December 2003 - cypherpunks-legacy

mailing list
by rwm132＠psu.edu 17 Dec '03

17 Dec '03

can you put me and Catch 22 on your mailing list? got any good philes philes?

1 0

No Subject
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Steve Schear wrote: > >Tim May <tcmay(a)got.net> wrote: > It may be somewhat self-serving but in light of the past few hundred years > history, few (except Italians) would see the founding of Rome as > significant as the invention of democracy. History is relative. I see neither or the these as being of as great a significance as the first time I got laid. > >or so, the death of that Jesus guy > >was a minor event (the real event was the rise of the Church, in Rome, > >during the next few centuries, > > I think you'd get some major disagreements with that one. No. No one disagrees with that one. > Many historians do not see Constantine's empire as truly the continuation > of the Roman Empire per se, but that of the church (an event which as you > point out began with Jesus). The church began with the invention of money. The papacy began with the invention of bingo. The reformation was begun by sore losers who never won anything at bingo. Jewry began with a jeweller who had agraphia. (1) (1) "I Know About All That Old Shit" by the History Guy HistoryMonger

1 0

Precipice remailer open for business
by David C. Lambert 17 Dec '03

17 Dec '03

The Precipice Remailer is now open for business! Below, I have included the remailer-help file. You can get this file by sending a message to: mixmaster(a)mix.precipice.com with a subject of "remailer-help". - David C. Lambert dcl(a)panix.com dcl(a)mix.precipice.com ================================================================================ This remailer supports both type II (Mixmaster) and type I (Ghio) cypherpunks messages. Help files for both are below. Both mailers have a 5 message reordering pool, with zero default latency. Posting to Usenet is not supported. I consider the following to be inappropriate use of this anonymous remailer, and will take steps to prevent anyone from doing any of the following: - Sending messages intended primarily to be harassing or annoying (this includes spam/velveeta); - Use of the remailer for any illegal purpose (death threats, kiddie porn, etc). Don't ruin this remailer for everyone by doing something stupid and/or illegal, and I won't be forced to assist the authorities in crushing you like an insect. If you don't want to receive anonymous mail, send me a message, and I will add your email address to the block list. You can get a list of statistics on remailer usage by sending mail to mixmaster(a)mix.precipice.com with Subject: remailer-stats Have a nice day. - David C. Lambert dcl(a)mix.precipice.com The type I PGP key is: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzAypWYAAAEEAMUFk7ue4Isn2u1FMtYhJBLbSmxSgUaBgs8EJNZZYExcfTCr V+m8o2N3pYxzbjPRAZ/pv0N1Tg93Kh17/RSzEjR/y91aaBjePv36VYKwCS8KeeX+ 4LDyboic5EVkiDt1eu2cI6LIrl9w7Fo1/3YzNvsMVJ1ki/v5Ie5wAysW17oJAAUR tBttaXhtYXN0ZXJAbWl4LnByZWNpcGljZS5jb20= =hVLK -----END PGP PUBLIC KEY BLOCK----- The Mixmaster key is: precipice mixmaster(a)mix.precipice.com 05fef5887ac55dfe7379d0ef4a2a0c4b 2.0.1 -----Begin Mix Key----- 05fef5887ac55dfe7379d0ef4a2a0c4b 258 AATIdI/+dQ3rsvREcdYsnJkd+zQKCkPerZsyDXmX NaYjUTwMhiHHjl/e7Zqx/mUAUQnifQfg4KpHvBGL a6rQUTQjRhhz8sOvynyJci4NTm8DFDjYdTpvnbjp YPu7xNhSfg7fmqXuqCan1M/AmpU1r6sF6M6gA0W4 EpOqFaJo7g32xQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB -----End Mix Key----- ============================== TYPE II INFO (Mixmaster 2.0.1) ============================== This is a Mixmaster remailer. It provides an extremely high level of security. To use it, you must have a client program to produce the messages. This software is available from ftp://nately.ucsd.edu/pub/remail Read the README file for instructions. This file is export restricted, so it can not be retrieved directly. Some information can be sent to you by the remailer by including the following commands (one per message) in the subject line of mail to the remailer. remailer-help This file. remailer-stats Usage statistics for the last 24 hours. remailer-key The mixmaster key file for this remailer. A list of remailers is available from ftp://nately.ucsd.edu/pub/remail, http://nately.ucsd.edu/~loki/, and will be posted periodically to alt.privacy.anon-server and other privacy related groups. ====================== TYPE 1 INFO (Ghio 2.0) ====================== I have an automated mail handling program installed here which will take any message with the proper headers and automatically re-send it anonymously. You can use this by sending a message to mixmaster(a)mix.precipice.com, with the header Anon-To: containing the address that you want to send anonymously to. (Only one recipient address is permitted.) If you can't add headers to your mail, you can place two colons on the first line of your message, followed by the Anon-To line. Follow that with a blank line, and then begin your message. For Example: > From: joe(a)site.com > To: mixmaster(a)mix.precipice.com > Subject: Anonymous Mail > > :: > Anon-To: beth(a)univ.edu > > This is some anonymous mail. The above would be delivered to beth(a)univ.edu anonymously. All headers in the original message are removed, with the exception of the Subject (and Content-Type, if present). She would not know that it came from Joe, nor would she be able to reply to the message. However, if Beth suspected that Joe had sent the message, she could compare the time that the message was received with the times that Joe was logged in. However, this problem can be avoided by instructing the remailer to delay the message, by using the Latent-Time header: > From: joe(a)site.com > To: mixmaster(a)mix.precipice.com > Subject: Anonymous Mail > > :: > Anon-To: beth(a)univ.edu > Latent-Time: +1:00 > > This is some anonymous mail. The above message would be delayed one hour from when it is sent. It is also possible to create a random delay by adding an r to the time (ie +1:00r), which would have the message be delivered at a random time, but not more than an hour. Another problem is that some mailers automatically insert a signature file. Of course, this usually contains the senders email address, and so would reveal their identity. The remailer software can be instructed to remove a signature file with the header "Cutmarks". Any line beginning with the same text at in the cutmarks header, and any lines following it will be removed. > From: sender(a)origin.com > To: mixmaster(a)mix.precipice.com > Subject: Anonymous Mail > > :: > Anon-To: recipient(a)destination.com > Cutmarks: -- > > This line of text will be in the anonymous message. > -- > This line of text will not be in the anonymous message. You can add additional headers to the output message by preceeding them with ## > From: chris(a)nifty.org > To: mixmaster(a)mix.precipice.com > Subject: Nifty Anon Msg > > :: > Anon-To: andrew(a)hell.edu > > ## > Reply-To: acs-314159(a)chop.ucsd.edu > > A Message with a reply address. By separating messages with cutmarks, you can send more than one message at once: > From: me@mysite > To: mixmaster(a)mix.precipice.com > Subject: message 1 > > :: > Anon-To: recipient1(a)site1.org > Cutmarks: -- > > Message one. > -- > :: > Anon-To: recipient2(a)site2.org > > ## > Subject: message 2 > > Message two. The two messages will be delivered separately. For added security, you can encrypt your messages to the remailer with PGP. The remailer software will decrypt the message and send it on. Here is the remailer's public key: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzAypWYAAAEEAMUFk7ue4Isn2u1FMtYhJBLbSmxSgUaBgs8EJNZZYExcfTCr V+m8o2N3pYxzbjPRAZ/pv0N1Tg93Kh17/RSzEjR/y91aaBjePv36VYKwCS8KeeX+ 4LDyboic5EVkiDt1eu2cI6LIrl9w7Fo1/3YzNvsMVJ1ki/v5Ie5wAysW17oJAAUR tBttaXhtYXN0ZXJAbWl4LnByZWNpcGljZS5jb20= =hVLK -----END PGP PUBLIC KEY BLOCK----- To utilize this feature, create a message with two colons on the first line, then the Anon-To line, then any other headers, such as cutmarks or latency, then a blank line, and then the message. Encrypt this with the remailer's public key. Then send it to the remailer, adding the header "Encrypted: PGP". If you forget this, the remailer won't know that it needs to be decrypted. Also be sure to use the -t option with PGP, or the linefeeds might not be handled properly. > To: mixmaster(a)mix.precipice.com > From: me(a)mysite.org > > :: > Encrypted: PGP > > -----BEGIN PGP MESSAGE----- > Version: 2.6.2 > > hIkCuMeAjnwmCTUBA+dfWcFk/fLRpm4ZM7A23iONxkOGDL6D0FyRi/r0P8+pH2gf > HAi4+1BHUhXDCW2LfLfay5JwHBNMtcdbgXiQVXIm0cHM0zgf9hBroIM9W+B2Z07i > 6UN3BDhiTSJBCTZUGQ7DrkltbgoyRhNTgrzQRR8FSQQXSo/cf4po0vCezKYAAABP > smG6rgPhdtWlynKSZR6Gd2W3S/5pa+Qd+OD2nN1TWepINgjXVHrCt0kLOY6nVFNQ > U7lPLDihXw/+PPJclxwvUeCSygmP+peB1lPrhSiAVA== > =da+F > -----END PGP MESSAGE----- Any unencrypted text after the PGP message is also remailed. This is to allow sending to someone who is anonymous. If you create a PGP-encrypted message to yourself via my remailer, and then you give it to someone, they can send you a message by sending the encrypted message to the remailer. The remailer will then decrypt it and send it to you. The message gets anonymized in the process, so the sender will need to include a return address if he wants a reply. Messages sent this way can be encrypted using the Encrypt-Key: feature. Any text following a line beginning with ** will be encrypted with this key. For example, if you put in your PGP message: > :: > Anon-To: you(a)yourhost.org > Encrypt-Key: your_password > > ** The appended message after the ** will be encrypted with the key "your_password", using PGP's conventional encryption option.

1 0

You really do want to volunteer, don't you?
by Tim May 17 Dec '03

17 Dec '03

Item: Getting a transponder or bar-coded "EZ Pass" for your vehicle is completely voluntary....but if you don't have one of these transponders or passes, you'll have to go to the "manual" lane...Oh, and it seems that due to budget cutbacks we're short on staff and so you'll have to wait a while...maybe _quite_ a while. (Plus, while you're waiting maybe we'll just snap a photo of your license plate anyway, as you might be a terrorist or Mann Act felon trying to evade our surveillance....) Item: The U.S. is proud to call its tax system "voluntary," in terms of what citizens report. (The voluntary term was never that participation was voluntary, only that a tax collector did not show up in person and decide what a person owed.) However, to ensure compliance with the voluntary part, citizen-units will find that their bank narcs them out to FinCEN and IRS, and that electronic intercepts of financial dealings are common, and that "compliance audits" are far more draconian than ordinary citizen-units imagine. Item: Key recovery is purely voluntary. Unless you try to communicate with foreigners. Unless you are involved in any communications with drug dealers, money launderers, terrorists, child pornographers, or any other Horsemen. (Wouldn't you really rather play it safe and use the Government Approved Krypto?) Item (in the Very Near Future): "But, Mr. and Mrs. Zludnick, the ChildFinder (TM) implant is painless and quick. Based on the technology used to find lost pets, ChildFinder (TM) allows authorities in public places to scan for kidnapped or lost children. Surely you'd want your daughter to have access to this technology? While completely voluntary--after all, Mr. Zludnick, we are still a democracy, aren't we?--you should be aware that the school nurse will be most unhappy if your children are not ChildFinder-compatible. Not to mention the teachers who count on using RollTaker (TM) to automatically take the roll of students. And your children will have to take tests in special rooms, and checked for evidence of identity spoofing. All in all, Mr. and Mrs. Zludnick, I think you can see the problems. Why, in a sense, it would be a kind of child abuse, don't you think, to make your little Johnny and Suzy such oddities in the class. I'm sure you wouldn't Child Protective Services to make one of their "visits," would you? They're oh-so-thorough in uncovering signs of an unwholesome home environment. And then where would you be? So, can I assume you'll be volunteering?" What we are seeing is an Orwellian abuse of the English language. Programs are introduced as "voluntary" ones, but the alternatives are either deliberately made time-consuming and annoying, or the alternatives are just dropped completely. (I'm not talking about what private individuals or companies ask for. Alice's Restaurant is free to require patrons to wear silly hats, as it is their property. What I'm confining my comments to is the "mandatory voluntary" nature of more and more government programs.) The airline bag confirmation system is an in-between situation. It is partly a security matter to require bags be correlated with actual flying passengers...cuts down on bombs sent in bags. But it is also a surveillance/tracking issue, and the airlines are playing the tune the government calls for. (Else why would airlines not accept passengers who a) in fact board the plane, and b) pay in cash for their tickets? It used to be this way. No more. Now they demand a True Name, regardless of how easy it is to buy phony documents. If I can buy a phony set, or can even make up my own, imagine what actual terrorists can do.) And there's the whole issue of Social Security Cards. My card, issued in 1969, says it's not be used for any purposes except SS and income tax matters. Tell that to the many agencies, public and corporate, demanding it. The point? Our privacy is being "escrowed." The automobile transponders and barcoded vehicle passes are touted as voluntary, but they really are not. Chaumian, identity-protecting technologies need to be deployed. Frankly, I think Cypherpunks are getting off track with all the recent focus on "old" technologies (which I'll leave unspecified, as my point is not to attack certain pet projects). The real stuff is going undone. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

8 19

Re: Brand e-cash implementation?
by Hal 17 Dec '03

17 Dec '03

Brands has a web page at <URL:http://www.cwi.nl/~brands>. I don't know of any implementations of his technology. The last time I heard from him was early this year and at that time he apparently was still looking for backers. BTW he has a new paper out as of July 95, available above, which discusses some problems and attacks on some earlier papers. He had proposed a notion called "secret key certificates" in which some problems have been found. Basically a secret key certificate is just like a public key certificate (a signature by someone on a public key as in PGP) except that realistic-looking but ultimately worthless secret key certificates can be faked up (simulated) by anyone. No one can distinguish a fake secret key certificate from a real one. However, they are worthless because the faking process requires you to choose a random public key, and you can't figure out what the secret key is. Brands has (re)expressed his digital cash technology in terms of these secret key certificates. But Berry Schoenmakers of CWI has shown a way in which a faked-up secret key certificate can be used to spend a coin which was never withdrawn. However, to do so, you have to go through the withdrawal protocol in a particular incorrect way. You force the bank to act as an "oracle" for a certain discrete log problem when you do the withdrawal. The data you get from the incorrect withdrawal protocol allows you to spend the fake coin. So this is not actually a dangerous attack, because you in effect have to withdraw a coin in order to spend the fake one. You can't make any money from it. Still it was not anticipated and that is a bit worrisome. I'm not sure why Brands' various proofs of correctness (which are one of the big selling points of his technology) did not anticipate this attack. (In effect this is a different form of a blind signature than what Brands planned for, since you withdraw one thing and get another. I was thinking Brands should write this up under the title "Unanticipated Blinding for Signatures", a pun on Chaum's "Blinding for Unanticipated Signatures", one of his credential papers.) Brands has a workaround to prevent this attack, but it hurts the provability of his scheme. "A rigorous prove [sic] of the effectiveness of the measure may be hard to provide, though, since one must hereto prove that the CA cannot be used as an oracle to perform the cryptographic action in the showing protocol with respect to simulated public keys." So this may be a setback in Brands' attempts to get his thesis finished and accepted. As for the question of whether any digital cash scheme offers "true" anonymity, I think you have to be more specific. Virtually all cash advocates will claim that they can offer this. In the debate I had earlier with Lucky Green I argued that Chaum's ecash does offer a certain kind of anonymity. The extent to which it does not is largely not technical but a product of not allowing anonymous bank accounts. With anonymous accounts Chaum's technology offers as much anonymity as any system that I have studied. There is one technical problem with Chaum's ecash which Lucky mentioned, but I believe it applies to all systems. That is that the spender of the cash can "mark" it or at least recognize it when it is later deposited. If the spender wanted to attack the receiver of the money and it is deposited non-anonymously then this will be a problem. However, as we discussed here several months ago, Chaum's paper "Transferred Cash Grows in Size" from a recent Crypto proceedings shows that by colluding with the bank a payor of cash can recognize it at any later stage of the payment chain. So this kind of anonymity is very hard to achieve. Chaum's paper applied to off-line cash, though, so perhaps an online system could do it. But you'd have to blind the coins twice, once when they pass from bank to payor and once when they go from payor to payee, and I don't see how to do this. Hal Finney

1 0

Re: Bizdos citizenship?
by Andrew.Spring＠ping.be 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >In correspondence with someone outside the US regarding ITAR regulations, the remark was made that Jim Bizdos was Greek and not a U.S. citizen. Is this statement in the same class as an Elvis sighting? Or if it is true, what impact would ITAR have on foreign nationals working for a US company involved with export restricted crypto? > >Please don't get carried away and turn this into a Net rumor. I'm just curious if anyone on the list can confirm or deny the citizenship comment. Jim Bidzos is a US Permanent Resident Alien and Greek citizen. He has a Green Card. It doesn't have any ITAR impact, since the ITAR term 'Foreign Person' doesn't include Green Carded Resident Aliens. It probably wouldn't have any impact anyway, since he's a business weenie, and not a software weenie. Now, if he had a _programmer_ that wasn't a US Citizen, that would be a-whole-nother kettle of fish. He's previously stated that he would become a US Citizen, if it were not for the fact that Greece would require him to give up his Greek (and hence his EC) citizenship. See Simson Garfinkle's book on PGP for more details. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFMZFI4k1+54BopBAQGK7gP+Oq+FjqjCeQziC16Ryq64i1tXMAhV/jaX 86TBumss/GPpaVfLGtDS3FZARK9eTo4gVPTfABtvIa/u6QzZGL9zCT5z5nWT5QJ4 Koj5jnGsnNpXx3YGa1bJfZOI4ctkRovPWpyPa4jWOEooJz5UbvCCwGW/YoYMlvCs sQ//Qs7uDPs= =ARLj -----END PGP SIGNATURE-----

1 0

You really do want to volunteer, don't you?
by Tim May 17 Dec '03

17 Dec '03

Oh, I left out one of the best examples of this Orwellian doublethink about what "voluntary" means. Item: "You may volunteer to let the nice officers boarding this bus search your bags without any kind of search warrant or probable cause. Most of you will readily volunteer, as you "have nothing to hide." However, failure to volunteer will then mark you as a probable hider of something, and the police officers will then have "probable cause" to search your bags. Have a nice day." This was an actual case, heard by the Supreme Court several years back. Bus passengers were given the opportunity to volunteer, as noted. Failure to volunteer was construed as probable cause that contraband was present. (No, I don't know the name of the case. My recollection is that it took place in Florida or one of the Carolinas. Nor do I recollect how the Supremes decided the case....I can hope they ruled it a clear violation of the Fourth. But I don't remember. Regardless of the outcome, for now, it shows the Orwellian concept of "mandatory voluntary" at work.) --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

not a flame please re
by damion.furi＠the-matrix.com 17 Dec '03

17 Dec '03

A|i know this is unpopular but i wish someone would respond the the points You're going out of your way to be an asshole and you're surprised that you're being attacked? If you don't want to be flamed, turn off the flamethrower, shut down the bulldozer, and use a reasonable tone. |rather than flaming me. pat farrel is the only one of you with the balz |to try to defend himself insead of attacking me. and you attack me for |being anon. i love it. cypherpunks yea right. Anonymous doesn't mean anything except that you don't have the "balz" to stand up for the beliefs you're espousing. A|wei dai patents algorithms - for microsoft!!!!. that should |fucking help us a lot. whos he gonna sue first? If the patents aren't valid, they won't stick. What are you bitching about? A|according to sci.crypt mat blaze can prove that clipper has no back |door. right. that sure helps us. david sternlights new hero. Maybe it doesn't. Not that it matters. The only reasonable working assumption for Clipper (or anything like it) is that it _does_ have at least one back door and that it will be abused. What's new about this? Again, what are you bitching about? Sternlight's an idiot, use your head. A|pat farrel signs up with the nsa to make the key escrow rules easier |for us morons to understand. hey thanks. maybe theyll give you a |nicer room in the concentration kamp. <shrug> I'm not going to participate in an escrow no matter how easily the rules are understood. I'm not going to participate for any reason. But I can feel that way without jumping down Farrell's throat over it. After all, he's not my spokesman. A|a whole shitload of socalled cypherpunks jumping over each other to help and |defend him. That's not what I saw. I saw a whole shitload of cypherpunks jumping over each other attacking you, not defending him. A|bruce schneier is copyrighting crypt programs and |threatining to sue people who use it. So? His programs, his rules. If you used one of my programs without a license, I'd sue you, too. A|even phil zimmerman is selling the rights to pgp. what about all the people w | contributed code (like me). not a dime for us because phil is famous |and your not alowed to say anythingn bad about him. sorry i forgot phil is go |no one dares to complain. ask phil about me and when i asked about sharing |profits from the code i conrtibuted. also about the deal with |r.f... You weren't expecting money when you contributed code. What changed? A|lets get back to being punks. fuck these traitors. do crypto and fuck the nsa Random defiance won't get you anywhere you want to be. :----------:----------:----------:----------:----------:----------:----- : furi(a)the-matrix.com | pgp-public-key(a)demon.co.uk | LIVE LION ALERT : 2.6.2 1024/C1225CE1 | 38 11 7C 59 FB F3 7C C0 F7 E9 67 1F AF B8 2D 94 PGP: When it's none of their damned business. --- þ SPEED 2.00 #2640 þ

1 0

Nice Guys
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

NY Times, Sept. 10, 1995. The Decline of the Nice-Guy Quotient By Daniel Goleman Contrary to conventional wisdom, nice guys do finish first. The trouble is, nice guys are harder and harder to find. Amid the agonizing over standardized intelligence tests comes a new problem to worry about. Psychologists seeking a broader measure of intelligence, one that accounts for the personality traits that seem to predict success better than IQ alone, have discovered that a newly minted virtue they call "emotional intelligence" is declining as well. A recent study done at Bell Laboratories the high-tech think tank near Princeton N.J., found that the most valued and productive engineers -- at least among electrical engineers working in teams of up to 150 people -- were not those with the highest IQs, the highest academic credentials or the best scores on achievement tests. Instead, the stars were those whose congeniality put them at the heart of the informal communication networks that would spring up during times of crisis or innovation. When these likeable engineers hit a snag and E-mailed for help, they got an answer instantly; when others less gifted in interpersonal realms sent similar messages, they sometimes waited days or weeks for a reply. The standouts excelled in rapport, empathy, cooperation, persuasion and the ability to build consensus among people. The new term for these traits is emotional intelligence, which, in addition to the social graces, includes the ability to read one's own feelings, to control one's own impulses and anger, to calm oneself down and to maintain resolve and hope in the face of setbacks. To predict the success of a financial analyst or geophysicist, IQ is still crucial. But within a pool of high-lQ people, those with high emotional intelligence will have an extra competitive edge. Emotional intelligence, like self-knowledge and personal charisma, has long been seen as ineffable, more the stuff of poets and philosophers than psychometricians. And yet, despite all that, the measuring has begun. In the mid-1970s, and again in the late 1980s, Thomas Achenbach, a psychologist at the University of Vermont, had thousands of American children assessed by their parents and teachers on a behavioral checklist. He found that over the course of that decade and a half, America's children, on average, had become more anxious and depressed, more impulsive and mean, more demanding and disobedient, more hot-tempered and aggressive -- and not just in beleaguered urban neighborhoods. The study found growing emotional deficits even among the children of the wealthiest suburbs. Although the scores were worst for the poorest children, the rate of decline was the same for all, privileged and impoverished alike. Apparently, students continue to be receptive even into their teen years. Neuroscientists have found that the centers in the prefrontal lobes that control emotional impulse are among the last parts of the brain to reach full maturity, sometime in mid- to late adolescence. Now, at last, from the emotional literacy front there is some promising news: Children in the courses show marked improvements in the ability to control their impulses, show empathy, cooperate with others, manage anger and anxiety, focus on a task, pursue goals and resolve conflicts. Delinquency, fights and drug use drop. And there is an added bonus: achievement test scores rise too. ------

1 0

Re: Information
by scuttle＠alias.cyberpass.net 17 Dec '03

17 Dec '03

At 08:00 PM 9/1/97 EDT, Dr.Dimitri Vulis KOTM wrote... >Dave K-P <k.p(a)snet.net> writes: > >> > > > Information, please! >> > > Dont go swimming on a full stomach. >> > Don't "escrow" your keys. >> Don't take advice from strangers. >Don't ask, don't tell. Don't eat yellow snow.

1 0

question about reputation
by Wei Dai 17 Dec '03

17 Dec '03

In an economy based on positive reputations, how does one acquire a reputation capital? One way may be to initially perform services at a price below cost, but this has some problems. For example, Alice starts a anonymous consulting service, and announces that she will answer the first ten queries for free. Upon hearing this, Mallet immediately starts another consulting service, and announces the same offer. At this point Mallet can simply forward his customers' queries to Alice and Alice's answers back to his customers. Thus, he gains reputation at no cost. On the other hand, this "man-in-the-middle" attack can also work against conventional True Name based services, but perhaps with less effect. Has anyone ever heard of this being done? Is there a better way to acquire a good reputation? Wei Dai

4 5

Re: not a flame please read and think about this
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Anon writes: > i know this is unpopular but i wish someone would respond the the > points rather than flaming me. Fair enough, try these... > wei dai patents algorithms - for microsoft!!!!. that should > fucking help us a lot. whos he gonna sue first? Shame it got patented, one more patent. Patents are a mess, ick! > hey i think ill patent xor!!!! and give the patent to the nsa!!! I was kind of wandering if it would be necessary to patent something just to ensure someone else did patent *your* idea, if you came up with one. Or can you publish, and then say that's prior art, so no one else can go patent your idea. Otherwise it would be kind of cool for cpunks to be holding a few patents themselves, allowing free use, just to stop some "hmm lets see what we can patent this week", and "lets patent their work cos they haven't yet" types stealing stuff, and disabling a whole section of work. Chaum's got lots of nice technology, but his patenting and $150k price tag might not be doing him favours. Unless he really does manage to pull some big banks or something. I reckon the netscape model is a good one, give stuff away to the educational lot, sell things cheap, have free demo versions, get the standard first before charging a ransom. Guess he knows what he's doing tho. I hope so for the sake of the future of anon ecash. Be a shame if some of these lame things which claim to be ecash but are really checks with full audit logs, or credit card transactions in disguise become the defacto standard. Problem is no one stands much of a chance unless a radically new method of ecash can be had, he has his patents cover blind sigs? I guess they don't cover blind sigs in general because Brands has applied for patents on his improved blinding techniques. > according to sci.crypt mat blaze can prove that clipper has no back > door. right. that sure helps us. david sternlights new hero. That interpretation was argued. But it's interesting anyway, if a MKCS is equivalent to a PK, and PKs are computationally expensive, and clipper chips are cheap, well hey maybe that's what it does mean, and they wouldn't want to have a weak backdoor in the sense of a weak algorithm, as it may come to light some day, similarly eventually the thing would surely get reverse-engineered, they wouldn't want to be caught out, I'd have thought. They don't need that for a backdoor, they've already got the front door - a copy of all the keys. > pat farrel signs up with the nsa to make the key escrow rules easier > for us morons to understand. hey thanks. maybe theyll give you a > nicer room in the concentration kamp. I found it real informative to have a first hand report of what was going on. I don't see anything wrong with going along to the meeting just to throw your spanner in the works, sounds like the govt types didn't have an easy time of it. They're clearly asking for things which are unacceptable to industry, and cpunks alike. A lot of the stuff Pat wrote up about the NIST meeting sounded like the majority of the attenders were trying to convert a government request for GAK into a CKE discussion. Would be a cool switch. > a whole shitload of socalled cypherpunks jumping over each other to > help and defend him. Well you did ask :-) > brian davis trys to convinice us that key escrow isnt so bad (who > signs your paycheck davie?????) Not sure that there was a motive attached (I could be wrong?), seemed like a provoking question to me. Got some interesting replies. > that guy from rand corp tells us words of wisdom from robert morris > the nsa guy as if we should write them down and pray three times a day > to them. I always kind of like to hear what ex-NSA types are reported as saying, it's quite fun because you never know if they are still on the payroll and feeding you a story for ulterior motives, or if they are making a statement which they think is to their advantage to scare you, or if they really are ex-NSA and are just saying what they can, being helpful, without getting in hot water with the secrecy stuff they have to agree to. > carl elison designs key escrow for tis and acts like hes one of us. Designs CKE, CKE is fine by me, it's voluntary, and just the software equivalent of having a spare key for your own use. GAK is the evil one. > bruce schneier is copyrighting crypt programs and > threatining to sue people who use it. Let's tackle one thing at a time ok? Lots of folks would agree patents are bad news, at least the state of them in the US with idiots patenting XORed cursors, etc. Clost to unanimous on GAK being evil incarnate. Copyrights, well GPL, ILF, RMS says programs should be free. Indeed long term copyrights look like endangered species, if crypto anarchy has it's say. But it's a tricky one because a lot of people make their money writing applications, and they don't want to vote themselves out of a job. If crypto anarchy long term proves copyrights to be outmoded, well the market will change. > even phil zimmerman is selling the rights to pgp. what about all the > people who contributed code (like me). not a dime for us because > phil is famous and your not alowed to say anythingn bad about > him. sorry i forgot phil is god. no one dares to complain. ask phil > about me and when i asked about sharing profits from the code i > conrtibuted. also about the deal with r.f... Wouldn't be much to go around if all the contributers got a share, there were lots of contributers. He's the one taking the rap anyway, and the guy who made it all possible. > lets get back to being punks. Cpunks write code, so lets do it! And lobby, and analyse govt polices, and educate about crypto, and attend govt run white-washes (NIST etc) to register their protest. > fuck these traitors Nah. Crypto anarchy and all that, it's an anarchy, you ain't going to find 2 cpunks with exact identical view points on all topics. Most of the people you complained of to my understanding have done a lot of work for the cpunk causes, as well as their implied copyright/patent crimes. > do crypto and fuck the nsa. Sounds cool to me. So whats the plan of action? People have different ideas, but they're all fighting for the same cause. Down with GAK, being the #1 target at the moment. Privacy from governments, scaling down of hugely bloated governments, malign cancerous growths that they are becoming these days, freedom is what it's all about. Adam

1 0

Re: You really do want to volunteer, don't you?
by Greg Broiles 17 Dec '03

17 Dec '03

At 11:38 PM 9/1/97 -0700, Tim May wrote: >This was an actual case, heard by the Supreme Court several years back. Bus >passengers were given the opportunity to volunteer, as noted. Failure to >volunteer was construed as probable cause that contraband was present. > >(No, I don't know the name of the case. My recollection is that it took >place in Florida or one of the Carolinas. Nor do I recollect how the >Supremes decided the case... This sounds like _Florida v. Bostick_, 501 U.S. 429 (1991), on the web at <http://www.findlaw.com/scripts/getcase.pl?court=US&navby=case&vol=501&invol =429>. Bill Stewart's summary of the case looked like a good one to me. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Re: not a flame please read and think about this
by Rich Salz 17 Dec '03

17 Dec '03

>I was kind of wandering if it would be necessary to patent something >just to ensure someone else did patent *your* idea, if you came up >with one. Nope. >Or can you publish, and then say that's prior art, so no one else can >go patent your idea. This works. IBM used to have publish a monthly journal (I forget the name, it came out of one of their Yorktown labs) that did exactly this kind of thing for exactly this kind of reason. ACtually, they wrote about stuff that they thought was 5-10 years away. >> even phil zimmerman is selling the rights to pgp. what about all the >> people who contributed code (like me) ... . ask phil >> about me and when i asked about sharing profits from the code i >> conrtibuted. also about the deal with r.f... Mr/Ms. Anonymous is lying. His/her name appears nowhere in the credits, and his/her code appears nowhere in any PGP release. Don't waste any neurons on it. /r$

1 0

Re: You really do want to volunteer, don't you?
by Tim May 17 Dec '03

17 Dec '03

At 12:12 AM -0700 9/2/97, Greg Broiles wrote: >At 11:38 PM 9/1/97 -0700, Tim May wrote: >>This was an actual case, heard by the Supreme Court several years back. Bus >>passengers were given the opportunity to volunteer, as noted. Failure to >>volunteer was construed as probable cause that contraband was present. >> >>(No, I don't know the name of the case. My recollection is that it took >>place in Florida or one of the Carolinas. Nor do I recollect how the >>Supremes decided the case... > >This sounds like _Florida v. Bostick_, 501 U.S. 429 (1991), on the web at ><http://www.findlaw.com/scripts/getcase.pl?court=US&navby=case&vol=501&invol >=429>. > >Bill Stewart's summary of the case looked like a good one to me. Thanks, I guess, to all of you who sent further information on this case. I'm chagrinned at this repetitive pattern, though: all it takes is a "I don't remember" for a thread to be completely dominated by helpful comments, clarifications, etc. (Ditto for any question even remotely impinging on financial or tax advice, which is why I almost always include requests that helpful tax advice not be sent to me. I can't seem to mention tax issues without a bunch of helpful souls sending me their ideas on how to beat taxes by incorporating myself in Andorra and then hiring myself as a consultant to the Andorran embassy in California, or whatever.) One strategy I've considered is to never, never, ever admit that I don't know something, as this will forestall the corrections, expansions, clarifications, and citings. Or to express things more elliptically. It pays to be Young. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Senate Bill 974?
by David Neal 17 Dec '03

17 Dec '03

Haven't seen it discussed here, but the August 28, 1995 issue of Lan Times covers Sen. Charles Grassley's (R-IOWA) Senate Bill 974. Frankly, you should probably read the text of the bill itself, because the article doesn't seem to get the facts straight. The article asserts first that the bill may outlaw any non-GAK encryption, but then quotes the senator as saying ``All my bill does is say you can't use computers to steal, to threaten others or conceal criminal conduct.'' Perhaps concealing criminal conduct is considered using non-GAK. The quote from the bill itself reads like the ITAR; it is illegal to ``distribute computer software that encodes or ecrypts electronic or digital communications to computer networks that the person knows, or reasonably should know, is accessible to foreign nationals and foreign governments, regardless of whether such software has been designated as nonexportable." The article also says that up to 64 bit keys may now be allowed in exportable software, but that ``some experts'' suggest that those keys may have to be GAK. I've never heard anything BUT the keys would have to GAK. David Neal <dneal(a)usis.com> - GNU Planet Aerospace 1-800-PLN-8-GNU Unix, Sybase and Networking consultant. "...you have a personal responsibility to be pro-active in the defense of your own civil liberties." - S. McCandlish

2 1

RE: 64 bit crypto
by John A. Limpert 17 Dec '03

17 Dec '03

Couldn't we modify RC4 easily to provide the same security against brute-force attacks by just running the key-setup phase 65536 times instead of just once? Why would the attacker need to run the key setup 65536 times?

1 0

IP6_pi2
by John Young 17 Dec '03

17 Dec '03

IEEE Spectrum, September, 1995: Excerpt on Net security from "Upgrading the Internet," a roundtable discussion of the Internet Society on the next generation of Internet protocols, IP Version 6. Discussants: Vinton Cerf, Stephen Deering, Christian Huitema, Haruhisa Ishida, Larry Landweber, Eric Schmidt, Lixia Zhang. A most important aspect of the IPv6 is the somewhat controversial decision to require that all v6 implementations support strong privacy and strong authentication. At this level, all of the security problems won't be solved, but we can authenticate and maintain privacy of packets that flow from one machine to another. This will eliminate many security threats in the current Internet, such as source-address-spoofing, source-related routing attacks, password sniffing, connection hijacking, and so on. New Scientist, Sept 9, 1995: "Watching you, watching us." Companies that sell electronic surveillance equipment to repressive regimes face the prospect of being "outed" on the Internet this autumn. Two electronic watchdogs, the British group Privacy International (PI) and its American sister organisation the Electronic Privacy Information Centre (EPIC), are setting up an offshore Internet site that will name companies that sell electronic instruments of repression to governments with poor records on human rights. IPI-pair: IP6_pi2 (13kb)

2 1

NSA/NIST Security Lab
by John Young 17 Dec '03

17 Dec '03

NSA and NIST will set up a new lab for evaluation of information-security products, including crypto algorithms: http://jya.com/nsa-nist.txt The lab will coordinate with other nations. Plans include eventual shifting the evaluation to private testing labs once accreditation standards are set. With critiques by Bruce Schneier and Steve Walker, and a slap from NCSA, which now provides testing, "They've been talking about this stuff for years."

5 4

Re: Wearing RSA shirt to school
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim wrote: <snips throughout> >At 4:43 AM 9/4/95, Futplex wrote: >>I wrote: >>> With respect to possession within the U.S., there aren't any >>> laws stopping you from waving strong cryptography around wherever you like >>> (at least, not yet). >> >>---- >>...and in private email, Jim Ray pointed out that showing the shirt to a >>foreign national might technically violate ITAR... > >Nope, no more so than letting a foreign national read Schneier's book is a >violation of the ITAR. If you dispute this, ask whether Schneier's book is >banned from export (the book, not the optional diskette). It isn't. Nor are >other cryptography _books_ banned from export. The law doesn't have to be consistent, or to make sense, or be enforced evenhandedly. The law is, after all, not written, or interpreted, or enforced, by partisan Libertarians like me. My private email to Futplex said *may* violate... and I stand by it. [IANAL, though.] Whether or not a law as incontrovertably stupid as ITAR is enforced may depend on the timing of the next election, as we seem to be witnessing in the limbo-state of PRZ. >I'm not minimizing the issue of export of machine-readable code, as in >diskettes. But to claim that a blurry, printed on cotton "barcode" is even >remotely in the same class as exporting a workable set of cryptographic >system routines, or that letting a furriner merely "gaze upon" this blurry >barcode, is a violation of the ITARs is laughable. Yes, but *many* laws are laughable. >>Yeah, I suppose I overstated it a bit. It appears that if the ITAR do cover >>the shirt (unclear at present, AFAIK -- any news on the CJR, Raph ?), then >>flashing it at a furriner could constitute a violation. Thanks for the >>correction. Actually, it was less a correction than me pointing out (yet another) note of uncertainty. James Madison, in Federalist #62 said it best: "What indeed are all the repealing, explaining, and amending laws, which fill and disgrace our voluminous codes, but so many monuments of deficient wisdom." Now, many of us would be more than satisfied to get back to that level of government. I suggest that everyone go have a look at the entire Code of Federal Regulations, before the next election. <g> >the original questioner need not fret about his son wearing the >>shirt to school. I agree that wearing it through Customs on the way to Jamaica would be more problematic, but I live next to a US Customs agent, and he learned about ITAR from me. Here in Miami, Customs has plenty to think about with the various (occasionally venomous) inbound cargo. >It was this series of posts about whether wearing the "munitions t-shirt" >near schools was a crime or not that made me think the silly season had >arrived. It has, a long time ago. Ever watch C-SPAN? JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMEro1W1lp8bpvW01AQHKsgP/bhOcCUoksLvbGe/nAKxDqZU8KvibvRFm nQ++Xy3FjDDJrFg1/lgmivtrriuFK/xg4CvKdu+yQ6zJ72pH+92cLivsfHeg+ljZ MPSXfHftaOP7i1e4KajnlC3jBcYbWQnqZRdduIyPXZnfn5xK5bU99c5oceCABtSx UD/Hp9Poqbc= =7tMD -----END PGP SIGNATURE----- Regards, Jim Ray See, when the GOVERNMENT spends money, it creates jobs; whereas when the money is left in the hands of TAXPAYERS, God only knows what they do with it. Bake it into pies, probably. Anything to avoid creating jobs. -- Dave Barry ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James M. Ray <liberty(a)gate.net> ------------------------------------------------------------------------ Support Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf ________________________________________________________________________

3 2

Senate Bill 974
by David Neal 17 Dec '03

17 Dec '03

Senate Bill 974 The full text is difficult to interpret since it mostly just amends other law. Essentialy the law makes illegal: using a computer for racketeering purposes, threatening to destroy data, transferring of unlicensed software, using any method to hide illegal funds transfer, and exporting crypto software. (Relavent bits are included below). The law also expands wiretapping authority, and seems to allow electronic evidence found during a search to be introduced as evidence. You'll have to insert the text of the bill into the real laws to get full context. `(2) to distribute computer software that encodes or encrypts electronic or digital communications to computer networks that the person distributing the software knows or reasonably should know, is accessible to foreign nationals and foreign governments, regardless of whether such software has been designated as nonexportable; `(3) to use a computer or computer network to transmit a communication intended to conceal or hide the origin of money or other assets, tangible or intangible, that were derived from racketeering activity; and `(4) to operate a computer or computer network primarily to facilitate racketeering activity or primarily to engage in conduct prohibited by Federal or State law. `(b) For purposes of this section, each act of distributing software is considered a separate predicate act. Each instance in which nonexportable software is accessed by a foreign government, an agent of a foreign government, a foreign national, or an agent of a foreign national, shall be considered as a separate predicate `(c) It shall be an affirmative defense to prosecution under this section that the software at issue used a universal decoding device or program that was provided to the Department of Justice prior to the distribution.'. David Neal <dneal(a)usis.com> - GNU Planet Aerospace 1-800-PLN-8-GNU Unix, Sybase and Networking consultant. "...you have a personal responsibility to be pro-active in the defense of your own civil liberties." - S. McCandlish

1 0

Re: Information
by Ross Wright 17 Dec '03

17 Dec '03

On or About 2 Sep 97 at 14:27, Sandromar Ferreira wrote: > > >>>> > > > Information, please! > > >>>> > > Dont go swimming on a full stomach. > > >>>> > Don't "escrow" your keys. > > >>>> Don't take advice from strangers. > > >>>Don't ask, don't tell. > > >>Don't eat yellow snow. > > >Don't spit, just swallow. > > Don't touch anything. Don't play with that, you'll shoot your eye out. =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: (408) 259-2795

1 0

NIS&T Key Escrow Export kangaroo conference
by Bill Trost 17 Dec '03

17 Dec '03

Pat Farrell's summary of the NIS&T conference (thanks for the report, by the way!) discussed a bunch of "criteria" that an "acceptable" GAK system should provide, including a couple that are supposed to limit the ability of law enforcement to use keys beyond the bounds of the search warrant. Another criterium that needs to be brought up (although I'm not sure of how one would phrase in a way that is either clean or polite) comes out of a debate between Philip Zimmermann and Dorothy Denning I ran across at one point: "How can a GAK system be arranged so that some future Congress cannot destroy the protections of the split-"escrow" system by issuing a resolution like 'All key components of suspected Comm^H^H^H^H terrorists shall be provided to the House Committee on Unamerican Activities'?" The links to McCarthyism are important here. GAK proponents can't claim this kind of thing won't happen -- it *has* happened, and could easily happen again. Anyone who claims otherwise is either terribly naive or is being outright misleading. In some sense, this criterium goes to the very heart of the whole GAK question -- even if you believe in the allegedly legitimate power of law enforcement to look through people's love letters, the "safety mechanisms" for the keys are nothing more than a set of flimsy policies that Congress could toss aside the next time something scary comes along. The protections that the GAK proponents are proposing (and proponing (-: ) are frightfully ephemeral. By the way, I'm a few days behind, so sorry if this is "old mail".

1 0

Digital Fingerprinting
by cman＠communities.com 17 Dec '03

17 Dec '03

A couple of threads have recently touched on aspects of "digital fingerprinting", a term that covers a variety of methods for making changes to digital documents in order to trace the origin of illicit copies. This subject has been on my mind after several discussions on this topic at Crypto, as well as the one formal presentation on the subject. Here are some of my thoughts on this subject: o If the domain of changes is well understood, and can be altered without significant loss of quality, then it is trivially easy to remove the fingerprinting. In other words, if you know the algorithm used to create the fundamental codewords in the fingerprint, and you can overwrite arbitrary codeword bits with other codeword bits, then the scheme can be avoided without collaboration of any kind. Example: A software company fingerprints its software by mapping two equivalent machine instructions onto binary "0" and "1", respectively. Someone who knows about this could randomly replace one instruction with the equivalent one, which would reduce the fingerprint to noise. Example: A publishing company uses an even number of points between paragraphs to indicate "0" and an odd number of points to indicate "1". Someone who understands this can overwrite the fingerprint as above. o If a fingerprinting scheme depends on the secrecy of an algorithm, then this is really "security by obscurity", which may be effective for a period of time, but is likely to meet the fate of most copy protection schemes that have rested on raw obscurity. o Certain domains of information lend themselves to the secure formation of fingerprint "bits" that are very difficult to scrub in this way. One such scheme was used as the basis for the presentation at Crypto: imagine that a film was shot with two (or N) cameras. For each frame of the film, the distributor can chose to take a frame from a different camera. Frames from camera 0 would be mapped onto binary "0", frames from camera 1 would be mapped onto binary "1". Using this approach it is possible to construct schemes that are resistant to collaboration up to "N" people. The security of such schemes rests on the assumption that given one frame, it is very hard (and possibly intractable) to fuzz up the frame such that the parallax information doesn't give away which camera shot the frame. Rather than hiding the fingerprint information in the "low bits", this technique hides the information throughout the picture. In one sense, a 2D picture of a 3D object is similar to a one- way hash function. It is a form of lossy compression on the 3D object that is impractical to work backwards. o Note that overwriting a fingerprint with random noise (or whatever) does not generate a valid replacement fingerprint. Therefore it would still be possible to tell that a document had been tampered with (and was not a valid copy), even if its provenance could not be determined. o A number of people are working on "black box" viewer technology, which would allow people to purchase documents that could only be read on devices with tamper-resistant hardware in them that would be required to decrypt media. Certainly much piracy could be done by capturing the output of such a box (unless it was embedded in a tamper-resistant chasis); there are some proposed schemes for reducing the payoff of output capture, but they depend on a similar approach to the movie fingerprinting idea above -- the base data format is somehow richer, possibly capable of generating different output under different circumstances or on different hardware platforms, while the output of the black box represents only one view of the base data. Example: a base format for a 3D object is encrypted with a public key resident in the "black box". Said black box also includes a hardware 3D rendering engine. The output of the black box consists of a series of 2D frames, which may make it impractial to reproduce the base 3D object. It is my considered opinion that this sort of technology will meet with tremendous customer resistance, and will not prove practical or cost-effective; many analysts are predicting a trend toward more general purpose computers for media viewing rather than towards specialized hardware that is needed for this kind of approach. o There are also some profound practical and legal problems with the use of digital fingerprinting. For one thing, it involves generating a unique copy of every document for each consumer. After the digitial fingerprinting session at Crypto, a guy from Microsoft was pointing out the incredible difficulties posed by trying to fingerprint, say, every copy of Windows 95. On the legal front, it's not clear what you can do to someone even if you _can_ prove that the 100,000 pirate copies of Windows 95 circulating in Amsterdam stemmed from his copy. Machines get hacked, co-workers and family members often have free access to machines running software -- it's not clear that media companies _want_ to invoke the paranoia associated with potential responsibility for millions of dollars in damages if someone makes an illegal copy of one's software and the loaves and fishes ensue. [Imagine what great revenge this would make for jealous co-workers, ex-wives, etc.]

1 0

Crypto Bill HR 3011
by John Young 17 Dec '03

17 Dec '03

MSNBC reports today that one of the bills coming up in the congressional session is "H.R. 3011, an encryption bill which favors stripping all export restrictions and opposes any key escrow requirements." We've not been able to find this bill in the usual gov sites. Assuming that MSNBC got the info right, pointers to the bill would be appreciated.

2 1