December 2003 - cypherpunks-legacy

Off the deep end (PUNCH!)
by Anonymous 17 Dec '03

17 Dec '03

Well, although Perry Metzger has expressed a disdain for re-postings of Detweiler's rants to this list, I think that a little, subtle reminder should occasionally be posted just to remind us all how deranged this fucker really is. Enjoy. -------- cut here ------------ Newsgroups: talk.politics.crypto,alt.privacy,comp.org.eff.talk From: ld231782(a)keller.lance.colostate.edu (L. Detweiler) Subject: ancient torture techniques Sender: news(a)yuma.ACNS.ColoState.EDU (News Account) Message-ID: <Dec31.090735.79631(a)yuma.ACNS.ColoState.EDU> Date: Fri, 31 Dec 1993 09:07:35 GMT Organization: Colorado State University, Fort Collins, CO 80523 Geoff Dale (plaz(a)netcom.com) wrote: : > Congratulations! If you repeat anything frequently enough, : > people begin to believe it. : : That seems to be your strategy. It doesn't work when you so consistantly : undermine your credability with rants, tho. : So stop posting and this little bit of net.history will soon be forgotten. Hello world, I am not proud of everything I have posted `out there' lately, but I am even less proud of the ugly depths and grotesque deformities I have seen in certain black corners of the Internet lately, and the apalling complacency with which you all view it. The skeletons have not only fallen out the the closet, they have danced around us and punched us all in the face. My own letters on the subject are an attempt to shock you from your silent complacency and `accessorizing'. What happens when trust breaks down? What happens when people respond to their own posts? When they misattribute writing? When they don't care who is behind email addresses, or deceive others about them? When they post multiple messages from different addresses? Imagine that every one of my posts came from a different address. What is to prevent me? My honesty? My integrity? What if I am a cyberanarchist? Would I be horrified or delighted at these embezzlements of trust? By the squirming and writhing of my victims underneath my crushing onslaught? * * * I was reading a book about ancient torture techniques. (Actually, it was about something else, but some paragraphs on the subject crept in from obvious relevance.) The Roman soldiers had invented some of the most grisly torture and execution techniques the world has ever seen, perhaps the most humiliating and heinous punishments known to man. One that I was reading about was called `Circle of Eight'. A blindfolded prisoner stands as Roman soldiers (enthusiastic volunteers?) circle him and take turns punching him in the face. They take the blindfold off, and ask him, who hit you? And if the prisoner fails to name the person, the game continues, they dance in their delight, circling at a faster, more dizzying rate, and pummel harder. What is the point of all this? I don't have a major point, except to suggest that this is one of the most evil abominations of humanity I can imagine. And that it is shockingly identical to the mentality that a cyberanarchist has in hammering others with his fake email identity arsenals. Medusa is delighted to punch the blindfolded victim in the face with her dizzying circle of tentacles. Guess who it is! Ooops, you're wrong, sorry. PUNCH. What? No, N.Szabo is a real person. PUNCH. Pseudospoofing is immoral? nah. PUNCH. N.Szabo is my roommate. PUNCH. Lies are liberating. PUNCH. cypherpunks have never pseudospoofed. PUNCH. especially the leaders. PUNCH. and everything in the media is true. PUNCH. especially what we say. PUNCH. and our leaders are the greatest of all. PUNCH. See the blood dripping on the ground, see the hideous disfigurement of the victim's face. * * * I am posting this many messages to drive home the point that the Cyberanarchists are not really noble at all. They are like Roman Soldiers who will hit you when they see that you are blindfolded. Otherwise, they hide in the shadows like all the rest of the cowardly slime at the putrid, dank recesses of humanity. And unless someone takes out the trash, we're going to have to get used to the smell. But where will we go to eat, then? go ahead, tentacles, water down my words with more trash. dilute and warp my message beyond all recognition. that's probably all we read is, anyway. all of history is just a big lie set out by people who aren't interested in the truth, but in fooling us to assuage their egos. the Bible, of course, is the worst of all. * * * I read one author who suggested that as part of Christ's torture before literally bearing his cross, he had been subjected to the Circle of Eight. Cyberanarchists, who are you punching? What was that saying of Christ's, as you do unto the lowest of men, you do unto me? I think the question you have to ask yourselves is, if a victim is blindfolded, does God hear his screams? What if the soldiers are athiests? When does the Circle of Eight stop, anyway? When the victim is unconscious? When he is dead? ``NEXT!'' -- ld231782(a)longs.LANCE.ColoState.EDU

1 0

WHAT ARE SMARTDRUGS
by chris.smart＠canrem.com 17 Dec '03

17 Dec '03

Ok, I'm totally new tto CP, have not read any of the Gibson novels, but have read the Frequently Asked Questions thing for this group and I have a question for all of you. What are "smartdrugs"? I already take a multi-vitamin pill daily, but is there something I can take to heighten my allertness or energy level? I'm asking this because I want to get into programming in a big way, and need something a bit nicer then large amounts of coffee and chocolate to keep me awake. <g> Any help would be appreciated. Either post here, or E-mail me at Chris.smart(a)canrem.com Thanks, Chris. --- * OLX 2.1 TD * You'll have to excuse him; he's from Canada. EH.

3 2

Reveal your key or else.
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

Mike Ingle had some good thoughts: Since the Canadian case, there's been a lot of talk about the problem of being coerced to reveal your key. If the coercers play by no rules whatsoever, there isn't much you can do. If they suspect you of having encrypted data, they will beat it out of you. ... Hypnosis might offer a defense here. A post-hypnotic suggestion could make it impossible for you to remember the passphrase in a coercive situation. Even better, you would remember -very clearly- an -incorrect- passphrase unrelated to the correct one. The more stressful the situation, the more you could think of -nothing else.- You could then put on a convincing performance that you are baffled why the passphrase you are "sure" is the right one doesn't work any more. Steganography can hide your data, but then you have the steg program itself. If they find the program, they have reasonable grounds for assuming you have hidden data, ... Then better hide the steg program. A good design would be like LZEXE, that would attach itself to any program, and would just pass through any command line except a pass phrase. It would require highly skilled analysis to detect the steg program hidden in, say, your GIF viewer or WAV player. This takes nothing away from Mike's suggestion of having different passphrases access different data. -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

FWD: L. Detweiler tortures the Satellite of Love
by plaz＠netcom.com 17 Dec '03

17 Dec '03

The second Detweiler forward in 24 hrs, but I just can't help it! This is just too good! I went back to alt.privacy to see the post forwarded earlier. I found that Detweiler had posted five or six messages in a row, in reply to my kiss-off message. But I also found this gem: --Begin Forwarded Post-- --------------------------------------------------------------------------- Xref: netcom.com talk.politics.crypto:1835 alt.privacy:10671 alt.tv.mst3k:18867 Path: netcom.com!csus.edu!decwrl!nic.hookup.net!europa.eng.gtefsd.com!uunet!dige x.net!digex.net!not-for-mail From: steve-b(a)access.digex.net (Steve Brinich) Newsgroups: talk.politics.crypto,alt.privacy,alt.tv.mst3k Subject: Re: ancient torture techniques Followup-To: alt.tv.mst3k Date: 31 Dec 1993 12:08:18 -0500 Organization: Express Access Online Communications, Greenbelt, MD USA Lines: 354 Message-ID: <2g1ma2$htr(a)access.digex.net> References: <netnewsCIMtzo.42w(a)netcom.com> <netnewsCIpv3q.CH7(a)netcom.com> <Dec31.090735.79631(a)yuma.acns.colostate.edu> NNTP-Posting-Host: access.digex.net SCENE: Satellite of Love. Tom Servo is polishing a glass globe that looks just like his own head. Crow: Whatya doing? Tom: I'm just.... polishing up a fishbowl. I thought it'd look good here by the hexscreen (he moves over to the hexscreen and places the bowl, opening up, just under the hexscreen). What do you think? Crow: I think that's silly. First of all, there's no place to put a fishbowl there. Besides which, we don't have any fish here to put in a bowl. (Mike enters from stage right) Mike: Are you two arguing again? (Light flashes to indicate an incoming call from the Mads) Mike: Never mind; let's see what they want this time. (taps button) SCENE: Deep 13. Dr. Forrester is holding a cheap-looking mask resembling his own face. Dr. F: Hello, Matt. Mike: That's 'Mike'. Dr. F: Whatever. Anyway, it's time for your Invention Exchange, unless you need more time to set it up and want me to go first-- Mike: Well, actually no-- Dr. F: OK, I'll go first. Of course, a mad scientist in my position has his share of enemies, and some of them are a bit too tough to be beaten off directly. The next best thing is misdirection: getting them to vent their frustrations on something more... what's the word... 'expendable'. (Turns toward stage left) Oh, Frank! (Frank enters from stage left) Dr. F: I need you to model this (hands Frank the mask) (Frank puts on Dr. F mask) Dr. F: As you can see, the perfect decoy to cover my escape if things ever get too hot to handle. And now, your turn. (Mike holds a telephone with several types of bells, horns, and other noisemakers attached to it.) Mike: You're finished, then? Dr. F: That's what I just _said_. Frank: How long do I have to wear this? Dr. F: (To Frank) Until I tell you to stop! (To Mike) Well?? Mike: We all know about Caller ID, but it has one big problem: you don't see the caller's ID until you get close enough to read that little display window. My invention is a Caller ID Ringer that lets you know whether the call is worth picking up without even having to get out of the bathtub. (Cash register bell rings) Mike: See, that tells you it's one of those calls from somebody asking you for money. (Bugle call of 'Reveille' sounds) Mike: That tells you it's an Army recruiter calling. (Foghorn sounds) Mike: That means it's your boss on the line. (Poofter pops out of phone, with sound) Mike: That means a call on the party line. Dr. F: Yes, yes, I'm sure you've got a million of them, but that's all the time we have for the Invention Exchange. Now, for your experiment, I have a special treat. (grins evilly) You remember L. Detweiler, alias R. Boxx, alias about a dozen other names I can't be bothered to keep track of? Crow: I have a bad feeling about this.... Dr. F: Well, we have a rare treat: a post from him under his very own name (as far as we know). Boy, are you in for some deep hurting this time! (Movie alarm goes off) 6....5....4....3....2....1....G >talk.politics.crypto #1834 (1 + 6 more) | |-<1> >Newsgroups: talk.politics.crypto,alt.privacy, | |-<1> >+ comp.org.eff.talk | \-[2]--[2] >From: ld231782(a)keller.lance.colostate.edu (L. |-<1> >+ Detweiler) |-<1> >[2] ancient torture techniques \-<1> >Date: Fri Dec 31 04:07:35 EST 1993 >Organization: Colorado State University, Fort Collins, CO 80523 >X-Newsreader: TIN [version 1.2 021193BETA PL3] >Followup-To: talk.politics.crypto,alt.privacy,comp.org.eff.talk >Lines: 98 > (Mike and Crow enter theater) Mike: Where's Tom Servo? >Geoff Dale (plaz(a)netcom.com) wrote: > >: > Congratulations! If you repeat anything frequently enough, >: > people begin to believe it. Crow: Repeat?? Isn't once bad enough? >: That seems to be your strategy. It doesn't work when you so consistantly >: undermine your credability with rants, tho. >: So stop posting and this little bit of net.history will soon be forgotten. (Tom Servo enters theater) Crow: What took you so long? Tom: I had to finish with the... fishbowl. > Hello world, I am not proud of everything I have posted `out there' lately, Crow: And you have so much to be not proud about! >but I am even less proud of the ugly depths and grotesque deformities Tom: Of my terrible secret past. >I have seen in certain black corners of the Internet lately Crow: Hey! That's "African-American corners of the Internet"! > and the >apalling complacency with which you all view it. The skeletons >have not only fallen out the the closet, Mike: They had a falling out, and outed each other, and are now out of the closet. > they have danced around us and >punched us all in the face. Crow: (Muhammad Ali voice) Dance like a butterfly, sting like a bee. > My own letters on the subject are an attempt to >shock you from your silent complacency and `accessorizing'. Tom: With out lovely line of spring accessories for 1994. > What happens when trust breaks down? Crow: (German accent) It decayz into a migzture of Uranium 235 and Plutonium 238. Very hazzardousz zubsztanzes. > What happens when people respond >to their own posts? Tom: They're schizo? Mike: Maybe they're just absent-minded. > When they misattribute writing? Crow: OK, so they're absent-minded AND schizo. > When they don't care >who is behind email addresses, Tom: Schizo, absent-minded, and now apathetic. Mike: This is getting hard to keep track of. > or deceive others about them? Crow: Schizo, absent-minded, apathetic, and dishonest.... Mike: Is somebody writing this down? Crow: Hey, you're the only one here with fully functional arms! Mike: (takes notepad and pencil from a pocket) > When they >post multiple messages from different addresses? Crow: As we come full circle back to schizo. > Imagine that every one of my posts came from a different address. Tom: Not hard in this guy's case. >What is to prevent me? My honesty? My integrity? All: NAAAAAH! > What if I am a >cyberanarchist? Mike: (jotting something on a notepad) How do you spell that? Tom & Crow: (turn to look at Mike) Mike: (tosses notebook and pencil into the air) > Would I be horrified or delighted at these embezzlements >of trust? Tom: He doesn't know how he'd react to his own actions? Crow: Jeez, enough already with the "schizo"? > By the squirming and writhing of my victims underneath my >crushing onslaught? Mike: Hey! I didn't think the Mads were sending us that kind of movies! * * * > I was reading a book about ancient torture techniques. Tom: Like these posts. > (Actually, it was >about something else, but some paragraphs on the subject crept in from >obvious relevance.) Mike: Obvious to _you_, maybe. > The Roman soldiers had invented some of the most grisly torture and execution >techniques the world has ever seen, perhaps the most humiliating and heinous >punishments known to man. Crow: Throw Sandy Frank to the Romans! Tom: Lippert, too! > One that I was reading about was called >`Circle of Eight'. Crow: (pirate voice) Arrrgh, mateys! I have a sack of doubloons and Circles of Eight. Mike: I think that's PIECES of Eight. Crow: Whatever. > A blindfolded prisoner stands as Roman soldiers >(enthusiastic volunteers?) circle him and take turns punching him in the >face. Mike: I think his verb tenses are about two thousand years off. > They take the blindfold off, and ask him, who hit you? Tom: The guy with the brass knuckles? > And if the >prisoner fails to name the person, the game continues, they dance in their >delight, circling at a faster, more dizzying rate, and pummel harder. Tom: On the other hand, if he _does_ correctly name the person, he wins a new 94 B.C. chariot and a year's supply of Rice-a-Roni. >What is the point of all this? Mike: I was hoping you'd tell _us_! > I don't have a major point, Crow: Imagine my surprise. > except to >suggest that this is one of the most evil abominations of humanity I can >imagine. And that it is shockingly identical to the mentality that a >cyberanarchist has in hammering others with his fake email identity >arsenals. Tom: You can send an arsenal through email? Crow: What will they think of next? >Medusa is delighted to punch the blindfolded victim in the face with >her dizzying circle of tentacles. Tom: Punched with a circle of tentacles?? > Guess who it is! Crow: You already _said_ it was Medusa! The tentacles are a dead giveaway. > Ooops, you're wrong, >sorry. Crow: _I'm_ wrong?? I'm just going by what you just said! > PUNCH. What? No, N.Szabo is a real person. PUNCH. Pseudospoofing >is immoral? nah. PUNCH. N.Szabo is my roommate. PUNCH. Lies are >liberating. PUNCH. cypherpunks have never pseudospoofed. PUNCH. >especially the leaders. PUNCH. and everything in the media is true. >PUNCH. especially what we say. PUNCH. and our leaders are the >greatest of all. PUNCH. Tom: Stop it! The pain! The pain! >See the blood dripping on the ground, see the hideous disfigurement of >the victim's face. Tom: (head explodes) (Mike and Crow exit hastily, Mike carrying Tom) SCENE: Satellite of Love. Mike places Tom on a table and begins looking around frantically. Mike: Crow! Quick! Help me find a spare head for Tom Servo! We don't have much time! Crow: (exits stage left) (A second Tom Servo enters from stage right) Mike: Tom Servo! Quick! Help me find a spare head for Tom Servo! (Mike stops and does a double-take) Mike: What?!? But you're there (points to Tom Servo on table) with your head blown apart from illogic overload or something.... Tom: (chuckles) Oh, that! That's just one of the alter egos I use when I need a break from the Mads' experiments. (Light flashes to indicate an incoming call from the Mads) Tom: Quick! Get that out of here! I don't want them to find out.... (Mike pushes the remains of the other Tom Servo out of sight under the table.) SCENE: Deep 13. Frank is still wearing the Dr. Forrester mask. Dr. F is wearing an equally cheesy-looking Frank mask. Frank: Well? Mike: Frank? Are you still wearing that silly mask? (Dr. F rips off his own mask, then Frank's. Frank clutches his nose, which was pinched by Dr. F's grab). Dr. F: Oh, stop whining and push the button! (Frank keeps both hands on his nose and fumbles for the button with his elbows, hitting it after several tries). \ | / Mystery Sceince Theater 3000 and associated characters \ | / are the property of Best Brains, Inc. and used here for \|/ satirical purposes only. ----O---- /|\ This post is not meant as a personal attack upon / | \ the original author (but rather as an impersonal / | \ attack upon his ideas and level of logical argument). --------------------------------------------------------------------------- --End Forwarded Post-- _______________________________________________________________________ Geoff Dale -- Cypherpunk/Extropian -- Plastic Beethoven AnarchyPPL - Anarch (Adjudicator) ExI-Freegate Virtual Branch Head plaz(a)netcom.com 66 Pyramid Plaza plaz(a)io.com Freegate, Metaverse(a)io.com 7777 "Subvert the domination paradigm!"

1 0

Re: Anonymous Video on Demand
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Mike Ingle writes: >Are you thinking of physical videotape or electronic distribution? Electronic distribution. "Anonymous video on demand" is a bit misleading, because I'm not so much interested in preventing the video provider from knowing my identity, just from correlating my identity with my video selections. >For electronic distribution, suppose you have a fiber-optic cable with >n channels, where n is a large number. My feeling is that this architecture is too inflexible. Here's the sort of thing I have in mind: Customer browses the video supplier's catalog and notes the catalog number of the video it wants Customer randomly chooses 99 other catalog numbers to generate a pool of 100 catalog numbers. The Customer and the Video Provider engage in a protocol so that the Customer ends up receiving 100 compressed and encrypted videos, only one of which the Customer can successfully decrypt (and uncompress). The Video Provider never learns which of the 100 videos the Customer successfully decrypts, but is sure that the Customer can decrypt only one of them. I don't know what the protocol would be, but it sounds like an ANDOS-like protocol. By the way, I think that if the "rental" fee is low enough, the Video Provider wont have to worry about cheaters. If it costs you more money (or time) to cheat the Video Provider than it does to simply pay the fee, then most people will pay the fee. I'm thinking the fee would be as small as 25 cents/video, for example. Jim_Miller(a)suite.com

2 1

Hypnosis and a pass-phrase...
by Jim choate 17 Dec '03

17 Dec '03

Hey everyone, Hope you are all having a great holidays...:) On the suggestion of a post-hypnotic suggestion it is great but it won't work. Psychologist and Psychiatrist are both very familiar with the signs of such 'tampering' and know how to get around it. Besides this won't support a defence since it shows pre-meditation to refuse and would only fauster the states case to use unlimited incarceration as pursuasive motivation. If they can prove you commited some action(s) prior to a crime which directly relate to that crime you are providing the state w/ probably cause, opportunity, motive, and a goodly amount of circumstantial evidence. I fail to see how shooting oneself in the foot is helpful...;) Probably the safest thing would be to make agreements among your friends to generate pass phrases for each other. One could then exchange public - private key pairs in some kind of anonymouse way. Then you could say in all honesty that you did not know it. On the stego front, I assume since nobody responded about my request for HSV information that we had nobody involved w/ it. Archie couldn't find any either....:( I was looking over some material done by Huffman years after his coding work relating to describing graphics w/ a meta-language. His motivation was looking at Escher prints and trying to determine a methodology to determine if a 2D representation was a honest representation of a 3D subject. He apparently succeded and I suspect that using such techniques you could find images which contained information imbedded in them. I am trying to find the material localy and will let you know what comes of it (if anything). Anybody else take a look at this work? I suspect that some of Penrose's tiling work might also be applicable but know nothing about except some SA articles here and there. Finaly, This morning I got e-mail claiming some guy found a shift and add technique for cracking RSA algorithms. Did anyon else get this? Anyone know anything about its authenticity or reference locations? Off to Archie... Everybody have a great party tooooonite!

1 0

Re: Anonymous Video on Demand
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

could As I think about it more, the "anonymous video on demand" problem can be solved with an oblivious transfer protocol. Here's how I see it working: (The following is adapted from the oblivious transfer protocol described in "Applied Cryptography" on page 98.) Say Alice is the Video Vendor and Bob is the customer... Alice generates a public/private key pair for each movie in her video database and publishes the public keys in an electronic catalog. Each public key would be paired with a movie description and a catalog index number. Bob downloads Alice's catalog and browses through it offline. Bob makes a selection, and also randomly picks 99 (or any large number) other catalog numbers Bob generates a random DES key and encrypts this key with the public key associated with his selection. Bob sends the encrypted DES key and the list of 100 catalog numbers to Alice. Alice decrypts the DES key with the private key associated each catalog number received from Bob. In only one case will Alice successfully recover Bob's DES key, only she doesn't know which case. Alice encrypts each movie selection with the resulting DES keys from the previous step and sends all 100 encrypted movies to Bob. Bob will only be able to decrypt and view the movie he selected and Alice wont know which of the 100 movies Bob selected. Ta Da! The nice thing about this protocol is that it doesn't really have anything to do with videos. It could be used for an electronic library, or any warehouse of digital information where the Vendor wishes to charge for a download, yet the Customer doesn't want the Vendor to know which item is selected. Also, the Vendor still can use statistical analysis to determine which items are more popular and which items are less popular. The Vendor could keep track of how many times an item was mentioned in a Customer selection list. The more popular items would appear in more lists. Unpopular items would have different statistics. This analysis breaks down if all items are equally popular, or Customers don't chose the other 99 items randomly. Jim_Miller(a)suite.com

3 2

Re: Anonymous Video on Demand
by Hal 17 Dec '03

17 Dec '03

Jim - That is a nice protocol. Seems to work OK. I had thought of a variant: Vendor creates a set of pairs of numbers and random DES keys: (1,KEY1), (2,KEY2), (3,KEY3),... These are sent via oblivious transfer to buyer such that he only gets one but the vendor doesn't know which. Suppose buyer gets (10,KEY10). Buyer sends back a mapping of the numbers 1-N and a set of N movies. He maps the number he got in step 1 (10 in my example) with the movie he wants. Vendor encrypts these movies with the corresponding numbered DES keys, and sends them to buyer. He will only be able to decrypt one of them. These protocols have the obvious disadvantage of increasing the needed bandwidth by a factor of N. I guess we assume bandwidth is cheap. Once I get the movie, what stops me from recording it and giving copies to all my friends for free? Nothing, as far as I can see. Therefore, it would be good to think of a system where N movies are broadcast all the time (on N channels), all N encrypted, but with each person who has paid only able to decrypt one of them. You argued that people would just share keys, but I don't think that is an issue since they might as well just share movies. This system is much more acceptable in terms of bandwidth. It would be interesting to think of a solution which worked with this situation, where the encrypting keys are fixed. The requirement is, given a set of keys, 1-N, which A knows, B ends up knowing only key I, where I is chosen by B ahead of time, but A doesn't know which key B got. Off hand I don't see how to do this. Hal Finney P.S. with a little thought, a variant on my protocol can solve this, and perhaps your protocol works too. In step 1, A sends random keys to B via oblivious transfer; in step 2, B sends a mapping of key numbers and movies, pairing up the key he got and the movie he wants; in step 3, which is different, A sends not the movies, but the movie keys which will be used during the broadcast phase, encrypted with the random keys chosen in step 1. B is left with one key which will decrypt just the movie he wants during the broadcast. Maybe if this were done in tamper-proof chips like the encryption chips used in current cable boxes it would be secure enough for most purposes, at least as secure as current pay cable.

1 0

The Best Death Threat Yet
by L. Detweiler 17 Dec '03

17 Dec '03

This person claims I have `threatened' Nate Sammons, Colorado Cypherpunks Founder and Leader. I have done no such thing. Please do not send me this vomit. `Mine enemies without reason outnumber the hairs on my head.' I am only posting this in case the person is serious, whoever starts an investigation has something to go on. Death threats are illegal in the U.S.Mail, and there is probably a pretty good case to be made they are illegal in email as well. I'm not aware of any legal precedents. Maybe someone could post on the subject. ===cut=here===

1 0

Privacy vs. Pseudospoofing
by L. Detweiler 17 Dec '03

17 Dec '03

Hello everyone. I am a bit unclear as to what cypherpunks are really promoting as far as privacy vs. pseudospoofing. The lack of official comments by head cypherpunks make this difficult to sort out. Clearly, you are in favor of some forms of pseudospoofing. Here is a list of all the various forms I can think of. Please indicate which ones you are in favor of. These are just some tentative names I'm coming up off the top of my head for terminology. pseudonymity: a name that is not traceable to a particular human being. 1) straight pseudonymity: the audience is aware of the fact that the name is not traceable. (e.g. anon.penet.fi aliases, some book pseudonyms.) 2) semipseudonymity: the audience is not aware of whether or not the name can be traced, and makes no assumption. 3) quasipseudonymity: the audience tends to assume from context that the name is traceable, but it is not. I think email addresses fall in this category, but (unfortunately IMHO) that is increasingly becoming the exception. 4) pseudoanonymity: the audience is deliberately deceived into thinking the name is traceable when it is not. (e.g. a tentacle saying `I am a real person.' or someone else vouching for them.) Now, I have no objections to 1-2. And one can indeed have privacy with them. But it seems to me that all the cypherpunks are promoting 3-4 in the name of `privacy'. But it seems to me that (3) is misleading, and (4) means active lies. These are not privacy. These are the tools that criminals use to evade punishment for their crimes. Also, one *must* make the distinction between *active* and *passive* pseudonymity. If I read a book, I am not conversing with the author. I am not asking him any questions about his identity. This strikes me as harmless in most cases even if the reader is tricked into thinking the name is `traceable'. But the interactive pseudonyms, those possible with the internet, are extremely dangerous, because someone can actively lie to me when I ask `who are you?'. And it really discourages me that all you cypherpunks (e.g. J. Gilmore) think it is all the same thing, Privacy. So, which do you favor? (Please do not continue to obfuscate the issue by pretending that they are all identical.) Cypherpunks, I don't think you all understand the whole purpose of names in the first place. They were invented so that we could function as a society. The ability to `trace' a name to a human being is a very basic aspect of social interaction and ettiquete. Every day that you corrupt that trust you are not only breaking down governments, but honest interactions. I am beginning to think that not only do the leaders have secrets from the followers, they have secrets from each other. Imagine one leader asking the other through a tentacle, `what do you think of so-and-so'? yee, gad. Where is your trust, cypherpunks? Why are you so paranoid? In my experience, the people I have met that are the least trusting of others are also the most paranoid. But they are also the most secretive themselves. When you keep secrets from other people, you begin to think the whole world is keeping secrets from you. Is all of history a big lie to massage the egos of some people? The Bible is probably entirely fictional too, right? Don't you people know you are playing with fire? Active pseudoanonymity is used to start riots and wars. I plant people around the mob or in a country who agitate for the destruction of everyone. And real people get caught up in the passions. Perhaps you think you can control this. You are mistaken. He who lives by a mob, dies by a mob. What is the consensus on that delightful little Nazi story about pseudospoofing for espionage purposes? A glorious example of the delights of pseudoanonymity? Something to strive for? This is the story that I was going to send you all when your leaders told me what they knew about pseudospoofing, that I was talking about for a long time. But S.Boxx sent it before I had the chance. BTW I have misplaced the comments from the leaders that said they didn't pseudospoof, could someone email them to me?

1 0

All of this Death Threat Shit.
by cornpop＠glia.biostr.washington.edu 17 Dec '03

17 Dec '03

Hello Fellow CypherPunks.... I've never posted to this list before, but I've been reading for quite some time. My name is Dan ieberman, and I am a high-school student in the Seattle area. I got interested in Cryptography, after my sister enrolled in a cryptography seminar at the local University. I have been published in Internet World Magazine, and that is my only professional citation. I don't think my little message will hold much water, but I was under the impression, when I joined this list, that the Cypherpunks list was a place for casual conversation about a common hobby, and maybe a place to make alliances and advancements in the cryptography field. For me, it was a place to learn about cryptology. But when it came to this 'Tentacles' and 'Medusa' stuff, I thought that it was getting a little close to the edge, but not too far. Not death threats? Come on guys! I'm 15 years old, and even I'm beyond death threats about senseless matters. I don't think that any of this should have gotten this far. I think people took Mr. L. Detweiler's posts as anything to be serious about. I dismissed them when I saw them, yet some people took them personally. I think L. Detweiler made that clear in some of his last postings. Something to the effect of: If you would have ignored me, I would have gone away. That's how it should have gone. All that's left now is to forgive and forget. ------------------------------------------------------------------------------- >From the Virtual Desktop of: -_____ _-_- ,, ' | -, _ /, ' || _ /| | |` < \, \\/\\ || \\ _-_ ||/|, _-_ ,._-_ \\/\\/\\ < \, \\/\\ || |==|| /-|| || || ~|| || || \\ || || || \\ || || || || /-|| || || ~|| | |, (( || || || || || ||/ || |' ||/ || || || || (( || || || ~-____, \/\\ \\ \\ ( -__, \\ \\,/ \\/ \\,/ \\, \\ \\ \\ \/\\ \\ \\ ( ------------------------------------------------------------------------------- Dan Lieberman Internet: cornpop(a)glia.biostr.washington.edu DBL Technology Services 17031 37th AVE NE Seattle, WA 98155-5426 (206)364-9088 -------------------------------------------------------------------------------

3 2

_The Hacker Crackdown_ on-line
by Anonymous 17 Dec '03

17 Dec '03

Excuse the repost, but this is interesting stuff. From: kadie(a)cs.uiuc.edu (Carl M Kadie) Subject: _The Hacker Crackdown_ on-line Organization: University of Illinois, Dept. of Comp. Sci., Urbana, IL Date: Sat, 1 Jan 1994 20:40:43 GMT The short of it: To access Bruce Sterling's _The hacker crackdown: law and disorder on the electronic frontier_, try gopher -p1/Publications/authors/Sterling/hc gopher.well.sf.ca.us 70 The long of it: I've directed followup to this article to comp.org.eff.talk. I found _The Hacker Crackdown_ with the CAF/WELL whatsnew server (gopher gopher.eff.org 5070). You can access the book via email. For details, send email to archive-server(a)eff.org. Include the line: send acad-freedom/admin access The electronic version of the book is being released as "literary freeware". Here is the library entry for the paper version of the book. Sterling, Bruce. The hacker crackdown : law and disorder on the electronic frontier / Bruce Sterling. New York : Bantam Books, c1992. xiv, 328 p. ; 24 cm. Includes index. Published simultaneously in the United States and Canada. ISBN 055308058X : $$23.00 ($$28.00 Can.) 1. Computer crimes--United States. 2. Programming (Electronic computers)--Corrupt practices. 3. Telephone--United States--Corrupt practices. I. Title. ocm25-914955 - Carl -- Carl Kadie -- I do not represent any organization; this is just me. = kadie(a)cs.uiuc.edu =

1 0

Re: _The Hacker Crackdown_ on-line
by smb＠research.att.com 17 Dec '03

17 Dec '03

It's also out in paperback now -- I picked up a copy yesterday.

1 0

radiation experiments and trusting the government
by Perry E. Metzger 17 Dec '03

17 Dec '03

I find the recent disclosures concerning U.S. Government testing of the effects of radiation on unknowing human subjects to be yet more evidence that you simply cannot trust the government with your own personal safety. Some people, given positions of power, will naturally abuse those positions, often even if such abuse could cause severe injury or death. I see little reason, therefore, to simply "trust" the U.S. government -- and given that the U.S. government is about as good as they get, its obvious that NO government deserves the blind trust of its citizens. "Trust us, we will protect you" rings quite hollow in the face of historical evidence. Citizens must protect and preserve their own privacy -- the government and its centralized cryptographic schemes emphatically cannot be trusted. Perry

1 0

anonymous mail
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Testing. 1/1/94

1 0

Re: Program to circumvent the Sep 1 Legal Kludge part 1/5
by Tom Jennings 17 Dec '03

17 Dec '03

On Tue, 23 Aug 1994 0x7CF5048D@nowhere wrote: > This is a 5 part binary=noklg.zip > Please make publicly available. put on BBS's, public ftp sites. > part 1/5. Can you please stop mailing me these unidentifyable, undecodable files from a person I cannot identify, nor detect the reason for the anonymity? Maybe if there was an explanation as to why I should bother to play with all this, I would understand. As my telepathy seems to not be working right now, you'll have to write it in plain english (lame monolanguage american). Thanks. PS: You misspelled 'cypherpunks' in the Reply-to field, which is where this seems to be going, and I'm sure my reply to the list will annoy everyone. Take it out on the anonymous bulk-mailer person. Tom Jennings -- tomj(a)wps.com -- World Power Systems -- San Francisco, Calif.

3 2

Radiation experiments & not trusting gov
by Mike Ingle 17 Dec '03

17 Dec '03

>I find the recent disclosures concerning U.S. Government testing of >the effects of radiation on unknowing human subjects to be yet more >evidence that you simply cannot trust the government with your own >personal safety. I was disgusted but not particularly surprised to read about these experiments. It's been known for many years that they deliberately exposed troops to atomic fallout and chemical weapons to determine their effects. They also tested LSD, mind control, and truth drugs on unsuspecting human lab rats. >Some people, given positions of power, will naturally >abuse those positions, often even if such abuse could cause severe >injury or death. Unfortunately, these people are exactly the type who seek power, and the culture of militarism and secrecy helps them to ignore any small amount of humanity they might otherwise have. >I see little reason, therefore, to simply "trust" the >U.S. government -- and given that the U.S. government is about as good >as they get, its obvious that NO government deserves the blind trust >of its citizens. What country has ever fallen because of too little oppression, too few prisoners, too little espionage on the people, or too much freedom? >"Trust us, we will protect you" rings quite hollow in >the face of historical evidence. Citizens must protect and preserve >their own privacy -- the government and its centralized cryptographic >schemes emphatically cannot be trusted. Most people know that; they just don't know what to do about it. I have the Time magazine from 1985 announcing Gorbachev's rise to power in the Soviet Union. They interviewed several Russians. Their attitudes were very much like Americans' today: yes, we know it is screwed up, but what can anyone do about it? Public anger grows quietly and explodes suddenly. T.C. May's "phase change" may be closer than we think. Nobody in Russia in 1985 really thought the country would fall apart in 6 years. Politics has never given anyone lasting freedom, and it never will. Anything gained through politics will be lost again as soon as the society feels threatened. If most Americans have never been oppressed by the government (aside from an annual mugging) it is because most of them have never done anything to threaten the government's interests. For example, much of the progress that's been made against media censorship is in danger of being lost in the hysteria over violence. But could the government ban a book today? Of course not, at least not after one person typed it or scanned it into a computer. Technological gains are permanent. The political approach is only useful as a tactical weapon, to hold them off until technological solutions are in place. If you want to change the world, don't protest. Write code! --- Mike

1 0

Re: Radiation experiments & not trusting gov
by doug＠netcom.com 17 Dec '03

17 Dec '03

Mike Ingle <MIKEINGLE(a)delphi.com> said: >I was disgusted but not particularly surprised to read about these >experiments. It's been known for many years that they deliberately >exposed troops to atomic fallout and chemical weapons to determine >their effects. They also tested LSD, mind control, and truth drugs >on unsuspecting human lab rats. I agree with Perry, and even more with what Mike there. Considering that such *has* been well known for so many years, I was a little bit startled at the current media reaction to the radiation experiments. Did they only just wake up or something? Or more likely, it's just been a few years since the media has had the opportunity to make a fuss over such things, so now it's "fresh news" again, as if that category of things had never happened before. BTW on the subject of how much was known about the long term effects of low level radiation exposure 4 or 5 decades ago: *LOTS*! Let us not forget that the nuclear age was not ushered in during WWII; decades prior to that it was well known that prolonged exposure to low level radiation could cause hideous cases of cancer. Remember the radium elixer cases? The luminous watchdial painters? (I think the latter came up twice; once early on with radium-based pigments, and again later with tritium.) What did Madame Curie die of? Even Roentgen got cancer from x-raying his hand so much. That's a bit of a digression, but people seem to forget, so there it is for the record. >Unfortunately, these people are exactly the type who seek power, and >the culture of militarism and secrecy helps them to ignore any small >amount of humanity they might otherwise have. True enough, but that doesn't really explain why the participating *physicians* did it. Probably 50% callousness and 50% willful ignorance, I would guess. >If you want to change the world, don't protest. Write code! I've been quiet here the last few months because that's what I mainly do. :-) Doug Merritt

1 0

CFS source code available January 12
by Matt Blaze 17 Dec '03

17 Dec '03

Source code for version 1.0 of CFS, the Cryptographic File System, will be distributed upon request in the United States starting on January 12, 1994. CFS pushes encryption services into the Unix(tm) file system. CFS supports secure storage at the system level through a standard Unix file system interface to encrypted files. Users associate a cryptographic key with the directories they wish to protect. Files in these directories (as well as their pathname components) are transparently encrypted and decrypted with the specified key without further user intervention; cleartext is never stored on a disk or sent to a remote file server. CFS employs a novel combination of DES stream and codebook cipher modes to provide high security with good performance on a modern workstation. CFS can use any available file system for its underlying storage without modification, including remote file servers such as NFS. System management functions, such as file backup, work in a normal manner and without knowledge of the key. CFS runs under SunOS and several other BSD-derived systems with NFS. It is implemented entirely at user level, as a local NFS server running on the client machine's "loopback" interface. It consists of about 5000 lines of code and supporting documentation. CFS was first mentioned at the work-in-progress session at the Winter '93 USENIX Conference and was more fully detailed in: Matt Blaze, "A Cryptographic File System for Unix", Proc. 1st ACM Conference on Computer and Communications Security, Fairfax, VA, November 1993. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfs.ps. The version being released differs from the version described in the paper in a few ways: * The encryption scheme has been strengthened, and now provides approximately the security of 3-DES with the online latency of only single-DES. * Support for the smartcard-based key management system is not included. * A few of the tools are not included (in particular, cname and ccat). * The performance has been improved. * The security of the system against certain non-cryptanalytic attacks has been improved somewhat. CFS is being distributed as COMPLETELY UNSUPPORTED software. No warranty of any kind is provided. We will not be responsible if it deletes all your files and emails the cleartext directly to the NSA or your mother. Also, we do not have the resources to port the software to other platforms, although you are welcome to do this yourself. (Note in particular that CFS has not been tested on either Solaris or Linux, and we have no plans ourselves to support either of these systems.) We really can't promise to provide any technical support at all, beyond the source code itself. Because of export restrictions on cryptographic software, we are only able to make the software available within the US to US citizens and permanent residents. Unfortunately, we cannot make it available for general anonymous ftp or other uncontrolled access, nor can we allow others to do so. Sorry. Legal stuff from the README file: * Copyright (c) 1992, 1993, 1994 by AT&T. * Permission to use, copy, and modify this software without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software and in all copies of the supporting * documentation for such software. * * This software is subject to United States export controls. You may * not export it, in whole or in part, or cause or allow such export, * through act or omission, without prior authorization from the United * States government and written permission from AT&T. In particular, * you may not make any part of this software available for general or * unrestricted distribution to others, nor may you disclose this software * to persons other than citizens and permanent residents of the United * States. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. If you would like a copy of the CFS source code, please send email to: cfs(a)research.att.com DO NOT REPLY TO DIRECTLY TO THIS MESSAGE. Be sure to include a statement that you are in the United States, are a citizen or permanent resident of the US, and have read and understand the license conditions stated above. Also include an email address in a US-registered domain, and say whether you'd also like to be included on a developer/user mailing list that is being set up. For a number of reasons, I am unable actually send out code until January 12, 1994. Unless you specify some other format, you'll get a uuencoded compressed tarfile. I'll be at the January USENIX conference in San Francisco, and will announce CFS at the WIP session there. -matt

1 0

trust your government
by Brad Dolan 17 Dec '03

17 Dec '03

Re. government radiation experiments, radium dial painters, & Marie Curie. Many of the radium dial painters received _stupendous_ doses. So, I surmise, did Marie Curie. Marie Curie, unlike many of the dial painters, lived to a relatively ripe old age. She might done better if she hadn't added the dose of a zillion X-rays to the dose from her internal radium burden. Interestingly, her husband was killed when he was run over by a horse-drawn cart. Anyway, the recent revelations should remind anyone who needs it how much trust should be accorded government. I'll stop preaching to the converted. Regards, bdolan(a)well.sf.ca.us

1 0

_The_Hacker_Crackdown_, _Three_Years_Later_
by ferguson＠icm1.icp.net 17 Dec '03

17 Dec '03

I bought Bruce Sterling's book, _The_Hacker_Crackdown_ when it was first published in November 1992. A lot of us followed along with the events outlined in the book in real time, so it was genuinely refreshing to see Bruce author an afterward, "...Three Years Later", in the electronic freeware release, which made its debut on The Well's gopher yesterday. The remainder of the book is available via gopher: gopher.well.sf.ca.us 70 follow the menu options to: /Publications/authors/Sterling/hc Cheers. 8<--------------------- cut here -------------------------- Bruce Sterling bruces(a)well.sf.ca.us Literary Freeware: Not for Commercial Use THE HACKER CRACKDOWN Law and Disorder on the Electronic Frontier Afterword: The Hacker Crackdown Three Years Later Three years in cyberspace is like thirty years anyplace real. It feels as if a generation has passed since I wrote this book. In terms of the generations of computing machinery involved, that's pretty much the case. The basic shape of cyberspace has changed drastically since 1990. A new U.S. Administration is in power whose personnel are, if anything, only too aware of the nature and potential of electronic networks. It's now clear to all players concerned that the status quo is dead-and-gone in American media and telecommunications, and almost any territory on the electronic frontier is up for grabs. Interactive multimedia, cable-phone alliances, the Information Superhighway, fiber- to-the-curb, laptops and palmtops, the explosive growth of cellular and the Internet -- the earth trembles visibly. The year 1990 was not a pleasant one for AT&T. By 1993, however, AT&T had successfully devoured the computer company NCR in an unfriendly takeover, finally giving the pole-climbers a major piece of the digital action. AT&T managed to rid itself of ownership of the troublesome UNIX operating system, selling it to Novell, a netware company, which was itself preparing for a savage market dust-up with operating-system titan Microsoft. Furthermore, AT&T acquired McCaw Cellular in a gigantic merger, giving AT&T a potential wireless whip-hand over its former progeny, the RBOCs. The RBOCs themselves were now AT&T's clearest potential rivals, as the Chinese firewalls between regulated monopoly and frenzied digital entrepreneurism began to melt and collapse headlong. AT&T, mocked by industry analysts in 1990, was reaping awestruck praise by commentators in 1993. AT&T had managed to avoid any more major software crashes in its switching stations. AT&T's newfound reputation as "the nimble giant" was all the sweeter, since AT&T's traditional rival giant in the world of multinational computing, IBM, was almost prostrate by 1993. IBM's vision of the commercial computer-network of the future, "Prodigy," had managed to spend $900 million without a whole heck of a lot to show for it, while AT&T, by contrast, was boldly speculating on the possibilities of personal communicators and hedging its bets with investments in handwritten interfaces. In 1990 AT&T had looked bad; but in 1993 AT&T looked like the future. At least, AT&T's *advertising* looked like the future. Similar public attention was riveted on the massive $22 billion megamerger between RBOC Bell Atlantic and cable-TV giant Tele-Communications Inc. Nynex was buying into cable company Viacom International. BellSouth was buying stock in Prime Management, Southwestern Bell acquiring a cable company in Washington DC, and so forth. By stark contrast, the Internet, a noncommercial entity which officially did not even exist, had no advertising budget at all. And yet, almost below the level of governmental and corporate awareness, the Internet was stealthily devouring everything in its path, growing at a rate that defied comprehension. Kids who might have been eager computer-intruders a mere five years earlier were now surfing the Internet, where their natural urge to explore led them into cyberspace landscapes of such mindboggling vastness that the very idea of hacking passwords seemed rather a waste of time. By 1993, there had not been a solid, knock 'em down, panic-striking, teenage-hacker computer-intrusion scandal in many long months. There had, of course, been some striking and well-publicized acts of illicit computer access, but they had been committed by adult white-collar industry insiders in clear pursuit of personal or commercial advantage. The kids, by contrast, all seemed to be on IRC, Internet Relay Chat. Or, perhaps, frolicking out in the endless glass-roots network of personal bulletin board systems. In 1993, there were an estimated 60,000 boards in America; the population of boards had fully doubled since Operation Sundevil in 1990. The hobby was transmuting fitfully into a genuine industry. The board community were no longer obscure hobbyists; many were still hobbyists and proud of it, but board sysops and advanced board users had become a far more cohesive and politically aware community, no longer allowing themselves to be obscure. The specter of cyberspace in the late 1980s, of outwitted authorities trembling in fear before teenage hacker whiz- kids, seemed downright antiquated by 1993. Law enforcement emphasis had changed, and the favorite electronic villain of 1993 was not the vandal child, but the victimizer of children, the digital child pornographer. "Operation Longarm," a child-pornography computer raid carried out by the previously little-known cyberspace rangers of the U.S. Customs Service, was almost the size of Operation Sundevil, but received very little notice by comparison. The huge and well-organized "Operation Disconnect," an FBI strike against telephone rip-off con-artists, was actually larger than Sundevil. "Operation Disconnect" had its brief moment in the sun of publicity, and then vanished utterly. It was unfortunate that a law-enforcement affair as apparently well-conducted as Operation Disconnect, which pursued telecom adult career criminals a hundred times more morally repugnant than teenage hackers, should have received so little attention and fanfare, especially compared to the abortive Sundevil and the basically disastrous efforts of the Chicago Computer Fraud and Abuse Task Force. But the life of an electronic policeman is seldom easy. If any law enforcement event truly deserved full-scale press coverage (while somehow managing to escape it), it was the amazing saga of New York State Police Senior Investigator Don Delaney Versus the Orchard Street Finger- Hackers. This story probably represents the real future of professional telecommunications crime in America. The finger-hackers sold, and still sell, stolen long-distance phone service to a captive clientele of illegal aliens in New York City. This clientele is desperate to call home, yet as a group, illegal aliens have few legal means of obtaining standard phone service, since their very presence in the United States is against the law. The finger-hackers of Orchard Street were very unusual "hackers," with an astonishing lack of any kind of genuine technological knowledge. And yet these New York call-sell thieves showed a street-level ingenuity appalling in its single-minded sense of larceny. There was no dissident-hacker rhetoric about freedom- of-information among the finger-hackers. Most of them came out of the cocaine-dealing fraternity, and they retailed stolen calls with the same street-crime techniques of lookouts and bagholders that a crack gang would employ. This was down- and-dirty, urban, ethnic, organized crime, carried out by crime families every day, for cash on the barrelhead, in the harsh world of the streets. The finger-hackers dominated certain payphones in certain strikingly unsavory neighborhoods. They provided a service no one else would give to a clientele with little to lose. With such a vast supply of electronic crime at hand, Don Delaney rocketed from a background in homicide to teaching telecom crime at FLETC in less than three years. Few can rival Delaney's hands-on, street-level experience in phone fraud. Anyone in 1993 who still believes telecommunications crime to be something rare and arcane should have a few words with Mr Delaney. Don Delaney has also written two fine essays, on telecom fraud and computer crime, in Joseph Grau's *Criminal and Civil Investigations Handbook* (McGraw Hill 1993). *Phrack* was still publishing in 1993, now under the able editorship of Erik Bloodaxe. Bloodaxe made a determined attempt to get law enforcement and corporate security to pay real money for their electronic copies of *Phrack,* but, as usual, these stalwart defenders of intellectual property preferred to pirate the magazine. Bloodaxe has still not gotten back any of his property from the seizure raids of March 1, 1990. Neither has the Mentor, who is still the managing editor of Steve Jackson Games. Nor has Robert Izenberg, who has suspended his court struggle to get his machinery back. Mr Izenberg has calculated that his $20,000 of equipment seized in 1990 is, in 1993, worth $4,000 at most. The missing software, also gone out his door, was long ago replaced. He might, he says, sue for the sake of principle, but he feels that the people who seized his machinery have already been discredited, and won't be doing any more seizures. And even if his machinery were returned -- and in good repair, which is doubtful -- it will be essentially worthless by 1995. Robert Izenberg no longer works for IBM, but has a job programming for a major telecommunications company in Austin. Steve Jackson won his case against the Secret Service on March 12, 1993, just over three years after the federal raid on his enterprise. Thanks to the delaying tactics available through the legal doctrine of "qualified immunity," Jackson was tactically forced to drop his suit against the individuals William Cook, Tim Foley, Barbara Golden and Henry Kluepfel. (Cook, Foley, Golden and Kluepfel did, however, testify during the trial.) The Secret Service fought vigorously in the case, battling Jackson's lawyers right down the line, on the (mostly previously untried) legal turf of the Electronic Communications Privacy Act and the Privacy Protection Act of 1980. The Secret Service denied they were legally or morally responsible for seizing the work of a publisher. They claimed that (1) Jackson's gaming "books" weren't real books anyhow, and (2) the Secret Service didn't realize SJG Inc was a "publisher" when they raided his offices, and (3) the books only vanished by accident because they merely happened to be inside the computers the agents were appropriating. The Secret Service also denied any wrongdoing in reading and erasing all the supposedly "private" e-mail inside Jackson's seized board, Illuminati. The USSS attorneys claimed the seizure did not violate the Electronic Communications Privacy Act, because they weren't actually "intercepting" electronic mail that was moving on a wire, but only electronic mail that was quietly sitting on a disk inside Jackson's computer. They also claimed that USSS agents hadn't read any of the private mail on Illuminati; and anyway, even supposing that they had, they were allowed to do that by the subpoena. The Jackson case became even more peculiar when the Secret Service attorneys went so far as to allege that the federal raid against the gaming company had actually *improved Jackson's business* thanks to the ensuing nationwide publicity. It was a long and rather involved trial. The judge seemed most perturbed, not by the arcane matters of electronic law, but by the fact that the Secret Service could have avoided almost all the consequent trouble simply by giving Jackson his computers back in short order. The Secret Service easily could have looked at everything in Jackson's computers, recorded everything, and given the machinery back, and there would have been no major scandal or federal court suit. On the contrary, everybody simply would have had a good laugh. Unfortunately, it appeared that this idea had never entered the heads of the Chicago-based investigators. They seemed to have concluded unilaterally, and without due course of law, that the world would be better off if Steve Jackson didn't have computers. Golden and Foley claimed that they had both never even heard of the Privacy Protection Act. Cook had heard of the Act, but he'd decided on his own that the Privacy Protection Act had nothing to do with Steve Jackson. The Jackson case was also a very politicized trial, both sides deliberately angling for a long-term legal precedent that would stake-out big claims for their interests in cyberspace. Jackson and his EFF advisors tried hard to establish that the least e-mail remark of the lonely electronic pamphleteer deserves the same somber civil-rights protection as that afforded *The New York Times.* By stark contrast, the Secret Service's attorneys argued boldly that the contents of an electronic bulletin board have no more expectation of privacy than a heap of postcards. In the final analysis, very little was firmly nailed down. Formally, the legal rulings in the Jackson case apply only in the federal Western District of Texas. It was, however, established that these were real civil- liberties issues that powerful people were prepared to go to the courthouse over; the seizure of bulletin board systems, though it still goes on, can be a perilous act for the seizer. The Secret Service owes Steve Jackson $50,000 in damages, and a thousand dollars each to three of Jackson's angry and offended board users. And Steve Jackson, rather than owning the single-line bulletin board system "Illuminati" seized in 1990, now rejoices in possession of a huge privately-owned Internet node, "io.com," with dozens of phone-lines on its own T-1 trunk. Jackson has made the entire blow-by-blow narrative of his case available electronically, for interested parties. And yet, the Jackson case may still not be over; a Secret Service appeal seems likely and the EFF is also gravely dissatisfied with the ruling on electronic interception. The WELL, home of the American electronic civil libertarian movement, added two thousand more users and dropped its aging Sequent computer in favor of a snappy new Sun Sparcstation. Search-and-seizure dicussions on the WELL are now taking a decided back-seat to the current hot topic in digital civil liberties, unbreakable public-key encryption for private citizens. The Electronic Frontier Foundation left its modest home in Boston to move inside the Washington Beltway of the Clinton Administration. Its new executive director, ECPA pioneer and longtime ACLU activist Jerry Berman, gained a reputation of a man adept as dining with tigers, as the EFF devoted its attention to networking at the highest levels of the computer and telecommunications industry. EFF's pro- encryption lobby and anti-wiretapping initiative were especially impressive, successfully assembling a herd of highly variegated industry camels under the same EFF tent, in open and powerful opposition to the electronic ambitions of the FBI and the NSA. EFF had transmuted at light-speed from an insurrection to an institution. EFF Co-Founder Mitch Kapor once again sidestepped the bureaucratic consequences of his own success, by remaining in Boston and adapting the role of EFF guru and gray eminence. John Perry Barlow, for his part, left Wyoming, quit the Republican Party, and moved to New York City, accompanied by his swarm of cellular phones. Mike Godwin left Boston for Washington as EFF's official legal adviser to the electronically afflicted. After the Neidorf trial, Dorothy Denning further proved her firm scholastic independence-of-mind by speaking up boldly on the usefulness and social value of federal wiretapping. Many civil libertarians, who regarded the practice of wiretapping with deep occult horror, were crestfallen to the point of comedy when nationally known "hacker sympathizer" Dorothy Denning sternly defended police and public interests in official eavesdropping. However, no amount of public uproar seemed to swerve the "quaint" Dr. Denning in the slightest. She not only made up her own mind, she made it up in public and then stuck to her guns. In 1993, the stalwarts of the Masters of Deception, Phiber Optik, Acid Phreak and Scorpion, finally fell afoul of the machineries of legal prosecution. Acid Phreak and Scorpion were sent to prison for six months, six months of home detention, 750 hours of community service, and, oddly, a $50 fine for conspiracy to commit computer crime. Phiber Optik, the computer intruder with perhaps the highest public profile in the entire world, took the longest to plead guilty, but, facing the possibility of ten years in jail, he finally did so. He was sentenced to a year and a day in prison. As for the Atlanta wing of the Legion of Doom, Prophet, Leftist and Urvile... Urvile now works for a software company in Atlanta. He is still on probation and still repaying his enormous fine. In fifteen months, he will once again be allowed to own a personal computer. He is still a convicted federal felon, but has not had any legal difficulties since leaving prison. He has lost contact with Prophet and Leftist. Unfortunately, so have I, though not through lack of honest effort. Knight Lightning, now 24, is a technical writer for the federal government in Washington DC. He has still not been accepted into law school, but having spent more than his share of time in the company of attorneys, he's come to think that maybe an MBA would be more to the point. He still owes his attorneys $30,000, but the sum is dwindling steadily since he is manfully working two jobs. Knight Lightning customarily wears a suit and tie and carries a valise. He has a federal security clearance. Unindicted *Phrack* co-editor Taran King is also a technical writer in Washington DC, and recently got married. Terminus did his time, got out of prison, and currently lives in Silicon Valley where he is running a full-scale Internet node, "netsys.com." He programs professionally for a company specializing in satellite links for the Internet. Carlton Fitzpatrick still teaches at the Federal Law Enforcement Training Center, but FLETC found that the issues involved in sponsoring and running a bulletin board system are rather more complex than they at first appear to be. Gail Thackeray briefly considered going into private security, but then changed tack, and joined the Maricopa County District Attorney's Office (with a salary). She is still vigorously prosecuting electronic racketeering in Phoenix, Arizona. The fourth consecutive Computers, Freedom and Privacy Conference will take place in March 1994 in Chicago. As for Bruce Sterling... well *8-). I thankfully abandoned my brief career as a true-crime journalist and wrote a new science fiction novel, *Heavy Weather,* and assembled a new collection of short stories, *Globalhead.* I also write nonfiction regularly, for the popular-science column in *The Magazine of Fantasy and Science Fiction.* I like life better on the far side of the boundary between fantasy and reality; but I've come to recognize that reality has an unfortunate way of annexing fantasy for its own purposes. That's why I'm on the Police Liaison Committee for EFF- Austin, a local electronic civil liberties group (eff- austin(a)tic.com) I don't think I will ever get over my experience of the Hacker Crackdown, and I expect to be involved in electronic civil liberties activism for the rest of my life. It wouldn't be hard to find material for another book on computer crime and civil liberties issues. I truly believe that I could write another book much like this one, every year. Cyberspace is very big. There's a lot going on out there, far more than can be adequately covered by the tiny, though growing, cadre of network-literate reporters. I do wish I could do more work on this topic, because the various people of cyberspace are an element of our society that definitely requires sustained study and attention. But there's only one of me, and I have a lot on my mind, and, like most science fiction writers, I have a lot more imagination than discipline. Having done my stint as an electronic-frontier reporter, my hat is off to those stalwart few who do it every day. I may return to this topic some day, but I have no real plans to do so. However, I didn't have any real plans to write "Hacker Crackdown," either. Things happen, nowadays. There are landslides in cyberspace. I'll just have to try and stay alert and on my feet. The electronic landscape changes with astounding speed. We are living through the fastest technological transformation in human history. I was glad to have a chance to document cyberspace during one moment in its long mutation; a kind of strobe-flash of the maelstrom. This book is already out-of- date, though, and it will be quite obsolete in another five years. It seems a pity. However, in about fifty years, I think this book might seem quite interesting. And in a hundred years, this book should seem mind-bogglingly archaic and bizarre, and will probably seem far weirder to an audience in 2092 than it ever seemed to the contemporary readership. Keeping up in cyberspace requires a great deal of sustained attention. Personally, I keep tabs with the milieu by reading the invaluable electronic magazine Computer underground Digest (tk0jut2(a)mvs.cso.niu.edu with the subject header: SUB CuD and a message that says: SUB CuD your name your.full.internet@address). I also read Jack Rickard's bracingly iconoclastic *Boardwatch Magazine* for print news of the BBS and online community. And, needless to say, I read *Wired,* the first magazine of the 1990s that actually looks and acts like it really belongs in this decade. There are other ways to learn, of course, but these three outlets will guide your efforts very well. When I myself want to publish something electronically, which I'm doing with increasing frequency, I generally put it on the gopher at Texas Internet Consulting, who are my, well, Texan Internet consultants (tic.com) This book can be found there. I think it is a worthwhile act to let this work go free. From thence, one's bread floats out onto the dark waters of cyberspace, only to return someday, tenfold. And of course, thoroughly soggy, and riddled with an entire amazing ecosystem of bizarre and gnawingly hungry cybermarine life- forms. For this author at least, that's all that really counts. Thanks for your attention *8-) Bruce Sterling bruces(a)well.sf.ca.us -- New Years' Day 1994, Austin Texas 8<----------------- cut here --------------------------------- ________________________________________________________________________ Paul Ferguson Sprint Managed Router Network Engineering tel: 703.904.2437 Herndon, Virginia USA internet: ferguson(a)icp.net

1 0

The Internet Code Ring
by Anonymous 17 Dec '03

17 Dec '03

THE INTERNET CODE RING! An Interview with Phil Zimmerman, creator of PGP We were sitting in a circle on the floor at the Computers, Freedom, and Privacy conference, March '93 in San Francisco, St. Jude and I with Tom Jennings, Fen La Balme, et al, discussing encryption and other neophiliac rants when a dapper fellow wandered by with a beard on his face and a tie hanging from his neck. He picked up Jude's copy of bOING-bOING number 10 and glanced through it, clearly interested. I later learned that this was Phil Zimmerman, creator of PGP ("Pretty Good Privacy"), so I tracked him down and we talked for the record. Jon: I'm fairly nontechnical, and I'm also new to encryption. I spent some time recently on the cypherpunks' list, and I have a pretty good sense of what's going on, but maybe you can tell me in your own words how you came to write PGP, and what your philosophy is, especially with distribution. Phil: Well, okay. PGP, which means "Pretty Good Privacy" is a public key encryption program, it uses a public key encryption algorithm, which means that you can encrypt messages and you can send them to people that you've never met, that you've never had a chance to exchange keys with over a secure channel. With regular encryption, the kind that everybody has heard about, you encrypt a message, it scrambles it up, renders it unintelligible, and then you send it to someone else, and they can descramble it, decrypting it. They have to use the same key to decrypt it as you used to encrypt it. Well, this is a problem, this is inconvenient, because how are you going to tell them what that key is, what're you going to do, tell them over the telephone? If someone can intercept the message, they can intercept the key. So this has been the central problem in cryptography for the past couple of millenia. There's been a lots of different ways of encrypting information, but they all have this problem. If you had a secure channel for exchanging keys, why do you need any cryptography at all? So, in the late 1970s, somebody came up with an idea for encrypting information with two keys. The two keys are mathematically related. You use one of the keys to encrypt the message, and use the other key to decrpyt the message. As a matter of fact, the keys have a kind of yin-yang relationship, so that either one of them can decrypt what the other one can encrypt. So everybody randomly generates a pair of these keys, the keys are mathematically related, and they can be split apart like cracking a coin in half, and the jagged edges stick together just right. They can publish one of the keys, and keep the other one secret. Now, unlike cracking the coin in half, you can't look at the jagged edge, and figure out what the other jagged edge is going to look like. In fact, you can't look at the published key and figure out what the secret key is without spending centuries of supercomputer time to do it. This means that any time anybody wants to send you a message, they can encrypt that message with your public key, and then you can decrypt the message with your secret key. If you want to send them a message, then you can encrypt the message with their public key, and then they can decrypt it with their secret key. Everybody who wants to participate in this system can generate a pair of these keys, publish one of them, and keep the other one secret. Everybody's published key can end up in a big public key directory, like a phone book, or an electronic bulletin board, or something like that. You can look up somebody's public key, encrypt a message to them, and send it to them. They're the only ones that can read it, because they're the only ones that have the corresponding secret key. J: Are there any such directories now? P: Well, actually, there are starting to be directories like that. For PGP, there are some public key directories on Internet. You can just send an electronic inquiry saying "Give me the key for [somebody]," and it'll send you their key back, their public key. J: The convention I've seen has been the inclusion of the public key in an email message posted to a mailing list. P: You can do that, you can include your own public key when you send a message to someone, so that when they send you a reply, they'll know what public key to use to send the reply. But the problem...there is an achilles heel with public key cryptography, and I'll get to that in a minute. But first, let me explain authentication. If I want to send you a message, and prove that it came from me, I can do that by encrypting it with my own secret key, and then I can send you the message, and you can decrypt it with my public key. Remember I said that the keys are in this yin-yang relationship, so that either one can decrypt what the other one encrypts. If I don't care about secrecy, if I only cared about authentication, if I only wanted to prove to you that the message came from me, I could encrypt the message with my own secret key and send it to you, and you could decrypt it with your public key. Well, anyone else could decrypt it to, because everyone has my public key. If I want to combine the features of secrecy and authentication, I can do both steps: I can encrypt the message first with my own secret key, thereby creating a signature, and then encrypt it again with your public key. I then send you the message. You reverse those steps: first you decrypt it with your own secret key, and then you decrypt that with my public key. That's a message that only you can read and only I could have sent. We have secrecy and authentication. So you get authentication by using your own secret key to decrypt a message, thereby signing the message. You can also convince third parties like a judge that the message came from me. That means that I could send you a financial instrument, a legal contract or some kind of binding agreement. The judge will believe that the message did come from me, because I am the only person with the secret key, that could have created that message. Now, public key cryptography has an achilles heel, and that achilles heel is that, suppose you want to send a message to someone, and you look up their public key, on a bulletin board, for example. You take their public key and you encrypt the message and then send it to them, and presumably only they can read it. Well, what if Ollie North broke into that BBS system? And he subsituted his own public key for the public key of your friend. And left your friend's name on it, so that it would look like it belonged to your friend. But it really wasn't your friend's public key, it was Ollie's public key that he had created just for this purpose. You send a message, you get the bulletin board to tell you your friend's public key, but it isn't your friend's public key, it's Ollie's public key. You encrypt a message with that. You send it, possibly through the same bulletin board, to your friend. Ollie intercepts it, and he can read it because he knows the secret key that goes with it. If you were particularly clever, which Ollie North isn't because we all know that he forgot to get those White House backup tapes deleted...but suppose he were clever, he would then re-encrypt the decrypted message, using the stolen key of your friend, and send it to your friend so that he wouldn't suspect that anything was amiss. This is the achilles' heel of public key cryptography, and all public key encryption packages that are worth anything invest a tremendous amount of effort in solving this one problem. Probably half the lines of code in the program are dedicated to solving this one problem. PGP solves this problem by allowing third parties, mutually trusted friends, to sign keys. That proves that they came from who they said they came from. Suppose you wanted to send me a message, and you didn't know my public key, but you know George's public key over here, because George have you his public key on a floppy disk. I publish my public key on a bulletin board, but before I do, I have George sign it, just like he signs any other message. I have him sign my public key, and I put that on a bulletin board. If you download my key, and it has George's signature on it, that constitutes a promise by George that that key really belongs to me. He says that my name and my key got together. He signs the whole shootin' match. If you get that, you can check his signature, because you have his public key to check. If you trust him not to lie, you can believe that really is my public key, and if Ollie North breaks into the bulletin board, he can't make it look like his key is my key, because he doesn't know how to forge a signature from George. This is how public key encryption solves the problem, and in particular, PGP solves it by allowing you to designate anyone as a trusted introducer. In this case, this third party is a trusted introducer, you trust him to introduce my key to you. There are public key encryption packages currently being promoted by the U.S. Government based on a standard called Privacy Enhanced Mail, or PEM. PEM's architecture has a central certification authority that signs everybody's public key. If everyone trusts the central authority to sign everyone's key, and not to lie, then everyone can trust that they key they have is a good key. The key actually belongs to the name that's attached to it. But a lot of people, especially people who are libertarian-minded, would not feel comfortable with an approach that requires them to trust a central authority. PGP allows grassroots distributed trust, where you get to choose who you trust. It more closely follows the social structures that people are used to. You tend to believe your friends. J: Did you make a conscious decision up front, before you started programming PGP, that you were going to create something that would be distributed in this grassroots way, free through the Internet. P: Well, there were some software parts of PGP that I developed some years ago, as far back as 1986, that I developed with the intention of developing commercial products with it someday. Over the years that followed, I developed a few more pieces that I hoped someday to turn into a commercial product. But, when it finally came down to it, I realized that it would be more politically effective to distribute PGP this way. Besides that, there is a patent on the RSA public key encryption algorithm that PGP is based on. I wrote all of the software from scratch. I didn't steal any software from the RSA patent holders. But patent law is different from copyright law. While I didn't steal any software from them, I did use the algorithm, the mathematical formulas that were published in academic journals, describing how to do public key cryptography. I turned those mathematical formulas into lines of computer code, and developed it independently. J: Did you originally intend to license that? P: When I first wrote the parts of it back in 1986, I did. But I began in earnest on PGP in December of 1990. At that time, I had decided that I was going to go ahead and publish it for free. I thought that it was politically a useful thing to do, considering the war on drugs and the government's attitude toward privacy. Shortly after I stared on the development, I learned of Senate Bill 266, which was the Omnibus Anticrime Bill. It had a provision tucked away in it, a sense of Congress provision, that would, if it had become real hard law, have required manufacturers of secure communications gear, and presumably cryptographic software, to put back doors in their products to allow the government to obtain the plain text contents of the traffic. I felt that it would be a good idea to try to get PGP out before this became law. As it turned out, it never did pass. It was defeated after a lot of protest from civil liberties groups and industry groups. J: But if they could get away with passing it, they would still take the initiative and try. P: Well, yeah, actually...it started out as a sense of Congress bill, which means that it wasn't binding law. But those things are usually set to deploy the political groundwork to make it possible later to make it into hard law. Within a week or so after publishing PGP, Senate Bill 266 went down in defeat, at least that provision was taken out, and that was entirely due to the efforts of others, I had nothing to do with that. PGP didn't have any impact, it turned out, at all. So that's why I published PGP. J: Several of my friends are involved in cypherpunks, and I've been on their mailing list...are you affiliated in any way with cypherpunks? Are you getting their mailing list? P: I was on their mailing list for a couple of days, but I found that the density of traffic was high enough that I couldn't get any work done, so I had them take me off the list. J: The reason I bring cypherpunks up is that they seem to have almost a religious fervor about encryption <laughs>. I was wondering if you share that. P: I don't think of my own interest in cryptography as a religious fervor. I did miss some mortgage payments while I was working on PGP. In fact, I missed five mortgage payments during the development of PGP, so I came pretty close to losing my house. So I must have enough fervor to stay with the project long enough to miss five mortgage payments <laughter>. But I don't think it's a religious fervor. J: I'm impressed with the way encryption in general and PGP in particular have caught on with the press, how it's become within the last year. P: Well, PGP 1.0 was released in June of '91. It only ran on MS DOS, and it didn't have a lot of the features necessary to do really good key certification, which is that achilles' heel that I told you about. Theoretically, you could use it in a manual mode to do that, but it wasn't automatic like it is in PGP 2.0 and above. The current release of PGP is 2.2. It's a lot smoother and more polished that 2.0 was. 2.0 was tremendously different than 1.0, and the reason the popularity has taken off so much since September, when it was released, is because it ran on a lot of UNIX platforms, beginning with 2.0. Since the main vehicle for Internet nodes is UNIX platforms, that made it more popular in the UNIX/Internet world. Since Internet seems to be the fertile soil of discourse on cryptography, the fact that PGP 2.0 began running on UNIX platforms has a lot to do with it's popularity since that version was released...Tthat was in September of '92. J: The easiest way to get PGP is through FTP from various sites? P: Yeah. Most of them European sites. PGP 2.0 and above was released in Europe. The people that were working on it were out of reach of U.S. patent law...and not only are they out of reach of patent law, but it also defuses the export control issues, because we're importing it into the U.S., instead of exporting it. Also PGP 1.0 was exported, presumably by somebody, any one of thousands of people could have done it...but it was published in the public domain. It's hard to see how something like that could be published, and thousands of people could have it, and it could not leak overseas. It's like saying that the New York Times shouldn't be exported, how can you prevent that when a million people have a copy? It's blowing in the wind, you can't embargo the wind. J: And by beginning in Europe, you sort of fanned the flame that much better. P: Yeah. J: It seems to have spread globally, and I'm sure that you're hearing a lot about it, getting a lot of response. P: Particularly at this conference (CFP93), yes. J: Do you plan to do more development of PGP, or are you satisfied with where it is.... P: PGP will be developed further. My personal involvement is more in providing design direction and making sure that the architecture stays sound. The actual coding is taking place overseas, or at least most of it is. We do get patches sent in by people in the U.S. who find bugs, and who say, "I found this bug, here's a patch to fix it." But the bulk of the work is taking place outside the U.S. borders. J: Is there a Mac version as well as a DOS version now? P: Yeah, there is a Mac version...there was a Mac version released shortly after PGP 2.0 came out. Somebody did that independently, and I only found out about it after it was released. People have written me about it, and it did seem to have some problems. The same guy who did that version is doing a much improved version, Mac PGP version 2.2, which I believe should be out in a few days...that was the last I heard before I came to the conference. The second Mac development group, that's working on a very "Mac"-ish GUI, is being managed by a guy named Blair Weiss. That takes longer, it's difficult to write a good Mac application, so it's probably going to be a couple of months before that hits the streets. J: Were you involved in the UNIX version, too? P: I did the first MS-DOS version entirely by myself, but it's not that big a distance between MS-DOS and UNIX, so most of it was the same. The UNIX board took place soon after PGP 1.0 was released. After that, many other enhancements were added, and major architectural changes took place to the code, and that's what finally made its way out as version 2.0. J: You're doing consulting now? P: That's how I make my living, by consulting. I don't make anything from PGP. J: Do you think you'll just let PGP take a life of its own, let other people work on it from here out? P: Other people are contributing their code, and other people are adding enhancements, with my design direction. Perhaps someday I'll find a way to make money from PGP, but if I do, it will be done in such a way that there will always be a free version of PGP available. J: I was thinking of the UNIX thing, where everybody's modified their versions of the UNIX Operating System so that some [customized versions] weren't even interoperable. I was wondering if there was a chance that PGP would mutate, whether you're going to keep some sort of control over it, or whether people will start doing their onw versions of it.... P: Well, I don't know, that could happen. There are so many people interested in the product now, it's hard to keep track of everybody's changes. When they send in suggested changes, we have to look at it carefully to see that the changes are good changes. J: But you don't have some sort of structure in place where you do some kind of approval if somebody wants to make some kind of mutant version of PGP.... P: There is a kind of de facto influence that I have over the product, because it's still my product, in a kind of psychological sense. In the user population, they associate my name with the product in such a way that, if I say that this product is good, that I have looked at this and that I believe the changes made sense the last version are good changes, that people will believe that. So I can determine the direction, not by some iron law, not by having people work for me that I can hire and fire, but more by my opinion guiding the product. It would not be easy for a person to make a different version of PGP that went in a different direction than how I wanted it to go, because everybody still uses the version that I approved, so to be compatible...this has a kind of intertia to it, a de facto standard. PGP currently, I believe, is the world's most popular public key encryption program, so that has potential to become a de facto standard. I don't know what that means in comparison to the PEM standard. PEM is for a different environment than PGP, perhaps, although the PGP method of certifying keys can be collapsed into a special case that mimics in many respects the PEM model for certifying keys.

1 0

POLI: Politics vs Technology
by Hal 17 Dec '03

17 Dec '03

From: Mike Ingle <MIKEINGLE(a)delphi.com> > But could the government ban a book today? Of course not, at least not > after one person typed it or scanned it into a computer. Technological > gains are permanent. The political approach is only useful as a > tactical weapon, to hold them off until technological solutions are > in place. If you want to change the world, don't protest. Write code! This position seems to be fast becoming cypherpunks dogma, but I don't agree. The notion that we can just fade into cypherspace and ignore the unpleasant political realities is unrealistic, in my view. Have people forgotten the Clipper proposal, with the possible follow-on to make non-Clipper encryption illegal? To the extent this proposal has been or will be defeated, it will happen through political maneuvering, not technology. Have people forgotten the PGP export investigation? Phil Zimmermann hasn't. He and others may be facing the prospect of ten years in prison if they were found guilty of illegal export. If anyone has any suggestions for how to escape from jail into cyberspace I'd like to hear about them. Mike's SecureDrive is a terrific program for protecting privacy. But if we want to keep keys secret from politically-motivated investigations, we have to rely on the very political and non-technological Fifth Amendment (an amendment which Mike Godwin of EFF and others contend does not actually protect disclosure of cryptographic keys). Again, we need to win political, not technological, victories in order to protect our privacy. I even question Mike's point about the government's inability to ban books. Look at the difficulty in keeping PGP available in this country even though it is legal. Not only have FTP sites been steadily closed down, even the key servers have as well. And this is legal software. Sure, this software is currently available overseas, but that is because PGP's only legal limitations are the U.S. patent issues. Imagine how much worse it would be if non-escrowed encryption were made illegal in a broad range of countries, with stringent limits on net access to countries which promote illegal software? Here again, these kinds of decisions will be made in the political realm. Fundamentally, I believe we will have the kind of society that most people want. If we want freedom and privacy, we must persuade others that these are worth having. There are no shortcuts. Withdrawing into technology is like pulling the blankets over your head. It feels good for a while, until reality catches up. The next Clipper or Digital Telephony proposal will provide a rude awakening. Hal Finney hfinney(a)shell.portal.com

1 0

Informed Consent
by nobody＠rosebud.ee.uh.edu 17 Dec '03

17 Dec '03

You know, this radiation experiment reminds me of another incident. A group of African-American men were injected, without their knowledge or consent, with live syphilis spirochaetes, and studied for a number of years. No attempt at therapy was ever attempted, as I recall, for these individuals. Here is a reference. <krlc> BRS Number: 000988639 Author: Jones, James H. (James Howard), 1943- Title: Bad blood : the Tuskegee syphilis experiment / James H. Jones. Impr/Ed: New York : Free Press ; Toronto : Maxwell Macmillan Canada ; New York : Maxwell McMillan International, c1993. New and expanded ed. Phys Desc: xv, 297 p. : ill. ; 24 cm. Subjects: Afro-American men -- Diseases -- Alabama -- Macon County -- History. AIDS (Disease) -- United States. Human experimentation in medicine -- Alabama -- Macon County -- History. Syphilis -- Alabama -- Macon County -- History. Syphilis -- Research -- Alabama -- Macon County -- History. Tuskegee Syphilis Study. Other Author: Tuskegee Institute. Notes: Includes bibliographical references and indexes. Language: eng ISBN: 0029166764 (pbk.) LCCN: 92034818

1 0

Re: Anonymous Video on Demand
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> It just occured to me that when this protocol is implemented with > RSA, it is subject to a minor (and unlikely) failure that can > allow Alice to determine which video Bob has selected (or at > least eliminate some of them). If each video keypair has a > different modulus and the one Bob selects has a larger modulus > than some of the "dummy" videos, then if the encryption of Bob's > session key with his selected video public key results in a > message that is close to the modulus itself, the keypairs with > moduli that are smaller than Bob's message can be trivially > eliminated as candidates. This protocol also assumes that all of the movies (or pieces of information) cost the same amount. Presumably in the video-on-demand business, a most movies would have the same cost or there would be a few 'levels' of costs with many movies in each 'level.' In that case you would only pick random 'padding' videos that have the same price. However, a video store could easily give all of the horror movies one price, all of the comedy ones another, all the pornos another, etc.... and at least be able to determine the general type of video the customer is purchasing. In a general information market type setup, I would expect that the value of different pieces of information would vary greatly. How would payment of the information be made? In a general information market setup, where the bits of information have varrying values you could do something like the following. in the oblivious transfer protocol, if the hardware used is implemented in tamper-proof chips, the price of each piece of information could be encoded with the information. The chip would store a running total of the prices of information successfully decrypted by the customer. At the end of the month, the box would send the total price to the vendor, which will bill the customer. Depending on the number of pieces of information purchased, the vendor would be able to infer more or less information on the types of info bought by the customer... Also, you could randomly purchase very cheap (or free and worthless) bits of information to make it more difficult for the vendor to figure out what you are interested in... andrew

1 0