December 2003 - cypherpunks-legacy

Re: Penet-style web remailer?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 11-MAY-1996 06:53:43.98 >Well, if you look at the remailer part of the web page, it's just >one of many web pages that are a form interface to a remailer CGI program. >Basically a friendly way to use a standard 1-way Cypherpunks remailer. Yes... but he does appear to keep track of the log file; he had up the name of someone who allegedly misused it a few days ago. He states: "If this remailer is used for something illegal, it can be traced. Also, if people use it to insult me, I will probably want to look in the logs and find out who it is!" >There is an amusing stealthed message at the bottom of the page, >designed to attract high relevancy ratings from spiders..... Have people never heard of the "keyword" meta header? -Allen

1 0

Re: Why I Pay Too Much in Taxes
by Ecafe Mixmaster Remailer 17 Dec '03

17 Dec '03

Black Unicorn wrote: >Looks like someone paying offshore for Mr. May to me. Again, 30% >withholding requirement unless you intend to hide it. You just don't get it, do you. The offshore payment is for licensing (or computer operations, consulting advice, buying worthless software, investment in penny stocks, use your imagination...) It has NOTHING to do with Mr.May. Those payments are something that the (drunk) CEO decided on and he is completely responsible for it. Why he ordered all those expensive services before he left on permanent vacation is anybody's guess. >The only way to avoid this is to conceal Mr. May's involvement. Right! >Also note that payments to an account for which Mr. May is the >beneficiary can trigger realization in several circumstances. The beneficiary is a trustee that doesn't ask too many questions. There are plenty of those available. >You also fail to mention the reporting requirements for U.S. citizens >holding offshore assets of significant size. "Laws are for people who can't think for themselves." >Either it is a tax avoidance plan, or it is a tax evasion plan. >Which is it? A little of both, to confuse the enemy. >Practically speaking I think you have merely altered the plan to >adjust for my comments and are stuck between both fact scenarios now. Nothing altered. I just didn't explain it in too much detail before. There are still details left out (like how to find a cooperative CEO, offshore bank and trustee). This is an extremely cheep setup. For most high bracket wage earners it could break even in the first month or two. Once the structure is in place it doesn't cost any more. To stop paying taxes completely you would need to lower your taxable profile slowly. If you already have enough money in the bank for your living style, you could take out a significantly smaller salary. If the tax man asks what happened to your high income, you explain that you lost your old job and had to accept a less attractive offer. That can happen to anybody. >I would think you'd advertize it here if you had anything worth selling The problem with selling services like this is that any buyer with half a brain worries that it is a sting operation. Therefore the customers are mostly friends and acquaintances. >Off the shelf companies and trusts have their uses but anyone proposing >to sell a standard tax avoidance/evasion setup off the shelf should >trigger major alarm bells. I agree completely. This is not an advertisement, just a chat on the theory of tax planning in the modern day of worldwide strong encryption. Today it is easier to communicate with an offshore trustee than it has ever been before. Just keep your pass phrase away from the tax man and you'll be fine. X

3 2

Re: Mandatory Voluntary Self-Ratings
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"vznuri(a)netcom.com" "Vladimir Z. Nuri" 11-MAY-1996 03:38:35.85 >the idea with the rating system is that the rating signs the signature >of the page, which is itself digitally hashed or something. in other >words, the rating is on the "state" of a page at some time. the system >would at least be able to detect a change in the state of a page, >and inform the user that a rating may no longer be valid due to obsolescence. >but you are correct that page changes are probably more problematic >for market ratings than self-ratings. One wonders what their hashing method would be. If it's not very cryptographically secure, one could (via selection of image file names, comments, etcetera) cause it to be the same hash for a very different set of images. (A Fun With Animals page from riding lesson photos to bestiality, for instance.) >2. will self-ratings be deliberately misused by people protesting the >system? will it be a problem? And how are you defining "misuse"? If the system is not good, then rating something differently than how the system says it should be is using it properly, not improperly. -Allen

1 0

Re: Publicity on PICS
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"reagle(a)mit.edu" "Joseph M. Reagle Jr." 10-MAY-1996 02:18:58.44 >From: IN%"EALLENSMITH(a)mbcl.rutgers.edu" "E. ALLEN SMITH" > It is _very_ confusing to follow though. >>CompuServe, Microsoft, Prodigy and Netscape Communications will soon give >>their customers software enabling them to block access to material they >>judge objectionable on the Internet's Worldwide Web. > Consider that Compuserve had a deal with SurfWatch, which was >incorporated in it "Internet" in a box, with a lot of Spry goodies. Now >Surfwatch has been purchased by Spyglass (a competitor or Spry). Also, >Compuserve offers RSACi services through CyberPatrols RSACi compliance (got >some weird derivitive and cross-liscencing works going on here!) and urges >its users and 3rd party people to use RSACi... I don't suppose that someone at Netscape can give us more information on this than is currently out there? All we've seen so far are the press reports, which are often inaccurate. -Allen

1 0

Re: Mandatory Voluntary Self-Ratings
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"vznuri(a)netcom.com" "Vladimir Z. Nuri" 11-MAY-1996 04:32:46.80 >From: TCMay >>If a system gets built into the WWW, as with proposals for PICS, it _will_ >>be used by those who want to control content. We should think twice before >>helping in any way. >I agree with your hesitation totally. I can easily see how the system >would be twisted in unspeakable ways. but I can see a lot of very >powerful positive uses too. as long as the best attempts are made to >discourage the former and encourage the latter... again, there is a >question that the future might turn out to be more orwellian if no >action is taken by internet designers whatsoever. I tend to believe >that view. It currently appears that both groups doing PICS ratings are doing it in a way that very much promotes unethical usage (by those wishing to control content). This does not bode well for future uses of it. >>(No, I'm not _against_ private ratings services...but this has little to do >>with _me_, and I won't participate. More importantly, I won't have my >>content have any kind of tag attached! >notice that what you demand is wholly irrelevant. if you put something >out in the public, in a world of free speech, anyone is free to >rate your posting, or your opinions, etc.-- they just set a system >that refers to the message-id of your posts or something. >if what you are instead saying is that you will never insert your >own tags into your content, well that is something you have control >over. but you have absolutely no control over what people "attach" >to your posts in a "virtual" sense. anyone could set up the >TCMay Rating Service and register ratings on everything you post in >public. However, one can do things to disrupt the rating system. Until we've got true AI, a web spider will be able to find and classify a newly-re-URLed page a lot faster than the rating people are able to find it - especially if one goes ahead and submits the web page to all the search engines every time you reclassify it. A search engine could turn over all new pages to be rated - but that would slow them down a lot, and other search engines would be used more because they'd be more up to date. If you have some ratings services that you like - market-determined ones, for instance - you can let them know the new URL also. The above is a bit harder for ratings of USENET posts and mailing list messages, but there are so many of those that they'll be hard for a rating service to keep up with. -Allen

1 0

Re: Publicity on PICS
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"vznuri(a)netcom.com" "Vladimir Z. Nuri" 11-MAY-1996 00:25:38.47 >From: IN%"EALLENSMITH(a)mbcl.rutgers.edu" "E. ALLEN SMITH" >>>The system depends for its ratings on voluntary compliance by Internet >>>providers. >ugggghghghghg. not my ideal use of PICS. I hope that people don't >begin to believe that PICS is this system. Oh? Look at the second method listed for means of getting PICS ratings. >From the ISP, essentially. >>>But there is no way to use the system to seek out pornography or violence on >>>the web, officials insisted. >I don't know why that would be a problem. That they mentioned this is perhaps an indication that they aren't exactly on the side of anyone except pro-censorship parents. >>>"To content-providers, I would say, 'Rate your sites' To parents I would >>>say, 'Set the levels for your children.' And to governments, I would say >>>humbly, 'Think again before censoring the net,"' Stephen Balkam, executive >>>director of the Recreational Software Advisory Council, told a news >>>conference. >> >> Note again the pressure for self-rating. >"content-providers" != internet providers. that former is OK. the >latter is a horrible nightmare. please, please, please, I'd call both a problem, when you're using a system that is meant for censorship purposes as opposed to finding-stuff purposes. If it's a system for finding stuff, then the content provider should be involved; it will vary whether the ISP should be involved (that can be left up to the individual ISP). >> Whatever became of market-ratings? Admittedly, they may mean that each >>country will be encouraged to given an example system... but I still don't >>like the idea of government involvement. >the government becomes just another rating agency. I don't like it either. >but as long as we emphasize, "the individual always has the ultimate >decision", which fortunately this press release does, >little can go awry, hopefully. They try to emphasize individual - or actually, parental - decision, but they seem to have entirely forgotten about the use of this system by governmental censors. It can be used for such either for preemptive censorship (a Chinese firewall) or for spotting people to arrest when you start up censorship. If the government gets involved in doing a rating system, then it can better start doing things like mandating that particular material be rated or you're up on "corrupting a minor". The recent CDA decision (thank you, all plaintiffs, lawyers, judges, and God) does emphasize that mandatory rating isn't constitutional... but A. the Supreme Court may not be as sensible (God forbid) and B. other countries may have other ideas. -Allen

1 0

Again: [hrdware] anti-Tempest video settings
by Jean-Francois Avon 17 Dec '03

17 Dec '03

> It won't make any diifference to the potential attacker. > His aim is to recover the text/shapes of what you are displaying. He > is not generally concerned with the "niceness" of the display, but > rather the contents. But of course. But what I want to know is: is there some combination of display colors that will be visible for the eye, but not for the Tempest equipment? > Also, many guns - red, blue, green actually do > radiate on slightly different frequencies, allowing differentiation > of signals - due to the slightly different physical geometry of the > guns themselves. That might answer it. I suppose that if some "stealth" settings exists, they are highly hardware dependent. My question was not "would it work in all instances?" but rather "had this tactic been implemented successfully in *some* instances?" Or, to the contrary, is it reasonable to assume that modern Tempest equipment can work around theses impediments almost all of the time, therefore making any attempts at this futile? Regards JFA PGP key ID# C58ADD0D at: http://w3.citenet.net/users/jf_avon Key Fingerprint: 529645E8205A8A5E F87CC86FAEFEF891 Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

2 1

Reply to anonymous ping.
by daemon＠anon.penet.fi 17 Dec '03

17 Dec '03

Your code name is: an611909(a)anon.penet.fi.

1 0

Anonymous code name allocated.
by daemon＠anon.penet.fi 17 Dec '03

17 Dec '03

You have sent a message using the anon.penet.fi anonymous forwarding service. You have been allocated the code name an611909. You can be reached anonymously using the address an611909(a)anon.penet.fi. If you want to use a nickname, please send a message to nick(a)anon.penet.fi, with a Subject: field containing your nickname. For instructions, send a message to help(a)anon.penet.fi.

1 0

[hrdware] Is Tempest detecting only video?
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 11 May 96 at 20:35, jim bell wrote: > I'm waiting for cheap flat-panel displays for desktop computers > to arrive, because they will probably be almost impossible to > detect usably by Tempest systems. Does Tempest detects only the emission from the electron gun in the monitor or can it get a usable "lock" on some other signals generated within a computer? As an example, can it grab the keystrokes? If the answer is yes, can it do it: a) rarely b) occasionally c) most of the time d) almost all of the time e) never Could somebody knowledgeable in Tempest can rate the various emissions from a computer? (such as: keyboard, COM port, modem, lpt, video signal(from the card), disk write, monitor emission, network comms, etc) Ciao JFA Just curious... PGP key ID# C58ADD0D at: http://w3.citenet.net/users/jf_avon Key Fingerprint: 529645E8205A8A5E F87CC86FAEFEF891 Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

1 0

Re: Again: [hrdware] anti-Tempest video settings
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 12 May 96 at 13:51, Julian Assange wrote: <technical tips snipped> > Equipment > capable of the latter would be extremely complicated and expensive > to design and produce; Even too expensive for entities with the power of taxation? > I suspect there has been no call for it to > date, given that if you are dealing with a target who understands > the risks of van-eck they usually have shielding and or a faraday > cage. You have a point for big outfits. But for small companies or cypherpunks on a restricted budget, they also know that there is most likely *no* shielding of any sort... Regards jfa Why is it that govt employees makes the best spouses? Because after they come back from work, they are not tired and they already read the newspapers. PGP key ID# C58ADD0D at: http://w3.citenet.net/users/jf_avon Key Fingerprint: 529645E8205A8A5E F87CC86FAEFEF891 Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

1 0

Re: Again: [hrdware] anti-Tempest video settings
by jim bell 17 Dec '03

17 Dec '03

At 08:02 PM 5/11/96 +0000, Jean-Francois Avon wrote: >Or, to the contrary, is it reasonable to assume that modern Tempest equipment can >work around theses impediments almost all of the time, therefore >making any attempts at this futile? It's probably worth investigating. Chances are good that as long as the total beam current remains as constant as possible, the signal will be much harder to interpret. One way to investigate this comparatively easily is to measure the total power consumption of a monitor when the screen is filled with different colors at different saturations, etc. Supply the AC to the monitor through a 1-ohm resistor, measure the AC voltage across the resistor to 1 mv accuracy or better, and you have a pretty good way to distinguish different beam currents. I'm waiting for cheap flat-panel displays for desktop computers to arrive, because they will probably be almost impossible to detect usably by Tempest systems. Jim Bell jimbell(a)pacifier.com

1 0

Crypto++ 2.1
by Wei Dai 17 Dec '03

17 Dec '03

Crypto++ 2.1 has just been released. You can find download instructions on the Crypto++ home page at http://www.eskimo.com/~weidai/cryptlib.html. Crypto++ is a free C++ class library of cryptographic primitives. Changes made in version 2.1 include: - added Tiger, HMAC, GOST, RIPE-MD160, LUCELG, LUCDIF, XOR-MAC, OAEP, PSSR, SHARK - added precomputation to DH, ElGamal, DSA, and elliptic curve algorithms - optimizations in elliptic curves over GF(p) - changed Rabin to use OAEP and PSSR - changed many classes to allow copy constructors to work correctly - improved exception generation and handling This is likely to be the last major revision of Crypto++. Future versions will probably only be released for bug fixes and compliance to new standards. Wei Dai P.S. A new set of benchmarks done using Crypto++ 2.1 is available at http://www.eskimo.com/~weidai/benchmarks.txt.

1 0

Re: Remailer in a box
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 00:24 1996-05-12 -0700, Lucky Green wrote: >May I suggest convincing that Swedish ISP to offer up a signup form >accepting Ecash? They probably will once the Post Bank gets going with ecash. Until then there are legal difficulties. Swedish online merchants can't even accept credit cards. They need an order in hand writing or voice before they can charge the card. My offer was to open an account with any ISP, whether they accept ecash or not. I think that improves the anonymity of the account. Matts

1 0

Re: found nym-differentiation! Still need perpetual motion, FTL travel, coldfusion
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 19:02 5/11/96, Perry E. Metzger wrote: >I doubt that will work even were it implemented. Every phone on the >planet and terminal would need to constantly do biometric analysis of >every user, and even then people could program their terminals to lie. Telling your terminal to lie will be rather difficult once the CPU refuses to run an OS with out propper signatures. The OS in turn won't run applications without such signatures. All commercial software has to undergo code review by CAs. Your machine won't even run anything but approved software. Should you think about keeping an old machine around that does, my advice would be: don't. At least not unless you are willing to face the ten years prison term mandatory for such a computer crime. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 2

Re: distinctive properties of ecash, netbill, cybercash and iKP
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 16:40 5/11/96, Jüri Kaljundi wrote: >This is one question why the central bank in Estonia (I am not sure about >other countries) does not allow issuing e-cash here in Estonia. While the >banks issue e-cash to people, they get some real cash from people. This >leads to actually doubleing the money in circulation, each monetary unit, >either dollar or kroon, can at the same time be used by owner of e-cash >and at the same time by the bank. The central banks are afraid that when >the amount of e-cash in circulation gets big, this could lead to >devalvation of money, especially a small country like Estonia is afraid of >such development. That's simply silly. The same argument would hold true for travelers checks. Are Estonian banks allowed to issue them? I thought so. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Remailer in a box
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 12:52 5/11/96, Matts Kallioniemi wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >At 17:39 1996-05-10 EDT, E. ALLEN SMITH wrote: >>Yes, for the cryptographic purposes. It doesn't make much difference >>on the juristictional end of things - I'd need to locate a UNIX account >>in another country for that. Hmm... possible. >> -Allen > >Anybody who want's an anonymous shell account in Sweden, send me MTB ecash >and I'll get an account opened for you with a local ISP. Sweden has the best >Internet access outside North America. A 34 Mbps line to the US, soon to be >upgraded to 155 Mbps! May I suggest convincing that Swedish ISP to offer up a signup form accepting Ecash? Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Again: [hrdware] anti-Tempest video settings
by Adam philipp 17 Dec '03

17 Dec '03

At 08:02 PM 5/11/96 +0000, you wrote: >But of course. But what I want to know is: is there some >combination of >display colors that will be visible for the eye, but not for the >Tempest equipment? I am not an electrical engineer and do not play one in real life. However in my on TEMPEST I heard nothing about varying colors to reduce RF radiation from a monitor. Just set up a Faraday cage, much simpler. >That might answer it. I suppose that if some "stealth" settings >exists, they are highly hardware dependent. Better to get TEMPEST rated hardware then... check government surplus... I've had reports of TEMPEST class computer cases being sold with power supplies real cheap... >My question was not "would it work in all instances?" but rather >"had this tactic been implemented successfully in *some* instances?" Not that I have ever heard... Hopefully I am not feeding this troll too much. >Or, to the contrary, is it reasonable to assume that modern Tempest equipment can >work around theses impediments almost all of the time, therefore >making any attempts at this futile? No modern equipment can detect radiation that does NOT leave a Faraday cage. Adam, Esq. -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\ | My PGP key is available on my |Unauthorized interception violates | | home page: http://www.rosa.com |federal law (18 USC Section 2700 et| |=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|seq.). In any case, PGP encrypted | |SUB ROSA...see home page... |communications are preferred for | | -=[ FUCK THE CDA]=- |sensitive materials. | \=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-/ If A is a success in life, then A = x + y + z. Work is x; y is play; and z is keeping your mouth shut. Albert Einstein (1879-1955)

2 1

Reply to anonymous ping.
by daemon＠anon.penet.fi 17 Dec '03

17 Dec '03

Your code name is: an611909(a)anon.penet.fi.

1 0

Re: distinctive properties of ecash, netbill, cybercash and iKP
by minow＠apple.com 17 Dec '03

17 Dec '03

> >> >> Anonymity of monetary transactions is another thing that Bank of Estonia >> has declared illegal. > >Cash is illegal, too! How does the economy in Estonia work these days? >Barter? If you think about it, anonymous cash transactions above a certain limit ($4,000?) are illegal in the United States, too. Martin Minow minow(a)apple.com

1 0

Notes from the SF Physical Cypherpunks meeting
by minow＠apple.com 17 Dec '03

17 Dec '03

Here are my notes -- without significant editing or correction -- from Saturday's (96.05.11) cypherpunks meeting in Palo Alto. Discussion of crypto user interfaces (particularly NetScape and e-mail) -- How to tell user that "installation" not secure in a decent GUI? -- Expectation of what leaves user machine. -- Vendor's "shouldn't distinguish products on security: security is the bedrock of our industry." (Quote from some industry person who was not present to defend this thesis). -- Someday, there will be a "Word virus that attacks your CyberCash wallet." -- If the message is insecure with respect to the user's expectation, there should be a user-visible window border (or similar): NetScape's little key isn't good enough. Did you know that the netscape key has 1 tooth for 40-bit, and 2 teeth for 120 bit encryption? -- Signed code is the new industry meme. Bonded agents who certify signed code. Do you know how much bonding costs, and how little it offers? -- Security dialogs need a help button that explains security. -- Error messages (of all kinds) should have a url that gives more info. Can be a file:// or http:// for local help. Eudora and Netscape will provide S/Mime. PGP is going nowhere, S/Mime becoming ubiquitous (Eudora, future Netscape) S/Mimepretty good. 2 Flaws: signature's name is not encrypted. Major flaw: encryption defaults to 40-bit. No good way to negotiate for stronger encryption. c2.org: 90% of all connections are 40-bit RC2. Need to publish negotiation info so that sender and receiver can agree on crypto strength. PGP lost in Eudora/Netscape: ongoing legal problems with Phil Zimmerman. Strong concern that companies can't use PGP without problems with RSA. Do they need Viacrypt. Web of trust: not working. Hard to map an e-mail address to a key. Hal Finney's Java implementation not sufficient for signature distribution. S/Mime will support Verisign. Verisign certificates have "trust" level: class 1 is untrusted (equivalent to PGP self-signed?) Next Netscape beta will have five additional non-verisign CA's: ---- Crypto toolkit: need certification for code fragments. Need "web of trust" for software validation. There will be a zillion Java applet's out there: how do you know one does what you claim it do? When will Java signed classes/signed applets be released. Two weeks. Hmm, Java One conference is in two weeks. Surely a coincidence. You can sign a class by signing the class file (zip), then archiving it together with the source and then sign the combined archive. I think that Stuffit (on the Macintosh) supports signed archives if PowerTalk is provided. ----- Norm Hardy talked about the E programming language from Electric communities. (Java with capabilities). [[These are notes, and occasionally incoherent, for which I humbly apologize.]] Capabilities. Should be able to import code and run it even when you don't trust the code. Java-type scheme can succeed. No short description. Here are some of the reasons you should believe it: -- History: late 50's Algol 60. Code shouldn't be able to escape it's storage. Compilers and hardware thought this was not sufficiently important to do this. Not implemented on actual compilers or hardware (hmm, Burrows 5000, Basic timesharing systems offer counter-examples). Intent was to be neat and modular, not to be secure against intruders. Garbage collectors forced better, formal, theory of storage. Gave us storage security. Multics gave cross-trust subroutine calls. KEYCOS Started in TimeShare, early 1970's. Ran customers (competitors) on the same machine. Machine code didn't get in other people's way. Customers needed to interact. NCSC (part of NSA) looked at this, recommended B3 rating. Archtecture was good for A1 (next to top, as good as it comes). Needed rewriting by cleared people, needed formal proofs. NSA judging systems to protect NSA secrets. Main idea: programs have rapid communication, with strong security properties that they themselves arrange. HYDRA earliest system (Bill Wulf). KEYCOS improved on HYDRA. Capability: designates something and conveys authority to that thing Can't pull this apart: can't access without having capability. Can't get information, can't affect its state. No specific superuser state: privileged programs have different set of capabilities, not necessarily all. COM e-mail/bbs system (Sweden) -- operator could backup e-mail, but not read it. Object oriented programming system is a capability system. Crypto (public-private key) similar to capabilities. Public key is a capability. Private key is the thing that the key designates. Access lists: people access data. However, it's really the computer program that accesses the data on the person's behalf. Access control lists (VMS, Mac filesharing) -- more prevalent than you might expect, but can be made unobtrusive. Few people notice that Mac filesharing has access control lists. Contraxt Unix and capability system. On Unix, programmer gives a filename to the shell, shell tells the compiler. Compiler opens the file. Capability: give "read" capability to shell, shell gives it to compiler. Compiler uses capability to access data. Cannot hide capability from programmer. When you build something (create something), you have to present a "space bank" (sub-pool). You can buy space bank, determine the amount of free space, zap parts of it, etc. Money object: can do in Java -- two classes: mint, pot. Pot has two private fields, mint reference, value. Pot method: produce a sibling pot with same mint object and no value. Transfer -- if two pots refer to the same mint, transfer value between them. I own program, you own data. I don't trust your data, you don't trust my program. I want to allow you to run your data on my program. Factory (mutually trusted). Give access to code to factory. Give you access to factory. You invoke factory, factory creates object that can execute code on data, but lacks capability to send data. Capability architectures (narrower sense): for A to affect B, necessary and sufficent for A to have capability for B. Can't add onto Unix since old, non-capability mechanisms are still there. Get capabilities two ways: create object, gets ownership to message. Can pass capability in a message. Give to subcontractor only narrow capabilities it needs. Build system so capabilities can be very narrow. Can grant capability "Q := zero" -- receiver executes capability, but never know name of variable. Algol call by name -- caller passes a "thunk" to the subroutine. Subroutine executes the thunk that carries out the caller's computation. Debugger subject to same capability restrictions. Keeper -- computational resources become capabilities -- meters grant ability to use cpu time. Meter has "amount of ticks" -- when hits zero, task is suspended. Attached to another program with role of meter keeper. Meter keeper can decide to replenish meter. Can allocate budget (rate-based) -- useful for real-time app's. Jewel manual (agorics web site). Market-based control Scott Clearwater. Fractional (Fractal) reserve bank. http://www.agorics.com/agorics. Can grant subsets of own capabilities. Can (by prior arrangement) revoke capabilities. Language-based vs OS based. Can run large parts of o.s. in capability model. Get some advantages, but there are pitfalls. Capability systems can protect against denial of service. Can administrate cpu/space usage. Language-based systems can message across trust boundaries quickly. O.S. based may need many machine cycles. Crypo-based capability may need millions (exponent). ---- Marianne Mueller. Reported on Java Security Workshop. [[Dumb jokes self-censored to protect the guilty.]] Java team interested in security -- nobody is specifically Mr. Security. Everybody's responsiblity. 1st Morning. Status + foodfight: Steve Bellovin: Java is a virus. Venting. We all got minimal trusted computing base (with verifying, formally) religion. Need better formal model of the language. with better specificiation, can get better testing. Need better test suites to ensure that Microsoft implements the same model as Netscape. VM spec, language spec, also working on policy spec (what the sandbox policy actually is). Funding an outside security group. 1st Afternoon. Paul Karger, Mark Schaffer. How to use capabilities with Java. "If you do capabilities, make sure it does these 15 properties. " 2nd Morning. Proposal to do code signing. Afternoon, continued to discuss code signing and key management. Discussed trust models. Butler Lamson and Ron Rivest paper on Rivest's home page (on capabilities). Lamson now working for Microsoft. IEEE symposium on security and privacy. Security theory people. Princeton stuff. Security folk all over the Princeton folk -- think they're just a bunch of hackers. Java folk impressed; find Princeton stuff useful. Working on crypto API's. Sun lobbying govenment to free crypto API's. Signing classes, applets, applications (application is classes + data). Microsoft coming out this summer. Code signing very important. Needs very soon. Hard to do real capabilities on Java. Transitive closure is very difficult. ----- Transcribed in real-time by Martin Minow minow(a)apple.com

3 2

Re: Mandatory Voluntary Self-Ratings
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

It is interesting to note from the CIEC trial bulletin (which they won't let me quote part of, according to their initial notice - stupid policy) and other sources that the conservatives won't let people just rate "objectionable" material in order to keep it from them. They want it off the net/world whether or not it's rated. Thus, the idea that vznuri and others (such as the various proponents of its current use) have that PICS can save the net from the conservatives et al doesn't work. Nice idea (maybe), but no cigar. -Allen

1 0

Re: Why I Pay Too Much in Taxes
by Jean-Francois Avon 17 Dec '03

17 Dec '03

> Thanks to Philip Zimmermann and Lance Cottrell the balance of power > between the state and the little guy has changed completely. It's > good to see that both of them are going into mass market business. > Perhaps they can get some of the billions of dollars they deserve. Thumbs up! JFA DePompadour, Societe d'Importation Ltee Limoges porcelain, Silverware and mouth blown crystal glasses JFA Technologies, R&D consultants. Physists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

1 0

No Subject
by Jeremiah Harmsen 17 Dec '03

17 Dec '03

1 0

Re: Notes from the SF Physical Cypherpunks meeting
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 09:29 1996-05-12 -0700, Martin Minow wrote: >COM e-mail/bbs system (Sweden) -- operator could backup >e-mail, but not read it. Sure. The database was encrypted by using XOR with the string "KOM". That was the sorry state of encryption in the early eighties. Matts

1 0