December 2003 - cypherpunks-legacy

Re: Here it is; bi-directional dining cryptographers
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Context: Bidirectional DCnets, Alice and Bob simultaneously transmitting to each other. Interesting approach, though you do have to schedule it somehow. It's a different take on the uses of DCnets - the original was for an anonymous-1 to many rather than a 1 to 1 with only the two participants knowing, though in the first case the recipient can be known only to the sender if they want to arrange things that way through shared secrets or whatever. At 01:31 PM 7/17/95 +0100, Rev. Mark Grant wrote: >Yes, but presumably it's expected that they would be using secure >encryption on the messages that they're sending. That might still provide >some information about the message for traffic analysis, e.g. if you send >a PGP message you have your key-id at the beginning, and if you knew the >keys of all members of the DC-net you could XOR them and see who's >talking to who. Presumably people will use multiple key-ids on the net as well - Alice may have a general-use "Alice" key, and maybe also a general-use "Medusa" key, but Alice or Medusa may have also arranged with Bob to use a different key for traffic where he doesn't mind if she knows he sent it and he doesn't want anyone else knowing it's being sent to her. Also, he can do this anonymously, so she doesn't know either: Alice posts Plaintext("Hi, I'm Alice, key AAAA") Bob posts Encrypt(AAAA, "Hi, Alice, I'm Dr. X, Key XXXX, please post a key I can use to talk to you") Alice posts Encrypt(XXXX, Signed(AAAA, "Hi, Dr. X, use key AXAX")) Bob's message lets him send stuff to Alice without anyone, including her, knowing it's from him, since the name X and key XXXX are new randoms. Alice signs her response so Dr. X knows that key AXAX will really go to Alice and not to Mallet who's impersonating Alice; she doesn't really care who X is. If traffic analysis is a concern (Alice noticing, for instance, that she's getting a _lot_ of requests from key AXAX for her remailer to send stuff to destination ZZZZ), Bob can keep sending her new requests for keys and ids, and not reuse them more than he thinks is safe. >I'd have thought the most significant problem would be reserving the >blocks in an anonymous fashion while not allowing denial-of-service >attacks. Since anybody can send bits at any time, and nobody can tell who without lots of collusion, you can't prevent denial-of-service (well, I assume not, unless there's something rather non-obvious in the literature.) The Bad Guy can decide if it's more fun to jam the reservations or the messages. What reservation does for you is gives a short inefficient period (with possible collisions, backoff-and-retry, etc., depending on algorithm) that you can use to reserve a longer one-user period for message traffic, so you can spend most of your time talking instead of haggling over interruptions. One way to do reservations is to use some variant on Slotted Aloha for the reservation period - for example, everybody picks a random id number for the session, (with odd parity or odd high-bit to make collision detection easier), waits a random number of slots, and then sends their id number. If there's a collision, wait and retry, maybe with exponential backoff. After the first slot that's got data and looks like it doesn't have a collision, anybody who thinks that it was their number picks a different number, waits a short random number of slots and posts; first one wins. (If you're using 32-bit randoms and have fewer than a million players, the chances of two undetected collisions in a row are really small, even if people cheat a bit on their backoffs.) Winner announces how many slots he's going to use up for his message, so you know when to start again. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

2 1

Re: Anti-Electronic Racketeering Act of 1995
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 06:06 PM 7/17/95 +0200, Hadmut Danisch wrote: >1. If the bill becomes law, how can someone who violates it be >punished? Only by violating the Constitution and basic common sense, but that doesn't usually bother the Government very much... >2. Does someone who publishes software which encodes or encrypts >(ASCII is a code, isn't it?) have to prove that he has provided the >universal decoder to the state or does the state have to prove that he >didn't do? It's not defined in the law, and if the good Senator writes stupid offensive laws which are so stupid that they have big holes in them like this, I don't intend to correct him :-) >In the former case, does he get any receipt from the department of >justice and what does the receipt say (1.3MByte of software >received...)? Nobody knows. >In the latter case, how do they want to prove he didn't? If he gave >just a big > for(i=0;;i++) try_key(i); >how do they want to prove this doesn't work? [... halting problem...] The proposed law doesn't say that the mechanism has to decrypt the message in a short period of time. If the law passes, I'll be happy to help write the PGP Universal Decoder program for anybody who needs it to take to court. Some kinds of program are affected by the Halting Problem; other kinds are easy to show that they halt. For the PGP Universal Decoder, trial division can find the factors for an N-bit key in much less than 2**N tries, if you program it well, and you know it will halt by then, if the Universe hasn't decayed first. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: Root Causes Roots
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 02:08 PM 7/17/95 -0400, Jim Ray wrote: [ Crypto timeline and discussion omitted ] >Careful thought reveals a atrong suspicion that the "3/5ths people" >[slaves] had more use for crypto at the time than free white males >did, but I doubt much, if any, evidence of that activity was >preserved, and I'm sure it was _forcefully_ discouraged if ever >discovered...My point is, slaves, or those who live in fear of >eventual slavery, for whatever reason, have a strong affinity for >cryptography. Note, for example, early use [mentioned in the timeline >above] by the Jewish people. Or, more precisely, they have a strong affinity for private in-group communications. Cryptography's a bit tough in an environment where it was often illegal to teach slaves to read. On the other hand, oral cultures are often good at using metaphor and in-jokes and shared knowledge to express things that the speaker doesn't want the oppressive group to understand. I've seen commentaries talking about that in North American black culture, and there are other examples like Cockney rhyming slang. And then, of course, there are totally incomprehensible communication systems like Gaelic :-), which the Brits tried hard to stamp out. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: Is it legal for commercial companies to use PGP?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 09:07 PM 7/17/95 -0400, tim werner wrote: >>... I was talking to one of the sys admins at >>A-B, and he said that we weren't allowed to use PGP to encrypt our mail, >>because Viacrypt owned the commercial rights. Actually, it's less clear than that. It's pretty clear what you can do with ViaCrypt code; just read the license to see who can use it, and you can send any kind of messages you want over it, even for money. On the other hand, the definitions of "non-commercial use" for RSAREF and IDEA are far less clear (and they're clearer for RSAREF than for IDEA, and I got the impression from what I read somewhere on the net or in the PGP docs that the initial permission from Ascom-Tech for use of IDEA with PGP was pretty informal, and that they've been trying to tighten up what's covered.) (Also RSAREF licenses have changed from version to version, and the license PKP uses to distribute versions of RSAREF may also have changed?) Selling software containing the code is pretty clearly commercial. Non-commercial messages from your personal non-business machine are clearly non-commercial. Providing a service of encrypting and decrypting messages for people for money sounds like it's _very_ probably commercial. Encrypting and decrypting messages to/from your business that deal with money are a very gray area. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: bi-directional dining cryptographers
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 12:24 PM 7/17/95 -0500, Phil Fraering wrote: >I'd also like to point out that this system indicates that during >an attack/disruption on a traditional dc-net, the disruptor can >tell what the original person was trying to send, even though noone >else can. > >And then perhaps XOR the data with something offensive, and if the >original sender tries to re-send, broadcast the result of the XOR, >resulting in a total net output of the offensive material. That's difficult - you have to identify that the sender is sending the same message while the message is being sent, rather than one or two bit-times later, and you can't fake encryption with an unknown keyid or digital signatures. (Digital signatures aren't something everybody would use very often on a DC-net, since the purpose of the net is to be anonymous, but since you can do anonymous broadcasts, you can anonymously post a signature key for your nym if you want to.) Also, there's no need to combine jamming and posting an offensive message; they both work well separately. I suppose you could do that if you only want to harass the net a bit (e.g. replace all trafic to remailer X with new remail to whitehouse.gov, or replace all postings from Cancelmoose with complaints about censorship), but basically DCnets degrade rapidly if the social structure of the net members does. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

2 1

SurfWatch for employees (ugh)
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Consistent with the trend towards treating employees like children, Webster Network Strategies has announced (but apparently has not shipped) a product similar to SurfWatch but aimed at an employment environment. The product is called "WebTrack" and supposedly supports access lists of URLs, where access can be allowed to "all but these sites" or "only to these sites". The product also can be configured to log all Web usage by users subjected to its reign of terror. :) WebTrack is priced at $7,500 with an annual subscription to its list of interesting (err, forbidden) sites priced at $1,500. The article in the 7/10/95 Infoworld doesn't list contact information for Webster Network Strategies. What is it, two months between deployment of software designed to restrict net access to one segment of the population perceived as especially vulnerable and the subsequent application of that technology to other target groups? My bet is the next target group will be university students, followed by "affinity marketing" with various repressive organizations (whose names I elide in the interests of greater Cypherpunk harmony, pick your own and imagine them here.) Of course, the next step is to use restrictive licensing/distribution terms (a la Netscape/Mozilla) and a nifty freeware/software package available only from a site which also carries porn (or other forbidden fruit) to make the customers/purveyors of this crap twist in the wind a bit. Break the terms of the license and get the software somewhere else? Avoid using the coolest new thing because you're hooked up via we'll-think-for-you.net? Doh. (Pedants need not point out that personal choice (and personal filtering) are always appropriate, and indeed empowering. Neither WebTrack nor NetSurf are marketed to help people subject themselves to a regime of repression - they are intended and sold to allow the purchaser to control what others (perceived as having fewer or no rights) will read and view. ". . inasmuch as you have done it unto one of the least of these my brethren, ye have done it unto me." Matthew 25:45) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMAtWUn3YhjZY3fMNAQH8EAP/aFXe7uI1EuIB31L8h7H+5l3Mg1aQE7e9 i86FnqwGMDg5JlDvJD05dXOBXeInvKtc6ZD0Us+qwDmg2ISo/Yu0QCfedTBgZ7fq s/3WFwtOcpiBG7YTkxGJrvB+r4KIgodb9QSGEQ8yofKaRLT33IkgO3ijxrnyoNkX vm/tZ8EnoV0= =hrOo -----END PGP SIGNATURE-----

3 2

Re: "Judgement Proof" and Putting Up or Shutting Up
by an250888＠anon.penet.fi 17 Dec '03

17 Dec '03

>> >and, conspiracy theories non-withstanding, we the people do not govern >> >America --we are only given a short list of politicians who have sold >> >their soul to CFR's satanist inner circle. >> >> What's CFR? >> > >Council on Foreign Relations. or Code of Federal Regulations. ---------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. If you reply to this message, your message WILL be *automatically* anonymized and you are allocated an anon id. Read the help file to prevent this. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

WebTrack URL/Contact Info
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

The WWW site for Webster Network Strategies and its WebTrack software is http://www.webster.com/ According to that page: How to reach us: E-mail info(a)webster.com Call (941) 261-5503 Fax (941) 261-6549 Write to WNS, 1100 5th Avenue South, Suite 308, Naples, FL 33940

1 0

SurfWatch for employees (ugh)
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Greg Broiles <greg(a)ideath.goldenbear.com> writes: > Consistent with the trend towards treating employees like children, > Webster Network Strategies has announced (but apparently has not > shipped) a product similar to SurfWatch but aimed at an employment > environment. The product is called "WebTrack" and supposedly supports Forcing workers to keep their minds on their work? Shameful... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://norden1.com/~jim/sylvania.html iQCVAwUBMAu7mN74r4kaz3mVAQEWhgP9FDkAtsbPMVk5/FTCGaImFu7Iqllw0Y55 Rv2gXxVdiYKmK449i1+PQhJvpnLJE5qVRqMeCjhcysrbI/WK9RUDP+6FVenfDjWZ Kxh385qzNWE1sJTv92ii3g4dbIp7yziePJc9ZH6HqZ9i1MAyQfjEPutNcE5xgLSH hBUYN0Q1cPE= =l0BB -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)voxbox.norden1.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programing, Information brokering

1 0

Is it legal for commercial companies to use PGP?
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- jgrubs(a)voxbox.norden1.com (Jim Grubs, W8GRT) writes: > As I recall, the following is a correct scenario: a customer can use PGP to > send credit card numbers to a vendor he's making a personal purchase from, > but the vendor must use Viacrypt. If the customer is buying something to use > for business, BOTH must use Viacrypt. In practice, I'd probably buy Viacrypt for legal reasons but use PGP anyway. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://norden1.com/~jim/sylvania.html iQCVAwUBMAu5iN74r4kaz3mVAQF11QQAiNccy69sb5OA1jmOpErqqZNJ4sNx3smW tAJQ3lD1op4qlPIO48vxwkvr+IaQyyOkf797+9Ca1z9WtxgwSamo32BQnPQZ6Pbm Vipmpwrabrxq67TOrGgxNp3UN7oBZl3eyad0hIj6ENzs8u1wi3wkHUV/3z341XB7 u953orkOZSk= =UYrt -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)voxbox.norden1.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programing, Information brokering

4 3

Mondex (forward)
by Rev. Mark Grant 17 Dec '03

17 Dec '03

Thought this might be of interest... forwarded with permission.. >From Andy Meredith (meredith(a)bcs.org.uk) on the ecm list : On Jul 18, 9:21am, Marcel van der Peijl wrote: > Subject: Re: e$, c$$$, Cyberbucks & ECash - terminology. > > > electronic cash (also digital cash) is a general term for > > > the concept of encrypted messages that have inherent value > > > - as opposed to credit notes or electronic checks. I guess > > > that the Mondex smart cards have ecash in them, but that > > > seems different. > > I am such a bad reader! You are right. This is a good definition > of electronic cash or digital cash. Mondex is questionable. The > card has an account, and uses crypto to proof it is a real Mondex > card, so you'd better believe it when it says it took the money > of it's internal balance. I would vote this is not digital cash. I am participating in the Mondex pilot scheme in Swindon. It took me a great deal of pushing to get _any_ details at all. The details I did get didn't go into the encryption schemes used or any such fun stuff. It did in fact take quite a while for me to realise the significant differences between ecash and Mondex. As they didn't, in the end, make me sign an NDA, I guess I can share. 1 - The Value is not encrypted on the card, that is held as plain text, it is the front door on the card that is heavily guarded. If therefore you can inject value into the card from the back door, it is then taken as real money. The logic being; Hey it managed to get through all that security which is imposible for anything except another mondex card to do, it must therefore be Mondex money ... that's Ok then. There can never be a software only version of Mondex as it stands. The trust is in the front door, not the cash values themselves. 2 - Some of their transaction monitoring is very "Big Brother"esque. As you can imagine, if a card is seen to be creating money but not consuming it, there IS a problem. Therefore whenever you get some money from a "hole in the wall", the bank sucks over your transaction log & error log. It will of course only ever use this for security monitoring. It will never follow the likes of AMEX and start stock pilling these transactions, using it's knowledge of the which physical entity own what card ID, and using the cross reference for market research/direct mail/consumer profiling. No of course not. That would be TOTALLY unethical ... 3 - Mondex is billed as "Electronic Cash", but you won't find the concept of anonymity in there anywhere. They talk about it, but I haven't seen them write it down explicitly. One could suggest however that that "Cash == Anonymous", so the scheme would have to be anonymous for them to have a right to the "Electronic Cash" title. > So what is the name for schemes like this? How about "Stored Value Card" >-- End of excerpt from Marcel van der Peijl One interesting thing that I noted. When I read through the technical blerb on ecash a while back, I had to sit back and think very clearly, and read very slowly. However, it was relatively easy to understand the bits, and then even easier to put the bits together into a system. The reason, I suggest, is that if you understood all the encryption technology behind ecash, and had the requirements that it has for anonymity and security (hand in hand). You would reinvent ecash. Maybe the layering would be subtly different, the real one ond your independant derivative wouldn't interact, but ... If however you were to have asked me to explain ecash a week later, I would have been totally stumped. It is a very elegant system. Mondex, on the other hand, worried from the word go. It just didn't seem to add up. Apart from everything else, why were they being so damned secretive. I read and thought, and read and thought. Then it finally dawned on me. Mondex just simply doesn't have the same requirements list as ecash. I was prejudging the requirements from my previous exposure to ecash. Ask me to explain Mondex to you now ... what do you want to know :) Andy M (this is my opinion of information gained outside of company time. It is not the opinion my employer.) And : On Jul 18, 12:29pm, Marcel van der Peijl wrote: > Subject: Re: Mondex > > I am participating in the Mondex pilot scheme in Swindon. It > > took me a great deal of pushing to get _any_ details at all. > > Of course! Security through obscurity has always been a good way of > protecting your systems... ;) Absolutely. That's why VISA have lost so little money :) > > 3 - Mondex is billed as "Electronic Cash", but you won't find the > > concept of anonymity in there anywhere. They talk about it, > > but I haven't seen them write it down explicitly. > > Hahahaha. Let me explain. You can buy the card anonymously. This > gives anonimity.... > NOT! Actually, you can't. You need to supply bank details in order to get one. At least you do for the Swindon trial. The cards in use here are in fact combined ATM and Stored Value ;) cards. They have all your bank details in a mag. stripe on the back of the card. The current batch of EPOS terminals don't use this stripe, but I wait with interest. > They are forgetting that tracebility plus one link of a person to an > 'anonymous' account is the same as identification. Sainsbury's (et al) sussed that one a while back. Hence the introduction of "Customer Loyalty Cards" (yuch!!). Thereby allowing them to bind purchases/times/locations => Credit card numbers => Physical customer addresses & therefore demographic data. Only in this situation for Credit card number read Mondex card ID. > Do you realise any ATM, and a lot of stores, have security camera's > embedded? No, they wouldn't use that to link a person to a card, > would they? That would be unethical... No need. They have not only formed the link, but they are getting you to fill in the damned form :) > > How about "Stored Value Card" > For Mondex, perfect. What about FV? And NetChex? Don't know about these ones. > About your perception of ecash: I admit that the blurp on our server > does not fully cover the system in such a way it is easy to remember > and explain. Not at all. If you had asked me to explain the system while it was still fresh in my mind, I would have had no trouble. It is very neat and logical, but it is also pretty intricate. Apart from anything else, I didn't feel it was necessary to hold on to the mental model of how it works. I liked it. However, Mondex ... >-- End of excerpt from Marcel van der Peijl Cheers Andy M

1 0

AYN_ran
by John Young 17 Dec '03

17 Dec '03

The New Yorker, July 24, 1995: "Twilight of the Goddess." A critical look at Ayn Rand and her work. Thirteen years after Rand's death, her books still sell more than three hundred thousand copies a year. Not since the popular novels of almost a century before, bent on refutations of Darwin or God, and offering what George Eliot called "a complete theory of life and manual of divinity, in a love story," had there appeared so vividly accessible and reassuring a guide for the cosmically perplexed. As late as 1991, the Library of Congress found that a majority of Americans surveyed named "Atlas Shrugged" as the book that had most influenced their lives, after the Bible. AYN_ran [About 57K, in three parts]

1 0

Re: S. 982 Kyl-Leahy(-Grassley) NII Protection Act
by Carl Ellison 17 Dec '03

17 Dec '03

I read it and it looks OK -- except, as I said in e-mail to Senators Kyl and Leahy, we can't let ourselves believe that legislation can keep computers safe from hackers. Many of these threats are outside the reach of US law. Instead, we need good firewalls, encrypting file systems, etc. - Carl

1 0

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by Peter Trei 17 Dec '03

17 Dec '03

> I remember one of the sponsors of the CDA ranting about pornographers > "profiteering" from pornographic images on the Internet, blissfully unaware > that stuff downloaded from alt.sex.binaries.insert.your.fetish.here doesn't > profit anyone but the phone company (for the hours you stay online to get > it). I called up Exon's press secretary and asked him about this. He claimed that BBS's were uploading advertisments to the Net, and this was the 'profiteering' referred to. He was immune to reason on this, and felt that the CMU 'study' was rigorous. It's true that a some of the pics in those groups include stamped-in BBS names and phone numbers, but my impression was always that this was the BBS operators trying to do a little damage control - so that when random users post their pix (on which they claim copyright, ignoring the fact that most of their scans rip off magazine publishers), they can recognize the 'piracy', and also earn a little publicity. For a good backgrounder on the story, check http://www.cybernothing.org/cno/reports/cyberporn.html Peter Trei ptrei(a)acm.org Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

1 0

Re: Zimmerman legal fund
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

> >I just received a bit of mail asking about the Zimmermann Legal >Defense Fund, which, like many folks out there, I support. The writer >implied that he might give money because I suggest it in my sig, but >expressed questions about its legitamacy, and questioned if it's "just >someone trying to exploit the Zimmerman case" > >Could someone in the know talk about the relationship between FV and >the ZLDF? I don't like to spread misinformation, so I won't answer >based on conjectures. > I had similar concerns last month, so I emailed the following to csn.net!dubois ("Philip L. Dubois") > > Could you please inform me of the financial status of the fund > raising for the Phil Zimmerman case? How much money has been > collected, and how much has been spent, and what are the future > anticipated expenses? I might like to contribute, but "a normally > unreliable source" has claimed to me that something on the order of > $50,000 has been spent, and there is not even an indictment yet. > Is this true and is this reasonable? Is it true that some/all of > his legal services are being done "pro bono" (I hope I got that phrase > correct, maybe I should just say "for free") > > If you choose to reply, may I have permission to make your reply public? > > Rick F. Hoselton (who doesn't claim to present opinions for others) > I got back the following reply: > >Mr. Hoselton-- > >Since the government has not yet decided whether to indict Mr. Zimmermann, or at least hasn't >told us its decision if it has made one, we continue to accept donations to the Zimmermann >Legal Defense Fund. I've never added up the total amount of all donations to date, but I >doubt that it would be in the neighborhood of $50,000. I can tell you that several lawyers >have been working on the case and that all of them but me have done so pro bono, which means >that they have not been paid. Since I have been lead counsel and have therefore had primary >responsibility for the defense, I have not been pro bono, at least not entirely; I have not >billed for much of my time. We have no way of knowing how long this case will go on. The >government could tell us today that it won't indict, in which case it will be all over, or it >could indict very soon, or it could do nothing until June of 1996 when the statute of >limitations expires. > >You have my permission to make my reply public. > >Philip L. Dubois >Counsel for Philip Zimmermann > Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0

Re: Anti-Electronic Racketeering Act of 1995
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> >1. If the bill becomes law, how can someone who violates it be > >punished? > > > > - From the top of my head: > Subpoena your service provider's computer records. That's not a problem. He will find a lot of encrypted messages and images of nude girls. Both is not illegal. :-) > Intimidate your roommate > into testifying against you. I don't have a roommate. > Tapping your phone. I use encrypted modem connections and Nautilus. > Feds are in the business of putting people behind bars. They are _very_ good > at it. That's the question. How long can they put me behind bars? > I'm betting that the Feds will adopt as a working definition anything that > requires a key to decrypt the communications. That means compression > software, rot13, and most hash functions are ok. rot13 is not ok, 13 is the key. Someone should register at the department. :-) > Expert Testimony: "We experimented with 113,296 keys chosen at random and > the defendants algorithm took an average of 29,000 years to find each one. > It is our professional opinion, therefore, that the defendant is jacking us > around and ought to be keelhauled". Oh boy, wonderful experts.... Hadmut

1 0

Re: Free The World Web Server project.. :)
by Duncan Frissell 17 Dec '03

17 Dec '03

At 07:10 PM 7/16/95 -0500, David K. Merriman wrote: >> The web page would generate a random letter, allow the user to edit >>it, further (possibly offering the alternate phrases) before he clicks >>on the [Send] button. >> > >If someone in the DC area wants to set up such a system, I'll gladly donate >an Intel SatisFAXion 200 fax/modem, complete with manuals, etc. > >This would be a Good Thing, IMHO. The "Experiment in Remote Printing" had this idea about two years ago. They have well established, free, email to fax gateways around the world (including DC). See their WWW page: http://www.dis.org/fax/faxsend.html DCF "And that is called paying the Dane-geld; But weve proved it again and again, That if once you have paid him the Dane-geld You never get rid of the Dane." Rudyard Kipling

1 0

Re: Automated Rant Generators and Letter Generators
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

David Conrad told me he meant for this to go to the whole list, but only sent it to me by mistake. So here is his post. At 4:14 PM 7/18/95, David R. Conrad wrote: >Tim May <tcmay(a)sensemedia.net> writes: >>Bart's comments about using Knuth's typographic work are interesting, to >>the extent that letters need to look handwritten. In the Mac market, it's >>possible to send in some handwriting samples and get back a font that >>emulates the handwriting! > >I suppose the resulting font has only one form for each letter? (Although >I understand that when you send them a sample, you send several instances >of each letter; a friend was showing me an add for this.) The fact that >each letter is the same every time would be a giveaway. We need something >like Metafont, or at least choose from a number of different shapes. > >> ... So, the combination of >>handwriting fonts, automated rant generators (of varying rabidities), and >>fax capabilities gives a pretty good start. Using lots of handwriting >>samples, various other fonts, and a mix of styles in the letters will help. > >Another factor that would make it appear more authentic would be spelling >and grammar errors. The grammar errors could be built into the rant >generators (an occasional dangling modifier, an incomplete sentence or two); >spelling errors could be done by post-processing the output of the rantgens. >It's important to take into account the different types of spellos that >occur: commonly misspelled words (aquired, beleive); wrong homophone (their, >they're, there; two, to, too); transposed letters (transpoesd); near-misses >on qwerty keyboards (nesr-mosses); and words left out. > >-- >David R. Conrad, ab411(a)detroit.freenet.org, http://web.grfn.org/~conrad/ >Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page >Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 >No, his mind is not for rent to any god or government.

2 1

Re: Root Causes Roots
by Michael Froomkin 17 Dec '03

17 Dec '03

Jim Ray asks what on earth I'm talking about the 9th amendment not applying to the right to write code, since people were using codes to protect their communications long before the passage of the bill of rights. I always understood "writing code" as in "cypherpuks write code" to mean computer code, that is FORTRAN, C++, assembler, perl or whatever. I understand "writing IN code" to be the use of cryptographic tools such as codes or cyphers. Thus my claim that the right to write IN code may have existed in the 1790s, but the right to write [computer] code could not (since there were no computers). Of course, I could be wrong about this, since however you define it, it's debateable whether I'd pass the code test to qualify as a cypherpunk, since I stopped writing code when I gave up programming for lawyering, and I didn't start writing in code when I started writing about codes. In any case it's a matter of definitions, not timelines. Note: I am not suggesting that the right to write code lacks constitutional protection; just that the protection wouldn't come from the 9th amendment. My views on the constitutional right to write IN code, which also does not rely on the 9th amendment, can be found in my Clipper paper, which Hal Abelson has kindly ported in Netscape friendly form to: http:// -- Michael Froomkin until Aug 6: michael(a)umlaw.demon.co.uk U.Miami School of Law London, England mfroomki(a)umiami.ir.miami.edu <-- this will still find me PO Box 248087 Coral Gables, FL 33124-8087 Rain. Sun. Rain. Sun. Rain.

1 0

PINESIGN 2.0: A simple script for PGP signing Pine mail
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- After a couple of comments, I've updated Pinesign to a new version. This new version adds the ability to choose whether your ascii signature (ie $HOME/.signature) is added. Some mail servers get confused by extra text, so the ability to make sure nothing extra is added was requested. Basically, if you want to sign the message both digitally and asciilly (is that a word :-), just press return twice after you exit your composing editor. Otherwise, make the selections you want specific to the type of message you are sending. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= #!/bin/sh # PINESIGN v2.0 # Written by: Robert A. Hayden <hayden(a)krypton.mankato.msus.edu> # PINESIGN is a simple program that will allow you to automatically sign # your email and news messages composed with the Pine 3.89 mail reader. It # may also work with other mail and news programs, but it has not been # tested. # INSTRUCTIONS FOR CONFIGURING PINE # # You need to define the following options in Pine. This can be done # either via the SETUP options in the main menu of Pine, or via editing # the .pinerc. # # A) signature-file=" " (an empty space) # B) enable-alternate-editor-cmd # C) enable-alternate-editor-implicitly (optional but recommended) # D) signature-at-bottom # E) editor=<exact path to this script> # INSTRUCTIONS FOR CONFIGURING PINESIGN # # The PGP program must be in your path, and the PGPPATH environment # variable must be defined. See the PGP documentation for details. # # Double check that the first line of this program points to sh. # # Edit the SIGPATH and PINEEDITOR variables to point at your signature # (if any) and the editor you wish to use for your Pine mail. Default # signature will be the file .signature in your $HOME directory. # Default editor is pico -z -t. SIGPATH=$HOME/.signature-pine PINEEDITOR='pico -z -t' # INSTRUCTIONS FOR USING PINESIGN # # When you compose a message, you will compose your message as normal. # # When you exit your editor (control-X in Pico), you will receive a prompt # asking if you wish to add your signature file to the message. If you # respond with y, Y or just press return, your text signature file (often # $HOME/.signature) will be appended to your message. If you type # anything else, your message will not have your signature added. # # Next, you will be prompted as to whether you wish to PGP sign your # message. If you answer with y, Y or return, you will be prompted for your # PGP passphrase and then dumped back to the address/subject section of # Pine. If you type anything else, your message will not be signed. # # If you selected it to be added, your .signature file will be appended # AFTER your digital signature. # # If you have not defined your alternate editor to be run implicitly, you # will need to start it manually. If you do not run the alternate editor, # your .signature file will not be appended and you will also have to do # that manually. It is highly recommended that your define your alternate # editor to run implicitly. ### DO NOT EDIT ANYTHING BELOW THIS LINE UNLESS YOU KNOW WHAT YOU ARE DOING ### $PINEEDITOR $1 clear echo -n "Would you like to add your ASCII signature to this message? [y] " read SIG echo " " echo -n "Would you like to sign this message with your PGP signature? [y] " read PGP if [ "$PGP" = "y" ] then pgp -sat +comment="PGP Signed with PineSign 2.0" $1 mv $1.asc $1 fi if [ "$PGP" = "Y" ] then pgp -sat +comment="PGP Signed with PineSign 2.0" $1 mv $1.asc $1 fi if [ "$PGP" = "" ] then pgp -sat +comment="PGP Signed with PineSign 2.0" $1 mv $1.asc $1 fi if [ "$SIG" = "y" ] then echo " " >> $1 cat $SIGPATH >> $1 fi if [ "$SIG" = "Y" ] then echo " " >> $1 cat $SIGPATH >> $1 fi if [ "$SIG" = "" ] then echo " " >> $1 cat $SIGPATH >> $1 fi -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.0 iQCVAwUBMAvz9DokqlyVGmCFAQHq6QP9FztYKCL9lV16HWwY3E6bRzyfpqwoqCag o7hvWivmc81uocYzo54fR5sz0pLCOAIAJL6f0ST+cRM/epdfgn/eEovCDQFZXelB 0I9mmhaUVpUdHFGfw8UD0XhuBuPWbsaNbMfYr07IVEddH8zqOKHANG0QLBmc8aVm 6btQbK8/MWE= =wfGX -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> Cthulhu Matata \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> hayden(a)krypton.mankato.msus.edu \/ Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden

1 0

Re: "Judgement Proof" and Putting Up or Shutting Up
by terrell＠sam.neosoft.com 17 Dec '03

17 Dec '03

> >>> >and, conspiracy theories non-withstanding, we the people do not govern >>> >America --we are only given a short list of politicians who have sold >>> >their soul to CFR's satanist inner circle. >>> >>> What's CFR? >>> >> >>Council on Foreign Relations. > >or Code of Federal Regulations. > or Cupherpunks Fuming and Ranting --buford

2 1

Re: A Chronology on crypto bans
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:08 PM 7/16/95 -0400, Dave Banisar wrote: >Attempts to ban encryption 1977-1995 > >1977-1980 NSA Director Inman calls crypto born secret. Should be restricted. >Attempts to use Invention Secrecy Act of 1951 to patent inventions by >academic researchers. Attempts to use export control laws to limit >scientific discussion. >NSA Threatens NSF over grants for crypto studies. I hope that you emphasize the big impact of the IEEE/MIT/Scientific American/NSA/"A Proposal for a Public Key Encryption System" flap of 1978(?). An awful lot of people first learned about public-key/private-key algorithms because of that fight. DCF "You men can't fight in here. This is the War Room." -- Dr. Strangelove (or How I Learned to Stop Worrying and Love the Bomb).

1 0

Re: NRC panel wants questions for Law Enforcement on crypto policy
by wb8foz＠nrk.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In April, gnu asked: > Herb Lin called today to ask if the Cypherpunks could come up with a > list of questions for their panel to ask the law enforcement community > about crypto policy. They will be meeting with senior law enforcement > officials like FBI Director Freeh a week or so from now. Did we ever get any feedback on this? - -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433 -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBMAw6JRqU5+N/mI7JAQEWQQP/UCKWs1m8cMbbG7pAk7CKPjKSAP9yJLvw m+vBFcC+TuFPrQSEjhK7s4qJnck3IzIXl7AmV70NFkr9Dc1Wni7YHkrfhx0nnRRe 7F131pKMNlgypyX/u3FaEHXtCxQV9R5IpYzBAGpvQ++3dzR7LdXcvS2I7kvcWf2G 6knV4KwHvp4= =9+ER -----END PGP SIGNATURE-----

1 0

Re: SurfWatch for employees (ugh)
by sbryan＠maroon.tc.umn.edu 17 Dec '03

17 Dec '03

At 11:36 pm 7/17/95, Greg Broiles wrote: [snip] >(Pedants need not point out that personal choice (and personal filtering) >are always appropriate, and indeed empowering. Neither WebTrack nor >NetSurf are marketed to help people subject themselves to a regime >of repression - they are intended and sold to allow the purchaser to >control what others (perceived as having fewer or no rights) will read [snip] There doesn't seem to be any suggestion that an employer will attempt to control net access that you pay and use yourself with your own equipment. What's the problem? As far as net access from work, that will naturally sort itself out. If unfettered access is beneficial to an enterprise then that will become apparent as "repressive" companies prove incapable of competing with "permissive" companies. +---------------------------------------------------------------------- |Steve Bryan Internet: sbryan(a)maroon.tc.umn.edu |Sexton Software CompuServe: 76545,527 |Minneapolis, MN 55415 Fax: (612) 929-1799 |PGP key fingerprint: B4 C6 E2 A6 5F 87 57 7D E1 8C A6 9B A9 BE 96 CB +----------------------------------------------------------------------

1 0

Re: Re: Root Causes Roots
by Michael Froomkin 17 Dec '03

17 Dec '03

The ported URL of my clipper piece seems to have gone spare. He's another try: www-swiss.ai.mit.edu/6095/articles/froomkin-metaphor/text.html -- Michael Froomkin until Aug 6: michael(a)umlaw.demon.co.uk U.Miami School of Law London, England mfroomki(a)umiami.ir.miami.edu <-- this will still find me PO Box 248087 Coral Gables, FL 33124-8087 Rain. Sun. Rain. Sun. Rain.

1 0