December 2003 - cypherpunks-legacy

AT&T Encryption Product
by Bill Stewart 17 Dec '03

17 Dec '03

NCR - An AT&T Company ____________________________________INTRA CORPORATION From: Bill Stewart <bill.stewart(a)pleasantonca.ncr.com> Location: Pleasanton District To: cypherpunks(a)toad.com Location: The Real World,or at least Cyberspace Subject: AT&T Encryption Product Well, it was interesting to see Philippe Nave's posting about an AT&T encryption software product (using the government's digital signature and secure hash standards instead of RSA and MD-5, so it won't be PGP- or PEM-compatible). Prices seemed a bit high, though not bad for AT&T, who are cutting some new market turf as well as typically pricey, and the encrypted Zmodem software may be useful. Does anybody know if there are any other SHA / government-signature products out? (I'm assuming there won't be much freeware because of the patent issue; people who don't mind violating RSA's patent generally use PGP.) Bill

2 1

Newsgroups, Sternlight-bashing and screaming children
by Bill Stewart 17 Dec '03

17 Dec '03

NCR - An AT&T Company ____________________________________INTRA CORPORATION From: Bill Stewart <bill.stewart(a)pleasantonca.ncr.com> Location: Pleasanton District To: cypherpunks(a)toad.com Location: cyberspace Subject: Newsgroups, Sternlight-bashing and screaming children I consider the Sternlight-bashing suggestions to be unreasonable; Sternlight may rave from a warped, pro-government viewpoint, but he is capable of carrying on civilized conversations, even when he's (continually) grinding the same axe. The coffee-house analogy is a very good one, and there *is* occasionally a screaming-children problem on usenet; I assumed the original poster was referring more to the perpetual-newbie types rather than to the newly arrived, chronologically-deficient college students, most of whom are either quiet, productive, or both (though a college student and the author apparently felt otherwise :-) I still prefer having this as a mailing list, in spite of the volume; I can read sci.crypt when I want to, though I'll probably have to get a netcom account rather than keep telnetting into my old system now that I've moved. Thanks; Bill

1 0

rant pointer
by Eli Brandt 17 Dec '03

17 Dec '03

L. Detweiler has a rather hefty essay in the latest Risks on the subject of `pseudospoofing', social parasites, "a criminal group called the CryptoAnarchists" (with members such as "Eric May" and "T.C. Hughes"), and such matters. I will not forward it to the list, unh unh, no way. PGP 2 key by finger or e-mail Eli ebrandt(a)jarthur.claremont.edu

3 3

P. Metzger
by L. Detweiler 17 Dec '03

17 Dec '03

Assuming you are not P. Metzger, please help him to understand how to implement a kill file rather than assaulting me with mailbombs. ===cut=here=== [insert minimailbomb here]

1 0

The Depravities of Cypherpunks
by L. Detweiler 17 Dec '03

17 Dec '03

I did not understand Mr. Metzger at first. When he sent me messages in the form `go away and leave us alone' I thought he was suggesting I be censored from the cypherpunks mailing list. Apparently he is only objecting to personal email from me. Well, after receiving 40 messages with the concatenated contents of other messages from him and myself over the matter, in response to the following two, I certainly will not do so. Mr. Metzger did say it was OK for me to post to the Cypherpunks list, for which I wish to express my heartfelt gratitude in his allowing me his permission. He threatened to send me 400 letters the next time I sent him personal mail however, and of course he is certainly capable of it. I mailed postmaster(a)lehman.com, asking him to encourage Mr. Metzger to learn how to use a kill file instead of sending me mailbombs in response to his obvious intense mental anguish at seeing my name <g>, but unfortunately Mr. Metzger is the postmaster at his site. Mr. Hughes is quite perplexed at my sheer rage at Mr. Metzger's unsurpassed childishness. He didn't approve of me attempting to shame Mr. Metzger (a close personal friend, I suppose) into refraining from sending me mailbombs and dealing with his own insanity in a more proactive manner -- like figuring out how to implement a kill file in his mail -- by informing the cypherpunk world of his puerile prank. I told Mr. Hughes that it was likely that Mr. Metzger was his own site administrator (I was not positive at this point, alas). Mr. Hughes has not responded to that letter. Mr. Hughes is also quite puzzled why I should violate Mr. Metzger's privacy in revealing his `private' mailbomb to other members of the community he (supposedly) resides in. I guess he believes that mailbombs, like everything else, are a private matter. My apologies, Mr. Hughes, for what you consider an inappropriate use of your mailing list. My personal opinion is that I had essentially no other recourse, and even the `recourse' I chose was obviously ineffective! I asked Mr. Hughes to condemn Mr. Metzger's behavior. So far his only comment is that it was `rude'. Maybe he will have another opinion upon learning of Mr. Metzgers 40 letter bomb just received, or his 400 letter threat. Or maybe he thinks that Mr. Metzger is just another patriotic cypherpunk, perhaps even deserving of a medal! Also, I have mail from Mr. Jason Zions (jazz(a)hal.com) also complaining that I violated Mr. Metzger's privacy in revealing his mailbomb to me to the list as a whole. This strange code of cypherpunk chivalry I am not familar with. I am quite bewildered! Perhaps someone can point me to an FTP site housing the Cypherpunk Code of Chivalry. I looked on soda.berkeley.com and found the Cypherpunk Charter (By E.Hughes) talking a lot about things like privacy and software, but it didn't really seem to address the issue of mailbombing. Maybe the basic idea is just privacy *everywhere*, even with cyberspacial assault and societal criminals. I guess I did miss the point. If all the other cypherpunks condone or applaud Mr. Metzger's behavior, please let me know. I'm not really sure what the consensus is on this. (Of course, here, no one can really be sure of the consensus on *anything*! <g>) I certainly haven't heard from anyone I respect yet, assuming these people are still on the list. BTW -- I do get the impression that the list membership is down. Perhaps Mr. Hughes can reveal that directly. Some people have been blaming me for the `deterioration of the list' lately. Another person told me that the list had `quite improved since I stopped posting'. I'm not sure what to make of all this -- unless both were tentacles, I suppose that might explain it all. Frankly, I have been posting very little lately compared to my Golden Cypherpunk Days. (ah, the carefree and naive life of youth.) Also, Mr. Hughes has always advocated software solutions like kill files, and if anyone objects to my presence, please put me in yours. It is silly to continually be offended by me! The people who are interested in listening will not plonk me, and those that are inflamed by my postings *will* -- what could be simpler? That certainly couldn't be a problem for anyone, could it? I mean, if what I am saying has no merit, people will immediately recognize that, right? To paraphrase somebody else, `There is only a message'. * * * P.M., after the 40 letter mailbomb >If you insist on 400 detweiler, I'll send them to you. Last warning. Mr. Metzger, I assure you an apocalypse in cyberspace will happen before I will ever send a message to the address pmetzger(a)lehman.com. In fact, perhaps you could tell me all your other addresses, so I do not inadvertently send mail to them. For example, I had a glimmer of hope that postmaster(a)lehman.com was not you, and paid dearly for it with your 40 letter mailbomb. Mr. Metzger, Do you pseudospoof? This could be a problem. What if I inadvertently send something to one of your tentacles? Does that count? Will you mailbomb me in that case, or just forgive me for my stark ignorance? I have to ask a favor, if you don't--perhaps you could give me a list of all the addresses you post from. I mean, that would compromise the pseudoanonymous security of your identities, but on the other hand I have absolutely no desire to be subject to another explosion in my mailbox when I open my mail! I guess in this case, you might have to decide which is worth more, your hatred for me and insane desire that you not see any communication from me in any form, or your passionate goal of further undetected, secret pseudospoofing. You have to forgive me for my instinct of replying to the letters in my mailbox. It has served me well until now. I assure you I will now make an exception in your case! For example, my response to your last letterbomb threat might have been `please don't do it!' but I now realize that would have gotten me `nowhere' (or wherever it is that bomb victims go) thanks to the previous two mailbombs! Thanks for the valuable education in cyberspacial netiquette! (All my habits and perceptions in cyberspace have been radically altered lately in response to changing circumstances, and your mailbombing is just the latest incarnation, so I certainly shouldn't be complaining!) HOWEVER -- I will continue to post to the cypherpunks list, since you, Mr. Metzger, have so kindly given me permission and I am still not being censored yet. Please, please, please Mr. Metzger, do not interpret this as sending you private mail! I certainly have NO DESIRE WHATSOEVER to be subject to your 400 LETTER MAILBOMB. Perhaps some other cypherpunks, who have no objections to your behavior so far, and criticize me for taking a stand by condemning it publicly, would like to VOLUNTEER IN MY PLACE. So, here is what bought me the 40 letter mailbomb: ===cut=here===

1 0

L. Detweiler's latest rant on comp.risks
by hughes＠ah.com 17 Dec '03

17 Dec '03

I would suggest that everyone with any interest at all in the latest L. Detweiler rant, which appears on comp.risks, to send a short message to RISKS attesting to the separate existence of the following individuals, as listed by LD at the end: >I thank the following eminent Cypherpunks for ideas in this article, >although it should not be construed to be representative of their >opinions, and neither can I provide any guarantee they represent >unique people: >G.Broiles, A.Chandler, J.Dinkelacker, H.Finney, E.Hughes, M.Landry, >T.C.May, N.Szabo In particular, I'd like to see short messages from each of the above people to RISKS attesting to their own individuality. Also, if LD has accused you in public or private of not existing, please send a message stating this. The address is risks(a)csl.sri.com Keep your comments short and polite, and mention "L. Detweiler" in each of them. We need everyone who has been involved to send a message. Please speak out. Thanks. Eric

1 0

Waving the White Flag
by L. Detweiler 17 Dec '03

17 Dec '03

Gosh, it has been very unpleasant lately. I have never been subject to mailbombs, and my postmaster has never been harassed over my postings anywhere (by an Eminent Cypherpunk Leader, no less), before yesterday and today. Yes, I really thank all the cypherpunks for their valuable lessons on the internet and cyberspace. Now we really *can* believe that pseudospoofing inherently promotes a sense of community trust and harmony! All this time, and all the rancor on the list, all our stellar successes in media penetration and identity-subversion protocols can be chalked up to the Joy of Pseudospoofing. I really am grateful for you all in showing me your vision of cyberspace, and how it is superior to all those Orwellian and `Dossier Society' schemes that involve those oppressive identification protocols. shew. Anyway, this letter is an attempt to find a topic that someone will not flame me about, and is relevant to the cypherpunk list as I understand it! Phiber Optik -- I have been watching the trial of Mark Abene, aka Phiber Optik, closely, and I think I even fowarded articles on it to the cypherpunks once. This is a very fascinating trial. We learn, for example, of the first use of wiretaps for digital data (modem communications) for a successful prosecution. Also, we learned about how LOD (Legion of Doom) -- or was it MOD, Masters of Deception, I get all these criminal organizations mixed up! -- infiltrated phone systems. I think I even heard in one news report that some in the group performed illicit wiretaps. I find this *fascinating*. Can anyone elaborate to me the wiretapping that was going on? who did they wiretap? how did they do it? how did they avoid detection? more importantly, have the phone systems been upgraded or modified to be protected from this kind of extremely insidious crime? I read in `Cyberpunk' by K.Hafner and J.Markoff (the latter my favorite cyberspatial writer) that K. Mitnick in California also had this capability of wiretapping, and used it in an extremely sophisticated way. Apparently he actually tapped the lines of police stations and knew when they were coming, or knew when they had detected or `sniffed' his own illegal wiretapping. Did this happen? or is all of this rumor? I remember Phiber Optik posting to *this list* on the subject of phone wiretapping. I think he might have been a bit too knowledgeable for his own good, eh? What ever happened to K. Mitnick, anyway? He did serve federal time, I know that. I remember reading that story and thinking -- here is someone we should keep our eyes on, even after he is out of prison, *especially* when he is out! Conspiracy Charges -- Another question. I understand that Mr. Abene was charged with `conspiracy' or at least that was one of the charges involved in the whole affair, perhaps against others. My question: what is the legal criterion for a `conspiracy'? what are the penalties? did Abene actually get successfully prosecuted for `conspiring'? what was the conspiracy? Did it have anything to do with the wiretapping?what are famous conspiracy cases? I'm sure that some cypherpunks may be knowledgeable on these subjects. I sincerely hope I haven't offended anyone in asking. Mr. Finney posted some outstanding analyses of the ITAR (which I subsequently incorporated into a RISKS article), for example, so there is definitely some strong legal background here. please cc: your replies to me or I may not see them.

1 0

Re: Should we oppose the Data Superhighway/NII?
by doug＠netcom.com 17 Dec '03

17 Dec '03

Mike Godwin <mnemonic(a)eff.org> said: >Perry writes: >> Seems to me that bandwidth is >> going to be nearly free in both directions in a few years whether >> government intervenes or not. > >I agree about the potential for it to be free, but, I gotta tell you, the >monopolists running the cable systems in this country have no inclination >to share that nearly free bandwidth with you, even if you're willing to >pay for access to it. I hate to disagree, considering that I prefer to agree with the philosophy here, but it *can't* work that way, regardless of what we wish. The problem is that bandwidth is a highly limited resource, just like real estate is a limited resource. Eventually we will complete saturate network bandwidth no matter what technology is used. This has been discussed in various forums for many years. Once optical fiber optic bandwidth peaks, you have to move to ultraviolet for greater channel capacity. Then that is exhausted, and we will continue pushing...gamma ray bandwidth fiber optic (or line of sight transmission) will eventually be a target, despite its extreme difficulties even in theory. At the same time we will be laying fiber and raising dishes to beat the band. But no matter how well all that goes, we will *very* quickly reach a saturation point of facilities as each new technology is introduced. These days it's easy to be optimistic, because bandwidth is growing geometrically. The problem is that there is no way in hell that that trend can continue indefinitely. One or two decades hence we will saturate theoretical limits. Bandwidth is and will always remain a scarce and precious resource. On the other hand, if you mean "slow channels by comparison with state of the art channels," then yeah, *that* may as well be free at any given point. Right this instant one could make an argument for 110 baud channels being free. >In order to get to a world in which free markets can meet our demand for >high-bandwidth connectivity, we have to dig ourselves out from the >market-failure position we're in now. And because government is part of >the problem, changing government policy is part of the solution. So, >that's one of the major thrusts of EFF's NII policy. I agree, but this seems to be a subject change. Doug

4 4

A short response to L. Detweiler: 'I exist as myself.'
by hughes＠ah.com 17 Dec '03

17 Dec '03

L. Detweiler's recent article on the RISKS of confusing an online identity with a potentially knowable physical one are quite interesting, if hypothetical. I would be interested in hearing of situations where this practice has actually occurred. If any RISKS members know of any such incidents from first-hand experience, please share them with the readership. Unfortunately, I think he really believes that the cypherpunks mailing list has been dominated by a small cabal who have been using multiple identities who talk with each other on the list in order to enforce concensus and to suppress disagreeing positions, namely his. It just ain't so. Therefore, to set the record straight I feel I ought to make the following public statement: I, Eric Hughes, have never posted or communicated in any name other than my own. I can personally testify that I am not the same as any of the other people listed at the end of L. Detweiler's post, and I can testify from personal experience that Arthur Chandler, Hal Finney, Tim C. May, and Nick Szabo are all different people. I also decline to answer, point by point, the numerous defamatory innuendos made by L. Detweiler against the members of the cypherpunks mailing list. Might I also observe that none of the statements are specific enough to actually count as accusation, but merely as general slander? Eric

1 0

On my recent Bcc: to cypherpunks
by hughes＠ah.com 17 Dec '03

17 Dec '03

I just forwarded my own contribution to the RISKS digest. Please, do not reply to the risks(a)csl.sri.com address unless you are submitting something for publication! I realized too lat what a blind carbon copy would do to repliers on the mailing list. Aack. Eric

1 0

Re: Personality BS (was: Should we oppose the Data Superhighway/NII?)
by doug＠netcom.com 17 Dec '03

17 Dec '03

arromdee(a)blaze.cs.jhu.edu said: >One problem is that if you just sit around and discuss everyone's impressions >of the candidate, you've probably got some people who automatically get >negative impressions of all candidates who are black, or Asian, or Jewish, or >gay, or in the wrong political party. True. And even aside from extreme examples like that, it is notoriously hard to judge such things, even given people who are reasonable and operating on the basis of good will. On the flip side, ideally one would not have hired bigots in the first place, so there wouldn't be such people making such judgements. (I haven't stopped to do a head count, but as a white male I may actually be in the minority in my group. Our V.P. is female and Jewish, as one example of that. We're probably atypical. ;-) And lastly, every method of interviewing anyone has ever conceived of has its bad side. Nothing's perfect. Therefore this particular interchange of ours is really merely a digression. Doug

1 0

Meeting Saturday 13 Nov 93
by hughes＠ah.com 17 Dec '03

17 Dec '03

Bay Area Cypherpunks Meeting Date: Saturday, 13 Nov 93, the second Saturday of the month as always Time: 12:00 noon - 6:00 p.m. Where: Cygnus Support Offices, Mt. View, CA This month we have planned so far the following: -- Scott Collins on the Newton. Scott is bringing some fellow Apple folk down to talk about the development environment. Since the Newton might be a good platform for a private key holder, we'll examine it. -- The new Schneier book has just hit the bookstores. I just got a copy and will be talking about it. -- The usual announcements and topics from the floor. Eric [Directions to Cygnus provided by John Gilmore. -- EH] Cygnus Support 1937 Landings Drive Mt. View, CA 94043 +1 415 903 1400 switchboard +1 415 903 1418 John Gilmore Take US 101 toward Mt. View. From San Francisco, it's about a 40-minute drive. Get off at the Rengstorff Ave/Amphitheatre Parkway exit. If you were heading south on 101, you curve around to the right, cross over the freeway, and get to a stoplight. If you were heading north on 101, you just come right off the exit to the stoplight. The light is the intersection of Amphitheatre and Charleston Rd. Take a right on Charleston; there's a right-turn-only lane. Follow Charleston for a short distance. You'll pass the Metaphor/Kaleida buildings on the right. At a clump of palm trees and a "Landmark Deli" sign, take a right into Landings Drive. At the end of the road, turn left into the complex with the big concrete "Landmark" sign. Follow the road past the deli til you are in front of the clock tower that rises out of one of the buildings, facing you. Enter through the doors immediately under the clock tower. They'll be open between noon and 1PM at least. (See below if you're late.) Once inside, take the stairs up, immediately to your right. At the top of the stairs, turn right past the treetops, and we'll be in 1937 on your left. The door is marked "Cygnus". If you are late and the door under the clock tower is locked, you can walk to the deli (which will be around the building on your left, as you face the door). Go through the gate in the fence to the right of the deli, and into the back lawns between the complex and the farm behind it. Walk forward and right around the buildings until you see a satellite dish in the lawn. Go up the stairs next to the dish, which are the back stairs into the Cygnus office space. We'll prop the door (or you can bang on it if we forget). Or, you can find the guard who's wandering around the complex, who knows there's a meeting happening and will let you in. They can be beeped at 965 5250, though you'll have trouble finding a phone. Don't forget to eat first, or bring food at noon! I recommend hitting the burrito place on Rengstorff (La Costen~a) at about 11:45. To get there, when you get off 101, take Rengstorff (toward the hills) rather than Amphitheatre (toward the bay). Follow it about ten blocks until the major intersection at Middlefield Road. La Costen~a is the store on your left at the corner. You can turn left into the narrow lane behind the store, which leads to a parking lot, and enter by the front door, which faces the intersection. To get to the meeting from there, just retrace your route on Rengstorff, go straight over the freeway, and turn right at the stoplight onto Charleston; see above. See you there! John Gilmore

1 0

the Tragedies of Pseudospoofing
by L. Detweiler 17 Dec '03

17 Dec '03

I wrote another essay, `the Joy of Pseudospoofing', which I have been refining and evolving, and will be glad to email it to anyone who is interested. For now, I would like to address briefly the issue, `The Tragedies of Pseudospoofing.' Knowledge & Friendship -- Consider the basis of friendship. In many ways, knowledge is friendship. The more you know about someone, the closer you feel. And in fact if you don't know certain things, about someone you consider a close friend, you might be surprised or upset. `I never knew that! why didn't you tell me?' or `you've been holding out on me! I'm upset!' Also, many of our metaphors about friendship involve its basis in knowledge, like thses. The whole idea of sharing knowledge is inherent to the idea of trust that is so critical in true friendship. We trust our friends not to betray us with sensitive information about ourselves to our enemies. There are plenty of classic situations about this. One really hilarious example, I recall, is that told in one Seinfeld story, where Jerry (is that right?), in the middle of some `hot and heavy' activity <g> tries to talk dirty to a girlfriend that was Elayne's (his close personal friend) secretary. It backfires, the girlfriend/secretary is incredibly upset and offended. Jerry, in total desperation, as a last ditch effort, says, `now, of course, beyond everything else, this is just between you and me.' The girlfriend storms out the room. Later, Jerry hears that Elayne promoted the secretary, or the secretary was leaving her office. He drops all kinds of hints. `Was that *all* she said?' He didn't want to be embarrassed by a frivolous girlfriend in front of his true friend. Elayne shows no sign that she heard of anything embarassing. But, later after she was walking out the door, she snidely quotes the exact lines of Jerry's backfired dirty talk! Jerry was betrayed by *both* the girlfriend and Elayne. And Elayne in an extremely callously, manipulative way! She dangled the knowledge above him, like someone teases and tortures an animal. So, the point of all this is that `information control' is one of the most crucial aspects of friendship. Pseudospoofing & Friendship -- Now, consider the ingredient of pseudospoofing, and how it completely destroys all this trust. First, suppose that no one knows I am posting under Jim Riverman. They would be really aghast to find out later, even if everything said under Jim Riverman was wholly respectable (or perhaps, especially in that case!). That is part of friendship: exploring all the nooks and crannies of each other's personalities. Its because of friendship that people say, `I want to get to *know* you' or `you think you *know* someone...'When we come upon locked boxes, the trust evaporates. Also, consider that I write a lot of outstanding material on software engineering under Jim Riverman. Everyone might get the impression that L. Detweiler doesn't know squat about software engineering. And L. Detweiler might even go to a job interview, where the interviewer was also on the Software Engineering mailing list. `I'm sorry Mr. Detweiler, your experience as I've seen on the list just doesn't cut it. On the other hand, that Jim Riverman really knows what he is talking about, but all he could do was recommend that you come. I really am disappointed. Please have him come himself.' In fact, if Jim Riverman did all the posting, people might think that L. Detweiler didn't know squat about *anything*, when in fact L. Detweiler was posting his brains out under another identity (so to speak!). They might become alienated. `What has that L. Detweiler done for the Software Engineering Mailing List, anyway?' To bring this home, consider the following. Suppose that E.Hughes was actually posting as H.Finney (my apologies to both of you, please just grin and bear this, I need the effect). We would be startled to find out that E.Hughes had such extensive legal experience with the ITAR or capability in presenting outstanding articles and tutorials to newcomers. In fact, people might even become disillusioned with, or criticize, E.Hughes because they don't see the `leadership' posting anything that helps newcomers, when in fact they are `posting their brains out' (so to speak!). Yet More Tragedies -- Another problem with pseudospoofing is that of publishing. Suppose that E.Hughes now wished to write a big article for RISKS about the ITAR. He could not do so except under H. Finney without potentially compromising a `crossing' (where someone discovers the correlation). So he would have to post as H.Finney. But this would be a problem, because people might send mail to H.Finney after seeing the great RISKS posting. `Please come give a talk to our university for $10K'. H. Finney, if he had the audacity to respond, might say, `I'm sorry, I can't make it, but my friend E.Hughes can. I taught him everything I know.' If the university even responds, it might be something in the form `why can't *you* do it?' or `sorry, we're not interested.' H.Finney at the same time craves reputation, but abhors recognition. A hellish life indeed. Also, consider the problem of phone numbers. People like to maintain relationships over the phone. Cyberspace just seems too impersonal at times. What happens when someone asks for the phone number of a tentacle? Does Medusa say, `gee, my phone service is really bad, and if you are looking for ways of getting in touch with me, the phone is the worst of all. please send me a fax instead.' If the person trying to maintain a friendship didn't go away right then, they'd be *un*lucky. But in any case, they would feel quite upset and alienated. Any way you look at it, they have been betrayed. The only question is, to what extent? I think that this `cyberspace thing' is not about building *reputations*, but about building *friendships*. A reputation is nothing but condensed admiration that is synonymous with friendship. And looking over the idea of pseudospoofing, I can't see how anyone who practices it could conceivably have *any* friends, because of all the details they have to hide from others. (Does a person with Multiple Personality Disorder or a pathological liar have any friends?) But, at the same time, I'm sure I will hear from many snakes and claiming it *is* possible, and that *they* have friends. Maybe they are referring to all their `friends' as the other tentacles around them! What a pity. Like I was telling someone recently, `I really feel sorry for you.'

1 0

Austin Cypherpunks Meeting
by Jim McCoy 17 Dec '03

17 Dec '03

Digital Freedom: By any means necessary. Austin Cypherpunks November Meeting November 13, 1993 3:00 pm 4th Floor Austin Public Library (800 Guadalupe St.) The Austin Cypherpunks chapter will be holding its November meeting on Saturday the 13th of November from 3 to 5 pm in a meeting room on the 4th floor of the downtown branch of the Austin Public Library. I have been told the room we will be using is "the first thing you see when you get off the elevator..." The theme of this meeting will be an introduction to PGP and public key cryptography in general. We will be explaining how PGP and other public-key cryptography systems work, and will go over some basic details regaring getting such software packages and how to properly use them. Bring your public-key on a disk of you have one, if not we will try to have a machine available for you to use to generate your own public-key. Additonal agenda items for this meeting include -Education/Information Disks The HoHoCon will be held in December in Austin and this should prove to be a good place for us to spread crypto technology and information about encryption in general. To this end we will be discussing possible files, programs, and news clippings to include in a disk of CryptoInfo and one of CryptoPrograms that we can distribute at conferences such as this. -TCP/IP Protocols and Encryption One possible project for us to consider is that of adding encryption to some of the most commonly used TCP/IP protocols (particularly those that otherwise broadcast account names and passwords in cleartext...) We will toss around a few ideas and see if this is something to try. -Digital Credit Union Project We will get up to date on this project and brainstorm some possible membership questions/ideas that we did not get around to at the last meeting. To subscribe to our full mailing list or our announcement-only mailing list, send mail to: listproc(a)mcfeeley.cc.utexas.edu Put the line "subscribe austin-cypherpunks [real name or nym]" in the BODY of the message to subscribe to the full list and "subscribe austin-cypherpunks-announce [real name or nym]" in the body of the message to subscirbe to the announcements list. Our file archives are available in /pub/cypherpunks via anonymous ftp at: ftp.cc.utexas.edu Cypherpunks: There is safety in numbers... large primes. Local contacts for your questions...: Jim McCoy <mccoy(a)bongo.cc.utexas.edu> Doug Barnes <cman(a)io.com>

1 0

whisper for NeXTSTEP
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Hi! If there are any cypherpunks with access to a NeXTSTEP box on the net who want to help me test out a little chatter app, please let me know. The app lets multiple people chat securely over the net using DistributedObjects and the IDEA cipher from PGP. It has no whizbang features like trading unique session keys with RSA (just distribute a pass-phrase through e-mail with PGP) or rich-text support, although these could be added if there was demand... I really want to find out if it works ok between NS/i and black hardware... thanks, andrew

1 0

Re: The Depravities of Cypherpunks
by Dark 17 Dec '03

17 Dec '03

Look, I have sympathy, Really I do. But we are all really tired of hearing about it. Take it somewhere else. I shouldn't HAVE to use my killfile on a mailing list. Christ. -uni- (Dark)

1 0

Re: Privacy, Property, Cryptography (long)
by Dark 17 Dec '03

17 Dec '03

-> And this intuition of yours seems to be reflected in law and statute to a greater degree than you're allowing elsewhere in your essay. For example, U.S. Supreme Court Justice Louis Brandeis said that the "right to be left alone is the most comprehensive of rights and the right most valued by civilized men."[1]Yet y our opening lines are <- The only statues giving any kind of "Right to privacy" that have any weight at all are full of holes. For the most part a right to privacy has been EXTRACTED from them, usually without much basis. Even Brandeis has his reservations (International News Service v. Associated Press) Again, the right to privacy is not constitutionally reserved, and is almost entirely a construction of common law. > Privacy was in a Hohfieldian manner, a privilege. Hohfield sounds like an interesting read. Can you give a reference? <- Let me dig up the bio on him and drop it here. -uni- (Dark)

2 1

Elm & PGP
by lear35!mdbomber＠nebula.acs.uci.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm having some trouble using the morepgp filter program that's in the contrib/elm_nn directory of the PGP distribution. It works nicely in most respects. However, I haven't been able to choose a good pager program for morepgp to send its output to. If I tell morepgp to use the 'more' program, it will page through the mail message until it gets to the end. When that happens, elm suddenly retakes control and clears the screen. The last screenful of the message is therefore on the screen only an instant. This is unacceptable. A lesser problem is when the mail message has a PGP signature. As pgp works on it, it will say something to the effect of good signature from <user> at <timestamp> However, it immediately passes control to more, which doesn't pause the screen until the "good signature" message has already scrolled off the screen. At least in an xterm window I can scroll back. Speaking of less, that's the default pager for morepgp, but it has problems also. It has the same problem as more where the pgp signature information scrolls off the screen before it can be read. However, since less clears the screen between each screenful, there is no way to scroll back using the scroll bars of an xterm window. Thus I only get a few miliseconds to read whether whose signature was on that mail message I just read... I haven't found any command line options for less that disable the screen clears. Does anyone have any solutions to this problem? -----BEGIN PGP SIGNATURE----- Version: 2.3a iQBVAgUBLOHgEjSSmvXojb+5AQH1/wH6A7j1dZalFHIIZXLxl0OW4K/CgA/hAZ0G SV2RAe5k5fDIY52JCJoFgtwL7fam0YQ+eifveIoCkkLV2EOP4ZXtUg== =4ctR -----END PGP SIGNATURE-----

1 0

The Depravities of Cypher
by Duncan Frissell 17 Dec '03

17 Dec '03

L.>Mr. Hughes is quite perplexed at my sheer rage at Mr. Metzger's L.>unsurpassed childishness. He didn't approve of me attempting to shame L.>Mr. Metzger (a close personal friend, I suppose) This is a joke -- right? <G> DCF --- WinQwk 2.0b#1165

1 0

Re: Should we oppose the
by Duncan Frissell 17 Dec '03

17 Dec '03

D >The problem is that bandwidth is a highly limited resource, just like D >real estate is a limited resource. Eventually we will complete D >saturate network bandwidth no matter what technology is used. This has D >been discussed in various forums for many years. Then why have telecoms prices been declining for years? A three minute phone call from the US to England cost $25 in 1955 (in 1955 dollars). Where in the current comms spectrum do you see saturation and rising prices? It seems to me that in most resources we get predictions of shortages for centuries but those shortages never appear because the market eliminates or dodges them. DCF --- WinQwk 2.0b#1165

2 1

smuggling currency
by Duncan Frissell 17 Dec '03

17 Dec '03

U>The basic thrust is this: You can't transport a monetary instrument U>worth more than $ 10,000 without filling out the appropriate customs U>report. Of course they have to be able to prove that you did so. Cash cards raise real proof problems. U>If you bring the money in with the intent to avoid taxes, you have a U>second count, There are no tax consequences to cash per se. The issue is whether the cash constitutes unreported income or not. A separate issue. U>All your transaction does (unfortunately) is delay the importation U>of the "currency" until after the plane trip. You're still required U>to report the transaction, the card just makes it easier to get U>away with it. However, by spreading the "importation" out over time, cash cards reduce the chances that a "structuring" count could be proved against you. The whole cash card thing really mixes up the exact location of the money. What if you are overseas and buy a VISA USA cash card and then bring it into the US. Is this a reportable transaction? Presumably the payment for the card was wired by your overseas institution to VISA USA, a bank wire is not reportable. In any case, the overseas institution may not link you with its purchase of a VISA Cash Card from the US. Complications. DCF --- WinQwk 2.0b#1165

1 0

Government Accounting Office Report on Communications Privacy
by djw＠eff.org 17 Dec '03

17 Dec '03

A few days ago, the Government Accounting Office (GAO) -- a pretty sharp internal gov't investigative organization that's about a lot more than accounting -- issued a report on communications privacy. (Much of what's in the report will probably raise of big "duh, we've been saying this for a decade," from cypherpunks and other digerati, but it's still very important to have the GAO saying this stuff.) The report makes four very important findings: 1. Privacy-protecting technology (crytopgraphy) is increasingly important for protecting the security of business communications and personal information. But federal policy is getting in the way of this technology. "Increased use of computer and communications networks, computer literacy, and dependence on information technology heighten US industries risk of losing proprietary information to economic espionage. In part to reduce the risk, industry is more frequently using hardware and software with encryption capabilities. However, federal policies and actions stemming from national security and law enforcement concerns hinder the use and the export of U.S. commercial encryption technology and may hinder its development." 2. The NSA's role in this area is has been extensive, and possibly beyond the spirit of the Computer Security Act. "Although the Computer Security Act of 1987 reaffirmed NIST's reponsibility for developing federal information-processing standards for security of sensitive, unclassified information, NIST follows NSA's lead in developing certain cryptographic standards" 3. Opportunity for public input in the standards process has been insufficient, leading to proposals like Clipper which lack public support. "These policy issues are formulated and announced to the public, however, with very little input from directly affected business interests, academia, and others." The report draws no specific policy conclusions, but provides excellent ammunition for those of us who are trying to open up the standards process and get export controls lifted. Full text of the report (GAO/OSI-94-2 Communications Privacy: Federal Policy and Actions) is supposed to be made available by ftp from GAO. As soon as it is, I'll let people know where it is. ...................................................................... Daniel J. Weitzner, Senior Staff Counsel <djw(a)eff.org> Electronic Frontier Foundation 202-347-5400 (v) 1001 G St, NW Suite 950 East 202-393-5509 (f) Washington, DC 20001 *** Join EFF!!! Send mail to membership(a)eff.org for information ***

2 1

Big Mother can't protect our privacy
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <199311101900.LAA22288(a)mail.netcom.com> tcmay(a)netcom.com writes: > let me say that the intent is psychological, not political. The > famoous questions about believing in God, having homosexual > experiences, washing one's hands, and so on, are devised by shrinks, > not designed to ferret out atheists and homos. The MMPI has been in > wide use since the 1950s, though it's use is declining as people file > lawsuits over it.) Read 'The straight dope' on how these questions are scored. Anyone who doesn't believe in God, for example, comes off very badly. There are many very nasty assumptions all through it that reflect the prejudices of the shrinks you refer to. It might as well have been written by god-freaks and gay-bashers. (Usually the same thing in my experience) > In Britain, in case there are some of you out there who haven't heard > about this, they got concerned about corporations compiling records on > people. Sounds like a valid concern, right? Well, the result was the > Data Privacy Act (or somesuch), which outlaws such records unless the > compiler notifies _all_ of the targets _and the government_. Close but your wording is misleading. People compiling lists in this country do *not* notify the people on the lists. The latter have to know who is compiling data on them, then put in a request (like a FOIA request) asking to be told what that data is. The public register just says 'company X keeps data' - it doesn't say on whom. In order to find out who is holding data on you, you would have to request it off every company registered with the DPA - and at about 10 pounds per request, that's a good way to go broke fast. The Data Protection Act would be better renamed the Data Secrecy Act - it primarily protects the large list of exempt bodies who not only do not register but are also immune from seaches; and any searches by other means are illegal. For instance, town councils, the police, banks, ... - just about anyone you would actually want to find out what they have on you. > The result is that anyone who saves computer files--like this list, > which of course contains e-mail addresses of hundreds of people--is > technically in violation of the law. Companies are finding it tough to > go about their business. And so on. This may well be true; it's been posited that anyone with a usenet feed should be registered since people post personal details in .sigs, and the data can be searched automatically in the mail spool. No-one to my knowlege has done so though, and no-one is asking them to. It's a big bone of contention at the moment whether BBSes should register - some see it as a way of squeezing them out of the BBS game. Again, most of them don't, and no-one complains. However it's always at the back of peoples' minds that the DPA could be used against them as an excuse if they were ever targeted for other reasons (such as unpopular political speech). G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

L. Detweiler's latest rant on comp.risks
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <9311110637.AA19911(a)ah.com> hughes(a)ah.com writes: > >G.Broiles, A.Chandler, J.Dinkelacker, H.Finney, E.Hughes, M.Landry, > >T.C.May, N.Szabo Hey, can't I be somebody too, pretty please?!!! G (aka Sy Verpunc, until he installed procmail) -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

A short response to L. Detweiler: 'I exist as myself.'
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <9311110714.AA19967(a)ah.com> hughes(a)ah.com writes: > L. Detweiler's recent article on the RISKS of confusing an online > identity with a potentially knowable physical one are quite > interesting, if hypothetical. > > I would be interested in hearing of situations where this practice > has actually occurred. If any RISKS members know of any such > incidents from first-hand experience, please share them with the > readership. I can tell a fascinating tale about spoofed identities that happened on a mailing list I was on a couple of years ago; but it's a *very* long story and I haven't the time. Maybe if I'm idle over the christmas holidays I'll pull up a log, sit down, and tell the story (if I'm bribed with enough drinks first :-) ) G (For anyone else here who's on that list, it's the story of Mahalingam et al...) PS Also I'm aware of quite a culture of 'she-males' in certain groups and IRC where men pose as women - usually lesbians - usually to get other real lesbians to confide in them (for the purposes of their own arousal...) -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0