 17 Dec '03

17 Dec '03

At 9:01 PM 1/26/96, Timothy C. May wrote: >The French seem to have partially done this. Francois Mitterand had a >mistress? Who cares? They take it for granted that people are people, with >human foibles and weaknesses. Of course, aside from censoring photos and a book that happened to talk about the fact that he had cancer. I think it's just a different set of sensitivites. - Tim Tim Dierks - Software Haruspex - tim(a)dierks.org If you can't lick 'em, stick 'em on with a big piece of tape. - Negativland

1 0

Anonymous trashing of Assassination Politics
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [on cypherpunks(a)toad.com] At 01:54 AM 1/27/96 +0100, Anonymous wrote: >Jim Bell writes: > >>While this would normally be my cue to offer up my "Assassination Politics" >>idea, which (if presumed to be correct) would stabilize "anarchy" and >>prevent "lawlessness and social disorder" (at least as normally seen by the >>average reader) I think that under the circumstances that would be redundant >>here. > >I'm not *sure* that your Assassination Politics trip is the worst piece of tripe I've ever seen on the list, but if it's not, it's right up there. I notice that you responded through an anonymous remailer, and didn't even use a nym. This is strange. If anything, the people who criticize my idea seem to be under the illusion that it is _I_ who should be embarrassed for proposing it, and in fact vociferously promoting it. "Those of you" who object to it should be the ones who are "proudly" taking the "moral high ground" and thus should be happy to identify yourself and defend your position. Even if, arguably, you invented the fiction that you feared for your life trying to argue with people like me, nothing prevents you from developing a stable nym and arguing your position using it, secure in the knowledge that your body is safe from attack. Your arguments would still be subject to sudden death, however. >Those of us who are anarchists What?!? You imply that you are an anarchist, yet you don't approve of a system which might not only produce anarchy, but in fact in record time? Well, EXCUUUUUUUUSE MEEEEEE! Sorry to put you out of a "job." > are often that way because we think the *means* the State uses are evil, not to be excused by any amount of >mumbo-jumbo. I think the state's ENDS are evil, too, not merely their MEANS. > And you gleefully propose to let us *all* in on the immoral game of murdering those who annoy us >sufficiently. Actually, if you followed my arguments carefully, you will notice that my position is most accurately described by pointing out that I _could_not_ keep you from participating in this "immoral game", even if I wanted to. For the record, I suspect some people who are total pacifists view the rest of us, those willing use use violence to defend ourselves, as "immoral." >I'll pass. Others won't. > >You know, if I were constructing an agent provacateur, I'd want a persona who's willing to be loudly clueless with ideas that show minimal or non-existent awareness of basic human hopes and fears, like security from random hit-squads. I'd have him go on and on with his ideas, until eventually they can splashed all over headlines and used to discredit the whole realm of privacy protection. Aha! You're implying (actually, implying is an understatement here) that I am an "agent provocateur." Naturally, it would be useless to deny this (although, for the record, I will deny it), because anybody who was convinced of its truth wouldn't expect me to tell the truth anyway. But hey, let's put it up for a vote. How many people out there believe that I am an "agent provocateur"? C'mon people, don't be shy, you've seen my prose. What do the rest of you think? >But no, I don't think you're an agent. Good! I'd hate to argue with a person who didn't realize I am SERIOUS. > More fool you, you're willing to do the government's disinformation work for it without even thirty pieces >of silver or a 401K. To be perfectly honest, I did a lot of soul-searching in early 1995 about whether I should publicize my ideas. No, it wasn't because I was AFRAID that it might happen. I _WANTED_ it to happen. Every little bit. Every government on the face of the earth, to come crashing down in a heap. Complete, total, absolute anarchy. (But not the "anarchy" that most people are pre-programmed to think of...) No more governments, no more borders, no more taxes, no more holocausts, no more wars, no more politicians. Forever and ever and ever. Rather, I was fearful that by publicizing the idea, I might end up PREVENTING it from occurring. You know, by giving the governments advance warning about what was going to happen, I might actually help them prevent it. That worried me, a lot. But eventually, I made my decision. After a huge amount of thought that some day I might be inclined to relate. However, if I'd REALLY wanted to PREVENT this, I would have alerted the government secretly, so that they could manipulate things behind the scenes, secretly, to prevent this "crypto/digicash/internet anarchy." _That_ I did not do. I publicized it, allowed it to be criticized and therefore "perfected" (not that it's "perfect, by any means!) it, and I'm now promoting it the best way I know how. And with all due modesty, it's getting a pretty good reception, considering how extreme and drastic it initially might appear. Part of my reasoning was that unless I engaged in the absurd conceit of believing that I was, cumulatively, smarter than everyone currently in the government, I had no choice but to conclude that the government was already aware of the potential problem. And if that were the case, they were, at that very moment, working desperately to PREVENT what I wanted, desperately, to ACHIEVE. At that point, I made the choice of forcing the government's hand. >At this point I recommend to you the 12-step program I explained to Vladimir. > >Signed, >A Friend Recommendation: If you really want to be taken seriously, use your real name or at the very least generate a stable nym. Preferably, with messages signed by the nym's public key. Without it, you are a silly, unbelieveable ass. Even with it, you may STILL be a silly, unbelieveable ass, but at least people would pay more attention to you. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQmqKPqHVDBboB2dAQGW6wP/Vjrmoj16SaBZwvoUa8Sxx3VLJTKEwxLx LOCs2zIl+Ahwr3R6IMw4y6VsESszYUz+271k1+rVVDf3GrxvlqJFyTRL2KeFltp2 fWosOD03X3Yneg8Ocg6oainIiiG+TLUkTqarddT+6VIoImmmWsFk4Yf+eG0OoEJc NgawkFoSokg= =Xs7A -----END PGP SIGNATURE-----

2 1

Re: Denning's misleading statements
by jim bell 17 Dec '03

17 Dec '03

At 10:24 PM 1/26/96 -0500, Thomas Grant Edwards wrote: > >I think the big bait-and-switch is her description of the various >companies falling over themselves to get to _VOLUNTARY_ key escrow to >avoid losing data and protecting themselves against employee problems >versus _MANDATORY_GOVERNMENT_ key escrow to ensure that individuals >cannot hide information from the government. > >Key escrow is good. Key escrow against your will is bad. While I understand your point, I sorta hafta disagree. (or, at least, state my reservations.) If something is technologically IMPOSSIBLE (or, in practice, not available), it won't be mandated by government because it can't be. The moment something exists, it can be forced on people. I'm not saying we should somehow try to prevent people from developing truly voluntary key-escrow systems; rather, I'm saying that their existence should alert us to the danger.

2 1

Re: Microsoft's CryptoAPI - thoughts?
by James A. Donald 17 Dec '03

17 Dec '03

For those allergic to Microsoft word, I have htmlized the crypto api You can find it at http://www.jim.com/jamesd/mscryptoapi.html I hope that microsoft will soon have an official html version. A notable misfeature of the API is that it assumes that in general you will have two key pairs. One for signing and one for encrypting. Since in the most common case you are encrypting something related to a signed message by the person you are encrypting to this is a bad idea, and protocols that require two key pairs to avoid protocol failure are hazardous and inconvenient. I think Microsoft should not have chosen to support such protocols. The Crypto engine that Microsoft will soon distribute in every copy of NT and windows will of course be crippled -- 512 bit RSA keys and 40 bit RC4 keys, but of course we should not do anything about this until we have some crypto enable applications floating around. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: Denning's misleading statements
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 7:49 PM 1/26/96 -0800, Rich Graves wrote: >Outlaw cryptography, and only cryptographers and outlaws will have >cryptography. However unlike guns which require some level of machine shop to produce, cryptographic systems can be produced at home by a smart high school student with only the computer that is needed to compete in the the modern economy. Bill

1 0

Re: [rant] A thought on filters and the V-Chip
by jim bell 17 Dec '03

17 Dec '03

At 11:56 AM 1/26/96 -0800, Alan Olsen wrote: >[Not Perry(tm) approved -- Skip of this offends you] > >I am waiting for someone to come out with a product that will modify the >v-ship (or the various internet "protection" tools) in such a way that it >scans *FOR* pornography. > >Porn is big business. You would think that people would pay for a way to >sort through all of that non-smuttiness and just "get to the good stuff". I >also imagine that as soon as such a product appears, the censors will scream >bloody murder. Sigh! Wonderful idea, but sadly it probably will never be allowed to work, for exactly the obvious reasons. (I know that sounds like an odd argumnt to get from ME, considering MY idea...) On the other hand, this would be an EXCELLENT "argument" to bring in front of a Congressional committee considering the adoption of any V-chip type proposal. Once they discover that a ratings system could be used for the diametrically opposite reasons of their reason for having it in the first place, they'll try to modify their proposal to prevent this. If we're lucky, this'll have the effect of killing the whole concept of government-sponsored (required?) V-chip-type technology. OTOH, I agree with other posters who think that truly voluntary content selection would be an excellent addition to television: In effect, an automatic, programmable TV-Guide search engine.

2 1

Re: Open NNTP servers and logging
by Michael Peponis 17 Dec '03

17 Dec '03

On 26 Jan 96 at 21:11, Stephen Albert wrote: > A little while back there were some very helpful posts about getting started > wit open NNTP servers. Since my regular site runs kinda slow in the news > department I've been having fun poking around and seeing about getting more > current. > > Then it dawned on me. People keep logs. Presumably routine logging would > point right back at my ISP, and from there it'd be not too hard to pin down me > specifically. No, I don't think anyone is particularly *likely* to do that, > but why take chances? > > So...anyone know of open NNTP servers that *don't* keep logs? Or some other > way around the problem? Well, as bad as the lack of anonymity may be, NNTP server logs serve a very usefull purpose, ie finding and eliminating trolls and spammers. Unfortunatly, I would have to go logs given the state of UseNet. Why not just read from the open server, and post anonyomously using anonymous remailers and News-to-Mail Gateways? Regards, Michael Peponis PGP Key Avalible form MIT Key Server,or via finger

2 1

Re: Hack Java
by br＠scndprsn.Eng.Sun.COM 17 Dec '03

17 Dec '03

]Both of you are correct if you look carefully at the assumptions. Rich ]assumes that you have a 'malicious compiler'. Godmar is right that Java ]does not utilize pointers in the byte code. What would make the entire ]scenario work is a malicious interpreter or a 'NotJava Browser'(TM) that ]allowed malicious code to be executed. Couple a bad compiler and a bad ]interpreter and you are in buisness (nasty business that is). Yes. And if you also let an intruder in your house, have them sit at your computer with your newborn child in the room and go on vacation, things can get really, really nasty. Sort of like when you execute untrusted code in an untrusted environment... -- Benjamin Java Products Group

3 2