December 2003 - cypherpunks-legacy

Re: NRC Session Hiss
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 15:58 6/3/96, Raph Levien wrote: > Basically, an exportable S/MIME client can transmit messages up to >1024/40 bit RSA/RC2 (or RSA/DES), and receive messages up to 512/64 bit >RSA/RC2 (or RSA/DES, but in the latter case I would imagine it's actually >restricted to 512/56 because of the keysize of DES). Note that the >asymmetry actually points in different directions for the public and >symmetric keysizes. What will be the maximum keysize for a domestic encryption client? It it is larger than 1024 bits, there will be interoperability problems with foreign clients. If the domestic client is limited to 1024 bits, it would set a bad precedence, since it would effectively require that the encryption key is smaller than the largest signature key. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by Duncan Frissell 17 Dec '03

17 Dec '03

At 05:01 PM 6/3/96 -0400, Michael Froomkin wrote: >On Mon, 3 Jun 1996, Perry E. Metzger wrote: > >[...] >> Securities laws are extremely complex, extraordinarily broad, and >> subject to extremely flexible interpretation. I would suggest not >> attempting to skate a fine line near them -- the ice is very thin. > >Damn good advice, if you ask me. > >A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) However, it is becoming a deregulated industry. Like all the rest. DCF

1 0

Re: [Off-Topic] "Curfews"
by David Rosoff 17 Dec '03

17 Dec '03

Quoted text originated from tcmay(a)got.net -----BEGIN PGP SIGNED MESSAGE----- At 07.45 PM 6/1/96 -0700, you wrote: >Personally, I liked my "religious exemption" example. The Baal worshippers >can claim that they are engaging in their religion by grokking the >darkness. If picked up and held, they can claim they are "being held >without Baal." Isn't that a little far afield to go for a pun? :) >Most of the ordinances, including the one here, specifically state that >"blanket permission" by parents is not acceptable. They want _specific_ >reasons for being out after curfew. "To whom it may concern: My son, David Rosoff, is out of our house on this June 3, 1996, Monday night, to party with friends, cruise Central Avenue, and partake of the spores that grow of the earth. Signed, A. Parent" >(It's this taking control from both the kids and their parents and putting >it in the hands of cops that really bugs me.) "Me too." (Standard non-AOL disclaimer applies.) >By the way, if being out after curfew is breaking the law, can I make a >"citizen's arrest" of some of those nice young chicas in Watsonville? No comment. :) Really. - ------------------------------------------------------------------------------- David Rosoff (nihongo o chiisaku dekimasu) drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu or get from keyservers pub 1024/D37692F9 1995/07/01 David Rosoff <drosoff(a)arc.unm.edu> Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 I accept anonymous mail. If I didn't sign it, you don't know I wrote it. - --- "Made weak by time and fate, but strong in will / To strive, to seek, to find-- and not to yield." ----- "Ulysses", by Alfred, Lord Tennyson -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMbNtGBguzHDTdpL5AQGK3QQAhX6CSiEr3z8puAhwDYlbayF7dBEUMtsk DygPCjL2lJ5d//WrEZxKm6ku/PoDDF9NcGqKBlHhuMYzCfEkOzdcv1idQ6lrWoua ONM3fdGSJt46qplX4UuSQSyLhKqvAwaijw7QDPCAedEFJsVVBPaDT1vpxDOFdylO UJBwLDjYa4k= =+KQb -----END PGP SIGNATURE-----

1 0

Re: [Off-Topic] "Curfews"
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10.23 AM 6/2/96 -0800, jim bell <jimbell(a)pacifier.com> wrote: >This, the curfew situation, is yet another of the reasons I'd favor "playing >hardball" with the government. I'm very much against discriminatory >enforcement, but on the other hand I don't think my liberty should be >dependent on getting an organization like the ACLU to look out for and >complain against discrimination against me. Are you then also in favor of killing, ruthlessly and brutally, not to mention somewhat randomly, both the police and the ACLU? - ------------------------------------------------------------------------------- David Rosoff (nihongo o chiisaku dekimasu) drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu or get from keyservers pub 1024/D37692F9 1995/07/01 David Rosoff <drosoff(a)arc.unm.edu> Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 I accept anonymous mail. If I didn't sign it, you don't know I wrote it. - --- "Made weak by time and fate, but strong in will / To strive, to seek, to find-- and not to yield." ----- "Ulysses", by Alfred, Lord Tennyson -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMbNx2xguzHDTdpL5AQE6bgQAreE5ikGCKxsyjue0fEcKWtmmGU6o2WiU zTXD2Py8y395NVQFuSlrnWSJ4eKmIpePv1oZjgd7sE9wcpKjhHwHq2Fs/ZmsdEb2 CZxPY1qexpxolo0k8uFNbWvqxs/3ieOa0BzE7jmp0jyopejq2OjXheE1v3zGGKtt OBSb4vADydw= =X8Zs -----END PGP SIGNATURE-----

1 0

Re: Why PGP isn't so ubiquitous (was NRC Session Hiss)
by Joel McNamara 17 Dec '03

17 Dec '03

Well for crypto-novices that use Windows, I'm hoping life will get a whole lot easier. I'm putting the finishing touches on the next release of Private Idaho (http://www.eskimo.com/~joelm/pi.html) Aside from some new "power-user" options (working with Lance to support a DOS version of Mixmaster), the next release is going to be targeted at all those folks who are intimidated by PGP. This includes features like an auto-install app, expert and novice modes, and a series of wizards for stepping the user through common tasks (I'm sure the name "wizards" is trademarked by MS, so they won't be called that). Also included will be something called PGP QuickStart. This utility will hand-hold a user through the entire process of downloading PGP from the Net, and installing and configuring it. I just wrote an essay for one of the on-line magazines on "unintentional crypto-elitism." One of my points was that decent crypto technology is now in place, and one of the next evolutionary steps towards wide-scale acceptance is implementing simple and easy user interfaces. Developers of public domain and commercial crypto apps really need to take this to heart. Joel BTW - I'm guessing Private Idaho version 2.7 will be available within the next two weeks. Send me e-mail (joelm(a)eskimo.com) with PI_LIST as the subject to get on the notification list (people on the list will be able to download about a week or so before it goes into wide-scale release).

1 0

Re: [Off-Topic] "Curfews"
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09.59 PM 6/1/96 -0400, Duncan Frissell <frissell(a)panix.com> wrote: >I'm afraid that some courts have explicitly held that "the child does not >have a right to liberty but only a right to custody." That is old law, >however. Kids have lost many rights recently too including gun rights, etc. I've known for a while that I have no rights as a minor. [ironic smilie] >Of course curfew laws only control the inarticulate and scruffy. Well >dressed children (coat and tie for the boys dress or suit for the girls) who I'll wear a suit if it means I won't get picked up ... :) >can claim that they are out doing tons of protected things like work and >school and worship and political campaigning and "trying to save street >children for Jesus" will not be picked up. They can also say things like >"Ossifer, I'm peaceably assembling to petition the government for redress of >grievances. It's in the First Amendment. You could read about it and >everything." You suggest that we minors stand up for ourselves? How odd. I'm sure no one has ever thought of that before, President Clinton especially. Since any nationally imposed curfew wouldn't have a leg to stand on in the first place, this can only improve the situation. >Home schooled children face this problem frequently and can usually find >something to say. Kids older than 15 or so can claim to be "emancipated >minors." Parents can emancipate their children by signing a simple >declaration to back up this claim. A good idea in any case. This sounds interesting. What are the particulars of being an emancipated minor? >"Whose children never got stopped by cops because at 14 they passed for 21. >Clothing and bearing alone can do it." I wish I were so lucky. At 15 I seem to pass for ... 12. I guess if the cops read from right to left ... - ------------------------------------------------------------------------------- David Rosoff (nihongo o chiisaku dekimasu) drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu or get from keyservers pub 1024/D37692F9 1995/07/01 David Rosoff <drosoff(a)arc.unm.edu> Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 I accept anonymous mail. If I didn't sign it, you don't know I wrote it. - --- "Made weak by time and fate, but strong in will / To strive, to seek, to find-- and not to yield." ----- "Ulysses", by Alfred, Lord Tennyson -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMbNsyxguzHDTdpL5AQGvfwP/f2PDE5JPiczwY/5EFt/ziT9UePbcxCV0 UCbYdkbl9hoNlMphUu+O+zneGntCVOIiEoPZLTpK35TYFgA/MCOQhuiCYnvbInMo pZlmnTvyoUI1rkHTUzf2cHRg1+18ieJqDDqBqBb58ZxaLxxJ1crUDrL+QHC/QZE9 mAiLT9tnwgc= =/+GV -----END PGP SIGNATURE-----

1 0

No Subject
by qut＠netcom.com 17 Dec '03

17 Dec '03

list cypherpunks

1 0

Re: Why PGP isn't so ubiquitous (was NRC Session Hiss)
by Deranged Mutant 17 Dec '03

17 Dec '03

On 3 Jun 96 at 11:27, Bruce Baugh wrote: > Date: Mon, 03 Jun 1996 11:27:33 -0700 > At 04:33 AM 6/3/96 +0000, Deranged Mutant wrote: > > >In part because it's not well integrated with mailers. That could > >change with a PGP3 DLL. > > I have a growing feeling that PGP 3 is never going to happen. Or that if it I'm soft-of having that feeling too. Or what's going to happen is that enough people will get impatient and international versions will start to appear. > does, it will happen only after the passage of more draconian anti-privacy > laws, and the guys working on it will be forced to include sundry backdoor > stuff or drop it altogether. More likely drop it altogether, or be openly admit they were forced to include GAK (people will want the source, anyway). > I suspect someone could do quite nicely by going ahead and developing a > 2.6.2 or 2.6.3 DLL. There's been talk. But just talk. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

4 3

The problem with encryption, period.
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

The problem with encryption is that 1) it takes effort, and so 2) you must have a non-empty threat model. With (2), you have to trust that you're really encrypting, which takes 3) a certain sense of paranoia. For most people, all three are lacking, which is why proposals like s/mime are succeeding. One button, no security, encryption. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software | Crynwr Software sells packet driver support | PGP ok 11 Grant St. | +1 315 268 1925 voice | It's no mistake to err on Potsdam, NY 13676 | +1 315 268 9201 FAX | the side of freedom.

1 0

Re:
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:46 AM 6/4/96, qut(a)netcom.com wrote: >ncr terminals are the most 31173 D0Dz Kenneth, what is the frequency? Kenneth, what is the frequency? --John Hinckley, First Disciple of AP

1 0

Java
by Perry E. Metzger 17 Dec '03

17 Dec '03

I've been rather hard on Java here lately. I'd like to state, for the record, that I have nothing against the folks at Sun. They are good, smart people, and I'm sure they mean well and aren't in on some evil plot. However, that doesn't make Java a good idea. For at least twenty or more years, people have known that for the ultimate in multimedia email or what have you all you would need to do is make the recipient execute a program that you sent them. This obviates all the questions of having to figure out what sort of things you would want to send -- if you can execute a program, you can do anything. Unfortunately, this is also so phenomenally obvious a security problem that no one ever proposed it as anything more than a joke -- until now. Sun is, unfortunately, suffering from a substantial hubris problem. As I have noted, the original Java applet security model and all the followups have had exactly the same problem -- they depend on perfect implementation of every element of the security model for the security to work, instead of having the realistic and conservative assumption that portions of the model will be misimplemented, and designing for defense in depth. Beyond that, however, they have created the ultimate hype monster. Java is a neat idea looking for a good application. I use the web all day long and I have yet to see a good use for Java. We have, essentially, mortgaged our system security for almost nothing better than the occassional gee whiz animation that could have been implemented with a safe graphics description format instead of a turing equivalent language. Again, I don't hate the Sun people or hold any animosity towards them. However, I will point out the lesson that any good student of Greek Tragedies could tell you -- the gods punish hubris, and severely. Perry

2 2

Audit & Security reviews
by alc 17 Dec '03

17 Dec '03

UNIX and DEC VMS Security Reviews I would like to take this opportunity to tell you about two of our audit software tools, PCUA and PCDA. PCUA and PCDA are PC based software tools designed to review the security of Unix or DEC computers using only the stand-alone PC in your office. There is no need for connections to the system, user-IDs or even a knowledge of computer security. Simply obtain a copy (usually on a floppy disk) of key files from the system under review, load these onto your PC and let our tools do all the work. These packages are ideal for use by auditors, security officers and computer system managers - anyone who takes computer security seriously. The programs produce a wide variety of reports which show the findings, explain the implications of the problems and then make recommendations about how to improve security. Reports range from a full, detailed report which is user-definable to a brief list of the problems found. Both packages are evolving products and we continue to add new tests to them, as well as keeping up to date with the latest releases of the operating systems. If you would like further tests added, we would be pleased to include these in our next release. To obtain more information or demonstration disks then please contact us. Thank you for taking the time to look through this email. Alastair Coxall Technical Director TRILLION SOFTWARE Ltd The Firs, Broadwalk, Cranleigh, Surrey GU6 7LS, England Tel: +44 1483 274001 Fax: +44 1483 274017 Email: alc(a)trillion.demon.co.uk

1 0

Re: Java Crypto API questions
by br＠doppio.Eng.Sun.COM 17 Dec '03

17 Dec '03

|> This is hard. It's probably not going to make it in the first |> release. The simple first pass is to say "code signed by x, |> y, and z" can do whatever it wants. | |Good thing Sun is spending millions pushing a brand-new language down our |throats so we can do nothing we couldn't already do. After all the hype |about security, security models, and sandboxes we get signed applets that can |do anything. What a let-down. Just to clarify a couple of things. We're not pushing anything down your throat. You are still perfectly free to use Visual C++ if that is what you prefer. A statement to the effect of "is probably not going to make it in the first release" means the following things: - If we can, we will make it happen (in some form) in the first release. We're just trying to set expectations realistically. - We think that the ability to let applets have free reign is useful,and since that is easier, we are certain to put it in the first release. - No matter what we do, we must address some very thorny issues of key management and user trust model, so doing this will be useful. |Currently, the only safe way to run untrusted Java code is to not run it. |This probably isn't going to change (see cpunks archives for reasons). If |Sun cannot prevent untrusted code from doing nasty things, how can they |prevent code empowered with certain capabilities from doing things they are |not certified to do? It now seems that all the effort, time, and money to |move towards Java over another OO language was a waste in a way since it no |longer appears to have any security advantages. Ignoring security, Java is |not a bad language at all, but it still has distinct disadvantages over some |of the possible alternatives (mainly immaturity, no dynamic message |invocation, interpreters still not ready for prime-time). The important thing to remember is that we're not going to come out with an implementation and claim to have solved the capabilities model problem. We're taking a first step at using signatures with Java for security purposes, but this is only a first step. We remain fully committed to finer and more powerful security models. Note that an application written to the Java platform will be able to implement security policies based on digital signatures which are not fully permissive. Cheers, -- Benjamin

2 1

CWD: "Jacking in from the "One that Got Away" Port
by declan＠well.com 17 Dec '03

17 Dec '03

(By Brock Meeks / brock(a)well.com / Archived at http://www.cyberwerks.com/) CyberWire Dispatch // Copyright (c) 1996 // Jacking in from the "One that Got Away" Port: Washington, DC -- President Clinton call your spooks, get FBI Director Louis Freeh on the phone. Tell them to order in pizza. Bill, it's going to be a long night. All your plans to hold the U.S. crypto market hostage have just been fucked... and you didn't even get kissed. A virtual tactical nuke was hurled into the arcane subculture of encryption technology Monday when RSA President Jim Bizdos revealed that his company's Japanese subsidiary had developed a monster chipset capable of scrambling voice and data real time with a so-called "key length" of up to 1024 bits. That key length stuff is just so much gibberish to those playing without a scorecard, so let me drill down on it for you. Basically, the longer the key length, the harder it is for a message to be broken by "brute force" automated attacks. Current U.S. laws prohibit the export of any encryption device with a key length longer than 40-bits, or roughly the equivalent of Captain Crunch decoder ring. For hardcore math types, I'm told that a 1024-bit key length is 10 to the 296th power more difficult to break than 40 bits. Bizdos, speaking during lunchtime at the Electronic Privacy Information Center (EPIC) 6th Cryptography and Privacy conference, told how his Japanese based company, Nihon-RSA, developed a set of two chips capable of scrambling messages at a level that will make the spooks in the Puzzle Palace (the National Security Administration) cough up hair balls that would make the First Cat Socks envious. Bizdos seems to have found crypto's magic bullet; a legit way to essentially give the finger to U.S. export laws for crypto product. For years now the White House has been locked into a kind of crypto war. The Administration insists that strong encryption products must not be exported for fear that "terrorists, child pornographers and drug barons" and a rabble of assorted "bad guys" would snag the technology and proceed to plot the destruction of the "World As We Know It"... or at least Western Democracy, if the inbred Iranians got in line first. The White House crypto-fascist team, led by the NSA, FBI and assorted military hawks, have offered braindead compromise plans, including three versions of the "Clipper Chip." This is a plan whereby you can buy strong locks for your data with the simple caveat that when you buy and use the products, you have to put the decoding key "in escrow." This way if a law enforcement agency ever has the need to unscramble any of your messages -- without you knowing it -- they can simply ask for these escrowed keys and have them handed over. Yes, even your local sheriff's department can ask for the keys. Now, the government promises it will use this power only for good and never for evil. Honest, that's what they say. Of course, the Justice Department, in writing the rules for getting the keys, totally absolves any law enforcement agency of all harm if this power is abused in any way. Oh.. and if that power is abused, the sheriff or the FBI or fucking Park Police for that matter, can still use any "evidence" they gin up on you. Honest, I'm not making any of this stuff up. So the battle has raged. The industry has been loathe to develop such products only for the American market because the cost of producing essentially duplicate products for domestic and foreign markets just wouldn't be cost effective. So, you and I are stuck having to use some pretty tedious encryption technologies, such as PGP (Pretty Good Privacy), which is great, but tough to use. Or we can use the Captain Crunch Decoder ring equivalents available off the shelf. In the meantime, other countries are happily making and distributing robust encryption technologies, at a possible loss of up to $60 billion for U.S. companies. In fact, it's a crime even to put a program like PGP on your laptop and go overseas. The State Department calls that "exporting." The government recently dropped a case against Phil Zimmermann, the inventor of PGP, after putting him through several hellish years in which they threatened to toss his ass in jail. There Phil would no longer be a threat to society at-large, but instead become a "girlfriend" for a 265 pound felon named Spike. Phil's "crime"?? That somehow his PGP app had been uploaded on to the Internet and whisked around the world. Phil didn't do it, but the U.S. government cried "export violation," anyway, eventually telling him, "Oh, never mind." So Bizdos, tired of fighting the wars here, enlisted the help of the Japanese. After setting up his Japanese unit, he hired a crack team of Japanese crypto experts who essentially "reverse engineered" the company's own U.S. crypto product, according to Kurt Stammberger, RSA director of technology marketing. It was a brilliant move. Bizdos can't be slammed by the State Department for violating crypto export laws because, well, he didn't export a damn thing, except some U.S. greenbacks, which of course, could have gone to U.S. cryptographers, but let's not quibble about jobs. Anyone want to kick around the subject of global competitiveness? What's happened here is the Japanese have now trumped the entire world on the crypto market. What's more, Clinton's brain-dead allegiance to the FBI, et al., has now allowed the Japanese government, which still owns a large share of NTT, which owns a minority share of RSA's Japanese subsidiary, to have a lock on the world's strongest encryption technology. Can you say "Remember the VCR" or "Remember the Semiconductor" or how about "Thanks, Bill. We're fucked." The boys in the Pentagon made a stink a few years ago when a Japanese company made a play for Fairchild, a top defense contractor. It was feared that the Japanese, by swallowing up the U.S. company, would also gain access to technologies vital to the U.S. military. The deal was squashed. Natch... now it looks like the G.I.'s with the stars on their shoulders have just put their spit-shined combat boots up their own ass by supporting Clinton and his continued ban on crypto exports. "We truly have ceded this market Japanese companies," Bizdos said. "It's almost too late to turn it around." Some 15 COUNTRIES have already placed orders for these chips, Bizdos said, adding that the Japanese will not build the chips with a key escrow function. EPIC Director Marc Rotenberg said he was told by a Japanese representative that the country's constitution wouldn't allow key escrow because it doesn't allow wire-tapping. Umm... maybe the Japanese just don't have *really* bad guys like the FBI assumes we have here. What's more, Bizdos says the deal with NTT is "no coup." He says the Germans and French "aren't far behind" in developing similar technologies. The RSA bombshell "fuels the argument that this stuff can't be contained in our own borders," said PGP's Zimmermann. Just how the relationship between NTT and RSA works out isn't set, Bizdos acknowledged. "They'll pay us a royalty for the chips they sell," he said. "We're working it all out." Meanwhile, from my office window here in DC I've already counted 17 Domino's Pizza delivery bikes go screaming by on their way to the White House. Through my telescope I can see the White House balcony; it looks like Bill is sick, like he's just heard some "really bad news." And behind him, just inside the double-doors, on a persian rug placed there by Warren G. Harding, I think Socks the Cat has just coughed up a hairball... or maybe it was Louis Freeh. From this angle, I just can't be sure. Meeks out... ------------ Additional reporting by Declan McCullagh (declan(a)well.com)

2 1

Re: Fate of Ecash if RSA is cracked?
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 8:01 AM 6/3/96, Perry E. Metzger wrote: >Dr. Dimitri Vulis writes: .... >> This'll happen, probably sooner than later. > >Why do you assume that? There are plenty of problems that are >provably not solvable in non-exponential time even if P=NP. What makes >you think this one is going to be solved? > >.pm The "Idea Futures" forum has established odds on this. The current odds are currently 60% that a 1024 bit number will be factored by 2010 and 30% that a 512 bit number will be factored by 1997. See <http://if.arc.ab.ca/IF.shtml> for Idea Futures and <http://if.arc.ab.ca/bin/summary> for odds for various questions.

4 4

Fate of Ecash if RSA is cracked?
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Hello, After reading Comm. of ACM and Schneier's book about ecash, a question arose: what if the underlying public key cryptographic scheme gets broken somehow? Suppose, for example, that someone discovers an ultra-fast factoring algorithm or something like that. What would happen with all ecash that's been issued? Of course criminals would be able to forge large amounts of authentic-looking ecash, so banks should not be honoring requests to convert e-cash into real cash. I apologize in advance is this question is silly, and will appreciate your corrections. - Igor.

5 7

Re: Why PGP isn't so ubiquitous (was NRC Session Hiss)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:59 PM 6/3/96, Deranged Mutant wrote: >On 3 Jun 96 at 11:27, Bruce Baugh wrote: > >> Date: Mon, 03 Jun 1996 11:27:33 -0700 >> At 04:33 AM 6/3/96 +0000, Deranged Mutant wrote: >> does, it will happen only after the passage of more draconian anti-privacy >> laws, and the guys working on it will be forced to include sundry backdoor >> stuff or drop it altogether. > >More likely drop it altogether, or be openly admit they were forced >to include GAK (people will want the source, anyway). I can't imagine _any_ set of circumstances which would cause Zimmermann, Atkins (?), Plumb (?), and anyone else who might still be on the PGP development team to include GAK. After all, those heartwarming stories about Burmese rebels using PGP to communicate using laptops in the jungles would then be replaced by: "16 April 1998, A.P., Rangoon, Burma. Internal Security Minister Bopalong Myanmoon announced today that rebel communications were intercepted and decrypted two weeks ago with the cooperation of the International Key Authority. As a result of this raid, 63 rebels were captured, tried, and executed. Visiting Rangoon at the time, U.S. Attorney General Louis Freeh was said to be satisfied that international key escrow was having such positive effects." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

[NOISE] rec.music.white-power failed 592:33033 FYI
by Rich Graves 17 Dec '03

17 Dec '03

The official result, including the votetaker's explanation for the extraordinary delay (which makes interesting reading), is in news.announce.newgroups, Message-ID <833851386.24895(a)uunet.uu.net>. Or for people who only use Netscape: http://ww2.altavista.digital.com/cgi-bin/news?plain@msg@31323@news%2egroups news:833851386.24895@uunet.uu.net While I think I was one of the people presenting legitimate reasons for voting no (as opposed to all the "VOTE NO ON NAZIS!" -- see news.groups archives), I'm actually disappointed that there were only 592 yes votes. I'd have expected more than the estimated 400 anti-censorship and spam-annoyance reactions. I would urge people NOT to download the 3MB list of votes, as I haven't, because the vast majority of voters had no clue what they were voting on. The majority probably thought it was a secret ballot. The poor votetaker definitely deserves a medal, but PLEASE don't send him appreciative mail; he's getting far too much already. Sent separately to fight-censorship and cypherpunks. Followup discussion, if any, belongs in news.groups ONLY. -rich

1 0

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad??
by Deranged Mutant 17 Dec '03

17 Dec '03

On 3 Jun 96 at 15:18, Jeff Barber wrote: > I trust it won't stun you to find that many, many large and even small > corporations -- including my current employer [*NOT* SecureWare, BTW, > despite the email address] -- actually encourage their employees to buy > stock by offering stock purchase plans as a benefit of employment. They > even make it convenient by deducting purchases from one's paycheck. [..] There's a difference between a) buying stock in your employer's company generally [above example] and b) buying stock in your employer's company because your department is working on something that will raise the stock value etc. etc. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Idea 'bout banning the internet
by Deranged Mutant 17 Dec '03

17 Dec '03

On 3 Jun 96 at 16:16, Blake Wehlage wrote: > What if in the future a country banned the internet and all things that had > to deal with it (ie- telnet, irc). It would be the "underground" thing. Depends. If it were run by people like the Khmer Rouge than anybody who so much as knows how to use a pocket calculator is better off leaving the country. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by rick hoselton 17 Dec '03

17 Dec '03

>Perry E. Metzger writes: >> Timothy C. May writes: Suggestion #1: Never get your legal advice from cypherpunks newsletter. Suggestion #2: If you absolutely can't resist going against Suggestion #1, then listen carefully to Perry. As just a lowly programmer around here, I have often been told that I would be breaking the law if I trade on some piece of information before it becomes public. I am not such an "insider" that I must register my trades 90 days in advance. I've read the actual statute. (though I am not a lawyer and, these days, even lawyers don't know what a law means until the final verdict) You might also want to ask Ivan Boeskey(sp?). I think he's out of Federal prison by now. He's the guy that cut a deal with the Feds to give him time to sell a few billion dollars worth of stock before being arrested, so that he could pay his fine. Once he was arrested, the value of those stocks fell. It looks to me like he and the Feds traded on inside information so that he could pay his fine for trading on inside information. He still went to jail, and he had enough money for good lawyers. Imagine what would happen to me! >IANAL, but I think you must be wrong about this, Perry. If this were >the case then, as an employee of company XYZ, I would never be permitted >to buy XYZ stock (which is clearly not the case) since I *always* have >information that others outside the company do not (about staff changes, >product plans and such). I suspect the deciding factor must have to do >with the ability to execute actions which have substantial direct effects >on the stock price (i.e. buying a company, declaring dividends, having a >massive downsizing, etc.). > > >-- Jeff >

5 4

Markoff in NYT on NTT/RSA chip
by Declan McCullagh 17 Dec '03

17 Dec '03

Heh. You read it first in the CyberWire Dispatch Brock and I put out earlier tonight. :) -Declan --- Japanese Data-Scrambling Chip Renews Debate By JOHN MARKOFF W ASHINGTON -- Nippon Telegraph and Telephone Corp. has quietly begun selling a powerful data-scrambling chip set that is likely to undermine the Clinton administration's efforts to restrict the export of the fundamental technology for protecting secrets and commerce in the information age. The existence of the two-chip set, which will have broad potential application for local computer networks, the Internet and telephone switching networks, was disclosed in Washington in a speech Monday at a public policy workshop by the chief executive of RSA Data Security, a Silicon Valley-based company that has frequently dueled with the administration over its export-control policies. [...]

5 5

Re: Something that just crossed my mind. Sorry.
by remailer＠2005.bart.nl 17 Dec '03

17 Dec '03

At 10:01 AM 5/31/96 -0700, Sandy wrote: >At 10:35 PM 5/30/96 -0500, snow wrote: > >>It is my position (until proven wrong--please) that larger business DON'T >>want anonymity. They _want_ to be able to track purchases and use of their >>product for several reasons. Let me first claim that I am an employee of a "larger business." Not that unless someone tracks me through the remailers is there any proof of that, but accept for now that it's not outside of the realm of possibility. I wish I could prove you wrong. I can inform you that you are correct, actually. There are large retail companies that track sales data on credit card account numbers and cardholder names in direct violation of any contract you may have with American Express (and possibly Visa and others, I have not seen those contracts). The data they capture is pretty impressive. I'm sure most of you probably get a direct mailing or two from them every now and then, based on your shopping habits. >Two quick answers: > >1) What big business wants and what it would be > willing to accept in order to make sales, are > two different things. While demographic data > are nice, an more robust economy full of big > spenders is better. And demographic data on big spenders is worth more than anonymous cash from people who buy packages of gum. Much more. The best part of the equation is that the big spenders are giving up the demographic information for free, every time they hand over a credit card. You even filter out the gum-buyers because gum-buyers use cash, which you don't track. An economy of big spenders is worthless unless they're in your store. The cards give evidence of who spends in your store, so you target your advertisements accordingly. >2) Big businesses are made up of individuals. > Most individuals would still prefer to have > their own privacy preserved even if they would > prefer less privacy for others. All it takes is one well-positioned executive who values profits more than his own privacy to say "Capture this personal data" and that data gets captured, regardless of who gets fired complaining about it. Trust me. And I value my job more than I value your privacy, which is why this is going out through a remailer. I also shop only with cash, here and elsewhere. Double-blinded e-cash will be the only way to go, if it ever is the way to go.

2 1

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:30 PM 6/2/96, Martin Minow wrote: >> >>One of the oldest tricks for running a stock up (or down) is >>to put rumor teams on elevators in the financial district of >>major cities. > >It would be more efficient to talk about the rumor on a cellular >phone. Probably make a nice sting scenario, too. An interesting example, but I'm having a hard time figuring out who has committed a crime, even by SEC rules. Namely, are the people "talking up" a stock committing a crime? Even if the SEC forbids this (under defined circumstances and for defined persons, as most of us are not covered by any such laws), how can talking over a "putatively secure" cell phone be construed as talking up a stock? And, how can someone who acts on overheard information--as in the elevator example Sandy cited--be charged with any crime? Unless they are "insiders," covered by SEC rules about trading, they are free to act on essentially anything they hear. "He who hesitates to act on inside information is lost." (To elaborate on this: I was never classified as an "insider" during my time at Intel, and I certainly bought and sold the stock based on what products and news I knew was coming out or what rumors I'd heard. Only a select group of executives and staff in the specific departments generating earnings announcements, auditing, etc., were covered. And senior executives are covered by various rules about trading stocks. And family members and friends may be covered, if they learn of "inside" (in the SEC sense) information. But ordinary people, even employees of a company, are not considered to be "insiders" and hence are not covered by insider trading laws.) So, the only way I can imagine the cell phone case leading to an insider trading charge is if the cell phone users _knew_ that the cell phones were not secure, and _planned_ to have their conversations overheard. The people doing the intercepting could be charged under one of the laws covering unauthorized interception of cell phone conversations, but probably not for insider trading. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

7 15

MOSS vs. S/MIME vs. PGP/MIME Matrix (fwd)
by Adam Shostack 17 Dec '03

17 Dec '03

----- Forwarded message from Rik Drummond ----- >From ietf-request(a)IETF.CNRI.Reston.VA.US Thu May 30 09:26:53 1996 Message-Id: <v02130500add3465435b8(a)[199.184.212.213]> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Thu, 30 May 1996 08:05:48 -0500 To: ietf-ediint(a)imc.org, Electronic Data Interchange Issues <EDI-L(a)uccvma.ucop.edu>, ietf(a)CNRI.Reston.VA.US Sender: ietf-request(a)IETF.CNRI.Reston.VA.US From: Rik Drummond <drummond(a)onramp.net> Subject: MOSS vs. S/MIME vs. PGP/MIME Matrix Source-Info: From (or Sender) name not authenticated. The EDI over Internet (EDIINT) working group will recommend standards which facilitate "EDI interoperability over Internet - Now" during the third quarter of 1996. Two of the many requirements are the implementation of encryption and signature for EDI transactions using existing standards/products, such as: MOSS, S/MIME, PGP/MIME and DMS. These four standards/products "generally" fit the needs of the EDIINT effort. We must choose those that best fit our requirements. A Comparison Matrix compares the products/standards across over 30 technical and business areas. Please take time to contribute your expertise to the effort by commenting on the existing information. This matrix is the basis for determining which security products/standards/algorithms to use for EDI over Internet. The matrix is also a significant tool for selling our final recommendation to EDI business product development management. The comparison matrix is in html format at http://ftp.sterling.com/edi/ietf-ediint/decision.html. Thank you. Rik Drummond Chair EDIINT ------------------------------------------------------ | Rik Drummond - The Drummond Group | | 5008 Bentwood Ct., Ft. Worth, TX 76132 USA | | Voice: 817 294 7339 Fax: 817 294 7950 | ------------------------------------------------------ ----- End of forwarded message from Rik Drummond ----- -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0