December 2003 - cypherpunks-legacy

Re: SCHEME for FULL-SPEC RETURN PATH
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Sorry, either I mixed it up with regular cypherpunks mail or didn't realize you were expecting a response. To summarize your method, messages going from the original sender to the recipient have headers like To: recipient X-Anon-Sender-Path: X-Anon-Reply-Path: where the X-A-*-P: headers have the form remaileruser+stuff@remailersite and "stuff" is similar-sorm stuff encrypted with a remailer's public key. When going from the sender to the recipient, remailers take their names off the X-A-S-P line, decrypt the stuff, and encrypt themselves onto the X-A-R-P line, which the recipient can use to reply. My two main problems with it are 1) It leaves the recipient's address visible the whole way. Not only is this a security risk, but the recipient may not have made it known, since the recipient may have set up some messy remailer-chain using different syntax to get replies. 2) The syntax may be symmetrical, but it's ugly :-) It would be cleaner to package it into the To: field if you can, though the user+stuff@somewhere format seems to be an Andrewism, and the Internet standard @somewhere.com:user@domain or user%foo(a)bar.com forms only carry machine names, not machine and user names. Because you're not using the standard mailer syntax, it means that you have to build a chain of only your flavor of remailers to get a reply to work, though I suppose almost any method has that problem. But you run the risk of a normal machine or smart-mailer along the way just seeing the To: recipient(a)machine.com and sending it directly instead of sending it to your remailer-user. Better to keep roughly your same syntax, except have the To: line be only the next hop, and the recipient's real address be hidden inside the X-A-S-P pile. That's also more symmetric, letting you take a reply from this sort of system and reply back to it again. Bill

1 0

REMAIL: simple digital postage
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >How willing are remailers to try this? Both Hal Finney and Karl >Barrus have code for remailers (Karl's is more recent, Hal's is in >wide use). Could their code be modified easily to accomodate a >primitive form of stamps? Well, I know that integrating a quick and dirty (not particularly cryptographically sophisticated) digital money system can be done in Hal's code, since thats what I did at elee6ue(a)rosebud.ee.uh.edu for quite a while. (Now elee6ue@rosebud has been restored to "ordinary" operation). And the one I recently wrote could be modified the same way - I just put it together to test cutmarks, automatically detecting pgp encryption, and latency delayed remailing. I was looking into a more efficient way to check the validity of cash, and making things bomb-proof, but sorta got sidetracked ;) The way I did it is to add to remail.pl, have the script search the header for a Digicash line (you use the pasting tokens as usual to place it in the header). The script extracted the "cash" and searched for it in a list maintained by the remailer. If found, then the remailing proceeded as usual, otherwise the message "Insufficient funds to deliver message" was sent along instead. The cash list is read into memory and rewritten out, minus the value just used. The cash strings I used were random characters, which looked like this (all starting with the character B): BU2j4yCJgtl8wO2KvsEIIttaSOt9zEfS7giqHwEuuh3bbuTGppoElILYeW09a BYnIA2EQSXEJQ65U8PM2nG07ilq7zCEFqaTBXDuzeEb6YjBgVWUGNm6GPA0zS BmgF0hscwOHICfLNcDefkPo8PSO1ou2NQ4ecMcIPiGDu5fUEz63Wjiosj0JSD and so forth. Now with magic money a more sophisticated system may be developed. Perhaps I will shift elee6ue@rosebud back to a pay-for-remail system, or do it at the mystery middle point of the remailer chain I'm experimenting with. Here is an extract of the additions to remail.pl I made to implement this: if (/^Digicash:/) { chop ; s/^.*: // ; # remove text before colon AND blank afterwards $payment = $_ ; } } # check validity of digital cash # open cash file and read it all in open(CASHLIST, "./digicash.list"); @listofcash = <CASHLIST>; close(CASHLIST); unlink "./digicash.list"; #open file, check cash for validity #if valid, don't write it back to the file open(CASHLIST, "> ./digicash.list"); $paidfor = "n"; while (@listofcash) { $validcash = shift @listofcash; chop $validcash; if ($validcash eq $payment) { $paidfor = "y"; next; } print CASHLIST $validcash, "\n"; } close(CASHLIST); -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLWGxcoOA7OpLWtYzAQHV2AP/T7o0N9qUE8XU/urPqx8pzL+h/Rvs2zbg 6Lky3vu2GoMXEUmVbtbB8xl4c20kvSz5ysSkQ3B8NYXhTdAtcrgH0J2Zd1YHdCKb xmh+rS4xLXuiO6T/j24XqiLOcq0YiF2F2ytzgM/mi03cxN6FMZrat+8vIqLrgjfg ZNVvBAR46to= =JDF6 -----END PGP SIGNATURE-----

1 0

money maker
by Gary Jeffers 17 Dec '03

17 Dec '03

I have an idea of how ambitious cypherpunks could make money. They could be communications intermediaries between financial clients in the U.S. & financial institutions in locations such as the Bahamas & Switzerland. This would require a cypherpunk in the U.S. & another cypherpunk in the foreign country. From now on in text cypherpunk = CP. The U.S. CP would get message from client & then use the internet with anonymous remailers & strong encryption to send message to CP in foreign country. CP in foreign country then decrypts message & gives it to local financial institution. Financial institution gives message to foreign CP who then encrypts & uses anonymous remailers to send info. back to U.S. CP. U.S. CP decrypts & gives info to client. In this way, encryption naive client could have access to great financial privacy & CPs get money. At this point, I think everybody gets the basic idea. CPs would have initial problem getting clients. To do this they would need to hook up with a financially sophisticated partner. That shouldn't be too hard. College friends in finance, local CPA's you've dealt with,th, lawyers, etc.. CPs would probably be the rare & precious birds. Once the CP has his financial contact, that financial contact can develop the clients. In the foreign country, the CP shouldn't have much of a problem getting a financial partner/advisor & could probably operate with neon lights. In the land of the free (the U.S.), I would advise discretion. This business should not take a lot of capital. CPs would bring the rare communications technical expertise & the financial expertise should be plentiful. There is a possibility of harassment, so the CP's should have courage. By the way, there was someone on CYPERPUNKS that was offering a percentage of the profits for great financial ideas. I would like to volunteer this idea. It might not meet all the specifications, but then someone might like to change specifications & accept this idea. This idea may be half baked. In which case, I leave it to my fellow cypherpunk geniuses associates to fully bake it. Good luck - Gary Jeffers GO TEAM GO! - GO TEAM GO! PUSH EM BACK! - PUSH EM BACK! WAAYY BACK! BEAT STATE! - BEAT STATE!

2 1

Re: Pynchon as roadkill on the digital superhighway
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Cyrus Shaoul writes: > Pynchon may not be as stupid as that. Has anyone gone to check up on Mr. > Vineland lately? Perhaps the address in the DMV computer is that of a > fried chicken franchise in Lost Hills, CA! Just cause you have some data > doesn't mean it's useful. Yes, I did. The point of getting the address is because I discovered he lived in Aptos, CA, same as I do. (My source saw my W.A.S.T.E. reference and assumed I was merely making a joke....he was surprised to learn I actually live in Aptos, and then volunteered the NLETS record.) His house was (rumors that he's been back on the East Coast for the past couple of years) about 3-4 miles from my house, less as the crow flies. I shot a dozen or so photos of the house and surrounding countryside, for my scrapbook and for that of the source. Not a fried chicken stand. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power:2**859433 | Public Key: PGP and MailSafe available.

1 0

Misc replies
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sandy Sandfort <uunet!crl.com!sandfort> writes: > Ever notice how few mail bombs we get from Trump or Gates? Maybe the > rich are rich because they've learned self-restraint. Bet you dollars to > donuts that LD doesn't have a pot to pee in or a window to throw it out. H. Ross Perot. ==== Xenon <qwerty(a)netcom.com> writes: > So tell my why I should censor > Larry 'cause I don't see why I should. It's a lost cause. He will simply > aquire other accounts, or telnet to port 25 of a remailer and fake his > address, but this time with greater ambition to do damage. I second Hal's suggestion to route Detweiler's traffic through Xenon's remailer. (Xenon - the point isn't to keep Detweiler off the net. We all know that's impossible. The point is to keep Detweiler from getting remailers shut down by abusing them. That's why this is particularly unlike censorship; Detweiler's goal is to keep all people from using remailers.) -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLWHDgH3YhjZY3fMNAQEIowQApVUiB4wdXYhTmj8ZuLOSiwTy94+uOUim mZCfbKca40cXkKzdUlX36deIeJ/NLFQsVJ+KVIUqn19IsfGcIQZnZFPJgVnrovji VYTChpGwVQ9LCHjc2ppmmBSC83145+AyKSKXuFt+auLHWLtWrPZGvohweyDv51HY argqt4+Czu0= =1FP6 -----END PGP SIGNATURE----- -- Greg Broiles ".. has bizarre Cyberanarchist theories relating greg(a)goldenbear.com to human punishment." -- L. Detweiler

1 0

Re: Pynchon as roadkill on the digital superhighway
by mcb＠net.bio.net 17 Dec '03

17 Dec '03

Tim May writes: > [...] > It seems that in the early morning hours of January 28, 1990, someone > accessed the Department of Motor Vehicles computer files and got a > printout of the elusive man's home address, personal characteristics, > etc. A copy of this was forwarded to someone who studies Pynchon, and > thence to me, for reasons I won't go into right now. > > The implications for Cypherpunks, privacy, and Pynchon as roadkill on > the digital highway are clear. Just looked at the date on this again, and realized it is not as surprising as it sounds -- until 1991 CA DMV records were open to anyone who made a request. No need to break in and look at secret files, all you had to do was go to the DMV and request them. This was changed, I believe, mostly as a response to a case involving a TV actress in LA who was stalked by an obsessed fan, who got her address from the DMV and eventually ambushed her there and murdered her. And as cool an author as Pynchon is, I suspect he is an amateur at the privacy business; anyone who would put their true residence address on their driver's license is obviously not paranoid enough to be serious about not being found. (Don't know if it has been mentioned here, but Simson Garfinkle has an article in this month's WIRED titled "Nobody Fucks With the DMV", about the privacy implications of the amassing of personal data by state DMVs. It's a good -- and scary -- read.) -- Michael C. Berch mcb(a)net.bio.net / mcb(a)postmodern.com / mcb(a)remarque.berkeley.edu

1 0

Re: Pynchon as roadkill on the digital superhighway
by Cyrus Shaoul 17 Dec '03

17 Dec '03

Michael C. Berch writes: >> And as cool an author as Pynchon is, I suspect he is an amateur at the >> privacy business; anyone who would put their true residence address on >> their driver's license is obviously not paranoid enough to be serious >> about not being found. Pynchon may not be as stupid as that. Has anyone gone to check up on Mr. Vineland lately? Perhaps the address in the DMV computer is that of a fried chicken franchise in Lost Hills, CA! Just cause you have some data doesn't mean it's useful. [Gratuitous Blues Brothers reference to Wrigley Field inserted automagically.] ----------------------------------------------------------------- Cyrus Shaoul cyrus(a)ntthcs.ntt.jp NTT Human Interface Labs / Yokosuka TEL +81(0)468-59-4672 Visual Media Laboratory / Japan FAX +81(0)468-59-2829 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Finger cyrus(a)media.mit.edu for PGP public key, or use the server. Or get it all from my WWW Page: http://iikk.inter.net/ ________________________________________________________________

1 0

An out of country Remailer
by Rob P. Martin 17 Dec '03

17 Dec '03

I recently decided that running a remailer from this account might be a good idea. To help the over all good. It is "out of country" for most of you, so it will make one more hop that will be harder for LE to get at from wherever you are. But I also want to protect my account as much as possible, so I would like to ONLY remail to other remailers. (As they are much less likely to complain to my sysadmin than any other recipient) Does anyone have remailer software that could be easily changed to remail to a limited set of adresses? If so I would be interested in helping the cause, if not I probably will go back to being a "watcher" from the sidelines.. Rob PS. Did I really read that someone said that Canada was a Socialist country with limited free speach?

1 0

unsubscribe
by katz＠spectrum.cs.bucknell.edu 17 Dec '03

17 Dec '03

unsubscribe me please

1 0

PFF's Jeff Eisenach: "Time to Walk the Walk on Telecom Policy"
by Declan McCullagh 17 Dec '03

17 Dec '03

--------- July 2,1997 Time to Walk the Walk on Telecom Policy by Jeffrey A. Eisenach The Progress & Freedom Foundation Thanks to Ira Magaziner -- of all people -- the Clinton Administration has finally learned to talk the free market talk that brings joy to denizens of the Internet. Now, as always with this Administration, the question is whether it will also walk the walk. Magaziner deserves real credit for crafting the Administration's new "Framework for Global Electronic Commerce." In language that could have come from the Cato Institute (or my own Progress & Freedom Foundation), it credits the amazing growth of the Internet to the relative absence of intrusive government regulation. And it concludes that the Internet should remain "a market-driven arena, not one that operates as a regulated industry." The paper -- and the process that created it -- has already had a salutary impact on Administration policy. The White House has now backed away from its previous support of the Communications Decency Act in favor of "industry self-regulation, adoption of competing rating systems and development of easy-to-use technical solutions." And last month, Treasury Undersecretary Larry Summers, reportedly at Magaziner's urging, had very positive things to say about the "no new taxes on the Internet" legislation sponsored by Congressman Chris Cox and Senator Ron Wyden. The Administration's conversion to a free market view of the Internet is, however, far from complete -- even rhetorically. Most importantly, the Framework's treatment of telecommunications regulation amounts to an endorsement of the Federal Communications current policies -- policies that are, if anything, more regulatory than before passage of the supposedly deregulatory Telecommunications Act of 1996. Following the path laid out by Vice President Gore and outgoing FCC Chairman Reed Hundt, the Framework ignores the fact that technological innovation is rapidly ending the "natural monopoly" characteristics of the market for local telephone (and Internet) access. What government should be doing in this context is allowing marketplace incentives to work, thereby encouraging new technologies and new competitors to turn the potential for local access competition into a reality. What it is doing, under the FCC and with the apparent blessing of the Framework, is continuing a price regulatory regime that destroys marketplace incentives for the development of new technologies and competitors. The Framework, which begins by stating that "government attempts to regulate are likely to be outmoded by the time they are finally enacted," ends up endorsing the idea of "implementing, by an independent regulator, pro-competitive and flexible regulation that keeps pace with technological development." Nice fantasy -- but in contrast to the reality of the FCC's implementation of the Telecommunications Act, it comes off as nothing but a bad joke. Telecommunications is not the only problem area with respect to policy. Most notable among the others: Encryption, where the Administration stubbornly adheres to its unworkable, privacy-invading notion of "key escrow" for encryption software -- i.e., giving the police the key to your house in advance in case they decide later they want to conduct a search. Still, problems aside, what we have from the Clinton Administration is a real and laudable move -- partly rhetorical and partly real -- in the direction of less regulation of the Internet. For the most part, the Administration is now talking the deregulatory talk. Will it also walk the walk? Here are three giant steps that would go along way to proving the Administration means what it says. First, will the Administration appoint a new FCC (there are four vacancies, including the chairmanship) that understands the idea of dynamic competition to erode natural monopolies? The FCC's current "managed competition" approach is inconsistent with the broader principles of the Framework and hugely destructive to the innovation and entrepreneurship the paper emphasizes so strongly. A new Commission would no doubt want to re-think the Commission's recent rulings with respect to Interconnection and Universal Service, both of which represent massively regulatory approaches to problems the free market can largely solve. Secondly, will it specifically endorse the Cox-Wyden legislation prohibiting discriminatory taxation of the Internet? Saying nice things about the bill is one thing; endorsing it and working for passage is something else. Third, will the Administration support the new legislative agenda being developed and soon to be introduced by Senator Conrad Burns and Congressman Billy Tauzin (chairs of the Senate and House telecommunications subcommittees)? Among other things, this legislation is expected to declare "enhanced services" (including broadband Internet access services) an essentially regulation-free zone -- exactly the sort of thing the Framework says the Administration should support. Free marketers want to believe the Administration has seen the light on regulating the Internet. Our message now is simple: Take three giant steps -- and throw away on the key on key escrow -- and show us you really mean it. ###

7 11

Magic Money and Remailers
by remailer＠merde.dis.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: >Subject: Simplified Digital Postage--Proposal >... A more sophisticated system based on true digital cash, perhaps >based on Magic Money," is more desirable, but almost anything is better >than the current system. (Well, not _anything_.) >I propose remailers immediately adopt some form of digital >money/postage, even if current instantiations are not fully debugged >or optimized. "Magic Money" may be ready for such a trial use. Magic Money will have to be modified for that use. As it works now, clients A and B are using a common server S's coins. Client A wants to pay client B some money. Client A sends client B the coins. Client B sends the coins along with new, blinded but unsigned coins, to server S. Server S checks the old coins, signs the new ones, and sends them back to client B. This leaves two options: A) The remailer is the server. In this case, you don't need Magic Money, just a straightforward blind signature system, and I could write that if someone could describe in detail what they want it to do. The remailer operator could write it too, using PGP Tools and Magic Money source code as a basis. B) There is a third party server, and all remailers use its coins. In this case, the remailers have to mail the coins to the server and get the server to verify the coins before remailing the message. A good way to set up a time lag, but pretty complicated for an all-automatic system (the client would have to be modified, too) and lost mail from the server would wreck the system. First someone has to set up a Magic Money server, which so far nobody has. >- subtle flaws in digital money protocols (and I doubt "Magic Money" >is completely free of subtle or not-so-subtle flaws...everything needs >debugging and evolutionary learning) will not be so serious when only >"postage" is involved. As opposed to "real money" situations, where >finding a way to break or spoof the protocol could result in large >amounts of money being lost. At least with digital postage, about the >worst that could happen is someone gets free remailing--the current >situation. Magic Money isn't too bad in security. It uses Chaum online cash: a random number x, MD5(x) put in a properly padded signature packet and blindsigned by the server, and different e/d pairs for different denominations. Messages to the server are encrypted with the server's PGP key, and the server's replies are encrypted with the client's PGP key (provided in the original message) and signed with the server's key. >How ready is Magic Money for a test-bed use like this? Right now it's designed to allow people to pass coins between each other, but the code could be hacked to accept coins automatically. I have mixed emotions about pay-per access (to remailers or anything else) but I am interested enough in seeing digital cash experimentation to write the code now and worry about the ideology later. >- and of course, a charge of, say, $2.00 in real money (send in $20, >get bact 10 remailer "stamps" of some form, suitably anonymized >through a blinding procedure a la Chaum) would mean that posting to 20 >newsgroups would be a nontrivial expense for a would-be flooder. Everyone would use the free remailers rather than pay $2. Both Chaum and RSA would jump on you if real money was involved. What about just having a finite number of stamps going around, to prevent mailbombing? Here's an anonymity-breaking attack I've been worrying about: In an untraceable digicash system, deposits cannot be matched to withdrawals, so the bank cannot find out where a customer spends money. However, the bank in collaboration with a payer can determine who deposits a particular coin. Suppose you are providing a non-approved service or product, using remailers and digital cash to protect your identity. Someone wants to trace you. All they have to do is set up a sting: buy your service with coins which are recorded, and get the bank to identify who cashes in those coins. To prevent this, the bank cannot know who deposits particular coins. The bank cannot know who any of its accountholders are. Being an accountless system, Magic Money can be operated through a remailer. But Magic Money is an online system. Offline systems depend on the bank knowing who the customers are, and being able to punish them for double spending. How could an offline system be made immune to this attack? I don't know about remailers, but I wish someone would set up a Magic Money server. I haven't heard much about Magic Money on the list lately. That could be good (the code works) or bad (nobody cares). Which is it? BTW the latest versions are PGPTL10C and MGMNY10E. Pr0duct Cypher -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLWGqBMGoFIWXVYodAQEFjAP/SvhcAGk4ZGuvDaFN9oNiTtZi0Yhf1Q63 ARqSJgHGtrwsMxoxKnT5cuErjoV3+ba0b7Id49apq6zdS6W7UVo6Gpm5WIxfIOui V6VeFlYE5Wry4YKrMahjYCd4th80hWLWpgcGcjCw0WqmESfR0i8jLVpiKzwB0cKO VldNKHU4/GY= =7EVp -----END PGP SIGNATURE-----

2 1

Re: Clipper and Traffic Analysis
by smb＠research.att.com 17 Dec '03

17 Dec '03

> Also, it probably goes via a different physical path. And at least some > SS7 trunks are encrypted with DES. Care to say anything about which ones are encrypted and why? Or to ask it another way, who decides? I phrased it that way because I'm not certain of the extent, and I'm not certain how much of what I know is AT&T-proprietary. But the obvious risks that encryption avoids are traffic analysis by enemies (pick your own definition of enemy), information on what channels to wiretap (remember the furor a few years ago about the location of the then-Soviet embassy on a hilltop in Washington, D.C.?), and the threat of phone-phreaking by introducing bogus call setup messages. On the latter point, recall that out-of-band signaling was introduced in part in response to ``blue boxes'' and other device that exploited in-band signaling technologies.

1 0

AT&T stopped talking to me
by rcain＠netcom.com 17 Dec '03

17 Dec '03

Cryptophiles, I don't know if there is any signifigance to this or it is incompetence. I was in discussion with a rep for AT&T about their VSELP part and getting the firmware development software to add crypto to the part. (Don't even need hardware, the simulator is supposed to be so good.) This rep had put me in touch with the local AT&T marketing person for the part in order to handle some questions he couldn't. Things were going along pretty well until the AT&T fellow asked me what my application was. I was queasy about answering that question and rightfully so. I felt a sudden change of attitude from the guy when I told him it was to implement my voice crypto and I have gotten nowhere with them since. I asked for the complete datasheet for the part and received instead the same two page summary I already had. There is no way one could design in this part with the info in that marketing blurb so something else *must* exist. I cannot get them to even return a call any more. I left a message on the men's phone mail detailing that I was ready to purchase the development software and wanted to meet briefly to discuss that and explain the real design information I need for the part. I have been unable to get either to return my calls. In my last conversation with the AT&T guy he was trying to discourage me, telling me that to get any support for this firmware development required some kind of market study showing that the application would result in the sale of 100,000+ of the devices. I told him that I saw little problem with that number and anticipated potentially ten times that quantity or more over the life of the product. :-) I dunno, maybe it is coincidence but it sure seems to me that AT&T's willingness to sell to me and help support a product development vanished at the point when I mentioned crypto. Steve B., since you are with AT&T is there any policy that you know about regarding sales of devices for use in crypto? Peace, Bob -- Bob Cain rcain(a)netcom.com 408-354-8021 H 415-966-9549 W (10 am to 7 pm) "I used to be different. But now I'm the same." --------------PGP 1.0 or 2.0 public key available on request.------------------

4 3

Barlow article on Clipper
by Mike Godwin 17 Dec '03

17 Dec '03

Forwarded message:

1 0

The L. D. persona...
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

The other day, I noticed that MacPGP seemed to give credit to a person with the initials L. D. He certainly seems unpopular...was he at one time a more positive force? Or is this a dumb question on my part? Regards, Dave

2 1

Re: AT&T stopped talking to me
by smb＠research.att.com 17 Dec '03

17 Dec '03

Steve B., since you are with AT&T is there any policy that you know about regarding sales of devices for use in crypto? I know of no such policy. To be sure, I wouldn't necessarily know of it if it existed, being enmeshed in the wilds of Research -- but I know of none.

1 0

EFF WANTS YOU TO CALL FOR SENATE HEARINGS ON CLIPPER
by Mike Godwin 17 Dec '03

17 Dec '03

EFF WANTS YOU TO CALL FOR SENATE HEARINGS ON CLIPPER *** Distribute Widely *** Feb. 15, 1994 Dear Friends on the Electronic Frontier, Thank you for your efforts in fighting the government's ill-considered Clipper proposal. We have already delivered over 2250 messages supporting H.R. 3627 to Rep. Cantwell, and your messages have continued to flood in. We'd now like to ask you to help us call for Congressional hearings on Clipper by writing to Senator Patrick Leahy c/o leahy(a)eff.org. As we have previously reported, the Clinton Administration has announced that it plans to proceed on every front to make the Clipper Chip encryption scheme a national standard and to discourage the development and sale of alternative powerful encryption technologies. If the government succeeds in this effort, the resulting blow to individual freedom and privacy could be immeasurable. So far, the government has resisted requests that it explain its policy. When the Presidential Decision Directive calling for Clipper deployment first appeared last spring, the Administration promised a report that re-evaluated cryptography and privacy policy in light of technological changes, the coming of the National Information Infrastructure, and the end of the Cold War. The Administration also made a commitment to meaningful public dialog before taking any major action on escrow deployment or new legislation. Yet in spite of the efforts of EFF, CPSR, ACLU, and other groups to provide extensive input to the Administration, the promised policy report never arrived, and the Administration has now said there will be no report after all. This failure of public accountability makes Congressional hearings an absolute necessity. There are individuals in Congress willing to look into the Clipper proposal and related policies--if they hear from you. Senator Patrick Leahy (D-Vermont), who chairs one of the key committees responsible for these issues, has asked for comments and concerns about the viability of the Clipper initiative. Here's where we need your help. *Please write Senator Leahy at leahy(a)eff.org and ask that the Senate hold hearings about Clipper.* Senate hearings may be the only means of ensuring public feedback about Clipper, and, just as important, they may be the only means of forcing the Administration to explain its Clipper policy. Please express your concerns about the United States' Clipper policy and cryptographic policy in general. Your letters in support of hearings will be printed out and delivered to the senator. And if you haven't written Rep. Maria Cantwell to show your support for H.R. 3627, her bill to relax export restrictions on encryption technology, now's the time to do so. Just send e-mail to cantwell(a)eff.org and put "I support H.R. 3627" in your Subject header. Letters in support of the bill will be printed out and delivered to Rep. Cantwell. Our fight to keep national encryption policy out in the open--and to continue allowing individuals to use encryption to ensure their own privacy--has only just begun. In the coming weeks and months, we will be working to give you more ways to make your voice heard on these vital public issues. Sincerely, Jerry Berman Executive Director Electronic Frontier Foundation

1 0

Re: AT&T stopped talking to me
by a2＠ah.com 17 Dec '03

17 Dec '03

I've had extensive experience with hardware vendors, and the behavior you describe is extreremely anomalous. It is just barely possible that your rep has quit, and his replacement hasn't picked up the slack yet. On just the basic problem of getting the data sheets, you might have better luck calling AT&T's literature department directly. This works very well if you have the part number of the data sheet, but just the part's id should get you the info. If the part is more than a few months past announcement, it's data sheet has probably been bound up with a whole lot of other data sheets and printed in some family book, which might be easier to ask for, and give you some alternates to consider. Or, you could ask some smiley friend ;+> to try to get the information for you. Buying the part shouldn't be as hard, they are required to sell to you. However, if you are experiencing politics, beware of such things as deliverly delays and a high percentage of bad parts in your shipment. Going through a distributor is probably enough to avoid most of these problems. So, when can I buy your gadget? -a2

1 0

NSA lobbying for Clipper in Europe
by baum＠newton.apple.com 17 Dec '03

17 Dec '03

from sci.crypt... The following article was printed on page 10 of the UK's `Independent on Sunday' (13th Feb 1994). It would seem that the tentacles are spreading. For those who haven't read it, James Bamford's book `The Puzzle Palace' contains a fascinating history of the incestuous relationship between the NSA and Britain's GCHQ. No official UK opposition can be expected. Follow-ups to talk.politics.crypto please. ---------------------------------------------------------------- How America Plans to bug the electronic age BIG BROTHER JOINS SCRAMBLE FOR DATA By Leonard Doyle A high-ranking official of the National Security Agency, America's largest and most secretive intelligence arm, is in London with the task of selling the 16 governments of the European Union and European Free Trade Association on the virtues of a controversial electronic scrambling technology. The Clinton administration hopes that the encryption devices will become the global standard for anyone wanting privacy while using cellular phones, computer networks and fax transmissions. They have a serious drawback for anyone looking for total privacy, however. The devices have a built-in `back-door' that will allow spy agencies to listen in on all communications, or read faxes and electronic mail. Spy agencies in the US and Europe, with nearly 50 years' experience of advanced technology in surveillance of citizens, suspected criminals and foreign governments, have been concerned for some time about developments that have put sophisticated encryption devices within reach of many. The agencies want to ensure that they are not left behind by the rapid advances in high technology which have made telephone scramblers and the mathematical codes used to encrypt computer and fax data relatively cheap and easy to use. The governments fear that electronic eavesdropping will be set back decades if and when terrorists, money-launderers, drug traffickers and unfriendly governments gain widespread access to the technology. The NSA is concerned that, despite the $30bn (UK Pounds 21bn) a year it spends monitoring global communications, it cannot keep pace with technological change and the massive spread of encryption codes. The NSA official, James Hearn, who until recently was the deputy director for information security at NSA's sprawling headquarters near Washington DC, is heading up a `liaison office' in London with a colleague, Clint Brooks, according to reliable sources in the computer security community on both sides of the Atlantic. The US Embassy in London issued a pro forma denial about Hearn's presence yesterday, saying: "There's nobody by that name here." Mr Hearn is well known, however, to UK and European officials at the cutting edge of efforts to control the spread of highly sophisticated scrambling devices. These encryption codes, developed by private software companies, are putting communication beyond easy reach of the NSA, Britain's GCHQ at Cheltenham and France's DGSE, to name but a few `Big Ear' agencies. As a response, the US has developed an encoding device for telephones and computers known as the `Clipper Chip', with a `back door' that will allow spy agencies armed with special electronic keys to eavesdrop. When the Clinton administration decided to press ahead with the controversial coding devices last week, the computer industry and privacy campaigners reacted with outrage. "It's like trying to order people to use only resealable envelopes for correspondence, so that no communication can ever be private again," said David Bannisar of Computer Professionals for Social Responsibility. Big computer companies, including IBM and Apple, are bitterly opposed to the new monitoring devices. But AT&T, the US telephone company, which is fast establishing itself in Europe, will put the eavesdropping technology into the telephone scrambling devices it sells in high street shops for about UK Pounds 800 each. The US is keen to ensure that similar electronic monitoring technology becomes standard in the rest of the industrialised world. The NSA's Mr Hearn has the task of persuading governments that the controversial Clipper Chip for telephones and a technology called Tessera, for computer modems, is quickly adopted, despite mounting opposition. The US, European Commission and four European Union countries - Britain, Germany, France and the Netherlands - are already deciding how to administer the dawning electronic age of `information highways' which will bring an explosion in the use of hi-tech in everyday lives. A consultant to the European Commission who has worked on the new encryption standards claims that those who object to US efforts to regulate the market for encryption are `politically naive'. "Whether we like it or not, the authorities will want to listen in on our communications," he said. "The Americans are to be admired for being up front about it, when other countries are doing the same thing anyway." Experts in the field of information security often speak of physical boundaries that now define the world being replaced by electronic boundaries. In this Orwellian world, which is at most five years away, people will be issued with so-called `smartcards' with microchips that can store their entire personal history. The identity cards will be a passport for ordinary citizens, used to store health records, for personal banking, paying for travel and for identity checks at borders. In the same way, companies and even countries will be expected to use technology like the encryption Clipper Chip for date transmissions. "We are defining our new electronic world - which will become increasingly important in a borderless Europe," the EU security consultant said. ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, 20525 Mariani Ave, MS 305-3B * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

1 0

Ameritech announcement
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ameritech first in nation to detail plans to open local network Ameritech has become the first communications company in the nation to volunteer to open its local network to competitors. Ameritech today submitted tariffs to the Illinois Commerce Commission (ICC) that specify how it will open its local network to competitors in Illinois communities where it is the primary telephone company. If approved, the tariffs will go into effect when Ameritech is authorized to enter the long distance business. "We believe that our customers want and deserve the choices that only all-out communications competition can deliver," said Dick Brown, Ameritech vice chairman. "No court ordered us to do this. No regulators mandated that it must be done. Ameritech initiated the idea as a way to better serve our customers and we now have delivered a detailed blueprint for getting the job done." When the changes that Ameritech has proposed are implemented, a competitor, subject to regulatory approval, can use portions of the Ameritech network to provide local telephone service. Thus, the competing company on its own can provide all of the capabilities necessary to offer local communications services, or it can obtain from Ameritech the capabilities that are needed but which it chooses not to provide itself. "The positive regulatory environment in Illinois favorably positions this state and its citizens to lead the way on the information superhighway and to be among the first to reap the economic benefits of communications competition," said Doug Whitley, president of Ameritech Illinois. Specifically, Ameritech's Illinois Commerce Commission (ICC) filing proposes procedures, technical specifications and prices. It describes how competitors can: - - Obtain access to Ameritech's local distribution network in Illinois (the local loop) so that they can use the Ameritech links to reach customers' homes or offices. - - Purchase from Ameritech the local switching capability. - - Integrate their local switches and networks with the Ameritech network. The Ameritech filing also provides details of a process under which an Ameritech customer in Illinois can choose to have a single company handle local and long distance calls. Ameritech's quid pro quo for fully opening its local network to competitors is straightforward: Ameritech wants new regulations geared to a competitive marketplace and the freedom to provide long-distance services. When Ameritech's plan to fully open the local network to competitors is implemented, all-out competition, market-driven prices and accelerated innovation will shape communications marketplaces in the portions of Illinois the company serves. "Ameritech should be a full participant in the new communications world that is emerging. We want the flexibility to serve its customers as they want to be served," said Brown. "As customers' needs become more sophisticated and voice, data and video industries converge, opening access to all networks is necessary for a fully competitive communications marketplace." "The same rules should apply to all players -- providers of voice, video and data; long distance or local service," he said. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLWJ0FtCcBnAsu2t1AQF3EAQAhqNcBIwBF1p8IxqwBWm/ZFui7KR8VWV9 bm1d6531kXoXt6wA7qaKqnZ8KvAfjCKxmEgBQ3OFCB9jYkyBB6/DRByNyb/agldS trTdUn48LZgsm4IP2Kr1O0Ds2J17droUS7bljNhrohjtCIoVY1UU8sOoefxMqlKG DRxjEEmCT58= =IMpJ -----END PGP SIGNATURE-----

1 0

New Crypto product & other ramblings
by baum＠newton.apple.com 17 Dec '03

17 Dec '03

I think the only way to prevent Clipper is pre-emptively. The advantages of Clipper are twofold: Gov't volumes may drive the price down The Algorithm is fast, and the silicon required to implement it is small. Modular arithmetic is (belief here, not fact) bigger, slower, and more expensive. There is enough knowledge, experience, and money on this mailing list to design an encryption chip to compete against Clipper. It would be better if we could just buy them- maybe that will happen. SGS-Thompson has just announced a smart-card chip with Modular Arithmetic Processor (ST16CF54) developed by an Israeli company, Fortress U&T Ltd. It's optimized for 256 and 512bit exponentiations, but can handle 1024 bit. It sounds like this is just for public key signature verification- it can't encrypt or decrypt at high speeds. Anyone know more about this product? (ref. EEtimes 2/14/94 pg 20) ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, 20525 Mariani Ave, MS 305-3B * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

1 0

Re: Clipper and Traffic Analysis
by smb＠research.att.com 17 Dec '03

17 Dec '03

Speaking of phone records and such, btw, AT&T keeps phone records for quite a long time. About half a year or so my girlfriend visited her relatives in Hong Kong and I called her there to save them some major money. A few months ago, I get a letter/offer from AT&T saying that I could save over xxx% on calls to HK, Taiwan, etc... Now, I'm a white boy and my name would give them absolutely no hint of having relatives or friends in Hong Kong. Obviously they keep records for waaaay far back, and keep them in use!!! If they use'em for advertising, you can bet they use them for other shady "law-enforcement" type info for cops, etc.... That's a fairly strange conclusion to draw. In fact, I was originally going to use a much stronger word than ``strange'', but I forbore to change my standing policy against flames. Why, pray tell, do you think that because AT&T uses its own information, that it gives it to the government? For one thing, that would be illegal, as I read the law. 18 USC 2703(c)(1)(A) specifically prohibits giving out records of subscriber information to government agencies, except in reponse to a subpoena, warrant, or court order. (Oddly enough, it is permissible to give out the information to non-government agencies; if I recall correctly what I've read of the legislative history of the act, that was specifically intended to permit compilation and sale of mailing lists and marketing data.) For another, it isn't at all clear to me that it's in any way unethical for a company to understand which of its products its customers buy. *Selling* such data is another matter -- I don't like that at all -- but that isn't what you're claiming. You also say that AT&T is not using racial data or certain names to pick out markets. All you're saying is that you once called Hong Kong, and that AT&T is now offering you a cheaper way to do so. What's wrong with that? (Btw -- half a year is not at all a long time. That's only very slightly longer than they'd need to keep the data just to resolve billing questions.) --Steve Bellovin Disclaimer: Obviously, I work for AT&T. That doesn't mean I like everything the company does -- but in this case, I fail to see the offense.

1 0

No Subject
by solovay＠math.berkeley.edu 17 Dec '03

17 Dec '03

Eric writes: Yeah, the internet technology is changing. ATM is coming. Query: What's ATM? --Bob Solovay

4 3

Re: Misc replies
by qwerty＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Greg Broiles wrote, >I second Hal's suggestion to route Detweiler's traffic through Xenon's >remailer. >(Xenon - the point isn't to keep Detweiler off the net. We all know >that's impossible. The point is to keep Detweiler from getting remailers >shut down by abusing them. That's why this is particularly unlike >censorship; Detweiler's goal is to keep all people from using remailers.) Sure, send me YOUR garbage. Why isn't Larry abusing MY remailer? This peer pressure is childish. I no longer really need qwerty as a remailer, and will happily shut it down as soon as YOU people start abusing it. I admit I created a lot of negative feelings out there with my statement that I didn't want to block Larry's addresses. However, say I retract that statement, and say I do not want to block him, but that I AM willing to give into such peer pressure and try TO block him? I now ask you to, with compassion, educate me about how the arguments I express against the MEANS you tell me to use, are not valid. I don't mind blocking the address of some undergrad who is sending silly stuff to Usenet, but must I always have to demonstrate to you things that I cannot seem to convey in words? OK. I shall write a script to telnet to port 25 of a given remailer, and forge mail from various non-existent addresses at Netcom. They will include names like "S.Boxx(a)netcom.com", "Executioner(a)netcom.com", and "Fuckyou(a)netcom.com". What will you do then, block incoming from netcom.com? Yeah right ;-) ! I sent myself mail this way via Hal's remailer. It WORKED. Larry knew how to do this when I was still trying to work my newsreader. Again, as I have said before, it is my feeling that all of our trying to block Larry's current known addresses will only fuel the fire, and next time he will REALLY cause problems. He isn't a stupid guy. And he IS the type of person who if you fight him, he will fight back with more energy than before. So far I am not impressed with the level of sophistication in the words I hear coming from the remailer operators and other interested parties out here. We need an ABUSE filter, not a Detweiler filter, for with current sendmail, we CANNOT block a determined person from abusing the remailers. And it is my belief that trying to do so will renew their fanaticism and dedication to upsetting the remailers. He already seems to have a new anon.penet.fi address. He can have as many more as he wants, brand spanking new, by telnetting to anon.penet.fi 25 and faking his address. I have tried this and it too WORKS. Give me a real solution, one that will not make the problem WORSE. Many of you out here remind me of government bureaucrats, in how you want to try quick very short term fixes, which in the end only backfire and make the problems worse. You think Larry isn't willing to fork over $20 to get a Netcom account and then spend another $50 to buy e-postage, then send out much MORE damning abuses (since you made it harder for him to do damage by quantity alone), this time

1 0

Re: Misc replies
by qwerty＠netcom.com 17 Dec '03

17 Dec '03

I'll try this again; Netcom has this nasty habit of just dying for 10 minutes at a time right in the middle of my pasting e-mail. -----BEGIN PGP SIGNED MESSAGE----- Greg Broiles wrote, >I second Hal's suggestion to route Detweiler's traffic through Xenon's >remailer. >(Xenon - the point isn't to keep Detweiler off the net. We all know >that's impossible. The point is to keep Detweiler from getting remailers >shut down by abusing them. That's why this is particularly unlike >censorship; Detweiler's goal is to keep all people from using remailers.) Sure, send me YOUR garbage. Why isn't Larry abusing MY remailer? This peer pressure is childish. I no longer really need qwerty as a remailer, and will happily shut it down as soon as YOU people start abusing it. I admit I created a lot of negative feelings out there with my statement that I didn't want to block Larry's addresses. However, say I retract that statement, and say I do not want to block him, but that I AM willing to give into such peer pressure and try TO block him? I now ask you to, with compassion, educate me about how the arguments I express against the MEANS you tell me to use, are not valid. I don't mind blocking the address of some undergrad who is sending silly stuff to Usenet, but must I always have to demonstrate to you things that I cannot seem to convey in words? OK. I shall write a script to telnet to port 25 of a given remailer, and forge mail from various non-existent addresses at Netcom. They will include names like "S.Boxx(a)netcom.com", "Executioner(a)netcom.com", and "Fuckyou(a)netcom.com". What will you do then, block incoming from netcom.com? Yeah right ;-) ! I sent myself mail this way via Hal's remailer. It WORKED. Larry knew how to do this when I was still trying to work my newsreader. Again, as I have said before, it is my feeling that all of our trying to block Larry's current known addresses will only fuel the fire, and next time he will REALLY cause problems. He isn't a stupid guy. And he IS the type of person who if you fight him, he will fight back with more energy than before. So far I am not impressed with the level of sophistication in the words I hear coming from the remailer operators and other interested parties out here. We need an ABUSE filter, not a Detweiler filter, for with current sendmail, we CANNOT block a determined person from abusing the remailers. And it is my belief that trying to do so will renew their fanaticism and dedication to upsetting the remailers. He already seems to have a new anon.penet.fi address. He can have as many more as he wants, brand spanking new, by telnetting to anon.penet.fi 25 and faking his address. I have tried this and it too WORKS. Give me a real solution, one that will not make the problem WORSE. Many of you out here remind me of government bureaucrats, in how you want to try quick very short term fixes, which in the end only backfire and make the problems worse. You think Larry isn't willing to fork over $20 to get a Netcom account and then spend another $50 to buy e-postage, then send out much MORE damning abuses (since you made it harder for him to do damage by quantity alone), this time with real religious zeal, since now he has gotten you guys to finally fight back, and as you must realize, he takes this all VERY seriously. And after all, isn't our installing ABUSE filters what Larry is trying to tell us to do in the first place? I do not find this an unreasonable request. It is a wonderful solution that avoids accountability problems, after the fact, upon someone posting an abusive message to Usenet, since they are unable to post such an abuse in the first place. Why don't we appease Larry? How? The answer is painful and obvious: Moderated remailers. You already have to trust the remailer operator with your privacy. E-postage is a fun idea especially for ME ;-), but the logistics and loss of traffic are real problems. Besides, I can't charge as much for a Netcom remailer, as it is not as secure as some others. Is it not unfortunate that an AI program cannot ever hope to accomplish what the human eye and brain can do in a millisecond? Hit a 'd' key in responses to abusive mail. Send me such a script! Until Usenet is fully moderated, and realize that MOST people on Usenet do NOT feel like pandering to "those cowards and irresponsible people afraid to use their real names". THAT is the attitude out there. There must be moderation, if only for remailing to Usenet. Since such moderation is unlikely in the next year, for all of Usenet, the moderation must lie within the remailers. Yes, anon.penet.fi has survived without this, but Julf keeps people's REAL addresses on his hard disk, and keeps FULL logs (not content though). Still, it is possible for Larry to send out a hundred Usenet posts, by forging e-mail to anon.penet.fi. Fortunately for Julf, he is busy enough upsetting us. If full moderation not be practical, then fairly smart scripts for detecting abuse could do SOME good. Certainly a barrage of posts to Usenet could be detected and blocked. But that only causes someone to post more damaging posts in fewer numbers. "I am afraid of knowing the truth, for when you offer it to people, they call you mad." -=Xenon=- -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLWI1bASzG6zrQn1RAQHPEwP/Wf/jCuEV6sE9vs89NvC25T1ejBrr6nxq +65zorNvaSpaTYJraH5kD7NHSerXX5XlNKllG10RoqwnpjwQ56FCsVQzqDrkYH+9 DXk5VP2ay0B0DFIRxgTGXhl4fXi6K6bjiS4dRi4AxvnOeZaGlzTQMu1CGJJZ1pNk Cv+P0X/rYcw= =tO7R -----END PGP SIGNATURE-----

1 0