December 2003 - cypherpunks-legacy

Re: Remailers, Feb
by Bruce Baugh 17 Dec '03

17 Dec '03

At 11:07 PM 2/22/96 -0500, Bryan Strawser <bstrawse(a)copper.ucs.indiana.edu> wrote: >The differences here are because gondolin.org had serious DNS problems >in January that caused alot of mail to be bounced. Those problems were >rectified.. hence our traffic flows now... Thank you, Bryan! This is _precisely_ the kind of info I'm interested in. >The latency differences are normal for gondolin because we are not on the >net, we get our mail via UUCP one hop away from the internet itself. >Since our polling is fairly irregular, our latency will move up and down >from month to month. Makes sense. And I don't particularly care about variability as long as I have a sense of the boundaries. Which my tests define for me. :-) -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

1 0

Re: url
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Bill Frantz wrote: > > At 2:52 PM 2/22/96 -0500, Perry E. Metzger wrote: > >Mike McNally writes: > >> At <URL:http://www.osf.org/~loverso/javascript/track-me.html> find > >> some interesting "surveillance" applications of Javascript.[..] > >When is the patch to let you disable JavaScript inside Netscape going > >to go out? Its more than time. > > Why Perry, it's called Netscape 1.1N. :-) I think the Options menu in Netscape allows you to disable it already. I only have the 16-bit version running, which doesn't allow it to be enabled anyway. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMS1dZioZzwIn1bdtAQEYcwGAvQEDB1b3YqAiiMFaKzDRzprnfLtTnkHp 7rlxQtd4VtToqDNb4aiDwgTKlgs0tP4+ =dUzI -----END PGP SIGNATURE-----

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by Deranged Mutant 17 Dec '03

17 Dec '03

IPG Sales <ipgsales(a)cyberstation.net> wrote: Suggestion: wait a week until the flames on the c'punks list die down. Have the techie folks there read all of them, think about them, and come up with a coherent and well written reply that addresses all of those issues. Much easier to deal with than attacks from several dozen directions all of the time. > Your point is well > taken and greatly appreciated; in make a hasty reply to but has nothing > to do with anything because at the time I > composed that, I was trying to be vague in a deliberate of > obscrurantism,because Derek, alone amoung you seem to understand what was > going on - and I made a stupid bluder - I can do nothing about > that except to apologize, admit it freely and take my medicne from > Perry and the others - > > I can assure you that the quoted three > lines are not a part of the algorithms, and have never been. I > hope that you will forgive me for such a stupid blunder. I hope that > such stupidity on my part does not close your mind to even looking at > actual algorithms - the question is to determine justice being > vague, and trying to decide to what to do about releasing the algorithms - > Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

2 1

Expect A Wave of Killings of Journalists....
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:36 PM 2/22/96, John Young wrote: > 2-22-96. TWP: > > "CIA Can Waive Prohibition Against Using U.S. Clergy Abroad > for Covert Work." > > A controversial loophole permitting the CIA to recruit > American journalists as agents also allows the agency to > waive a similar 19-year-old ban on employing clerics or > missionaries. An official also disclosed that CIA > regulations prohibit recruiting employees of members of > Congress or congressional committees "without the > approval of the member" for whom they work. I watched CIA Director John Deutch (or is it Deutsch?) explain today just how the rules are being relaxed on having journalists as CIA operatives, and I could practically hear a collective "Oh, Shit!" echo from the journalistic capitals of the Second and Third Worlds. Even when journalists were reporting to the intelligence agencies, they like the convenient fiction that such practices were forbidden. Even so, a couple of journalists were tagged by the governments they were spying on and disposed of. Expect this to increase. Except now it will likely be Russian Mafiosos garrotting the "Washington Post" economics reporter in the back alleys off the Arbat. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: "consent of the governed"
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- "Vladimir Z. Nuri" <vznuri(a)netcom.com> wrote: >I tend to define government more liberally in that it does not >merely exist to protect rights-- Since it is a man-made, created entity, on what vision of reality would you justify the existing principles of our collectivistic-oriented govt? >the 20th century saw a rise in >government that tried to be a social force. The govt consists of a few individuals. >this may have failed, >but it does point out that people want a government to do more >than merely protect their rights. By 'peoples', do you mean productive population at large or a small bunch peoples who want their wishes to come true, no matter how many .38 special bullets it costs? > in other words, the 1776 definition >of government is reasonably slightly modified. ^^^^^^^^^^ ?!?!!! Would another adjective be more appropriate? >government in its >essence is a form of organized human collaboration/cooperation imho. Yeah! With, ultimately, a *gun* under every pile of red tape, just to make you "cooperate" more easily.... >it is a nervous system for a society. Yes! And it has epilepsy! JFA -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMSzkYAOWptJXIUrtAQHdbwP+Kh7tCFRExtvWxxdkVG5nyuRDr8/PgAj6 jle8Rvh2ysGMwPyZguoBb8Hz0N9xp3pPEspAUcrvB6JsDo0mQUQ8Rf/zM420Yfvk 8xP5I/+H7PhZF8MbmjoFN3pIjywBi9YFykuLSlsg5snqBBSTi9EjcCiL79WfSpng oM4XVYmTgpc= =IQZn -----END PGP SIGNATURE----- **** NEW PGP 2.6.2 KEY ********* This key is actually suspended, as of Feb, 16 1996, was never distributed, and might be subject to deletion. Sorry for the trouble my mis-management might have caused. 2048 bits Key ID:24201BA1 1996/02/13 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 23 B6 24 31 86 67 FB 35 C7 A7 AF 12 A1 61 E9 3D **** OLD KEY: DO NOT USE ANYMORE UNLESS FOR VERIFYING SIGNATURES **** 1024 bits Key ID:57214AED 1995/10/04 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 84 96 76 AE EB 7C AB 15 88 47 87 B0 18 31 74 9F

1 0

Re: TIS--Building in Big Brother for a Better Tommorrow
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:19 AM 2/23/96, P.J. Ponder wrote: >The first paragraph here bothered me. If a user (or an organization) >needs to have access to data that was encrypted by an associate ( or one >of its employees) wouldn't sound practice require that the key not be >entrusted to just one person? I don't see the need for any fancy >"key-recovery" protocol with any outside entities. We can handle this ^^^^^^^^^^^^^^^^^^ >internally in my shop. Some keys I give a copy to Alice, and down the ^^^^^^^^^^^^^^^^^^^^^^ This is my perception, too, though I haven't been in Corporate America for almost a decade. Still, I would encourage people to take this position, that "we don't need no steenking key escrow!" (to borrow again the B. Traven phrase I used yesterday) >hall Bob has some, too. If I get hit by the bus, they can get my company >related data back. We don't need any "service" or "licensee" or "trusted >third party" or any of that, thank you very much. And we don't need any >one developing OTPs for us either, and we don't need government agencies >keeping copies of any of our keys. Bravo! And we should all remember, again, that basic observation: even if "key escrow" is needed to recover *stored* files, it sure ain't needed for *communications*!! The only entity that really has a compelling need for "key escrow" for _communications_ is Big Bro himself, nto companies or individuals. Think about it. TIS is just playing the shill role for Big Brother and the Holding Company. --Tim May THE X-ON CONGRESS: INDECENT COMMENT ON AN INDECENT SUBJECT, by Steve Russell, American Reporter Correspondent....You motherfuckers in Congress have dropped over the edge of the earth this time... "the sorriest bunch of cocksuckers ever to sell out the First Amendment" or suggesting that "the only reason to run for Congress these days is to suck the lobbyists' dicks and fuck the people who sent you there," ....any more than I care for the language you shitheads have forced me to use in this essay...Let's talk about this fucking indecent language bullshit.

1 0

Re: TIS--Building in Big Brother for a Better Tommorrow
by P.J. Ponder 17 Dec '03

17 Dec '03

Steve Walker wrote to John Young: (large piece snipped; good stuff though.) + Suppose the U.S. government had never thought of placing export controls on cryptography... We would now have widespread use of encryption, both domestically and worldwide; we would be in a state of "Utopia," with widespread availability of cryptography with unlimited key lengths. But, once in this state, we will face situations where we need a file that had been encrypted by an associate who is unavailable (illness, traffic jam, or change of jobs). We will then realize that we must have some systematic way to recover our encrypted information when the keys are unavailable. When we add a user-controlled key recovery capability to our Utopia, we find ourselves in an "Ultimate Utopia," with unlimited key length cryptography, widely available through mass market applications, and user-controlled key recovery. The first paragraph here bothered me. If a user (or an organization) needs to have access to data that was encrypted by an associate ( or one of its employees) wouldn't sound practice require that the key not be entrusted to just one person? I don't see the need for any fancy "key-recovery" protocol with any outside entities. We can handle this internally in my shop. Some keys I give a copy to Alice, and down the hall Bob has some, too. If I get hit by the bus, they can get my company related data back. We don't need any "service" or "licensee" or "trusted third party" or any of that, thank you very much. And we don't need any one developing OTPs for us either, and we don't need government agencies keeping copies of any of our keys. Am I in the state of utopia already, is this what "user controlled key recovery" means? I think it's just common sense and sound management practice. If you know that your co-worker/colleague/summer intern, etc is encrypting your business related data, you should make sure you can get it back if she doesn't come back from lunch. Let her keep her own PGP passphrase, though. That's her business. -- I am now going to push a button and cause this to quantumly re-assemble in California. Really two buttons (Ctrl-X). One observes, one measures. -- send message body: "unsubscribe cypherpunks yourmailbox@domain" to: majordomo(a)toad.com to drop off the list. Don't put it in quotes, tho.

1 0

Diffie-Hellman parameters
by Eric Murray 17 Dec '03

17 Dec '03

Perhaps this is the wrong list to ask this question on, but does anyone have any pointers to where I could find good Diffie-Hellman parameters? Or source code that will generate some? -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

1 0

Cluelessness V.S. Lack of Knowledge
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In the snake oil controversy, I see a couple of issues... There are some people/companies out there who have the attitude that they have some sort of "remarkable achievement in the field of cryptography". In fact, it is SO remarkable that they do not have to submit to any sort of peer review or examination by people with more skill in the field than themselves. Some of this can be explained by being too close to the problem to see any of the flaws. Most of it can be attributed to ego. These people are pretty much hopeless. They can be a great source of entertainment and/or flame fest practice, but rarely do they ever learn by their mistakes. Their ego gets in the way far to often. (IPG Sales (any relation to "Soupy"?) is a prime example of this.) There are companies out there that are trying to build good products. These people can be instructed on the ways of implementing good crypto. Unfortunately, I have seen a number of them pushed up against the "Wall of Attitude" when they do ask for help. Cypherpunks, for good or for bad, have a reputation for being experts in the field. People come here to ask questions because "Cypherpunks know what Good Crypto tastes like". What is happening though is that they are also getting a reputation as people who flame first and give answers later, if ever. This is not a "good thing". If you want strong crypto to exist, you have to make the people who are trying to put it into place able to understand what it is in the first place. Giving them grief when they try to find out the flaws in the ideas (and are willing to learn) is not helpful to the community as a whole. I know of one developer who is trying to implement a strong cryptosystem in his app. He is unwilling to post his questions/concerns here because he is afraid of getting his ass shot off on the first query. Judging by some of the responses I have seen, I do not blame him! I can understand intolerance of the sales droids who push crap. I do not have much tolerance for them either. It bothers me when I see people who are not experts in the field AND ARE TRYING TO LEARN getting "blowed up real good" because they are not experts. Cypherpunks not only need to teach, they need to be willing to teach. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMS4xFOQCP3v30CeZAQEUlwf/SpOqOAnhk/8jZcQrH0IgDHtMgyUtjdIh b3URbqcIpfff6qQm8dT8/bbmEsGxavoYKC8xO6H5fiLtw2TRqaFYLsQX+JyYBurd lW7k+llMtGqRdthOPBjhVthTEnncVMhqqlT4E0axhhZMWPYNvW3h+NRjiDJSBFEl CFXe1MgiYt3wMlwJLu7Xqwem1zDT4Jmx3h2mx4ULeyvbKyM1ZkZZPe6vBuTgrgBN DaVw8204nc5vIO1LjTr2eY2zfwQToEVOlXlg3IgXtzmTz0eA0mFGoG/klapWKXcQ PSGFrWBhf0fmA488z2DlboiA6Q/HaxAQ4SR9sZ05CUKT1CKgGYX+Lg== =FY3m -----END PGP SIGNATURE----- --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "I, Caligula Clinton... In the name of the Senate and the people of Rome!" - Bill Clinton signing the CDA with the First Amendment bent over.

2 1

Re: NSA agent arrested
by Eric Thompson 17 Dec '03

17 Dec '03

> I just heard a very short blurb on CBC radio about a KGB mole within the NSA > from the 60's (?) getting arrested by the FBI. Pretty much no details > were given. Any info? See http://www.cnn.com/US/9602/spy_charges/index.html Eric

1 0

Edited Edupage, 22 February 1996
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)elanor.oit.unc.edu" 23-FEB-1996 00:27:10.72 ***************************************************************** Edupage, 22 February 1996. Edupage, a summary of news items on information technology, is provided three times each week as a service by Educom, a Washington, D.C.-based consortium of leading colleges and universities seeking to transform education through the use of information technology. ***************************************************************** This is the first I've heard (I think) that theirs will allow electronic cash. Wonder what exactly this means? >ELECTRONIC WALLET FROM ORACLE AND VERIFONE >Oracle, which specializes in database software, and Verifone, which >specializes in credit card verification systems, have formed an alliance >that will allow customers using "electronic wallets" built into Internet >browser software to access a full range of financial transaction methods, >including credit and debit cards, smart cards and electronic cash. The >companies call it an "end-to-end" system for secure electronic commerce on >the Internet. (Financial Times 22 Feb 96 p16) Somehow, the cluelessness of governments sometimes amazes even me. Have they ever heard of companies moving? >TAX REVOLT ON THE INFO HIGHWAY >When officials in Spokane, Wash. thought they could wring some extra revenue >via a 6% tax on Internet providers, they were inundated with e-mail and >phone calls protesting the action. One firm even set up a Web site for >users to vent their opposition. The result was the city council decided to >delay the tax pending further study, but the Spokane experience is likely to >be played out in cities across the country as local governments look for new >sources of cash. (Information Week 12 Feb 96 p10) >Edupage is written by John Gehl (gehl(a)educom.edu) & Suzanne Douglas >(douglas(a)educom.edu) Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by the Office of Information Technology, >University of North Carolina at Chapel Hill. >*************************************************************** >EDUPAGE is what you've just finished reading. To subscribe to Edupage: send >a message to: listproc(a)educom.unc.edu and in the body of the message type: >subscribe edupage George Bernard Shaw (assuming that your name is George >Bernard Shaw; if it's not, substitute your own name). ... To cancel, send >a message to: listproc(a)educom.unc.edu and in the body of the message type: >unsubscribe edupage. (Subscription problems? Send mail to >educom(a)educom.unc.edu.)

1 0

Re: Cluelessness V.S. Lack of Knowledge
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:29 PM 2/23/96, Alan Olsen wrote: >There are companies out there that are trying to build good >products. These people can be instructed on the ways of >implementing good crypto. Unfortunately, I have seen a number >of them pushed up against the "Wall of Attitude" when they do >ask for help. Cypherpunks, for good or for bad, have a >reputation for being experts in the field. People come here to >ask questions because "Cypherpunks know what Good Crypto tastes >like". What is happening though is that they are also getting >a reputation as people who flame first and give answers later, >if ever. This is not a "good thing". If you want strong >crypto to exist, you have to make the people who are trying to >put it into place able to understand what it is in the first >place. Giving them grief when they try to find out the flaws >in the ideas (and are willing to learn) is not helpful to the >community as a whole. I disagree. There are several points to keep in mind: 1. There are many sources of information on crypto, including excellent books on cryptography and information theory, and several FAQs readily available. There are frequent pointers to these FAQs, books, journals, and newsgroups. 2. Most of the "harsh criticisms" come when people do one or more of the following: a. announce an amazing new discovery, but refuse to give details ("we have applied for patents on our amazing new discovery") b. show an unawareness of basic facts which any competent cryptologist should at least be familiar with c. expect "the Cypherpunks" to provide free consulting and educational training (this same issue comes up on sci.crypt all the time, too, with people announcing some new cipher--which is usually some variant of a well-known cipher--and expressing frustration that "nobody will help me try to break it.") 3. "The Cypherpunks" is not a freelance consulting group, doing "Underwriter's Laboratories" (as in "UL Approved" on your electrical appliances) tests on proposed new systems. Even weak ciphers take time to break. See above. Or see the many comments to this effect in sci.crypt (in fact, I recall that it's in the FAQ for sci.crypt.) 4. In any case, with 1000 or more subscribers, and no consensus mechanism (no official position), nearly any proposal is going to be met with some negative comments from _someone_. Welcome to the real world. Anyone whose skin is so thin as to be scared off from posting because he fears that _someone_ will criticize his idea is a hopeless case. 5. Genuinely good ideas, or ideas that appear to come from someone who has done some real research and thinking, are usually responded to pretty favorably. I could cite the work on MixMaster, Crypto++, Blowfish, etc. >I know of one developer who is trying to implement a strong >cryptosystem in his app. He is unwilling to post his >questions/concerns here because he is afraid of getting his ass >shot off on the first query. Judging by some of the responses >I have seen, I do not blame him! I can understand intolerance >of the sales droids who push crap. I do not have much >tolerance for them either. It bothers me when I see people who >are not experts in the field AND ARE TRYING TO LEARN getting >"blowed up real good" because they are not experts. > >Cypherpunks not only need to teach, they need to be willing to >teach. There's a huge textbook on crypto: Schneier's book. Also, numerous books by Koblitz, Denning, Meyer and Matyas, and on and on. If your friend has a system which builds on basic principles, he won't be "shot down." If his ideas are good ones, he'll be embraced as a colleague. If he hasn't absorbed the standard theory, he'll be dismissed curtly. As it should be. Breaking a system, even one based on good principles, takes real work. Few people will volunteer to put free time and computer resources into testing the strength of unknown systems. Think about it. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Chain Letter to Congress, TOO!
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

They oughta send it to the congress servers while they are at it. Liked the mailto: tag on the mail Netscrape and Eudora support it. Love Always, Carol Anne -----BEGIN PGP SIGNED MESSAGE----- This is my public PGP key. Signed and certified! Love Always, Carol Anne - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAy/ZOrAAAAEEANDo2ZIACDkf8irWB0Pi8UhcBts8hlhPguUputkwXfabtqpo PziaSrj0/qpd+SfjjKyjC4l0TPfc8wrEHbGfNdwbMCmugBgVfaw8SBZnV7J0NxYC GWt819ZZHhgM5+b+MjjY7DftHv6WDuo5ag0aMBW3FuDyDvaVRIrpjEWs1wBlAAUT tBxjYWI4IDxjYXJvbGFubkBjZW5zb3JlZC5vcmc+ =8ToJ - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Uncensored from heavily.censored.org iQCVAwUBMSmN0YrpjEWs1wBlAQFLTAQAjt6NhN0GFNNLUhkVaho6pcUi+VKP1Kw8 8m7Wwyhk4baS25m2wumyeoCxIKQz2nP6pT2EwbNJXmig+g/CeMxuqlInGmSBKeuZ evpGgc8q5rZVdnLW2q8dCyoe/uALcPa1K9WpBB030Mka8Gq/9Lc8Y7WtJ09Cnwrw w7YE0N/X594= =5puG -----END PGP SIGNATURE-----

1 0

Re: NSA agent arrested
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:51 PM 2/23/96, Mike Tighe wrote: >Yeah, I got his name but was not sure of the spelling. Robert Steven >something. Lives in Millersville, PA. I think he is retired. Looks like a >victim of the cozying relationship between the FBI and the KGB-whatever >they call themselves nowadays. Lipka. Details are in the usual news sources, such as Reuters (http://www.excite.com/Bulletin/) under Net Directory in Netscape. No CP relevance that I can see, except that Lipka didn't use remailers to protect his identity when he tried to reestablish contact with the Soviets ()who were actually FBI). Lipka was a low-level 20-year-old when he worked for the Army, probably assigned to the Army Security Agency (considered part of the NSA). --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Digital Watermark
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Financial Times, 22 Feb 96 Digital watermark protects copyright Scientists at the NEC Research Institute in Princeton believe they have developed "a fundamental enabling technology" for protecting the copyright of images and music on the Internet. They have developed a secure method of producing a digital watermark, an invisible code that identifies the owner, which is permanently embedded in the multimedia data. Attempts to remove the watermark would be virtually impossible without degrading the image quality. Moreover, counterfeiting would be almost impossible, says NEC. the Japanese electronics company. The digital watermark is designed to be used in conjunction with cryptography, which limits access to encrypted data to legitimate users. NEC Research Institute: US, tel 609-520-1555 fax 609-951-2481.

3 2

Re: TIS--Building in Big Brother for a Better Tommorrow
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:16 PM 2/22/96 -0800, Timothy C. May wrote: >And we should all remember, again, that basic observation: even if "key >escrow" is needed to recover *stored* files, it sure ain't needed for >*communications*!! If a key is being generated for two way communications, then it should be generated via a protocol like Diffie-Hellman which leaves no recoverable knowlege of the key outside the participants, and discarded when the session is over of frequently, whichever occurs more often. This procedure will reduce the incentive for rubber hose attacks to recover these keys. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: url
by Alan Olsen 17 Dec '03

17 Dec '03

At 01:23 AM 2/23/96 -0500, Mutant Rob wrote: >Bill Frantz wrote: >> >> At 2:52 PM 2/22/96 -0500, Perry E. Metzger wrote: >> >Mike McNally writes: >> >> At <URL:http://www.osf.org/~loverso/javascript/track-me.html> find >> >> some interesting "surveillance" applications of Javascript.[..] >> >When is the patch to let you disable JavaScript inside Netscape going >> >to go out? Its more than time. >> >> Why Perry, it's called Netscape 1.1N. :-) > >I think the Options menu in Netscape allows you to disable it already. You can disable Java but not Javascript via the security options. --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "I, Caligula Clinton... In the name of the Senate and the people of Rome!" - Bill Clinton signing the CDA with the First Amendment bent over.

1 0

Re: IBM Breakthrough?
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 21:03 2/21/96, Mike Duvos wrote: >Now this has some interesting implications. One of the problems >with teleportation devices in Science Fiction stories is that >they allow for the creation of duplicates. They reduce an object >to a pattern by measuring it, and then recreate it at a distance >by assembling atoms of the same types according to the >appropriate directions. There is no theoretical reason why, once >the pattern has been saved, this process could not be repeated >multiple times. This has implications for things like souls and >self-awareness that many people would rather not think about. Its been used in an SF Story/Series <g>. It is the Venus Equilateral Series by George O. Smith. Midway into the Series, they invent a method of doing Teleportation via destruction of the original item, sending the info to the receiver, and recreating the object. In the process of a Court Case involving if the transmission of the signal between the two Teleportation Devices was a transmission of Energy (which was the province of the other party in the case) or a transmission of Data (which was VE's job), they had to invent a Duplicator (in the process allowing the non-destructive readout of the transmission signal). It gets vary hairy for a story or two until Civilization gets adjusted to the Duplicator (they have to invent something that can not be scanned and thus duplicated to act as "Paper" for Money and Contracts/etc since the bottom fell out of the Economy due to no need for most Factories and the lack of uncounterfeitible currency).

1 0

Re: Secure Mail (Was: IMC resolving security workshop)
by Alan Olsen 17 Dec '03

17 Dec '03

At 12:47 AM 2/23/96 +0000, P.J. Ponder wrote: >ObSecureMail: I got the beta Pronto secure mail, but haven't had tome to >fool with it yet, then I got a mesage about a bad key or something. >What's up with that? My experience so far has not been very positive. I have tried both of the betas on Win95. Neither of the betas have been able to get past the "Synchronising keys" section of the setup. The program just keeps accessing my public keyring for almost 30 mins before it returns a cryptic error 111. What I have seen of it, I am not very happy with some of the design choices. You should be able to tell it the hex id of the key that you want to use with the mailer. Nope! It tries to find what it thinks the key should be based on your e-mail address. Since I have two keys under that address, there is a wee bit of a problem. I have tried generating a new one as well, and i still get the problems with the key sync. (As in it not completing and ending with an obscure error message.) So far, my last message to the beta address has gone unanswered on this problem. I would like to test it further, but getting that far has not been very easy at this stage of the development. Not a hopeful sign. --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "I, Caligula Clinton... In the name of the Senate and the people of Rome!" - Bill Clinton signing the CDA with the First Amendment bent over.

1 0

Look, a chain letter :-)
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I received a curious mimetic e-mail. The cypherpunks relevance is: will we or will we not bring down the White House server? :-) ---------- Forwarded message ---------- To whoever may read this, This is not a typical chain letter, in that by passing it on to as many people as you can, you are taking part in what may yet become the world's biggest practical joke. The U.S. Government has recently passed an act which enforces censorship on the internet. A group of internet users has now come together to kick back at this oppression, and have a bit of fun at the same time. The aim of this exercise is to re-establish the United States as "The Land of the Free", not a fascist state where freedom of speech and thought are curtailed. Communist Russia fell as a result of such limits being placed upon the minds of the general populus. On receiving this letter, please pass it on to as many friends or E-mail lists as you can. We predict that if everybody copies the letter to 5 other addresses, by February 29th 1996, this letter should have reached in excess of 2 million people. That's when the fun begins........ On February 29th, please send the message: Dear Mr. President, Do you remember this: And afterwards enclose the pre-typed copy of the Bill of Rights. By sending the letter on the date above, you will contribute to either one huge petition for freedom, or else lead to a crash of the White House server. Send all letters to: President(a)Whitehouse.gov Remember that solidarity is the key to success THE BILL OF RIGHTS Amendment I Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the government for a redress of grievances. Amendment II A well regulated militia, being necessary to the security of a free state, the right of the people to keep and bear arms, shall not be infringed. Amendment III No soldier shall, in time of peace be quartered in any house, without the consent of the owner, nor in time of war, but in a manner to be prescribed by law. Amendment IV The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. Amendment V No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a grand jury, except in cases arising in the land or naval forces, or in the militia, when in actual service in time of war or public danger; nor shall any person be subject for the same offense to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation. Amendment VI In all criminal prosecutions, the accused shall enjoy the right to a speedy and public trial, by an impartial jury of the state and district wherein the crime shall have been committed, which district shall have been previously ascertained by law, and to be informed of the nature and cause of the accusation; to be confronted with the witnesses against him; to have compulsory process for obtaining witnesses in his favor, and to have the assistance of counsel for his defense. Amendment VII In suits at common law, where the value in controversy shall exceed twenty dollars, the right of trial by jury shall be preserved, and no fact tried by a jury, shall be otherwise reexamined in any court of the United States, than according to the rules of the common law. Amendment VIII Excessive bail shall not be required, nor excessive fines imposed, nor cruel and unusual punishments inflicted. Amendment IX The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people. Amendment X The powers not delegated to the United States by the Constitution, nor prohibited by it to the states, are reserved to the states respectively, or to the people. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: [No subject]
by Yee, Peter 17 Dec '03

17 Dec '03

>> Earlier, I mentioned that two and a half protocols survived the >> day. The remaining one is MSP. It's actually not a bad protocol. It >> has two features that none of the others have: the ability to label >> classified messages, and a cryptographically strong signed receipt. >> Both of these functions are highly important for government users. It >> looks like government suppliers are going to go ahead and implement >> it, and the government is going to use it. >Although these benefits are present in the current MSP, I >don't see anything inherent in MSP that makes it necessarily superior in these >areas. If you were doing normal MIME-type receipts (whatever that means, since >I think there are three different drafts under way currently), and you simply >added the ability to cryptographically sign a timestamp in the "proper" MIME >receipt type, then MSP would lose this advantage. FIF. I guess this could be said about any of the protocols. With enough changes they all have the same feature set. :-) MSP just has it now and it works. >I think labeling could potentially be done by follow-on >versions of other packages as well, since I think we all agree that generic >labeling which can be used both for standard gov't-style classification levels >and compartments, as well as for business-style sensitivity labeling. In fact, >I'd almost be inclined to say that it would likely be as easy (or easier) to >create a new general-purpose labeling system for use with any of the >competitors than it would be to modify MSP to support business-style labels in >addition to the gov't-style labels I'm sure it has today (maybe it already has >labels, but I don't think that this is that tough of a problem to solve in any >event). Well, read MSP first before assuming. And of course, see above comment. -Peter

1 0

Re: "E-Money" is trademarked
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:54 AM 2/24/96, Jim Miller wrote: >FYI, I learned tonight that Electronic Funds Clearinghouse, Inc., holds >the trademark "E-Money" which is licensed to E-Money, Inc. a Delaware > >Corporation. See the Web page http://www.efunds.com > >I guess I will have to rename my E-Money mini-FAQ. I guess we're left with "D-marks" (D for digital...). I can only hope that someone soon trademarks the stupid "e$" and thus enjoins the rest of us from using it. (On a serious note, yet another example that the American copyrighting and patenting engine is overrevving.) --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: REM_ote
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:28 PM 2/23/96 -0600, Alex Strasheim wrote: >> Might want to be careful calling Marianne a borderline liar. She's our host >> for Cypherpunks meetings at Sun, where's she's in the Java group. The >> article didn't make it clear that she's with Sun and not Netscape. She's >> also been coming to Cypherpunks meetings since the beginning, and posts >> here occasionally. > >I apologize for the remark, it was out of line. I don't know who she is, >or what she actually said, for that matter. > >But the fact remains that these sorts of security problems were predicted >well before Java was widely deployed. They're serious, and this isn't >going to be the last one. An awful lot of people aren't going to patch >their copies of Netscape any time soon, either. I agree these problems will continue to show up from time to time. With a large security kernel, you will have security bugs. However, if the fixes come out in a week, then the hacking potental is greatly reduced. >(A useful feature for Netscape might be a facility that checks >periodically to see if a security patch is in order, and displays a >warning if it is.) A very good idea. An advantage for web based products. >Problems with security are a fact of life. I've made embarassing mistakes >that compromised security for some of my users. When that happens you >have to come clean, tell the truth, and fix the problem. Don't try to >convince people that you didn't screw up, that the problem isn't serious. >Don't say things that will encourage users to put off installing a >security patch. And don't underestimate the ability of your attackers. This is all true. However, from what I know, in this case you would need to know the details of the flaw, and be able to generate a java bytecode stream which takes advantage of the problem. If the fixes come out quickly, then your attackers don't have much time. However if they discover the flaw before you do you are in deep shit. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: REM_ote
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:32 PM 2/23/96, Alex Strasheim wrote: >> Marianne Mueller, Java security engineer, also said the chances of such >> hacking occurring are "remote." > >This is the sort of bullshit that gets companies in trouble. Netscape has >a good record of responding to and fixing security problems. Why should >they feel the need to do spin control? This borders on lying. Might want to be careful calling Marianne a borderline liar. She's our host for Cypherpunks meetings at Sun, where's she's in the Java group. The article didn't make it clear that she's with Sun and not Netscape. She's also been coming to Cypherpunks meetings since the beginning, and posts here occasionally. I'm sure she can speak for herself, but she may not see this comment for a while, hence my comment here. As for the substance of her remarks, best to let her elaborate. Though, knowing journalists, it's quite possible that her "remote" remark was embedded in a much longer comment, which the reporter chose to cut. --Tim may Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3

No Subject
by Raph Levien 17 Dec '03

17 Dec '03

Here follow one cypherpunk's impressions of the Internet Mail Consortium's Security Workshop (http://www.imc.org/security-workshop.html) on Wednedsday 21 Feb 1996. Since there will be official notes of the proceedings, I felt I had a little more scope to convey mood and feelings rather than dry technical facts. After all, I think the buzz will do more to determine what gets deployed than the technical merits. This document is available on the Web at: http://www.c2.org/~raph/report.html The setting ----------- Paul Hoffmann and Dave Crocker recently started the Internet Mail Consortium (http://www.imc.org) This workshop was its first major activity. Dave Crocker moderated the event, skillfully herding almost 70 secure email proponents and representatives from user communities through a very tough subject. The title of the workshop was "Resolving email security," but there was no real expectation that the issues would be resolved that day. What was expected (and what happened) is that people would get a better understanding of why secure email hasn't happened yet, what kinds of things could be done to make it happen. More impressively, there was "room consensus" for a few _very_ positive steps, about which more later. One of the goals of the IMC is to involve users, not just developers. I was ready to "officially" represent the "cypherpunk user community," but fortunately, I didn't need to. In fact, the strongest advocacy of strong crypto came from an employee of a "large service provider in America." Overall, I felt that the user communities were pretty well represented, and all important technical points got made. MOSS is dead, long live MOSS ---------------------------- There were five contenders on the field going into the day, and two and a half at the end. MOSS was one of the casualties. A lot of us were sorry to see it go, but eliminating candidates has got to happen if we're going to have interoperation. It's hard to say exactly what went wrong. MOSS had many advantages, and was a nice, clean, pretty standard. I think what doomed it was the lack of a good implementation. Even though MOSS is no longer considered a serious contender, one piece of it is still very much alive: the multipart/signed message format. At the end of the day, there was strong, nearly unanimous consensus that multipart/signed should be recommended as the signed message format for _all_ of the email encryption protocols. S/MIME: you can dance to it --------------------------- There was a lot of energy around S/MIME. People are implementing it. Internally, it's pretty kludgely, but it does provide pretty good cryptographic services. (as an aside, my favorite kludge anecdote is the fact that X.509 certificates use an IA5 character set rather than ASCII, so that the @ in email addresses has to be represented as (a) instead). The main thing people didn't like about the existing S/MIME spec is the signed message format. In the existing spec, you've got a choice between a message unreadable to non-S/MIME-aware clients, or duplicating the data. Neither alternative is very palatable. Apparently, though, a new version of the S/MIME spec _will_ incorporate the multipart/signed format of RFC 1847. This made almost everybody happy, although I'm sure all those S/MIME developers are a bit unhappy with the spec changing, and having to reimplement stuff. The biggest problem with S/MIME is that the signed and encrypted format reveals who made the signatures. Obviously, this has severe consequences for anonymous mail. Believe it or not, a lot of people care. For example, the car manufacturers do not wish to broadcast the email addresses of their employees over the net. One technical workaround is to do it the MOSS way - first, sign the message, resulting in an intermediate S/MIME message, then encrypt that into a second S/MIME message. I'd recommend that implementors make provisions for such recursive formats; I think it's likely that we'll see a lot of these on the Net. PGP: troubled, but still alive ------------------------------ The consensus was that S/MIME and PGP/MIME are the two viable email encryption protocols. Thus, PGP is still very much alive and kicking. PGP's fabulous strength is that it won't let you down cryptographically. That simply cannot be said for the other contenders. That said, much about the PGP effort troubles me. Perhaps the biggest problem is that there just aren't enough people working on it. >From what I understand, it's pretty much just Derek and Colin, and there's a _lot_ of work to do. I said before that I didn't think the public PGP/MIME release will happen until this fall, and I see no reason to change my estimate. By that time, a lot of S/MIME implementations will already be deployed. One strength of PGP has traditionally been its unity. PGP means one message format (the PGP one), one suite of crypto algorithms (the PGP one), one key format (the PGP one), one application (PGP itself). Most of the other proposals are modular in some way, especially with respect to algorithms. PGP is moving in that direction. The most visible evidence of that is the way PGP/MIME is being done. The prevailing philosophy of the PGP people is that the PGP application itself should not decode MIME formats - that should be the job of a separate application. It seems to me that this is going against the tradition, though. In the past, if you got a PGP message, you just ran it through PGP. Now you won't be able to do that. Also, the existing data formats (while pretty good) are going to get changed. The algorithms are going to "go modular" (although I don't think we'll be seeing a Fortezza implementation any time soon). This is going to cause a lot of pain for the installed base. Will it be worth it? We'll just have to see. MSP: not as bad as you think ---------------------------- Earlier, I mentioned that two and a half protocols survived the day. The remaining one is MSP. It's actually not a bad protocol. It has two features that none of the others have: the ability to label classified messages, and a cryptographically strong signed receipt. Both of these functions are highly important for government users. It looks like government suppliers are going to go ahead and implement it, and the government is going to use it. MSP has been around a while, but the effort to turn it into a serious alternative for general Internet use is quite new. Two specs got published this month: a MIME integration spec (sharing the same problems as the old S/MIME), and a spec for plugging in the RSA algorithm suite. With these specs in place, MSP would not be fundamentally that different than, say, S/MIME. My feeling is that the main differences are cultural. MSP still has a very ASN.1, OSI, governmental flavor. Its proponents are making the effort to be responsive to users, but I think there's still a bit of skepticism about that, perhaps misguided, perhaps not. It was announced that there will be a free reference implementation of MSP, available to US citizens. My kingdom for 40 bits ---------------------- I've been thinking about the 40 bit thing a lot. It makes me very uncomfortable. From the cypherpunk perspective, this should be nothing new or remarkable, but keep in mind that there's a _lot_ of pressure on companies to be able to make money in overseas markets. In one of the "modular algorithms" designs, it's not easy to figure out which algorithms your recipient can understand. Guess wrong, and your message goes out with 40-bit encryption. In my opinion, this is worse than no encryption at all, because it gives the false sense of security. Building such a failure mode into an email encryption protocol strikes me as a bad idea. This is my subjective impression, but I sensed that there was a collective delusion that US software developers would actually be able to sell a 40-bit product overseas. Certainly, Netscape has proved that it is possible, but then again, encryption is peripheral to the value of their product. You'd still be using Netscape even if it had no encryption at all, wouldn't you? How many https: URL's are even in your history.db file? For a "secure email" product, it's a different story. There were a few other things that led me to the conclusion of a 40-bit delusion. First, people still seemed to thing that the cypherpunk 40-bit cracks were a concerted effort by highly expert people, rather than the weekend hacks that could be duplicated by any competent sysadmin or grad student. I don't think the message really got through. If 40-bit email gets deployed, we need to make a few more high-profile cracks just to hammer it in. Finally, there's an almost religious belief that making the choice of algorithms indepenent of the encryption protocol will somehow solve the problem. From the point of view of the user, this is just not true. What the user selects is an encryption protocol, an algorithm suite, and whatever other parts of the spec were left open. What the user selects doesn't have any modularity in it at all. It's either a good protocol or a bad one. Maybe customers today think that 40-bit encryption offers some value, but I think they'll soon be disillusioned. This is something that cypherpunks can have a role in. In the medium to long term, it will become clear that 40-bit encryption offers no benefits, and in fact is dangerous. My advice to US developers: don't even try to export a 40-bit version of your product. Just leave crypto out of the export version. Your product will have better performance and many fewer configuration problems. Include 40-bit in the US product if you have to, but don't allow it to be used silently. For example, put up a little dialog that says, "are you _sure_ you want to use 40-bit encryption? It's not secure, you know." If care about offering crypto in the non-US market, form a partnership with overseas developers to add the crypto. Non-US developers, now is a fabulous opportunity. Get those implementations underway, the sooner the better. Coexistence ----------- Since there is no one single standard that everyone feels comfortable with, we will somehow have to deal with the coexistence of multiple conflicting protocols. Fortunately, this is something the Net is good at. Most serious email vendors plan to "implement everything that's real." That means S/MIME for sure, PGP/MIME assuming they can get their hands on a decent implementation, and MSP if they sell a lot of stuff to the government. If everyone follows this path, then we really will have interoperable secure email. Perhaps over the long term, one of the standards would come to dominate, perhaps not. I know that the deployment of secure email has been a year away for the past decade or so, but now I think it really is poised to happen. The implementation effort is very much real. Over the next few months, we will see some very high profile, mass market implementations. Before that happens, though, the protocols must actually become stable. It's a characteristic of _all_ of the viable protocols that they're still in flux, still in the process of being defined. But at least the direction is clear, largely as a result of feedback from this workshop. Consensus --------- At the end of the meeting, Dave asked the room for consensus on several points. First, there was strong consensus that the encryption protocols converge on multipart/security for their signed message format. Second, it was agreed that the proponents of the surviving schemes get together to list their differences, justify these difference, and commonalize things that don't _need_ to be different, also agreeing on a timetable concluding at the Montreal IETF meeting. I'd say that's quite a remarkable achievement for a such a difficult area. Raph Levien

3 2