December 2003 - cypherpunks-legacy

DRAFT agenda for DC net-conference in early May
by Declan B. McCullagh 17 Dec '03

17 Dec '03

I recently saw a DRAFT agenda for a day-long Net-conference to be held in early May, hosted by Congressmen Jack Fields and Rick White. Panels include Future of the Internet, Electronic Commerce, Intellectual Property, Law Enforcement and Encryption, and Education on the Net. Highlights include a POSSIBLE luncheon address by The Honorable Newt Gingrich. Thought DC-area cypherpunks might like an advance heads-up. -Declan

1 0

WhoWhere.com v. that stanford.edu loon
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Several people asked for an update, so here it is. WhoWhere.com has been provided a dump of the password file that they may never have seen before, and they will be purging all 27,128 addresses therein from its database. Of course, many of those addresses may also be available from other, publicly available sources, and the Stanford community has been made well aware of whowhere.com's service (for user entries), so I expect that thousands of these addresses will return soon. I am confident that the Parsec folks are now acting in good faith, and that they are now sensitive to the relevant privacy and ethical issues. Myself, I'm cognizant of the hypocrisy and foolishness inherent in my position, but hey, we do what we can with what we got. Until the system is fixed, I gotta defend my people the best I can. I'm still reasonably serious about that "Hack Stanford Privacy" thing. If there is an easy way for outsiders to glean our whole kerberos namespace (outside of other major universities interconnected via AFS, and we'll get that fixed Real Soon Now), I want to know about it. - -rich [not on cypherpunks, so please Cc any responses] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMYWLdo3DXUbM57SdAQF9fAP+Pw4ra8Q5JfDy/DnmfrDauP5/4x+sH+SY qOwGk+GDgKW1p9yO+31OhuLsatPK5sXDGjTtwseRZXZXizylGmwQtgs2g9gQMxNR feZLyo0WBVnYw600ppms7nfay0uqEjM25nw/z+HDrUZ7VlWuAXZ/yctqLadiO3P8 +vCGbDfSQWA= =dP6F -----END PGP SIGNATURE-----

1 0

Re: Freedom and security
by Scott Schryvers 17 Dec '03

17 Dec '03

At 11:08 PM 4/28/96 -0700, you wrote: > >>No. "Those who sacrifice security for freedom, will have neither" is >>not consistent with Franklin's statement, nor is it true. Security and >>freedom are antithetical, and worse than that, security is always an >>illusion. But you can have your illusion, as long as you keep it out of >>my life. Censor yourself if you wish, but don't censor anything I might >>want to look up. >> >The Internet may once have been one of those small close knit communities, >small enough not to require law enforcement - although even then it had >rules that had to be followed. But that Internet is gone, and it will >never return, because now its the biggest city in the world, and the >history of the change from pastoral communities to urban life, to the >development of nation states and power blocs is also the history of crime. >And as the Internet grows, so will its security problems. > >My position is to seek a balance between the freedom of the individual and >the security of the community. My argument is that when the security of >the community is threatened by the freedom of the individual, the community >will always prioritise its safety. "When the security of the community is threatened by the freedom of the individual?!" >From what socio-political ideology do you run your group? >Good government of course means >maintaining individual freedoms *and* maintaining community security. I >actually disagree that they are antithetical. On the contrary they are a >balance that any society has to find. Where individual freedom takes over >you have the urban jungle where predators consume prey. Where security >takes over you have the totalitarian state. Neither is necessary nor >inevitable. By the way government serves best when it serves least. Remember that. >We are simply concentrating on the problem from two different angles. My >concern is to maximise community safety while protecting individual >freedom. Your angle is to maximise individual freedom while protecting >community safety. There is IMHO very little difference between the two. No there is a major difference, I feel society is served best when each individual has the freedom to defend and protect themselves apposed to what you want us to do in essence you want us to lay down those liberties to an outsied group who are supposed to protect us. The internet is not a city, it is a computer network that spans the globe. What you are asking for in analogy is not a cop walking a city street but fucking U.N. tanks driving through neiborhoods enforcing rights by way of brute force. >From what I have seen of what your group does you are as hypicritical as law enforcement in your techniques and attacks on others. Often unwarranted and justified in the name of some supposed higher ideal. PGP encrypted mail preferred. Scott J. Schryvers <schryver(a)radiks.net> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzFX9usAAAEH/2r2eovPAoYZbxzmfJ1DW7yjjdVnckXjUVKU/zZNAUV/IjzF GDEq040wbAG1rFHDYoBOjjJTOGWMFuZ9apqoAvvI7Q4NAmVrNif0Rp8q/j4jib13 dlAA4Q0nvJZ5YNw4sf4r0iug76+9i0WpIZoP60DEB8BTuyCP55+nsbe7Ii3xLRyq ThZ2fhNqK2hD/rFugXK29Ynyzuc6TuFfu78kVOsYUUbQpplXyaLjhGKN94pZ5jox x7/wvqmBoH9E3rnaIPY9vOwy3kvMmCTlkjhlCzMXZHDn0e3UHWAax2mUTMttRzzi +SUv45h6ua+eSwUkA8uojojn/JiPOKIPwPk3hq0ABRG0KFNjb3R0IEouIFNjaHJ5 dmVycyA8c2Nocnl2ZXJAcmFkaWtzLm5ldD4= =58dK -----END PGP PUBLIC KEY BLOCK-----

1 0

Calling other code in Java applications and applets
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:22 PM 4/29/96, sameer(a)c2.org wrote: >> >> Java applications can't save files to disk or use data files on >> disk. > > Uh, yes they can. It's the applets that can't. And I believe that even applets can read and write data files on disk IF THE APPLET ENVIRONMENT PERMITS this. Netscape and similar environments at this time of course _don't_ let this happen, but this is a choice (as I understand it) made at this time and perhaps for this version of the respective pieces of software. (As I understand it, an explicit decision not to allow file i/o, for some obvious though not necessarily permanent reasons.) Certainly the InputStream and OutputStream classes handle file i/o for Java applications--if not applets in general, and presumably not with Netscape 2.0. I can imagine future developments which will allow browsers or similar environments to have full file i/o capability. (Sure, there are dangers. There are always dangers in running code gotten from others. These are recurring problems. I expect lots of flavors of solutions, from signed classes to "playpen" holding tanks (which allow file i/o, but only within some constrained environment), and so on.) By the way, I had a discussion at a party with several Sun folks and other Java programmers, and they agreed that external code (C, for example) could be called, even by an _applet_, if arranged. For example, various underlying graphics routines in the AWT (Alternative Window Toolkit) package are of course using underlying code written in various other languages, code that has been reasonably optimized for speed. "import java.awt.*" makes this code available to applications, and (I believe) to applets within Netscape-type environments. (I suspect there's a simple chart someplace showing what will run under what constraints.) The interesting thing here is that a crypto package, perhaps with speed-optimized underlying routines in C or even hand-coded machine language, could be released. It might be that patent holders (not that I am endorsing this) could license such packages to users. Thus, import java.bignum.* import.java.entropy.* import java.rsa.* import java.digicash.* ... (Such packages may need approval by Sun, etc., and formal integration, a la AWT. But certainly there is talk of replacing AWT with something else, so changes and additions are clearly possible.) Lastly, I don't believe that discussing the implications of Java justifies the claim that "males are posturing." To me, discussing Java, virtual machines, security issues, and advantages/disadvantages is what the list is about, at least as much as the other topics we so often discuss. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: On computer face recognition:
by geeman＠best.com 17 Dec '03

17 Dec '03

At 09:39 PM 4/29/96 -0400, you wrote: ><< "Results were successful (else why write about it?" >> > > > Another believer in the tooth fairy. Send this kid to the "Real World >Academic Life" bootcamp, please. No (sigh) I'm not a believer in the tooth fairy, nor a kid. I take the time and trouble to post to the list something of bona-fide value and interest and all you can do is snipe at some side-comment, tongue-in-cheek at that? I see we're not talkin' bout a 1-percenter here, are we? Let's see if you can't do something more useful next time. > >Note that I am not making any comment on the success of this particular >work. Probably because you haven't a clue. > >

1 0

Re: Mindshare and Java
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:56 PM 4/27/96 -0700, mrm(a)netcom.com (Marianne Mueller) wrote: >One thing I don't understand, why do you trust signed code? >So you know the code is signed by Jack the Ripper. so what? How do >decide what you want the code to be allowed to do? I think there's >nothing for it but a kind of limited capabilities model built on top >of the authentication mechanism. Some code comes from random sources; signatures there mainly buy you the ability to blame someone if the code hoses your machine, and thus reduces the chance that someone will hose you. But as Java develops, there'll be more commercial code available; I'd trust Java code signed by Microsoft just as much as I'd trust any other Microsoft code I'm running on my machines. Maybe more, given the quality of some of the Microsoft code I'm running now :-) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: arbiter/escrow agent for hire
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 17:43 4/28/96, bryce(a)digicash.com wrote: >-----BEGIN PGP SIGNED MESSAGE----- > > Black Unicorn <unicorn(a)schloss.li> wrote: >(> "E. ALLEN SMITH" <EALLENSMITH(a)ocelot.Rutgers.EDU> wrote:) >> > IIRC, currently Black Unicorn doesn't have any signatures on >> > his public key of others. Therefore, this requirement, while >>understandable, >> > could cause a bit of a difficulty in the current situation. >> >> Please obtain a copy of my current key by finger. > > >Oh please. My respect for Uni's acumen just decremented a >couple of notches. A 2048-bit key, and no signatures? >Rather like a front door with welded plate armor and an open >window, no? We had once had a thread on the list that discussed if it makes sense to sign keys for nyms you have never met. I think it does. Even seeing a driver licencse isn't 100% proof that the name stated on the doccument is the True Name of the person. However, I am firmly convinced that the person using the PGP key pub 2048/4E685D39 1995/03/26 Black Unicorn <unicorn(a)access.digex.net> Key fingerprint = 00 B9 28 9C 28 DC 0E 55 E1 6D 53 78 B8 1E 1C 96 is the same Black Unicorn that is frequently posting to Cyphperpunks. Therefore, I am willing to sign his key. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQEPAy91JFIAAAEIALRKcL9qZZnqMn3fuDDxOd8+d2F+rqKB3Ff1U7+9Cp2CGugx zfygey2nBEZQXiXG8fBi44iGAuHNc7TRRkQCr8srMwKXeU1Ue/fe5ACcDGy0H1ki C0YYOuWFY2mtKCiqW3kcXWGFlDf418FbXftqJwSvMiIWIzgtepSWfzl5ApmguHjA lTngdR+R557Cb6mgLV0Vug9yGyqXGeCqIs7Yx5SpakoIRwkkfniGa3m6L8+OgREY bW6MoDPOfUox90xqJsDePB7b11l05I87V28s4FaTYH8CdmtdAun52/hLEAQKMXyz g7jPlSQzpLObZ0OL3eiulHyC0aR4LWieb05oXTkAEQEAAbQoQmxhY2sgVW5pY29y biA8dW5pY29ybkBhY2Nlc3MuZGlnZXgubmV0PokAlQMFEDGFkHEEkJHpt/K8BQEB nXgEAIe4FNcBuzXHT3VR1jfLcL+5vbjSH6Cxv06vEhpV3UpZonpD8C9Y+Mv2YSea iOV5aKf98xgRpGNqxuofkDsQu9fJPJizOaFQFEFJXbjT/NcnzYKBFDX3XyDF45Uq n6OM9t5ysRQOCPMzRlf05tu48qVwpx3qSU4yWDok3F6hQhMuiQEVAwUQL3VAdC1o nm9OaF05AQH/oAgAp/ZME1rM4o2lnKRuI/n+IrrBZVMrB59tzgpDzt0KNoOkIRsE 4YIC1bgZKbcfKYr8ovaH0R2/xGe8V2HPcZZocCNCtQJodOPgwHGwU44E7JSugMTC XsqtRt1Ost7n6X5e0AklQo2bYvTv5ylhrEybZA4Yeg1VYTITMxoTVdG4kKSQ4LWf SV9qGV74kPldNfScTjfw/eP2hnIKvDDlveFgoeJD3/kN0sLkckzVkP+jkygMc2QZ 6h8278cvRjXzGndP+2jm0DrNBF9P8tGka9HSZZwyCDCwSlAdNy4EgYEpWNbFOSUn g02GKEVZ5dz7CYQz3gd40VYYl5/B4Hktj69V+w== =dPns - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMYWSfwSQkem38rwFAQE4+QP+Jzh1AJjwCMCDuWZoe5Tf3AaOz/M0x1AV 6VLmy5A2dk4Kqm/40bOd5PPzq6fQJUcke/PRKP55gXoXyFnZrurXBzB+ogpurzH3 +FKfpBEPjfZRvZzDF7/MNUCq7TpgEucIpe0jXNoCg/DxYkl84ZbEPdudnRhUjfaW dE2XgLK+iUk= =LD50 -----END PGP SIGNATURE----- Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: The Joy of Java
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:45 PM 4/29/96, Perry E. Metzger wrote: >Scott Brickner writes: >> I don't understand what you mean by "insufficiently powerful". It's as >> expressively powerful as most high-level languages, and computationally >> Turing equivalent. It's lack of power seems entirely in the performance >> arena, which may be solved, eventually. > >Java applications can't save files to disk or use data files on >disk. If you were, for instance, buying two CPU weeks of idle time on >some machines, you would need stuff like checkpointing or the ability >to save intermediate results. Java applications _can_ save files to disk, and read them. Further, even the presently-more-constrained applets can retrieve certain types of files. For example, "getImage" and "getAudioClip" methods. I mention this point for two reasons. First, it says the applet model is not forever and totally blocked from reading disk files. (And I would not be surprised to see additional file retrieval methods "allowed." To be sure, this raises more and more security issues to look at, but TANSTAAFL.) Second, the relevance for providing sources of entropy for Java applets. I haven't looked in detail, but I'll be willing to bet quite a bit that someone has already or soon will run a QuickCam video input, not to mention sound input, in a Java applet, and that this could easily be used as a source of entropy bits. --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Social Transformation, Not Tax Evision
by attila 17 Dec '03

17 Dec '03

** Reply to note from Duncan Frissell <frissell(a)panix.com> 04/29/96 10:28am -0400 = "God fights on the side with the heaviest artillery. These days MarketEarth = has the heaviest artillery." just because you carry, like everyone else, carrying God's banners does not mean God is on your side, or the side with the heaviest artillery. God is on the side of those who have faith and charity-- nothing else required. the heaviest artillery is nothing more than man's pride, not his humility; pride will not bring you to the celestial kingdom, nor will you inherit the earth. -- Overseeing first-rate programmers is a managerial challenge roughly comparable to herding cats. cc: Cypherpunks <cypherpunks(a)toad.com>

1 0

Re: Neuron Magnetics (Data Needed)
by Ben Wern 17 Dec '03

17 Dec '03

There has been a recent discussion on dc-stuff about Dallas Semiconductor's Touch Memory stuff. (http://www.dalsemi.com) Has anyone played with these? Any info on the security / insecurity of the methods they use? Perhaps a cheap way to encode pgp / similar keys onto a card technology? Ben Wern bwern(a)jaxnet.com or bwern(a)unf.edu Try New and Improved Jello: V 2.0 "I may not have gone where I intended to go, but I think I have ended up where I intended to be."

1 0

Re: On computer face recognition:
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 0:07 4/30/96, Alan Horowitz wrote: >What task is the human brain optimized for ? None. Which put us on top of the food chain. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Calling other code in Java applications and applets
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 21:50 4/29/96, Timothy C. May wrote: >By the way, I had a discussion at a party with several Sun folks and other >Java programmers, and they agreed that external code (C, for example) could >be called, even by an _applet_, if arranged. For example, various >underlying graphics routines in the AWT (Alternative Window Toolkit) >package are of course using underlying code written in various other >languages, code that has been reasonably optimized for speed. I understand that calling C libs from Java is possible, but the details how to go about that are still hazy to me. It is also unclear if Sun will support this dual coding as a general capability that can be used by all Java apps (don't think of Java just as downloadable applets) or require that all modules, to give an example, for a certain soon to be very relevant Java application to be written in 100% Java. [...] >The interesting thing here is that a crypto package, perhaps with >speed-optimized underlying routines in C or even hand-coded machine >language, could be released. It might be that patent holders (not that I am >endorsing this) could license such packages to users. > >Thus, > >import java.bignum.* >import.java.entropy.* >import java.rsa.* >import java.digicash.* >... > >(Such packages may need approval by Sun, etc., and formal integration, a la >AWT. But certainly there is talk of replacing AWT with something else, so >changes and additions are clearly possible.) Presumably, such packages would have to be signed by Sun. Needless to say, these certificates would cost money. A potentially lucrative source of revenue for Sun. Nothing wrong with that. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

5 8

Re: Former CIA Director and *Strategic Investment* Editor
by jim bell 17 Dec '03

17 Dec '03

At 07:40 PM 4/29/96 EDT, Dr. Dimitri Vulis wrote: >jim bell <jimbell(a)pacifier.com> writes: >> At 04:06 AM 4/29/96 -0700, anonymous-remailer(a)shell.portal.com wrote: >> >CNN is reporting that Colby's canoe has been found on the Potomac and >> >Colby is missing. >> >> Don't tell me, let me guess: The guy who rented the canoe to him has >> suddenly retired, and has been reportedly seen going on a Park Avenue >> shopping spree. Right? > >Jim, I don't find dumb jokes about dead people I liked particularly funny. Aren't you making an assumption that Colby is dead? No body has been found, last I heard. Maybe he just decided that he wanted to disappear in a comparatively non-suspicious fashion? Jim Bell jimbell(a)pacifier.com

4 3

[Joke] It Takes a Village
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

Friend, Here's Timothy May, the self-appointed village headman. He's surrounded by a bunch of arse-kissing accolytes: -"Gosh, I thought that Java was garbage, but now that Tim mentions it, it's the best thing in the world" -"Tim's right, Java is terrific." Village Jester: "Tim's dead wrong. Java isn't good--it's great!" Then there's Perry Metzger, the local squire, who's embittered over the fact that, while he's got some worthwhile things to say, he's always overpowered by the "charisma" and new clothes of May. Jim Bell, village idiot. He's always good sport for the village bully, Black Unicorn. His pretentions aside ("the black unicorn has been in my family crest for a thousand years"), he is in actuality a short, portly Philadelphia accountant by the name of Irving Lipshitz-Groins. Cordially, Your village historian

4 4

[LONG] Churchill Club: 20th Anniversary PK Crypto
by frantz＠netcom.com 17 Dec '03

17 Dec '03

The moderator, David Morris of Cylink, introduced the field by discussing the problems of corporate espionage, and privacy concerns vs. public and private databases. He said that the old security paradigms present with face to face business don't work with electronic commerce. He introduced Jim Omura, who gave an overview of PK encryption and introduced Martin Hellman, Ralph Merkle, and Whitfield Diffie. Louis Morris, Cylink CEO, presented them with inscribed glass trophies. Hellman described the key to the early years as being willing to be a fool, because you need to step out of the standard thought patterns. Diffie described the genesis from 1974 to 1978 as going from Merkle's paper, "Secure Communication Over Insecure Channels", thru DH key exchange, to RSA. Since 1976 is the center of gravity of these steps, this year makes a good 20th anniversary. Merkle said it is most striking how long it has taken to be adopted. Networks lead to a need for security, lead to a questioning of regulations on Crypto, which leads to changes in those regulations. Diffie said it is absolutely amazing that it is happening so quickly. "How wonderfully lucky it is we started working 20 years ago." Senator Larry Pressler (R, SD) was introduced via video projector from Washington D.C. He talked about bad government rules and that government should help or at least get out of the way. He talked about the need for exports and to assist US multi-national businesses. The controls hurt US companies. Encryption is the future of industry. If we don't fix the export problem, there are two outcomes. (1) Foreign competition will provide the function, or (2) US companies will move the R&D offshore. Either will cost US jobs. After listing his [off topic] pet bills, he mentioned that he was talking about encryption in software. He said Senator Burns' bill will be introduced tomorrow. Senator Conrad Burns (R, MT) spoke from the podium in a joke filled speech. He talked about the Telecom Bill as a way to do something about giving more people access to the glass highway. He talked about the problem of how do we make sure that people have agreed to a deal on the highway and supporting sales. He said we need the crypto bill to support them. His bill provides for, (1) Export of publicly available software (e.g. PGP and browsers), (2) no GAK, (3) limiting the authority of the Department of Commerce to set standards, and (4) export to countries which equivalent technology. He wants to have public hearings in Silicon Valley. Then questions came from the floor: Q: Why are we streamlining the Department of Commerce when the Department of State and NSA are the problem? Burns: Legislation will deal with this problem and prevent them from blocking export. You may still need a license, but there should be no fences. Pressler: We need to streamline relations between State and Commerce in this area. We need to streamline trade in hi tech. I don't think that state and NSA should have the say. Export is a trade problem. It is a "disaster for American exports." Burns: We are going to need grass-roots support to pass this bill. Q: Where do California's senators (Feinstein and Boxer) stand? Burns: We don't know. Pressler: We didn't have their support on tort reform. Stick with your friends and work for them. Q: Who is against the bill? Burns: People who listen to NSA. People who feel the US needs to be able to watch you. Q: How do you expect administration opposition to show up? A: We don't know yet. Q: Currently encryption is classified as a munition. Will your legislation reclassify it. Pressler: We don't see encryption as a threat to national security. People in Washington D.C. who make a living suppressing information oppose the bill. Burns: We need your knowledge to pass this bill. The senators bid us goodbye and the Congressman Robert Goodlatte (R, VA) was introduced. He said that President Clinton testified for 4.5 hours over an encrypted communication link on the McDougall trial. His bill is called Security And Freedom thru Encryption (SAFE). Local congressmen Campbell and Eshoo are co-sponsors. We need to broaden the base of support for this bill. Everyone should talk to their customers/vendors/and companies with web sites about this issue. If we don't change the rules, it could cost $60B in 2000. There are 500 foreign encryption software products. He talked about how fast 40 and 56 bit encryption could be cracked and said that, in his opinion, the administration's desire to read everything, foreign and domestic is the greatest threat. He argues it is the wrong approach and we should be encouraging everyone to use encryption routinely. We need it for counter terrorism against attacks on computer systems used in design, manufacturing and e.g. controlling nuclear power plants. We need your help getting the word out. Write your member of congress. We will have hearings on the bill in the next month or two. Q: What do you say to techies/CEOs who want to run for public office? A: Well are you a Democrat or Republican? (laughter). Seriously, congress needs a variety of backgrounds to help with technical issues. Get good expert advice on running your campaign. James Freeman, Special Agent in Charge, San Francisco Office, FBI, discussed the tools the FBI needs to do its job. He talked about foreign espionage on US companies. He mentioned 800 cases involving 23 countries, 20% in the SF Bay area. Counterfeit drugs cost US drug companies $1.5B/year. The FBI does not have adequate laws to pursue theft of intellectual property. It could use a computer fraud/abuse law. In the last few years, the FBI and local law enforcement have identified 9 gangs dealing in stolen electronic components thru undercover operations and wiretaps. Each set of arrests have reduced the rate of reported armed robbery. They used RICO to help prosecute these gangs. He stated the FBI can do the same for intellectual property given the right tools. He stated that in some cases, foreign students are sent here to spy on US corporations. In some cases they are released from military service for their spying. Inside theft is responsible for most spying, but hacking and computer intrusion are increasing. He said that terrorists, money launders, drug dealers using crypto is a serious threat, and he thinks GAK is a good solution. If congress takes GAK away from law enforcement, they will use the tools they have. However we need a balanced approach. Q: If any high school student can implement unbreakable crypto, what can you do? A: Regulation of crypto is the responsibility of congress. Edward Kozel of Cisco Systems spoke about the problems they have had with the export regulations. He said that the Internet was important because it lowered the barriers to market entry. He offered the example that the big 3 American auto manufactures are requiring network links for their suppliers. He talked about attacks on hosts and networks. He said that right now, Atlanta is a boom area for telecommuting because Atlanta companies fear the Olympics will bring gridlock this summer. He suggested micro payments as a solution to copyright problems. We must see the problem as a global problem. PK is a fundamental component of commerce, authentication, and non-repudiation. Q (Dave Del Toro (sp?)): RSA patent license imposes significant limitations on what we can do with RSA. How can we overcome that barrier? Morris (Cylink): Cylink owns the DH patents. We are opening the technology with no-cost licenses. Patents should not be used to block the technology. Kozel: We certainly support open dissemination. In 1990 we couldn't export routers to e.g. Russia. So they used PCs and public domain software to build their nets. Now they are converting to routers. Now is the time to unleash encryption. Q: What is the best way to go given the new laws and IPv6? Kozel: 40 bits is no good. Even people in rural Australia know that. Industry needs to recognize the need for controls, if only by the customer. The technology is moving to the mass market. Encryption will be needed to keep everyone from reading data on cable networks. Paul Raines, Project Manager, United States Postal Service described the post offices digital postmark and certificate services. Cylink is the technical developer. The post office brings four things that private industry can't: (1) The postal fraud statutes, (2) A long track record and well established reputation, (3) 40,000 existing post offices (vs. 10,000 McDonald's), and (4) it can act as a trusted third party. Q: How much will you charge for these services and when will they be available? A: Postmarking: $.10, 7/96. Certificates: $10-$15/person/year, 4Q96. Q: Do you see the post office acting as an ISP? A: Only to the extent necessary to provide electronic delivery of digital postmarks and certificates. Q: Do you see the post office going into transaction verification? What limits your future business directions? A: We will make sure not to compete with private business. Because we must go through a rate commission to change prices makes it hard to compete. The evening closed with a Diffie, Hellman, Merkle panel. Hellman: After these 20 years, I feel less of a fool. When we wrote "New Directions in Cryptography" in 1976, we envisioned our ideas would be widespread in five years. Diffie: I was excessively optimistic about the spread of PKC in two of my papers. Hellman: We were off for two reasons. (1) Lack of public concern. With cell phone fraud approaching 40% that may change. And (2) ITAR. This new legislation will have a very positive effect. Merkle: I wish I could pipe the comments this evening back 20 years. I would particular like to pipe them to my rejection letter from Communications of the ACM which said my contribution was not mainstream. One is often over optimistic about the early rate of progress and under optimistic about the later rate. OK, I was wrong before, but things are going to happen fast now. Morris: Where are the new frontiers? Diffie: Quantum computing (if it works). Elliptic curve crypto. The next decade or so will be used to sort out the social effects. Passive listening by major governments is moving to active computer penetration. What will our high-level security specifications be? What are fair rules for intellectual property, privacy etc? We closed with David Morris reading email from Phil Mellinger, Chief Engineer, Government Securities Association. He said the US and Canada are discussing inter operability on Certificate authorities. The government is using DH with DES and SHA for government communications. Short of the automobile, PKC has had the largest effect on the world of any 20th century technology. Impressions: In conversation afterwards, I noted that discussion of personal privacy seemed to be politically incorrect in this group. Unless it directly supported corporate commerce, we didn't discuss it. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

5 4

Re: Former CIA Director and *Strategic Investment* Editor
by jim bell 17 Dec '03

17 Dec '03

At 01:59 AM 4/30/96 +0100, Ed Carp wrote: >On Mon, 29 Apr 1996, Dr. Dimitri Vulis wrote: > >> jim bell <jimbell(a)pacifier.com> writes: >> > At 04:06 AM 4/29/96 -0700, anonymous-remailer(a)shell.portal.com wrote: >> > >CNN is reporting that Colby's canoe has been found on the Potomac and >> > >Colby is missing. >> > >> > Don't tell me, let me guess: The guy who rented the canoe to him has >> > suddenly retired, and has been reportedly seen going on a Park Avenue >> > shopping spree. Right? >> >> Jim, I don't find dumb jokes about dead people I liked particularly funny. > >CNN is reporting that although the search is continuing, the authorities >are presuming Colby drowned in a boating accident. I'd like to hear more about the timeline. From a snippet I heard yesterday, he telephoned his wife and said he'd be renting a canoe. Okay, who and why did "they" visit a cabin (?) to find him? (If somebody called me from a cabin, and he had a telephone, I would not consider his failure to later answer the phone to be particularly suspicious...) And one version I heard said that the canoe was at the cabin. How often do fatal canoe accidents occur what might have been a few feet from shore? (You can't sink a modern canoe, especially a rental, because they have floats under the seats to prevent this.) We can't tell, because the information being released is so sparse. Somebody's not telling us the whole story.

1 0

(fwd) E-Commerce Info. Needed
by Robert Hettinga 17 Dec '03

17 Dec '03

Reply directly to this person, and not me, please... Cheers, Bob Hettinga --- begin forwarded text From: aiq005(a)teix.uib.es Date: Tue, 30 Apr 1996 09:46:56 +0200 To: RAH(a)shipwright.com Subject: E-Commerce Info. Needed Status: U Dear sir, I'm doing a project on Security and E-Commerce. I would like to know if you could help me on my search of information on two subjects: * Graphics and statistics about the growth of the e-commerce in the last years, and also on the attacks to comercial sites on this period. * Future tendencies, projects... on e-commerce, and how security is going to affect the future on the commercial sites. When I say 'information' I'm talking about URL's (of course) Thanks a lot, and please forgive my bad use of English! Joan Andreu (Universitat de les Illes Balears) aiq005(a)teix.uib.es --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Austin, TX meeting notice
by sdt＠zilker.net 17 Dec '03

17 Dec '03

There will be a physical meeting of cypherpunks in Austin, TX. Location: Central Market Cafe 4001 N. Lamar Blvd. Time: Saturday, May 4 at 6:00PM This will be a general meeting covering the existing projects (the video, the web page rebuild, and remailer planning), events in the news, and assorted other topics. As usual, look for a table with a stack of crypto-related books.

1 0

Re: LolitaWatch v1.1
by Duncan Frissell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 08:02 PM 4/17/96 -0700, Dave Del Torto wrote: >[ Newt Gingrich and his ilk being the mensches they are, I expect v2.0 may ] >[ add support for the "Jew," "Nigger," "Kike," "Fag," "Nerd" and "Wop" bits ] >[ -dave ] > Slick Willie and his ilk being the copraphagic cretins they are, I expect v2.0 may add support for the "religion", African-American, "Person of the Jewish Faith", "Lesbian", "Gay man", "Itellectually enhanced but socially challenged", and "Euro-American" bits. DCF -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMYYXfIVO4r4sgSPhAQGLlQP/dB4ElSyHbDEqdOMNGESh6UNrzTcvbsZH BKvXiPBAz2HUitD5lX3AdJ0KqJmZkPo+nRKe48rE19H370M9hFuvkOT04Jsydf6E IOt3EyOw2McZw66rRjN0HxWiS4yHu1Bj+bhjASX7QpZoG1XKO2wozUb/AHhH1dvA UroHHC6bJFc= =uHho -----END PGP SIGNATURE-----

2 1

Netscape 3 betas
by Adam Shostack 17 Dec '03

17 Dec '03

I'd like to commend Jeff and Phil, and any other members of the netscape team who are here, for the strong list of security controls available in Atlas (beta 2) They include control of caching SSL protected docs, alerts before showing a cookie or submitting a form via email, control over email address as ftp password, and, best of all, Java and JavaScript come turned off by default. Nice work! (I'll also offer a pet peeve, which is I can't refuse to accept server pushes, and the stop button doesn't really seem to affect them. I should be able to prevent keep-alive if I don't want it.) Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

2 1

Re: Calling other code in Java applications and applets
by Hal 17 Dec '03

17 Dec '03

I understand that Sun is considering including a bignum package and possibly other crypto support in native form in a future release of Java. There has been considerable discussion of this on the coderpunks list. Apparently Sun has said they will release their crypto API within the next week or so. However these kinds of things are often delayed, in my experience. An earlier version of the crypto API was shared with Java developers at a meeting a few months ago, and the response was quite negative, according to list memebers. The class and method design in many cases seemed awkward, spotty, and inconsistent. Apparently there are also export considerations, with the NSA resisting the inclusion of too many explicitly crypto oriented classes. Hal

1 0

"Scruffies" vs. "Neats"
by tcmay＠got.net 17 Dec '03

17 Dec '03

(The version I apparently just sent out was not quite complete. I saved it in my mail program, intending to work on it later today, but it got queued for sending inadvertently. Sorry it got sent. But maybe it's just as well, as I can look at the commentary--if any--and make additions and clarifications later.) --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: [Joke] It Takes a Village
by attila 17 Dec '03

17 Dec '03

** Reply to note from cpunk(a)remail.ecafe.org 04/30/96 10:49am +0100 well, might as well flesh it out and get the rest of us who were slighted --and don't forget yourself. if you can not laugh at yourself occasionally, check your pulse = Friend, = = Here's Timothy May, the self-appointed village headman. = He's surrounded by a bunch of arse-kissing accolytes: = -"Gosh, I thought that Java was garbage, but now that Tim mentions it, = it's the best thing in the world" = -"Tim's right, Java is terrific." = = Village Jester: "Tim's dead wrong. Java isn't good--it's great!" = = Then there's Perry Metzger, the local squire, who's embittered over the = fact that, while he's got some worthwhile things to say, he's always = overpowered by the "charisma" and new clothes of May. = = Jim Bell, village idiot. He's always good sport for the village bully, = Black Unicorn. His pretentions aside ("the black unicorn has been in = my family crest for a thousand years"), he is in actuality a short, = portly Philadelphia accountant by the name of Irving Lipshitz-Groins. = = Cordially, = = Your village historian -- Overseeing first-rate programmers is a managerial challenge roughly comparable to herding cats.

1 0

Re: Freedom and security
by angels＠wavenet.com 17 Dec '03

17 Dec '03

Mike McNally wrote >If.... (freedom and security) ....weren't antithetical, there'd be no need >for a balance. If they were antithetical then as freedom increased security would decrease, and as security increased freedom would decrease. It is not IMHO inevitable that if we increase security we will jeopardize freedom. My concern is that if we ignore security we will have no freedom left to protect. I don't believe the Internet community is split into two camps on this issue - there appear to me to be many places where people draw their lines at different points. I don't believe that security is the enemy of freedom. I believe that freedom needs security in order to exist at all. ********************************************************* Colin Gabriel Hatcher - CyberAngels Director angels(a)wavenet.com "Two people may disagree, but that does not mean that one of them is evil" *********************************************************

4 3

once again
by Perry E. Metzger 17 Dec '03

17 Dec '03

Lots of people seem to have misread my statement about java programs and I/O. To repeat: I fully understand that Java is a general programming language and can do I/O. However, "Safe" Java subsets, like the ones used for writing applets or presumably the ones that would be needed for markets in CPU cycles, do not do i/o. One could add i/o to the suite, but that would be dangerous. Perry

1 0