December 2003 - cypherpunks-legacy

Re: Virtual assasins and lethal rema
by TJHARDIN＠delphi.com 17 Dec '03

17 Dec '03

Adam is absolutely right. A somewhat similar case comes to mind that happened a few years back. Remember the SOF contract cases? Ads for "high risk employment" were placed in SOF by hired killers & employers responded to mail drops. Although not as anonymous as what we are discussing, interception of those communications did not break those cases. It was good old fashioned police work combined with mistakes on the part of employers & employees. Only after the case was pretty well solved was the method of hiring revealed (by suspects talking.) SOF paid a big civil judgement & agreed to stop running personal employment adverts. Even if a killer is so anonymous that she can't be linked to a given crime by the employer who will talk 99.9% of the time any pressure is applied, she must still continue to accept various contracts. The police would then set up one of their stings & "hire" her anonymously for another job & snatch the killer up when she attempts to fullfill this contract. Likewise, the very first offer of employment may well be of this sort. All of this presupposes that there are still some police around, which I kinda hope they aren't. They have rarely been around when I needed them & with all the moraline addicts they have to fix they don't have time for real crimes against person & property anymore. tjh pgp261 available

1 0

Re: On the crime bill and remailers
by nobody＠kaiwan.com 17 Dec '03

17 Dec '03

>From: Black Unicorn <unicorn(a)access.digex.net> >Subject: Re: On the crime bill and remailers > >Anonymous must be a Baker & Botts associate. Now that's funny. >> 1) The act does not make it a per se offense to have a remailer. Below it is asked whether this is assertion or assumption. Neither. It is obvious. If the act wished to make running a remailer a per se offense it would simply say so. It doesn't say anything like that. [...much deleted. Time preses and this is unpaid...e$ anyone?...] > >Instead you might ask how the statute will be read in the context of the >differing language between the investigation threshold requirement and >the definition of offense. Why would one mention intent so explicitly >and the other ignore it? Did congress anticipate the difficulty of >showing intent in this type of prosecution and structure the act >accordingly? This would be my argument as a prosecuter. This argument is not frivolous. But I doubt it would work, particularly since the counterweight is constitutional due process. > >> 3b) Query: why would it be a violation of due process to >> have a ban on unknowingly aiding terrorists in the manner Mr. Unicorn >> wishes to read the satute? > >Ah, but the counter to this arguement (obviously structured well into the >statute) is that there will never be any investigation into the offense >without resonable facts to suggest intent. (This is the killjoy to the >due process arguement.) This won't work either. First, it is not "obviously structured well into the" badly drafted statute. Second, a limit on investigations does not in this world of police and prosecutorial discretion operate as a meaningful, or even mesurable, limit on prosecutions. Suppose the police get information in the course of a separeate investigation? Suppose they are following Carlos and see him go into your resturant? [...] > >You rely on the construction tending to constitutionality here, but it is >equally valid to construct the statute as meeting the due process >requirement via the investagatory intent requirement. This was my entire I disagree completely. See above. >point. Given the difference in the requirements between allowing >investigation and definition of offense, there is a basic imbalance in >the act. Why? Accident, poor drafting? Intent? Neither. A guess, and only that: the investigation limit (which I would argue is uneforceable) is intended as a signal to cops/sop to civil libertarrians that the act should not start witch hunts. > >> N.B. these problems could be cured, and due process observed, by finding a >> duty to make enquiry or imputing a negligence standard of some sort, but >> we do not see any hint of this in the statute. > >Exactly. So why are they not? Why is this never mentioned. I can only stupid drafters is the most likely explanation >believe that the structure of the statute is intended to provide this >arguement as a loophole. I'm not paranoid enough to want to claim that >this is to peg remailer operators specifically, (duh) but what are the >implications for a very soft offense definition in a federal crime bill? Standard operating procedure these days. Hmmm...maybe a literal-minded court is not so bad? [...] >> Ratzlaf v. United States, >> 114 S.Ct. 655 (1994) [summary quoted below], in which the Supreme >> Court imputed a scienter requirement into a money laundering >> statute which on its face required no such scienter at all. > >I have not had time to look at 31 USC 5324(3) in detail with reference to >this problem. Nor have I looked at the case. At first glance it looks >promising, but I remain a skeptic. It is too tempting to use the >language in the investigatory intent requirement to dismiss the >arguements you make. > I disagree. Intent from investigation won't cure the due process problem. Intent -- at a minimum in the sense of knowingly committing the act of aiding a terrorist, not necessarily in the sense of knowing that it is illegal to do so -- must be read into the offence itself. Only a very, very clear statutory command to the contrary would suffice to avoid this reading -- and then we have pretty much created a per se offense of running an open remailer since it is impossible to know who you are dealing with. I might add that I believe it would be a violation of the First Amendment to make running a remailer a per se offense, but that's not required for the argument [...] > >> //QUOTING-- >> SYLLABUS: > >> time it is called into play. Because currency structuring is not >> inevitably nefarious, this Court is unpersuaded by the United >> States' argument that structuring is so obviously "evil" or >> inherently "bad" that the "willfulness" requirement is satisfied >> irrespective of the defendant's knowledge of the illegality of >> structuring. > >In any event, this is the real key here. What do you think a judge will >find encrypted remailing rates on the "nefarious" scale? In context I >think it will be quite harsh. Especially given the very nature of the Given the importance of money laundering to drug deals, and the 1st Amendment aspect of remailing, I rate it at least a tie or better. [...] Since we are now being civil, I should note that the Ratzlaf case has been criticized by almost every commentator as wrongly -- even insanely -- decided, and I tend to agree with the critiques. Nevertheless, the decision is of a piece with other odd, hyper literal, statutory construction cases in the past two years and the odds are it will be followed. SOLONg

1 0

any CP going to the International Cryptography Institute this week?
by Carl Ellison 17 Dec '03

17 Dec '03

I have the program in front of me and it looks ominous. - Carl

2 1

Re: Scienter and all that stuff
by chen＠intuit.com 17 Dec '03

17 Dec '03

> In article <9409201859.AA00254(a)doom.intuit.com>, > Mark Chen <chen(a)intuit.com> wrote: > >> The facts and the law only matter when the government doesn't have > >> a hard on for you. If the government wants to get you [and, perhaps, > >> if you're not a millionaire "sports figure"] it will get you. The > >> crime bill just makes the task a bit easier. > > > >This is quite accurate. Howard Zinn makes the same point in > >_Declarations of Independence_. > > Where does Steve Jackson fit into this theory? > > I don't think it's nearly as black & white as you suggest: Our systems > are not monolithic and some consitutional and democratic principles do > still have some sway. Noam Chomsky discusses this when he talks about > reasons for optimism. > > Which is not to belittle the orginal point that we have reason to be > paranoid: it's just to say that we don't have total justification for > despair, either. Yes, it's often easy to identify a single piece of the overall dynamic and use it to account for everything that happens. I'm only saying that legal guarantees are not necessarily the last word about what the government can and can't do to you. Chomsky's optimism (as you know) doesn't stem so much from a faith that our legal system will one day start working properly, as from a faith that people are capable of evolving - an outlook that you and I seem to share, but that many on this list don't. - Mark - -- Mark Chen chen(a)netcom.com 415/329-6913 finger for PGP public key D4 99 54 2A 98 B1 48 0C CF 95 A5 B0 6E E0 1E 1D

1 0

Re: Virtual assasins and lethal rema
by doug＠OpenMind.com 17 Dec '03

17 Dec '03

TJHARDIN(a)delphi.com writes: >Adam is absolutely right.... Even if a killer is so anonymous that she can't >be linked to a given crime by the employer who will talk 99.9% of the time >any pressure is applied, she must still continue to accept various >contracts. >The police would then set up one of their stings & "hire" her anonymously >for another job & snatch the killer up when she attempts to fullfill this >contract. Likewise, the very first offer of employment may well be of this >sort. Once again (and hopefully for the last time!), I reiterate that it is the person *placing* the contract who is at zero risk (except for the risk of losing their digital cash). Stings can be set up to catch the killer, but providing the person doing the hiring trusts no one but himself, there is no risk to him. To the extent that there is *any* risk to this person, the goals of crypto anarchy have not been met. This pertains to every conceivable security leak that might affect the person placing the contract. Doug ___________________________________________________________________ Doug Cutrell General Partner doug(a)OpenMind.com Open Mind, Santa Cruz ===================================================================

2 1

HTTP authentication efforts
by paul＠hawksbill.sprintmrn.com 17 Dec '03

17 Dec '03

Howdy guys 'n gals. As much as I'd love to rant about Detweiler getting an account on Colorado Supernet, I must put aside my insidious remarks for the time being. Does anyone know, on the off-chance, who is currently working on HTTP authentication processes for web browsing and Mosiac? Pointers appreciated. _______________________________________________________________________________ Paul Ferguson US Sprint Managed Network Engineering tel: 703.904.2437 Herndon, Virginia USA internet: paul(a)hawk.sprintmrn.com

1 0

Reserved DC-Net IP addresses - NOT!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

hughes(a)ah.com (Eric Hughes): > Speaking of long-term integration on the internet, might it not be a > good idea to get some IP address range assigned for dc-net use? I don't agree. Apart from the IP address crunch that already poses a problem for the IETF, I don't see why DC-Nets should be limited to specially allocated addresses. DC-Nets should be implemented a layer over protocols such as IP, or as extensions to them. It should be possible for _anyone_, regardless of IP address (officially allocated DC-Net number) to connect with _any_ others on a DCN, with some software or other interfacing. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

3 2

Re: Scienter and all that stuff
by chen＠intuit.com 17 Dec '03

17 Dec '03

James Donald writes; > L. Todd Masco writes > > I don't think it's nearly as black & white as you suggest: Our systems > > are not monolithic and some consitutional and democratic principles do > > still have some sway. Noam Chomsky discusses this when he talks about > > reasons for optimism. > > Of course Noam Chomsky is optimistic - he favors limitless and absolute > state power and the forcible and violent silencing of all those who > deviate from political correctness. > > If I was campaigning to make a the US a totalitarian terrorist > state, I would be full of optimism. Before this gets out of hand (which it certainly will), I very gently suggest that you read something which Chomsky has written before favoring us all with your opinions. -- Mark Chen chen(a)netcom.com 415/329-6913 finger for PGP public key D4 99 54 2A 98 B1 48 0C CF 95 A5 B0 6E E0 1E 1D

1 0

Re: On the crime bill and remailers
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hal said: > I strongly disagree with this. Anonymous remailers as presently > constructed will be almost completely ineffective against any significant > government attempts to surveil email traffic. The government does have > the resources today to defeat most uses of remailers. Since present-day > remailers lack padding features, the correspondence between incoming and > outgoing messages, even with encryption, is relatively easy to establish. > This is made worse by the lack of general support for reordering, which > renders the task almost trivial. Although it does seem that the government ought to be able to track remailer traffic, is there any evidence that they are actually doing it in the real world? I've seen posts on usenet which would have presumably provoked a reaction from police, but I can't remember hearing of any cases in which such surveilance occured. == Alex Strasheim alex(a)omaha.com -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLn9tpREpP7+baaPtAQHrewQAvJW8zUIQb57XwHHsdGC7gJo9UyFfds4o hu1vTUEsZvzyYJL7BIVgDEnHowVZ6vWyKky2QW+CiYli6Ulo8zFN5zoeWS09vLx2 /pANQPxXC+o61C1rypiR85D/esJ7a7ZRJu8OI5sa98+eLmDDad/j/768OMmFwR8c iI8ZnV2PCbQ= =DwQt -----END PGP SIGNATURE-----

4 3

Re: Scienter and all that stuff
by John Young 17 Dec '03

17 Dec '03

Responding to msg by jamesd(a)netcom.com (James A. Donald) on Tue, 20 Sep 3:22 PM > >Of course Noam Chomsky is optimistic - he favors >limitless and absolute state power and the forcible >and violent silencing of all those who deviate from >political correctness. > >If I was campaigning to make a the US a totalitarian >terrorist state, I would be full of optimism. I respectfully suggest that that's not what Chomsky advocates. He makes superior detailed analysis and criticism of authoritarian government by brilliantly attacking weak-willed ideologues of all political persuasions which hide under skirts of tyrants. On the contrary, his optimism, it seems to me, derives from his own hard work and original thinking not from parroting any party line. With this he is in the company of original thinkers like Karl Hess, Murrary Bookchin and others who have garnered the courage to grow beyond the simple faith of left-right comforts and conceits. Their writings have a generosity of scope and purpose that exemplify how to assess specific problems and to prescribe remedies, and thereby perhaps help us break free of the mesmerizing, melodramatic defecations of partisan politics. Or so I optimistically muse. John

1 0

Re: On the crime bill and remailers
by Hal 17 Dec '03

17 Dec '03

From: greg(a)ideath.goldenbear.com (Greg Broiles) > In general, scienter/mens rea requirements mean that you must have intended > a particular action (or failure to act) - the question is about your > understanding of the facts of a particular situation, not the legal status > of a particular situation. Given your example, it's illegal to drive > across the border, knowing your pickup contains ammunition - whether or > not you believe your actions are legal. It's not illegal to drive across > the border with a box full of ammunition if you thought you were carrying > a box full of clothes. > > The old saw "ignorance of the law is no excuse" is basically accurate. > Good-faith reliance on legal advice from competent counsel won't even > save you. (but it might get you a malpractice judgement/settlement). I don't know how true this is in general, but my research into the arms export question indicated otherwise. Here is part of a posting I sent to CP some time last year concerning a case in which the defendant did in fact drive to Mexico with a truck load of ammunition: > In U.S. v Lizarraga-Lizarraga, the appellate court wrote (in 541 F2d 826), > > "At trial and on appeal, the defendant admits that he purchased the > ammunition and that he intended to export it to Mexico. His defense is > bsed on the contention that he had no knowledge that his conduct violated > the law. Hence, the appellant claims that to be found guilty under > 22 U.S.C. 1934 [the predecessor to 22 U.S.C. 2778], the government must > prove that he intended to violate the statute.... We agree, and hold > that he was entitled to a specific intent instruction. Accordingly, we > reverse his conviction and remand for a new trial." > > The court discusses several reasons for concluding that "willfully" > implies a need to show specific intent, among them that the articles on > the Munitions List are not obviously illegal to export, finally concluding: > > "Accordingly, we hold that in order for a defendant to be found guilty of > exporting under 22 U.S.C. 1934, the government must prove that the > defendant voluntarily and intentionally violated a known legal duty not > to export the proscribed articles, and the jury should be so instructed." Perhaps the arms export laws are worded differently than some others and so the more stringent rules apply. Hal

2 1

SHAMELESS PLUG
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Mark Chen wrote the follow about the scienter thread: ... Howard Zinn makes the same point in _Declarations of Independence_.... he concludes that law is made not by legislators and judges, but by the policman's club. But less and less every day. As Duncan and I--the official "Pollyannas of Privacy"--have been telling you, technology is on our side. As it advances, technology continues to shift the balance of power from the State to the individual. For my vision of technology in the service of civil liberties, see my upcoming article, "Support Your Digital Police," in the "Idees Fortes" section of December's Wired. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: SHAMELESS PLUG
by chen＠intuit.com 17 Dec '03

17 Dec '03

Sandy Sandfort writes: > Mark Chen wrote the follow about the scienter thread: > > ... Howard Zinn makes the same point in _Declarations of > Independence_.... he concludes that law is made not by > legislators and judges, but by the policman's club. > > But less and less every day. As Duncan and I--the official > "Pollyannas of Privacy"--have been telling you, technology is > on our side. As it advances, technology continues to shift the > balance of power from the State to the individual. Which is why, even with their exceedingly feeble perception of what these technologies portend, authoritarian structures are thrown into fits of nearly hysterical apoplexy when confronted by Things Crypto. > For my vision of technology in the service of civil liberties, > see my upcoming article, "Support Your Digital Police," in the > "Idees Fortes" section of December's Wired. I'm there. - Mark - -- Mark Chen chen(a)netcom.com 415/329-6913 finger for PGP public key D4 99 54 2A 98 B1 48 0C CF 95 A5 B0 6E E0 1E 1D

1 0

DB Technology
by L. Todd Masco 17 Dec '03

17 Dec '03

For a good example of DB/Expert system technology used for good instead of evil ("A power so great...") check out ringo(a)media.mit.edu, body of mail "join". You tell it your musical preferences and it suggests albums that others with a similar taste to yours liked. It'll also tell you what to avoid. I intend to honor its advice, to avoid Neil Diamond, Tiffany, and Barry Manilow. -- Todd

1 0

Re: Virtual Assassins & lethal remailers
by TJHARDIN＠delphi.com 17 Dec '03

17 Dec '03

Subject: Re: Virtual assasins and lethal remailers (Doug Cutrell) doug(a)OpenMind.com writes >>TJHARDIN(a)delphi.com writes: >>Adam is absolutely right.... Even if a killer is so anonymous that she can't >>be linked to a given crime by the employer who will talk 99.9% of the time >>any pressure is applied, she must still continue to accept various >>contracts. >>The police would then set up one of their stings & "hire" her anonymously >>for another job & snatch the killer up when she attempts to fullfill this >>contract. Likewise, the very first offer of employment may well be of this >>sort. >Once again (and hopefully for the last time!), I reiterate that it is the >person *placing* the contract who is at zero risk (except for the risk of >losing their digital cash). Stings can be set up to catch the killer, but >providing the person doing the hiring trusts no one but himself, there is >no risk to him. To the extent that there is *any* risk to this person, the >goals of crypto anarchy have not been met. This pertains to every >conceivable security leak that might affect the person placing the >contract. >Doug Sorry to have to repost on this, I only meant to make a brief point. To the following --> >the person *placing* the contract... is at zero risk To this entire point I must say Au Contraire!The person at greatest risk *is* the person placing the contract. This is the employer whom I said would fold under pressure 99.9% of the time. If the police are still around,they will use the classic investigatory method of cui bono? Who benefits? Who has motive?This was Adam's point & the one I was emphasizing. Even if the payment is untraceable, the police have often succeeded in bluffing suspects into confessing to crimes for which strong suspicions existed, but evidence proving guilt was entirely lacking. This will not change as human nature will not fundamentally change. As far as the assassin being unable to link the employer to the crime, or know who hired her, this is fine in theory, but it is likely that she two will ask the same question regarding the job, cui bono? & coming to the same conclusion. When arrested later for some other offense, merely providing law enforcement with the time, place, victim, & payment for various jobs will be enough to convict or scare most employers into confessing. After all the impatient heir will no longer be able to claim that Uncle Scrooge was a tragic victim of random violence. Now I know the idea is to reach a state where police forces no longer exist. But let's be realistic. -Publicly Supported- morality or Political Correctness Cheka's such as we know today will hopefully cease to exist, but it is extremely likely that Private Police squads will be hired by individuals & groups for protection & revenge. Such units/individuals have a long history in this country, & I knew (verrry casually- we frequented the same Houston New Wave hangout, Rudyard's in the early 80's) a hired killer named David West who was tripped up by a femme fatale hired by a private dick named Clyde Wilson who was hired by the victims' other daughters to get at the daughter who arranged their parents' murders. The case was solved entirely by these private cops & only turned over to HPD for arrest & prosecution. I am sure that if no HPD or State of Texas existed, the "good" daughters would have paid Clyde Wilson for more than just investigation. Actually, the natural condition of humans in anything more complicated than a small scale subsistence bands seems to be not living under powerful states, but rather private armies, condottieri, vendettas, etc. This was the state of affairs in the Italian Renaisance & which one of us would choose the deadly dull certainties of the Middle Age's dogmatic fideism over the brilliant explosion of that great liberation of the human spirit & potential? No one reads Aquin-ass- anymore or even knows who he was but the Borgias, Machiavelli, & Michelangelo are still remembered, read with profit, & restored...respectively even now. tjh 2.61 available

1 0

Re: On the crime bill and remailers
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 05:45 PM 9/20/94 -0400, John Young wrote: >Hal and Tim point to the vulnerability of the person running >the remailer to being threatened through the equipment owner Soon most remailers will be run on equipment owned by the operator. At the last NJ computer show I attended, I could have purchased a 486/66 with a paltry 250 meg HD for $999. Then all we have to worry about are the network connections but in a few years, we'll be able to do high-speed "dial up" connections from our home boxes to other (and different) systems anywhere on the nets. Hard to track. >This isolation and elimination (or co-optation) of a target has >worked again and again to destroy networks once they become >serious threats to law and order. They can afford to intimidate a few remailers but "enforcement doesn't scale well." (Another DCF quote.) Networks, software, and hardware scale much better than enforcement resources. Swamping effect. DCF

1 0

Re: Laws Outside the U.S.
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Germany: There is no restriction of import or use of cryptography ( _yet_ ). There are some restrictions about export and transmission of encrypted data: - Encryption soft/hardware can not be exported to communist countries (COCOM) without problems. I don't know exactly, whether it is forbidden, must be licensed, or must be registered in any way. - There are two kinds of amateur radio, the CB (citizen band) and the licensed amateur radio, which requires a personal license. On this licensed radio it is not allowed to send encrypted messages, but as far as I know nobody cares and nobody checks. The sense was to make you use the telephone and pay. - There was a restriction about the telephone net. You are not allowed to transmit anything but voice. I don't know what happened with that restriction since everyone uses fax and modem legally. At the moment they have a lot of problems with such laws. They have to decide whether they are valid or not, because most european countries have joined the European Community. The EC forces their countries to equalize their laws in the sense of "what you can do in one country, you can do everywhere". Sometimes this is very helpfull (e.g. use of modems. Most of them where illegal in Germany, meanwhile nearly all of them have a license), sometimes they have silly ideas (e.g. laws about ingredients of noodles or beer). If France forbids the import of crypto software, but allows to sell it inside of France, then I can sue France, because the french programmer can sell his programs in France and I can't. I'm sure we will get a special crypto law within the next years. Hadmut

3 2

Re: HTTP authentication efforts
by Mark Hittinger 17 Dec '03

17 Dec '03

> From: paul(a)hawksbill.sprintmrn.com (Paul Ferguson) > Does anyone know, on the off-chance, who is currently working on > HTTP authentication processes for web browsing and Mosiac? Cern probably has this already done and under wraps by now. In the USA the recent NCSA/Spyglass, Inc press release implies that Spyglass will develop an "electronic commerce" capability for Mosaic. Tuesday's Wall Street Journal has an interesting article (Sep 20 C1 bottom) about the mysterious DE Shaw company. For those of you who don't follow every vital scrap of information pryed out of DE Shaw - they are a stock market related firm with very heavy investment in computer hardware and brain power. The article quotes Shaw implying the development of yet another electronic market capability - "commercial use of the Internet". Perhaps Shaw is funding some of Spyglass? Its odd to see program trading gurus get side tracked on this. mark.h

1 0

HTTP authentication efforts
by michael shiplett 17 Dec '03

17 Dec '03

"pf" == Paul Ferguson <paul(a)hawksbill.sprintmrn.com> writes: pf> Does anyone know, on the off-chance, who is currently working on pf> HTTP authentication processes for web browsing and Mosiac? pf> Pointers appreciated. There is a www-security mailing list based at Rutgers (majordomo(a)nsmx.rutgers.edu; list name of www-security). From the introductory majordomo message: This list is intended for the discussion of World Wide Web security proposals, enhancements and issues. Ben Fried of Columbia posted to www-security some NCSA httpd/xmosaic patches to allow Kerberos 4 authentication. The University of Michigan is using these patches (with some bug fixes fed back to Ben) and a similarly patched lynx browser for authenticated web connections. I haven't looked at the code to know whether the network traffic is encrypted or not. michael

1 0

THOSE DARNED HIT MEN
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Tim May writes with regard to anonymous contract killers: ... And the risk of losing the digital cash can be made vanishingly small by use of anonymous escrow services, which act solely as holders of the digital cash.... I don't buy it. Anonymous digital assassins, murder escrows and all that work fine in an artificial, abstract, game-theory world. I doubt we'll see much--if any--of it in the Real World. Why? Because the market is too richly textured not to come up with its own cultural, ethical and digital fixes. Would you do business with a escrow that was the bag man for contract murders? I wouldn't, you wouldn't and the vast majority of people in the world wouldn't. That wouldn't stop some escrows from performing that service, but it would run up the cost. When the costs rise high enough, profitable opportunities are created for false escrows to enter the business. That's just one problem that can interfere with such an odious endeavor; there are more. I think the best way to illustrate that the anonymous murder business is nothing more than a bugaboo, is to set the best minds on the planet--Cypherpunks--to work on the problem. Let's all put our thinking caps on, and come up with answers to the follow hypothetical situation: Let us assume a world with totally anonymous communications and payments (strong crypto, remailers, digital cash, etc.). 1) How would YOU scam money from the system without actually knocking anyone off? Or in the alternative, 2) How would YOU use technology to address the problem from police/private investigator perspective? I'm betting that with no more than a few moments of thought, Cypherpunks will come up with a ton of hacks. To get the ball rolling, here are two from me: SCENARIO ONE I set up a meat-and-potatoes escrow business. I keep my nose clean. I honor my obligations. I build up a good reputation. At some point, I'll be approached by a murderer and the person who is hiring him or her. I'll accept the payment. When the murder is committed, I won't pay off. The murderer will (a) sue me (I don't think so), (b) damage my reputation (I'll leave this one as an exercise for the student), or (c) murder *me* (ah, but first he has to find me; in the world we posit, that won't be very easy). If this scenario happens very often, it'll take all the profit out of the murder business. Of course, the murderer can get the money face-to-face from the customer, but then we're back to today's square one. SCENARIO TWO I set up a phoney murder-for-hire business. Someone contracts with me to bump-off their rich uncle. The client deposits my payment with a reputable escrow company, "Murder Escrows R Us." I go to the uncle and tell him the whole deal. Using digital technology, bribed coroners, etc., we fake his death. When the news hits the Net, the escrow pays me off. The uncle comes back to life, disinherits whomever he suspects wanted him dead. And I laugh all the way to the digital bank. I create a new pseudonym, place another murder-for-hire ad, and do it all again. Given our Brave New World, nobody can touch me. Okay C'punks, it's your turn. How would you subvert Tim May's vision of anonymous murder-for-hire for fun and profit? (Feel free to take potshots at my two scenarios as well. Cypherpunk cleverness cuts both ways, I'm sure.) S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

Re: HTTP authentication efforts
by ekr＠eit.COM 17 Dec '03

17 Dec '03

Paul writes: >Does anyone know, on the off-chance, who is currently working on >HTTP authentication processes for web browsing and Mosiac? >Pointers appreciated. Philip Hallam-Baker at CERN has done some work in this area. The general name for it appears to be Shen. I don't know what the status of it is. There is also the original PEM and PGP work done at NCSA by Rob McCool. I'm given to understand that MCC has done some work with Kerberos integration. (Microcomputer and Electronics Corp, or whatever). In addition, I believe that both Spry and Mosaic Communications Corp have announced that they have their own security solutions but haven't announced any technical details... And.....Shameless plug follows: Allan Schiffman and I here at EIT have developed an extension of HTTP called 'Secure HTTP' which provides for end-to-end security and authentication. (Mainly by recycling a lot of the preexisting work in cryptographic messaging, particularly PEM and PKCS7). The protocol is publicly specified and basically consists of wrapping the entire transaction inside privacy enhanced messages, using a variety of cryptographic message formats. It also includes support for systems in which only one party has a public key pair. [By exchanging an encrypted session key to be used for the return transaction]. Disclaimer: While there will be some free distribution of the software based on this protocol, and the protocol is completely nonproprietary (except, of course, that it uses public key) EIT (and I) have a financial interest in selling products based on this technology. You can get a copy of the current (though slightly outdated) version of the protocol via: WWW: http://www.commerce.net/information/standards/drafts/shttp.txt Email: shttp-info(a)commerce.net (Automatic response) Anonymous FTP: ftp.commerce.net/pub/standards/drafts/shttp.txt The next rev should support (though the released software probably won't for a while) Diffie-Hellman and Kerberos. -Ekr

1 0

international escrow and things
by Brian D Williams 17 Dec '03

17 Dec '03

>4:30-5:00 >International Escrowed Encryption >Dorothy E. Denning, Georgetown University >John Droge, Mykotronx, Inc. Boy, doesn't this just give you a warm and fuzzy feeling? "Sorry I couldn't attend your conference Dorothy, I was busy doing my cryptography homework." On the subject of remailers, I just had a thought. What about a series of "meta-remailers" known only to the remailer operators? Is this just a case of meta-security through obscurity? Then there's that pesky "web of trust" thing.... Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced communication is indistinguishable from noise." --Steve Witham "Have you ever had your phones tapped by the government? YOU WILL and the company that'll bring it to you.... AT&T" --James Speth

1 0

Linux and PGP
by merriman＠metronet.com 17 Dec '03

17 Dec '03

I'm starting to take Linux for a "test drive", and am looking for a couple pointers on using PGP. Some time ago, I saw a couple of vaguely-related messages regarding PGP; one of them was editing a header file (?) to compile properly under Linux, the other was a patch (command-line switch?) to increase the available number of bits for the second part of the key (increasing it from 5 [!!] bits). Could someone either email me the info, tell me where it's hiding, or (if necessary) tell me I'm full of fertilizer? Thanks.... Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

2 1

Re: THOSE DARNED HIT MEN
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > SANDY SANDFORT > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . >Would you do business with a escrow that was the bag man for >contract murders? But if the system is set up for total anonymity, _who would know_ that an escrow agent was the "bag man"? Just like no one would know who the contractee was, or the contractor: ========================================================= Date: 21 Sep 2003 07:59:53 -0700 (PDT) From: nobody(a)remailer.mafia.org Subject: HIT MAN Needed To: alt.jobs.hitmen Contract killing needed. 5,000 credit bonus if "accidental", additional 5,000 credits is done within 30 days. If interested, post MegaCrypted bid to alt.jobs.hitmen, specifying escrow agency, and using message ID in subject line. MegaCrypt v3.7 key: dijfwoiertqwgsdfjiwqfnwenfgwiegeowqt-384`=3jkig918ur5=`9ur2ihg roih2`-98tu`=0r`\012jri2nf92ur=0`9u3r9goi23`08ru2`=093r2`3ru23 ofn1-90401t9=039t30149t394t13=04t343049u=0349304109fj3=090458g ru2-983r3i3hg143594t=39jfv3jf0`2\203r9349ugpweokwoert213tr9u=0 flkj2-0r9`2=9t130gjf32if2-103r0134ui=109jf30uf=039r=0394jf3409 flk23fr09r092r9jfgiogif30rtu=09ru0jf02ijf029ru20`9u29ti3jfoi3i oiwf-90283r-9283ru2f2ijf20r-28ru89u2h28f2-98ru2-8r298h23ohf298 oifg213-09r12-03r-20rj20jf09rut034toi53ofeg0we9g34wjkego-i309g fi3r230ru2rij39rturt3iof8u1ru30rj3f285u^&*df23rt209342`j232t4j -98tu`=0r`\012jri2nf92ur=0`9u3r9goi23`08ru2`=093r2`3ru23ofn1-9 0401t9=039t30149t394t13=04t343049u=0349304109fj3=090458gru2-98 3r3i3hg143594t=39jfv3jf0`2\203r9349ugpweokwoert213tr9u=0flkj2- 0r9`2=9t130gjf32if2-103r0134ui=1 ================================================== My nickel's worth..... Dave Merriman (hoping I don't hear from the FBI about this :-) - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

2 1

Re: Laws Outside the U.S.
by Cyber City 17 Dec '03

17 Dec '03

Tim May writes: > Indeed. One of the mysteries is why so few French are on our list...I > can't recall any, actually. Their country has some of the most > draconian laws, it is alleged, and, as Phil notes, an active SDECE > industrial espionage unit. I noticed the following in sci.crypt recently. There are some useful crypt- analysis papers in the archive, among other things: > From vaudenay(a)dmi.ens.fr Wed Sep 14 11:52:18 EDT 1994 > Subject: New WWW-Crypto-server > Organization: Ecole Normale Superieure, Paris, France > > We are happy to annonce the birth of the html pages of our team : > > http://www.ens.fr/equipes_dmi/grecc > > Most of our papers are available. > > --Serge for the GRECC team. The French company BULL makes a nice encrypting laptop computer, called "Sub Rosa", which is used by Canada's Department of national revenue auditors. -- Alex Brock

3 2