December 2003 - cypherpunks-legacy

Re: cypherpunks at ietf
by Michael Coates 17 Dec '03

17 Dec '03

>> OUR CURRENT PROBLEM IS THAT THE AVERAGE CONSUMER CAN NOT COMPLETE AN > ACCURATE >> SEARCH ON THE WEB. >> >> [...] >> >> AT THIS POINT SO MANY CYBERPUNKS HAVE EMBEDDED SO MUCH GARBAGE ON THE > WEB, >> THAT YOU CAN NOT COMPLETE AN ACCURATE SEARCH. > >Gee: Someone who has not learnt to use the caps key on his computer >cannot do accurate searches, so will everyone else please get off >the net. > >> >> [...] >> >> BUT MORE IMPORTANT, WE NEED TO CLEANUP THE TRASH THAT THE CYBER-PUNKS ARE >> PLACING ON THE WEB. > >Pleasant comic relief. > My guess is; he simply wanted to embarass himself. Don't they have karaoke bars for that sort of thing?

1 0

Re: Attribute-testimony example (was Re: The future will be easy touse)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"cme(a)TIS.COM" "Carl Ellison" 30-NOV-1995 12:34:35.18 Once an element of that set is identified, it can be assigned a codeword (to make parsing easier). ---------- How about an email address? Or a URL? Those can be autodetected easily enough. Plus, the email one could be used to automatically use the appropriate key if reading something from a particular address (whether for decryption or for signature verification). If there are more than one with that address, try all of them and if one turns up looking right (looks like email headers, for instance) use that decryption. That last is even easier with the signature verification, and that can show up the user-specified portion of the field so as to remind you who's sent the message. Sorry if this has been thought of (and suggested) before... it is kind of obvious. -Allen

2 1

Re: VisaCash security.
by ljo＠ausys.se 17 Dec '03

17 Dec '03

<fletch(a)ain.bls.com> wrote: > I think the Visa stuff is basically stored value and >rechargeable smart cards, not really ecash type money. Supposedly >you'll be able to get a card with $10 or $20 on it and all the >vending machines and phones around the Olympic venues will be set >up to take the cards. So to answer your questions, no it's not really >digital cash (like ecash); and yes I think it's probably traceable >to some extent (unless you buy stored value cards w/paper cash). > > First Union, the bank selling the cards, has a page on them: > >http://www.firstunion.com/visacash/ > > Low on the technical info, but they give an address to mail >questions to. A couple of weeks ago I was giving a talk at a conferance on computer technology in financial applications in Stockholm. I mentioned VISA:s electronic purse 'Smart Cash' in my talk and during the break afterwards a representative from a danish bank told me that VISA:s 'Smart Cash' was actually bought from the danish purse/project 'Danmont'. Does anyone know the truth of this, please let me know. Regards, /Lars Johansson ljo(a)ausys.se

1 0

Re: Netscape gives in to key escrow
by JR＠ROCK.CNB.UAM.ES 17 Dec '03

17 Dec '03

From: SMTP%"tcmay(a)got.net" 1-DEC-1995 12:26:55.99 >With the assumption that this is not a troll, and giving the writer some No, it isn't. >At 10:45 AM 12/1/95, JR(a)ns.cnb.uam.es wrote: >>With regard to all this waving about Netscape giving in to key scrow... > >Key _escrow_, though "scrow" is perhaps just as accurate as the >improperly-named "key escrow" (hint: escrow is something done voluntarily, >not the situation here with GAK). > Yup. I should have said "mandatory key scrow". Sorry for using a shorthand. >Having said this, I think all of the shareholders, either of issued shares >or as-yet-unissued shares, are interested in maximizing share value. Not >surprising. That's the point. They look after *their* interests, not after "public" interest, specially where "public" is a local (as big as local to US may be) interest in a global economy. >Importantly--and maybe this is the real point JR is making--we on the >Cypherpunks list are probably *not* interested in Netscape's stock price. >But who cares? Our role is not to maximize Netscape stock price, but to >talk about what is "right" and what is not right. And GAK is definitely not >right, to the vast majority of us. Right. What I wanted to say was exactly that. >They were "criticized" not because they went public with their stock but >because of their security mistakes, made more important by their sudden The point is not why they were chased but the fact they were. It reflects on further reticences by crypto-interested people to get involved and opens more field to crypto-unaware or uninterested people to gain control of the company. ... >Well, this is the point, isn't it? I doubt there are such things as "tax >reliefs" for Netscape--these things are done pretty much out in the open in >the U.S., and any special tax treatment would be widely noticed--but there >may indeed have been "discussions" with senior management at Netscape. >Several of us have already speculated in broad terms on this. Well, I don't know about what kind of compensation could be offered. Tax reliefs was just a suggestion. What about saying "hey guys, if you comply with our demands we'll set Netscape as the standard browser for the administration. If you don't you won't sell a copy". In any case, the point is that a Government (anY) can make strong pressure, specially one as big as USA's Gov. And facing it is a risky position. ... >First, a viable strategy is to simply do nothing. Ignore the goverment's >protestations, drag one's feet, shrug, etc. Jim Clark could simply have >said nothing. (Recall that Bill Gates came out recently saying that strong >encryption is inevitable...Clark could have either said nothing, or said >something similar to what Gates said.) That may be a very bad move from their point of view. If the Gov. pushes hard, and it is an important customer, it is in their interest to satisfy them. As long as anyone else wants to follow the Gov. it is also good for them to follow those lines, and to be the firsts ones. What about foreign customers? If the Gov. can restrict export of your technologies, they'll move to other providers. It is better for you to pay hommage to the Gov. requests and get to overseas markets faster and sooner than anyone else. >Second, the issue is not "satisfying" a "bunch of cypherpunks." If Netscape >truly pushes for GAK, and people reject GAK and Netscape, then this will >surely hurt shareholder value. (Frankly, I expect one or more stories to >appear in the next few days about the budding "Friends Don't Let Friends >Use Netscape" and "Just Say No to Netscape" movements. Whether this will >hurt the stock is unclear.) The "just say no" movement is OK as long as you don't append "to XXX". It could work if it is only Netscape... But as soon as anyone else gives in (e.g. Microsoft) it will become a burden. It's much better IMHO to ask "say yes to privacy". It's much better to say "this page is optimized for good safety and may not be reliable under non-crypto browsers -e.g. Netscape-" than saying "your browser is bad". Which BTW, may be OK in the USA, but is not in other places. Belgium comes to mind for forbidding negative advertising. And surely others. ... >I say that the ideas being discussed are in fact "constructive" ideas. I >won't reiterate them all here, but they clearly involve concrete action >(e.g., modifying server software to issue warnings to Netscape users, or >encouragement of alternatives to Netscape). Some of them are. Others are not. Others are destructive (like denying access to Netscape users), or unpracticable (like saying "Mozilla is not the best thing" in some places), or unrealistic (like saying "quit your job"), or plain silly. If you deny access to a user, you'll make him/her angry. And not angry with Netscape. They'll be angry with you. We need people on our side. That's basic psicology. I'd go for more pages explaining what crypto is and can do for Joe Random. Many people has said "I can do this or that with my server or whatever". How many people is offering an alternate safe crypto service and making it interesting and desirable for Joe Random? And making it well known? I'd say that not enough. If you can offer an attractive service, protected with another crypto method, and make it popular, people will demand it. If you just add a note saying you use that crypto 'cos Government-enforced crypto is not good enough, people will feel happy and will learn. In general, people prefers positive presentations to complains or problems. Have a look at TV ads. How many of them say "Don't use that stuff, it's shit" instead of "Use my stuff, it's better". That's what I advocate: a positive course of action, offering a better alternative. Not just a storm of complains or "bad karma". >What more are you expecting? Have you been reading what people are actually >discussing doing and actually already doing? > Yes, I've read all along. As I hope will be more clear now. And I have found lots of people saying "I won't support Netscape", "I will say no", "I will deny access to Netscape", "I'll add a complain to my page", "Jim should retract", "Netscape should go back", "Netscape better changes its money-making policy and becomes a political activist", "This or that guy must quit job"... What I was expecting is people to be more realistic, not to forget that the main goal of a company is to make money instead of defending public freedom (which indeed is bad for business), and start promoting better (or not) alternatives. And, to finish, note that I have also seen some very good answers, on which I don't coment since I agree and have little to add to. >--Tim May > jr

2 1

Re: "Got a subpoena?"
by Jay Campbell 17 Dec '03

17 Dec '03

>> "finessing" laws will become more important. In short, they WILL have >> a subpoena--then what? > > Then they'll find out that I don't have any information that >could help them, anyway. What about a court order to (a) start comprehensive logging, and (b) not tell anyone under penalty of ______ . -- Jay Campbell edge(a)got.net - Operations Manager -=-=-=-=-=-=- Sense Networking, Santa Cruz Node Jay(a)Campbell.net got.net? PGP MIT KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

4 3

Netscape, Corporations, and GAK Support
by John Young 17 Dec '03

17 Dec '03

Picking up on Tim's and Atilla's comments on Netscape, GAK, a WTO czar and government regulation of security on the Net: Jim Clark's speech was probably a trial balloon, to see what the reaction would be. Remember that the NIST conference on KE is December 5. It would make sense for the corporations to welcome application of police power to handle threats to public order, in cyberworld like the other. That way they reduce culpability for failures of their private security systems, as they do on private real estate property. Key escrow requires someplace for the buck to stop beyond several private pitstops, and that is usually Uncle Sugar when no other party has the resources to withstand sustained, substantial, culture-wide risk -- as, say, in the financial realm. Internationally, the same need exists. Probably the corporations would like to work in concert with governments on this, so no single firm, or nation, gets stigmatized, or wounded and prey to vultures -- as Netscape was with the brute hack, and as Microsoft and others have been with other attacks on their lightly guarded property, or as the US might be if it does not work out international agreements. Moreover, it has been noted here that government contracts are crucial for a new company -- for testing, for credibility, for prestige. All the major players already have such vital contracts -- indeed most would not have thrived without them -- so why would Netscape, and its investors, not want them too? It's possible that Netscape was selected to sound off on KE to see if it could play with the Big Boys -- take the heat, pass initiation, qualify for the Bohemian Grove bear hugs of assured stability, growth and profits. Could be, though, that after getting stable R/E for his backers, Jim will be confident enough to join Pixar in that rhumba risk of mercurial, evanescent mass-marketers. That's not to be believed now at 7,000 times earnings.

2 1

Re: "Got a subpoena?"
by Jonathan Zamick 17 Dec '03

17 Dec '03

At 11:46 AM 11/30/95, sameer wrote: >> >> What about a court order to (a) start comprehensive logging, and (b) not >> tell anyone under penalty of ______ . > > Aren't court orders part of the public record? I don't quite >know how this would work. I don't think they can keep me from telling >people that I've started comprehensive logging, or at least keep it >from being founnd out. (Legally, that is. I'm sure they could always >use an approach like threatening to audit me every year, threatening >my family, etc.) In fact, most forms of recording need willing participation by at least one party. Wiretaps are the main method of recording information which doesn't involve willing participation of one of those communicating. Since there are no laws regarding participation of service providers assisting the government at gathering information, there is a great deal of leeway legally. If they actually pass a law (as in Penn) regarding ISP obligations it'll probably be fought a bit, but does then put more stress on the situation. Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

1 0

WTO an even worse possibility as Inet regulator
by attila 17 Dec '03

17 Dec '03

based on an article from the (London) Financial Times [available from John Young at jya(a)pipeline.com with subject line WAY_lad], a very credible white paper is circulating for the WTO to establish an internet CZAR to regualate the Internet and level the playing field world wide. personally, the Feds and the FCC are bad enough --now they want to have a **global** bureaucracy play god -??? are we ready to go back to UUCP?

2 2

Re: Credit card theft Re: The future will be easy to use
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Thu, 30 Nov 1995 s1113645(a)tesla.cc.uottawa.ca wrote: > What if it's an ecash password getting stolen? Who's liable? (lemme > guess, your money's gone, tough luck!) >From what I remember of the contract, that's true, the bank appear to take no liability for ecash (check the WWW page for the real details). As I'm not likely to have more than about $ 50 of ecash at any time, I'm not *that* concerned about it. Big users could transfer payments back into their dollar account ASAP to avoid most of these problems, just keeping enough in the ecash account to make any payments that may be required. It's not really any worse than physical cash, as long as the software is reliable, which it appears to be (I've lost payments in the past, but cancelling them has always worked to get the money back). > Disclaimer: I don't have a marktwain account at the moment, so I can't > say a thing about the security of the system. I wish them the absolute best > of luck. I do, and yes, from conversations with them it appears that if someone gets your secret key and password they can clear out all the money from your ecash account. This is potentially a real problem for shops, which have to have a secret key file on the machine they run from. Currently this even applies to shops that only *accept* ecash, though there may be an accept-only server out sometime, and I found a way to delete the secret key itself from the file and still have it work (I forget the exact details, you basically zero 256 bytes of the file that contain the key, which appears to be 768-bits according to the debug output, so I don't know what the extra bits are used for). Shops that pay out need to have an *unencrypted* secret key on the server, which is scary, but there's not much you can do about it if you're running on an insecure server... The only way around it that I can see would be to withdraw ecash using a secure machine and upload it to your server, so that the shop could make payments until the ecash supply was depleted and then you'd manually have to withdraw more. Then if someone broke into your account they'd get the ecash, but not the key, and you could limit your exposure to the amount you uploaded at any one time. I'll probably be doing that once the check I mailed over gets into my ecash account. This is strictly my understanding of the system based on what I've been told, so hopefully if I'm wrong then someone from DigiCash will correct me. Mark

1 0

Re: Netscape gives in to key escrow
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:26 PM 11/30/95, Ravi Pandya wrote: >If you're looking for an alternative Web browser for Windows, we just made >ours available for free at www.netmanage.com. It's fast and reliable, and >supports HTML 3.0, inline video, software distribution, VRML (NT version), >Real Audio, TrueSpeech, etc. This shows the price Netscape could pay for taking a pro-surveillance, anti-privacy stance. Various alternatives to Netscape exist (even on the Mac), despite attempts to make "Netscape-enhanced-encoding" (or whatever it's called) the standard. I expect alternative browsers will catch up fairly quickly. (As an aside, and based on my past experiences at Intel during its rapid-growth phase, it may be tough for Netscape to keep people motivated and focused on development, what with all the "distractions" of a stock price of $140 when it was expected to go public at $14. CNBC reported yesterday that several _secretaries_ at Netscape have cashed in $600K stock options....I can imagine a lot of folks are eager to leave to enjoy their new wealth, but will stick around for the future stock options. This becomes a real drag on productivity, based on my experiences and those of my friends at various other start up companies.) I also expect that this pro-surveillance, anti-privacy "stumble" by Jim Clark will either be quickly "clarified" (but perhaps nothing really changed), or Netscape will suffer a black eye in public relations, with many "Cypherpunk"-type people adopting a "Just Say No to Netscape!" stance. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

whither NetBill? (micropayments)
by Thomas Grant Edwards 17 Dec '03

17 Dec '03

NetBill (http://www.ini.cmu.edu/netbill/) appears to be a great way for implementing micropayments. Does anyone know what the deal is, or did Visa sign on just to keep it from happening? -Thomas

1 0

Re: Netscape, Corporations, and GAK Support
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:08 PM 11/30/95, hallam(a)w3.org wrote: >Folks, lay of Netscape on this one. _EVERYONE_ is doing Terissa for the feds to >use themselves. There are reporting requirements (FOI) which most people >on this >list seem to enjoy which make the privacy issue moot. There are other >people who do >not want to have non escrowed data flowing over their internal nets, nuclear >installations etc. Ah, but Jim Clark's comments were as follows, and indicate that the issue is the _government_ reading _private Net communications_: ---section of interview or speech with/by Jim Clark of Netscape, emphasis added by me--- To secure Net communications, the government will need to have access to private data exchanges ^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ using what is known as a key escrow security system, said Clark. He added that an invincible security system for the Net is possible, but such asystem won't be built unless the government ^^^^^^^^^^ has a stake in it. "That's where key escrow comes in," said Clark. Key escrow is a controversial security system advocated by the Clinton administration that gives the government access to private Net communications. It uses public key cryptography, a system ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ in which messages are coded and decoded using a set of private and public keys. In key escrow, the private key is held by both the individual or group and the government. The government can ^^^^^^^^^^^^^^^^^^ use the key ostensibly to read messages for intelligence and national security reasons. ---end of section--- This is not then just an issue of supporting voluntary key escrow for corporations, nuclear installations, germ warfare labs, and the Church of Scientology, this is GAK, pure and simple. Phill, very few of us are opposed to the voluntary use of escrow schemes. I, myself, would be interested in a robust system wherein my lawyer, for example, could have a "duplicate key" to some of my files. We have discussed this issue many times. Truly voluntary key escrow means that the criteria described above by Jim Clark, that government access to private communications is "where key escrow comes in," would be impossible to achieve. Clearly, the type of key escrow being supported by Jim Clark, Dorothy Denning, David Sternlight, Stuart Baker, and others is hardly voluntary. >Key escrow is not bad in itself. It is the idea that individuals be forced to >use it for private conversations that is the bad idea. Carefully read Jim Clark's direct quotes and the views attributed to him in the article. > >If people want to argue "make the technology avaliable and it will be >abused" then >let them. Just remember that we normally argue the other side of the case. No, the issue is that the proposal is explicitly GAK, not a voluntary system. Details of deployment are of course murky, and this firestorm may help to kill it for now, but the issue is clearly that Jim Clark is saying the government needs to be able to read private communications and that key escrow is needed. Given that he is the Chairman of Netscape, this is worrisome. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Getting a copy of the Jim Clark speech
by Raph Levien 17 Dec '03

17 Dec '03

I called Netscape public relations. Here's what I found out: 1. Netscape PR does not keep transcripts, etc., of Jim Clark's speeches. 2. You can order a tape of the speech from Conference Copy for $12. Their phone number is +1 (717) 775 0580. Be advised, though, that it will take three weeks. If we are lucky, an amateur recording technician (trained by the Grateful Dead, perhaps?) will come out of the woodwork before then. Failing that, maybe a Fair Witness was there and is willing to speak. Raph

2 1

query...
by BlackHeart 17 Dec '03

17 Dec '03

Reply to: DR940788(a)caper1.uccb.ns.ca I am currently putting together an e-zine covering computer security issues, non-mainstream music, and basically anything else people want to write about. This is an open query for submissions on any kind. Here are good examples of what I will consider putting into the zine : --------- Good chance of getting in: a. interviews, quotes, etc. from "net personalities", writers, band members, people with interesting computer-related jobs/hobbies/etc. b. people involved in the field of computer security on either side of the wall, hackers, phreaks, system admins, police, etc. and their tales c. reviews of independant, or non-mainstream software, movies, music, etc. d. any kind of new digital tech. that is interesting and unique, a description and review e. basically anything else that is related to the information age, digital, cyber (even though i hate the word), 'net related, etc. --------- NO chance of getting in: a. political views/essays which are not a concern of the computer and/or net community b. fiction of ANY sort (sci-fi, cyberpunk, etc, etc.) c. anything else not related to alternative or "tech" field (ex - reviews of mainstream albums, movies, etc., also articles on things such as the environment and gay rights will be turned away, simply because this is not what the magazine is aiming for) --------- If you have an album, tape, CD, software, device, etc. you want reviewed, send it along to : Terminal Obsession P.O. Box 831 Sydney, Nova Scotia CANADA B1P 6T7 If you are interested in subscribing to the completed 'zine, wait until you see an announcement, as the zine is not complete as of yet, and may not be for a short while, so i have nothing to send you yet!

1 0

Netscape's Delicate Balancing Act
by tcmay＠got.net 17 Dec '03

17 Dec '03

The market valuation of Netscape Communications is not specifically a Cypherpunks topic, though many of us interested in it, and/or use Netscape. But there are some issues about Netscape's future product plans which may affect market valuation, and which also could hinge on PR issues like Jim Clark's apparent support for mandatory key escrow. To wit, Netscape is currently valued at $5 billion or so, despite having essentially no revenues or profits (sure, it has a little of each, but not much). This is more than the market capitalization of many sizable, respected companies. Companies like General Dynamics, Apple Computer, CBS (which was just sold to Westinghouse for $5B). Granted, Netscape investors are betting on the come. (And contrary to what someone said, investors in companies like Netscape are not mostly interested in profits. Rather, they are interested in selling at a higher price, for whatever reason. This is also known as the "greater fool" theory: that no matter how high the price of a stock, there is some greater fool who will buy it a higher price. Of course, the corrolary to the greater fool theory is that there is usually a greatest fool.) So, can Netscape keep a $5 billion valuation? (And more to the point, can it double from where it is now, say, and sustain a $10 B valuation? I am skeptical, personally, but I've been wrong before.) What Netscape has to offer is based on a *public* standard, the Web and all the various pieces that so many companies are supporting. Netscape's _server_ market--which is said to be where the revenues are mostly coming from--is likely to face heavy competition. As is the browser, of course. (Spyglass Mosaic, Ravi's company, HotJava, CyberDog, MacWeb, and a bunch of others). Scenario #1: Netscape sticks to an open standard. Hard to see what keeps the valuation at $5 B with so many free browsers, free servers, low-cost servers, etc. (From the browsing side, "brand loyalty" is probably minimal: I've used several browsers, and currently use Netscape 1.1N for _some_ of my Web needs. I'll switch "on a dime" to another browser if it offers features I like. Others I have talked to feel the same way. I think "loyalty" to a particular browser is close to nil. Much less than loyalty to a text editor, for example.) Scenario #2: Realizing this, Netscape seeks to "differentiate itself" by proprietary technology. "'Nuff said." I can't see any means of "proprieterizing" the Web that Netscape could hang on to. Any good ideas will be quickly copied or reverse-engineered by other companies and groups. Unlike a chip company, with various and complicated secrets tied up in internal chip design data bases and in billion-dollar fabrication plants, what could a browser or server really keep secret? Unlike a company like Adobe, with various programs whose functionality can mostly be protected from copying by use of copyright laws, a Web browser that operates on public standard files in standard ways will be hard to protect. (Ironically, Netscape's valuation is significantly higher than Adobe's, and Adobe had something like $700 million in yearly sales and $100+ million in profits.) So, it is my thesis that "brand loyalty" to Netscape is ephemeral, that users will flock to the Next Whizzy Thing faster than you can say "price collapse." The connection with crypto and key escrow is that any bad publicity, any hint that Netscape is signing-on to be an agent for Big Brother, could hasten this conversion. While I would never, ever suggest to anyone that the sticker idea I devised a few years ago--"Big Brother Inside"--be applied here, I can imagine others will. Netscape is in a very delicate balancing act. Jim Clark may turn out to be the Karl Wallenda of the Web (with no Net to catch him). --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Netscape gives in to key escrow
by vinnie＠webstuff.apple.com 17 Dec '03

17 Dec '03

GAK or is it Gack!!! You know, one possible solution lies in the direction of Apple's CyberDog. It is based on OpenDoc and should be portable to windoze, I hate to say Rah told you so but... Even with all the ITAR silliness, even if on the contigincy that Apple can't provide a SSL or whatever in thier HTML part, YOU can always write your own HTML part, (its just not that complicated) in the Cyberdog environment and override the Apple CyberDog HTML part. This looks like a great opertunity for some Cypherpunks to write code, and code that people DO care about.. a CypherPunk CyberDog part to replace the Apple HTML viewer with one that has hooks for an encryption API (GSSAPI?) (lawyer types beware: This is definitely my opinion and you and I both know Apple is old enough to speak for itself.) ------------- Vinnie Moscaritolo Apple DTS Sniper "One Shot..One Kill" http://webstuff.apple.com/~vinnie/ Fingerprint = 4F A3 29 81 50 E4 04 F2 78 25 01 87 6E A2 14 6A --------------

2 1

Re: Netscape, Corporations, and GAK Support
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:09 PM 11/30/95, Timothy C. May wrote: >To secure Net communications, the government will need to have access to >private data exchanges > ^^^^^^^^^^ >^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Sorry about the misaligned text and emphasis marks--it looked OK when I was composing the message, but some hidden characters must've been present when I cut-and-pasted the Clark text. I think you all get the gist, though. --Tim Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

CyberDog?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:16 PM 11/30/95, Vinnie Moscaritolo wrote: >You know, one possible solution lies in the direction of Apple's CyberDog. >It is based on OpenDoc and should be portable to windoze, I hate to say Rah >told you so but... > >Even with all the ITAR silliness, even if on the contigincy that Apple >can't provide a SSL or whatever in thier HTML part, YOU can always write >your own HTML part, (its just not that complicated) in the Cyberdog >environment and override the Apple CyberDog HTML part. > >This looks like a great opertunity for some Cypherpunks to write code, and ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >code that people DO care about.. a CypherPunk CyberDog part to replace the >Apple HTML viewer with one that has hooks for an encryption API (GSSAPI?) Go for it, Vinnie! Let us know how it works out. Being at Apple, I presume, you're in a position to do what you suggest. The problem of course is that many, many pieces of code "need" to be written: several projects mentioned on this list frequently could use more coders. Integrating the casual work of volunteers is usually hard to do. If the idea is really a good one, and will result in an interesting product, then probably the best approach is for someone to do more than just volunteer some free time: he should set out to build a product he can sell or at least get some recognition for. (A la Eudora, Stuffit, Red Ryder, etc.) I'm a Mac user, but am taking a wait-and-see approach to this "CyberDog" (dumb name!) thing. If it works out, great. But until OpenDoc (and the alphabet soup of object standards like Ole, Bento, DOE, SOM, etc.) appears in real products and demonstrates usefulness, I don't see a rush of folks moving from Windows and Unix platforms to the Mac to develop it. If CyberDog is really a decent Web browser--and I've heard some good things about it, admittedly from Macintosh partisans--then many of us will probably use it. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Netscape gives in to key escrow
by Corey Bridges 17 Dec '03

17 Dec '03

Speaking for me and not Netscape: I am not in favor of governmental key escrow. Getting that news yesterday made for the worst day I've had in a while. However, I think that history will look back on this period and snicker. "They thought they could pull off key escrow? Yeah, right." I think that things are going to get pretty ugly over the next few years, but ultimately, it's too late. The genie's out of the bottle. I'm not going to say "Don't give up on Netscape." Do what you feel you should. *I'm* not giving up on Netscape, however. We haven't adopted this as a company position, and besides, I think I can do more good on the inside than on the outside. In a related matter, there was talk a couple days back about creating a PGP plug-in for Netscape Navigator. I've actually been thinking about that for a couple months, but I make a much better writer than a programmer. (And if you've ever read any of my books, keep your jokes to yourself.) Anyway, if people out there are interested in doing the real work on such a product, I'd be more than willing to help with the documentation, UI, and other things where I have a modicum of talent. I'd also put a copy of it on my home page and hype it internally. In an unofficial capacity, natch. Corey Bridges Security Documentation Manager Netscape Communications Corporation 415-528-2978

1 0

Re: GAKzilla & British MPs
by KJC＠cityscape.co.uk 17 Dec '03

17 Dec '03

> > >On Thu, 30 Nov 1995, KJC wrote: > >> for ages - I give up!.- BTW- after 'Britland' MPs posted hear a while back > >Interesting, that must have been during one of my sanity vacations from the >list. Do you remember approx. when or maybe what their names were? >Might make it easier to hunt it down in the archives. >Thanks. > >You know it's really strange, the only people around here I've found >interested in crypto and aware of sci.crypt and this list were government >spooks. I even sold my 1st edition Applied Crypto to one. >Friendly people, but totally discouraging. > >> I thought _maybe_ we'd hear more.Will the last one to leave Grate Britain >> please switch out the lights! >> kc >At least you have better weather. > > I think it was around March '95. Adam Back(?) cross-posted an email from sci.crypt (written by Chris Smith and concerning Cambridge(U.K.) MP Anne Campbell).At some point Campbell posted to the list herself(?) Sorry,I'm not very clear on this but for some reason I always thought she wasn't the only MP involved. Yadayadayada... they're a bit like London buses- nothing for hours then 3 or 4 arrive at the same time... I've posted this to the list 'cause maybe someone can update the story... I'd _still_ like to know if there has been any discussion(by MPs) since then Sorry about the bandwidth kc p.s. Weather better now its been sold to the French.

1 0

none test
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

12890 87221 56907 00458 94225 40838 75693 98239 87802 85834 98347 49857 21349 12038 14896 09343 87458 98589 32759 74545

1 0

UK Labour Party policy on encryption
by Richard Martin 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [see http://www.poptel.org.uk/labour-party/policy/info-highway/content.html for full text] > It is important that privacy is rigorously protected over the > new networks, for both personal and commercial reasons. We do > not accept the "clipper chip" argument developed in the United > States for the authorities to be able to swoop down on any > encrypted message at will and unscramble it. > > The only power we would wish to give to the authorities, in > order to pursue a defined legitimate anti-criminal purpose, > would be to enable decryption to be demanded under judicial > warrant (in the same way that a warrant is required in order > to search someone's home). > > Attempts to control the use of encryption technology are wrong > in principle, unworkable in practice, and damaging to the > long-term economic value of the information networks. There is > no fundamental difference between an encrypted file and a > locked safe. A safe may be effectively impregnable in that the > effort taken to open it would destroy the contents. An > encryption algorithm, similarly, may be effectively > unbreakable. Notes. I've taken this entirely out of context*; cpunks will be glad to find that the same document manages to hit at least two of the horsemen of the infocalypse. A few paragraphs earlier is the standard "must protect women, children, and ethnic minorities" (paraphrased) argument. Labour seems likely to form the next government. And even if they don't, their stated policy might be a good thing to take to the Tories, saying something along the lines of, "Labour has a clue, where's yours?" [Note that I was unable to find the Tory point of view.] I found this stuff from Anne Campbell MP's home page. http://www.worldserver.pipex.com/home/anne.campbell * for brevity's sake. richard Richard Martin I DON'T SPEAK FOR ALIAS|WAVEFRONT Alias|Wavefront - Toronto Office [Co-op Software Developer, Games Team] rmartin@aw.sgi.com/g4frodo@cdf.toronto.edu http://www.io.org/~samwise Trinity College UofT ChemPhysCompSci 9T7+PEY=9T8 Shad Valley Waterloo 1992 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBML5COB1gtCYLvIJ1AQFZ1wP+Ox2fbOKsEbtl06GZugpB8ecHl5cGYHSQ 7sBro0QFr2v4KZOV6X435LXmAqSV8ML+BmVsT/1bnfUzsxeIQErhC0q1kQeA+hAX h21SYfW6hN3h2L9aOtLr/1FDZkKAcXGDNFkvq/weKQdxCbtTw0Nl1ZQym3oaYdhT MrjKi85fU44= =CeYH -----END PGP SIGNATURE-----

1 0

Re: e$: Moof! (Hettinga Speaks at Apple)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 28 Nov 1995, Robert Hettinga wrote: > God help us all. > > I've been invited to the CyberDog Coding Retreat next week at Apple > Computer in Cupertino. Getting flown out there is cool. Hanging with the > more clueful Mac Internet types and getting to kibbitz and watch (I like to > watch!) them code OpenDoc parts for the internet from 8AM to midnight plus, > subsisting on Dew and Pizza is really way cool. Even getting some > mac.cypherpunks in the door to code cypto parts is extremely cool. But... Mountain Dew and Pizza?? Ohh, waita minutae ... this is California. That means it's probably smoked salmon, with avocado and mayonnaise pizza. Yum. Seriously though ... I'm green with envy. I'd love to attend something like this, but logistics would be a nightmare. First, I'd have to get clearance from the US government for that. And I think I'm on their "undesirable" list, and would need to get some type of waiver to clear immigration. Problems, eh?? I tried to call the Consul-General this afternoon, actually to inquire about that and got put on perpetual hold and forced to listen to some long recording. Then I was told that if I wanted any information at all, I should call a 1-900 number. A 1-900 number?? Too rich for my blood. I guess that Foggy Bottom, really is worried about their budget issues, aren't they? I guess they really want me to use my quarter for pretty much everything. > They've asked me to give a "talk". All by myself. In an auditorium. With an > audience, I mean. With publicity. I feel like Hoffman in Rain Man... > V-E-R-N, Verrrn... More to the point, I feel like I'm tempting fate, > here... Oh, I hate large groups, unless I have prepared text. > Sooo. I've been told I can have friends in the audience. That's cool. As > many friends as I want. That's even cooler. I can even have reinforcements > up on the rostrum. That's extremely cool. Cool. About reinforcements on the rostrum. I know, I really wouldn't inspire any confidence in the audience, at all. I'd probably go off into some strange side track on the nuances of something completely irrelevant and loose the entire audience while talking. I'm really one of those people that doesn't always have facts, and figures, and symbols readily at hand. It's a cognitive thing. Sort of like a database inquiry. Alternatively, if I do focus on an issue. YIKES!! My Aunt Danielle always warned me about my tendancy to use nuclear weapons when simple artillery would suffice. I tend to come on a "bit" heavy at times, unless I actively self-censor. It really is a constant battle on that front. > So, while I work on the "reinforcements up on the rostrum" part, *please* > come and help me explain this stuff to the rest of the Apple community. I'm really not sure I'd necessarily want to break "bad news" to people, reinforcements or not. I saw this yesterday, at a presentation that I was at. It was horrible, and I wasn't even presenting. I was in the audience -- an invited guest. I sorta kinda pissed on someone's campfire, and after that no-one wanted to talk to me. Shoot if looks could kill ... I'd be worried about reputations and popularity, and what this all means "long-term", beyond the time-line of the presentation. I know that explaining some of this might severely limit future opportunities. I think I read that somewhere recently ... that "consultants with blood on their hatchets" usually don't get very far. But it's your talk, I guess. Just my $.02. > Cryptoanarchy. Right here in Cupertino, folks. > > See you there... Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Q: Legal liability for Certification Authority
by Greg Rose 17 Dec '03

17 Dec '03

In the last few weeks, mostly under the subject of creating a Cypherpunks Certification Authority, someone mentioned legal liability of a CA if a certified identity was misused. I am looking for material to pass on to a REAL, PAID net-savvy lawyer relating to this question. In return for the money we pay him, he will return an opinion on just what liability exposure would be for, say, a large technical users group who got into the CA business for PGP keys. And/or what disclaimers or indemnities would be needed. I would be happy to make his legal opinion available to the list. IANAL, so I don't know just what precedents, decisions, regulations, and so on might be relevent. More information is always a good thing. Please: 1. reply to me by mail, not the list, unless there is more general relevence to Cypherpunks. I'll summarise. 2. Speculation is not useful. thanks, Greg. -- Greg Rose INTERNET: greg_rose(a)sydney.sterling.com Sterling Software VOICE: +61-2-9975 4777 FAX: +61-2-9975 2921 28 Rodborough Rd. http://www.sydney.sterling.com:8080/~ggr/ French's Forest 35 0A 79 7D 5E 21 8D 47 E3 53 75 66 AC FB D9 45 NSW 2086 Australia. co-mod sci.crypt.research, USENIX Director.

1 0

Re: Netscape gives in to key escrow
by Jeff Hupp 17 Dec '03

17 Dec '03

On 30 Nov 95 at 13:30, Timothy C. May wrote: : At 7:26 PM 11/30/95, Ravi Pandya wrote: : >If you're looking for an alternative Web browser for Windows, we just made : >ours available for free at www.netmanage.com. It's fast and reliable, and : >supports HTML 3.0, inline video, software distribution, VRML (NT version), : >Real Audio, TrueSpeech, etc. : : This shows the price Netscape could pay for taking a pro-surveillance, : anti-privacy stance. : The word is getting out. Both brokers I have system support contracts with have called me asking for my take. -- JHupp(a)gensys.com |For PGP Public Key: http://gensys.com |finger jhupp(a)gensys.com Waking a person unnecessarily should not be considered a capital crime. For a first offence, that is

1 0