December 2003 - cypherpunks-legacy

retiring my remailer.. (fwd)
by L. McCarthy 17 Dec '03

17 Dec '03

Forwarded message:

1 0

FW: How do I know if its encrypted?
by Matt Thomlinson 17 Dec '03

17 Dec '03

---------- From: <Ben.Goren(a)asu.edu> To: Matt Thomlinson Subject: Re: How do I know if its encrypted? Date: Friday, January 13, 1995 12:27PM At 9:35 AM 1/13/95, Matt Thomlinson wrote: >make "handful of plaintext" - > "hash of the plaintext" and you've got >yourself >a decent system. :) > >(this way, alice can keep a hash of the plaintext, hash of the ciphertext, and >a key around for recovery, without keeping ANY plaintext. Also, for someone >to request the data, knowing part of the message won't work; now they've >got to know the entire message to recreate the hash. That would be a little more secure, but I'm thinking that the "handful of plaintext" would be a random number of some kind that the user prepends to the file before encrypting. This is kinder on the data haven's CPU; compare even 3DES of, say, 256 bits to IDEA of a few megabytes followed by MD5 of same. Plus, it offers the operater even more deniability: he doesn't even look at the whole file, but just enough to be sure that it's what it's supposed to be. Presumably, the data haven will specify how much a handful is, and offer a client program that generates all this automatically. >matt You sent this to me privately, so that's how I'm replying. If you don't mind, though, please forward this on to the list. b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music Finger ben(a)tux.music.asu.edu for PGP public key ID 0xCFF23BD5.

1 0

C'punks slogan?
by Joshua M. Sled 17 Dec '03

17 Dec '03

Mostly because I'm looking at having bumper stickers made, and partly because I'm testing a procmail script :), I want a few suggestions for a good slogan for the C'punks, something that would look good on a bumper sticker... stuff I've come up with so far is like: sub rosa - Cypherpunks 1995 Support your local Cypherpunk Privacy isn't a crime (I think I stole that from somewhere) Ensuring privacy isn't a crime And that's about it.... you should see by now why I'm asking. :) Joshua M. Sled <jsled@ctp.org/jsled@free.org>

2 1

Re: How do I know if its encrypted?
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 09:17 PM 1/12/95 -0600, Larry E wrote: > ... > (1) the people who use the remailer, who get a measure of > comfort from knowing their communication is secure They know it's secure because they made it secure. If they don't care, I don't particularly see why the remailer should care. > (2) legal groups etc. who may try to hold the remailer > liable in some way for what passes through their remailer. It strikes me that this is a very weak defense. Legal beagles will probably argue that the remailer should have either prohibited encrypted communications or else was in collusion with the sending party. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

2 1

Re: How do I know if its encrypted?
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

At 6:58 PM 1/13/95, Eric Hughes wrote: > From: Ben.Goren(a)asu.edu > > That of the data haven operator being able to deny knowledge of the > contents of files people send him. He'll only return files that, when > operated on by a strong cryptographic algorithm, make sense. > >This idea doesn't work for the purpose intended. I'll upload straight >ASCII. When you ask for an decryption key, I'll make one up randomly, >apply the decryption algorithm to the flat text, and send that back to >you as a confirmation. >[. . .] Damn. I hate it when I overlook the obvious. Still, I'd like to think there's an answer. Perhaps I'll keep thinking on it. >Eric -- Ben.Goren(a)asu.edu, Arizona State University School of Music Finger ben(a)tux.music.asu.edu for PGP public key ID 0xCFF23BD5.

1 0

NIST Key Certification Document
by chen＠intuit.com 17 Dec '03

17 Dec '03

At the RSA conference, I came across an interesting-looking tome called _Federal Certification Authority Liability and Policy: Law and Policy of Certificate-Based Public Key and Digital Signatures_. It seems that we can obtain this thing from NIST for a modest fee of $61, but I'm wondering if there might be an online version around somewhere. Does anyone know? -- Mark Chen chen(a)intuit.com 415/329-6913 finger for PGP public key D4 99 54 2A 98 B1 48 0C CF 95 A5 B0 6E E0 1E 1D

1 0

Re: Reefer madness
by Blanc Weber 17 Dec '03

17 Dec '03

Thanks for your replies about the Turkish prison films, and all, I think I comprehendo now. I did see the movie Airplane, but I somehow overlooked that salient point. Blanc

1 0

Re: How do I know if its encrypted?
by daleh＠ix.netcom.com 17 Dec '03

17 Dec '03

You wrote: > >Fine. The operator has no idea of how to make sense of this data >format. Just because someone in the world has an interpretation for >it doesn't mean that I do. > The primary point that I'm trying to make is that there is no such thing as an algorithmic test for a dataset being in a 'state' of encryption. Such a test is beyond alogrithmic capability (at least in our universe). Therefore, an RM/DH operator should just drop the pretense of filtering out non-encyphered submissions. Just take what comes and tell customers that if they don't want you to read it, it's up to _them_ to make certain that you can't. Period! The DH operator could encypher all submissions with his own key so that the DH contents can't be compromised to outsiders. This seems to be a much more real-world approach to the problem than tilting at windmill with encryption filters. (The previous examples were an attempt to demonstrate, in a concrete way, the failure of any such algorithmic approach. Whatever encryption-test algorithm you come up with I guarentee you I can defeat it!) Dale H.

1 0

Re: How do I know if its encrypted?
by Dr. D.C. Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > From: daleh(a)ix.netcom.com (Dale Harrison (AEGIS)) > Paco begins by > inventing the new [format] of which only Paco knows the internals. Eric Hughes replied: > No operator of any data service can be expected to know about every > data interpretation. The key here is "good faith". An operator can > undertake a good faith effort to remain ignorant about content. While this may be possible, the argument that someone actively tried to remain uninformed about something "dangerous" or potentially "illegal" doesn't seem like a particularly strong defense. Someone with proper credentials might want to comment on whether intentional ignorance is sufficient to avoid culpability. =D.C. Williams <dcwill(a)ee.unr.edu> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxdS6yoZzwIn1bdtAQHHYQF/Qe+7AcXH5ub+BMEY91hjbKNwGGUEho5o CN63jwJ4NQYBcLHwhhu9Q+b1wTE9hMrB =lSSE -----END PGP SIGNATURE-----

2 1

Re: How do I know if its encrypted?
by jpb＠gate.net 17 Dec '03

17 Dec '03

I accidentally sent a reply to Ben's letter solely to him. He responds here to the major points I brought up. I'm forwarding it here with his permission. Ben's text begins At 8:11 AM 1/13/95, jpb(a)gate.net wrote: >Ben.Goren(a)asu.edu said >> Here's a solution: >> >> Alice sends a file to Dave's DataHaven. When Alice wants her file back, she >> sends to Dave a secure hash of the file, a key with which to decrypt it, >> and a handful of plaintext at the beginning of the file. Dave decrypts the >> file that matches the hash with the key Alice gave him; if the file begins >> as Alice says it should, Dave returns the file to Alice. > >If Alice initially encrypts the file to herself, and then encrypts it to Dave >(Dave doesn't accept non-encrypted files), Dave doesn't need to decrypt it. >If Dave even *can* decrypt it, and makes a policy of decryption, he is >setting himself up for legal liability. > >Dave should allow anyone who can provide the MD5 of the cyphertext, the >fileid and the fee to retrieve the file. Retrieval requests will of course >also require a pgp key to encrypt the file to and a anonymous remailer block. I address this somewhat further in a response to Eric Hughes on the list. Basically, Dave wants to make sure that he can't see what's in the file. My scheme guarantees that the file is unreadable to anybody but the owner until the owner asks for it back. If return of the file is automated, Dave'll never know what's in it. Alice should, of course, further protect her data if she feels the need. >> This way, only those people who have an intimate knowledge of the files can >> recover them. > >I agree that this is a good thing to enforce. > >> Dave can have a policy whereby he deletes a file after returning it, unless >> Alice pays more to keep it there. Thus, Bad Bobby can send his naughty >> pictures to Dave, tell the 'net how to get them--but the first person who >> neglects to include the fee to leave the pictures there winds up blocking >> out everybody else. Similarly, Samaritan Sam could get into a spending war >> with Bobby. Each time Bobby sends Dave his smut, Sam retrieves the file >> without paying for its continued storage--and takes a sneak peak at the >> pictures before deleting them himself. > >This is a bad policy for Dave from a financial point of view. If Alice pays >for a 30 day storage, it should stay there for 30 days. This means that Dave >also needs to require an owner-password when the file is initially stored, >but that is no big deal. Change the payment structure a little and you don't have those worries. Alice doesn't pay for thirty day storage, but rather pays for at least thirty day storage. If she thinks she'll be getting the file back in fifteen days, she only pays for that long. If she needs it for longer than that, she sends another payment before the file expires. >In a perfect world, Alice could specify an extra retrieval charge over and >above Dave's, and the DH would enforce this and pass the extra money on to >Alice. This would allow for information sale when neither party trusts the >other - Alice and Bob can agree on a fee for the file through anonymous means, >and once it is set, Bob can send in the cash and be sure the file will be >sent. That's the job of a data broker, not a data haven. Dave might well wish to offer that service, too, but, if I were him, I'd keep the two obviously separate. >Whether or not the file is what it is advertised to be is a whole >new problem that can't be solved securely in software. Not without an awfully good AI....

1 0

Re: How do I know if its encrypted?
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 10:07 PM 1/13/95, Ben Goren wrote: > ... Alice hashes her file and uses that hash as the key to encrypt the file. >She sends the file to Dave, and sends the original hash when she wants it >back. Dave decrypts, and confirms the hash. > >Unfortunately, this still doesn't quite close the loop--Dave knows the >contents of the file once Alice sends the key. It does, however, make it >very difficult for Dave to know anything about Alice's file. ... This seems overly complicated. If Dave has a known public key, then Alice should be able to hash her file, sign the hash, encrypt (the hash, her public key, and the file) with Dave's public key, and (anonymously) sends the result to Dave's (encrypted) address. Dave then decrypts, verifies the sig, and stores the file, hash, and PK together, indexed by the hash. When Alice wants the file back, she signs (the hash and her encrypted return address), encrypts the result with Dave's key, and sends it off. Dave decrypts the request, fetchs the public key based on the decrypted hash, verifies the signature, encrypts the file with Alice's provided public key, and sends it back to the encrypted return address. To avoid Dave's knowing the file contents, Alice can encrypt it before the described protocol and decrypt it afterwards. The protocol is subject to a replay attack, but the result of the replay would cause the file to be sent to the original sender and not to the replayer. The signed hash in the first step prevents people from spamming Dave with files that have Alice's public key. Alice only requires an encrypted address and public key for Dave, and Dave validates the retrieval request against the public sent in the first step. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

Draft of editorial to SF Chronicle
by raph＠netcom.com 17 Dec '03

17 Dec '03

Chaos and Anonymity keep the Internet Vital I could not let Martha Siegel's editorial ("Anarchy, Chaos on the Internet Must End", 2 Jan 1995) go unchallenged. To the uninformed reader, her arguments may seem plausible. However, her distortions give a picture of the Internet quite at odds with the true nature of the Net. Her views are by no means representative of those who actually use the Net. Of the dozens of messages I saw in response to the editorial, not a single one was in favor of her proposals. As Ms. Siegel correctly points out, the Net is not governed by any one individual person or organization. Rather, it is collectively run by those who use it as part of their daily lives. The operation of each Internet node is subject to the individual judgement of the people who own it. Ms. Siegel is wrong, however, in believeing that such a state of affairs is intolerable. Rather, this state of affairs has brough us a remarkable flowering of discourse, ideas and culture, which is just now beginning to be recognized in the mainstream press. In a lawyer's dream world, there is a rule covering every action in every situation, along with a well-functioning system to enforce the rules. This is the exact opposite of the spirit of the Net, and of Usenet in particular. Rather, there has evolved an informal set of guidelines for promoting open, civil discourse, collectively known as "netiquette." These guidelines may seem arcane to newcomers, but basically they simply ask people who use the Net to be considerate of other people, their time and their resources. A violation of netiquette brings on not legal action, but responses pointing out why the action was inconsiderate. Continued violation brings on ridicule and scorn -- people who engage in this are considered to be either sociopathic or just obnoxiously self-promoting. The single most infamous breach of netiquette in Usenet history was almost certainly the "green card spam," in which thousands of advertisements for green card services were posted to completely unrelated message areas, or "newsgroups." Advertisements presented in a way considerate to others are tolerated and even welcomed on the Net. Posting thousands of copies, though, is just going too far. Negative response was immediate. The perpetrators were asked to stop, but they refused to. One Norwegian hacker took it upon himself to track down and "cancel" the offending messages. Most people on the Net considered this to be entirely appropriate. A number of other self-promoting hucksters have sensed an opportunity, and have performed similar spams. In response, the Net evolved a defense mechanism to counter these spams and minimize the damage. The person currently serving this role is known by the pseudonym "CancelMoose." Almost everyone on the Net supports this effort, and agrees that it improves the overall value of Usenet. Who was responsible for the original green card spam? Why, Ms. Siegel herself, the same one who is complaining about "chaos and anarchy." Chaos, anarchy, and anonymity are a large part of what keeps the Net so vital. Particularly galling is Ms. Siegel's appeal to free speech. Usenet in its present form is perhaps the most conducive forum for free speech in history. The threat to free speech is not from chaos or anonymity, but from the sorts of changes that Ms. Siegel proposes. Usenet is astonishingly effective in getting around the practical barriers to free speech. These barriers come in many forms, including libel, trademark, and copyright laws, fear of retribution, etc. Because of its decentralized, communal nature, Usenet resists direct attempts to censor. The main tool for circumventing more these more indirect barriers is anonymity. As an example of such barriers, take the t-shirt commemorating the green card incident. It was emblazoned with the words, "Green Card Lawyers - Spamming the Globe" and a fist clutching a green card. Shortly after the shirt was proposed, Canter & Siegel threatened to sue if the shirt was in fact produced. It was only after several outraged lawyers promised to defend against such a case pro bono that I and others could be proud owners. Or take one of the sexual abuse recovery newsgroups, where anonymity is the norm. If someone were to post a message asking for support, saying "my uncle did it" under their real name, they would be vulnerable to a libel suit from said uncle. On the other hand, if they used an anonymous service such as the one in Finland, they would not simply escape punishment for the libel, but prevent it from happening at all. In many countries (and even China is on the Net these days), writings critical of the government, such as exposure of human rights abuses, are illegal. The authors face imprisonment, torture and death. By posting anonymously to the Net, the information can be brought safely to the attention of the world. Not all anonymous messages are pleasant or popular. Unpopular speech is a necessary consequence of free speech. At least to the founders of this country, the benefits of free speech outweigh the discomfort. Our founding fathers were also comfortable with anonymity -- the Federalist papers were originally published under the pseudonym Publius, because the authors felt the ideas should be evaluated on their own. Judging from the materials already published by Ms. Siegel, an Internet built according to her vision would free of such disturbing ideas, but would readily support five hundred channels of green card ads, impassioned pleas to purchase American flag plaques, and, yes, anonymous testimonials for radial keratotomy specialists.

4 3

NYT on Phiber Optik
by John Young 17 Dec '03

17 Dec '03

There's an article today on Phiber's return to indecency, a recap of MOD and celebratory party, with digs by unnabbed hiway-weebs. For copy send blank message with subject: PHI_out

1 0

BBC on Net trade, G7 special summit
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

BBC WSTV reports on commerce on the Net prior to a special G7 meet on the implications of the infosphere. Surprisingly, they don't mention anarchic blackmarketeers; more surprisingly they don't mention encryption - which one might expect when they talk about a one-man garage firm settling multimillion $ commodities trade contracts over the Net. Some people are about to learn something really fast. Let's hope they don't react like C&S. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Gateways to the infosphere
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Here I argue that universal service is unnecessary even for equal distribution of information age opportunity, if one drops the 'highway' metaphor which, as I argued in the last episode, is lousy. This one also points out the advantage and use of demand-driven markets in widening access - Bombay slum-dwellers without clean water buy colour TVs and VCRs. For info on back issues, send a blank message with 'get help' (without the quotes) as the Subject to rishab(a)arbornet.org (do NOT 'r'eply to _this_ message). --------cut here-------- Electric Dreams Weekly column for The Asian Age by Rishab Aiyer Ghosh #43, 9/January/1995: Gateways to the infosphere Asimov once wrote of a universe where intelligent life was intelligence alone, roaming the avenues of pure thought divorced from all physical form. To reach the infosphere with your feet still on this planet though, you need a point of access, a gateway to what could easily become another world in your life. The nature of these gateways, their availability and their owners are among the more contentious aspects of the global information infrastructure. The task of developing this infrastructure to the point of ubiquity has been compared to the construction of road networks - any place, however remote, must be connected to every other. As this would make little economic sense for private investors, the task had to be one for the government. Present-day governments are poor, so they insist that subsidies should come from business in the form of universal service: providing the same thing at the same prices everywhere. The rationale for this is noble - equal opportunity to all. Without roads people can't get anywhere, literally and economically, and the same must be true for information highways. But if the info-highway is actually an information ocean, the situation changes dramatically. It is no longer necessary to move from place to place, but simply to dive in. This is true even in practical terms. On a highway, the route traffic takes is important, because of the distance, while on the Internet routing is a very low-level, technical sort of thing, as data may travel in little pieces on different paths, ignoring geographical distance. Moreover, a highway needs a physical connection between any two points, which affects costs, while the infosphere floats above waiting to be reached through a satellite transceiver from just anywhere. Nor will the lack of universal service lead to a society of information haves and have-nots. Information is unique in that one doesn't 'have' it. It is created, and a 'have- not' can easily become a 'have'. The possible inequality is in trading information resources, in knowledge opportunities. However, especially in the field of information, people are not equally equipped to take advantage of opportunities, however unequally distributed the latter may be. Instead of demanding universal service, governments should encourage the development of infrastructure where it will be best used, which is in the interests of business, anyway. Unfortunately even telecom corporations have an incorrect perception of who the best users are. They believe in connecting those who can pay now for services, rather than the many more who would benefit and therefore be able to pay the most, once they exploit currently non-existent opportunities. Demand-driven markets grow fastest, though companies right now seem to be more interested in shoving interactive television down the eyes of the reluctant and rather bored elite. A demand-driven information market is harder to work with, as prospective buyers (as also the sellers) have to be convinced of the benefits of technology. But the potential markets are huge, if far from the minds of the vendors of 'convergence' technology, as peoples' information (or entertainment) needs are often more basic than their material needs - just look at Bombay slum- dwellers, who despite limited access to clean drinking water, buy colour televisions and VCRs. They only needed to see what TV was good for, first. An information ocean is cheaper to build than any highway could possibly be. It needs no legislation to exist everywhere, this is in its very nature. Gateways to the infosphere will, governments permitting, sprout spontaneously wherever needed, as cracks on the surface of a frozen sea. Rishab Aiyer Ghosh is a freelance technology consultant and writer. You can reach him through voice mail (+91 11 3760335) or e-mail (rishab(a)dxm.ernet.in) --====(C) Copyright 1994 Rishab Aiyer Ghosh. ALL RIGHTS RESERVED====-- This article may be redistributed in electronic form only, PROVIDED THAT THE ARTICLE AND THIS NOTICE REMAIN INTACT. This article MAY NOT UNDER ANY CIRCUMSTANCES be redistributed in any non-electronic form, or redistributed in any form for compensation of any kind, WITHOUT PRIOR WRITTEN PERMISSION from Rishab Aiyer Ghosh (rishab(a)dxm.ernet.in) --==================================================================-- ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Final draft of editorial to SF Chronicle
by raph＠netcom.com 17 Dec '03

17 Dec '03

This is the final cut. Only minor copyedits have been made. Thanks to all who responded -- about a dozen messages all strongly in favor. Anyone know the email address or fax number for the Chicago Tribune? Raph Chaos and Anonymity keep the Internet Vital I could not let Martha Siegel's editorial ("Anarchy, Chaos on the Internet Must End", 2 Jan 1995) go unchallenged. To the uninformed reader, her arguments may seem plausible. However, her distortions give a picture of the Internet quite at odds with the true nature of the Net. Her views are by no means representative of those who actually use the Net. Of the dozens of messages I saw in response to the editorial, not a single one was in favor of her proposals. As Ms. Siegel correctly points out, the Net is not governed by any one individual person or organization. Rather, it is collectively run by those who use it as part of their daily lives. The operation of each Internet node is subject to the individual judgement of the people who own it. Ms. Siegel is wrong, however, in believing that such a state of affairs is intolerable. Rather, this state of affairs has brought us a remarkable flowering of discourse, ideas and culture, which is just now beginning to be recognized in the mainstream press. In a lawyer's dream world, there is a rule covering every action in every situation, along with a well-functioning system to enforce the rules. This is the exact opposite of the spirit of the Net, and in particular of Usenet, the collection of ten thousand newsgroups which carries most public discussion on the Net. Rather, there has evolved an informal set of guidelines for promoting open, civil discourse, collectively known as "netiquette." These guidelines may seem arcane to newcomers, but basically they simply ask people who use the Net to be considerate of other people, their time and their resources. A violation of netiquette brings on not legal action, but responses pointing out why the action was inconsiderate. Continued violation brings on ridicule and scorn -- people who engage in this are considered to be either sociopathic or just obnoxiously self-promoting. The single most infamous breach of netiquette in Usenet history was almost certainly the "green card spam," in which thousands of advertisements for green card services were posted to completely unrelated newsgroups. Advertisements presented in a way considerate to others are tolerated and even welcomed on the Net. Posting thousands of copies, though, is just going too far. Negative response was immediate. The perpetrators were asked to stop, but they refused to. One Norwegian hacker took it upon himself to track down and "cancel" the offending messages. Most people on the Net considered this to be entirely appropriate. A number of other self-promoting hucksters have sensed an opportunity, and have performed similar spams. In response, the Net evolved a defense mechanism to counter these spams and minimize the damage. The person currently serving this role is known by the pseudonym "CancelMoose." Almost everyone on the Net supports this effort, and agrees that it improves the overall value of Usenet. Who was responsible for the original green card spam? Why, Ms. Siegel herself, the same one who is complaining about "chaos and anarchy." Chaos, anarchy, and anonymity are a large part of what keeps the Net so vital. Particularly galling is Ms. Siegel's appeal to free speech. Usenet in its present form is perhaps the most conducive forum for free speech in history. The threat to free speech is not from chaos or anonymity, but from the sorts of changes that Ms. Siegel proposes. Usenet is astonishingly effective in getting around the practical barriers to free speech. These barriers come in many forms, including libel, trademark, and copyright laws, fear of retribution, etc. Because of its decentralized, communal nature, Usenet resists direct attempts to censor. The main tool for circumventing these more indirect barriers is anonymity. As an example of such barriers, take the t-shirt commemorating the green card incident. It was emblazoned with the words, "Green Card Lawyers - Spamming the Globe" and a fist clutching a green card. Shortly after the shirt was proposed, Canter & Siegel threatened to sue if the shirt was in fact produced. It was only after several outraged lawyers promised to defend against such a case pro bono that I and others could be proud owners. Or take one of the sexual abuse recovery newsgroups, where anonymity is the norm. If someone were to post a message asking for support, saying "my uncle did it" under their real name, they would be vulnerable to a libel suit from said uncle. On the other hand, if they used an anonymous service such as the one in Finland, they would not simply escape punishment for the libel, but prevent it from happening at all. In many countries (and even China is on the Net these days), writings critical of the government, such as exposure of human rights abuses, are illegal. The authors face imprisonment, torture and death. By posting anonymously to the Net, the information can be brought safely to the attention of the world. Not all anonymous messages are pleasant or popular. Unpopular speech is a necessary consequence of free speech. At least to the founders of this country, the benefits of free speech outweigh the discomfort. Our founding fathers were also comfortable with anonymity -- the Federalist papers were originally published under the pseudonym Publius, because the authors felt the ideas should stand on their own, without opinion being swayed by the names behind them. Judging from the materials already published by Ms. Siegel, an Internet built according to her vision would be free of such disturbing ideas, but would readily support five hundred channels of green card ads, impassioned pleas to purchase American flag plaques, and, yes, anonymous testimonials for radial keratotomy specialists. ------------------------------ Raph Levien is a graduate student in computer science at the University of California, Berkeley

1 0

Media watch
by A.J. Janschewitz 17 Dec '03

17 Dec '03

NPR's "Weekend Edition/Saturday" has an insubstantial piece on Phyber Optik on today's program, check local NPR times/listings. Nexis-hunters might want to check out a manifestly stupid editorial in today's Hartford (CT) Courant, significant only because it is the (L-A Times-owned) paper of record in the state of greatest wealth in the U-S. I would summarize it, but I don't understand it; something to do with shrink-wrap copyrights and digital cash. Fax copies sent to interested parties, just give me a number. ==a.j.== "The large print giveth and the small print taketh away." - Tom Waits

1 0

Re: How do I know if its encrypted?
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

Paul, I think we're after two different objectives here. You want Alice to be sure that Dave can't read her file; I want Dave to be sure that he can't read Alice's files. Alice should worry only about her privacy: if she doesn't want Dave to know what she's sending, she should encrypt her file in a way that Dave cannot break. Dave certainly doesn't want to know what Alice is sending him, because he might have to answer to a Grand Jury if he did. My protocal makes it very difficult for Dave to gain any useful knowledge about Alice's files. Dave does this not as a courtesy to Alice, but for those three wonderful letters, CYA. Of course, any data haven worth paying for will offer lots of neat features, like PGP support, anonymous file drops, and all other sorts of goodies. But that does little good if Alice can trick Dave into selling child pornography. Douglass Floyd asked, "How do I know if [be certain that] it's encrypted?" Unfortunately, I'm pretty sure the answer is, "You decrypt it." My protocol at least delays the decryption until it's [hopefully] too late to matter. b& [Here's part of the thread; nothing new follows.] At 11:00 PM 1/13/95, Paul J. Ste. Marie wrote: >At 10:07 PM 1/13/95, Ben Goren wrote: >> ... Alice hashes her file and uses that hash as the key to encrypt the file. >>She sends the file to Dave, and sends the original hash when she wants it >>back. Dave decrypts, and confirms the hash. >> >>Unfortunately, this still doesn't quite close the loop--Dave knows the >>contents of the file once Alice sends the key. It does, however, make it >>very difficult for Dave to know anything about Alice's file. ... > >This seems overly complicated. If Dave has a known public key, then Alice >should be able to hash her file, sign the hash, encrypt (the hash, her >public key, and the file) with Dave's public key, and (anonymously) sends >the result to Dave's (encrypted) address. Dave then decrypts, verifies the >sig, and stores the file, hash, and PK together, indexed by the hash. > >When Alice wants the file back, she signs (the hash and her encrypted return >address), encrypts the result with Dave's key, and sends it off. Dave >decrypts the request, fetchs the public key based on the decrypted hash, >verifies the signature, encrypts the file with Alice's provided public key, >and sends it back to the encrypted return address. > >To avoid Dave's knowing the file contents, Alice can encrypt it before the >described protocol and decrypt it afterwards. The protocol is subject to a >replay attack, but the result of the replay would cause the file to be sent >to the original sender and not to the replayer. > >The signed hash in the first step prevents people from spamming Dave with >files that have Alice's public key. Alice only requires an encrypted >address and public key for Dave, and Dave validates the retrieval request >against the public sent in the first step. > > --Paul J. Ste. Marie > pstemari(a)well.sf.ca.us, pstemari(a)erinet.com -- Ben.Goren(a)asu.edu, Arizona State University School of Music Finger ben(a)tux.music.asu.edu for PGP public key ID 0xCFF23BD5.

1 0

RE: State of PGP dll?; Encrypted session projects
by Pat Farrell 17 Dec '03

17 Dec '03

sdw(a)lig.net (Stephen D. Williams) writes: > What is the state of the Windows/.dll PGP libraries? > Does anyone have a usable version yet? I helped David get a compiled version of a .DLL, but it was way too raw to use. Specifically, all we did was make a DLL of all of the code, exporting all of the subroutines. A usefull .DLL would only publish the "important" ones, and leave the internals hidden. The selection of which routines need to be classified as "important" is a bunch of work. Additionally, I expect that some of the routines would really be better off with a wrapper that made less of their internals visible. All quite doable, but a non-trivial effort. I know I'm too busy to attack it. > For Windows: twnsck12.zip, which is simple, is GNU, and has source and > by writing a relatively simple windows serial terminal emulator and > using Comt ($15 or 25 shareware) to convert it to a telnet client. > Both of these could be modified fairly easily. There are sources to a simple terminal emulator in the MSVC samples directory. Changing it to use sockets wouldn't be all that hard. Last time I looked, comt didn't work under NT, and so I stopped looking at it. There are also terminal emulators in the code in at least two books, Monk's Windows Programmer's Guide to Serial Communications, and Nelson's Serial Communications, a C++ developers's Guide. Since I'd much rather write C++ than C, I prefer Nelson's. I use ewan as a terminal emulator, got it from cica or wustl, I forget which. Dunno if sources are availavle. > Does anyone have better ideas? Any suggestions on login/key > exchange sequence? SKey would work if you are talking to a unix box that you can get the admin to change. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Slogan/procmail help
by jsled＠free.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Speaking of testing stuff.... After my last question about C'punks slogans, I've messed up some stuff and haven't storage of the list since, therefore I don't have any of the replies. If anyone would like to compile a list of what's been said (if anything) and mail to to me (to jsled(a)ctp.org) I'd be eternally grateful. Also, if anyone is fluent in procmail (I think there are a couple of you floating around), please mail me at jsled(a)ctp.org... Thanks a bunch, sorry for the annoyance. Joshua M. Sled <jsled@ctp.org/jsled@free.org> -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLxfoaaTT29daLBKRAQGXlQP/dYc4aPR7rNApmqG78jIDhYZJh6bqMg4i AXVAAZ5IzLP4Z/qch7zkiTM05DjbmXOzkcVBmhlGlO+H2VfNug569A/jEKFnDrDs wg0Rv5mPWLo74zUECHxp7faviAVmOxt7Bx3JzQCmHZXBekq+owUetEraq9hKzCzr qQR+KUq3X+k= =4gq8 -----END PGP SIGNATURE----- --- þ KWQ/2 1.2g NR þ "MTV get off the air!" - DKs

1 0

Re: Cybersmut
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

John Young quotes NY Post on Kiddie porn: Rule No. 1 is that [kids] must never ever give their real name, address or telephone number to anyone on-line. Hurray! Let's teach the next generation the value of pseudonymity now! BAN TRUE NAMES! Note: I still have mine in my sig though... too late for me. Tim's axed his phone # suddenly! ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Data Havens, NOT!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Hal Finney writes: > The data haven concept as I understood it held data for public access in > some form (for sale or for free) which would be illegal in some > jurisdiction. This might include credit information that was older than > the legal limit, libelous claims, damaging medical records, etc. > Frankly, I suspect that most usages would be directed towards reducing, > rather than increasing, individual privacy. So this is not an area I am > interested in working towards. I believe the Data Haven started out as a Message Haven to get the effect of anon remailers with less traffic analysis hassles, so there would be no pseudonymous login or anything, you'd either download everything, or apply some filter (as with an alt.anon-messages group). However, the current discussion of glorified remote file systems makes no sense to me. If you can keep something encrypted on a remote site as an archive, you can do it at home. A data haven is more likely to get busted than your home PC; serious efforts (RF pickup of keystrokes/display) will be equally effective in either case. Here's a summary of data havens as I see them: Remote file system where people can anon/pseudonymously dump and read files - in the 'pure' variety there'd be no record of who posted/can read a file. Advantages: 1. Could hinder traffic analysis, if they did not have pseudonymous login in any form. 2. Could act as a store of encrypted data for those who can't/don't encrypt on their own systems 3. Could act as a backup OTOH: 1. Would depend on 'correct usage' ie download of enough irrelevant cover data, and would be vulnerable to analysis at the TCP/IP level. Newsgroups remain far better as means to evade traffic analysis 2. Don't keep all your encrypted BlackNet commodities in one basket - it can be busted more easily than your home machine. If you can encrypt there you can encrypt at home; if encryption is illegal at home, you can't legally access the havens. 3. Pfaugh! Rent space on Netcom. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: How do I know if its encrypted?
by Hal 17 Dec '03

17 Dec '03

If you want to not be able to read the files on your storage site, then why not just try reading them? Check their entropy to make sure it is maximal, check that they can't be unzipped, unstuffed, displayed as gif or jpeg files. When a new format becomes popular add that to the list. This is all you can do. What does this gain you? I'm not sure. If someone posts encrypted Windows 95, then publicizes the location and the key, people will get the data just as easily as if it were not encrypted. Hal

1 0

voice pgp
by Loren Fleckenstein 17 Dec '03

17 Dec '03

I've heard mention that Phil Zimmermann was going to demonstrate Voice PGP at the January Cypherpunks meeting at Cygnus. Can anyone mail me a note about this? Has the meeting already taken place? How well did the demo perform?

2 1

Self-service computers
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

A friend of mine forwarded this to me; I couldn't resist forwarding it to the list. b& ---- Date: 4 JAN 1995 16:32:23 -0500 From: Kay Lukens <klukens(a)halcyon.com> Newgroups: alt.humor.best-of-usenet Subject: [pdx.general] Re: Keep self-service COMPUTERS out of Oregon! From: keithl(a)chip.klic.rain.com (Keith Lofstrom) Newsgroups: pdx.general,or.politics Subject: Re: Keep self-service COMPUTERS out of Oregon! It has been pointed out by the stalwart defenders of our rights (to be told what to do) that self-service for gasoline is a Bad Thing. We are assured by many of the same people that self-service for pharmaceuticals, personal defense, transportation, and education are also Bad Things. Other folks, nominally their political competitors (in the same sense that Burgerville and Burger King are competitors) assure us that self-service in personal morality is an *extremely* Bad Thing. And look at what happened to Joycelin Elders when she suggested self-service for sex... >From this, we must conclude that self-service is in itself highly suspicious. Look at self-service grocery stores - all the time people are buying things that are bad for them. Self-service entertainment has resulted in Beavis and Butthead. And look at the way many computer professionals dress - if this is not an indictment of self-service apparel, what is? However, in the finest tradition of bureaucratic micromanagement, we as computer professionals are not qualified to even consider these effects on other aspects of Society. Such thoughts must be reserved for Wiser Heads Than Ours (unless of course the subject is economics or nuclear power, in which case Our Opinions Count). No, we as computer professionals must confine our thoughts to self-service as it affects us - through our flagrant, dangerous, and socially irresponsible use of Self-Service Computers! Self-Service Computers: Threat or Menace? Carpal Tunnel Syndrome. Backaches. Obesity. Bleeding Piles. Bill Gates and Steve Jobs. Computers are a known health threat. Reputed Scientific Journals, such as the National Enquirer, are full of stories of people being turned into three-headed cabbages by Nucular Radiation from video displays. It is obvious that the average computer professional, while quite able to find obscure flaws in Pentiums or the secret levels in Doom, is a helpless incompetent when it comes to actually typing on or reading from personal computers. We get so caught up in our alleged thinking that we don't notice our bodies turning into rickety tubs of cancerous lard. We Need Help! Meanwhile, the Great Unwashed Masses are being deprived access to the Information Super Duper Highway. Confined to low paying jobs as sanitation workers or Congressional Representatives, these poor wretches are unable to share in this cornucopia of undocumented, virus-ridden software, poorly informed opinion, and stolen pornography that we call the Internet. These outcasts of the information age must fritter away their time which such mind-numbing activities as outdoor sports, rampant sex, and junkets to the Caribbean. When these people accidentally find their way onto the Internet, perhaps by mistakenly sending their rent check to America On Line, they begin posting meaningless, inappropriate drivel such as spam advertisements for shady lawyers, or actual referenced facts from original sources, violating the hallowed traditions of the Internet. While all citizens must have access to the Net, LET'S NOT GET CARRIED AWAY HERE. What Should We Do? (That is, how can we find new excuses to control other people with minority opinions?) The only solution is to ELIMINATE self-service computers! Every computer in the State of Oregon *must* be operated by THREE OR MORE people - one to do the thinking, one to do the typing, and one to read the screen - preferably through a foot of leaded glass! Think of all the jobs this would create! Not only would we have jobs for all the new operators themselves, we could create vast new bureaucracies to insure that the operators are specially trained, certified, and licensed! Computer Cops could roam the streets, equipped with special Jolt-sniffing dogs, breaking down the doors of self-service scofflaws! Pizza delivery drivers would find new income and respect by turning in their hacker clients! Elizabeth Furse, famous for not reading her own email and for having flunkies type in press releases, will become our shining symbol of the new, socially responsible computer age! You can help. Send your checks to C.A.S.H., the Committee to Abolish Selfservice Hardware, care of me (thnx Frank). I will see that your donation gets the attention it deserves. And on behalf of all of us here at C.A.S.H. (Arnold who handles the left side of the keyboard, Julia the right side, Millie the punctuation, Sam who reads the verbs, Trevor who reads the nouns, and our shop steward Penny, who is lobbying for a government grant to bring in a mentally-challenged lesbian vegetarian special needs hispanic-surnamed person of color to watch the blinky lights on the modem) may you have an appropriate and socially enlightening seasonal celebration! -- Moderators accept or reject articles based solely on the criteria posted in the Frequently Asked Questions. Article content is the responsibility of the submittor. Submit articles to ahbou-sub(a)acpub.duke.edu. To write to the moderators, send mail to ahbou-mod(a)acpub.duke.edu. -- Ben.Goren(a)asu.edu, Arizona State University School of Music Finger ben(a)tux.music.asu.edu for PGP public key ID 0x875B059.

1 0