December 2003 - cypherpunks-legacy

[ANNOUNCE] Eternity server 1.01 alpha release
by Adam Back 17 Dec '03

17 Dec '03

Annoucing the `eternity server'. Alpha testers wanted. See source code at: http://www.dcs.ex.ac.uk/~aba/eternity/ System requirements are: unix perl5 news source (local news spool or access to nntp server) pgp (2.6.x) web space ability to install cgi-binaries ability to schedule cron jobs a plus but not essential Unfortunately I have not got a service up and running for you to play with because I don't meet those requirements (in cgi capability on the server I would otherwise like to use). If someone wants to set one up to demo, and post the URL that would be useful. The local news spool stuff is tested better than the nntp server stuff, but it is all there and the nntp stuff was working at one point. Remember this is alpha code. If you can hack perl and want to stress test the nntp server stuff or the rest of it that would be helpful. What is an Eternity Service? (Some of you may recognize the name `Eternity Service' from Ross Anderson's paper of that name. What I have implemented is a related type of service which shares Anderson's design goals, but has a simpler design. Rather than invent a new name, I just borrowed Anderson's, unless anyone can think of a better name. Anderson has the paper available on his web pages (look for `eternity') at http://www.cl.cam.ac.uk/users/rja14/ Also I heard that Eric Hughes gave a talk on UPS `Universal Piracy Service' I presume this has similar design goals, though I have not heard further details.) I have implemented this to give something concrete to think about in terms of creating something closer to Andersons real eternity service in robustness. The eternity server code above provides an interface to a distributed document store which allows you to publish web pages in such a way that the attacker (the attacker here is a censor such as perhaps a government, perhaps your government) can not force you to unpublish the document. It's architecture is quite simple. We already have an extremely robust distributed document store: USENET news. We already have the ability to post messages to the document store anonymously: type I and type II (mixmaster) remailers. So theoretically we can publish what ever we want, just post it to USENET. However retreiving the data is cumbersome. We must search USENET with a search engine, or look manually for the document, the document will expire after some short time. You may still be able to find the document in a search engine which archives news for longer periods such as dejanews or altavista. However, it is not as user friendly as a web based interface, there are no hypertext links between related documents, there are no inline graphics, etc. So my `eternity server' is a kind of specialised web search engine which acts as a kind of web proxy and provides a persistent web based interface to reading web pages stored in encrypted documents posted to different USENET groups. The web search engine provides persitent virtual URLs for documents even if they move around with different in different news groups, being posted via different exit remailers. Signatures on documents allows the user to update document. The web proxy has options to cache documents, and otherwise fetches from a USENET newsspool or nntp news server. Technical Description The system offers different levels of security to users. All documents must be encrypted. The subject field of the document should include the SHA1 hash of the document's virtual URL. (All eternity virtual urls are of the form: http://[virtualsite].eternity/[documentpath] that is they would not function as normal urls because the use the non-existant TLD "eternity". You may be able to use this facility to get your browser to look at a particular eternity server to serve documents of this form). The lowest level of security is to encrypt the document with PGP -c (IDEA encryption) with the passphrase "eternity". This is just obfuscation to make the documents marginally harder to examine in USENET without using the eternity service to automate the process. The next level of security is encrypt the document with the SHA1 of a 1 prepended with the URL. ie passphrase = SHA1( "1". "http://test.eternity/doc/" ) This means that you can not read documents unless you know the URL. Of course, if you can guess the URL then you can read them. The third level of security is to additionally to one of the above two options to encrypt the document with another passphrase of your chosing. Then you can give the passphrase only to those amongst your circle of friends. Additionally support is given for signed documents. This is important because once you've published a web page you might wish to update it. And yet you don't want other people updating it with a blank page (or otherwise changing your page) as this would be as good as the ability to remove the page. If you include a PGP public key with a document, the eternity server will associate that PGP key with the hash of your documents URL. Any attempts to update that document will only succeed if signed by the same PGP key. The document server has the option to cache documents. Cacheing can either be turned off (in which case documents are always fetched from the news spool, this is not that inefficient as the news spool may be local, and the server keeps a database of USENET group/article number against document hash, and so can directly fetch the document), or cacheing can be turned on, or cacheing can be set to encrypted, in which case documents in the cache are encrypted with a passphrase derived from the SHA1 of the document's URL by prepending a 1 to the URL. In the encrypted mode if the server operator is not keeping logs, he can't decrypt the documents in his own cache. If cacheing is off there are no documents in the cache, only in the USENET news spool. In addition some users will have a password which is pasted into an extra password field on the field Users can set their own per document cacheing options (they can set no cacheing to override the options of on or encrypted on the server), or they can set encrytped to override cachine turned on, etc. There is a document index at eternity root ( "http://eternity/" ), and users may optionally request documents to be included in the directory of eternity documents and virtual hosts. It makes sense to include the root document of your set of web pages in the index, and to leave the rest out of the index. Then you can link to your own pages from your original page. Relative URLs work, inline graphics work, site relative URLs work, and it includes crude support for mime types, so most normal web data types will work as normal. The document format is: [flags] [pgp key] [eternity document] The flags are can be any of: URL: http://test.eternity/example1/ Options: directory or exdirectory Cache: on/yes/off/no/encrypt/encrypted Description: An example eternity document The pgp key is an asii armored PGP key, and the eternity document must also be ascii armored and may optionally be signed (with the acompanying pgp key). The eternity document can also be encrypted again inside that layer with a user key which need never be revealed to the server. The overall document is encrypted with PGP -c password "eternity", or with a password obtained by prepending a 1 to the URL as obtained like this. % echo -c 1"http://test.eternity/example1/" | sha1 The flags, pgp key and eternity document can be arbitrarily jumbled up in order. The eternity server source code includes an examples directory. The eternity server has a configuration file which is heavily commented: eternity.conf. Threat Models Think of this as a specialised search engine. If you don't like the documents you find, then change your search terms, don't complain to one of the many search engine maintainers! The Eternity Service is designed to facilitate publishing in a web based form of non government approved reading or viewing material, or the publishing of non government approved software, or other "liberated" documents, programs, etc. Each user can easily install their own search engine in a shell account for their own use. Newsgroups are very robust against attack because they are part of a distributed system: USENET news. It is difficult to remove a USENET newsgroup (the Scientologists know, they tried and failed, and they have seriously deep pockets, and attitude to match). For the eternity service it probably doesn't matter that much if you do get rid of a particular newsgroup, eternity documents can be in any newsgroup. Somehow I don't think you'll succeed in getting rid of all USENET newsgroups, ie in shutting USENET news down. I'm not sure that a major government could succeed in that even. Information wants to be free. Long live USENET news. Improving robustness The main problem with this system that I see is that documents don't live long in USENET news spools as expiry dates are often 1 week or less. So to use the service you'd have to set up a cron job to repost your web documents every week or so. Some documents remain in the cache and so survive as long as there is interest in them. An immediately easy thing to do is to include support for fetching and looking documents up in altavista's news archive and in dejanews archive. This shouldn't be that difficult. The eternity server article database already includes newsgroup and message id against document hash, all that is required is to formulate the requests correctly. If anyone wants to add this, feel free. A mechanism for eternity servers to query each other's caches would be one mechanism to think about. Another would be to charge anonymous digicash rates to keep documents in the cache a couple of $ per Mb/year. Also you could perhaps think about charging for acccesses to the service and passing a royalty back to the document author. There is no `ownership' of eternity virtual domains, or of document paths. If Alice puts a document at http://books.eternity/, there is nothing to stop Bob putting other files under that virtual domain, such as http://books.eternity/crypto/. However in general Bob can't make Alice's document point to his URLs. Bob can't modify or remove Alice's pointer from the eternity directry http://eternity/. But he can add his own entry. There can however be race conditions. If Alice puts up a document on http://books.eternity/ which points to an inline gif, but hasn't yet put up that inline gif, Bob can get there first and put up a picture of Barney until Alice notices and changes here pointer to point to the picture she wants to point at. So one solution would be to only accept documents which are signed by the signator of the next domain up. First come first served for the virtual domains, the key signing the root dir of the virtual domain is checked for each file or directory added under that. Note even if the URLs are exdirectory, this need not be a problem as you can just try the path with one directory stripped off. Could be done. Is it worth it though? It would add overhead to the server, and there is minimal distruption someone can cause by sharing domains. Perhaps it is desirable for someone to own a domain by virtue of being the first person to submit a document with the hash of that domain together with a key. Comments? The rest of this document is things on the to do list, if you feel like helping out, or discover a limitation or bug. To do list It could do with some documentation. And some stress testing. The file locking hasn't really been tested much. NNTP may be flaky as I made some mods since last debugging. It would be nice to have a CGI based form to submitting documents. Paste signed ascii armored document here. Paste public key here. Click radio buttons to choose options. Enter URL here. Type in newsgroup to send to. Click here to submit through a chain of mixmaster remailers. There are a few bugs in the above system which ought to be fixed, but this is alpha code, and they are on the TODO list. One problem is that the flags aren't signed. A change of message format will fix that in a later version. The basic problem is that you can't check the signature until you've decrypted and obtained the key. At which point you have to decrypt again. A simple fix would perhaps to be to put the public key outside the outer encryption envelope, but that is unattractive in terms of allowing author correlation even by people who don't have passphrases or don't know URLs. Better would be to just decrypt once, obtain the key if there is one, and then check the sig again. The server already keeps a database of PGP keys (not using PGP's keyring) it stores keys by the SHA1 hash of the armored public key and indexes against document URL hashes. In this way public keys do not need to be included in later document updates. This could be used to check a signature on the outer encryption layer. Then only the first post needs to decrypt twice (once without key available to check sig, and then again with key available). As a nice side effect this protects against the PGP 0xdeadbeef attack (or 0xc001d00d as Gary Howland has on his public key). Another problem is when scanning a newsgroup, if the scanned message can not be read it just stores it for later, so that when someone accesses the server who knows the URL for that document it can be decrypted and scanned for good signature and updated then. However the code only has a place holder for one document at the moment. That should be changed to a list and appropriate code to scan the list when the document is accessed. Once the newest document is found, the list of documents to be scanned can be discarded and the newest article stored against the hash in article.db. Another more subtle problem is that the code may update documents in the wrong order if multiple versions are posted to different news groups. The articles are scanned one group at a time. So if the groups are scanned in order alt.anonymous.messages followed by alt.cypherpunks, and version 2 of the document is in alt.anon.msgs, and version 1 in alt.cp, then it will update the document with the older version. Another to do list entry is the cache replacement policy. There isn't one, your cache will grow indefinately as documents are never removed. Another thing to do is the altavista and dejanews lookup via HTTP by message-id. All the place holders are there. If anyone wants to tackle any of the above tasks feel free. The program dbmdump prints out .db files in ascii so you can see what is there. eternity -u is suitable to run as a cron job, or just at the console. eternity -r resets everything, clears out the cache, empties database etc. eterity?url=http://blah.eternity/blah is the form to use as a cgi. It handles both GET and POST methods. There is a log file for debugging, see eternity (the perl program) for how to set different logging opitons. You can log most aspects of the program for debugging purposes. Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Rejecting Foreplay With Government Vermin
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Hume's evil twin wrote: (Declan take note...) "It is seldom that virginity of any kind is not lost all at once." - Human Gus

1 0

House subcom. passes crypto bill, USDoJ letter to panel
by Declan McCullagh 17 Dec '03

17 Dec '03

********** Date: Wed, 30 Apr 1997 19:28:10 -0400 To: fight-censorship-announce(a)vorlon.mit.edu From: Declan McCullagh <declan(a)well.com> X-FC-URL: Fight-Censorship is at http://www.eff.org/~declan/fc/ After all the backroom wrangling that led up to today's markup, the actual subcommittee vote on legislation that would lift export controls on encryption was an anticlimax. A House Judiciary subcommittee passed Rep. Bob Goodlatte's (R-Va) "SAFE" bill unanimously by voice vote. Not one member of the panel spoke against it -- even after the Justice Department tried a last-minute lobbying blitz to derail the bill. It's a tribute to the effectiveness of the high-tech lobbyists that even Rep. Bill McCollum (R-Fl) didn't slam the bill, as he was itching to do. Instead he had to be content with huffing: "I'm not saying I'm opposed to the bill; I want to put up a red flag. There are people in the intelligence community and criminal justice community who have expressed concerns to me." He warned he might have amendments later. And what else could he say? High tech was smart enough to recruit outside its ranks for unusual allies in its last-minute legislative push. An April 29 letter to the committee urging them to pass the bill included groups like the National Association of Manufacturers and the National Retail Federation. Goodlatte, the bill's chief sponsor, came up to me afterwards and grinned. "We already have a significant majority of the full committee supporting this bill," he said. "There's not one member of Congress who's stepped up and said they're openly opposed to this legislation. None." (Rep. Zoe Lofgren (D-Ca) noted that she received a letter from a coalition of groups criticizing the bill for imposing harsh criminal penalties for using crypto to further a crime. She vaguely promised to address it later. That section stayed in.) But the fight isn't over; rather, it's just beginning. SAFE still has to clear the full House Judiciary committee, and Sen. Conrad Burns' Pro-CODE bill has yet to advance in the Senate. Don't discount the Clinton administration and the Department of Justice -- the largest law firm in the world, with plenty of lobbyists who regularly swarm onto Capitol Hill to demand expanded police powers. An excerpt from the DoJ's fearmongering letter sent to the committee today is attached below. -Declan *************** April 30, 1997 Rep. Howard Coble Subcommittee on Courts and Intellectual Property chairman House Judiciary Committee Your Subcommittee will soon begin mark-up of H.R. 695, the "Security and Freedom Through Encryption (SAFE) Act." Although the Department of Justice supports H.R. 695's overall goal of promoting the wide dissemination of strong encryption, we believe that the bill would severely compromise law enforcement's ability to protect the American people from the threats posed by terrorists, organized crime, child pornographers, drug cartels, financial predators, hostile foreign intelligence agents, and other criminals. In addition, the bill would greately impair the government's ability to prosecute those crimes when they do occur. We urge the Subcommittee to reject H.R. 695 in its present form... We also oppose H.R. 695 because it would impede or prevent the development of a key management infrastructure. The bill could be read as prohibiting the United States government from using appropriate incentives to support a key management infrastructure and key recovery. Without such an infrastructure supporting key recovery, federal law enforcement investigations will become far more difficult. The problems that enactment of H.R. 695 would pose for state and local law enforcement, which lack access to supercomputers, are even greater... Sincerely, Andrew Fois Assistant Attorney General Office of Legislative Affairs U.S. Department of Justice ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ -------------------------------------------------------------------------- This list is public. To join fight-censorship-announce, send "subscribe fight-censorship-announce" to majordomo(a)vorlon.mit.edu. More information is at http://www.eff.org/~declan/fc/

3 2

SAFE Bill is a Disaster--"Use a cipher, go to prison"
by tcmay＠got.net 17 Dec '03

17 Dec '03

(A copy of this message has also been posted to the following newsgroups: alt.cypherpunks, talk.politics.crypto, comp.org.eff.talk) CDT and other Washington insider groups are busily singing the praises of the SAFE encryption bill, despite some acknowledged "minor flaws." Well, the flaws are not minor. The bill does not give Americans any rights they do not already have, and does not ease export of strong crypto in any meaningful way. In fact, the bill contains odd language implying it is essentially only financial software which is easier to export, and then only if the receiving country (huh?) allows it...since when is the duty of U.S. Customs to pass products for export based on whether Baluchistan, for example, wants the product? Ah, but things get worse. The language speaks of barring key escrow, but then says that law enforcment needs are not affected. This not only is not a bar on key escrow, which of course is not required at this time, but it also may open the door for "legitimate needs of law enforcement" key escrow. And, worst of all, it criminalizes the use of crypto in connection with the use of crypto in any prosecutable offense. Say "Fuck Goodlatte and the horse he rode in on" in a message using encrypted remailers, and the Communications Decency Act is violated (if it gets upheld). Voila, instant 5-year sentence. Use remailers to distribute information banned by Big Brother.... The chilling effect is exactly and completely analogous to the chilling effect intended when those giant billboards went up some years back with the dire warning: "Use a gun, go to prison." I hope the fools at CDT are prepared to help install the "Use a cipher, go to prison" billboards. I've been watching these so-called "crypto liberation" bills, Pro-CODE and SAFE, wend their ways through the legislative process. Both are severely flawed. Both should be rejected. Passing laws with flaws is worse than doing nothing, than just relying on the good old Constitution for our rights. Here's a partial analysis of this pernicious piece of legislation: At 2:19 PM -0800 4/30/97, Alan Davidson of CDT wrote: > CDT POLICY POST Volume 3, Number 1 April 30, 1997 > > CONTENTS: (1) House Subcommittee Approves SAFE Internet-privacy bill >----------------------------------------------------------------------------- >HOUSE SUBCOMMITTEE APPROVES SAFE INTERNET-PRIVACY BILL > >The House Judiciary Subcommittee on Courts and Intellectual property today >approved the Security And Freedom through Encryption (SAFE) act (HR 695), >sending the SAFE bill to the full House Judiciary Committee. ... >Today's vote marks a critical step forward in the ongoing fight to reform >US encryption policy, and sends a strong signal to the Clinton >Administration that Congress is serious about passing real encryption >reform legislation. SAFE provides no rights not already enjoyed by Americans, and contains language which appears to compromise some other rights. For example: ""§2804. Prohibition on mandatory key escrow "(a) PROHIBITION. -- No person in lawful possession of a key to encrypted information may be required by Federal or State law to relinquish to another person control of that key. "(b) EXCEPTION FOR ACCESS FOR LAW ENFORCEMENT PURPOSES.-Subsection (a) shall not affect the authority of any investigative or law enforcement officer, under any law in effect on the effective date of this chapter, to gain access to a key to encrypted information. " Sounds good...a ban on key escrow, right? No, because "EXCEPTION FOR ACCESS FOR LAW ENFORCEMENT PURPOSES" could easily be used to mandage key escrow. After all, even Louis Freeh and Dorothy Denning have never argued that key escrow is for use by non-law enforcement! Put another way, this particular section says Alice doesn't have to relinquish a key to Bob, a private citizen. Same as the way things are now, where there is no law, modulo contractual relationships, mandating such disclosure of keys. A truly meaningful form of this putative or purported ban on key escrow would include language along the lines of: "No government agency or department shall in any work propose, negotiate, plan, or do research on any scheme related to "key escrow," blah blah blah..." (Not being a lawyer, I won't try to write the language; the point is that SAFE contains only weasel language and doesn't actually bar key escrow so long as the Magic Words "Law Enforcement Purposes" are uttered.) Meanwhile, the traitors have criminalized crypto with this little gem: "§2805. Unlawful use of encryption in furtherance of a criminal act "Any person who willfully uses encryption in furtherance of the commission of a criminal offense for which the person may be prosecuted in a court of competent jurisdiction -- "(1) in the case of a first offense under this section, shall be imprisoned for not more than 5 years, or fined in the amount set forth in this title, or both; and "(2) in the case of a second or subsequent offense under this section, shall be imprisoned for not more than 10 years, or fined in the amount set forth in this title, or both."." Obviously, this is a serious problem, recognized by CDT, Lofgren, and many others. Given that a vast and increasing number of behaviors are now prosecutable offenses, this section alone would make most remailers parties to a crime, would make corporations parties to crimes, and would have a "chilling effect" on the use of crypto. "Use a cipher, go to prison." (Using a cipher alone would not itself be a crime, obviously, but the parallels are *exact* with the famously chilling billboard message: "Use a gun, go to prison." Using a gun in and of itself is not a crime, as in target shooting, etc., but the chilling effect message is crystal clear...this was the whole intent of the California billboards with this message. So, will billboards be erected with the same message about crypto?) This alone is grounds for CDT, EFF, EPIC, ACLU, and anyone else to immediately and completely withdraw all support for SAFE. The message "Use a cipher, go to prison" is simply too pernicious to be allowed. Period. Anyone who disagrees with this should immediately get out of the "civil rights" industry. As for the supposed relaxation of export restrictions, I fail to see much of a difference. The SAFE text says (and I am only partly quoting it, as quoting it all is too complicated for a message like this one): " No validated license may be required, except pursuant to the Trading With the Enemy Act or the International Emergency Economic Powers Act (but only to the extent that the authority of such Act is not exercised to extend controls imposed under this Act), for the export or reexport of..." Gee, that little clause gives back control of exports. The "except pursuant to the Trading with the Enemy Act," etc. part means that strong crypto still won't be freely exportable. And the famous bit about exports being allowed to any country in which the product is already approved...well, we see which way the wind is blowing in other countries on this one. No doubt the Crypto Tsar, David Aaron, will ensure that many products are not legal for use in France, Germany, Japan, etc. Oh, and just why is a U.S. _export_ contingent on it being "allowed" in some other country? Export laws regarding national security are about stuff _leaving_ the United States, not about stuff _entering_ France! That's a problem for France to solve, not a problem for U.S. Customs to worry about. And the "permitted for use by financial institutions" seems odd. Is this SAFE bill only allowing (supposedly) free export of _financial_ software? It sure looks this way. "(3) SOFTWARE WITH ENCRYPTION CAPABILITIES. -- The Secretary shall authorize the export or reexport of software with encryption capabilities for nonmilitary end-uses in any country to which exports of software of similar capability are permitted for use by financial institutions not controlled in ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ fact by United States persons, unless there is substantial evidence that such software will be -- "(A) diverted to a military end-use or an end-use supporting international terrorism; Well, there's the gotcha. There goes the export of "unbreakable crypto," as it will surely (and already has) been used by Hamas, Sindero Luminoso, the IRA, and other such international freedom fighters, er, "terrorists." Thus, we've gained absolutely nothing. Nada. Zip. And so it goes. Crypto becomes semi-criminalized. Key escrow is not at all restricted, providing the need is related to "law enforcement" (though private citizens like me are apparently no longer able to demand the keys of our neighbors...but, gee, I guess we never were, so nothing even here has been gained...duh). And export has the same restrictions related to the Trading with the Enemy Act, with various national security and law enforcement concerns, but with some strange language about export being allowed for financial cryptography providing the receiving country allows it for non-U.S.-owned entities. (????) A dangerous piece of legislation. Worse than the status quo. It ought to be killed dead. "Use a cipher, go to prison." --Tim May, who is a felon under various laws, and who has used crypto in furtherance of these felonious activitities, and who hence faces 10 years in the pokey for the SAFE "crime" of using crypto in furtherance of multiple prosecutable offenses Fuck that. Fuck CDT, too, for not denouncing this horrible piece of crap. -- There's something wrong when I'm a felon under an increasing number of laws. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

mainstream media corruption same as govt
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

[DM] >Perhaps that's why it's hard, sometimes, to be a columnist here. If I call >up the FDA, ask them why they're considering regulating the Net, then >blast them in a column -- well, they're not going to return my phone calls >next time. The TIME affiliation helps, but bureaucrats aren't entirely >stupid -- they're not going to offer information and interviews to their >critics. Perhaps there's something to be said for the Washington Post "he >said, she said" style of reporting. there is nothing to be said for it except that it is one step up from what is contributing to the inbred relationship between journalists and politicians. once upon a time, a journalist did not try to curry favor with politicians, it was not a non-antagonistic relationship nor was it meant to be. today, journalists go to their feeding buffets called "press conferences" and pass on uncritically what is fed to them. whatever happened to the journalist who tried to dig for a real story? obviously the truth does not come easily, and older style journalists were closer to understanding this. why is our press so screwed up? because it has been infiltrated at the very highest echelons by the CIA with its own agenda, which itself is being driven by another more sinister agenda behind the scenes. the press has reached the level of hypnotic proportions in its ability to manipulate the perceptions of the populace. if the media is the eyes of the populace, then it has been increasingly blinded for several years. I encourage anyone to read anything by Ambrose Evans Pritchard, a british journalist, to see the level of unwary mindless corruption we are now wallowing in daily in this country, in both the media and government. the crack cocaine situation in LA is a good example of how the truth is buried by the media. a maverick newspaper reports something close to the truth and the cia-manipulated mouthpieces around the country pile on the journalist and the newspaper in a barrage of picks that choke the truth in clouds of smoke. the internet is breaking some of the press's stranglehold on communication between citizens. I expect that the mainstream media is going to crumble very soon as the public begins to realize how corrupted it has become, both advertently and inadvertently. in my opinion, the press has become as corrupt as the government. a pity, because as Jefferson hoped, the press would become a control on the government. the founding fathers seemed to have a lot of faith in the integrity of humanity that does not seem to have entirely been borne out by history.

2 1

Re: Rejecting Dialog with Government Vermin
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

DM > >Yep. DC is about power. It's okay to question who should have it (though >Republicans or Democrats are your only choices), but it's almost unheard >of to question whether any of 'em should have it at all. And rewards are >given to those who Play the Game. For instance, I was interviewing some >FCC commissioners recently for an upcoming article in a widely-read print >mag, and the agency wanted the article to tilt their way. A week later I >found my name on the posh invite list to black-tie dinners with the >commissioners. That's access, folks, and it's responsible for a good >portion of a journalistic success. If you don't have it, your articles >suffer. I rest my case. That's *bias* and essentially *bribery*, folks, and its responsible for a good portion of the corruption of the media. and what's more amusing, not a single reporter involved in it has any pangs of doubt. DM is downright proud that he's so clever that he's figured out this ingenious inbred system of you-scratch-my-back!! congratulations on your ingenuity, DM!! you will truly go a long way with your clearly highly negotiable and hockable ethical standards...! I see you must be eyeing the NYT or the Washington Post, eh? (DM, imagine the manipulation that you are describing getting *worse* as you rise to the top, with your scent of it only a small whiff in comparison, and you begin to understand the corruption that infects the reality that surrounds us..)

3 2

Re: This is not "cash" if the government demands a report...
by azur＠netcom.com 17 Dec '03

17 Dec '03

At 4:51 PM 4/29/97, Kent Crispin wrote: >On Tue, Apr 29, 1997 at 01:01:59PM -0800, Tim May wrote: >> At 11:26 AM -0800 4/29/97, Kent Crispin wrote: >> >> >I was refering to your purchase of the 'vette -- presuming the dealer >> >followed the law, the sale would be reported, and the amount, and >> >hence the transaction is not anonymous, even though you paid cash... >> >> Ah, Kent, so you are citing the government's intervention in cash >> transactions (part of the War on Some Drugs, of course) as evidence that >> cash has flaws. Well, I wouldn't call this cash, not if the government >> demands that True Names be taken down and reported. > >OK. What would you call it, then? Perhaps you could think of another >catchy, short name for those greenish bits of paper and circular metal >objects I have in my pocket that I use to pay for lunch? The coins in your pocket are 'legal tender' or currency, a non-intrest bearing bearer bond issued by the treasury. Ecash and its ilk are private currencies, similar in some ways to traveller's checks and money orders which are unsecured and uninsured debts of the issuer, but legally closer to the tokens issued at an amusement park or or the premium stamps (like Blus Chip or S&H Green) which have all but disappeared. Constitutionally, the government has only limited rights to restrict private the issueance and use of private currencies (Stamp Act of 1861 and its current codification under Title 18.) --Steve PGP mail preferred Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 Key available on BAL server, http://www-swiss.ai.mit.edu/~bal/pks-toplev.html --------------------------------------------------------------------- Steve Schear | tel: (702) 658-2654 CEO | fax: (702) 658-2673 First ECache Corporation | 7075 West Gowan Road | Suite 2148 | Las Vegas, NV 89129 | Internet: azur(a)netcom.com ---------------------------------------------------------------------

1 0

Re: Rejecting Dialog with Government Vermin
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

At 08:40 4/30/97 -0500, Bradley Felton wrote: >What is needed is a "Bonsai" government, that is kept carefully pruned into >exactly the desired shape, and is never allowed to outgrow its pot. With >this analogy in mind, I would posit: > >4) Insufficient pruning mechanisms. I've proposed what I consider to be a very efficient and effective "pruning mechanism." However, I've also suggested that it would continue pruning until the size of government reached zero. Jim Bell jimbell(a)pacifier.com

1 0

Re: Rejecting Dialog with Government Vermin
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

At 21:32 4/29/97 -0800, Tim May wrote: >At 9:15 PM -0800 4/29/97, Jim Bell wrote: >>For example, I consider a major nuclear powers' possession of nukes to be >>one of the most serious examples of "nuclear terrorism" there is, but on the >>other hand I believe that an appropriate use of crypto (AP) could force any >>owners of nuclear weapons to dismantle them. Few people challenge this >>claim. If I'm right, crypto is a solution rather than a problem. Why not >>remind that journalist that her false impression is the real problem, not >>crypto. > >I believe you are incorrect that AP would force dismantling of nukes, for >reasons I am weary of repeating (you repeat your matra, I repeat mine), Well, you're entitled to be wrong! B^) I have always been willing to defend my assertion, and since it hasn't been discussed recently I think it's not too soon to rehash, as weary as you may be. Assuming AP works in particular, and crypto-anarchy works in general, both will work to reduce and minimize the "height" and size of government entities everywhere. Looked at from a cost/benefit standpoint, since nuclear weapons are generally of a certain minimum size and cost, they only "work" if the enemy is sufficiently numerous and segregated from the non-enemy populace to make attack with a large bomb effective. Reduce the size of the largest government unit, and it's harder to find a useful target, thus reducing the benefit of owning nukes. Also, if an AP system were available to an individual or group that previously owned nukes, it would be a far more economical (and specific) tool to defend itself from enemies of a certain limited size. (you can't nuke a terrorist cell, for instance, at least not without making far more enemies than you originally had.) At some point, nukes will become far "larger" a weapon than any owner can reasonably use, and at that point he will disassemble it due to sheer uselessness. (if you don't believe that the average size of the potential nuke-owners will get smaller, then you obviously don't believe in AP and/or crypto-anarchy!) AP dramatically increases the "cost" of owning nukes as well: If I were free to do so, I'd be happy to donate money to help force the few nuke-owners to dismantle their bombs. Assuming more than a small fraction of the population is sympathetic to this use of AP (and even if they generally would oppose other uses) this will work. Nukes won't be useful to "fight back" against AP and/or crypto-anarchy, and in fact threatening their use will do nothing except strength the argument in favor of the development and use of AP as an anti-nuke tool. Generally, in order to claim that a fully-functioning AP system WON'T dismantle all nukes, you've got to be able to postulate the kind of nuke-owning organization that could survive in a post-AP world, and further suggest what reason that organization would have to own them. > but >I agree that serious discussion of such game-theoretic issues is just too >scary, too extreme, too un-American for almost everyone. You'd be surprised. Since having had at least my second "15 minutes of fame" locally, I've had many discussions of the AP concept with average citizens. Admittedly, many of them were no more familiar with the cryptographic details than you might expect, so they pretty much accepted that part of the proposal as a given. However, every one of them seemed to accept the idea that if my system would do, generally, what it appears to do from first principles, the conclusion that it would shut down militaries and dismantle nukes follows directly. Jim Bell jimbell(a)pacifier.com

1 0

Re: Rejecting Dialog with Government Vermin
by Lucky Green 17 Dec '03

17 Dec '03

At 08:40 AM 4/30/97 -0500, Bradley Felton wrote: >What is needed is a "Bonsai" government, that is kept carefully pruned into >exactly the desired shape, and is never allowed to outgrow its pot. With >this analogy in mind, I would posit: > >4) Insufficient pruning mechanisms. The pruning mechanism was put in by the Founding Fathers in form of the Second Amendment. The problem was that the People decided they wanted to give up the pruning mechanism for some (perceived) temporary safety. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

Re: SAFE Bill is a Disaster--"Use a cipher, go to prison"
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

At 17:19 4/30/97 -0800, Tim May wrote: >(A copy of this message has also been posted to the following newsgroups: >alt.cypherpunks, talk.politics.crypto, comp.org.eff.talk) >CDT and other Washington insider groups are busily singing the praises of >the SAFE encryption bill, despite some acknowledged "minor flaws." > >Well, the flaws are not minor. The bill does not give Americans any rights >they do not already have, and does not ease export of strong crypto in any >meaningful way. In fact, the bill contains odd language implying it is >essentially only financial software which is easier to export, and then >only if the receiving country (huh?) allows it...since when is the duty of >U.S. Customs to pass products for export based on whether Baluchistan, for >example, wants the product? I agree with everything you've said, here. SAFE is truly awful if it attempts to make use of encryption illegal. Prosecuting the underlying crime, if a crime was done, should be considered more than enough. The thugs are afraid of getting whacked. Jim Bell jimbell(a)pacifier.com

1 0

Re: Rejecting Dialog with Government Vermin
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

At 23:07 4/29/97 -0700, Kent Crispin wrote: >3) There is no serious flaw -- the current government isn't as >bad as we claim. Or, put another way, the evils we see are a function >of size of government, and size of government is more a function of >population than anything else -- the larger the population, the >larger the government. > >I think that strong arguments could be made for any of these, though #3 >would be shouted down in this forum. I disagree that a "strong argument" could be made for item #3. Sure, some people would strenuously ATTEMPT to make that argument, but they would fail miserably. I feel confident that a statistical analysis of various countries' governments would reveal a wide scatter in the relationship between population and government size. One of the main factors in this scatter is simply the amount that government has decided to butt into activities that could (and should) be privatized. Another is the amount that the government steals from one group in order to reliably receive the votes of some other group. Population size would end up being a very poor determinant of government size. Jim Bell jimbell(a)pacifier.com

2 1

Problems with SAFE bill
by Declan McCullagh 17 Dec '03

17 Dec '03

I've received a few comments along the lines of "Why are you supporting the SAFE bill?" Here's my post to f-c about it from last week that might give some background. In short, I think this legislation is not good. -Declan (I sometimes forget to send f-c posts to cypherpunks, even when they're on-topic. If you want to join, subscription info is at the end.) ---------- Forwarded message ---------- Date: Thu, 24 Apr 1997 18:17:09 -0400 From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: FC: Crypto moves forward: Commerce Dept panel and SAFE markup Encryption is again bubbling to the surface of Washington politics. Today the Department of Commerce announced that it was creating a new committee to advise it on crypto-issues. A department official told me it would be composed of "businesses that export encryption," and interested parties have 15 working days to file comments. A way for the White House to split industry opposition and persuade high tech firms to buy into key escrow? Hmm... On the Hill, crypto legislation that would lift export controls is about to advance farther than ever before. (Last fall, Sen. Exon killed any chance that pro-crypto legislation had in the 104th Congress.) Rep. Bob Goodlatte's crypto bill (SAFE) will move to subcommittee markup next Tuesday at 2 pm in Rayburn 2237. After the full committee reports the bill, it moves to the international relations committee. Sen. Conrad Burns also would like to move forward with his Pro-CODE bill in May. Problem is, Goodlatte's SAFE bill, which has about 70 cosponsors, does more than just relax export controls and prohibit mandatory key escrow. It also creates new criminal penalties for using encryption to further a criminal act. Now, some say that it's innocuous -- and a good tradeoff for getting export controls lifted -- but I'm not convinced. When encryption is widespread and present in telephones, radios, cell phones, wireless modems, web browsers, televisions, and maybe light switches, *any use* of any electronic appliance will involve encryption. (Who wants a hacker playing with your toaster?) Remember that Maryland bill that would criminalize sending "annoying" or "harassing" email? If the Goodlatte bill became law, Marylanders who signed their messages with PGP or telnetted to local ISPs could be slammed with an all-expenses-paid trip to the Federal pen for five years. In other words, SAFE would turn state misdemeanors into Federal felonies. This is not good. A coalition of groups is sending a letter to Goodlatte tomorrow supporting the bill but expressing concern over the criminalization provision. Interested in signing on? Email David Sobel: sobel(a)epic.org. -Declan ***************** Security and Freedom Through Encryption (SAFE) Act (Introduced in the House) `Sec. 2805. Unlawful use of encryption in furtherance of a criminal act `Any person who willfully uses encryption in furtherance of the commission of a criminal offense for which the person may be prosecuted in a court of competent jurisdiction-- `(1) in the case of a first offense under this section, shall be imprisoned for not more than 5 years, or fined in the amount set forth in this title, or both; and `(2) in the case of a second or subsequent offense under this section, shall be imprisoned for not more than 10 years, or fined in the amount set forth in this title, or both.'. ***************** Federal Register, April 24, 1997: DEPARTMENT OF COMMERCE President's Export Council Subcommittee on Encryption; Notice of Establishment The Secretary of Commerce has determined that the establishment of the President's Export Council Subcommittee on Encryption is in the public interest in connection with the performance of duties imposed on the Department by law. The Subcommittee will advise the Secretary, through the Assistant Secretary for Export Administration, on matters pertinent to the implementation of an encryption policy that will support the growth of commerce while protecting the public safety and national security. The Subcommittee will consist of approximately 25 members to be appointed by the Secretary to assure a balanced representation among the exporting community and those Government agencies with a mandate to implement policy regarding encryption. The Subcommittee will function solely as an advisory body. Interested persons are invited to submit comments regarding the establishment of the Subcommittee to Lee Ann Carpenter, Committee Liaison Officer, OAS/EA/BXA, U.S. Department of Commerce, MS: 3886C, Washington, D.C., 20230. Telephone: 202-482-2583. FAX: 202-501-8024. Dated: April 18, 1997. Sue E. Eckert, Assistant Secretary for Export Administration. [Thanks to JYA. --Declan] ------------------------- Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ -------------------------------------------------------------------------- This list is public. To join fight-censorship-announce, send "subscribe fight-censorship-announce" to majordomo(a)vorlon.mit.edu. More information is at http://www.eff.org/~declan/fc/

1 0

Eternity service proxies
by Adam Back 17 Dec '03

17 Dec '03

[btw what do people think of the practice of putting To: cypherpunks, and Bcc: coderpunks@toad, cryptography@c2 as I have done here? I do this for stuff when I'm interested in comments of people who are on cryptography but not cypherpunks, similarly for coderpunks to avoid the non-crossposting issue with coderpunks, and avoid extra moderation work for Perry with cryptography. I know you get multiple copies if you're on all lists, how else does one reach you all? Myself I have a procmail recipie which junks multiple copies, like: :0 Wh: msgid.lock | formail -D 128000 msgid.cache ] My announce was rather hurried, and someone suggested to me the use of a proxy as an architecture for interfacing to the eternity service rather than the cgi based system I have. The person who suggested this to me also described some work on a "universal proxy framework" which is designed to enable things like "cookie-cutting, onion routing etc." Also it was suggested this is a cheaper way to implement a proxy. Here are some comments on possible architectures for an eternity service. There are a number of places where one might put a eternity server: - cgi script on your ISP for yourself and others to use - cgi script and local web server on your dial up linux box - standalone eternity proxy running on an ISP - local proxy - proxy framework module (local or remote? does it support both) - apache module "eternity proxy module" - browser plugin (if this has the power to do it) My ideal interface would have been a web proxy, as this allows the user to transparently integrate this into their browser. You may be able to set your browser to use the proxy to handle *.eternity, and have the rest go direct, but I'm not so sure on this point. Regardless, the proxy can forward requests as cacheing proxies do for documents not in *.eternity. My first consideration was to get a proof of concept going as quickly as possible. What you are looking at is a weekend hack + 3 days debugging and cleaning up. Proxies have higher user requirements to set up, you need root, or at least ability to leave processes running indefinately, and some mechanism to restart them on reboot (or do it manually). My cgi-bin implementation allows you to run with cgi access, and cron, or at a pinch to do without cron even. Local proxies have higher development costs, in that it involves windows code to be of use for the majority of users, which has much higher development cost. The universal proxy framework (which I am not familiar with) would allow a local proxy to be implemented more easily if I understand correctly. Local handling of at least the last layer of decryption would help from a security point of view. Or the local proxy could be a full eternity server for your own use. The ones I've made possible with my cgi based implementation are the first two, I chose them over proxies simply because they are the easiest to implement first. Basically what I have implemented is a poor mans remote proxy or (with a local webserver) a poor unix person's local proxy. You give it URLs of the form: http://www.foo.com/cgi-bin/eternity?url=http://blah.eternity/blah/ The cgi script modifies on the fly URLs in documents (if they are type text/html) and involve *.eternity to have prefix: cgi-bin/eternity?url= Well actually it copes with local, and site relative urls also (where site is the eternity virtual site). Normal URLs are left as is. Proxy is the more elegant way to do it as you don't have to re-write urls on the fly. There are advantages to running the server (proxy or otherwise) on an ISP rather than locally: - if you're using the cgi solution and an SSL web server you get SSL encryption on the link. This way people don't get to see your requests, if they are handled locally by your ISP from it's news spool. - it has lower bandwidth requirements which may be an advantage, as you don't have to down load all the eternity documents, only the ones you want to read as you browse them - if the eternity server is running on your ISP and the ISP has a local newspool people outside the ISP can not see your requests go to the NNTP server to see which articles you are reading. There are some advantages to local proxies: - you don't rely on the ISP or the eternity service operator not to log exdirectory URLs, and not to log your accesses. (However note that your ISP can observe your use of the NNTP server, unless you protect against this by saving all eternity web pages locally, so that you never have to do a NNTP lookup per article). - if you are accessing URLs which are private (encrypted with a password inside the final layer) you don't need to give this password to the server to get it to decrypt for you. (You don't need to with the remote proxy, but you get back a PGP message which you then have to manually decrypt, unless you can figure out a browser plugin to automatically decrypt PGP documents on the fly as they are read). A local proxy used in combination with remote proxy or cgi-proxy would allow another architecture. Your local proxy obtains it's article hash -> message-id/newsgroup/article-number database from a real remote eternity proxy which is watching news as it comes in. Then it can fetch the articles itself with lower overhead. Another architecture (moving more towards Anderson's meaning of an eternity service) is the idea of forwarding requests between eternity servers. In this way the eternity servers would be "remailing" your requests. If your entry point into the eternity service network was via an SSL protected link, and the links between the eternity servers were encrypted, the eternity servers as a whole would disguise who was accessing what. You could allow proxying of normal web pages too, and create a distributed version of anonymizer.com as a side effect. Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

3 4

Privacy news: Oakland Cameras, Levi employee files, FileGate
by Bill Stewart 17 Dec '03

17 Dec '03

It's been a busy day for privacy issues in the Oakland Trib. Surveillance Cameras in Oakland ------------------------------- Bay Alarm is trying to sell the City Council a $500K-$1.5M closed-circuit TV system for watching people in public places. The three picknickers didn't litter, but the camera mounted on the public library building could zoom in enough to that the council could tell a ham sandwich from roast beef, and whether the two joggers were wearing Nikes or Reeboks. "Anybody who is a law-abiding citizen is not going to be concerned about this.. "When I'm out in a public place.... I don't have an expectation of privacy" said Councilcritter Nate Miley (East Oakland/Elmhurst), who wants a test run in his district, where residents have bars on their windows and are afraid to go out at night. Police Chief Joseph Samuels likes it too. "This is technology spying on our citizens from camera on light poles" said John Crew of the ACLU police practices project, speaking against it. Bay Alarm said that some British cities have dealt with privacy fears by setting up monitoring centers away from city and police offices, where tapes are kept in case a crime occurs -- crime victims can call up the police and ask them to play back tapes, said Mark Demier of Bay Alarm. The camera systems are also capable of taking pictures in the dark. Personnel Data Theft Plaguing U.S. Firms --------------------------------------- Levi Strauss & Co. recently had a disk drive stolen from an office computer. It had background information on over 20,000 current and former employees, including names, addresses, SSNs, birthdates, and bank account numbers. It appeared to be just a crude theft of the $500 hardware, rather than somebody trying to steal the information itself, and is "not likely" to be used fraudulently because it's "written in a language difficult to decode", but the affected employees have been notified. Dave Banisar of EPIC is one of the various experts quoted. Insiders Chip In for FileGate Fall Guy Defense ---------------------------------------------- Remember FileGate, with the White House accessing confidential background files of hundreds of Republican Administration workers? Remember Craig Livingstone, White House staffer who resigned after it was revealed that his office was responsible for it? Well, he was never charged with anything, but he had about $9550 in legal expenses to advise him when he talked to Congress, and apparently 55 of his good friends decided to help him out. Hillary Clinton's chief of staff gave $50, Bill Clinton's golf partner Vernon Jordan gave $250, D.C.City Council member Charlene Davis gave $100, and overall it averaged out to about $200 per insider. Petty cash, perhaps, but it goes to show you the Clinton Administration's attitudes toward violation of privacy and abuse of power. Needless to say, the Associated Press story was a bit more balanced in tone than my summary here :-) ---- And in other news, San Leandro High School students, mostly the drama club, led a protest against against a proposed school board policy that would ban profanity, obscenity, libel, or slanderous speech in school-produced publications and productions. (Out, Out, <censored> spot!) "We want to be able to have the plays we've had in the past", said Sean Givens. "We're not doing profanity, we're doing ideas." Last year the drama department canceled a production of "The Breakfast Club", though it was allowed to go on with modified language. And Mike Royko died. The world will be a quieter place without him. He'll be missed. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

3 2

Re: SAFE Bill is a Disaster--"Use a cipher, go to prison"
by geeman 17 Dec '03

17 Dec '03

At 05:19 PM 4/30/97 -0800, Tim May wrote: ..elided.. > >""§2804. Prohibition on mandatory key escrow > >"(a) PROHIBITION. -- No person in lawful possession of a key to encrypted >information may be required by Federal or State law to relinquish to >another person control of that key. >"(b) EXCEPTION FOR ACCESS FOR LAW ENFORCEMENT PURPOSES.-Subsection (a) >shall not affect the authority of any investigative or law >enforcement officer, under any law in effect on the effective date of this >chapter, to gain access to a key to encrypted information. " > >Sounds good...a ban on key escrow, right? No, because "EXCEPTION FOR ACCESS >FOR LAW ENFORCEMENT PURPOSES" could easily be used to mandage key escrow. >After all, even Louis Freeh and Dorothy Denning have never argued that key >escrow is for use by non-law enforcement! > I'd like to point out that the key phrase in there seems to be "under any law in effect on the effective date of this chapter" -- altho it's gobbledegooked, the intent seems to say "if there is no law in effect mandating GAK when this bill becomes law, there can never be a law passed which does" Or in other words, it has the effect of making GAK no better, or worse, than under current law, while preventing passage of GAK laws in the future.

2 1

[CRYPTO] ZKP
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Tim May is widely recognized on the net, because of his frequent vitriolic postings, as someone/thing ready to cut off his own penis to spite the testicles, although his friends recognize him better from the rear. __ /_/\__ \_\/\_\ Tim May /\_\/_/ \/_/

2 1

Re: Eternity service proxies
by Lucky Green 17 Dec '03

17 Dec '03

At 05:41 AM 5/1/97 +0100, Adam Back wrote: > >[btw what do people think of the practice of putting To: cypherpunks, >and Bcc: coderpunks@toad, cryptography@c2 as I have done here? Works for me. [...] >My announce was rather hurried, and someone suggested to me the use of >a proxy as an architecture for interfacing to the eternity service >rather than the cgi based system I have. > >The person who suggested this to me also described some work on a >"universal proxy framework" which is designed to enable things like >"cookie-cutting, onion routing etc." Also it was suggested this is a >cheaper way to implement a proxy. [...] This is true for some value of cheaper. The proxy framework provides services to the proxylets. Therefore it is cheaper to write a proxylet than it is to write a proxy. However, the advantages of using a proxy framework to enable multiple local proxies are not limited to reducing the work effort of the proxylet author. The framework also would provide registration services, which are pretty much a requirement for dynamically loadable proxylets to exist on a machine without requiring user intervention. After all, the proxies have to operate in a certain order to be functional. This order would be hard to achieve without the proxies knowing about each other. And since the proxies almost by definition have no idea what is happening on the other side of that socket (or however you want to implement the proxy-to-proxy interface), somebody needs to watch over them to make sure they get used in the right sequence. To give an example of a machine with a moderate number of client side proxies, you might have 1. A DNS resolver proxy that intercepts the *.eternity TLD's. 2. The actual Eternity proxy that builds the NNTP requests. 3. A crypto proxy that encrypts the NNTP requests between the localhost and a suitable NNTP server. 4. An Onion Router/Pipe-net/jondo proxy that allows for anonymous access of the NNTP server. And that's just for the Eternity service. Add to this a POP/SMTP proxy that automatically encrypts/decrypts all mail, an https proxy that beefs up 40 bit SSL to 128 bits, a proxy that provides for on the fly decryption of webpages that are _stored_ encrypted, and before you know it you have ten proxies on a machine that all have to be used in a specific order. Ten proxies that have no way of knowing about each other. A proxy framework soon becomes a requirement. >My ideal interface would have been a web proxy, as this allows the >user to transparently integrate this into their browser. You may be >able to set your browser to use the proxy to handle *.eternity, and >have the rest go direct, but I'm not so sure on this point. Sure. The user should never have to use special tools to access information. That's the beauty of using proxies. You use a standard browser as front end. All the rest is taken care of transparently by the proxies. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

Re: mainstream media corruption same as govt
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:33 PM 4/30/97 -0700, Vladimir wrote: >the crack cocaine situation in LA is a good example of how the truth >is buried by the media. a maverick newspaper reports something close to the >truth and the cia-manipulated mouthpieces around the country pile on >the journalist and the newspaper in a barrage of picks that choke the >truth in clouds of smoke. The main thing that puzzled me about that episode was that everybody made such a big deal over it. I mean, didn't _everybody_ remember that Ollie North's Contra buddies were smuggling coke and occasionally getting caught at it? The whole Yankee-Panamanian War was largely caused by my liberal friends with their "Bush and Noriega in '88" bumper stickers that George "I am not a wimp!" Bush had to distance himself from :-) "Bush and Noriega - A _Crack_ Team!" And then there's "The Politics of Heroin in Southeast Asia", for a more scholarly and thorough treatment; I think the followon book was just named "The Politics of Heroin". # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

PGPSteps
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

I've done a semi-major update of "PGPSteps" and included key revokation in the set-up part. Also various URL's were added/corrected/updated. I've tried to include Windows 95 references as well (where applicable). By now I consider "PGPSteps" "complete" in terms of the installing procedure. I hope, it's still simple and easy, although it's a couple page longer now. If you have any comments, corrections etc., please let me know. Ciao Harka PS: Dave, please update it on the Web page. Thanks :) -- /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! -> http://www.epic.org */ /* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNED MESSAGE----- PGPSteps -------- Pretty Good Privacy (PGP) Installation - Step by Step by Harka <harka(at)nycmetro.com> last updated: 05/01/1997 "PGPSteps" (c) may be distributed freely without charge, left unchanged and the intact signature. The latest version is available by sending an e-mail to harka(at)nycmetro.com with the subject: SEND PGPSTEPS (finger for update info). See also http://bureau42.base.org/public/pgpsteps.txt for a recent version. Note: This document is intended for first-time PGP users. It is meant as a short step-by-step reference guide for the installation of PGP (Pretty Good Privacy), versions 2.6.2 and 2.6.3i, on an IBM compatible computer running DOS/Windows. However, it is _not_ meant to replace the PGP-documentation in any way. As a matter of fact, it is highly recommended to read at least pgpdoc1.txt (included in the PGP-distribution) _before_ actually installing the program. Much more additional info not covered here you'll also find in the various comprehensive FAQ's (see FURTHER INFORMATION at the end). Portions from the PGP documentation have been used herein. Thanks to Philip Zimmermann, Perry Metzger, Colin Plumb, Derek Atkins, Jeffrey I. Schiller, all of the Cypherpunks list and others. It might be useful to print this document out as a reference. ==================================================================== So you feel like having some more privacy by using PGP? Wise decision! Congratulations :) All install steps in short -------------------------- --download the respective PGP version --create C:\PGP directory --copy the downloaded zip into C:\PGP --unzip pgp262.zip (pgp263i.zip) into the C:\PGP directory --unzip second archive pgp262i.zip (pgp263ii.zip) into the C:\PGP directory, recreating the directories by using pkunzip's -d option --edit autoexec.bat, adding the lines SET PGPPATH=C:\PGP SET PATH=C:\PGP;%PATH% and SET TZ= (see below). --save autoexec.bat and reboot --create key pair with pgp -kg --sign key with pgp -ks yourID -u yourID (only version 2.6.2) --add keys from keys.asc to your public keyring with pgp -ka keys.asc --verify integrity of PGP distribution archive with pgp pgp262i.asc pgp262i.zip (pgp pgp263ii.asc pgp263ii.zip) --copy keys and the downloaded zip-file to floppy as a backup --create Key Revokation Certificate with pgp -kd yourID --extract revoked key with pgp -kxa yourID revoke into a file called revoke.asc --copy revoke.asc to the backup disk --copy secring.pgp and pubring.pgp from backup disk back into the C:\PGP directory, overwriting the revoked keys --write-protect backup disk and keep in a safe location --add public key to a key server (optional) --have fun (it all sounds more complicated than it is...promised :)) Getting PGP ----------- The latest official US-version is PGP 2.6.2 (freeware). If you are a citizen of the United States, you can download pgp262.zip from the Massachusetts Institute of Technology (MIT) at http://web.mit.edu/network/pgp.html The latest international version is 2.6.3ia (freeware). If you live in any other country than the US, you can download pgp263i.zip from the International PGP-Homepage at http://www.ifi.uio.no/pgp/ The reason for two separate versions are patent law issues. If you use the international version in the US (or vice versa) you might be in violation of these patent laws. Both versions are, however, essentially the same thing. Therefore download and use the one, that applies to you. Having downloaded PGP, create a C:\PGP directory. In DOS you can use MD PGP from the C:\ prompt and in Windows 3.1 you can use the File Manager. Here go to the FILE menu and CREATE DIRECTORY (in Windows 95: EXPLORER/select MAIN FOLDER (c:)/FILE/NEW/FOLDER, name the new folder PGP). Copy the downloaded pgp262.zip (or international pgp263i.zip) into your new C:\PGP directory. You might want to copy pkunzip.exe into your PGP directory as well - makes things easier :). (You will need PKUNZIP version 2.04g or later to uncompress and split the PGP262.ZIP archive file into individual files. PKUNZIP is shareware and is widely available on MSDOS machines. A Windows-version called WINZIP is available as well. More details if necessary you'll find in the PGP documentation in a file called setup.doc.) Unzip the archive in the C:\PGP directory with: pkunzip pgp262.zip or pkunzip pgp263i.zip Now you'll find a second zip file pgp262i.zip (pgp263ii.zip) in your PGP directory, plus a corresponding file pgp262i.asc (pgp263ii.asc). The .asc (ASCII)-file is the signature, that let's you verify the integrity of the archive (after you've installed PGP). Unzip pgp262i.zip (pgp263ii.zip) with: pkunzip pgp262i.zip -d or pkunzip pgp263ii.zip -d Remember to recreate the directories by using pkunzips -d option! (You should now have a subdirectory within C:\PGP called DOC, i.e. C:\PGP\DOC. As you might have guessed already, that contains the PGP documentation :)). Setting the Environment ----------------------- Next, you can set an MSDOS "environment variable" to let PGP know where to find its special files. Use your favorite text editor to add the following lines to your AUTOEXEC.BAT file (usually on your C: drive): SET PGPPATH=C:\PGP SET PATH=C:\PGP;%PATH% In DOS you can use EDIT by typing EDIT C:\AUTOEXEC.BAT . You'll probably already have a couple of SET lines, just put the one's for PGP in there somewhere. In WINDOWS 3.1 you can go to Program Manager (the main screen) and go to the menu FILE, RUN and type SYSEDIT (in Windows 95 use START/RUN/SYSEDIT). This will open several files, including the AUTOEXEC.BAT. Go to that window and include the SET lines from above. Substitute your own directory name if different from "C:\PGP". While you're editing the AUTOEXEC.BAT, include the TZ variable as well. The TZ (Time-Zone)-variable tells MSDOS what time zone you are in, which helps PGP create GMT timestamps for its keys and signatures. If you properly define TZ in AUTOEXEC.BAT, then MSDOS gives you good GMT timestamps, and will handle daylight savings time adjustments for you. Here are some sample lines to insert into AUTOEXEC.BAT (see above on how to), depending on your time zone: For Los Angeles: SET TZ=PST8PDT For Denver: SET TZ=MST7MDT For Arizona: SET TZ=MST7 (Arizona never uses daylight savings time) For Chicago: SET TZ=CST6CDT For New York: SET TZ=EST5EDT For London: SET TZ=GMT0BST For Amsterdam: SET TZ=MET-1DST For Moscow: SET TZ=MSK-3MSD For Aukland: SET TZ=NZT-13 Your AUTOEXEC.BAT should now look similar to this example: @ECHO OFF C:\MCAFEE\VSHIELD /anyaccess /xmsdata /only a: PROMPT $P$G PATH=C:\NC;C:\DOS;C:\;C:\NC\WINSOCK;C:\WINDOWS;C:\MCAFEE SET PGPPATH=C:\PGP SET PATH=C:\PGP;%PATH% SET TZ=EST5EDT SET MIXPATH=C:\NC\PI SET TEMP=C:\TRASH SET WINPMT=[WINDOWS] $P$G SET BLASTER=A220 I5 D1 T4 SET GALAXY=A220 I5 D1 K10 P530 T6 C:\DOS\SMARTDRV.EXE 1024 512 /X C:\MCAFEE\VSHIELD /reconnect win : If it does, EXCELLENT! Now save it and reboot your system to run AUTOEXEC.BAT, which will set up PGPPATH and TZ for you. Generating Your First Key ------------------------- Being new to PGP, it might be a good idea to create a test key first, so that you can play around with it and even pretend to send messages back and forth. That will give you some feeling on how it works (and also take some of the fear away :)). But note, that this is for _testing_ purposes only, it's not your actual key yet! I recommend to play around in DOS using the command lines, so when you use one of the many shells and front-ends available later on, you'll know what's going on "behind the scenes". To generate your test key, go to DOS and type: pgp -kg Since this will be a test key only, choose the smallest key size (1), make your keyID Test Key <test(a)test.com> and the pass phrase TEST. Then generate the key. Now you'll find two new files in your C:\PGP directory: secring.pgp (your secret keyring) and pubring.pgp (your public keyring). Basically you're ready to play now. You might want to start by signing your own public key (Note: the international version 2.6.3i already does that automatically for you during key generation) by typing: pgp -ks test -u test ("test" being the ID for the key, that you sign and the second "test" the ID, that will be used to sign with. Since you sign your own key, both ID's are the same. Later on with your real key, however, the ID "test" will be replaced by your actual name and the key to be signed will very likely be somebody else's). You could also add the public keys from C:\PGP\keys.asc to your public keyring with: pgp -ka keys.asc After having added the keys, you now can also verify the integrity of the PGP archive (good idea!) by typing: pgp pgp262i.asc pgp262i.zip or pgp pgp263ii.asc pgp263ii.zip PGP should tell you that it has a Good Signature from: Jeffrey I. Schiller <jis(at)mit.edu> It will also tell you that it doesn't "trust" the (jis(at)mit.edu) key. This is because PGP does not *know* that the enclosed key really belongs to Jeffrey. Don't worry about this now. Read the section "How to Protect Public Keys from Tampering" in Volume 1 of the PGP manual. (If you get a Good Signature, you could now actually delete pgp262i.zip & pgp262i.asc or pgp263ii.zip & pgp263ii.asc to save some space. But keep the original archive that you downloaded around.) Or you can take some document and sign it clear-text with pgp -sta filename and then verify it by typing pgp filename.asc Or you can encrypt files, sign them, wipe them, extract keys, check fingerprints or, or, or... At the end of this document you'll find a very helpful command line summary with enough options to play with. And, of course, read the actual PGP documentation before you move on to the next step!! Getting set up for real ----------------------- Alright, you've played around with PGP, might have generated several keys, sent messages "back and forth", read the documentation and maybe the FAQ's, and generally you feel pretty comfortable with it. Of course, you actually want to now use PGP in the "real world". :) Since you've edited the autoexec.bat, have set up the PGP directory etc. already during the test run, all you actually have to do to get back to "ground zero" is delete the files C:\PGP\SECRING.PGP, C:\PGP\SECRING.BAK (if there), C:\PGP\PUBRING.PGP and C:\PGP\PUBRING.BAK (if there). Now generate your actual key with: pgp -kg This time choose at least "military grade" (option 3, 1024 bits) for your key size. Note, that both 2.6.2 and 2.6.3i support up to 2048 bit keys. If you want the maximum key size, you'll have to actually type 2048, instead of simply choosing 1, 2 or 3. For the key ID use the generally used format of: firstname lastname <handle(a)domain.name> example: John Doe <jdoe(a)whatever.com> (including the < >). Now choose a _strong_ and _long_ passphrase. At least 20 different characters are recommended. Try to avoid simple words but include as many different (random) characters as possible. Example: Passphrase "Thomas" is really not a good one, especially if that's your name. "Thomas is wandering over the Red Square" is better already, but wouldn't stand long either to a dictionary attack. "Th0m@$iswaN-Der1ngOVE/RtH%r&dS\QA~<" would therefore be a much better choice. Use your imagination and remember: long, unguessable and many different characters! (see also the Passphrase FAQ and the Diceware Homepage in FURTHER INFORMATION on how to get a good passphrase) _Never_ write your passphrase down, don't tell it to anybody (not even to your boy/girlfriend, husband, mother or whomever!) and never let anybody look over your shoulder, when you type it in!! Now finish generating the key. Btw., when it comes to "type some random text", don't hit the same key over and over again :). Type your favorite poem or an article from the newspaper until it beeps. Sign your own key again with pgp -ks yourID -u yourID (only 2.6.2.) and then make backup copies of the keys and the original pgp zip-archive (that you downloaded) to a floppy disk. While you're at it, extract your public key with pgp -kxa yourID yourID and copy yourID.asc to the disk as well. Keep this file on your hard drive too; you'll probably need it quite often to cut & paste your public key from into e-mail. Next create a Key Revokation Certificate. This will be used in case you either somehow loose your secret key completely or if somebody has gotten a copy of your secret key and you have reason to believe, that they got (or will get) your passphrase too. Obviously something you want to avoid at all costs! A Key Revokation Certificate is basically your public key with a stamp "REVOKED" on it. This you can send to people (or a key server) if your secret key ever gets compromised. It will essentially tell their PGP: DON'T USE yourID's KEY EVER AGAIN 'CAUSE IT'S COMPROMISED! (see also PGP-documentation). Before you create your Revokation Certificate, make sure that you have made backup copies of your keys (secring.pgp and pubring.pgp) to the floppy-disk. You will need them! To revoke your key type: pgp -kd yourID You'll have to type in your passphrase and then your key get's revoked. If you check with pgp -kc yourID , you'll see, what it looks like. Next extract your (now revoked) key with: pgp -kxa yourID revoke into a file called revoke.asc. This is the file, that you'll send to people in case your secret key get's compromised. Copy the Key Revokation Certificate (revoke.asc) to the floppy-disk with your backup-keys. Now all you actually have to do to get your keys from "REVOKED" back to "normal" is to copy the backups (secring.pgp and pubring.pgp) from the floppy-disk back into your C:\PGP directory. Overwrite the existing (revoked) keys with the backups. If you now check with pgp -kc yourID, you should see your regular public key again (no "REVOKED" anymore). On your backup disk you should now have at least the following files: pgp262.zip -the original PGP-distribution archive (or pgp263i.zip) secring.pgp -your secret keyring pubring.pgp -your public keyring yourID.asc -your normal public key revoke.asc -your revoked public key (Revokation Certificate) autoexec.bat -(optional) Write-protect the disk and keep it in a safe place, where _nobody_ but you has access to it. That's almost it for installing PGP... As an optional step, you might want to make your public key generally available by sending it to a public key server. See http://www-swiss.ai.mit.edu/~bal/pks-toplev.html for an easy Web-form, where you can submit your own key or get the public keys from others (works also via e-mail). Check http://www.pgp.net/pgpnet/www-key.html for other WWW-key servers. You're finished with the setup now and ready to roll!! (Was pretty easy, huh? :)) Most common mistakes in the beginning ------------------------------------- 1. Sending your secring.pgp and/or your passphrase to somebody else. DON'T!! You don't need to share any of this with public key cryptography (see PGP documentation for more details). All that people need to encrypt mail to you or check your signature is your _public_ key. 2. Sending the entire file pubring.pgp to somebody else. No need to either. Extract only your _own_ key with pgp -kxa yourID filename into a file. This file you can now send either as attachment or simply cut & paste the key into your e-mail window and send it as regular e-mail (the same applies to the Revokation Certificate in revoke.asc; in case you ever need it). 3. Writing down your passphrase. As strange as it may seem, but despite all warnings a lot of people still do that. DON'T! EVER! Besides, after using PGP on a daily basis, you really should not forget your passphrase anymore anyway. 4. Not keeping physical control of secring.pgp Don't let _anybody_ get a copy of your secret keyring. Because the only thing, that will stand from there between them and all your e-mail is your passphrase. And if it's a weak one (that they can crack or guess) or they even know it (see "Writing down your passphrase"), then it's over with security and privacy. And that would be very unfortunate indeed. The same applies to the floppy disks with the backups. As a common tag line on the Internet goes: "My public key you can get with the subject: Send public key. My secret key you can pry out of my cold, dead fingers!!" 5. Not being careful with plain-text(s) PGP only protects messages and files as long as they are encrypted. If you save the de-crypted text(s) to your hard drive or even print them out and leave them laying around on your desk, then PGP can't help you anymore either, if somebody finds it. So either delete the files (wipe them with pgp -w filename) or encrypt them to yourself or encrypt them conventionally (pgp -c filename), if you need to keep them. 6. Not reading the PGP documentation at least once no comment, except RTFM! Front Ends and Plug-In's ------------------------ Of course, most of us get pretty tired after a while doing everything manually via command lines. That's where so called front-ends come in. These are additional programs, that make things like PGP much easier to use. There are literally tons of them out there (check http://www.ifi.uio.no/pgp/utils.shtml) for some of them. Personally I recommend the following three: ** AutoPGP ** by Stale Schumacher <staalesc(at)ifi.uio.no>, the same guy, who also wrote the international PGP version 2.6.3i. (Shareware; registration fee is 15$) This is a DOS program designed to work together with QWK/SOUP-standard offline mail readers, such as OLX, Blue Wave, 1st Reader etc.. It makes sending/receiving PGP messages really, really easy, especially if you have lots of them. check http://www.ifi.uio.no/~staalesc/AutoPGP/ to download it. ** Private Idaho ** by Joel McNamara <joelm(at)eskimo.com> (Freeware) A Windows front-end not only for PGP, but also for anonymous remailers and NYM-servers. Nice and easy to use interface, and it works together with most popular mail programs. If you have a SLIP or PPP connection, you can even send/receive PGP messages right from Private Idaho itself. If not, you can "port" messages from the PI window into your regular mail program (Netscape Mail, for example) with the click of a button. If that doesn't work, you can still write your messages in Private Idaho, encrypt/sign them and then cut & paste it into your normal e-mail program (and vice versa, of course). It also comes with a PGP Quickstart file for Windows, in case you really don't feel comfortable setting up PGP in plain DOS. But why would you, since you're reading this...:) check http://www.eskimo.com/~joelm/ to download it. ** PGPMail ** by Pretty Good Privacy Inc. (29,95 $ for US users, who have PGP 2.6.2 already installed) Contact: <pgpservice(at)pgp.com> - From the masters themselves a full-featured plug-in for the Windows 95/NT versions of Eudora 3.0 and Netscape Mail. You actually don't even need to have the freeware PGP version installed. All you'd need is PGPMail 4.5 (pgpmail45.exe). However, the price given above is a special discount given to PGP 2.6.2 freeware users (see web page for details). PGPMail 4.5 makes PGP-encryption not only easy, but fast as well. During installation it will add a few buttons to your Eudora window, which means, that you never have to leave Eudora (or Netscape) to encrypt/decrypt/sign etc.. Highly recommended, for newcomers and seasoned PGP-users alike. check http://www.pgp.com/products/PGPmail.cgi to download it (US-citizens only). PGPMail is export-controlled software. Therefore a URL outside the US can not be provided here. If you live outside the US and you use Windows 95/NT, you might want to check the windows95 directory at: ftp://ftp.replay.com/pub/replay/pub/pgp/pc/ for any other front-ends and/or plug-in's available. Here's a quick summary of PGP v2.6x commands -------------------------------------------- To encrypt a plaintext file with the recipient's public key: pgp -e textfile her_userid To sign a plaintext file with your secret key: pgp -s textfile [-u your_userid] To sign a plaintext file with your secret key and have the output readable to people without running PGP first: pgp -sta textfile [-u your_userid] To sign a plaintext file with your secret key, and then encrypt it with the recipient's public key: pgp -es textfile her_userid [-u your_userid] To encrypt a plaintext file with just conventional cryptography, type: pgp -c textfile To decrypt an encrypted file, or to check the signature integrity of a signed file: pgp ciphertextfile [-o plaintextfile] To encrypt a message for any number of multiple recipients: pgp -e textfile userid1 userid2 userid3 - --- Key management commands: To generate your own unique public/secret key pair: pgp -kg To add a public or secret key file's contents to your public or secret key ring: pgp -ka keyfile [keyring] To extract (copy) a key from your public or secret key ring: pgp -kx userid keyfile [keyring] or: pgp -kxa userid keyfile [keyring] To view the contents of your public key ring: pgp -kv[v] [userid] [keyring] To view the keys in the keyring with the signatures: pgp -kvv [userid] [keyring] To view the "fingerprint" of a public key, to help verify it over the telephone with its owner: pgp -kvc [userid] [keyring] To view the contents and check the certifying signatures of your public key ring: pgp -kc [userid] [keyring] To edit the userid or pass phrase for your secret key: pgp -ke userid [keyring] To edit the trust parameters for a public key: pgp -ke userid [keyring] To remove a key or just a userid from your public key ring: pgp -kr userid [keyring] To sign and certify someone else's public key on your public key ring: pgp -ks her_userid [-u your_userid] [keyring] To remove selected signatures from a userid on a keyring: pgp -krs userid [keyring] To permanently revoke your own key, issuing a key compromise certificate: pgp -kd your_userid To disable or reenable a public key on your own public key ring: pgp -kd userid - --- Esoteric commands: To decrypt a message and leave the signature on it intact: pgp -d ciphertextfile To create a signature certificate that is detached from the document: pgp -sb textfile [-u your_userid] To detach a signature certificate from a signed message: pgp -b ciphertextfile - --- Command options that can be used in combination with other command options (sometimes even spelling interesting words!): To produce a ciphertext file in Ascii radix-64 format, just add the - -a option when encrypting or signing a message or extracting a key: pgp -sea textfile her_userid or: pgp -kxa userid keyfile [keyring] To wipe out the plaintext file after producing the ciphertext file, just add the -w (wipe) option when encrypting or signing a message: pgp -sew message.txt her_userid To specify that a plaintext file contains ASCII text, not binary, and should be converted to recipient's local text line conventions, add the -t (text) option to other options: pgp -seat message.txt her_userid To view the decrypted plaintext output on your screen (like the Unix-style "more" command), without writing it to a file, use the -m (more) option while decrypting: pgp -m ciphertextfile To specify that the recipient's decrypted plaintext will be shown ONLY on her screen and cannot be saved to disk, add the -m option: pgp -steam message.txt her_userid To recover the original plaintext filename while decrypting, add the -p option: pgp -p ciphertextfile To use a Unix-style filter mode, reading from standard input and writing to standard output, add the -f option: pgp -feast her_userid outputfile Further Information ------------------- All of the following FAQ's and sites have much more additional information not covered here, URL's, book references, ftp-sites etc.. Check 'em out... Where to get the latest PGP (Pretty Good Privacy) FAQ; by Peter Herngaard <pethern(at)datashopper.dk>: ftp://ftp.csn.net/mpj/getpgp.asc The Beginners Guide to Pretty Good Privacy; by Bill Morton <wjmorton(at)nbnet.nb.ca>: http://www.clark.net/pub/rothman/pgpbg11.asc The comp.security.pgp FAQ (the "official" PGP FAQ): http://www.pgp.net/pgpnet/pgp-faq/ The International PGP FAQ (for version 2.6.3i); by Stale Schumacher <staalesc(at)ifi.uio.no>: http://www.ifi.uio.no/pgp/FAQ.shtml or via email with (empty) message to <pgp(at)hypnotech.com>; subject: GET FAQ The Passphrase FAQ; by Randall T. Williams <ac387(at)yfu.ysu.edu>: http://www.stack.nl/~galactus/remailers/passphrase-faq.html The Diceware Passphrase Home Page http://world.std.com/~reinhold/diceware.page.html Pointers to other Cryptographic Software http://www.cs.hut.fi/ssh/crypto/software.html Usenet: alt.security.pgp Want to know more about Privacy and Civil Liberties issues? ----------------------------------------------------------- check out these organizations and web sites: ** Electronic Privacy Information Center (EPIC) ** http://www.epic.org/ ** Electronic Frontier Foundation (EFF) ** http://www.eff.org/ ** Center for Democracy and Technology (CDT) ** http://www.cdt.org/ ** The Voters Telecommunications Watch (VTW) ** http://www.vtw.org/ ** American Civil Liberties Union (ACLU) ** http://www.aclu.org/ ** Encryption Policy Resource Page ** http://www.crypto.com/ ** Democracy Net ** http://www.democracy.net/ ** Privacy International ** http://www.privacy.org/pi/ ** Amnesty International (AI) ** (general human rights) http://www.amnesty.org/ ==================================================================== May there be peace in this world, may all anger dissolve and may all living beings find the way to happiness... harka(at)nycmetro.com Finger or e-mail for public key [KeyID: 04174301] Fingerprint: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBM2hsfzltEBIEF0MBAQG4Gwf/W24G2sxwqVzeSIO5BBKpyWd03G1xH6Jz qhkgOWfSRJ1V+2pwCXP4TAtb+ldgjB2jxtx5rv5XGC/2KWaUgjM0mhN8OAZXPb6R Nu/WKyzt5GJTN9SDe12xVC/jtBPQuTQPENFp07tx4e2KU3PlOrn/vpvHRzFk/Dfb Ck2LBw61uEyaSP2ZFdUM2exK6lioDBaUKmSW+zJWcfFfnlgaUPQRuWCmQFJidD71 u4tHO0y5VHg4G/3yXi1vuw4iUcjFcCqyqnGCAIyFmagi281xZsUI9ZgJx6Lu82c7 tD/OwOAojFbamUK1d9ISqFA8InnT+L4kpn046FaSgrrhl4njuRcOBg== =7vIU -----END PGP SIGNATURE-----

1 0

Re: SAFE Bill is a Disaster--"Use a cipher, go to prison"
by Jonah Seiger 17 Dec '03

17 Dec '03

Tim - It's too bad we may not see eye-to-eye on this one. For what it's worth, CDT shares your concerns about the criminal provision in the SAFE bill. We believe that as currently written, the provision is overly broad and could create a chilling effect on the everyday use of encryption, and unnecessary because it duplicates existing obstruction of justice law. We have expressed these concerns both publicly (in a letter to the committee signed by EPIC, ACLU, EFF, VTW, CDT, and over 20 other organizations - see http://www.privacy.org/ipc/safe_letter.html) and privately in conversations with the committee staff. We hope to work with the authors of SAFE to address these concerns, but, as you know, we are not running this show and have to work with what the Congress gives us. However, despite our concerns about the criminal provisions, we believe strongly that the SAFE bill, and the bills in the Senate sponsored by Burns and Leahy, are vitally important and should be passed. As you know, the debate over encryption policy reform has been going on for more than 4 years. Despite all of our efforts to promote the use of encryption, crypto is still not widely used by the public. The Clinton administration has not backed off from their commitment to a global key-escrow/key-recovery system with guaranteed law enforcement access to private keys. And despite the brilliant work of EFF on the various legal challenges to the export restrictions, we feel this issue will only be fully resolved through legislation. The status quo, in our view, is not good enough. Because of the export controls and the lack of a coherent US encryption policy, Internet users do not have access to the privacy protecting encryption products they need. Congress needs to stand up to the Administration and say, with a strong voice, "your policy is a failure - we need a different solution". That's what SAFE, Pro-CODE, and ECPA II do. Best, Jonah ** THE FIGHT FOR FREE SPEECH ONLINE IS IN THE HANDS OF THE SUPREME COURT ** Find out the latest news and information about the case, visit <http://www.ciec.org> -- <ciec-info(a)cdt.org> -- Jonah Seiger, Communications Director (v) +1.202.637.9800 Center for Democracy and Technology pager +1.202.859.2151 <jseiger(a)cdt.org> PGP Key via finger http://www.cdt.org http://www.cdt.org/homes/jseiger

7 13

HELLO
by stop1＠usa.net 17 Dec '03

17 Dec '03

We apologize if this is an unwanted message. If you wish to be removed from our list simply send a blank message to stop1(a)usa.net -------------------------------------------------------------------- Make $5000 or MORE This Month!!! Are you looking for a business to generate HUGE amounts of cash in very little time, then Fortune 5000 is for you. --> NO Selling, NO Meetings, NO Inventory, NO Recruiting ** FORTUNE 5000 DOES ALL OF THE WORK FOR YOU!! ** All you do is refer people to their 800 number. Their PROFESSIONAL telemarketers do all of the selling and close all of the sales for you. -- At no cost to you! --> No out of pocket monthly purchases --> $100 Fast Start Bonuses paid EVERY Friday --> Phenomenal GUARANTEED Advertising Co-Op Plan --> Fortune 5000 pays to INFINITY! - With unlimited width! CALL NOW - 1-800-811-2141 CODE 14646a Fax On Demand 415-273-6020 * If you are an experienced networker, this is the ideal addition to your portfolio. You still can make GREAT $$$ without having to invest a great deal of time. Fortune 5000 does it all!! * Never tried a home business before? You can do this! I have seen many wealth building programs, and this is by far the easiest to make big money FAST. I encourage you to call the 800 number to get all of the details at no obligation. You will LOVE it! 1-800-811-2141 CODE 14646a

1 0

Re: SAFE Bill is a Disaster--"Use a cipher, go to prison"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 1 May 1997 10:09:27 -0400 From: Jonah Seiger <jseiger(a)cdt.org> To: tcmay(a)got.net, declan(a)well.com Cc: fight-censorship(a)vorlon.mit.edu, cypherpunks(a)cyberpass.net Subject: Re: SAFE Bill is a Disaster--"Use a cipher, go to prison" Tim - It's too bad we may not see eye-to-eye on this one. For what it's worth, CDT shares your concerns about the criminal provision in the SAFE bill. We believe that as currently written, the provision is overly broad and could create a chilling effect on the everyday use of encryption, and unnecessary because it duplicates existing obstruction of justice law. We have expressed these concerns both publicly (in a letter to the committee signed by EPIC, ACLU, EFF, VTW, CDT, and over 20 other organizations - see http://www.privacy.org/ipc/safe_letter.html) and privately in conversations with the committee staff. We hope to work with the authors of SAFE to address these concerns, but, as you know, we are not running this show and have to work with what the Congress gives us. However, despite our concerns about the criminal provisions, we believe strongly that the SAFE bill, and the bills in the Senate sponsored by Burns and Leahy, are vitally important and should be passed. As you know, the debate over encryption policy reform has been going on for more than 4 years. Despite all of our efforts to promote the use of encryption, crypto is still not widely used by the public. The Clinton administration has not backed off from their commitment to a global key-escrow/key-recovery system with guaranteed law enforcement access to private keys. And despite the brilliant work of EFF on the various legal challenges to the export restrictions, we feel this issue will only be fully resolved through legislation. The status quo, in our view, is not good enough. Because of the export controls and the lack of a coherent US encryption policy, Internet users do not have access to the privacy protecting encryption products they need. Congress needs to stand up to the Administration and say, with a strong voice, "your policy is a failure - we need a different solution". That's what SAFE, Pro-CODE, and ECPA II do. Best, Jonah ** THE FIGHT FOR FREE SPEECH ONLINE IS IN THE HANDS OF THE SUPREME COURT ** Find out the latest news and information about the case, visit <http://www.ciec.org> -- <ciec-info(a)cdt.org> -- Jonah Seiger, Communications Director (v) +1.202.637.9800 Center for Democracy and Technology pager +1.202.859.2151 <jseiger(a)cdt.org> PGP Key via finger http://www.cdt.org http://www.cdt.org/homes/jseiger

1 0

Federalists vs. States Rights
by Jordan 17 Dec '03

17 Dec '03

"U.S. prosecutions of pro-marijuana doctors barred April 30, 1997 Web posted at: 11:09 p.m. EDT (0309 GMT) SAN FRANCISCO (Reuter) -- A U.S. district judge Wednesday issued an order temporarily barring the federal government from prosecuting California doctors who recommend marijuana to their patients." http://cnn.com/US/9704/30/marijuana.doctors.ap/index.html It's the same old song - Federalism v. States Rights Maybe we should see what went on in past US history to find out the outcome of current US events.

1 0

Re: SAFE Bill is a Disaster--"Use a cipher, go to prison"
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

At 10:09 5/01/97 -0400, Jonah Seiger wrote: >Tim - > >It's too bad we may not see eye-to-eye on this one. > >For what it's worth, CDT shares your concerns about the criminal provision >in the SAFE bill. We believe that as currently written, the provision is >overly broad and could create a chilling effect on the everyday use of >encryption, and unnecessary because it duplicates existing obstruction of >justice law. > >We have expressed these concerns both publicly (in a letter to the >committee signed by EPIC, ACLU, EFF, VTW, CDT, and over 20 other >organizations - see http://www.privacy.org/ipc/safe_letter.html) and >privately in conversations with the committee staff. We hope to work with >the authors of SAFE to address these concerns, but, as you know, we are not >running this show and have to work with what the Congress gives us. There's your error. No, you don't "have to work with" it. Simply make your public support absolutely and completely conditional on the removal of the bad part. That's quite easy, isn't it?!? > >However, despite our concerns about the criminal provisions, we believe >strongly that the SAFE bill, and the bills in the Senate sponsored by Burns >and Leahy, are vitally important and should be passed. Why? Tim May said it quite well: SAFE gives us no rights that we don't already have, and what it does claim to give us has so many "legitimate needs of law-enforcement"-type loopholes that it would be almost totally useless. It is certainly not "vitally important." There are some components of SAFE which would be good to have, IF they can be obtained without the disastrous component of SAFE which we all know must be removed. > >As you know, the debate over encryption policy reform has been going on for >more than 4 years. Despite all of our efforts to promote the use of >encryption, crypto is still not widely used by the public. > >The Clinton administration has not backed off from their commitment to a >global key-escrow/key-recovery system with guaranteed law enforcement >access to private keys. And despite the brilliant work of EFF on the >various legal challenges to the export restrictions, we feel this issue >will only be fully resolved through legislation. > >The status quo, in our view, is not good enough. Let's not have any backsliding, then! Jim Bell jimbell(a)pacifier.com

1 0