December 2003 - cypherpunks-legacy

WebWorld 10-11
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

WebWorld 12-14
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

PGP as disinformation
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Sergey Goldgaber wrote: >This is only a practical problem related to PGP's lack of popularity. >The proposed solution will work in the long run, assuming PGP achieves >great popularity. Thus, education of the public concerning PGP and remailers >will help make this solution more effective. > Has this list not considered the very real possibility that PGP is itself a rogue program released by the intelligence apparatus to detour we cyberpunks? As I have been arguing, the obvious is often false. While certain statists on this list are arguing in vain that I lack expertise in cryptographic matters, the truth is apposite this. Ask not for whom Bell toils, Dr. Roberts -- --

2 1

Re: "why privacy" revisited
by Robert Hettinga 17 Dec '03

17 Dec '03

At 8:48 pm -0500 on 3/23/97, Peter D. Junger wrote: > On the other hand the strongest proponent of interning the Japanese > was the governor of California: Earl Warren. Thank you, Peter, for what I believe is the most singular example of the two sides of the statism coin I've ever seen. Seen with the traditional liberal/conservative political worldview, it makes no sense for the famous compassionate liberal judge Earl Warren, whose supreme court presided over the creation of the world's largest welfare state, to advocate what is on its face an extremely conservative act -- the internment of thousands of Japanese Americans in concentration camps -- in his earlier role as a state governor. Viewed from the statism/freedom standpoint, it is completely logical, that is, "We're your nation-state. We're stronger than you are, and we'll take what we damn well please from you, including your life, if necessary." In the case of the Japanese concentration camps, it was taking the personal freedom of Japanese Americans. In the case of the judicially activist Warren court's welfare state, it was the confiscation of assets from productive members of society in violation of the laws of economics, which in turn caused misery for the increasing dole-dependant millions. People who are now much less free than they ever were before the creation of the "Great Society". I *love* this list. Absolutely love it. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/

1 0

Re: "why privacy" revisited
by jim bell 17 Dec '03

17 Dec '03

At 10:55 PM 3/23/97 -0500, Robert Hettinga wrote: >Seen with the traditional liberal/conservative political worldview, it >makes no sense for the famous compassionate liberal judge Earl Warren, >whose supreme court presided over the creation of the world's largest >welfare state, to advocate what is on its face an extremely conservative >act -- the internment of thousands of Japanese Americans in concentration >camps -- in his earlier role as a state governor. > >Viewed from the statism/freedom standpoint, it is completely logical, that >is, "We're your nation-state. We're stronger than you are, and we'll take >what we damn well please from you, including your life, if necessary." > >In the case of the Japanese concentration camps, it was taking the personal >freedom of Japanese Americans. In the case of the judicially activist >Warren court's welfare state, it was the confiscation of assets from >productive members of society in violation of the laws of economics, which >in turn caused misery for the increasing dole-dependant millions. People >who are now much less free than they ever were before the creation of the >"Great Society". Which is yet another of the many reasons I can espouse an "extreme" solution to the problem, but one that I can honestly claim to not consider "extreme" at all! The way I see it, the lives of these thugs are not sufficiently valuable to lose sleep over their loss, when to keep them around means the kinds of abuse society has suffered for many generations. Jim Bell jimbell(a)pacifier.com

1 0

Re: "why privacy" revisited
by Toto 17 Dec '03

17 Dec '03

Robert Hettinga wrote: > At 8:48 pm -0500 on 3/23/97, Peter D. Junger wrote: > > On the other hand the strongest proponent of interning the Japanese > > was the governor of California: Earl Warren. > Thank you, Peter, for what I believe is the most singular example of the > two sides of the statism coin I've ever seen. > Seen with the traditional liberal/conservative political worldview, it > makes no sense for the famous compassionate liberal judge Earl Warren, > whose supreme court presided over the creation of the world's largest > welfare state, to advocate what is on its face an extremely conservative > act -- the internment of thousands of Japanese Americans in concentration > camps -- in his earlier role as a state governor. > Viewed from the statism/freedom standpoint, it is completely logical, that > is, "We're your nation-state. We're stronger than you are, and we'll take > what we damn well please from you, including your life, if necessary." > In the case of the Japanese concentration camps, it was taking the personal > freedom of Japanese Americans. In the case of the judicially activist > Warren court's welfare state, it was the confiscation of assets from > productive members of society in violation of the laws of economics, which > in turn caused misery for the increasing dole-dependant millions. People > who are now much less free than they ever were before the creation of the > "Great Society". Bob, It humbles me to realize that I had completely overlooked this example of the evil forces lurking in the background (and under the bed) being involved in the duplicity of even using the bleeding heart liberals to imprison and slowly bleed us of both our wealth and our freedom. If you wish to devote more of your time to exposing these types of dark undercurrents to those on the CypherPunks list, then Dale and I would be more than happy to run the eca$h lists for a while, to free up your time. (What are friends for, eh?) -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

I want to see your paper " A New Attack to RSA on Tamperproof Devices".
by Yu-Hyun Kim 17 Dec '03

17 Dec '03

Dear Sir, Would you send me the full paper "A New Attack to RSA on Tamperproof Devices"? Yu-Hyun Kim yhkim(a)dingo.etri.re.kr

1 0

Re: UK to ban free use of crypto?
by Bill Stewart 17 Dec '03

17 Dec '03

The document is at http://dtiinfo1.dti.gov.uk/pubs/ At 08:01 AM 3/23/97 -0500, Peter D. Junger wrote: >After a very quick reading of this proposal I am convinced that all it >would do if implemented by legislation that follows its recommendations >would be to forbid those who are in the UK from using an unlicensed >key escrow services. > >It quite clearly does not intend to ban the use of cryptography or the >publication of cryptographic software. And Michael Froomkin offers similar sentiments. They're both lawyers, and I'm not (:-), so they're expected to do a better job of reading the legal parts of it. On the other hand, the DTI says: 57.The legislation will provide that bodies wishing to offer or provide encryption services to the public in the UK will be required to obtain a licence. The legislation will give the Secretary of State discretion to determine appropriate licence conditions. and it's got a really broad definition of "encryption services", including even things such as time-stamping. The big problem is that the document has a really warped view of the cryptographic and business services that a "Trusted Third Party" would provide, and some parts are expressed in quite broad language. For instance, it implies that the TTP is being trusted with private keys, otherwise there would be no way for it to recover anything. On the other hand, from their Q&A: Q: Will a TTP be able to access an encrypted message ? A: No. It is important to be clear that it is not envisaged that the encrypted communication would be routed via the TTP. Nor will the TTP encrypt the message, it will merely assist (depending on the service offered) in the very complex area of key management or Key Certification. If the TTP is not encrypting the data, they don't need the secret key or your private key. They DO need your public key, to sign it, so a second party can trust that a key they have is really yours. But you and the second party can use the signed keys to exchange a secret session key, or to sign documents, without the TTP's help.* So their primary description of what a TTP would do does not involve escrow. Keys are used for three things - communications, signatures, and storage. As discussed above, for communications, the TTP doesn't need your private key, and there's no business need for anyone to have the keys to decode a communication unless they already have the cyphertext. Business applications that do require a third party to have a copy of your _message_ can be met by sending them a copy of your message, encrypted with their key, and the document explicitly says it's not talking about them. Similarly, cell-phone companies are providing encryption and routing, so this document claims not to be about them, though it regulates them. The only third parties who need just the session key itself are eavesdroppers and forgers, who are Untrusted Third Parties. For signatures, there's also _never_ a need for the third party to have the private keys - the function you Trust the Third Party to do is to certify that the holder of the key either is who he claims to be or has the permissions he claims to have (e.g. to write purchase orders or sign contracts for Company X.) And the document even states that "There is, of course no intention for the Government to access private keys used for only integrity functions." The main time you want another party to have a copy of your keys is for stored data: to cover the "employee dies" case (the document explicitly permits companies to handle their own keys without regulation, so no TTP is needed here), and the "you die, and your family digicash is in your encrypted file system" case, for which you can give a copy of your key to your spouse or solicitor, or keep it on a floppy in your bank safe deposit box, all of which cases are presumably covered by current law in the UK just as they are in the US. SO - what _is_ all this malarkey about "legal access" and "key recovery" and "key escrow" systems? The document claims repeatedly that it's not purporting to regulate any of the conditions under which a Third Party would ever be Trusted with the keys you actually encrypted something with. There's a whole lot of material about restricting who can be in the business and offer these services, seemingly designed to either restrict the emergence of new services or to be later expanded to cover other parts of the encryption business, such as supplying encryption software. And it's very unclear about whether it covers the encryption services used in inter-corporate projects such as Mondex - as a stockholder and customer of some of those companies, this concerns me. In particular, the expansion appears to be targeted specifically at the UK end of the Stronghold Apache-SSL web server, Adam Back's RSA Munitions Shirts, the PGP and Crypto Software distribution site at Oxford, and Ross Anderson. [*There are non-public-key systems where the TTP handles the secret keys, but they're typically older or specialized military or banking systems, where the TTP isn't an independent party, and are generally superseded by public-key systems now that the technology is practical.] # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1

UK TTP regs
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Have spent some time reading over the paper re TTP/CA regulation in the UK. I don't think the paper is exactly a model of clarity, but my impression (from a few passes over it) is that it isn't intended to affect the distribution of software but is intended to affect people acting as CA's (including signing a friend's key) or as key escrow agents. But both this document and two of the three bills in the US Congress (Goodlatte and Leahy) look to me like "first shoes" which precede "the other shoe dropping", e.g., making use of a TTP/key escrow agent mandatory once there's a reasonable infrastructure in place. Regulating essentially informal and private transactions like key signing between associates strikes me as absurd - but not much more absurd than things done on this side of the Atlantic, of course. I do think there are interesting issues around certifying CA's and CA liability, but it seems like they can be addressed using existing legal theories/strategies - some mix of tort law and contract law should be sufficient. Criminalizing a PGP key-signing party is almost as stupid as threatening to criminalize PGP. My hunch is that legislatures in Europe as well as Congress are going to get around to trying that within a few years. All it's going to take is repeating the phrase "legitimate needs of law enforcement" and "a fair balance between law enforcement needs and industry needs" a few thousand more times and it'll all seem perfectly rational. Last week's hearing for the ProCODE bill totally ignored the right of individuals to be free from interception/eavesdropping, and seemed to focus on some sort of compromise between business (who's perceived as wanting to make money from exporting strong crypto, but the argument is structurally the same whether we're talking about export/import controls on wheat or cars or on crypto) and law enforcement (who's perceived as being, at worst, slightly overzealous in their pursuit of safety & tranquility for each and every American, perhaps to the detriment of business interests, apologies to those fine businesses & their investors, etc.) (* I missed the first 20 minutes or so, perhaps that's when this was discussed, but I'll bet not.) I don't think I heard the Fourth Amendment (or any similar concerns) mentioned even once, nor the consistent pattern (across tens of years, subject matter, internal jurisdictions, national boundaries, and ideology of the government in power) by which law enforcement grows contemptuous of the law itself and begins using its power to perpetuate itself and in various flavors of political or personal repression. I suppose it would have been impolite to mention the various Red Squads, the COINTELPRO operation against domestic dissident groups, harassment of antinuclear and anti-Contra activists, local police spying in Pittsburgh and Los Angeles and San Francisco (and surely many other places I haven't heard about, too), Ruby Ridge, Waco, Operation MOVE, and recent revelations that the FBI crime lab has been altering lab reports and offering perjured testimony against criminal defendants. Law enforcement abuses are not "aberrations" nor "unfortunate incidents" which could not be predicted nor are they unlikely to recur. The only real question is whether or not we want to give law enforcement tools which can only be misused in obvious ways (like guns, which make noise, or tanks or helicopters, which are easy to see/hear) or if we're going to give them tools (like secret wiretaps and access to crypto keys) which are very difficult to track or detect when used illegitimately. Between cops who fuck up for political reasons (see above) and spooks/cops who sell out just for money (Ames, Lonetree, and the rest of the sad parade I've already forgotten who've been willing to sell "top secret" material which they knew put their colleagues' lives in danger, as well as street-level corrupt cops who "look the other way", steal from suspects/defendants, "borrow" from evidence lockers, carry "throw-down" guns and the rest), it's hard to feel like this is an institution that deserves any real trust. It may be that society ends up with less net brutality and corruption if we let the SFPD or the LAPD or the FBI drive around with guns & radios than if we allowed the Mafia or the Crips or the Bloods to do that .. but it's really just "more brutality" or "less brutality". The lesser of two evils is still evil. Which is a lot of rant to say that I don't think the sky is falling in the UK just yet. -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMzZU2f37pMWUJFlhAQEO2wf+Lmuc6t8m1pdvcFt3EKsG6UEKoSIV9SUn e8QYrj2FFkCYUMS4Oh/FZ8T+wtgLRZ/z1eZQs5KUU1GMpP58j1KLS6K859Y9rvQs kFZqVwXzoLrD06Dn7Vr9AOxcqx0VC/692jEBoMsuqCjfL9VGDjIPFJFbPN900QQn mbbU5eL5567YGnYYd2Xe25zPDS4UWUiF7HKxgZF+mt619wOBVMRf9h8A853iA9h5 as156RPh1t5R4NGKwfGb+b8S5vmB5+tbTkFNLcPv2gcTl4xUHMnUST0I5BG6ww9C aV1Ove4muVg/Dw/vhbWixjGKI312uWQ+4lcRSaUOJ9j6XsKGUzxFEw== =Gnfa -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

INFO: Pro-CODE hearing (photo, audio, & text) available online!
by Shabbir Safdar 17 Dec '03

17 Dec '03

========================================================================== _ _ __| | ___ _ __ ___ ___ ___ _ __ __ _ ___ _ _ _ __ ___| |_ / _` |/ _ \ '_ ` _ \ / _ \ / __| '__/ _` |/ __| | | | | '_ \ / _ \ __| | (_| | __/ | | | | | (_) | (__| | | (_| | (__| |_| |_| | | | __/ |_ \__,_|\___|_| |_| |_|\___/ \___|_| \__,_|\___|\__, (_)_| |_|\___|\__| |___/ Enhancing Participation in the Democratic Process Through the Internet _________________________________________________________________________ Update No.2 http://democracy.net/ March 20, 1997 _________________________________________________________________________ Table of Contents - democracy.net Cybercast draws Thousands to Interactive Hearing - Upcoming Events - Volunteering for democracy.net - About democracy.net ___________________________________________________________________________ DEMOCRACY.NET CYBERCAST DRAWS THOUSANDS TO INTERACTIVE CONGRESSIONAL HEARING democracy.net, a project designed to explore ways of enhancing citizens participation in the democratic process via the Internet, held its first live, interactive cybercast of a Congressional hearing on Wednesday March 19th, 1997. Thousands of Internet users joined this historic event by listening to a live audio feed from the hearing (cybercast over the Internet via RealAudio), submitting questions and testimony for the hearing record, reading information about the hearing, and joining a simultaneous online discussion forum to discuss the hearing with Congressional staff and policy experts. The hearing was held by the Senate Commerce Committe to consider S. 377, the Promotion of Commerce online in the Digital Era (Pro-CODE) Act and this issue of US encryption policy -- a critical issue to the Internet user community. Some statistics from the event. * 6,019 individual Internet users visited the democracy.net web site containing information about the Hearing, links to both sides of the issue, and other relevant information in the 24 hours preceding the event. * 703 individuals listened to the hearing live online via Real Audio throughout the 3 hour event. The actual Senate hearing room (Russell 253) where the event took place only holds less than one hundred people when filled to capacity (as it was for this hearing). * Throughout the event, between 20 - 50 people joined the simultaneous live chat discussion where Commerce Committee staff and encryption policy experts fielded questions and discussed the hearing. The audience included individual Internet users, reporters, advocacy groups, and Congressional staff. * Twenty-three Internet users submitted formal comments for the hearing record via the democracy.net web page, including IETF chair Fred Baker. The democracy.net cybercast was promoted on the front page of Netscape's World Wide Web site (one of the most popular destinations on the entire Web) on March 18 - 19. The site is also featured at Progressive Networks WebActive Site of the Week for the week of March 17-21. Despite some technical bugs early on (par for the course for a cutting-edge Internet event such as this), the cybercast went even better than we anticipated. We are grateful to Brett Scott, Mike Rawson, Matt Raymond, Mike Inners, and Pia Pialorsi of the Senate Commerce Committee staff for their help and support of this effort. Archives of the hearing are posted http://democracy.net/events/03191997/ democracy.net is a new project of the Center for Democracy and Technology and the Voters Telecommunications Watch designed to explore ways of enhancing citizen particpation in the democratic process via the Internet. democracy.net is made possible through the generous support of Webactive Panix, Digex, and the Democracy Network. Visit http://democracy.net/about/ for more details. ______________________________________________________________________________ UPCOMING EVENTS * April 10, 8:30PM EST - Online town hall meeting with Rep. Rick White (R-WA), Co-Founder of the Congressional Internet Caucus * April 16, 8:30PM EST - Online town hall meeting with Rep. Anna Eshoo (D-CA), Key Representative from California's Silicon Valley and leader on Internet Policy issues. * Additional events are in the works -- please visit http://www.democracy.net for more details, and sign up for our event announcement mailing list. democracy.net town hall meetings will be moderated by Todd Lappin (Cyber Rights Editor for Wired Magazine). The town hall meetings are designed to bring interested members of the Internet community and key members of congress together to discuss current Internet policy issues. ____________________________________________________________________________ VOLUNTEERING FOR DEMOCRACY.NET A volunteer is needed to help index the RealAudio transcript of the hearing. If you would like to help, please do the following and mail the results to webmaster(a)democracy.net. To index the RealAudio transcript, please listen to the transcript and watch the time counter at the bottom right of the page. Please note the following beginning and ending times: -whenever a new witness begins their prepared testimony and, -whenever a question and answer section begins. Mail them to us at webmaster(a)democracy.net with the start and stop times of each section. Thanks! ____________________________________________________________________________ ABOUT DEMOCRACY.NET The democracy.net is a joint project of the Center for Democracy and Technology (CDT) and the Voters Telecommunications Watch (VTW) to explore ways of enhancing citizen participation in the democratic process via the Internet. To this end, democracy.net will host live, interactive cybercasts of Congressional Hearings and online town hall meetings with key policy makers. democracy.net is made possible through the generous support of WebActive, PANIX Internet, the Democracy Network, and DIGEX Internet. More information about the project can be found at http://democracy.net/about/ To receive democracy.net announcements automatically, please visit http://democracy.net/ _____________________________________________________________________________ end Update No.2 03.20.97 =============================================================================

1 0

Re: BXA on Crypto Plans
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Fri, 21 Mar 1997 08:42:22 -0500 > To: cypherpunks(a)toad.com > From: John Young <jya(a)pipeline.com> > Subject: BXA on Crypto Plans > Reply-to: John Young <jya(a)pipeline.com> > Excerpt of BXA head William Reinsch statement on Goodlatte's > SAFEncryption Bill HR 695 on March 20, 1997: > > [...] > To that end, > we will shortly submit legislation intended to do the following: > > Expressly confirm the freedom of domestic users to choose any > type or strength of encryption. > > Explicitly state that participation in the key management > infrastructure is voluntary. > I think we should ponder the validity of the underlying assumption here - that there will be *one* PKI system, and (speculating here) (i) the government sets what it's requirements are, and (ii) they will include compromising one's private keys. > > Offers, on a voluntary basis, firms that are in the business > of providing public cryptography keys the opportunity to > obtain government recognition, allowing them to market the > trustworthiness implied by government approval. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ This is a joke, right? Peter Trei trei(a)process.com Disclaimer: I do not represent my employer.

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"wazoo"} = "<remailer(a)wazoo.com> cpunk mix pgp hash latent cut ek"; $remailer{"shaman"} = "<remailer(a)lycaeum.org> cpunk pgp hash latent cut ek"; $remailer{"hidden"} = "<remailer(a)hidden.net> cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 24 Mar 97 6:48:58 PST remailer email address history latency uptime ----------------------------------------------------------------------- nym config(a)nym.alias.net --###*+***## 18:54 100.00% hidden remailer(a)hidden.net #####+***### 1:55 99.99% balls remailer(a)huge.cajones.com #########+# 3:23 99.94% shaman remailer(a)lycaeum.org *+*++*+++-++ 23:55 99.92% lucifer lucifer(a)dhp.com +*++++++++++ 35:54 99.91% winsock winsock(a)rigel.cyberpass.net ----_-.----- 5:07:09 99.89% weasel config(a)weasel.owl.de ++++--+++-- 2:47:00 99.89% cyber alias(a)alias.cyberpass.net + - +++*+*** 35:59 99.69% exon remailer(a)remailer.nl.com #* #+#*#*+## 16:00 99.61% dustbin dustman(a)athensnet.com ++.+ ++ +++ 44:28 99.26% replay remailer(a)replay.com +*_ -**-** 4:29:56 99.15% jam remailer(a)cypherpunks.ca ** **** * ** 21:53 99.05% squirrel mix(a)squirrel.owl.de ++++--+++-- 4:36:01 98.56% reno middleman(a)cyberpass.net * - +-+ 44:40 97.15% mix mixmaster(a)remail.obscura.com _ _. +- 51:47:04 88.89% extropia remail(a)miron.vip.best.com -_..- . 21:51:10 65.36% middle middleman(a)jpunix.com ++-+*+++ 35:43 46.02% haystack haystack(a)holy.cow.net ++ 52:19 26.11% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: Security of SSL proxies
by Peter Trei 17 Dec '03

17 Dec '03

pgut001(a)cs.auckland.ac.nz (Peter Gutmann) writes: > A number of vendors are now selling SSL proxies which implement secure > tunnelling for web browsers using a non-crippled SSL implementation running on > the client machine. Has anyone considered the total security level provided > by one of these systems? I can see three problems with this approach: > > 1. The security stops a few feet short of the browser, making a MITM attack > possible (see below). > > 2. Security and authentication is handled by the proxy and not the browser. > This means that the browser (and browser user) never get to see the usual > indicators that their connection is secure (or "secure" for non-US users). > > 3. If you use a proxy like this to protect traffic for an entire company, the > proxy provides the same type of target as a GAK key center: An attack which > compromises this compromises security for the entire company. [problems with this approach deleted] > Peter. I'm a little confused by your use of the term 'SSL proxy'. Netscape defined an extension to HTTP to allow SSL traffic through a firewall: the encrypted request is prepended (in clear) with the actual destination IP address and port. The firewall proxy then opens a TCP/IP channel to the actual destination/port, and blindly relays packets between the actual destination and the browser until one side or the other shuts down the link. The proxy does no encryption or decryption - in fact, it requires no crypto code at all. (BTW: this what setting the 'security proxy' field in Netscape is all about). The scheme has some drawbacks - there is no provision for chaining proxies. - the server can't determine the source browser's IP - it only sees the proxy's IP address. This makes it more difficult to filter requests based on source ID. - the proxy has no idea of the actual URL requested - proxies which want to filter or log requests based on URL can't do so. Or are you talking about something entirely different? Peter Trei (yes, I've implemented the above) trei(a)process.com

2 1

WebWorld 15
by Bubba Rom Dos 17 Dec '03

17 Dec '03

The True Story of the InterNet Part II WebWorld & the Mythical 'Circle of Eunuchs' by Arnold Copyright 1995, 1996, 1997 Pearl Publishing Initiation ----------- Jonathan was a wreck. A totally nervous wreck. The bottle of bourbon was almost empty, but that was O.K., he had more-plenty more. He knew that the woman who came to 'initiate' him into the circle was right about Bubba Rom Dos. Just an old, drunken has- been who liked to shoot his mouth off and act important, rambling on about things he knew nothing about. But Jonathan knew about these weird, evil things. He knew much more than he wanted to know about them. Things that he couldn't forget, no matter how hard he tried. After he had been to see Bubba, receiving only a denial of the Magic Circle's existence (from a young girl whose existence was so real that he still thought about her), Jonathan had immersed himself in scanning old CyberPosts...email, he corrected himself...that dated from the early CypherPunks era. It was a twisted, rambling trail that was woven around and through the history of the CypherPunks. CryptoRebels, CyberHackers, Spooks, Phreaks, and Phantoms... Everybody had an angle, or a game, and even the players often seemed unsure of who they were playing with, or against. Was it Gilmore, or Hughes-Jonathan couldn't remember, it had been so many years ago-who had stood on the desk in his grandfather's study, and uttered the words which might well have been the official battle-cry of the CypherPunks? "Close ranks-every man for himself." Jonathan had pored over the archive surrounding the date of the legendary moderation experiment on the list. It was an archive that Jonathan's grandfather, among others, had used for PseudoID Traffic Analysis, along with UNIX route tracing records and information secretly gleaned from the military's Onion Routers, in order to attempt to "separate the double agents from the triple agents," as one of the Russian list members, Igor, used to say. Jonathan still remembered the one time that he had received a scathing rebuke from all present in his grandfather's study, as a result of suggesting that they could learn much of what they needed to know by studying the remailer records. Big mistake. Jonathan immediately found himself surrounded by a plethora of enraged CypherPunks who obviously didn't give a fat rat's ass whether he was a mere child, or not-nobody questioned their integrity regarding their foremost contribution to anarchy...end of story. One of the CypherPunks picked him up by his collar, lifting him up to eye level, and said, in deadly serious, deep-throated tones, "You don't tug on Superman's cape. You don't spit in the wind. You don't peek in the files on your own remailer, and you don't mess around with Jim." To Jonathan's great relief, the whole ragged band broke out in laughter. Jonathan learned later that the gentleman who had 'corrected' him, Jim, was the author of an Assassination Bot-one which had begun as a theoretical exercise, and later became a major tool in the implementation of the CypherPunks launching of Channel War II. Jonathan shook his head slowly, trying to convince himself that this was all a dream, and that he wasn't really irrevocably connected to this band of fringe-dwellers, rogues and eccentrics. It didn't work. He remembered the night that Priscilla had knocked on his door, and in his rush to shut off his blue-light unit he answered the door with his upper body uncovered. He was terrified when he realized that this woman, whom he had never seen before, was standing there, dumbfounded, staring at his tattoo. Jonathan had almost fainted with relief when she stepped inside the door, quickly shutting it, reached into her cloak, and pulled out a bottle of Jack Daniel's, with a label he instantly recognized, saying in a quiet, calm voice, "We need to talk." Tuesday was the worst. That was what set off his three-day binge. He had been working on his skills, like the lady had told him to do. And he was keeping his eyes open, like she said. Somehow, seeking to observe the weird things, instead of dreading and trying to avoid them, had helped. Now, instead of trying to repress the memory of these events, he would analyze them, note them, try to arrange them in a logical fashion, so that if he ever had to deal with them, to work with or against them, he would be prepared. "Be prepared.", that's what the woman had told him during his initiation. "You will probably will not be contacted for quite some time-perhaps never.", the woman had said, but that was all right. Just knowing that there was a Magic Circle, that there were others out there, waiting, preparing, possibly already acting against the strange forces he had encountered-that was enough, just knowing that he wasn't alone. And then Tuesday... It had been a strange couple of weeks. The weirdness going on in his system was just the 'usual' weirdness. Programs that he hadn't written cropping up and running themselves. They followed the normal pattern, in most cases-extracting newly input information from the databases he was working with, sorting and codifying it, uploading it to /dev/null. Theoretically, that meant it was being sent 'nowhere', but he had long since figured out that 'nowhere' was 'somewhere' that he was not supposed to discover. So he left it alone...until Tuesday. The Cowboy, one of the top computer honchos on the InterNet, probably the top honcho, according to many, had dropped out of sight, suddenly and unexpectedly, a couple of weeks before. Strangely, he had been called into the Cowboy's 'domain'-"Cowboys don't have offices, they ride the range.", he had told Jonathan-the next working day after his initiation into the 'Circle'. He thought that this might be the 'contact' he was expecting, but it turned out to be a routine, minor matter. There was a bizarre incident, however, which left Jonathan wondering if the Cowboy was really all that his reputation held him out to be. The Cowboy had been drinking quite liberally from a bottle of Jack Daniel's he had stashed behind the monitor, while Jonathan worked on some minor programs that the Cowboy had told him to troubleshoot for him. Once Jonathan had completed his tasks, the Cowboy came over to check his work, and proceeded to log onto the terminal that Jonathan had been working on. The Cowboy, his coordination seemingly affected by his prolonged drinking, accidentally hit the return key at the 'login:' prompt, and then typed 'Cowboy' into the 'password:' prompt by mistake, which 'hid' what he had typed, as it is supposed to do, in order to keep others from discovering another user's password. The Cowboy now typed his password in at the subsequent 'login:' prompt, where it was plainly visible for Jonathan to see. The Cowboy, in his inebriated state, repeated this mistake several times, cursing the system for not allowing him to log on, before realizing what he had done. The Cowboy, looking up sheepishly at Jonathan, corrected his error, logged onto the system, checked Jonathan's work, then dismissed him. This type of thing happened every now and then, with one user accidentally discovering another user's password, but Jonathan had never heard of such a thing at the ultimate level of security which the Cowboy was privileged to hold. And even a low-level user, having made this mistake, would immediately 'change' his or her password, in order to maintain the security of their user identity and their work. The Cowboy had not done this, which bothered Jonathan. Then, when the Cowboy disappeared, Jonathan was called in to take over some of his duties, which were spread amongst a variety of individuals. Jonathan was amazed at this, since the others sharing the Cowboys former duties were all top-notch, experienced 'Net'ers, which he was not, with high-level clearance in their regular posts. Jonathan then discovered, when changing his user attributes to match the Cowboy's, so that he could work with a variety of 'C-shell' programs, that his own security-level had been changed to match that of the Cowboy. What was unusual was that this had been done weeks ago-at the same time that Jonathan had been at home being initiated into the 'Circle of Eunuchs'. Jonathan shivered as he thought about this, with a strange chill running up and down his spine. The same strange chill had occurred twice that day. The first time was when he realized that the strange men surrounding him in the office he was temporarily working in-men sent down directly from the Chief Director's Security Office-were all working frantically to try to 'break into' the Cowboy's user account-which Jonathan knew the password for. The second time was shortly thereafter, when thinking about the 'password' incident, and realizing that the Cowboy's password-gnimocsizemog-when spelled backwards, read 'gomeziscoming'. Then, Tuesday... Jonathan was working at his home terminal, cleaning up a few leftovers from the day's office work, and he had noticed the intruding, unauthorized 'background' programs running, again. When he checked into their activity, he noticed that they were doing searches on all of his databases, searching for the word 'Uncle'. Each time the word was found, the database record was uploaded to /dev/null, as usual. Jonathan decided it was time to find out just where the purloined information had been going, for all this time. He pulled a sub-routine out of one of his programs, one designed to report back on 'path' errors when debugging programs. It was a sub-routine of his own design, and one that he was quite proud of. When one of his programs was sending its output files to some unknown place, with an unknown name, his sub-routine (which he called 'find_me.c'), would intervene to 'tag along' with the file, and, at its destination, change do a 'pwd' command (report the 'present working directory'), and use that and the name of the unknown file as arguments for the 'find_me.c' file, which would then report back to Jonathan's terminal with the path name and file name of the lost file. When Jonathan 'piped' his sub-routine into the intruder program, however, he got some very unexpected results. First, he was booted out of his login account, and his terminal screen went blank. Secondly, the power to his system went off, and he could not turn it back on. Thirdly... Jonathan reached for another bottle of bourbon. This one was Wild Turkey. He poured himself a stiff shot, threw it back, and thought about the third effect of his program. Thirdly, there was the sound of jack-boots on the stairs, several minutes later, then the sound of his next- door neighbor's door being kicked in, shots ringing out, and the sound of jack-boots leaving shortly thereafter. Jonathan had looked out the window to see dark figures loading his neighbor's lifeless body into a dark vehicle and then drive off into the night. The following morning, Jonathan had seen the news of his own death come over the VirtualNews link, stating that a lone burglar, who escaped capture, was responsible. Jonathan had switched apartments with his neighbor the day before, switching their terminals inside the junction box himself, rather than wait for the apartment manager's return from his vacation. He had chastised himself for forgetting to change the names on their mail slots, as he had promised the neighbor he would take care of it, but that omission, apparently, had saved his life. Jonathan reached for the bottle, once again, and thought about Bubba Rom Dos. The broken-down old buzzard may be, as the woman had told him, a useless failure, having given up on life. But the geezer sure knew how to do it with style, and since it would undoubtedly be discovered, upon his landlord's return, that Jonathan was still alive, he could think of no one better to emulate, than Bubba Rom Dos, in his final days. Jonathan raised his glass, in toast, to his new-found 'liquid guru', and he thought about the young girl he had encountered on his visit to see Bubba. What was her name? Alexis? Yes, Alexis. ---------------------------- Chapter 15 - Initiation

1 0

[PGP-USERS] JFYI: Austria goes offline
by Alec 17 Dec '03

17 Dec '03

>X-Sender: helmberg(a)mailhost.via.at >Date: Mon, 24 Mar 1997 16:07:03 +0100 >To: <pgp-users(a)rivertown.net> >From: Florian Helmberger <helmberg(a)via.at> >Subject: [PGP-USERS] JFYI: Austria goes offline > >-----BEGIN PGP SIGNED MESSAGE----- > >I thought this might be of interest for some of you guys... > >More info about this action is accessable at <http://www.internet.at>. > >*** > ==================== > Austria goes Offline > ==================== > > On Tuesday, 25.3.1997, Austria's ISPs are going to shutdown all their > Internet services from 16:00 to 18:00 MET. The reason for this unique > action is the recent seize of all computer equipment of a Viennese ISP > by the police as pieces of evidence. This official act was triggered by > a denunciation versus persons unknown regarding child pornography dating > 10.3.1996 (! one year ago !). > > Confiscation of equipment after more than one year doesn't seem to be > appropriate for securing evidence. The current legal status doesn't > clearly define the position of an ISP and doesn't specify general > guidelines for the responsibility of content of the Internet. With the > general shutdown Austria's ISPs are demonstrating the only mode of > operation which is evidently conforming to current law. > > Apart from the existing willingness for co-operation Austria's ISPs are, > at the same time, offering practical support for the legal authority > like free Internet access and training for their staff. > > From: "Christian Panigl, ACOnet/UniVie" >*** > >Best wishes, >Florian > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.3i >Charset: cp850 > >iQB1AwUBMzaYlHA6iYwSpSQNAQG5KgMAjeCROiykp0KxRhwBEtjrHgeK4wHqrTry >v1racUrPbqkIW1B9yLvc8yzkJ4v0+r1Bd7a2OBRbvcxm9TgtS8MzMy+vPumTgL7v >0kj3Qkt8NDYrU3nIHmrcriSlkZ8G7W7T >=Nk8a >-----END PGP SIGNATURE----- > >___________________________________________________________________________ >Florian Helmberger http://home.pages.de/~helmberg >------------------------------[Quote of the day]--------------------------- >"I am a marvellous housekeeper. Every time I leave a man, I keep his > house." > -- Zsa Zsa Gabor

1 0

INFO: Pro-CODE testimony available now online at democracy.net!
by Shabbir Safdar 17 Dec '03

17 Dec '03

========================================================================== _ _ __| | ___ _ __ ___ ___ ___ _ __ __ _ ___ _ _ _ __ ___| |_ / _` |/ _ \ '_ ` _ \ / _ \ / __| '__/ _` |/ __| | | | | '_ \ / _ \ __| | (_| | __/ | | | | | (_) | (__| | | (_| | (__| |_| |_| | | | __/ |_ \__,_|\___|_| |_| |_|\___/ \___|_| \__,_|\___|\__, (_)_| |_|\___|\__| |___/ Enhancing Participation in the Democratic Process Through the Internet _________________________________________________________________________ Update No.2 http://democracy.net/ March 20, 1997 _________________________________________________________________________ Table of Contents - democracy.net Cybercast draws Thousands to Interactive Hearing - Upcoming Events - Volunteering for democracy.net - About democracy.net ___________________________________________________________________________ DEMOCRACY.NET CYBERCAST DRAWS THOUSANDS TO INTERACTIVE CONGRESSIONAL HEARING democracy.net, a project designed to explore ways of enhancing citizens participation in the democratic process via the Internet, held its first live, interactive cybercast of a Congressional hearing on Wednesday March 19th, 1997. Thousands of Internet users joined this historic event by listening to a live audio feed from the hearing (cybercast over the Internet via RealAudio), submitting questions and testimony for the hearing record, reading information about the hearing, and joining a simultaneous online discussion forum to discuss the hearing with Congressional staff and policy experts. The hearing was held by the Senate Commerce Committe to consider S. 377, the Promotion of Commerce online in the Digital Era (Pro-CODE) Act and this issue of US encryption policy -- a critical issue to the Internet user community. Some statistics from the event. * 6,019 individual Internet users visited the democracy.net web site containing information about the Hearing, links to both sides of the issue, and other relevant information in the 24 hours preceding the event. * 703 individuals listened to the hearing live online via Real Audio throughout the 3 hour event. The actual Senate hearing room (Russell 253) where the event took place only holds less than one hundred people when filled to capacity (as it was for this hearing). * Throughout the event, between 20 - 50 people joined the simultaneous live chat discussion where Commerce Committee staff and encryption policy experts fielded questions and discussed the hearing. The audience included individual Internet users, reporters, advocacy groups, and Congressional staff. * Twenty-three Internet users submitted formal comments for the hearing record via the democracy.net web page, including IETF chair Fred Baker. The democracy.net cybercast was promoted on the front page of Netscape's World Wide Web site (one of the most popular destinations on the entire Web) on March 18 - 19. The site is also featured at Progressive Networks WebActive Site of the Week for the week of March 17-21. Despite some technical bugs early on (par for the course for a cutting-edge Internet event such as this), the cybercast went even better than we anticipated. We are grateful to Brett Scott, Mike Rawson, Matt Raymond, Mike Inners, and Pia Pialorsi of the Senate Commerce Committee staff for their help and support of this effort. Archives of the hearing are posted http://democracy.net/events/03191997/ democracy.net is a new project of the Center for Democracy and Technology and the Voters Telecommunications Watch designed to explore ways of enhancing citizen particpation in the democratic process via the Internet. democracy.net is made possible through the generous support of Webactive Panix, Digex, and the Democracy Network. Visit http://democracy.net/about/ for more details. ______________________________________________________________________________ UPCOMING EVENTS * April 10, 8:30PM EST - Online town hall meeting with Rep. Rick White (R-WA), Co-Founder of the Congressional Internet Caucus * April 16, 8:30PM EST - Online town hall meeting with Rep. Anna Eshoo (D-CA), Key Representative from California's Silicon Valley and leader on Internet Policy issues. * Additional events are in the works -- please visit http://www.democracy.net for more details, and sign up for our event announcement mailing list. democracy.net town hall meetings will be moderated by Todd Lappin (Cyber Rights Editor for Wired Magazine). The town hall meetings are designed to bring interested members of the Internet community and key members of congress together to discuss current Internet policy issues. ____________________________________________________________________________ VOLUNTEERING FOR DEMOCRACY.NET A volunteer is needed to help index the RealAudio transcript of the hearing. If you would like to help, please do the following and mail the results to webmaster(a)democracy.net. To index the RealAudio transcript, please listen to the transcript and watch the time counter at the bottom right of the page. Please note the following beginning and ending times: -whenever a new witness begins their prepared testimony and, -whenever a question and answer section begins. Mail them to us at webmaster(a)democracy.net with the start and stop times of each section. Thanks! ____________________________________________________________________________ ABOUT DEMOCRACY.NET The democracy.net is a joint project of the Center for Democracy and Technology (CDT) and the Voters Telecommunications Watch (VTW) to explore ways of enhancing citizen participation in the democratic process via the Internet. To this end, democracy.net will host live, interactive cybercasts of Congressional Hearings and online town hall meetings with key policy makers. democracy.net is made possible through the generous support of WebActive, PANIX Internet, the Democracy Network, and DIGEX Internet. More information about the project can be found at http://democracy.net/about/ To receive democracy.net announcements automatically, please visit http://democracy.net/ _____________________________________________________________________________ end Update No.2 03.20.97 =============================================================================

1 0

Re: American Registry for Internet Numbers?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 08:23 AM 3/24/97 -0800, Robert Cannon <cannon(a)DC.NET> wrote: >Does anyone know anything about ARIN (see www.arin.net) This is a >proposal to make IP numbering allocation seperate from domain name >registration. Currently NSI is paying for IP numbering paid for with >its domain name fees. Thus NSI is a big advocate of getting rid of this >work which it is not receiving profit from. But I find it difficult to >discern from the ARIN web site how credible this proposal is. I'm not sure how credible it is. However, a proposal to pay for IP addresses now would be really bad timing. The reason is that sometime soon the net is going to change to IPv6. It's not clear when, given some of the stopgap measures to get by with existing IP space, but it will probably be within the next 2-3 years. There are three main differences between IPv6 and the current IPv4 1) It's different, so you need to upgrade your routers and machines, which is expensive and annoying. 2) IPSEC security feature support is mandatory, so various government agencies are footdragging 3) Addresses are 128 bits long instead of 32 bits. 32 bits is 4 billion, which would be enough for almost everybody on the planet to have one (except that the addressing structure wastes part of the space.) 64 bits is almost enough for everyone on the planet to have a network number with a host number for everyone else. It's almost enough for every human neuron on the planet to have an address. 128 bits is far, far larger than that. Even if we waste lots of space by using an inefficient structure, which we will to make routing easier, there's still mindbogglingly more space than anyone needs. There are two reasons to charge for Internet numbers: 1) Even if you've got nearly infinite supplies, somebody still needs to coordinate it to prevent collisions, and this has non-zero cost. 2) Today, numbers are in short supply, so charging for them can help reduce waste and bring in revenue for the lucky contractor, especially if you charge by the address or size of address block. Tomorrow, there are so many numbers that charging by the number doesn't make sense - all you need is an initial coordination cost. So if you want to make big bucks on this business tomorrow, you'd better get the market locked in today. There are alternative approaches that don't even require a registry. For example, divide the address space into a 48-bit host part (Ethernet numbers are unique) and an 80-bit network part, and just pick a random network part. On the average, the probability of collisions is very low unless 2**40 other people are playing, and you can put all the machines you want on that network. If that's not guaranteed enough for you, you could use an Ethernet board number as the network number (even if your network isn't Ethernet based, you can buy a $50 board :-) To put costs in perspective, the last time I checked, the Ethernet industry charged manufacturers $1000 for a 24-bit chunk of numbers, and there are 2**23 chunks available; there are very few manuacturers who'll ever need to buy a second chunk, and not many manufacturers, so this relatively high price is reasonable. On the other hand, if somebody wanted to set up a web-based registry of IPv6 numbers, they could dole them out for a few dollars per chunk, most of which would be spent on billing. Perhaps the Ethernet folks could sell IPv6 registry space for $1000/registry? A bit of initial coordination can set aside different parts of the number space for different strategies, and let the market settle it. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Analysis of proposed UK ban on use of non-escrowed crypto.
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 09:51 AM 3/24/97 -0500, "Michael Froomkin - U.Miami School of Law" <froomkin(a)law.miami.edu> wrote: >It may be that in the UK/EU usage has moved (been moved?) to the point >where TTP => escrow. If so, this is as unfortunate as the term "escrow" itself. The UK folks who introduced the term TTP did it in the context of escrow. > I prefer "key bailment" myself. > It more closely captures the legal relationships. What a great term! It does sound like it covers the legal relationship, and it sounds like something the average person would rather avoid, as opposed to escrow which is has a neutral-to-positive sound, or "Trusted Third Party" which drips saccharine "We're from H.M.Government, and we're here to help you" # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

[Proposal:] Revolving Web Mirrors
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi, I am working on a system of a revoloving web mirror. The basic operation would be as follows: 1. The Server - ------------ The would be a server that would contain a colection of web pages that have been "baned" or blocked due to their content by various countries. I addition to this their would be a form that users could fill out to subscribe to mirror a web page (details under User). The server would mail out periodicaly to the users different web pages for them to mirror off of their web pages. 2. The Forms - ------------ The Web Form for the user to fill out would give the user the options of size/# of pages, general content type, and how often to change. 3. The User - ---------- The User would be able to offer some of his web space to mirror web pages that due to their content have been blocked. The users should have a choice of different catagories of web pages: political, sexual, crypto, ...ect. (since they are donating the web space they should have some say in what web pages they mirror). The User should be able to determin the amount of web space / # of web pages he is willing to host. The User should be given the option of hosting HTML pages and/or binaries. If he selects to host binaries he should have some selections as to what binaries he is willing to host. 4. Links - ------- Some users may be unwilling or unable to mirror webpages. That may be willing to provide links to baned web pages and/or to the web mirror servers. A collection of links should be made available to the user so they can be integrated into their web pages. 5. Notification - ------------ Users that have subscribed to the Mirror service should be sent e-mail with a list of web pages that meet the options that they filled out in the form. The should be given URL's of where they can download the pages along with the orriginal web pages URL's so they can make the final determination of what web pages they wish to mirror. This is just a rough outline. If you have any thoughts or comments on this please let me know. If anyone has server space they could donate for such a project please let me know. Thanks, - -- - ----------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. Finger whgiii(a)amaranth.com for PGP Key and other info - ----------------------------------------------------------- Tag-O-Matic: What I like about MS is its loyalty to customers! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: Registered User E-Secure v1.1 ES000000 iQCVAwUBMzccE49Co1n+aLhhAQEvJAP9Edh72M0adX5ZXcKPo6qQvuvbLG/1u6Vo CrPU8mMtRxbgBptRZgJ+fzCB98nEMASTUb/vkWx4He/sS5xs3Tjy5kS/fdxs9z4W pNwoau9YsOJOOx8EMUIWJNU08x011kREqxFMP2M7ds+LHsO9HuVy/fvNPVJuXDOV g7q/tEodJNc= =+ixR -----END PGP SIGNATURE-----

1 0

No Subject
by Mix 17 Dec '03

17 Dec '03

Many forgeries are traceable with mathematical certainty to feebleminded Tim C[rook] May's poison keyboard. ( )( )________ Tim C[rook] May /00 \ _ O_\\--mm---mm /_______)

2 1

No Subject
by Mix 17 Dec '03

17 Dec '03

Timmy C[rook] Mayonnaise's abysmal grammar, atrocious spelling and feeble responses clearly identify him as a product of the American education system. ___ ./_ -\. q| o O |p -oOOO--~U~--OOOo- Timmy C[rook] Mayonnaise

4 3

Reps. White and Bliley: requesting comments on crypto policy
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 24 Mar 1997 19:33:39 -0500 From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: FC: Reps. White and Bliley: requesting comments on crypto policy Reps. Rick White (R-Washington) and Tom Bliley (R-Virginia) have been busy sending out letters requesting comments on encryption policy -- and asking pointed questions. The letters have gone to: Lieutenant General Kenneth Minihan, Director of the National Security Agency Secretary William Daley, United States Department of Commerce Director Louis Freeh, Federal Bureau of Investigation Ambassador David Aaron, U.S. Special Envoy for Cryptology Robert Holleyman, President of the Business Software Association Ken Wasch, President of the Software Publishers Association Kathy Kincaid, Director of I/T Security Programs at IBM Attached is the one to the NSA. -Declan ******************* March 21, 1997 Lieutenant General Kenneth A. Minihan Director National Security Agency/Central Security Service 9800 Savage Road Fort George G. Meade, MD 20755-6000 Dear General Minihan: The Committee on Commerce has jurisdiction over all matters relating to interstate and foreign commerce, including commerce transacted over electronic mediums. One vehicle for interstate and foreign electronic commerce, the Internet, has experienced unexpected and exceptional growth. Our Committee has an obligation to ensure that the growth of electronic commerce over the Internet and other networks is not stifled by unnecessary or harmful regulation or policies. Thus, the Committee will be discussing what policies best promote electronic commerce over the Internet and other networks. The growth and success of the Internet and the World Wide Web as both a communications tool, and a medium for electronic commerce is unprecedented. Leading industry estimates indicate that the number of people using the Internet is increasing at the rate of more than 100% per year -- few technologies have had such quick acceptance into the daily activities of Americans. However, the full potential of the Internet as a means for conducting business transactions, or electronic commerce, has yet to be achieved. Most leading experts agree that a developed Internet, and corresponding intranets, have the capability to be engines for economic growth for those offering services over the Internet, and also have the capability to be a means for transforming business operations from one of paper-intensity to one conducted solely through electronic communications and transactions. Unlocking the full potential of the Internet and thus, promoting the use of electronic commerce has been difficult, in part, because of existing and perceived barriers, e.g., many consumers and businesses are concerned with the security and privacy of transactions that would occur over the Internet. A belief in the security of information passed over the Internet and through on-line services that use the public switched network will foster the continued growth of electronic commerce. Fortunately, the use of cryptography or encryption, either hardware or software, may provide a technological aid in the promotion of electronic commerce. We believe, however, that a sound encryption policy for both interstate and foreign electronic commerce must balance users= privacy interests with society=s interest in legitimate law enforcement and investigative needs and the needs to preserve national security. As you know, the U.S. has export restrictions on certain encryption products that may or may not interfere with the development of encryption products designed to secure communications and transactions. These restrictions have been the subject of recently proposed legislation in committees in both the House and Senate. Because of our responsibility over electronic commerce, we seek to have your views on a number of the issues related to the various bills. Therefore, we request that you provide written answers to the following questions by April 25, 1997: (1) With the understanding that there are no domestic restrictions on encryption products, please provide examples where national security may be jeopardized by the relaxation of current American export restriction policy, as incorporated in Executive Order 13026 and implemented, in part, in the corresponding Bureau of Export Administration rules of December 30, 1996. Are there remedies other than export restrictions that would provide the United States government the access it needs to encrypted communications, e.g., increased funding for new advanced computers? (2) How significant is your agencies= consultive role with the Department of Commerce within the current export restrictions? Should this role be strengthened or is it even necessary? How much additional application process time does your agencies= consultive role add to the Department of Commerce=s procedures? (3) It is commonly accepted that current encryption export restrictions imposed by the Administration will delay the proliferation of advanced encryption products, but that it is inevitable that advanced encryption products will be developed world-wide. In your opinion, do export restrictions prevent the development and distribution of advanced encryption products? (4) Are foreign import restrictions consistent with the Administration=s policy? Please identify the countries that have import restrictions and those that have stated their intent not to have any import restrictions. If the United States relaxes its export restrictions, do you anticipate that foreign nations will increase their import restrictions? In addition, we request that your staff analyze and submit their comments on the following: (1) the current export restrictions; (2) the congressional bills introduced that would alter export policy (H.R. 695, S. 376, S. 377); and (3) any other analysis related to encryption export policy your organization has prepared. Please have your staff contact John Morabito or Tricia Paoletta of the Commerce Committee staff at (202) 225-2927 if you have any questions regarding the above request. We thank you in advance for your assistance. With kindest regards, we are Sincerely, Tom Bliley Chairman Rick White Member of Congress ------------------------- Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ -------------------------------------------------------------------------- This list is public. To join fight-censorship-announce, send "subscribe fight-censorship-announce" to majordomo(a)vorlon.mit.edu. More information is at http://www.eff.org/~declan/fc/

1 0

Re: Analysis of proposed UK ban on use of non-escrowed crypto.
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

"Timothy C. May" <tcmay(a)got.net> writes: > (I could go on and cite dozens of examples. Did ASCII need the "force of > law" to make it a better standard? Did the government have to certify, > license, and regulate the makers of various implmentations of computer > languages? And so on.) Bad example, Timmy. I used to hang out with the standards people and yes, a lot of government purchases (both US and non-US) are mandated to comply with ANSI and ISO standards, which is why vendors push so hard to have their implementation declared the standard. Yes, U.S.Gov't does buy certified ANSI C, Fortran, etc compilers, not to mention ADA. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Announce: list-abuse mailing list
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Mon, 24 Mar 1997 15:12:13 +7 From: "John Buckman" <jbuckman(a)shelby.com> Subject: Announce: list-abuse mailing list To: listmom-talk(a)skyweyr.com Precedence: Bulk Sender: "ListMom-Talk Discussion List" <listmom-talk(a)skyweyr.com> Reply-To: "ListMom-Talk Discussion List" <listmom-talk(a)skyweyr.com> On the list-managers list, I suggested that a mailing list discussing how to prevent mailing list abuse might be useful. Based on the strongly positive feedback I received about the idea, I've gone ahead and created a "list-abuse" mailing list. I apologize to members of "list-managers" who have already received this announcement. General instructions about joining "List-Abuse" are available at: http://clio.lyris.net/list-abuse/ Alternatively, you can send email to: join-list-abuse(a)clio.lyris.net About LIST-ABUSE: LIST-ABUSE is an Internet discussion group working to stop abuses of Internet mailing lists. In particular, we aim to stop mail bombs, spoofed-subscribers, denial of service attacks, and other forms of "Mailing List Terrorism". Mailing list administrators, authors of mailing list software, and others interested in mailing list abuse are welcome to join. John John Buckman <jbuckman(a)shelby.com> Shelby Group Ltd., http://www.shelby.com/ Developers of Lyris Email List Server --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/

2 1

[IMPORTANT] Forgery detection
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Timmy C[rook] May's mother attempted to pro-choice the unwanted little bastard by fishing with a coat hanger in her giant cunt, but failed miserably to pull the rabbit and succeeded only in scraping out the contents of little Timmy's fetal cranium (not much to begin with). _ / ' | /><oo><\ Timmy C[rook] May //[ `' ]\\

2 1