December 2003 - cypherpunks-legacy

RATINGS: an alternative request-based system?
by Seth Morris 17 Dec '03

17 Dec '03

I have been thinking about the proposed ratings system, and thought long and hard about what *I* would want in ratings I receive, and how much I would like to rate articles with ease. The model I arrived at was substantively different, and may reduce overall bandwidth while allowing greater control of my own personal mbox. What I would see is a list which only sent the traffic to a subscriber on _request_ instead of at once (perhaps more digest-oriented). I would send a message to cypherpunks-rated(a)whatever.domain (which could be an independant ratings group subscribed to receive and hold the "normal" 'punks list, and perhaps other related lists) with a command to get the mail I had not yet received. I would prefer that the list handle a database of when I last requested mail, and perhaps had a command to just tell me how MUCH mail was waiting (in both messages and Kb). Then, the messges would arrive, along with any ratings. Perhaps some services could maintain a ratings profile for me, of the signators I trusted to rate and the topics/ratings I prefer (one especial benefit for me would be to raise my filtering level at the transmission end on those days when the volume had increased, as launchpad has _serious_ disk problems, and I'm telnetted in at 2400 bps anyway). The messages would arrive and I could reply to cypherpunks-rated with MY ratings/comments (whichI would like to see batched and transmitted to the author, so comments on saliency/style/flamage would be sent only to her/him and not clutter up anyone's mailbox) to the server to be added to the list. This way, new messages are always sent (although it would be easy to change that, preferably in my profile) to be rated, and old messges have longer accumulated ratings. Actually, this runs more like a mail-based archive than a list, but the end result is similar. Perhaps a couple of days hacking at some archive manager (like the ones at most listserv's... does majordomo have archiving?) could set up a running prototype. It seems that this meets most of the requirements: multiple ratings, multiple ratings services, easily alterable filtering profiles, easily extended to handle keywords (many archivers already o this, of course). Specifics are debatable: the source filtering seems controversial (although I don't know why, unless people are worried about having the list manager know their preferences, in which case they can get everything and its ratings and handle them locally), so maybe the server shouldn't keep persistent profiles, but should receive a request with a profile for that specific request. Perhaps I send a "request on" message, and receive a message containing information on the queue: how many new messages (in however much time, so I know), how many Kb, how many rated messages on which common topics (in any given two-day period, the number of topics stays pretty low), etc, and I reply with numbers ie: >Per: your "request on" message of 940401:1935GMT > Last request 940401:1209GMT >Messges: 12 >Kbytes: 65 >Remember: ar is "Average Rating" of raters accepted in your > "request on" message: Raters id's follow: > exclude: BIFF.DORK(a)BITNET.SHOUT > exclude: ld*@lance* > accept: master.rater(a)text.analysis.god.com > >Keyword: Remailers... 3 messages rated, 1 message unrated, ar:8.2 send all Remailers >Keyword: Libertarian... 2 messages rated, 0 messages unrated, ar:0.6 send above 2.0 >Keyword: PGPTools... 5 messages rated, 1 message unrated, ar:5.2 send above 7.0 send below 1.0 #for chuckle factor > Your messages comments: > msg id: xxxxxx > "Excellent, it changed my life" Rating: 1.1 --SomeOne > "Rehash of old crap" Rating 7.6 --SomeOne Else > msg id: yyyyyy > <no comments> Hmmm... a bit too wordy, but you get the idea. (Get the lucifer? Get the skipjack? (Remember: Ounce for ounce...) ) This would also make receiving multiple lists easier for those of us with no filters (Where does one get pc-elm???????), as we could receive one list, process it, and then get another list, allowing us to not get them mixed up. Seth Morris (seth.morris(a)launchpad.unc.edu)

1 0

Education needed, but what specifics?
by Seth Morris 17 Dec '03

17 Dec '03

I think we all agree that the public needs education on crypto and crypto politics. What specific issues need to be addressed? For some time now, I have been kicking around ideas for games related to crypto, and I have decided that it may be an excellent education/propoganda tool. What I'm thinking of is a BBS door that incorporates encryption ideas (probably without using any actual excryption, to make sysops more comfortable with it -- I'm co-sysop of a local BBS and my "real" sysop refuses to allow crypto software on it, for the same reason he's reluctant to house an adult area, no matter how much he personally would like both (although, admittedly, he's primarily interested in the adult area)). Originally I had thought of a game where encryption was used to transmit messages to units (a space-war-game, perhaps?), and capturing and decrypting your opponents messages was paramount. Ultimately, as your "cryptotech level" increased, you'd get stronger cyphers and develope public-key tech, etc., but this seemed pretty limited in its educational potential and pretty derivative of existing games. My current idea is something more based on the net. Players take the role of corporations pet punks, or freelancers, and use encryption to cover their butts while following traffic analysis trails of opponents (digital) money, setting up services for profit (and perhaps to follow the traffic opponents pass through them... leading to more encryption, etc), leading to ratings services and digital reputations, leading to denial-of-service attacks, etc. This could get exciting to play, and would lead to a cypherpunks-agreeable position in the game, perhaps facilitating "market penetration" of EFF, CPSR, and other cypherpunks-friendly literature. Perhaps the game should make frequent mention of PGP, RSA, Chaum and other sources in the literature (a door with a bibliography!)? What do y'all think of the idea? I think gaming is a wonderful way to spread ideas, and have been looking for a way to use it for some time. What elements of cypherpunks' philosophy and methods should/could be incorporated? I think emphasising the cyBerpunk-like aspects of the game (spoofing to get information, copyiong mail logs to follow message traffic, etc) would make the game more popular, and while it might hurt the game's reputation as a propoganda tool (wow-- a game that's a manual on attacking services on the net... how is that good for people?), it should increase the player's awareness of the _need_ for signatures, reputations, untraceablility, etc. Besides, who wouldn't want to infiltrate Denning Associates Corporation and Stern & Light Pharmaceuticals to funnel money and information to Mayday Publishing or somesuch? Seth Morris (seth.morris(a)launchpad.unc.edu) PS- I'm still having problems with PGP Tools 1.0c. The ptd.exe locks in fifo_destroy when trying to find a private key on the ring. Any suggestions? My first applet to test the library (an MD5 hasher for files on the command line) works fine, though.

2 1

Re: Education needed, but what specifics?
by Seth Morris 17 Dec '03

17 Dec '03

> Seth Morris writes : > > > > For some time now, I have been kicking around ideas for games related to > > crypto, and I have decided that it may be an excellent education/propoganda > > tool. > > Interesting.. Interesting.. > > > > > Perhaps the game should make frequent mention of PGP, RSA, Chaum and > > other sources in the literature (a door with a bibliography!)? > > Getting better... > > > > Whoa... is this thing supposed to be a *game*, or a training school for > net.guerilla.warfare? I may be a minority of one, but I'm not going to Point well made, and I did allude to the possibility that some would see it as that (although I think I was unclear about specifics, I had nothing actually _training_ like in mind certainly!). This is to be a game, primary emphasis on fun. I find that I learn best when I'm having fun, and my experience with rpg's and wargames has been that I think about the implications and inspirations for the games I play. (Has anyone else read the story about the USG using games to manipulate the voters? Where they make a voting game to increase turnout in a manner similar to Monopoly's supposed influence on people during the depression?) > risk *anything* by trying to hack mail systems, trace their logs, or > spoof. Quite frankly, I can't be bothered - apart from a sort of 'James > Bond' thrill, that sort of thing has no appeal whatsoever. Hopefully, I'm > just missing the point here, but I wonder how smart it is to advocate > 'hacking net services' in a game that is supposed to introduce people to Understyood, and agreed. All simulation, not like reality. I haven't ever commited such silliness myself (part of why I'm asking for ideas), and I see no reason for anyone else to. > strong crypto. Although it might not be very thrilling, my hope is that > Mom and Pop Citizen will one day use PGP (or <insert-favorite-crypto-here>) > on their routine e-mail - they may never know or care about telnetting to > port Q-47, and I don't think that matters much. Be careful with the game; > don't overemphasize the cloak-and-dagger to the point that Average Citizen > gets spooked off strong crypto. I'm hoping that the game would emphasize that anyone could _need_ strong crypto, and anonymity, and digital cash, etc. Also that understanding your network makes you and everyone else safer. > Don't take this as flame-bait, please; this just posting just hit me at > the right time to provoke a philosophical outburst. While it is fun for > the cypherpunks to skulk around and spoof each other, we must not lose > sight of a large segment of our intended audience - namely, those people > who might hop on the strong crypto bandwagon so long as the 'skullduggery' > factor does not get too high. I think there is a large market for crypto > services that is completely detached from the 'full blown' cypherpunk > agenda of anonymity, remailers, untraceability, etc. Have you played the game "Neuromancer" based on Wm Gibson's novel? My thought all the while reading the book was that it's make a better game than novel, and I was right. The game focuses on finding and infiltrating systems on the net with emphasis on tracking financial transactions and reaching secure(?) meeting places with other net underworld figures. The game was immensely popular, and could have used more "puzzle-like" elements, more data presented to the player, and an interactive option. That is more like what I'm proposing. The players I know of BBS door games in Tucson, Arizona (where I'm located physically), would like to see more control than would make the game "friendly." Understanding that their sysadmin can follow the sendmail logs might encourage users to use crypto on their mail, and use remailers (even non-anonymous remailers, just designed to take the tracking away from their own sysadmin and put it with one they have CHOSEN to trust). I know a lolt of sysops, and you'd be surprised how much email is read. Also, if more people are thinking about didgital cash, anonymity, encryption, and the lack of proivacy they have (and how public their lives may become if governments/corporations/"unfriendlies" of all types were the ones controlling information entirely vis a vis clipper, storuies of sysops reading mail, stories of corporations reading mail, stories of operators listening in on phone calls, ...), the more solutions will emerge, and the more prepared the people already using computers to exchange ideas will be when confronted with the options that take away privacy as opposed to those which enhance it. Perhaps I should send you a plan of what I'm thinking? Storyboards? I do **NOT** want to be seen as suggetsing/writing a manual on net.warfare, but the cyberpunk novels are already pretty closeto to what I'm thinking of and without presenting real dangers, I don't know how to suggest people use real solutions. Any suggestions are greatly appreciated. (Glad I didn't mention the proto idea of having users use hunter-killer viruses... that'd get me in trouble!) I appreciate criticism. Disagreement isn't flamage. Indignation isn't necessarily ad hominem. Please help me prepare a concept that won't cause these reactions in the non cypherpunks-friendly communities. Ideally, the abstract for the gam,e shouldn't raise too many eyebrows in comp.virus, talk.politics.crypto, or anywhere else. It certainly should be something sysops would be willing to use. Seth Morris (Seth.Morris(a)LaUNChpad.unc.edu)

1 0

Re: Disinformation (or the Truth?) About Clipper
by geoffw＠nexsys.net 17 Dec '03

17 Dec '03

> Phil Karn says: > > >The idea of a disinformation campaign to oppose Clipper really bothers me. > > >Isn't the true about Clipper damning enough? Lying about Clipper seems like > > > > I agree completely. Telling the truth is all that's necessary. You know, I'm a person that rarely lies, I don't lie to aquaintances let alone friends, but in this regard I think I have to side with Tim. We don't have the time or money to flood the media with the truth, this thing has to be STOPPED by any means necessary, The truth will surface one way or the other, It will surface when it is too late and we are all in jail for using illegal crypto, or it will surface when Clipper is finally derailed and the nation/industrialized world is free to be able to have the truth known. "THINK, It ain't illegal... yet." - George Clinton

2 1

Re: Disinformation
by smb＠research.att.com 17 Dec '03

17 Dec '03

How will the development of the Clipper hamper the info-supe-hi? And what is the info-super-hiway anyway, eh? I'll leave out the buzzwords -- but Clipper will definitely hamper the deployment of good networks. Encryption is a vital tool for network management and authentication, even apart from privacy considerations. But Clipper is of necessity hardware-only, which means that most current platforms will never support it, and few future ones will actually have it, whether they're capable of it or not. And on many important boxes -- routers, for example -- just leaving room for Clipper on the boards will be expensive. We have the following dilemma: DES isn't exportable, Clipper isn't suitable, and lots of foreign governments won't allow it in anyway, I suspect. How is one supposed to do authentication on a global Internet? --Steve Bellovin

1 0

Bet it's not encrypted...
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

[The following was snipped from EDUPAGE, the online summary service. Anyone have access to more information? --AW] AND OPTICAL FINGERPRINTS. The National Registry uses an optical scanning technology to create and compare digital maps of the finger surface. The map can be converted to a modified bar code for inclusion on a wallet ID card. The information can also be encoded on circuitry inside a credit or debit card. (Tampa Tribune 2/20/94 B&F1)

2 1

Re: Mac encryption
by Ron Davis 17 Dec '03

17 Dec '03

>> What is everyones opinion of the best encryption software forthe Mac? >> Frederic Halper >> fhalper(a)pilot.njin.net > >MacPGP, available by anonymous ftp from the soda.berkeley.edu site, is >the only one I know of using public key methods, and hence the only >one of real interest to Cypherpunks. I find this to be a strange statement. Do we have no interest in non-public key methods? Seems the Cypherpunks should have an interest in all forms of crypto. Most users don't currently use public key becuase they just want to keep thier boss from sitting down at thier computer and reading the resumes they wrote for other companies. This can be accomplished with symetrical crypto just as well, if not faster than PGP. >Commerical products (like the various "Kent Marsh" products) are >mostly DES-or-weaker and are oriented toward local file protection. >(MacPGP will do that, too, of course). Cryptomatic does come with Triple DES which is still a very strong method. Unfortunatly MacPGP's biggest draw back is that its interface is poor and it is hard to use. There is also MacRIPEM which is written by Raymond Lau, author of Stuffit, and is much easier to use, but weaker than PGP (but legal). > >About six or seven years ago I bought "Sentinel," from SuperMac, and >used it a few times. The problems were obvious: lack of other users >(so my friends couldn't receive or send), and the symmetric cipher >nature (we had to share keys for a message). Public key systems based >on PGP have solved both problems (though problems of convenience >remain). > Can't stop without mentioning that my company make a product called Citadel which does DES encryption. ___________________________________________________________________________ "I want to know God's thoughts...the rest are details." -- Albert Einstein _________________________________________ Ron Davis rondavis(a)datawatch.com Datawatch, Research Triangle Park, NC (919)549-0711

3 3

Re: Mac encryption
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From: Ron Davis <rondavis(a)datawatch.com> > > >> What is everyones opinion of the best encryption software forthe Mac? > >> Frederic Halper > >> fhalper(a)pilot.njin.net > > > >MacPGP, available by anonymous ftp from the soda.berkeley.edu site, is > >the only one I know of using public key methods, and hence the only > >one of real interest to Cypherpunks. > > I find this to be a strange statement. Do we have no interest > in non-public key methods? Seems the Cypherpunks should have > an interest in all forms of crypto. Most users don't currently > use public key becuase they just want to keep thier boss from > sitting down at thier computer and reading the resumes they wrote > for other companies. This can be accomplished with symetrical > crypto just as well, if not faster than PGP. Cypherpunks do have an interest in all forms of crypto, but there are very good reasons why public key is more desirable than symmetric for "our purposes." This is at the very root of the crypto revolution and the cypherpunk ethos. Have you done the basic reading? (That's a serious question, not sarcasm.) PGP _does_ symmetric crypto. > >Commerical products (like the various "Kent Marsh" products) are > >mostly DES-or-weaker and are oriented toward local file protection. > >(MacPGP will do that, too, of course). > > Cryptomatic does come with Triple DES which is still a very > strong method. And MacPGP comes with IDEA, which is at least as strong (as far as we know). And of course, it does all the public-key encryption and key-management as well. A pretty incredible package, considering its size and cost. > Unfortunatly MacPGP's biggest draw back is that its interface > is poor and it is hard to use. I disagree. > Can't stop without mentioning that my company make a product > called Citadel which does DES encryption. Hmmm... --Dave.

1 0

Another Brick in the Wall (fwd)
by Mike Godwin 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Re: Mac encryption
by Ron Davis 17 Dec '03

17 Dec '03

>Cypherpunks do have an interest in all forms of crypto, but there are >very good reasons why public key is more desirable than symmetric for "our >purposes." This is at the very root of the crypto revolution and the >cypherpunk ethos. Have you done the basic reading? (That's a serious >question, not sarcasm.) Depends on what the required reading list for this group is. I thought that our purposes were to promote the privacy of individuals through the use of cryptography. This can be done in the contexts I talked about with symmetric as well as PK crypto. Maybe I have the wrong idea about "our purposes", please correct me if I'm wrong. >PGP _does_ symmetric crypto. >And MacPGP comes with IDEA, which is at least as strong (as far as we know). Rumor has it that Kent Marsh is working on an IDEA module for thier products as well. >And of course, it does all the public-key encryption and key-management as >well. A pretty incredible package, considering its size and cost. You're right its free. If something is free you can't really complain about it. If it does anything its a bargan. > >> Unfortunatly MacPGP's biggest draw back is that its interface >> is poor and it is hard to use. > >I disagree. I can live with disagreement. Of course hopefully you would admit that Cryptomactics ability to select a file in the finder, pull down a menu and Boom encrypted file is easier than PGP's methods. ___________________________________________________________________________ "I want to know God's thoughts...the rest are details." -- Albert Einstein _________________________________________ Ron Davis rondavis(a)datawatch.com Datawatch, Research Triangle Park, NC (919)549-0711

1 0

http:--cnnfn.com-hotstories-washun-wires-9707-24-fcc_wg-
by Jim Choate 17 Dec '03

17 Dec '03

Help for your desk so that it is no longer flooded with calls with the new HP Vectra PCs. [INLINE] Washington Unwrapped graphic New FCC chief to be named Kennard expected to get post, but choice has irritated Sen. Hollings July 24, 1997: 6:49 p.m. ET [LINK] [INLINE] Hundt sees book in future - June 2, 1997 FCC Chairman steps down - May 27, 1997 [INLINE] Federal Communications Commission Infoseek search __________ ____ ____ WASHINGTON (CNNfn) - President Clinton has settled on William Kennard to be his choice to become the next chairman of the Federal Communications Commission, well-placed Administration officials tell CNN. [INLINE] Kennard, the FCC's current general counsel, would succeed Reed Hundt, if confirmed by the Senate. [INLINE] The sources say the president could make the announcement as early as Friday, though the official announcement could slip a bit. [INLINE] Kennard was favored for the job by Vice President Al Gore, the White House official who makes most of the final decisions regarding FCC appointments, because of Gore's long time work on telecommunications issues. But another telecommunications policy maker in Washington is furious at the White House for the Kennard selection. [INLINE] Sen. Ernest Hollings, the ranking Democrat on the Senate Commerce Committee, had pushed his former chief of staff on the committee, Ralph Everett, for the job. Everett, the first African American to ever serve as chief of staff to any Senate committee, had the endorsement of 16 Senators and was considered a leading candidate for the job. [INLINE] Not only is Hollings angry that his candidate didn't get the nod, but sources say he is also miffed about how the White House handled the process of making the final decision. White House Chief of Staff Erskine Bowles called Hollings, Senate sources say, "to apologize for how this was handled." [INLINE] One source close to Hollings told CNN Financial News, "Don't expect quick work in the Senate on this nominee." [INLINE] The president also is expected to nominate Justice Department attorney Michael Powell to fill a Republican vacancy on the five-member FCC, according to the sources. [INLINE] And Gloria Tristani, a phone regulator from New Mexico, is expected to be Clinton's choice to fill a Democratic seat. [INLINE] Those two nominations, however, aren't expected to be announced at the same time as the Kennard pick. Clinton already had nominated Kennard for the FCC. But the president has yet to name his choice for chairman of the agency following Hundt's announcement in May that he planned to leave. [INLINE] Clinton already has nominated Harold Furchtgott-Roth, chief economist for the House Commerce Committee, to fill a second Republican vacancy. The FCC oversees the phone, broadcast, wireless, satellite and cable-television industries. Link to top home | washington unwrapped | hot stories | contents | search | stock quotes | help Copyright © 1997 Cable News Network, Inc. ALL RIGHTS RESERVED.

1 0

ironic
by Carl Ellison 17 Dec '03

17 Dec '03

It's a bit ironic that the Administration is crying foul so loudly over the Soviet/Russian spy in the CIA -- as if this was unfair -- while they're openly proclaiming the right to spy on citizens and foreigners via Clipper. (IMHO) - Carl Carl M. Ellison cme(a)sw.stratus.com RIPEM MD5OfPublicKey: 39D9860686A9F075A9A83D49589C677A PGP 2.4 Key fingerprint = E0 41 4C 79 B5 AF 36 75 02 17 BC 1A 57 38 64 78

1 0

Re: Disinformation (or the truth?) about clipper
by Andy Lowton 17 Dec '03

17 Dec '03

Given that this is a public forum, is it a good idea to announce that you are going to lie about Clipper? Next time Tim May (for example) is on a radio prog talking about Clipper, he is wide open to the question 'Why should we believe you? Your group advocates spreading disinformation doesn't it?' I agree that this should be fought, but I would be cautious about announcing tactics like this to the world. Andy

1 0

Re: Mac encryption
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From: Ron Davis <rondavis(a)datawatch.com> > > > dmandl(a)panix.com said: > > > >Cypherpunks do have an interest in all forms of crypto, but there are > >very good reasons why public key is more desirable than symmetric for "our > >purposes." This is at the very root of the crypto revolution and the > >cypherpunk ethos. Have you done the basic reading? (That's a serious > >question, not sarcasm.) > > Depends on what the required reading list for this group is. > I thought that our purposes were to promote the privacy of > individuals through the use of cryptography. This can be done > in the contexts I talked about with symmetric as well as PK crypto. The invention (discovery?) of public-key crypto changed the world, and makes practical everyday use of crypto infinitely easier. It also makes the kinds of specific things cypherpunks are interested in much more practical (or POSSIBLE). If you correspond with hundreds of people on a regular basis, including people you don't know and people you may send something to once and never deal with again, it is impractical to say the least to have to generate and exchange keys. That's the basic argument. Why was public key crypto invented at all? Why are people interested in using it? Practically, it's really fundamentally different from symmetric crypto, which is of very limited use in the situation we're all in now (anonymous communication, the net, quick hit-and-run dissemination of information, digital signatures, etc., etc.). PGP also has the "web of trust" structure built in. This is worlds away from basic symmetric crypto. This is really basic stuff, so I'm hesitant to discuss it on the list. > Maybe I have the wrong idea about "our purposes", please correct me > if I'm wrong. If you're relatively new to the list, try to get your hands on some of the basic cypherpunk material, like tcmay's Crypto-Anarchy manifesto, the cypherpunk articles in Wired or Whole Earth Review, etc. There are many different views represented on the list, but I think we all agree on the significance and importance of pk crypto. Symmetric is fine for hiding things from your boss. PK is intended for different purposes. > >And of course, it does all the public-key encryption and key-management as > >well. A pretty incredible package, considering its size and cost. > > You're right its free. If something is free you can't really complain > about it. If it does anything its a bargan. I didn't mean to insult PGP by claiming that it's worth the price ($0). It's actually worth much more. I was just saying that for free it's an astounding deal. --Dave.

1 0

Clipper
by tomh＠bambi.ccs.fau.edu 17 Dec '03

17 Dec '03

If the govt and all its agencies used Clipper for all their communications, they would be vulnerable to attack from foreign govts that have bought the keys from spys. Despite being in escrow, I can't imagine they are really as secure as everyone seems to think. If random govt agencies can get the keys for legal wiretaps, spys will also be able to do so. Does Clinton have the right to listen in on NSA communication? If he tried he might find that they aren't using Clipper internally (or that they keys aren't in the proper escrow locations).

3 2

Re: Mac encryption
by Ron Davis 17 Dec '03

17 Dec '03

>> From: Ron Davis <rondavis(a)datawatch.com> >The invention (discovery?) of public-key crypto changed the world, and >makes practical everyday use of crypto infinitely easier. It also makes >the kinds of specific things cypherpunks are interested in much more >practical (or POSSIBLE). If you correspond with hundreds of people on a >regular basis, including people you don't know and people you may send >something to once and never deal with again, it is impractical to say the >least to have to generate and exchange keys. That's the basic argument. >Why was public key crypto invented at all? Why are people interested in >using it? Practically, it's really fundamentally different from symmetric >crypto, which is of very limited use in the situation we're all in now >(anonymous communication, the net, quick hit-and-run dissemination of >information, digital signatures, etc., etc.). PGP also has the "web of >trust" structure built in. This is worlds away from basic symmetric >crypto. > >This is really basic stuff, so I'm hesitant to discuss it on the list. I wasn't saying that PK wasn't important, or the most important. I agree it is a great thing. I was just saying that I thought cypherpunks was also about non-PK crypto. I also ventured to think it wasn't just about PGP, but all crypto used for purposes of insuring individual freedom and privacy. >> Maybe I have the wrong idea about "our purposes", please correct me >> if I'm wrong. > >If you're relatively new to the list, try to get your hands on some of the >basic cypherpunk material, like tcmay's Crypto-Anarchy manifesto, the >cypherpunk articles in Wired or Whole Earth Review, etc. There are many >different views represented on the list, but I think we all agree on the >significance and importance of pk crypto. I read the Wired article. I've also read the FAQ. Missed May's manifesto is it available via ftp? > >Symmetric is fine for hiding things from your boss. PK is intended for >different purposes. But isn't hiding things from your boss important in the cypherpunks worldview, even if people choose not to use PGP? Seems to me that the fact is many, if not most, people will not use PGP because of is outlaw status. Many of us are attracted to it because of that, but many people aren't. We can still advocate methods that people are comforatable with that will further our goals. If I'm wrong about the very basics of the list, then I guess this discussion is good, because I've been around for a couple of months at least and this is the idea I got. ___________________________________________________________________________ "I want to know God's thoughts...the rest are details." -- Albert Einstein _________________________________________ Ron Davis rondavis(a)datawatch.com Datawatch, Research Triangle Park, NC (919)549-0711

1 0

Disinformation
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

The Net is growing rapidly. As it grows it will become more signifigant in our world(transaction of digital cash, etc.) Security will become more of a neccesi ty(lets face it MOST people don't need encryption) If Clipper is widely impleme nted (be it voluntary or forced) people will be looking over their shoulders and righ tfully so. Also, i feel that the structure of the Internet is likely to change( It's present structure is not a good base to build on) when the cahnge occurs do n't you think Clipper is going to become the "standard." Reuben Halper -anger is a gift- rage against the machine/freedom

1 0

Re: Disinformation (or the Truth?) About Clipper
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Tim May writes: > My use of the term "disinformation" seems to have taken on > a life of its own as "lying," with several posters saying > that the truth is best, that lying is bad, and that if we > have to lie we deserve to have Clipper and Capstone! > > What I urge--and others are free to do as they wish--is to > "educate" people by describing to them the implications > as we see them. That is, we who have thought about Clipper > and have seen past government depredations and abuses, > have seen from the beginning how Clipper is likely to be > abused, how the very concept of key escrow is anathema to > basic rights, how Clipper and its Big Brethren (I just > coined this) are likely to be made mandatory, etc. We see > truth, not the charade of "voluntarism" and the "social > need" cited by the authorities. > I'm quite satisfied with this clarification (as if it matters to any but me). Still, I believe labeling your efforts a "disinformation campaign" was a mistake. It gives the pro-Clipper people something to throw back in your face. How about changing "disinformation campaign" to "education campaign"? It has a more positive sound to it and doesn't limit you to only dry facts. Education through speculation, hyperbole, and satire can be effective and is ethical if the reader can recognize when you are engaging in speculation, hyperbole, or satire (my opinion, of course). Jim_Miller(a)suite.com

2 1

Re: Why only public-key crypto?
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

>I find this to be a strange statement. Do we have no interest >in non-public key methods? Seems the Cypherpunks should have >an interest in all forms of crypto. It's not so strange. Cypherpunks are trying to bring about social changes, not primarily technological ones. Crypto is here, and we want to change our culture in a way where, through strong crypto, privacy becomes the norm rather than the exception. With this goal in mind, public-key systems are vastly more interesting because they are the `social' solutions. Scott Collins | "That's not fair!" -- Sarah | "You say that so often. I wonder what your basis 408.862.0540 | for comparison is." -- Goblin King ................|.................................................... BUSINESS. fax:974.6094 R254(IL5-2N) collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2D Cupertino, CA 95014 ..................................................................... PERSONAL. 408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

quetion about Multi-user systems
by Grand Epopt Feotus 17 Dec '03

17 Dec '03

I myself have a Linux system at home, all set up with PGP and rather secure from outside thrats since it is unconnected from the net except for when I dial-up. I was wondering what strategies some people use in order to make it easier to write and respond to mail. I dont feel like writing a message at home, encrypting it and then U/Ling it to my acount and mailing it. Is there another wya to use PGP on my mail account wihtout severely reducng mysecurity? I know the Sysop can read my secring etc.. at any time and can also intercept my passkey for my secring, BUT I would still like to perhaps use a low security key from my Unix account and then have a high security key on my home system that is very safe. The problem is, figuring out which message goes to where and all. Could someone with extnsive knowledge of PGP use on a Unix system help me out here>? You're eqipped with a hundred billion nueron brain, that's wired and fired, and it's a reality generating device, but you've got too do it. Free youself ----Tim Leary----

1 0

Dorthoy Denning editorial, Newsday
by Matt Blaze 17 Dec '03

17 Dec '03

Note: I'm just passing this on. I am only the messenger. ------- Forwarded Message Return-Path: research!cs.georgetown.edu!denning Received: from big.l1135.att.com by codex.UUCP (4.1/4.7) id AA26751; Wed, 23 Feb 94 16:18:14 EST Received: from research (research.research.att.com) by big.l1135.att.com (4.1/4.7) id AA08487; Wed, 23 Feb 94 16:18:13 EST Posted-Date: Wed, 23 Feb 1994 16:16:09 -0500 (EST) Received: by ninet.research.att.com; Wed Feb 23 16:17 EST 1994 Received: from cs (cs.cosc.georgetown.edu) by guvax.acc.georgetown.edu (PMDF V4.2-11 #5850) id <01H98BXBMQA88YCH3A(a)guvax.acc.georgetown.edu>; Wed, 23 Feb 1994 16:16:33 EST Received: from chair by cs (4.1/SMI-4.1.2) id AA01896; Wed, 23 Feb 94 16:16:09 EST Date: Wed, 23 Feb 1994 16:16:09 -0500 (EST) From: denning(a)cs.georgetown.edu (Dorothy Denning) Subject: Newsday Editorial Errors-To: Postmaster(a)cs.georgetown.edu Message-Id: <9402232116.AA01896@cs> Content-Transfer-Encoding: 7BIT ====================================================================== | Newsday, Tuesday, February 22, 1994, Viewpoints | ====================================================================== The Clipper Chip Will Block Crime By Dorothy E. Denning Hidden among the discussions of the information highway is a fierce debate, with huge implications for everyone. It centers on a tiny computer chip called the Clipper, which uses sophisticated coding to scramble electronic communications transmitted through the phone system. The Clinton administration has adopted the chip, which would allow law enforcement agencies with court warrants to read the Clipper codes and eavesdrop on terrorists and criminals. But opponents say that, if this happens, the privacy of law-abiding individuals will be a risk. They want people to be able to use their own scramblers, which the government would not be able to decode. If the opponents get their way, however, all communications on the information highway would be immune from lawful interception. In a world threatened by international organized crime, terrorism, and rogue governments, this would be folly. In testimony before Congress, Donald Delaney, senior investigator with the New York State Police, warned that if we adopted an encoding standard that did not permit lawful intercepts, we would have havoc in the United States. Moreover, the Clipper coding offers safeguards against casual government intrusion. It requires that one of the two components of a key embedded in the chip be kept with the Treasury Department and the other component with the Commerce Department's National Institute of Standards and Technology. Any law enforcement official wanting to wiretap would need to obtain not only a warrant but the separate components from the two agencies. This, plus the superstrong code and key system would make it virtually impossible for anyone, even corrupt government officials, to spy illegally. But would terrorists use Clipper? The Justice Department has ordered $8 million worth of Clipper scramblers in the hope that they will become so widespread and convenient that everyone will use them. Opponents say that terrorists will not be so foolish as to use encryption to which the government holds the key but will scramble their calls with their own code systems. But then who would have thought that the World Trade Center bombers would have been stupid enough to return a truck that they had rented? Court-authorized interception of communications has been essential for preventing and solving many serious and often violent crimes, including terrorism, organized crime, drugs, kidnaping, and political corruption. The FBI alone has had many spectacular successes that depended on wiretaps. In a Chicago case code-named RUKBOM, they prevented the El Rukn street gang, which was acting on behalf of the Libyan government, from shooting down a commercial airliner using a stolen military weapons system. To protect against abuse of electronic surveillance, federal statutes impose stringent requirements on the approval and execution of wiretaps. Wiretaps are used judiciously (only 846 installed wiretaps in 1992) and are targeted at major criminals. Now, the thought of the FBI wiretapping my communications appeals to me about as much as its searching my home and seizing my papers. But the Constitution does not give us absolute privacy from court-ordered searches and seizures, and for good reason. Lawlessness would prevail. Encoding technologies, which offer privacy, are on a collision course with a major crime-fighting tool: wiretapping. Now the Clipper chip shows that strong encoding can be made available in a way that protects private communications but does not harm society if it gets into the wrong hands. Clipper is a good idea, and it needs support from people who recognize the need for both privacy and effective law enforcement on the information highway. ====================================================================== | Copyright Newsday. All rights reserved. This article can be freely | | distributed on the net provided this note is kept intact, but it may | | not be sold or used for profit without permission of Newsday. | ====================================================================== ------- End of Forwarded Message

1 0

Re: Digitally Signing Physical Objects
by Hal 17 Dec '03

17 Dec '03

Tim has an interesting point on the use of digital signatures. A variation is to use an "undeniable" signature. This is a signature which can only be checked with the cooperation of the signer. However, the protocol is such that the signer cannot cheat and try to deny a valid signature (hence the name). This could be used by manufacturers to authenticate their products only to certain customers; for example, to customers who have paid for them. This might be especially useful for software, although Tim's idea would extend it to any object for which the authentication is especially valuable. PGP is distributed signed by Phil Zimmermann using an ordinary digital signature. This allows anyone to verify that it is a good package, free of viruses or trap doors. If it instead had an undeniable signature, this verification would require interacting with Phil (or his agent) via a protocol; but at the end the same assurance would result. This kind of signature would be more appropriate with a payware product. Undeniable signatures cannot be passed on from one person to another. If Alice verifies Bob's undeniable signature, she can't prove to Charlie that the signature is good. She can claim it is good, and assure Charlie that it is good based on her own reputation, but Charlie can in general not be convinced unless he verifies it himself directly with Bob. Hal

2 1

NIST Crypto Update (fwd) - a Feb 4 doc we somehow missed...
by Stanton McCandlish 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Give me your privacy and I will protect you.
by Michael Johnson 17 Dec '03

17 Dec '03

The following letter was received anonymously via USPS, postmarked "SUBURBAN MD MSC 206, 19 FEB 94 PM, and printed using an HP DeskJet printer in 12 point courier type. I thought that I would share it with you, not because I agree with it (I don't), but because I thought that it was interesting that it has been the ONLY comment I have received on my paper that expressed disagreement. Note that the entertaining mis-spelling of "imperfect writing" is the original author's, and not mine. For a copy of the paper I refer to, ftp csn.org:\mpj\cryptusa.* or see my posting in alt.privacy and talk.politics.crypto **************************************************************** TO: Michael Paul Johnson Re: Data Encryption Software and Technical Data Controls in the United States of America Read your document. You made very sweeping statements. Obviously, you are not an expert for all the material addressed. Educated people, when not an expert, cite to references for positions articulated in a paper. One example of your imprefect writting style is the "law enforcement" section. You never mentioned or solved the law enforcement community's efforts in detecting the transfer of illegal drugs. Your paper needs a major rewrite. FROM: Not Impressed **************************************************************** I won't waste time on a rebuttal. I just want to say that I consider traffic in harmful drugs to be a major problem. I'm not willing to give up my Constitutional rights in the War on Drugs, but I am glad that there are law enforcement agents who are intelligent enough to be a real threat to criminals without being a threat to the honest citizens that they are hired to protect. In fact, I believe that the vast majority of law enforcement agents fall in this category. Just say "NO!" to harmful drugs, promiscuous sex, the ITAR's restrictions on strong cryptography, and Key Escrow! Write YOUR Congressional Representative NOW and express support for Maria Cantwell's bill to ease restrictions on privacy software!

2 1

NIST Fed. Info. Processing Standard for EES (Clipper/Skipjack)
by Stanton McCandlish 17 Dec '03

17 Dec '03

Forwarded message:

1 0