December 2003 - cypherpunks-legacy

Re: Another Motivation for the CDA (Federal Sentencing Guid
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-03-09 03:42:04 EST, you write: >And the guys who just got busted for having fertilizer, diesel oil, >and drugs on their farm had a whole three ounces of marijuana and >personal-use quantities of crank. Maybe they were planning to blow up >buildings rather than stumps; but the Feds are trying to paint them >as max evil just to build up their case. Who says they were going to blow anything up? It is perfectly legit for farms to have large quantities of fertilizer around--they use it all the time. Same with diesel fuel--what are they supposed to run the tractors and combines with? Dog piss? DUHHHH! As far as having the instructions for mixing them to go boom, who the hell made that a crime? You could bust most of the farmers in this country if you criminalize simultaneous posession of fertilizer and diesel fuel. Did these people ever actually mix any of the fert. and fuel together? Did they threaten to blow up anything? This whole situation is nothing more than jackbooted thugs getting a rush by stomping on people. FTJBT Jonathan Wienke

1 0

Re: Encrypted Communications Privacy Act of 1996 (fwd)
by Bill Stewart 17 Dec '03

17 Dec '03

>> S 1587 IS >> 104th CONGRESS >> 2d Session >> To affirm the rights of Americans to use and sell encryption >> products, to establish privacy standards for voluntary escrowed >> encryption systems, and for other purposes. >> IN THE SENATE OF THE UNITED STATES >> March 5, 1996 >> Mr. LEAHY (for himself, Mr. BURNS, Mr. DOLE, Mr. PRESSLER, and Mrs. MURRAY) ^^^^^^^^ Interesting that Bob Dole is supporting it! It's certainly not a perfect bill, and will presumably be less perfect by the time it's passed. But it's a nice alternative to Clinton, who was happy to buy in to the previous Administration's anti-crypto efforts. (I'll presumably be voting for Harry Browne or some other Libertarian, unless I get fed up and vote for Frank Zappa or Hugh Romney; the Democrats can look me up some year if they decide to run a genuine liberal :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

keystroks
by sakarias＠tripnet.se 17 Dec '03

17 Dec '03

Is there anbody out there happens to now a keystroke recorder thats record keystroks from dos to windows. please contact me if you know. "It is the real, and not the map, whose vestiges subsistr here and there, in the deserts which are no lionger those of the Empire, but our own. The desert of the real itself." J. Baudrillard

2 1

re: FCC & Internet phones
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:12 PM 3/9/96 -0500, Padgett Peterson wrote: > >"Long-Distance Dueling. Free Dialing Via Internet Faces a Challenge From > >Small Phone Firms." > You seem to forget that the Internet is just about the *only* electronic > communications media not controlled/licensed by the FCC in the US. The > FCC also prohibits use of cryptography by those with amateur licenses. Oh, we remember it :-). But actually, large chunks of the Internet's facilities _are_ on controlled or semi-controlled media, such as frame relay (which the Feds just insisted had to be tariffed) or local private-line (which is often regulated by state PUCs.) But in those cases, the regulation is at the price/quantity/schedule layer, rather than the content layer. And according to someone I talked to recently, the Network Access Points, MAE-East/West, (though not CIX), are still NSF-funded, even though they're often built and run by folks like PacBell - I'd thought we'd gotten rid of those guys a couple of years ago except for the NIC and Internic. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

RE: Petty Civil Disobedience
by blanc 17 Dec '03

17 Dec '03

From: jamesd(a)echeque.com Major problem here is that ten million horny geeks are likely to bring your server to its knees, but if one only has one image, and it is moderately small, say thirty thousand bytes, perhaps the flood would taper off eventually. ................................................................................... Here James has stated the crux of the problem in its basic, elementary form. Why cannot legislators, the courts, and all those socially responsible individuals promoting the CDA and their other complaints against indecency recognize the obvious: that the problem of the presence of (and the success of) alarmingly objectionable material on the internet is all due to the existence of all those "ten million horny geeks", who en masse can actually "bring servers to their knees". I think this is a Male vs Male problem, and personally I think the mature and wise men of the world should take the case in hand and deal with it on a Man-to-Man basis. Or, they could just adopt Assassination Politics and do away with all those "other people's" (horny) internet-addicted male children. (Ha-ha. Really, Jim - any "democratic society" where one group elects a governor and another group votes to to shoot that person down sounds more like a Bosnian/Serv "society". It wouldn't make sense to become a member of such a disfunctional, self-defeating group of misfits in the first place.) .. Blanc

1 0

Re: Cryptanalysis
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:37 AM 3/10/96, Adam Shostack wrote: >Timothy C. May wrote: > >| cryptanalysis. (Not to sound harsh to Allen, but why would anyone ask here >| on the list for recommendations to such a standard subject when Schneier, >| Garfinkel, Denning, etc. all have books listed?) > > Niether Schneier nor Garfinkel really talk about analysis. >The only book I can think of is Biham's "Cryptanalysis of the DES," >and thats on a single technique. I said "....all have books listed," not that they are textbooks on cryptanalyis. My point was that Schneier, for example, has extensive bibliographic pointers. For example, and relevant to another recent thread, Ref. 355 (1st Ed.) is to Friedman's "The Index of Coincidence and Its Applications in Cryptography," 1920. And more Friedman, and Biham, and even reference to our very own Bob Baldwin's Crypt Breakers Workbench (dare I point out that this is probably a very educational tool for those seeking to play with cryptanalysis?). Likewise, Garfinkel gives a bunch of pointers. (Not that I hold it out as a textbook on crypto, but it's one of several recent semi-popular crypto books.) (And in recent days there have been pointers to the Aegean Park Press series of books, available at "Computer Literacy" (http://www.clbooks.com/) and the database may be browsed, books ordered, etc.) (One more note. The question that came up recently about "does anyone know what the "index of coincidence" is?" is readily answered with Alta Vista. More than two dozen hits, including definitions, papers, homework assignments, etc. The point being that between the Web, search engines, archives, FAQs, searchable library catalogs and retail bookstore databases, and the many hundreds of books and papers listed in Schneier, there is no reason people need to say they "can't find anything.") > I don't know of any books on 'applied cryptanalysis.' The >public knowledge is all in the heads of a few practitioners, and the >papers they've written. > I think there's no single book on cryptanalysis for the various reasons I've mentioned recently. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: rhetorical trickery
by Deranged Mutant 17 Dec '03

17 Dec '03

"Vladimir Z. Nuri" <vznuri(a)netcom.com> wrote: > >> but I have a question: how did they know it was his diary? > > > >If I remember some earlier discussion about that case from a few years > >ago, the file was called "diary.pgp". > > how did they know it was *his* diary? Well, nobody *knows*. But if you've got a file called diary.pgp on your hard drive, chances are it's a diary of some sort. It's a reasonable guess. Whether there's anything incriminating in it for him or anyone else is another matter, of course. Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

2 1

Re: Leahy bill nightmare scenario?
by Dan Weinstein 17 Dec '03

17 Dec '03

On 9 Mar 96 at 9:26, you wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > At 12:19 PM 3/8/96 -0800, Dan Weinstein wrote: > > > >> Second, if what they're charging is the hindrance of an > >> felony investigation, it isn't clear to me why they would be > >> limiting the charging of that "crime" to only those actually who > >> have committed a felony. (logic isn't the normal mode of thought > >> for a government employee, you realize.) > > > >I agree with your concerns here, but I find it hard to believe that > > the courts would allow a broader interpretation. > > Unfortunately, what you find "hard to believe" I find easy to > believe. Remember, if this bill is passes, it doesn't merely affect > YOU, it affects ME. So I suggest the burden of proof is on YOU to > show that these provisions aren't going to be maliciously > interpreted by the courts. Burden of proof? Sorry, I do not have to justify my views to anyone. I am trying to have a reasonable discussion of this issue, thus, the "burden of proof" lies equal on each of us. > >> Third, all they have to do is to "suspect" the person of a > >> felony, and a > >> "felony investigation" starts. That would presumably make him > >> guilty of the Leahy bill's provision, regardless of whether he is > >> actually participating in the crime supposedly being > >> investigated. > > > >Here you are dead wrong, the bill specifically states: "in > >furtherance of a felony." Its like those laws that let them charge > >someone with murder in the first if someone dies while you are > >commiting another felony. They must prove the original felony > >before they can get you on the murder one. The real purpose of > >this provision, as I read it, is to give longer sentences to > >criminals that use crypto. > > I'm not a lawyer, but I assume neither are you. Please explain the > LEGAL DEFINTION of "in furtherance of a felony." If you can't, then > you simply don't know how far they will go. And you're depending on > the reasonableness of the government for the interpretion. True, I am not a lawyer. I would like to hear from one of the lawyers on the list for a more deffinitively. Since you also admit you are not a lawyer, I do not accept your opinion as superior to mine. I was pointing it out as something that I believed you had missed. I find it hard to believe that anyone can further a felony when their is no felony. In addition, this is VTW's interpretation based on the analysis that they have posted to their home page. I would presume that they were using lawyers to analyze the bill. > >> Fourth, I gave what I considered to be a clear example of the > >> hypothetical misuse of an encrypted remailer by the cops, one > >> that would arguably make the remailer operator guilty of some > >> "reasonable" anti-kiddie-porn statute. At that point, _he_is_ > >> the target of the investigation. Unless you can show that this > >> kind of action by the government is impossible, I consider it to > >> be not merely possible but almost certain to occur. > > > >Again, the problem I see with your scenario is that I don't believe > > that the courts will interpret it that way. > > What you think is irrelevant. Most people probably didn't realize > what the government did in the Amateur Action BBS case was "legal," > either. But they did it anyway. Yes, this case was certainly a travesty. The thing about it was that it violated the law. Their actions took place in California, but they were tried in Tennessee. This is a violation of U.S. law. Again, this is my non-professional opinion, but I have heard several professionals proclaim that the governments actions seriously violated its own laws. If your point is that the government does not obey its own laws, then all I can say is that if that is how you feel then why oppose the bill? Won't they end up doing what they want anyway? > > > My interpretation is that > >if they serve a warrent and I don't decrypt for them and they can > >prove a felony, then I will be subject to the listed punishment. > > Are you assuming that you have the key? Remember, if you run an > encrypted anonymous remailer, and assuming you do it honestly, you > won't be keeping records as to the source of the note. > > Thus, if they "serve a warrant" and you CAN'T decrypt the message > (or tell them where it came from) then why aren't you already > guilty? Remember, the wording of the proposed law doesn't require > that you have full knowledge of the crime involved, merely that you > act "in furtherance" of it... If you don't possess the key, but > you explicitly ran your remailer so that you never it, just so you > couldn't relinquish it, you have structured your operation too > thwart any investigations. You are ALREADY guilty. This may not > sound reasonable, but the government no longer (if it ever did) > considers "reasonableness" to be an impediment to their actions. > I don't but this. If I am a reporter if I receive an anonymous tip, a court could order me to tell who my source was, but I couldn't and they couldn't do anything about it unless they could prove that I knew who the source was. If I knowingly aranged for the source not to reveal himself to me, could I them be charged with obstruction of justice or contempt of court? Again it is my non-profesional opinion, but I really doubt this. Comment from a lawyer would be appreciated. > > >> Fifth, it isn't clear what amount of knowledge is necessary to > >> "trigger" this clause, especially in its current flawed state. > >> Since ISP's and encrypted remailers might know, in general, that > >> their systems can and probably are being used for SOME criminal > >> activity, even if they can't identify it or the user, or decrypt > >> it, etc, a broad interpretation of the resulting law could easily > >> de-facto prohibit any business practices (i.e., allowing users to > >> use encryption) that prevents full-scale monitoring and/or > >> tracing. > > > >I disagree, it states you must "willfully endeavor" to use the > >encryption as a means of obstructing the investigation. To me, > >this means that it is the motivation for using the encryption. > > Question: What, exactly, is the motivation of a person running an > anonymous remailer? His motivation is clear: To allow people to > send anonymously untraceable messages. Assuming he's of ordinary > levels of intelligence or beyond, he is aware that somebody may some > day use his system for illegal purposes. You're going to have to > explain why a court _CAN'T_ interpret this as being in violation of > the law. > If I rent cars, someone might one day use a car rented from me in a robbery. Does that make my an accessary? NO. > > > If I set > >up an encrypting remailer for the purpose of allowing free exchange > > of ideas, I don't believe I would be liable under this law. > > Your optimism is touching. It is also vastly misguided. If you think I am optimistic, you must think just about everyone is an easy dupe. If I do not quite reach your level of paranoia, I apologize; I will try to get to where I distrust everyone like you. Or are you just plotting to make me paranoid? > >The > >only way I could see a remailer charged under this is if he had > >solid evidence that a specific user was violating the law, and took > >no action. > > Gee, I wish you were right, but my experience with government thugs > says that they will do anything they think they can get away with. > Their is certainly A LOT of that with in our government, but to claim everyone in the government is a jack-booted thug is just too far over the top for me. (Yes, yes I realize you think this is niave.) > > >> This is only the beginning of the problems with this section. If > >> you can explain why nothing I've described could possibly occur, > >> I welcome a contrary explanation. > > > >I see some real problems too, but I do not see the problems with > >this provision to be enough to condemn the entire bill. > > I don't "condemn the entire bill." I would, however, reject the > entire bill if that provision remains. And morever, if we make a > serious attempt to have it removed, the more they resist removing it > the more we should insist it go. I don't want it removed, I think it is an important bone to through to those in the middle. I would like the phrasing tightened up so that it could only be used against those that deserve it. > >I would like to > >see this portion of the bill ammended to make it clear that only > >those actually involved in commiting the felony would be held > >responsible. > > There would still be a problem. What's the definition of "actually > involved in committing the felony"? Are you aware, for example, > that manufacturers of small plastic screw-top vials have been > prosecuted and convicted simply because their vials could be used to > hold small quantities of drugs such as cocaine and crack? This was > a case from a few years back, BTW. I wish I could remember the > cite. I was not proposing that exact language, I am not a lawyer and don't imagine I could come up with the bullet-proof wording that is required. > If you're not aware of these things, WAKE UP! Your optimism > disgusts me, because it is entirely unrealistic and based on a > rose-colored-glasses view of the government. I am not aware of the vial case; I certainly would find such a thing interesting to read. If this was what happened, and laws exist that allow this, then we ought to repeal those laws, but I don't see the baring that has on this case; I have already said that they should narrow the language so that it will not be used to the ridiculous extream. > >> But I would also ask this: Why, exactly, do we need this > >> section? We've already been told that the opponents of this bill > >> will fight it tooth-and-nail under its current wording; if that's > >> the case then the presence of this section is inadequate to > >> appease their unhappiness. Therefore, we shouldn't include it in > >> the bill at all; it does no good. > >> > >> Any explanations, Dan? > > > >You are talking about the fringe, this, I think, was added as an > >attempt to bring in those that are in the middle. > > Why would "those that are in the middle" object to a bill which is > little more than a re-statement of rights we already believe we > have?!? I am not talking about reality; I am talking about what they can tell the voters if they are beat up over passing such a bill. You seem to over rate the average voters grasp of the issues. It doesn't matter that the bill really creates or diminishes crime, it is how the voters can be made to perceive it. > > That is, Those > >that see the need to prevent the use of encryption as a means of > >obstructing justice, but feel that we should also have a right to > >privacy. > > There is no viable middle ground here. Any tool can be abused. > If that is true, than you are left with those that are the oppressed and the jack-booted thugs. I do not believe that the only motivation of those that are opposed to strong encryption is to oppress me. Many are trying to do what they think is right, this provision is their to give those that are tetering between the two options an easy way to move to our side. > > > To say that there is no delema here is ridiculous, crime is > >a serious problem that we are already having a terrible time > >dealing with. > > On the contrary, my opinion is "The _government_ is a serious > problem that we are already having a terrible time dealing with." > Fortunately, I've found a solution, and the government is trying as > hard as it can to prevent it (and "crypto-anarchy" in general) from > taking root. > Good premise, now if you could sell that premise to everyone in Congress than your right this provision is useless. Unfortunately, I don't think you will have much luck with this. > > > I think Leahy realizes that this provision will be about as > >useful as the "use a gun, go to jail" laws, but wants to give those > > in the middle to say that they bill will help prevent crime. > > Ha ha! That's rich! There is no reason that a "pro-encryption" > bill has to contain any general "anti-crime" clauses. The average > person is afraid of burglars, muggers, murderers, rapists, car > thieves. When is the last time the average person was the victim of > a crime whose investigation could be "thwarted" by the use of > encryption? If you can't think of an example, you've just proved my > point: This provision is entirely irrelevant to the average citizen > (at least in a "positive" way) and can't be considered a "win" for > him. You talk about my being naive, this takes the cake. Do you really believe that any pro-crypto bill could make it through Congress with out some sort of anti-crime clause? > >> Jim Bell > >> jimbell(a)pacifier.com > >> Dan Weinstein djw(a)vplus.com http://www.vplus.com/~djw PGP public key is available from my Home Page. All opinions expressed above are mine. "I understand by 'freedom of Spirit' something quite definite - the unconditional will to say No, where it is dangerous to say No. Friedrich Nietzsche

1 0

Re: Vexatious Litigants (was: SurfWatch)
by Bill Stewart 17 Dec '03

17 Dec '03

>From: IN%"janzen(a)idacom.hp.com" "Martin Janzen" 9-MAR-1996 09:48:42.59 >>ObCrypto, sort of: What if the page were retrieved through an HTTP >>proxy which, unbeknownst to the author (and the filtering service/SW), >>deliberately removes or alters the PICS-Label or other rating >>information? Sure, you could probably write http://www.g-rated.com/. At least with movie ratings, the MPAA has trademarked the G, PG, PG-13, R, NC-17 ratings so that producers can't self-rate their own movies (though they can self-rate them as X.) But you could delete the ratings. Presumably, almost nobody in Europe is going to add these silly Yankee rating labels to their web pages, except a few commercial content providers who want to sell advertising or services into markets that block un-rated web pages. So schoolkids behind rating-mandatory sites will have to ask their teachers why the "World-Wide-Web" is just American --- "It's got All 50 States, Johnny!" <Exonive deleted>! >> Must Web authors now add a digital signature to each page (including its rating >> info), to prevent tampering? Tamper-proofing is a far more general issue than just ratings. Most of the tampering today is either political protest (the see-your- favorite-web-pages-after-censorship site), quasi-silliness (the Great Web Canadianizer, eh?), or advertising addition from commercial sites or deletion from de-commercialization software. Imagine if your movie rating web page gets linked up by some studio-owned web site (www.disney.not/reviews/siskel+ebert/Rocky23 says "Two Thumbs Up!" "Rave!") Or your stock picking service gets arbitraged a bit on fast.make.money.com. Or the ExonOnLine webserver starts deleting all links to unrated pages from pages it serves. If you don't need it now, you'll need it soon enough. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

Re: Leahy's guillotine.
by Bill Stewart 17 Dec '03

17 Dec '03

Leahy et al.: > Whoever willfully endeavors by means of encryption to obstruct, > impede, or prevent the communication of information in furtherance > to a felony which may be prosecuted in a court of the United States, > to an investigative or law enforcement officer shall... <Exonive deleted>! Let's look at the word "willfully". Among other things, it implies knowledge; under US law, to be guilty you have to know you did something that you at least reasonably believe is an activity that you're not supposed to do. Yes, cops can send you email threatening to use your remailer for felonious purposes, but if you don't know they've actually done it, and you haven't agreed with them to provide your encryption services in support of their felonious action, you're not a willing participant. Especially if you've got the welcome banner on your remailer page saying "You may not use this email encryption service for thoughtcrime, violations of the verbal morality act, idea laundering, anti-abortion activism, or other felonious or Un-American activities." You're no more a willful participant than the guy who receives an unordered package of child pornography mailed by a postal inspector. Now, if they make this a felony, surely conspiracy to participate in such activities could eventually be made illegal, and if the DemoPublicrats get re-elected, it probably will be some day. But this law doesn't do that yet. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

Re: News on RSA vs. Cylink Injunctions and Patents
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:00 PM 3/9/96 -0500, Perry wrote: >> I'm curious, because in the past, as I understand things, RSA has >> said that the DH patent covers El Gamal. If RSA no longer considers >> DH to be a valid patent, that would mean El Gamal is not patent >> encumbered. >It all matters very little to me, as the patents expire next year. Yeah, but that's still a year and a half till they're gone. Having them gone now (for some relatively small value of "now") would be especially pleasant, because we can start totally ignoring them (except for the RSA and Schnorr patents) rather than mostly ignoring them. Unfortunately, the somebody-at-Siemens-in-Paderborn patent on using Diffie-Hellman with hashed shared secrets for authentication is (minimally) good until something like 1994+17, even though it's so obvious to the skilled practitioner that I thought of it independently myself. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

Explosives, Criminality, and Preemptive Action
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:06 AM 3/10/96, JonWienke(a)aol.com wrote: >Who says they were going to blow anything up? It is perfectly legit for >farms to have large quantities of fertilizer around--they use it all the >time. Same with diesel fuel--what are they supposed to run the tractors and >combines with? Dog piss? DUHHHH! As far as having the instructions for >mixing them to go boom, who the hell made that a crime? You could bust most >of the farmers in this country if you criminalize simultaneous posession of >fertilizer and diesel fuel. Did these people ever actually mix any of the >fert. and fuel together? Did they threaten to blow up anything? My personal belief, from the news reports I've read (which may be incorrect, of course), is that the ingredients were for use in a bomb, whether or not they'd ever have gone through with it or not. The ancillary items found (dozens of assault rifles, weapons manuals, patriot literature, crank, meth, etc.), and the stockpiling of ANFO precursors, suggests an Oklahoma City-type scenario. This is what I think was objective reality. Now, before certain readers go ballistic, start foaming about how TCMay and his Tentacles of Medusa are pawns of Bill and Hillary, not to mention spawn of Satan, etc., I'm not saying that what they did is criminal. Having the potential to build a bomb or other deadly gadget is not the same as actually building and using one. But should law enforcement have waited until the bomb was actually built? Or actually loaded onto a truck? Or actually placed in a target area? Or actually detonated? Mightn't it be argued that until the bomb actually explodes, no crime has occurred? (A fine line. A topic oft-debated in libertarian discussion talkathons: if you see your neighbor preparing what you think will ultimately endanger you or your neighbors, at what point are you justified in taking premptive action? Certain extremists argue that at no point prior to your own death, for example, has an "assault" occurred. Less extreme folks argue that the assault happens when your neighbor begins to turn his gun in your direction. And extremists at the other end believe that potentially dangerous objects must be taken away from people long before they could ever put them to use. Ergo, gun control, restrictions on bomb-making info/anfo, etc. I take a stance closer to the first example, though I feel no qualms about hitting first if I really think I'm about to be attacked.) The argument that because farmers can use these products that the use must have been an innocent use is a weak one. Anyone with any common sense can see what they were up to. Who's kidding whom? But, like I said, this may not be criminal. And courts routinely have to deal with "conspiracy" cases to decide just how real the conspiracy was. (I don't care for "conspiracy" charges...too much chance for abuse.) Certainly the folks in Oregon will not face much prosecution, as near as I can figure. The weapons charges may affect their parole (some of them are ex-cons). The drug amounts are small. And the ANFO precursors....not clear to me at all that having these is a violation of the laws about explosives, but maybe it is. >This whole situation is nothing more than jackbooted thugs getting a rush by >stomping on people. FTJBT Overly simplistic. Don't misunderstand me: I share your anger at Waco, Ruby Ridge, gun confiscation, tens of thousands of laws, high taxes, etc. But I doubt the Oregon bust was a bunch of Waco Warriors assaulting the compound with tanks and helicopters. --Tim May, probably just added to Jim Bell's list of people he plans to have killed Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: FCC Sets Comment Date for Internet Phone Call Rulemaking (fwd)
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Henry Huang wrote: > ------- Start of forwarded message ------- > From: "Neal J. Friedman" <njf(a)commlaw.com>[..] > > The FCC has acted with astonishing speed in setting a date for comments > the ACTA petition to regulate telephone calls via the Internet. It is > uncommon for rule making petitions to sit for weeks, months, even years > without action. ACTA filed its petition on March 6th and two days [..] Odd that I have yet to see this in any business news. Has it made the WSJ, NYT, Bloomberg or TWP? Also odd that the FCC could try to regulate it. Not much they can do if someone outside the US uses IPhone or the like. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMUDveCoZzwIn1bdtAQHRkQF/U9Ypd5hAkoY86fF8e4pW9HLtVVvrRTVz GqxrRoq12MRtfQZqtD5q0u7VY6gJgR3Y =T64o -----END PGP SIGNATURE-----

1 0

CRIMINAL LAW SEMINAR
by AFDA2＠aol.com 17 Dec '03

17 Dec '03

On Friday, April 19, 1996, the Association Of Federal Defense Attorneys (AFDA) will present a one-day seminar, "The Key Fundamentals of Federal Sentencing." The seminar will be held at the Los Angeles Airport Marriott Hotel, from 9:00 am to 4:30 pm. Fee: $125 for AFDA members; $175 for non-members. Handout materials will include case law outlines and the sentencing guidelines. This seminar is specially designed for state court attorneys who handle occasional federal cases, for new federal defense attorneys, and for those who want a primer on the mechanics of the federal guidelines. For the experienced federal practitioner, AFDA will present its Third Annual Seminar, "Federal Sentencing Updates & Strategies," in the fall of 1996. For more information, click the Reply button and send a brief email requesting a fax-flyer. Remember to include your fax number. The Association's email address is: AFDA2(a)AOL.com

1 0

Re: Paint Your Own Scarlet Letter (Was: Edited Edupage, 29 Feb 1996)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: lmccarth(a)cs.umass.edu >I couldn't resist the temptation. I rushed out and rated my home page >as evil incarnate, at least according to the SafeSurf rating system. No >innocent rugrats are gonna be learning anything about my work in crypto and >symbolic computation on the web ! I have noticed that they ask for one's URL on the page in question. This information gathering brings to mind the question of if they plan on also keeping some sort of database. While private rating efforst are not directly wrongful, given the circumstances involved they may be attempting to mandate some such (either directly or through lawsuits) via governmental pathways. >It's, uh, interesting to note that "homosexual themes" gets a whole >separate category from "heterosexual themes". :[ Quite. (Incidentally, that the CyberAngels are associated with SafeSurf, which has this distinction in their material also, gives the lie to many of the CyberAngels' claims). I am currently in the process of writing a response to this proposal, and will post the initial version to cypherpunks. >Here's the reply I received after filling out the SafeSurf web form. It looks >as though anyone can use the code below by sticking it in their HTML as >directed: They supposedly have the code in question copyrighted. I suspect that such an attempt will not be valid without changes to copyright laws, but I am not a lawyer. (It does not appear to me, at least, to have any degree of true and original creativity involved). -Allen

1 0

Vexatious Litigants (was: SurfWatch)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:38 AM 3/8/96, Bill Frantz wrote: >At 6:59 PM 3/7/96 -0800, Timothy C. May wrote: >>If SurfWatch can be sued for a "bad review," then Siskel and Ebert had >>better find a new line of work. > >As long as a reviewer corrects errors, as SurfWatch seems to be willing to >do, I think they are relativly suit-proof. If they don't, well - anyone >can be sued for anything. I'll let the lawyers comment on the possibility >of success. OK, OK, I did not stick enough qualifiers in my "If SurfWatch can be sued" point. I should have said, in gory detail, "If SurfWatch can be successfully sued and found liable," etc. It is true that "anyone can be sued for anything" in these BS. I can sue Bill for writing the post he wrote. However, such a suit would definitely never reach trial. My point was that "opinions" (such as movie reviews) are not "tortable" (don't know the legal name), unless specific inaccuracies can be demonstrated, and even then it is hard. Siskel and Ebert have undoubtedly destroyed the box office prospects of many a movie with their "thumbs down" diss of death, but I know of no successful (or even adjudicated) lawsuits on this basis. One of the few cases of a reviewer being successfully sued involved the Bose Corporation, maker of the once-trendy Bose 901 speakers. It seems that around 1970 or so, at the height of popularity of the 901s, one of the stereo mags, or maybe it was "Consumer Reports," ran a review of the 901s and (correctly) criticized them as being not worth the high price (and maybe a comment that Bose's "direct-reflecting" snake oil was just that). Bose sued, and the case dragged on for many years. I think Bose eventually won. Too bad. Opinions are opinions, and a free society has no business suppressing opinions by use of torts. (Another related area is the use of torts to halt public comment on controversial development plans. These are called "SLAPP" suits--"Strategic Lawsuits Against Public Participation." For example, where AT&T sues "the Cypherpunks" to shut them up about their anti-Clipper feelings. Some judges are awarding large damages to the groups hit with the SLAPP suits.) So, while it is technically true that "anyone can sue anyone else," having the case get to trial is a different thing. And the law actually means what it says, in some cases. The First Amendment, for example, will stop Bill from successfully suing me because he dislikes my use of the word "tortable." If he files some number of these frivolous suits, he may find himself on a list of "vexatious litigants" (one of my favorite phrases of all time!). --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: What's anyone know about Teledyne Electronic Technologies?
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

>Teledyne (TET) is out marketing a "new" crypto system as a competitor >against DES and what TET calls "linear" cryptosystems. They are claiming >a non-linear approach in which (as best I can tell) they are permuting >the s-boxes and using 4 bit/16 entry substitution tables. Dont trust it unless you are a good cryptanalyst and have a copy of the source code. Most commercial crypto products are crap. Jonathan Wienke

2 1

Re: Switchboard
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:05 PM 3/6/96 -0800, Steven Weller wrote: >Check out www.switchboard.com. From the blurb: > >find people ... I checked them out and the couldn't find my record. Since I have a listed telephone number, I can only assume that their records do not include GTE local service records or some other equally huge gap. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Switchboard
by stevenw＠best.com 17 Dec '03

17 Dec '03

Check out www.switchboard.com. From the blurb: find people Find friends, colleagues, and old roommates for free. Any time, nationwide. Look up over 90 million names and get fast response to addresses, phone numbers, and personalized updates. Even send email to registered users. find businesses Find over 10 million businesses across the U.S.A. for free. Whether or not they're on the web. Day or night with immediate results. Is this the same data that was supposed to go on that Lotus CD-ROM? Is this publicly available info? ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

TCP/IP Stego (was CU-SeeMe)
by Ben Holiday 17 Dec '03

17 Dec '03

It seems to me that it would be possible to squeeze one bit of subliminal data into each tcp packet if you were willing to sacrifice a few cpu cycles in the process: A tcp header contains quite a bit of useful information.. but most of it wouldnt be easily manipulated (by me) to get a bit. You cant very well alternate the port number you are using, or change the packet sequence numbers. However, the tcp protocol forces each tcp header to contain a 'checksum' field.. which is (more or less) the sum of all the octets in the packet. This is used as error correction for the protocol. It shouldn't be too difficult to force TCP to fiddle with the data in the packet a bit to force the checksum to be a particular sort of thing (i.e. even or odd number) .. 0 for even and 1 for odd would get us our one bit of data per packet. I may be wrong, but im pretty certain that you could hack your client (an ftp client would be a good choice since it can easily be made to receive vast numbers of packets without attracting attention) and leave the basic tcp/ip stack untouched. If your client figured out what sort of packet needed to be sent to get the right bit before passing it to the tcp stack then voila you have a subliminal channel. Of course there are alot of other ways to go about it, im sure.. Benji

1 0

Re: Steganography idea: CU-SeeMe
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:28 AM 3/6/96 +0000, Ed Carp <erc(a)dal1820.computek.net> wrote: >On Wed, 6 Mar 1996, Nelson Minar wrote: >> So here's one idea I've had as a place to hide a channel: network >> video, in particular CU-SeeMe video streams. CU-SeeMe is a lowtech > >I think it likely that people will be sending GIFs and JPEGs to each >other far more often than video. Video is far more an "uncommon >communications channel" than is a uuencoded picture. The Quickcam videocameras are $100; they're the next toy to buy after you've got the Soundblaster, CDRom, and 100MB Zip drive. The Macintosh folks will buy them first (:-), but pretty soon they'll be very common, especially for business LAN users to have desktop video. The problem is that, unlike GIFs, CU-SeeMe and other low-bit-rate video compression schemes are _very_ lossy. You can't just put the stego bits in the raw image before running the compression, because they'll get lost, and if you try to fit them in to the compressed image, you've got to do it very carefully or they'll really drastically affect the image. I don't know CU-SeeMe's compression algorithm, but imagine putting bits into a run-length-encoded file: if you put them in the run-length, you'll change the lengths of the runs a lot. If you put them in the color, you'll get lots of streaks of random-looking noise. Either way, it's quite noticeable. So you've got to work very carefully with the algorithm. The other problem with CU-SeeMe is dropped frames, which someone mentioned. That's easier; any email system, especially a stego type, has to deal with lost message. So try to fit your messages into single CUSM frames, and build some tracking or ack messages or maybe message numbering, so you can detect lossage and request retransmits. It can be as complex as X.25-over-stego-over-CU-SeeMe, or as simple as "Message 14 of 32, RSVP". (If you _do_ implement X.25-over-stego-over-CU-SeeMe, you've got a fine April 1 RFC :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 #

1 0

Re: Square pegs in round holes, matchmaking, corporate mailservers
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:01 PM 3/5/96 -0500, "A. Padgett Peterson P.E. Information Security" <PADGETT(a)hobbes.orl.mmc.com> wrote: [>>Dimitris Tsapakidis <dimitrt(a)dcs.rhbnc.ac.uk> wrote:] > >Bob must find out whether Alice has declared (commited) her interest > >in him, if and only if he has declared (commited) his interest in her. > >Before he does so, he can at most know that a girl is interested in him. > >Another description: Bob and Alice can have a date if they both commit > >to each other. If only one commits, nobody will ever find out about it. > >- T is the trusted third party. > > Well if we *must* use D-H that is a way, but why do that ? Instead of > using a binary assymetric key, why not a triple ? (Just because I do not > know of any does not mean that one does not exist). > > Consider a function such that Alice has a key such that given a message M, > when encrypted by Alice may be manipulated by T such that Bob can decrypt > it. Similarly, Bob has a key that when manipulated by T' can be read by > Alice. Assymetric but not binary. The advantage here is that while "T" > is trusted by both, he/she/it/other is not able to read either message, > rather acts as a catalyst. Oh, that would work fine. Let a, b, and t be Alice, Bob, and Trent's secret DH keys, and g and p be the generator and prime (all math below is mod p.) If Bob wants to talk to Alice, he sends Trent B = g**b, marked "For Alice", optionally anonymously. Trent calculates X = B**t == g**bt, and sends it to Alice. Alice calculates K = X**a == g**bat, calculates H = Hash(K) and posts it anonymously, or sends it to Trent to post or mail to Bob. If Alice wants to talk to Bob, she calculates A = g**a mod p, sends it to Trent, optionally anonymously, marked "For Bob". Trent calculates Y = A**t == g**at , and sends it to Bob. Bob calculates K' = Y**b == g**abt, calculates H' = Hash(K') and notices that it's the same as the H he pulled off the net earlier. Bob says "Oh, wow! Alice wants to talk to me!", encrypts some lame drivel of a message M with key K'==K, and mails it to Alice if he knows her address or posts it with Subject: H', which Alice receives. Comments: 1) If Alice doesn't also want to talk to Bob, or Bob doesn't want to talk to Alice, they don't both come up with H == H', so they only know that _some_ shy person wanted to talk to them but not who it is. 2) Why does Alice reply to the anonymous message? Maybe just because she's free that evening, or maybe because it included a note with it that made her think the sender is a Nice Guy. 3) Under this method, Alice, Carol, Eve, and Greta can get together and notice that they've all gotten mail with keys X; they don't know who X is, but they know he's interested in all of them and he's probably a trolling loser :-) So they all dump him. However, even though they know Bob's public key B, they don't know t, so they can't tell from g**bt mod p that it's Bob, so they can't send him email saying "Get lost, loser" without revealing their identity. So Trent is providing anonymity, and needs to be trusted. Without Trent, you could do a two-way version of the protocol - if Bob wants to talk to Alice, he posts Hash(A**b), and vice versa, but Alice can go evaluate Hash(B**a), Hash(C**a), Hash(D**a), etc., for everyone in the phone book, and find out that it was Bob. 4) If Bob wants to reduce the level of trust he needs to have in Trent, he can create a bunch of keys b1, b2, b3, ...., bk in addition to b, and use a different one for each note. If I remember correctly, he can often calculate the inverse of b, b1,... (??????) So he sends Trent B1=g**b1, Trent sends Alice X1=B1**t == g**b1t, Alice calculates K1=X1**a == g**b1at, H1=Hash(g**b1at), and posts/sends. Since she's also interested in Bob, she does the same with key a, so Trent gives Bob K'g**bat. Bob calculates Z = K'**binv == g**at(b*binv) mod p == g**at, and then calculates Hash(Z**b1), Hash(Z**b2), Hash(Z**b3)..., and notices that H1 = Hash(X**b1) and says "Oh, it's Alice!" On the other hand, this doesn't appear to work if Alice is also using multiple identities. 5) If Trent is a really trustable guy, he can offer meeting services for people who have unusual tastes, such as liking (Exon) and Duct Tape and Political Party Z and (for bipartite variants) suppliers and consumers of various substances. So he could broker a list of (Exon)fans, as long as the activity is not criminal enough to lead to subpoenas or warrants for his transactions (if he keeps them) or his key t (or t1, t2, t3... if he's running multiple lists.) Dimitris's approach of using Hash(message) could be used to exchange preference here as well. If Alice checks the message for Hash("Duct Tape"), she can decide that she and the unknown sender would be a great match, and if she hadn't thought to check Hash((Exon)) she wouldn't know that Bob enjoyed that also. So it's at least some privacy for low-popularity unusual activities :-) 6) Of course, Trent really could be a front for Blacknet :-) Or Trent's key could be stolen and published, embarassing all his customers. > As to why you would want such a curiosity, consider a corporation with 80,000 > mailboxes. It would be desirable for each person to be able to send E-Mail > to any other person but not desirable for each person to have to hold all > 80,000 keys. Given a triple (tertiary ?) function each individual would only > need their receive key and a "post office" transmit key. On sending a message, > it would be encrypted with a session key and the session key encrypted with the > post office key. The post office would have all 80,000 receive functions but > through the assymetic keying would only be able to convert the session key to something > each intended recipient could decode but not be able to decode the message > itself. > This would meet both criteria (not key escrow but that is under "management") > D-H is wonderful but has difficulties with scalability. If such a function > existed (has anyone looked ?) it would solve the problem. Ah. The method I described above doesn't solve your problem; it just solves the original Shy-People's-Dating problem. If your only concern is scalability, and you don't mind doing the multiple-message handshaking Diffie-Hellman requires (<=SPD...), you can use either a signed-keypart Diffie-Hellman or just use PGP with the mailserver signing keys and keyserving. PGP approach: Bob has Public/private keys B/b, Alice A/a, Trent T/t, Sam S/s. Trent is the mail agent at Alice's company, T is well-known. Sam is the mail agent at Bob's company, S is well-known. "Well-known" means that all the mail servers know each other's pubkeys. If Alice and Bob both use the same postoffice, Sam==Trent, so it's simpler. Bob to Sam: Fetch Alice's Key Sam to Trent: Fetch Alice's Key Trent to Sam: A (signed by T) Sam verifies and caches A(signed by T), and already knows T. Sam to Bob: A (signed by T), T (signed by S). Bob verifies T's signature on A, S's on T. Bob to Sam: To: Alice(a)trent.aliceco.com, PGPEncrypted(Message,A) Bob either caches A, or caches T, or doesn't bother. Sam to Trent: (ditto) Trent to Alice: (ditto) Alice decodes the message. If she needs Bob's keys, she asks Sam to fetch them. So there's basically a key-fetching handshake, with Trent and Sam acting as CAs as well as keyservers, and then regular PGP. Clean, simple, and all your regular tools work, except of course that the keyservers use some database to store keys in instead of a big hulking PGP keyring. A Diffie-Hellman relative is a bit messier, because it's Diffie-Hellman. Assume that the modulus and generator p and g are agreed on (e.g. Photuris's.) Alice and Bob have their PGP public keys A, B. Trent and Sam have their PGP public keys T and S, well-known. Bob generates a random x, calculates X = g**x mod p. Bob to Sam: To: alice(a)trent.aliceco.com, X signed B. Sam to Trent: To: alice(a)trent.aliceco.com, X signed B, B signed S. Trent to Alice: To: alice, X signed B, B signed S, S signed T. Alice generates random y, calculates Y = g**y mod p, also K = X**y mod p. Alice to Trent: To: bob(a)sam.bobco.com, Y signed A Trent to Sam: To: bob(a)sam.bobco.com, Y signed A, A signed T Sam to Bob: To: bob, Y signed A, A signed T, T signed S Bob verifies Y, A, T, calculates K' = Y**x mod p == K. Bob to Sam: To: alice(a)trent.aliceco.com, Encrypted(Message,K). Sam to Trent: (ditto) Trent to Alice: (ditto) Alice decodes the message using K. To make things simpler, Bob might include Hash(K) or some other message identifier. In this case, the key-fetching handshake is piggybacked along with the DH key-exchange halves, and then Bob uses the jointly derived session key to send a conventionally-encrypted message (which he _could_ use PGP for...) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 #

1 0

test
by uunet!in2.uu.net!newsfeed.internetmci.com!info.ucla.edu!ihnp4.ucsd.edu!pwa.acusd.edu!news＠warwick.com 17 Dec '03

17 Dec '03

1 0

Re: PLEASE REPLY!!
by uunet!in2.uu.net!munnari.OZ.AU!news.mel.connect.com.au!harbinger.cc.monash.edu.au!usenet＠warwick.com 17 Dec '03

17 Dec '03

david(a)emeraldis.com (David G. Cannon) wrote: >Did this message make it out to the "real" world?? Please reply to this message >if it did. Thankyou. > >*David* > Your message did make it David. Hi from Australia!! Jim / jaar1(a)student.monash.edu.au

1 0

No Subject
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Hi! There was a discussion on How to install phone extension sometimes ago. Is there any appropriate URL or Usenet or Newsgroup or Mailing List available? Please email directly to: Durian(a)alpha.c2.org Thank you.

1 0