December 2003 - cypherpunks-legacy

Re: Destabilizing China's Government with Strong Crypto
by t byfield 17 Dec '03

17 Dec '03

At 12:10 PM +0000 on 7/12/96, Deranged Mutant wrote: > On 12 Jul 96 at 0:04, Timothy C. May wrote: > [..] > > And this is yet another example of the negative effects of the U.S. > > restrictions on crypto export: where widespread crypto tools might be used > > to destabilize repressive governments, the lack of these tools integrated > > into common applications makes it harder for freedom-fighters in China, > > Burma, Iran, France, etc., to use them. > > The US has a sad history of supporting its own 'friendly dictators' > though. Makes it hard to support flow of decentralizing tech to > destabalize countries like Iraq but keep countries like El Salvador > in the fold. Me too. In fact, citing "freedom fighters" to justify relaxing ITAR is neither more nor less disingenuous than citing "international arms traders" to justify maintaining or tightening it; and given the litany of imbecilic, corrupt, rump, and reactionary regimes and factions the US has supported over the past decades, it isn't exactly going to win over hearts and minds in the agencies that have a strong hand in ITAR. Ted

1 0

Re: Another bad idea
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"WlkngOwl(a)unix.asb.com" "Deranged Mutant" 10-JUL-1996 05:02:42.84 >Great idea. Get some (possibly) innocent techie in an oppressive >country thrown in jail or executed. If these countries didn't value their technical people and what they can do, they wouldn't be allowing them on the Internet (even in a restricted way) in the first place. The above would only be a likely scenario if the effort wasn't big enough - didn't cover enough people. China almost collapsed (pity it didn't) with the Cultural Revolution; I doubt many in government there who remember that time want to go through it again, particularly considering the current level of instability there. >Or perhaps s/he gets offended, >contributing to the notion that all Westerners are evil perverts >out to corrupt them. This is a possible problem with the pornography approach, yes; some form of human rights information may be more suitable, even in countries in which one of the main crackdowns on the Internet is anti-sex. >> An extension of this for web sites, which I understand as possible >> but difficult, would be to swap anyone from such a country trying to get >> acces to a technical web site to instead receive "subversive" information or >> pictures. (The pornography mentioned above would probably be more effective >> in picture format; other pictures might include information on human rights >> abuses). >Damn aggrevating for that user, and it could get him/her in trouble. Yes. One possible solution for the aggrevation problem would be to include material on human rights, cryptography, etcetera _and_ the tech info that the person was looking for. While this would still give these countries easy access to the technical info (a bad outcome), it would also lead to the people getting information that the country's government didn't want. >On a wide-scale it could provoke responses from those countries. >Imagine this list being bombarded with propaganda, or perhaps >somebody here looking at an anti-censorship web page getting >pro-censorship messages from religious fundamentalists. If you look at someone's web page and A. they haven't made a contract with you to do otherwise and B. you haven't been smart enough to go through an anonymizing web server or an anonymous account, you need to realize that they are likely to keep info on you. I customarily don't use my own account for web viewing for that reason. Bombardment of lists like these with propaganda, etcetera, is an admitted possible problem. We're currently seeing something of the sort on alt.religion.scientology, but (according to what I've gathered) they seem to be dealing with that pretty well. I have my doubts how effectively the Chinese, etcetera governments are likely to be in carrying out such attacks; they aren't noticeably good at Internet-awareness. >Or it could encourage them to use special firewalls which filter >content and disallow graphics... (probably many US-based companies >would be all-too-happy to sell them the software to do it), or even >close themselves off from the Internet altogether, perhaps form >separate, unconnected Family/Islamic/Chinese-values networks. How, precisely, is one going to filter out graphics from web sites in Chinese? Ascii text and ideographs don't exactly get along. One interesting option would be text, possibly varied to disable practical OCR, in the form of graphics. This is more of a problem for web sites in English, although simple denial of such to such countries has its advantages (as per some earlier discussions). In the latter case, they aren't going to get the technical information that's their reason for getting on the Internet in the first place. These countries are largely third-world in locally understood technology, anyway; the exception is for those who have gotten training in the West - note that one of the biggest trade _surpluses_ of the US is in graduate education in technical fields. -Allen

1 0

RE: FW: [RANT] Giving Mind Control Drugs to Children
by blanc 17 Dec '03

17 Dec '03

From: E. ALLEN SMITH Actually, my Ritalin was one of the things that led me to come to the conclusion that drug laws were nonsense. It's a Schedule II drug that I never felt _any_ addiction to; I was off it on evenings, weekends, and during holidays. So at least in my case it had a pro-libertarian effect. ........................................................................

1 0

CDT Policy Post 2.27 - No New News on Crypto: Gore Restates Support for Key Escrow
by editor＠cdt.org 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 27 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 27 July 12, 1996 CONTENTS: (1) No New News on Encryption - VP Gore Reiterates Support for Key Escrow (2) How to Subscribe/Unsubscribe (3) About CDT, contacting us ** This document may be redistributed freely with this banner intact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ** This document looks best when viewed in COURIER font ** ----------------------------------------------------------------------------- (1) NO NEW NEWS ON ENCRYPTION - VP GORE REITERATES SUPPORT FOR KEY ESCROW Despite the growing pressure from Congress, privacy advocates, the computer industry, and the public for the reform of US encryption policy, the Administration continues to embrace its Clipper III key-escrow encryption proposal. In a written statement issued Friday (7/12), the Vice President announced that the Administration will continue to push for the adoption of a massive public key infrastructure to enable law enforcement access to encryption communications and continue to rely on cold war-era export controls. [The full text of the announcement is available on CDT's Encryption Policy Issues Page: http://www.cdt.org/crypto/] CDT is disappointed that the Administration's latest statement offered no new solutions to what is becoming a critical policy issue for the future of the Internet and the development of a secure and trusted global information infrastructure. Friday's announcement comes amid growing concern from bi-partisan members of Congress, computer industry leaders, privacy advocates, and the public. Recent calls for changes in current US encryption policy include: * Bipartisan legislation in both the House and Senate designed to relax US encryption export controls and encourage the widespread availability of strong, easy to use encryption technologies. * The Security and Freedom through Encryption (SAFE) Forum, held on July 1st, where members of Congress, computer industry leaders, privacy advocates and the public discussed the need to reform US encryption policy. * The recent report by the National Research Council which criticizes current policy as failing to address the needs of an information age society. These developments represent a growing consensus among members of Congress, the computer industry, and privacy advocates that current US encryption policy is harming the competitiveness of US industry and endangering the privacy of computer users. Our understanding of this consensus does not match the conclusion the Vice President reaches that: "A consensus is emerging around the vision of a global cryptography system that permits the use of any encryption method the user chooses, with a stored key to unlock when necessary". CDT sees no evidence of broad support for a key escrow approach. While the Administration seems to acknowledge the importance of encryption for privacy and electronic commerce, neither the current policy nor its predecessors have met the needs which virtually all involved in this debate now see. Since 1992, the Administration has continued to offer solutions which fail to recognize the privacy needs of individual computer users and the realities of the global economy. While law enforcement and national security considerations are important factors which must be addressed, the Administration's current proposal, along with Clipper I and Clipper II, continues to put law enforcement and national security concerns above the privacy and security needs of the American public. SUMMARY OF VICE PRESIDENT GORE'S STATEMENT While putting forward an initiative ostensibly designed to make encryption more available to computer users, the Administration would do so at a high price: Individuals would be required to place their most private personal encryption keys in the hands of third parties. Today's statement is essentially a re-statement of the Clipper III proposal released in May. Among other things, the Vice President: * Called for the liberalization of export controls provided computer users participate in a "global key management infrastructure" designed to make personal encryption keys accessible to law enforcement. * Reiterated the Administration's opposition to the bipartisan encryption legislation introduced this Spring in the House and Senate, which would ease export controls. * Announced that a Cabinet Committee will send detailed recommendations regarding implementation of this proposal to the President by early September. * Indicated that the Administration "is considering" interim measures until a key escrow system is in place, including: - Liberalizing export controls for certain industries, - Developing performance standards for key recovery systems that will be eligible for export. - Launching key recovery pilot projects. - Moving jurisdiction over encryption export licenses from the State Department to the Commerce Department (The Burns/Leahy Pro-CODE bill contains a similar provision). The full text of the Vice President's Statement, along with the Clipper III proposal, the text of the Pro-CODE bill and other legislation, and detailed background information on the encryption policy debate, is available on CDT's encryption policy resource page: http://www.cdt.org/crypto/ CDT believes that a far more sensible approach to encryption is offered by the bipartisan legislation introduced this Spring to ease export controls, including: S. 1726, the Pro-Code Act introduced by Senators Burns (R-MT), Leahy (D-VT), Pressler (R-SD), Lott (R-MS), Wyden (D-OR), Simpson (R-WY), Murray (D-WA), and others; S.1567, authored by Sen. Leahy with many of the same co-sponsors; and H.R. 3011, introduced by in the House of Representatives by Reps. Bob Goodlatte (R-VA), Anna Eshoo (D-CA), Tom Campbell (R-CA) Zoe Lofgren (D-CA), and a bi-partisan group of over 20 others. NEXT STEPS CDT will continue to work with Senators Burns, Leahy, Pressler, Wyden and Reps, Eshoo, Goodlatte, and others to encourage the widespread availability of strong encryption by pushing for passage of legislation to relax export controls on encryption. The full Senate Commerce Committee, chaired by Senator Larry Pressler (R-SD), is expected to hold hearings on the Pro-CODE bill during the week of July 22. CDT is working to cybercast that hearing live on the Internet. Please continue to visit CDT's encryption policy issues page for the latest information on this issue. ------------------------------------------------------------------------ (2) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by nearly 10,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (3) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.27 7/12/96 -----------------------------------------------------------------------

2 1

Re: I@Week on crypto export loophole 6/24/96
by Will Rodger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >As I see it, the most important issue is not the legal status of the one >actually doing the export/mailing, but in fact the organization which is the >recipient and thus, the beneficiary of this act. _THAT_ organization will >be well-identified, yet will not have done anything obviously illegal. Is >there any indication that Baker was trying to distinguish between the one >physically mailing it, and those receiving it? Yup. He was speaking only of the US company. As you mentioned, odds of anyone getting caught are fairly low in many cases, but even lower for anyone outside the US. The odds the US would go after a foreign company would seem pretty remote, unless based in a country that strongly suppported US policy. The UK comes to mind, but few others. I'll leave it others to decide who else should be on that list. Will -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMebLF0cByjT5n+LZAQF3Owf5AbJCUK/9sbaUGDVV4eZcqggSuOgH+ubr fbx3W7HXaXcAlqvATFRt+mw5h6GMubNrRCC+Ka6CJYC60QESWnHCw8/XX000I2UQ ucBwRMTID+KZuNHN9vD4/hE+JBLkWDQyu2S4IDWkCR0+7UJDFQQ9z3kSVmqgczlB jGyOtUwVpNHETg0yGreuQVCMz6gzxX1eZf0Hv38BJQqD8ROOLVCmYC1grRlrltRV VJqRohsVustzqgu35OoKKzZES3hJxqvmXaNHIDMKhZmnbeHiZeAKs0tQ9hJz7Znp oNAGcwIugB7S7mANIr6bd0EPHiljOP2Ipe13LgMAtkhidipTDQgtRQ== =6+G6 -----END PGP SIGNATURE-----

2 1

Re: Can the inevitability of Software privacy be used to defeat the ITAR? (fwd)
by Cindy Cohn 17 Dec '03

17 Dec '03

At 09:38 AM 7/11/96 -0400, Michael Froomkin wrote: >Here's a fun legal issue that cropped up on the cypherpunks list Nice try, but no cigar. The problem with all of the "ITAR loophole" ideas is that they only work where the rules are clearly articulated and carefully followed by the administrative agencies. Neither of those exist with the ITAR.. There are no restrictions on the ODTC's ability to interpret the ITAR however they see fit and to change those interpretations as they wish to meet their goal: stopping folks from getting strong crypto easily. The best example of this is the mislabelled "crypto with a hole," in which ODTC interprets the regulations as allowing them to limit software with no cryptography in it at all but only hooks which could allow the insertion of crypto later. The ITAR says that they only regulate "software with the capability of maintaining secrecy" and so on its face would not extend to software which only has hooks for crypto. But this doesn't stop ODTC and there is no mechanism in place to allow anyone else to stop them short of a lawsuit or a change in the law by Congress. So, having said that, here's where I think they could fit in the "piracy" sublicense maneuver: First, entering into the sublicensing agreement could be interpreted as a "defense service." By giving them a license you are "assisting the foreign person" because, presumably, life is easier for them if they have a license. Second, call the sub-license agreement "technical data" since it is related to the crypto. Or, as they did with Zimmermann, they just assume that the company had something to do with the unauthorized export and begin an investigation. If it goes to indictment, better hope you have iron-clad evidence to convince the jury that you had nothing to do with it. If you've gone ahead and sub-licensed afterwards, making money off of the illegal act, I think it would be difficult to convince a jury that you didn't have something to do with it. Gotta write a brief now, Cindy Cohn > >A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) >Associate Professor of Law | >U. Miami School of Law | froomkin(a)law.miami.edu >P.O. Box 248087 | http://www.law.miami.edu/~froomkin >Coral Gables, FL 33124 USA | It's hot here. And humid. > >---------- Forwarded message ---------- >Date: Thu, 11 Jul 1996 04:06:05 +0000 >>From: Paul Elliott <paul.elliott(a)hrnowl.lonestar.org> >To: cypherpunks mailing list <cypherpunks(a)toad.com> >Subject: Can the inevitability of Software privacy be used to defeat the ITAR? > >-----BEGIN PGP SIGNED MESSAGE----- > >All software companies who sell (really licence) software >must deal with the inevitability of software piracy. It >is a brute fact that any usefully product sold in the U.S. >will eventually appear as an unauthorized copy for sale >abroad. This fact must be recognized in the software companies' >business plan. > >The question occurs to me "why can not this fact be used to >defeat the ITAR?" > >What is to prevent a U.S company to licence a foreign company >to sublicence and distribute a Crypto product abroad, if that >foreign company obtains that product on the pirate market? > >I am not a lawyer, but I look at the definition of "export" >on page 612 of Applied Cryptography and nothing seems to >obviously apply. > >The scenario I imagine is this: U.S. company produces a crypto >product. To be generally useful, the product supports all languages. >(Those CDROMs really do hold a lot of data.) >After all, Americans do need to do business with foreigners. >The company licences and distributes the product in the U.S. >taking special care not to distribute the product to any foreign persons. >When inevitability, the product appears in the pirate market outside >the U.S., the company makes a contract with a foreign company >allowing it to distribute it and sublicence it. The foreign company >can get their copy from the pirate market, being authorized to get >the copy by the U.S. company. When this deal is cut copies >have already been exported and are already being sold by the >pirates, against the will of the U.S. company. > >In this scenario, the U.S. company had done everything >it possibly could to prevent the illegal export of its product. But >when its efforts have inevitably failed, it makes money by >sublicencing. > >When I look at the definition of Export on page 612 of applied >cryptography, I see one clause that defines transferring registration >as export, but only for aircraft, vessels and satellites. > >OK, cypherpunk legal types, there has got to be something wrong >with this idea. There are a lot of smart people in the world, >so if this idea was good, somebody else would have thought of >it before now! But what is specifically is wrong with it? >I want to be educated! > >- -- >Paul Elliott Telephone: 1-713-781-4543 >Paul.Elliott(a)hrnowl.lonestar.org Address: 3987 South Gessner #224 > Houston Texas 77063 > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.3 >Charset: cp850 > >iQCVAgUBMeR9nvBUQYbUhJh5AQGkYAP/bN0lmkjF6uZ92MmWIqdZwVmLmsiIUg9L >XbtYaeawNCMdi2BnkDUu4j/G1rNngFuAmRwABE9UxKOnwjMU5lfmxHev5RP9/CBF >81AnYc1bWeh52EuKJCKu47LMDn9PqfiCIGBwfRehgkZ72gO0+ywIP1fZrkwNNCF+ >Md76LqUE5Z4= >=k7M5 >-----END PGP SIGNATURE----- > > ************************ Cindy A. Cohn McGlashan & Sarrail, P. C. 177 Bovet Road, 6th Floor San Mateo, CA 94402 (415) 341-2585 (tel) (415)341-1395 (fax) Cindy(a)McGlashan.com http://www.McGlashan.com

1 0

Re: Can't block caller ID in Massachusetts? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi all, Forwarded message: > Subject: Re: Can't block caller ID in Massachusetts? > Date: Fri, 12 Jul 1996 19:37:42 -0400 (EDT) > From: "Michael H. Warfield" <mhw(a)wittsend.com> > > Eric Murray enscribed thusly: > > > Caller ID isn't for people, it's for businesses who want to > > track callers. They're willing to pay for that service, enough > > to make it worth the while of the phone companies to spend many > > millions on a campaign of lies (excuse me, "PR") to convince us > > that we need CID for "safety". > > number was to be able to log and track that information. Every wonder > about those local companies who still had you call a 1-800 number. Guess > what. That was the easiest (and sometimes the cheapest) way to get ANI. > I ran a Harris 20/20 PBX switch for a company over 6 years ago and remember > looking over and discussing the ANI specs with the management. We decided > not to pursue trying to get ANI on our DID lines but the switch supported > it and that switch was considered out of date technology at THAT time! > I can verify this ability of telephone switches and number tracking. From 1984 to 1990 I worked for the University of Texas at Austin in their Physical Plant Telco shop. I worked on a NT SL-1 based switch feeding voice, data, and analog signals all over campus as well as interfacing to SWBT's trunk lines. I personaly used the system to track on campus phreak and hack attacks as well as feeding the universities computerized security system. We used a Charles Rivers 68/35 running building control software. With it we could track various aspects of the telephone switch and log them offline. We used the system strictly for input of signals for physical security (ie door switches, mag-locks, PIR's, etc.) over the dry pair of the switch. Watch your 6's. Jim Choate CyberTects ravage(a)ssz.com

1 0

RE: Can't block caller ID in Massachusetts?
by Bill Olson (EDP) 17 Dec '03

17 Dec '03

What's worse, is that if you just want to call and get information about a particular product, they can log you for their marketing database. >---------- >From: David Mazieres[SMTP:dm@amsterdam.lcs.mit.edu] >Sent: Friday, July 12, 1996 8:55 AM >To: cypherpunks(a)toad.com >Subject: Can't block caller ID in Massachusetts? > >My last phone bill said that Nynex is now giving out people's names in >addidtion to their phone numbers over caller-id. I therefore called >Nynex and told them to block caller-id on my phone line. > >They said no problem, but... They said nothing I can do will block it >when I call 800 numbers. "The people with 800 numbers have special >software, and there is nothing you can do to block your identity when >calling them. Not even *67." > >Wow. Maybe I'm not paranoid enough, but I never expected this. I can >never again call an 800 number anonymously to get information about >something unless I go out to a pay phone. What an incredible >inconvenience, and how truly depressing. > >I know 800 number owners probably used to be able to get lists of >calling phone numbers on their phone bills, but this is less >disturbing as it would take significant effort to match up the lists >after the fact. I just want to be able to call up companies and say, >for instance, "If I buy your product, can it do X?" as opposed to, for >instance, "I'm stuck with your product, can it do X?". People are >often more helpful in the former case. Now, though, they'll know >exactly who I am before they even say hello. > >David >

1 0

Good dictionary files?
by Sentiono Leowinata 17 Dec '03

17 Dec '03

As many people say, a good password cracker is very dependent on the dictionary file(s). When one has a very good dictionary file(s), the chances of password being cracked is bigger. I am wondering if someone can tell me where I can get good dictionary file(s). Search on the web result to nothing. I have one large dictionary file (about 14Mb) to check it, but I still not feel comfortable to say it's a good one. This might be off topic from cryptography, but until we can reverse engineer (decrypt the crypt or crypt(3)) functions, nothing we can do but to rely on those good dictionaries. Thank you and I apologize for anyone who might get offended by my post. Regards, Sent.

2 1

Re: Can't block caller ID in Massachusetts?
by Dana W. Albrecht 17 Dec '03

17 Dec '03

David Mazieres writes: > My last phone bill said that Nynex is now giving out people's names in > addidtion to their phone numbers over caller-id. I therefore called > Nynex and told them to block caller-id on my phone line. > > They said no problem, but... They said nothing I can do will block it > when I call 800 numbers. "The people with 800 numbers have special > software, and there is nothing you can do to block your identity when > calling them. Not even *67." > > Wow. Maybe I'm not paranoid enough, but I never expected this. I can > never again call an 800 number anonymously to get information about > something unless I go out to a pay phone. What an incredible > inconvenience, and how truly depressing. > > I know 800 number owners probably used to be able to get lists of > calling phone numbers on their phone bills, but this is less > disturbing as it would take significant effort to match up the lists > after the fact. I just want to be able to call up companies and say, > for instance, "If I buy your product, can it do X?" as opposed to, for > instance, "I'm stuck with your product, can it do X?". People are > often more helpful in the former case. Now, though, they'll know > exactly who I am before they even say hello. > > David 800 (And 888/900 etc.) numbers use a different mechanism (ANI) than caller ID to provide your telephone number to the person you are calling. This has been around far longer than caller ID, and really doesn't have all that much to do with the caller ID service, which is entirely different. So in essence, nothing's really changed with regard to 800 numbers, except that people are now becoming _aware_ that the called party has access to their telephone number. If you want additional information, I'd recommend starting with the FAQ for the alt.2600 newsgroup. Dana W. Albrecht dwa(a)corsair.com

1 0

EFA attitude to crypto
by Sherry Mayo 17 Dec '03

17 Dec '03

Just to clear up Rich Grave's comment regarding the Electronic Frontiers Australia's attitude to crypto. EFA did not object the the ABA's report and it's comment about crypto. They did object to an earlier government report which said that crypto should be *mandatory* - since turning people into criminals for transmitting plaintext is just as daft as turning them into criminals for transmitting encrypted text. Hope this puts things straight. Sherry

1 0

Re: Another bad idea
by Deranged Mutant 17 Dec '03

17 Dec '03

On 12 Jul 96 at 10:23, Alan Olsen wrote: [..] > Of course this is all a moot point, because it has been proven by computer > projections that all informative net traffic will be buried under > advertisements by the year 2000 anyways. I expect some legislative body to > try and make money fast on the net by selling ad space on IP packet headers. Yes. They can follow the American model and rather than censor communications, allow advertising. Nobody will be able to get an inteeligent thought from the net without being interrupted by an ad every five minutes... and people will pay good money for this 'privledge' (sp?) too. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Another bad idea
by Deranged Mutant 17 Dec '03

17 Dec '03

Note that my main point was sort-of vague. Let me re-iterate it: crypto-activism should go along with the other activism for democratizing countries like China, Iraq, Burma, etc. Most of the activists involved with those issues know about the culture (and many are already PGP-aware)... so for specific situations some of the ideas presents may not be appropriate for others. It might be ok to direct-mail someone in one country, but dangerous for someone in another. Also don't take for granted the relative access of privacy one has in the US or Europe compared to some regime where you can only net surf with a policement watching over your shoulder at the police station's internet kiosks (hypothetical...). Using an anonymous remailer or web anonymizer may be reason enough to get somebody in another country in trouble. The thought of blindly being a k00l krypt0 activist and getting some poor guy in another country thrown in jail doesn't do much to help democratize that country. Spam and unsolicited mail aren't the way to go. Better, more subtle ideas, might be to say 'check out this page' ot 'i've got source code for that on my page at...', which has techie or even entertainment info but also has political info (that already happens quite unintentionally). I wonder what web users in places like Singapore thought when they kept running across blacked-out anti-CDA pages... If one is familiar with the culture, one can even be really subtle and seem to be talking about an unreleated story or even techie or sports but actually be discussing the political situation in that country (look at many Soviet films, some Chinese films, Spanish films under Franco's regime, Cuban films, etc.) On 12 Jul 96 at 18:30, E. ALLEN SMITH wrote: [..] > If these countries didn't value their technical people and what they > can do, they wouldn't be allowing them on the Internet (even in a restricted > way) in the first place. The above would only be a likely scenario if the [..] Don't underestimate people's stupidity. The party loyalists or bootlickers may get away with more naughtiness on the 'net, but those borderline techies who are about due for another month at a re-education camp or loyalty counseling may get screwed. If such countries really valued their techies, then why do they allow them to emmigrate to Western countries? [..] > How, precisely, is one going to filter out graphics from web sites in > Chinese? Ascii text and ideographs don't exactly get along. One interesting [..] By filtering out all photographs, which from what I heard the Chinese were contemplating. Whether is it truly feasible is another matter, of course. But since when has infeasability prevented anyone from trying it? Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: ANI Blocking! Fast, Easy, Effective! (fwd)
by Bruce M. 17 Dec '03

17 Dec '03

> ---------- Forwarded message ---------- > Date: Thu, 4 JUL 1996 14:48:28 GMT > From: Glen L. Roberts <glr(a)ripco.com> > Newgroups: alt.2600, alt.privacy, alt.private.investigator, > alt.dcom.telecom, > comp.dcom.telecom.tech, alt.security, misc.consumers > Subject: ANI Blocking! Fast, Easy, Effective! > We are in the beta teating phase of a new service to block ANI. > You'll be able to call any toll-free number and prevent them from > getting your phone number. We do not charge for this service (you > do have to call a long distance number). > Complete details are on our web page. As we are beta testing, we > can't say for such what problems might crop up, but let us know. > http://pages.ripco.com:8080/~glr/block.html > ------ > Purity of Opinion through force of Intimidation: > http://pages.ripco.com:8080/~glr/rogue > Web Site for FBI File Access! You, too can be like Pres Clinton! > http://pages.ripco.com:8080/~glr/fbi.html > ------ I thought this might be of interest due of the recent discussions about ANI and privacy. I've seen this type of service before, but this one is apparently free (besides the cost of calling their area code if you aren't local). ________________________________ [ Bruce M. - Feist Systems, Inc. ] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ "Official estimates show that more than 120 countries have or are developing [information warfare] capabilities." -GAO/AIMD-96-84

3 4

Crypto-activism
by Deranged Mutant 17 Dec '03

17 Dec '03

On 13 Jul 96 at 0:37, Arun Mehta wrote: [..] > >> 1) Collect the e-mail addresses as Allen suggested (including those in > >> Hongkong), and send them a single, short message offering to teach them free > >> of cost how to use pgp and all the goodies at > >> http://www.eskimo.com/~joelm/cbsw.html > > > >Might be condescending. 'Civilized white man brings PGP to the > >barbarians...' > > Look around you: while "civilized", "white" and "man" might characterize the > vast (?) majority on this list, I'm sure that's not the universe on > cypherpunks. And how does it matter? I'm suggesting an e-mail course that My point is that a lot of people in those countries are aware of PGP etc. than make it out to be. Certainly many activists are. They focus on the human rights issues at hand, to which PGP etc. may be a tool... but isn't the central focus. It would be condescending to email to many people in a domain saying "hey, have you heard of PGP?..." Chances are they'll think it's a strange commercial spam anyway. The "civilized white man" comment was more of a metaphor. Change that to "Cypherpunks bring gifts of crypto to the natives" or maybe "Cypherpunks civilized the barbarians with PGP"... [..] > > They may well know about PGP, but not in a position > >to make that knowledge widely known. > > That's no good to the rest of the world. Forget them: the question is, are > *you* in a position to share your knowledge? Yep. But there's a proper way to share knowledge. You don't want to do it in such a way as to get the person you're sharing it with in trouble (esp. for something like crypto, where you could go to jail or be shot in some jurisdictions). If that person isn't interested, there's not much you can do... you may end up turning someone off. If you want someone to listen, and be interested (if they're not already), you have to do it in an appropriate way. You also have to know what you're talking about: if you're not familiar with the nitty -gritty of politics in such countries, you'll come off as the "cypherpunk bearing gifts of crypto for the natives"... the politics going on in places like Cuba, China, Iraq, Russia are a bit more complex than what comes off through the media (to some extent no matter where you are and what media you watch). For example... there are many anti-Castro 'democratic' socialists in Cuba. If you approach them as if they were anti-Communists you'll be seen as a clueless kook. Some Chinese I have spoken to are suspicious of the Tiennamen Sq. activists, claiming they were more 'reformists' than true democratizers who were unknown before Tiennamen. Many Iranians will insist Iran is a democratic country where fundamentalists hold a lot of popular power, and that Western tinkering will only strengthen fundamentalists rather than allow a transition to a more moderate party. I'm not saying any of these are true... they are just examples of how people in the respective territories view their situations differently, and that one can do more harm mistaking the situations in those countries. One more important issue: people have to trust you. You can't go into a strange environment and expect trust if you come off as a tourist. As for sharing knowledge... share crypto with activists involved with other issues. If one right, they're likely to use it in ways one hasn't imagined. [..] > >I'd leave the specifics to activists who are already familiar with > >the respective cultures, societies, politics, etc.... > > I'm one. Be glad to tell you more,... Yes, do tell. [..] > It's only crypto, not the Bible or Koran. And let them be their own judges? > You seem to want to protect people in the Third World the way the US > government wants to keep cyberporn from kids. No. I don't want to see somebody do something annoying and counterproductive that can get people it's allegedly meant to help in trouble and perhaps make a case for strengthening crypto regulations. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Can the inevitability of Software privacy be used to defeat the ITAR?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:21 PM 7/12/96 -0400, Michael Froomkin wrote: >> could claim that MIT came very close to violating ITAR, but the same claim > >"The ITAR do not apply to books" I'm not sure the exact legalities apply here. I think it is more like the mob pressuring business men for protection and punishing those who do not comply. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

It's more than "White Punks on Dope"
by Brad Shantz 17 Dec '03

17 Dec '03

Tim May Wrote: > In recent decades, do-gooders have taken upon themselves to intervene > in the parenting process and have essentially succeeded in making such > sanctions harder for parents to impose. Schools routinely teach young > children to inform on their parents if they have been spanked, touched, > talked to "inappropriately," etc. Check out the parent's rights > newsgroups (and father's rights) for tales of interrogations by agents of > Child Protective Services, who are empowered to remove a child > immediately and without court proceedings if they merely _suspect_ a > child has been treated in ways the State has deemed no longer >appropriate. ...yadda yadda yadda...more on how we all agree that burning children is not a viable option....etc. It is so much more than what the "State" deems appropriate. Having grown up with both parents being teachers in the public school system and my wife a teacher in a private Montessori school system, I've seen that the feeling in society is, "Everyone is a victim." In seattle a few years ago, there was a teenager who killed his girlfriend. (beat her face in with a rock) Yes, he was caught, yes he went to trial. This 19 year old lame-o used this as his defense, "Fetal Alcohol Syndrome." THEY LET THE MURDERER GO ON THE PRECEDENT IT WAS HIS MOTHER'S FAULT BECAUSE SHE HAD A FEW DRINKS WHILE SHE WAS PREGNANT WITH HIM. So, he wasn't in control of his own actions? I say bullshit to that. At my wife's school the kids are being taught that the definition of harassment is if someone is doing something to you that you don't like. Oh, the third graders have a heyday with this one. "Chris is looking at me and I don't like it." Immediately, Chris is repremanded because he is harassing the other kid. What's wrong with this picture? Well, it's not Chris' problem, is it? The teachers need to be a little more understanding of what harassment is. Chris could turn around and say, "By reprimanding me, you are harassing me for something totally stupid." There are so many different "syndromes" and "conditions" that you can't keep track of them all. ADD, Hyperactivity, Fetal Alchohol Syndrome, Chronic Fatigue, Repetitive Stress (which is a physical ailment, but it came to mind), they are all names to psychological conditions. Some because they are serious problems...like ADD in some children, but not all. Some however are lame attempts by psychologists to put the human psyche into a bunch of prepackaged little boxes. Eventually, you could build the perfect beast by just grabbing a handfull of syndromes from this box over here, mixing them with a few neuroses from this box over here. Pour in a little Free Love, a little Self Preservation and give the entity a stopwatch in the shape of a heart and a scroll for a brain and you've got an average human being. Sorry, no, thank you. We are more a part of our environment than that. Some people grow up to be just like their parents. Some grow up to be the exact opposite. However, our "raising" does have an effect on us. > So, what to do with children who are otherwise uncontrollable? > > Ah, the State has the answer. And its name begins with "R." 'Nuff said. At my wife's school, they do not use Ritalin. They have started using a product called PhytoBears. Don't laugh. These are GummiBears made out of all natural vegetable extracts. One of those, "100% of all the vitamins and minerals needed by the human body and mind in a day" kind of things. Apparently, the kids who were on Ritalin are now getting on much better with PhytoBears than they were with Ritalin. >> I will admit to the possibility of ADD being a "disease", but I >> think that the number of children who really have the disease is small >> compared to the number of childern recieving drugs for it. Yes, I've read this entire thread, I don't need loads of flame mail telling me to go back and read the ENTIRE THREAD again. I just want to say that in many schools, at least in Washington, ADD is no longer being treated strictly with drugs. Someone mentioned being put in a "special" class while his brother was in a regular class (or the other way around). That is more common than an automatic prescription for Ritalin. I still claim that ADD is a syndrome that is serious in some kids and for others it's a crutch. The diagnoses in Washington are getting better. > This is the point I have been making. Not that ADD (aka ADHD, > hyperactivity, etc.) does not sometimes exist, but that giving Ritalin > and suchlike drugs to children has been a panacea for fidgeting, > wandering attention, boredom, "cutting up" in class, class clowns, > and so on. Dr. Cynthia Tobias (who just happens to be from Seattle Pacific University, just a coincidence) has done studies for her entire doctoral carreer on the subject of learning patterns. Her findings are interesting. They aren't practical in a public school system, but interesting nonetheless. There are a number of different learning styles. I won't go into all of them for the sake of brevity (I know, too late.) One of the learnign styles that she has spent much time working on is the Kinetic/Kinesthetic learner. These are the kids who wander around, and fidget as Tim put it. The goal of the teacher with a Kinetic learner is not to get them to sit down, but to get them to not distract others. If the kid likes to do his work laying on the floor and he's not bothering anyone, let him. There are some people (like me) who can't stand to sit at a desk all day long. I get my work done, but I often lay on the floor, sit on the desk, walk around the office, etc. Anyway, my point is that there are teaching practices that could be used to teach the child without resorting to labelling (as I think ADD is sometimes used) or drugs. > And perhaps worse, _parents_, such as the example I provided, are using > it to control children. Where once they would've paddled the kid for > using obscene language, or refusing to get dressed for school, now they > pop a pill in the child's mouth. That is only in the example you provided, Tim. Yes, if one person is doing it, there are probably more. (It's like Cockaroaches....where there's one...) > I didn't have ADD. I was simply bored by a system that either taught > me stuff that was irrelevant > > I suspect this was true of 90% or more of us on this list...we're a > bright lot, and it's hard to imagine that _any_ school could keep us from > being bored a lot of the time. (And hard classes can be boring, too.) Agreed. The teachers at my High School and even at Oregon State University always had trouble convincing me of the validity of some of the topics we were learning. I'm sure it bugged them when I asked. Brad

2 1

SEARCH> Social Security Death Index Search (fwd)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 5 Jul 1996 12:41:15 -0300 (ADT) From: Todd Smith <tsmith(a)admin.fsu.edu> To: Multiple recipients of list <inet-news(a)nstn.ca> Subject: SEARCH> Social Security Death Index Search Social Security Death Index Search http://www.infobases.com/ssdi/query01.htm To search the Social Security Death Master File (a.k.a. Social Security Death Index or simply SSDI), fill in any or all of the fields below and press "Submit." A list of some Social Security Death Index information is available here. The SSDI search indexes are currently under development. Indexs are currently available for surnames beginning with the following letters: A B C D E . . . I J . . M N O P Q R . . U V . X Y Z Last Name: First Name: SSN: Location Issued: Birth Information Date: Month: Year: Death Information Date: Month: Year: Last Residence / Lump Sum Payment Information: City: County: State: Zip Code: ------------------------------

1 0

Re: Crypto-Activism & PGP
by William Knowles 17 Dec '03

17 Dec '03

Does anyone know how many languages PGP's help files and documentation has been translated into? A good start I would think would be translating PGP into Chinese? and mirroring it on sites around the world. William Knowles erehwon(a)c2.org -- William Knowles <erehwon(a)c2.org> PGP mail welcome & prefered / KeyID 1024/2C34BCF9 PGP Fingerprint 55 0C 78 3C C9 C4 44 DE 5A 3C B4 60 9C 00 FB BD Finger for public key --

1 0

Execution of signed scripts received by e-mail
by Matt Carpenter 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This is a rough description of a perl script I'm working on to allow the automated execution of PGP signed scripts received by e-mail. I call it emscrypt. Right now it is in the volatile-ware stage. Hopefully I'll have it tested enough to post here shortly, if I feel i can pull myself away from my research for a few hours. But I thought I would post a description now to see if anyone can find any problems with the way I'm going about this or has any suggestions. I apologize for the possibly inscrutable descriptions; it's been a while since I last slept. Let me know if anything needs clarification. First, a basic description of the idea: 1. Write a script (perl, sh, etc.) to be executed on a remote machine. 2. Sign the script with PGP. It can also be encrypted using the public key for the emscrypt installation on the remote machine. 3. Mail the signed/encrypted script (a.k.a. emscrypted mail) to the address where emscrypt is installed. 4. The script is received and piped to emscrypt (using procmail or something similar). 5. Emscrypt checks the PGP signature on the message, and checks for replay attacks based on the time stamp from the signature. 6. Emscrypt executes the script, gets the results, encrypts them, and sends them back to you. The install procedure: Create a directory to hold the PGP keyrings and the emscript temporary files. Generate a secret/public key pair for the emscrypt software and place in the emscrypt directory. These need to be DIFFERENT for each installation of emscrypt. Otherwise you are subject to a "same play" attack. I suppose you could create two or more installations with the same key if you will ALWAYS be sending all the same scripts to every installation. Generate a public keyring in the emscrypt directory which has only the keys with which you want to be able to validate incoming scripts. Make them "trusted" by the emscrypt key. Update the PGPPASS, PGPPATH, and emscryptPath variables in the emscrypt script. This is very important since if the PGPPATH is pointing to your normal pubring ANYONE with a key in that ring would be able to run scripts on your system. Actually only the keys which are "trusted", but there may be lots of "trusted" keys which you wouldn't trust to run arbitrary scripts on your computer. Test the script to make sure it seems to work alright on your system. After that, you can set it up to be automatically called when you receive e-mail with the magic subject line of your choosing (or in some other way I suppose). I've been using something resembling the following procmail recipe: :0: * ^Subject.*SQUEAMISH OSSIFRAGE |/MY_PATH/emscrypt How emscrypt works: * Get input Get one input line at a time, and look for Reply-To: and From: headers to get a reply address. As we are slurping up lines, watch for '-----BEGIN PGP' lines. If it is for encryption or a signed message (i.e. as long as it is not for a key block), get all the lines up to and including the appropriate '-----END PGP' line, and save them to a temp file. Note that several scripts can be batched together in a single input file. Just generate the scripts and sign them separately and the combine all the PGP messages into a single file. Also, they may be signed with different keys. * Verify signature Run PGP on the temp file to verify/decrypt it. Save the stderr results from the PGP process in another temporary file. Get the verified(?)/decrypted output from a pipe, and save in memory. (QUESTION: is it possible to have stderr redirected to a separate input pipe and avoid writing to disk? How? (This is in Perl.) I was combining the the stderr and stdout from the PGP process into a single input pipe, but that may allow for leakage of PGP stderr output into the script we are verifying/decrypting if we aren't careful.) Search through the PGP process stderr output to look for important stuff like whether the signature was good, what the time stamp was, and what the key user string is. I'm not real happy with this method. Probably doesn't work well with versions other than 2.6.2 or non english language versions. I'm waiting for the signature code and such in the PGP library from Systemics (an announcement showed up here a couple days ago, http://www.systemics.com/software/ ) which will allow this to be much cleaner. (QUESTION: Any other ideas for handling this?) * Check for replay If the signature is good then we need to check for the dreaded replay attack. This is how I have it working: there is a separate file for each PGP public key which keeps track of the time stamp for the last executed script which was signed by that key. Right now the file names are generated from the key ID string for the pgp key. Mainly because we get that for free when we check the signature. Will probably run 'pgp -kv "ID string"' so that I can get the hex key ID, since that would probably make a more reasonable file name. Besides the value saved to disk, we store a separate time stamp for this "batch" of messages in an associative array by key ID. Each separate mail message is a batch, but we may have more than a single PGP signed script in each message. So the batch time stamp is the stamp we read from a time stamp file for a key ID when we process the first message in a batch for that specific key ID. The batch time stamp is then constant for the remainder of this run of the script. Anyway, we generate a file name based on the key ID, save it in an associative array by key ID for later use, and see if the file actually exists. If the file doesn't exist, create it and save the time stamp from the current signature to the file. Put a timestamp of 100000000000 in an associative array by key ID for later use (this is the batch time stamp: the time stamp is formatted as YYYYMMDDHHmm. I use 100000000000 here since I explicitly check the time stamp format each time to make sure it is composed of exactly 12 digits. Also, if the file doesn't exist, we need to use a batch time stamp that will be lower than that of any of the messages in the current batch for this key ID. I suppose it might be better to generate a time stamp something like (CURRENT_TIME - (some reasonable amount of time)) to limit what is accepted. I also plan to allow a limit for the amount of time which can elapse between the script being signed and being received by emscrypt for cases where the file does exist. If the file did exist on disk, read the time stamp from the file and save in the batch time stamp associative array by key ID. So now we have a replay prevention time stamp to compare to the time stamp from this PGP signed script. If the script stamp is more recent, then we can execute the script. But first, check to see if the script stamp is more recent then the stamp saved in the file. If it is, then replace the file time stamp with the script stamp, and update the associative array which keeps track of these values (this is the "most recent stamp" array, not the "batch stamp" array). * Execute the script Check the variable status to make sure that both the signature and time stamp were acceptable. If not, then generate an appropriate error message explaining why the script was rejected, include a copy of the script, encrypt the message using the submitter's public key, and mail it back. Then go back to the top of the loop to deal with the rest of the input. If it everything checks out, then prepare a file to receive the stderr output, save the script to a file, set the script to executable, and open (execute) it as an input pipe. Get the results from stdout. Open the stderr file, and get the stderr results. Combine the stdout, stderr, and the script (with separators so we can tell what is what), encrypt the whole bundle with the submitter's public key and mail it off. Repeat loop for rest of input. Problems? Suggestions? Let me know. Thanks, - --Matt - -- mcarpent(a)mailhost.tcs.tulane.edu Finger for PGP public key. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMedc/SjtJAMyBnp9AQF83wf+J9P1Lmr8sca12R89LUYcFxRms1gJro/9 E5Ni1kqivWKYJ+JP9geP+k7VLWbq5miby8RMfKemuz77BuK9UIQG1pd6bGNjlSg9 O+XkiB5dbHX6+hZ23wPABzeuu6+3klLfNnzQEuNZ4/jxeNwFIIY3ifYglhWIPoeG a3kpd2DXY1HVjO674TQNGBYn6bnDPi5wMzYSTxJLukKHBzlgaLt4nssv/8N2jhcg XHWqEEvHc2lY0UvBk+wuqJHigzI03NzpFkh7mgF6ll5gEuG0qGgvLIKb+ir4vF1Q k46mNHq03M+Vc5/loLjFfQzcuu24GdjlFY2pHEpHz7rhYG25ONJeDg== =Lm22 -----END PGP SIGNATURE-----

3 3

Internet Relay Chat
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Is it legal to hack IRC??? Just wondering..

3 2

Re: Can the inevitability of Software privacy be used to defeat the ITAR?
by jim bell 17 Dec '03

17 Dec '03

At 11:27 PM 7/12/96 -0700, Bill Frantz wrote: >At 9:21 PM 7/12/96 -0400, Michael Froomkin wrote: >>> could claim that MIT came very close to violating ITAR, but the same claim >> >>"The ITAR do not apply to books" > >I'm not sure the exact legalities apply here. I think it is more like the >mob pressuring business men for protection and punishing those who do not >comply. And that's what "our" government's coming to! Does anybody still think that they're not going to deserve what they get? Jim Bell jimbell(a)pacifier.com

1 0

Re: CDT Policy Post 2.27 - No New News on Crypto:
by jim bell 17 Dec '03

17 Dec '03

At 06:23 PM 7/12/96 -0400, Bob Palacios wrote: >----------------------------------------------------------------------------- > _____ _____ _______ > / ____| __ \__ __| ____ ___ ____ __ > | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ > | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ > | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ > \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ > The Center for Democracy and Technology /____/ Volume 2, Number 27 >---------------------------------------------------------------------------- > A briefing on public policy issues affecting civil liberties online >---------------------------------------------------------------------------- > CDT POLICY POST Volume 2, Number 27 July 12, 1996 >(1) NO NEW NEWS ON ENCRYPTION - VP GORE REITERATES SUPPORT FOR KEY ESCROW > >Despite the growing pressure from Congress, privacy advocates, the computer >industry, and the public for the reform of US encryption policy, the >Administration continues to embrace its Clipper III key-escrow encryption >proposal. Bob, I think I'd feel a lot better about CDT if you'd explicitly withdraw any support for the Leahy encryption bill. Jim Bell jimbell(a)pacifier.com

1 0

SECURE + PGP
by Remo Pini 17 Dec '03

17 Dec '03

I played around with secure (eudora plugin) a little bit, but it seems to be unable to decrypt anything it encrypted. (eudora 16-bit on winnt 4.0) Any hints? Also, I wan't to write a mail-program (like eudora), with built-in PGP. Is the algorithm published anywhere (including the protocols)? ie.: key generation, signing, en- and de-crypting, u.s.w. I presume the algorithms are of the shelf (DES and IDEA), but what about the hash-algorithms and key-ring management? ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

2 1

Re: I@Week on crypto export loophole 6/24/96
by Will Rodger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:03 PM 7/13/96 +0200, you wrote: >Will Rodger wrote: >> >> The odds the US would go after a foreign company would seem pretty remote, >> unless based in a country that strongly suppported US policy. > >Er, right ... Just like they don't go after the Swiss bankers who >choose to have dealings with Columbians, or German businessmen who >have dealings with Cubans ... > You're right. I should have be more specific: I was thinking the odds the US could successfully prosecute a non-US citizen for violating those laws seems pretty remote if that person was from a country not in agreement with US crypto policy. "Go after" is a bit vague. Shame on me. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMefTA0cByjT5n+LZAQFPIAgA1CePSpY1wJm8CCQEloxIZMQMXNuaOC3U Un6JpPtIIDY8X/uSFP7wg8Mgbt+bKBNp1Ehgx6dPMavs8JnMTQWZGGuSDlIdc+5Y 41sTEA6ig6iIls3NqnnVz+0F6JTRF20gKCR1KH++7EdG/zJKJJN833N9NU4QP3od vXQ8jkaNILWzawsh83d9ZngC3ublDFU9onDOx6XIJAoSFNUn39hN8198BCtixCSq FzIDsR2cuiWe4k1PcrUAtKCOlqRxjNqrgc/sy5Gf56qIdjbgJ/rfvO9Rf6JVFZ3i 6dIqw37OEZZ89+pm5hWnjjRQUj2O3oFgO6psBdLkfXkYF6w9ryVbAw== =+1IU -----END PGP SIGNATURE-----

1 0