December 2003 - cypherpunks-legacy

Re: Fw: Jim Bell Sentenced (fwd)
by John Young 17 Dec '03

17 Dec '03

Jim Choate wrote: A pretty convincing manifesto, as far as Constitution-thumping goes. And then, empowered by righteousness, fire-and-brimstoned: >You sir, don't have one whit of morality, ethics, or empathy. >Let alone any sort of sense of justice or liberty. > >I hope your happy licking the hands of your keepers. Damn tooting, Jim, my babe is sweetest licking and being his love slave is a pleasure. And for it, I eagerly forego morality, ethics, empathy, justice and liberty along with constitutional and biblical protection. Babe's my blackhearted PO, with two years to release. Damn, Jim, have you never lost it all where every which way was up? If not, then you don't know shit about Jim's situation, or mine, sweetheart, and whose balls you'll lick to get back to zero, not even hoping you'll get back to where you were before insane vanity took you and those who trusted you over the edge to irreversible loss and despair. Sorry to say that "Constitutional protections" might do that to you, Jim, for they are sometimes finger-licking nose-candy, bad shit that's pushed by a nasty gang of predators as morality, ethics, empathy, justice and liberty along with biblical protection. They, and other holy writs, have got a lot of innocents wasted for addictive righteousness of hustlers who use perfect grammar to hide evil. Just kidding, son, you're okay, don't EMR me. Zap my literary inchoate.

1 0

Re: HAYEKWEB: V Postrel on Hayek
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

On Sun, 14 Dec 1997 at 11:29:25 -0600 (CST) Jim Choate once again showed his clueless side (yes, he does have another side) wrote: >> Nobel laureate F.A. Hayek, one of the earliest economic >> theorists of the role of knowledge, would have recognized >> the problem. Organizations overcome such difficulties >> through compromise and negotiation, or they break down. >> But society as a whole can avoid the "knowledge problem" >> only at the cost of stamping out individuality. > It's a real pitty Hayek never tried 'cooperation' instead > of 'compromise'. It's a real pity Choate never tried reading before spewing. It would appear poor Jim doesn't have a clear idea of Hayek, and has difficulty distinguishing between any of the several voices used, and in filling in thin context. This is another case like Jim's confusion over which "Gates" Tim was referring to in a recent post. > Oh, the short-short sightedness of ego and tryanny. Well, ego anyway. > What is the line of reasoning that the *only* solution for > society is to stamp out individuality? Sounds more like > wishful thinking from some brain-dead drone with no > imagination or respect for others. Sounds like you should do some reading before you mouth off. > Perhaps he should have stuck with economics and kept away > from sociology. Perhaps you should have stuck with programming and kept away from political commentary. Scratch that -- programming requires a high degree of ability to deal with reality as it is, not as one mistakenly sees it. Your assignment is to read The Road to Serfdom and submit a 5,000 word essay to the c-p list on the subject of Hayek, the brain-dead drone. Following that you will be allowed to submit a 20,000 word essay on Jim Choate, the often-clueless and illiterate half-wit motor mouth. GetALifeMongerII

1 0

IRS intimidation of Cypherpunks
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

On Sun, 14 Dec 1997 at 08:12:31 -0600 Human Gus-Peter wrote: >>> We should not let distaste/disgust for Jim's ideas and >>> tactics blind us to the important legal and constitutional >>> questions lurking beneath the surface of this investigation >>> and prosecution - there's some possibility that the IRS >>> used its investigation of Jim as a threat to other prolific >>> authors on the Internet. > The government's armed assault on Ma and Pa Bell's > residence took place within hours of an email being sent > to him containing a rough draft of a chapter of an InterNet > published manuscript describing and lauding Bell's AP system. >>> For example, copies of the press release announcing the >>> raid on Jim's home were mailed, apparently from computer >>> systems inside the IRS, to individuals active on the >>> Cypherpunks list. The IRS has never before (or since) >>> bothered to notify those individuals about criminal >>> investigations which might otherwise be of interest. > It is interesting to note that the emails from > treasury.gov constituted the same type of 'threat' that > Bell was roundly accused of by government officials and > the press. I've seen brief mention of this before, but have never seen any details on the list. Aside from Jim Choate questioning my arithmetic or attention span, would anyone be kind enough to provide pointers to information about incidents of c-p list members having received unsolicited email from .gov? Declan, did you catch a whiff of this when it happened? I would think everyone's alarm bells would have gone off and people would have been intensely interested in the messages themselves, particularly the headers. StringPullMongerII

4 3

Bell sentencing
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- the charges of intimidating an IRS agent are felonies the stinkbomb charge in a federal building is a felony the tax evasion charges are felonies virtually all federal felonies start with 5 years and increase from there. federal misdemeanors have a sentence limitation of 1 year less 1 day. under the sentencing guidelines, it is difficult for the judge to hand down less than the specified guideline unless a deal has been cut --big time, I would say in this case. the prosecutor and public defender agreed on one year, but probation and parole asked for two years -therefore the plea bargained charge was a felony. secondly, the Feds almost always file the charge itself, plus a separate charge of conspiracy (even if they do call the rest of the conspirators "unknown") which carries the same time as the act of commission. you can rack up some serious time with Fed charges which do not seem like much until they multiple count the indictment and add conspiracy. given the exposure of this case, etc. there was a deal cut someplace. frankly, I would rather do 3 years inside instead of "highly supervised" tail --some asshole social worker cum parole officer that can literally tell you when you can shit; if he tells you to start polishing the apple, you best be getting on your knees and get on with it. you have more rights in federal prison than you do with a PO and his inferiority or dogooder complex --either way, you are his victim. personally, I think Bell was lucky --or he rolled over and the fruits of his loose tongue will start new lives for new political prisoners of the U.S. gestapo. I'll put my money on the rollover. too many unanswered questions; books returned marked "not a prisoner"; writing a letter acknowledging he was a "bad person"; and all that good stuff. Bell just snitched out; he doesn't look like the type that would do well under pressure. maybe a lot of bark, but no bite to tell the man to fuck off. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQBVAwUBNJSp2rR8UA6T6u61AQHsOAH9GXK+cHv91438Cmr9INsDCCEIbpWL9YO6 HDsWygSXSIWftoQl0+SFUL7/6mcjPlxt7N5nTlCub4zA0JQZYEHq2w== =GPPA -----END PGP SIGNATURE-----

1 0

Identity, Persistence, Anonymity, and Accountability--Part I of II
by Tim May 17 Dec '03

17 Dec '03

[Note: This is a two-part article I posted to the "Nym" list. I'm posting it here as well, but not in a "cross-post" form, because it obviously touches on many themes of interest to Cypherpunks. Declan M. has created this new list to discuss anonymity and pseudonyms. It is, predictably, largely duplicative of discussions on the Cypherpunks and other lists, but Declan and others feel it is needed. It is not necessarily open to all, to reduce the number of insults, ASCII art posts, drunken ramblings (mine excepted), and off-topic spams and such, so don't ask _me_ for instructions on how to subscribe to it. Declan may send you instructions if he wants to, of course.] [The second part will follow this part] There are many swirling notions of anonymity here, and a bunch of what I think are misconceptions about the link between anonymous systems and "accountability." Some here believe accountability (which I'll define and discuss in more detail below) is important enough to take precedence over a "right to anonymity." I think this is confusing some important issues. First some observations: * The norm in most interactions is a very loose amount of formal checks of identity credentials. Most of us never actually check the credentials of our friends and associates. Most commercial transactions, and most travels, involve no identity credentials whatsoever. (A point nicely make my Marc Rotenberg today.) * However, as we have repeated dealings with people, on lists or in person, we begin to establish a "sense of identity" for those persons, a repeated history. This has nothing _formally_ to do with identity credentials, but much to do with _expectations_ about the future. Thus, in my several years of dealing with "Black Unicorn" I have come to view him (or her, or it) as a persistent personna. Whether or not he truly is one person, and whether I know his (alleged) True Name, is largely unimportant. * It is very important that even we non-lawyers keep in mind what a _contract_ is. A contract is an offer, and an acceptance. Whether a True Name is part of the offer, by any of the parties, is unimportant. (In terms of enforceability of the contract, in terms of going after parties who fail to meet the terms of a contract, some measure of identity may of course help accountability. But this is epiphenomenol to the basics of the contract...it's just a matter of convenience.) * Hence the view many of us have that if Alice and Bob interact, they may or may not use fake names, nicknames, handles, putative True Names, or even DNA-verified biological markers. Their call. * In cases where accountability is Very Important, as in purchases of large ticket items, the usual method is to use strict title search companies, specialists in tracking actual records. Title companies, in other words. (And, even then, proofs of identity are less extreme than many anti-anonymity advocates might think. In the purchase of three homes, I've only had to "flash" my state-issued I.D. card. In fact, it was a driver's license, hardly designed as an actual proof of identity. Of course, there are certain ontological assumptions about identity in such large-ticket purchases, such as that I.D. is backed up by other things, including possession of a title deed.) * The main question that involves Washington (or other lawmakers) is this: Under what circumstances may the state compell identity to be produced? I happen to agree with several on this list, including E. Volokh and (actually) D Brin, that there are cases where identity can be compelled. Even if it only means a _sworn statement_ (as in "making an X" on a statement written by others). Applying for a passport, appearing before court, perhaps driving on the public roads. But note that there absolutely is no requirement in the United States for a general form of identification. Non-drivers need not have any form of I.D. And as we have seen in court cases, a la Lawson v. Kolender (where a black man in dreadlocks used to like to walk the streets of San Diego...the cops stopped him many times and jailed him for not having I.D. on him...the court ruled that people don't have to present credentials issued by the state to walk the public streets). * Therefore, the issue is not of a "right to anonymity," which would probably be as nebulous to debate as the "right to privacy" (which Bork probably was correct in saying cannot be found in the Constitution), but, rather, the issue of when the State may compell identity. To put it in the blunt terms we libertarians find useful: "When can men with guns tell us we have to produce a piece of paper with our pictures on it that they find acceptable?" Possibly for the situations I mentioned above. But maybe not even in all of those situations. (Next time I am called for jury duty, and my last time was in 1973, I plan to take no state-issued I.D. junk with me...I will _tell_ them who I am and leave it at that.) * In ordinary interactions and in commercial transactions (modulo gun purchases and a few other similar areas), identity cannot be compelled. Alice is free to ask Bob for his name, or his blood type, or anything else she chooses (modulo questions banned by the Civil Rights Act, disgustingly enough), and either is free to cancel the interaction or transaction as they wish. Contracts again: an offer made and an acceptance. * Now if Alice wishes to _extend credit_ to Bob, or take his promise to pay via a check or some other "delayed clearing" instruement, she is free to request various things that will satisfy her that she can later track down Bob and collect from him. Importantly, this is not a _state_ function. This is still a matter of contract. Bob is of course free to refuse to give his name and to cancel the transaction. * It's a fact that most vendors (Alice) are less interested in acquiring market research data by getting True Names than they are in selling stuff. Hence, most merchants don't care about True Names. And for online clearing (instant clearing, as with cash or guaranteed payments sytems), names really don't matter. Even Radio Shack, which makes a big point of asking for names and addresses, will gladly make a sale to those who refuse to go along. * There are cases where this normal "Alice doesn't care about names" situation is distorted by other considerations. Recently, airlines have been instructed by the FAA to do a credential check...they are happy enough to comply, as it cuts down on the practice of companies buying advance tickets in bulk and then deciding later who will actually use the tickets. (I believe the pre-FAA ruling situation, where airlines didn't bother to check I.D.s to be a good indicator of what free market forces would produce absent such an FAA rule.) Certain large-ticket purchases may no longer be made in cash. Part of this is the move to control money-laundering and smurfing, and the "structuring" laws. Black Unicorn has an amusing story of trying to buy a car in suburban Washington, with cash (or a cashier's check, I forget which), and having law enforcment arrive a short time later and hold him for questioning.... Likewise, it's becoming more common for motels and hotels to demand photo I.D. Some even refuse to accept cash without a credit card (which we know is not an actual I.D., but it sort of acts as one). I'm not sure what all the reasons for this are. Here are some, briefly: fear of being stung by someone who trashes the room, concern about being charged with enabling prostitution, pressure from regulatory boards (who may be pressured by law enforcement), or perhaps just the general attitude that "I.D. is required." (As I've said, this attitude hasn't filtered down to ordinary daily transactions.) So, identity is not the same as accountability (though there are some correlations). And lack of identity does not mean criminality. And most importantly, most cases where some proof of identity is requested don't need any state involvement in what are private transactions or contracts. Lastly, there is no "is-a-person" (in the cryptographic sense) credentialling system in the U.S. In Part II of this post, I'll combine these various points, made somewhat anecdotally here, into a more graphical form. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." Voluntary Mandatory Self-Rating of this Article (U.S. Statute 43-666-970719). Warning: Failure to Correctly and Completely Label any Article or Utterance is a Felony under the "Children's Internet Safety Act of 1997," punishable by 6 months for the first offense, two years for each additional offense, and a $100,000 fine per offense. Reminder: The PICS/RSACi label must itself not contain material in violation of the Act. ** PICS/RSACi Voluntary Self-Rating (Text Form) ** : Suitable for Children: yes Age Rating: 5 years and up. Suitable for Christians: No Suitable for Moslems: No Hindus: Yes Pacifists: No Government Officials: No Nihilists: Yes Anarchists: Yes Vegetarians: Yes Vegans: No Homosexuals: No Atheists: Yes Caucasoids: Yes Negroids: No Mongoloids: Yes Bipolar Disorder: No MPD: Yes and No Attention Deficit Disorder:Huh? --Contains discussions of sexuality, rebellion, anarchy, chaos,torture, regicide, presicide, suicide, aptical foddering. --Contains references hurtful to persons of poundage and people of color.Sensitive persons are advised to skip this article. **SUMMARY** Estimated number of readers qualified to read this: 1 Composite Age Rating: 45 years

4 5

Identity, Persistence, Anonymity, and Accountability--Part II ofII
by Tim May 17 Dec '03

17 Dec '03

As promised, here is Part II, with a more graphical analysis of the issues of identity, anonymity, traceability, accountability, and the correlations between them. Consider two principles axes: -- identity -- accountability A "0" on the identity axis means a complete lack of any identity, with no assurance whatsoever in the nickname, casual name, and certainly not in the True Name, of an entity. The canonical "Anonymous," with not even any clues as to identity. A "1" on the identity axis means a complete certainty as to whom someone is, with extensive credentials, perhaps even voiceprint, blood tests, etc. An appearance by Bill Clinton probably rates a "0.999" on this scale, as various input vectors are summed...most of my posts might be rated at "0.95," and so on. There are some meta-issues about what true names really are. Was Bill Clinton switched at birth? Did the Trilateral Commission actually kill the real Bill Clinton when he was at Oxford and replace him with a KGB lookalike? Do his footprints match that on the birth certificate on file in the Arkansas hospital? Is that stuff even what we mean by "that guy is Bill Clinton"? I won't get into these meta-issues here, but they are eventual boundary-value problems for any "is-a-person" formal system. On the "accountability" axis, a "0" means an entity cannot be held accountable. Cannot be reached, cannot be hauled into court, etc. This could be because the entity is outside a jurisdiction. Marc Rich, resident of Zug, Switizerland, is about a "0.1" on the accoutability scale. A "1" obviously represents full accountability. Clearly it is possible for someone to be high on the identity scale (like Marc Rich), but low on the accountability scale. Or, more interestingly, it is possible for a participant in a transaction to be essentially anonymous, but very accountable. This is what digital cash and anonymous escrow systems provide. Chaum's "credentials without identity" makes this clear. It is possible to present some credential for some property, such as age, without identity. (An easy to see example being admissions to bars...as ID scanning technology spreads, we would like to see methods for checking an age credential without also creating a computer record of all bars visited, number of drinks consumed, etc.) (Crime and illegal markets often work this way, too. That is, with identity not necessarily known ("Vinnie the Nose"), but with other mechanisms for ensuring accountability. The usual, but important, stuff about reputation capital. Ditto for primitve markets, with goods left in clearings...absolutely no "identity," but various mechanisms for enforcement of trading protocols (including "no future business if you screw me," which is how many markets have worked, a la the Law Merchant for international trade, which evovled into the Uniform Commercial Code.) OK, here's a diagram. Notice that the central diagonal, the "main sequence" ( a la Hertzsprung-Russell diagrams) is the correlation between "identity" and "accountability." To those who argue that accountability IS identity, this is there line. But there are many other place in this space. For ease (to me) in making this diagram, I've had to just use letters, with the legend below the diagram. ^ CASH TOTAL 1 | CHAUM | ESCROW ^ | BRIN | | DIGNYM | | CORP Accountability | | | MRICH | | ANON 0 |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 0 1 Identity --> CASH = immediate clearing, but no identity CHAUM = Chaumian "credentials without identity" (in many forms) ESCROW = leaving a deposit, or linking to another payer (an anonymous VISA card, with a deposit, works this way. Or a corporate account, card, etc., where the company backs the transaction, but identity of the participant is unknown, or poorly known) BRIN = David Brin's "accountability means identity" mapping (no doubt there are nuances to his view, but I believe this fairly characterizes the position he has described here recently) TOTAL = The total state. Eveyone in their place, every transaction logged, everyone held accountable by the State DIGNYM = Digital pseudonyms, or signed messages. Identity may be variable, from almost completely anonymous (e.g., Pr0duct Cypher) to known to some (e.g., Black Unicorn). Accountability also varies, depending on factors like jurisdiction. CORP = corporate, or collective, accounts, where identity of actual participants is poorly known, but accountability is high MRICH = identity known to high certainty, but "judgment proof" (note that this applies to many other persons, such as poor persons, who may say all kinds of libelous or actionable things, but who are not worth going after) ANON = the canonical "anonymous" message, with no identity, no accountability. Of course, there are many other examples. And each examples has "scatter." Each is a "blob," not just a point. And they can move around, as laws change. (For example, Marc Rich could quickly become "accountable" were Switzerland to change its laws about extradition.) The structure of this identity-accountability space is itself interesting, with peaks and valleys (suggesting a third axis, that of "cost" to live in these spaces....). And so on. I hope this helps clarify for you some of my thinking on these issues. i find that simplistic arguments, whether, "accountability requires identity," or "anonymity is a basic right," are not very helpful. There are clearly times when participants in a voluntary transaction want some kind of "identity credential" (especially to the extent they think identity = accountability). There may even be times when the State has a legitimate interest in compelling identity (though many of us would quibble with most such demands, and look for ways to satisfy these "is-a-person" needs less invasively than by requiring national I.D. cards and tattooes on forearms). Again, I hope this has helped. --Tim May Voluntary Mandatory Self-Rating of this Article (U.S. Statute 43-666-970719). Warning: Failure to Correctly and Completely Label any Article or Utterance is a Felony under the "Children's Internet Safety Act of 1997," punishable by 6 months for the first offense, two years for each additional offense, and a $100,000 fine per offense. Reminder: The PICS/RSACi label must itself not contain material in violation of the Act. ** PICS/RSACi Voluntary Self-Rating (Text Form) ** : Suitable for Children: yes Age Rating: 5 years and up. Suitable for Christians: No Suitable for Moslems: No Hindus: Yes Pacifists: No Government Officials: No Nihilists: Yes Anarchists: Yes Vegetarians: Yes Vegans: No Homosexuals: No Atheists: Yes Caucasoids: Yes Negroids: No Mongoloids: Yes Bipolar Disorder: No MPD: Yes and No Attention Deficit Disorder:Huh? --Contains discussions of sexuality, rebellion, anarchy, chaos,torture, regicide, presicide, suicide, aptical foddering. --Contains references hurtful to persons of poundage and people of color.Sensitive persons are advised to skip this article. **SUMMARY** Estimated number of readers qualified to read this: 1 Composite Age Rating: 45 years

1 0

Re: Fw: Jim Bell Sentenced (fwd)
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

>Phillip M. Hallam-Baker <hallam(a)ai.mit.edu> wrote: > >>FC folk may find this interesting. What Jim Bell was charged >>with and admitted was planning and executing attacks on the >>IRS. > >No, that's not correct. He was charged with (and plead guilty to) >obstructing an IRS agent (26 USC 7212(a)) and misuse of a Social Security >number (42 USC 408). The "attack" he admitted to executing consisted of >applying a stinky chemical to the doormat of an IRS office. (see ><http://jya.com/jimbell-dock4.htm> for more.) Actually I was entirely correct. He had already executed a non-lethal attack and there was considerable evidence to suggest he was planning something more lethal in future. >>His 'Assasination Politics' essay was used to demonstrate >>motive (amongst other things). > >That doesn't make any sense - it could conceivably have been introduced to >demonstrate intent, or state of mind .. but not motive, at least in the Read the essay, he quite clearly states his reason for wanting to see IRS agents murdered. >But it's misleading to say that the essay was used to "demonstrate" >anything, as it was never introduced into evidence - there was no trial. He plead guilty, to lesser charges. That does not mean he gets the benefit of the doubt. He was clearly a loon and quite probably would have killed someone sooner or later. Phill

2 1

Re: IRS intimidation of Cypherpunks
by John Young 17 Dec '03

17 Dec '03

bureau42 Anonymous Remailer wrote: >would anyone be kind enough >to provide pointers to information about incidents of c-p >list members having received unsolicited email from .gov? See the IRS spam at: http://jya.com/irs-spam.htm And the 7 headers of 19 spams, titled "Death to Tyrants" and "Something of Interest" sent to various persons at: http://jya.com/irs-header.txt I recall that Declan offered to ask IRS about the spam, but do not recall if he was successful.

1 0

Gates of Hell
by Jenaer Mixmaster Anonserver 17 Dec '03

17 Dec '03

I'd always wondered how Bill Gates could shit with that pole so far up his ass. Then I realized: The pole is too long to be completely embedded in his ass and he uses the other half of it to rape computer users everywhere on a regular basis. And since the pole is crammed in his ass he can't shit, so he just retains his shit, making him incredibly anal retentive. I'm sure he enjoys this.

1 0

All Children Work in Sweatshops
by Eric Cordian 17 Dec '03

17 Dec '03

One of the interesting things about the child porn crusades is the terminology manipulation employed to officially describe more and more innocuous things as officially being "child porn," and by inference, describing those who object the slightest bit to the government's violation of the First Ammendment as "child porn supporters." Now the wonders of government terminology have been applied to a new problem, the "scourge" of child labor. While an historical review will clearly demonstrate that laws preventing minors from working and earning a living had their origins in times when adult unemployment was high, and were heavily pushed by the public school teachers labor unions and immigrant parents outraged that their children had an opportunity for financial independence, the myth that such laws exist to "protect children" instead of to economically and politically disempower them persist. Enter the current crusade, being heavily trumpeted by the media, to rescue children from "sweatshops." What is a sweatshop, you may ask? According to the official definition, a "sweatshop" is a workplace that engages in repeated labor violations involving wages, hours worked, or the age of its employees. So by the magic of government definitions, all unlawfully employed minors automatically work in "sweatshops," by virtue of their being illegally employed. All people arguing for the right of minors to work of course "support sweatshops," and all consumers and stores who buy goods produced by these illegally employed minors are purchasing "goods produced by children working in sweatshops." 290,200 children are alleged to have been employed illegally last year, (in sweatshops of course). And woe to anyone who doesn't support the call to liberate these children from their paychecks. (er, sweatshops) The US is now attempting to export its crusade against so-called "child labor" to third world nations, citing of course only the most egregious examples in the case histories it presents. The US still refuses to sign the UN Convention on the Rights of the Child because it prohibits the execution of minors, which many US states permit, and guarantees minors access to reproductive health information. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

Invitation to Join "Nym"
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

You are cordially invited to join "Nym," a new mailing list devoted to discussing anonymity and pseudonymity. The topics: anonymity's history, current politics, and proposals to regulate anonymous speech and commerce. Nym's primary, but not exclusive, focus is on anonymity and pseudonymity online. This includes the technologies of untraceability: digital cash, anonymous remailers, and public key encryption. It will be unmoderated but not widely advertised at first in hopes of preserving quality of conversations. Personally, I'd like to see folks join from many disciplines. I don't expect it to be very high volume. To sign up, or for more info: http://www.well.com/~declan/nym/ Or send "subscribe nym" to majordomo(a)vorlon.mit.edu. -Declan

1 0

Plot to Overthrow U.S.Government: three indicted
by ichudov＠Algebra.COM 17 Dec '03

17 Dec '03

Wow, this is a colorful story. As usual, I am not sure how much of it is true. igor Three Indicted in Alleged Plot to Overthrow U.S. Government AP 13-DEC-97 LITTLE ROCK, Ark. (AP) Three men charged with planning a revolt against the United States government wanted to create a new republic limited to whites while allowing polygamy to build its population, prosecutors say. Chevie Kehoe of Colville, Wash., and Daniel Lewis Lee of Oklahoma City were charged Friday with murder, racketeering and conspiracy in a seven-count federal indictment. Kehoe, 24, directed the group, and Lee, 24, carried out the orders, the indictment said. Faron Lovelace, 40, of Sandpoint, Idaho, was charged with a single count of racketeering for allegedly being Kehoe's assistant. Prosecutors say Kehoe and the others wanted to create the Aryan Peoples Republic through a campaign of murder, robberies and kidnappings. Once the U.S. government was gone, their new country would grow quickly "by recruiting certain white people into the Republic and by engaging in polygamy so that the number of these white persons would greatly increase," the indictment said. The indictment did not detail threats or name targeted officials. Kehoe and Lee were previously charged in state court with the 1996 deaths of William Mueller, 52; his wife, Nancy, 28; and Mrs. Mueller's daughter, Sarah Elizabeth Powell, 8. Kehoe and Lee allegedly robbed Mueller, a gun dealer in Tilly, Ark., to support their cause, and the circumstances surrounding the deaths gave the Arkansas grand jury jurisdiction. Prosecutors said state murder charges would be dropped to allow the federal case to advance. Authorities say the Muellers and Kehoes knew each other and were associated through gun shows and militia group activities. Kehoe is accused of directing crimes that also include theft, interstate transportation of stolen property and money laundering. Part of Lee's job was to carry out four murders, and Lovelace's duties included one murder, according to the indictment. Kehoe and Lovelace are accused of transporting stolen goods from the white separatist community of Elohim City, Okla., to Spokane, Wash., in March 1995 and again from Arkansas to Washington after the Muellers were killed. Lovelace was convicted this year of killing Jeremy Scott, 23, in 1995 out of fear Scott was a government informant. Lovelace also has admitted kidnapping and robbing a Washington state couple in 1995. He held them captive for five hours after stealing their weapons and extorting several thousand dollars from them. Kehoe and his brother, Cheyne Kehoe, 21, made national headlines in February when they were allegedly involved in a shootout with Ohio police. It was caught on videotape by a camera mounted on a police car. No officers were wounded but a passerby was injured by a bullet fragment. Kehoe and his brother were fugitives until June, when Cheyne surrendered and told authorities where to find his brother. Cheyne was not named in Friday's indictment. Kehoe was being held in Ohio awaiting charges stemming from the videotaped shootout. Lee was jailed in Arkansas on capital murder charges, and Lovelace was being held in Idaho. Copyright 1997 & The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. `

3 2

No Subject
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

When posted MISTY algorithm source code, I hadn't read "A Cypherpunk's Manifesto" yet. Such a fee was set up as a result. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

SHY?.....................................
by highjock＠yahoo.com 17 Dec '03

17 Dec '03

FREE.....FREE.....FREE..... FREE FREE CALL! 011-678-77432 ( NEW !!! ) If you're OVER 21, Get Ready and HANG ON! Our young girls are SEXY & HOT (or HOWEVER you want), and are for real! >>>>>> LIMITED TIME OFFER <<<<<< Talk to them LIVE...... For FREE! NO 900's, NO credit cards needed! Just pick up the phone.But HURRY. You don't have too much longer. We want to introduce you to our girls and our new business, so we're charging NOTHING for the service, you just pay for normal small long distance charges. Shy?........Then sit back and listen in on live, sexy conversations with other callers. Get away from that computer, loosen your belt for a few minutes, recharge your batteries, and have some fun! They're waiting for your call, and will talk about ANYTHING you want! No holds barred. >>>>> LIMITED TIME OFFER <<<<<< FREE CALL! 011-678-77432 (Use your country code if 011 doesn't work) This is a one time mailing!! You will not receive any more ads from us. But if you'd like, hit reply and put "remove me" on the subject line.

1 0

$145 turned to $1300: BEST investment for ANYBODY
by woostp＠ns.interred.co.cr 17 Dec '03

17 Dec '03

Dear Friend: Earlier this week I sent you this very same letter and since I have not heard from you I imagined either it didn't get delivered or you accidentally hit "delete" on it. Or you simply just haven't gotten around it. I don't think you want to wait around much longer. Especially if like other friends of mine and business relationships, you are interested in MULTIPLYING SUBSTANTIALLY (and in a very short time) a very small investment. So here again, is a copy of my letter. Today I write you to share one of the most simple and beneficial investments I found in the last months. I waited effectively several months to verify the incidence of my decision and truly, I am so glad of this one, that I decided to share it with a selected handful of people. I was proposed to invest $145 minimum and $485 maximum to receive a basic $1300 in the first months with a program, by sharing it with a very few friends. (I took the $485 option). Conclusion: not only didn't I have to wait one year to see a 800% of return on my investment, but I had the surprise to receive this amount SEVERAL TIMES BY MONTH. It seems incredible, but it's true. The American Company offering this program is not only serious, but I could personally speak with the President and the CPA and they have been reliable for the few friends I shared the program with. So, if I awakened your interest just a little bit, this is the moment and opportunity to give a look to the complete information pulling the FAX ON DEMAND # 716-720-2106 or visiting the following WEBSITE: http://peopleschoice.com/STP/home.html And remember, do as I did by considering this opportunity as an investment, and, applying the program, it will give you the most secure and fantastic yield you can find. FOR ONLY $145 to $485. Just try it, contemplating that the risk is around zero and share it with two or three of your best friends just after you applied. To participate, you must indicate a sponsor number. I would be glad if you used mine, it is: # 983 registered under the name of my corporation, WOOSTER CORP. So don't hesitate on this opportunity my friend. You are getting today one of the most safe and simple ways to increase a very little capital SEVERAL TIMES. Just try it as I did. Friendly Jean Marc Gelot CEO / WOOSTER CORP.

1 0

Interview with Cindy Cohn
by Jim Gillogly 17 Dec '03

17 Dec '03

There's an excellent but short interview with Cindy Cohn, the attorney on the Bernstein Snuffle case, on the San Jose Mercury site: http://www.sjmercury.com/business/center/cohnqa121597.htm She has a knack for getting to the crux in clear and logical steps. Good stuff -- should make it all obvious to the judges! -- Jim Gillogly Sterday, 25 Foreyule S.R. 1997, 07:34 12.19.4.13.12, 2 Eb 10 Mac, Second Lord of Night

1 0

M$: an about face for NYTimes editorial policy
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>> an about face for the official policy at the NYTimes. prior to the decision, the NYT was acting almost like an apologist for M$; now they are placing the onus on M$: "It is in the public interest that Microsoft be required to show that its practices are not anticompetitive." should make life interesting; now that M$' momentum has been nicked, everybody will join in the great Muslim tradition of stoning Bill Gate$ to death. Gate$ predicted a year or so ago that M$ would suffer a near-death experience --well, BadBillyG, is the handwriting on your wall? you can fool all the people some of the time, you can fool some of the people all the time, you can not fool all the people all the time. who said that? http://www.nytimes.com/yr/mo/day/editorial/ December 15, 1997 NYTimes Editorial / editorial policy statement Saying No to Microsoft >>> NYTimes' policy change since the decision: A preliminary injunction ... ... is a smart step that preserves the competitive status quo while the court reviews the antitrust suit brought by the Justice Department in October. The injunction is needed, Judge Jackson pointedly wrote, because the probability that Microsoft will, through its licensing practices, reinforce its operating system monopoly and acquire yet another monopoly in the Internet browser market "is simply too great to tolerate indefinitely until the issue is finally resolved." ... ...Judge Jackson said Microsoft's idea of what is "integrated" would appear to render the consent decree provision meaningless. If Internet Explorer can be turned into a Windows component under the decree, so might other Microsoft products like Word and Excel. >>> the NYTimes real reversal of statement since the decision: ...It is in the public interest that Microsoft be required to show that its practices are not anticompetitive. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQBVAwUBNJTfY7R8UA6T6u61AQGfPAH/aYfZ25kL3xJBpJgX9CUYmeBM8EE57xno MLonOVNkvMNyVyuJS2X8N1x5higS8q/V4sOv89K9w6tq2u8Hud5SUg== =D5z5 -----END PGP SIGNATURE-----

1 0

Re: Who's afraid of an uncensored forum? Good riddance to forger
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

mj(a)creative.net writes: > > Tiny Tim is > >happy to bend over and let Declan (or Sandy or any other self-appointed > >censor) decide which of Timmy's rants are worth publishing. > > <snip> > > Look, I'm new to this list and don't know the history of these disputes - I > have neither information nor prejudices - but you must be aware that it's > difficult to take anyone who talks like this seriously. Or even to keep > listening. If you have a problem, you can killfile me or go to a modereated list. There are plenty of them. > <snip> > > > >I'm not the only victim of Declan's lies and forgeries. E.g., the Center for > >Deomcracy in Technology (CDT) complained to Declan's employer, Time Warner, > >about Declan's lies, forgeries, and misrepresentations of CDT's position. > > > > Can you document this? Yes, but I have better things do to. Search the list archives. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Welcome to OANDA financial services
by webmaster＠olsen.ch 17 Dec '03

17 Dec '03

Dear Fred Cypherpunk, Thank you for registering with OANDA! You may begin to use your account (cypherpunks) immediately to access any of the following services: - OANDA's advanced financial forecasting services. Refer to our pricing plan to find out how to best use your free credit. Please note that starting December 1, 1997, all of our prices are handled in US dollars. - OANDA's Customizable Currency Converter. Now you can customize OANDA's popular 164 Currency Converter with the look and feel of your Web site. Feel free to try your own customization. It's free for designing and testing. Please refer to our Customizable Currency Converter for information about how to activate your customized currency converter. We would be glad to help with any questions you may have. Thanks again for using our services. Explore and enjoy! The OANDA Team e-mail: oanda-info(a)oanda.com http://www.oanda.com

1 0

The Best XXX Guest Area on the Net...
by 34705164＠25955.com 17 Dec '03

17 Dec '03

Filled with the hottest XXX action on the net. See it NOW for FREE... http://www.fleshgrotto.com/guests/ We feature Streaming XXX videos, LIVE feeds, huge XXX galleries, adult toys, imports, and much more!!! Our LIVE CyberSex can't be beat, see the Newest Blondes in our stable.. Ashley and Brianna. Come see how the latest in technological wizardry can make hardcore XXX action EXPLODE on your screen. No other site gives their guests so much... Check It Out. http://www.fleshgrotto.com/guests/

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord ?"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"cracker"} = "<remailer(a)anon.efga.org> cpunk mix remix pgp hash ksub esub latent cut ek reord post"; $remailer{'redneck'} = '<config(a)anon.efga.org> newnym pgp'; $remailer{"bureau42"} = "<remailer(a)bureau42.ml.org> cpunk mix pgp ksub hash latent cut ek"; $remailer{"neva"} = "<remailer(a)neva.org> cpunk pgp pgponly hash cut ksub ?"; $remailer{"lcs"} = "<mix(a)anon.lcs.mit.edu> mix"; $remailer{"medusa"} = "<medusa(a)weasel.owl.de> mix middle" $remailer{"McCain"} = "<mccain(a)notatla.demon.co.uk> mix middle"; $remailer{"valdeez"} = "<valdeez(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"arrid"} = "<arrid(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"hera"} = "<goddesshera(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"htuttle"} = "<h_tuttle(a)rigel.cyberpass.net> cpunk pgp hash latent cut post ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix reno winsock) (weasel squirrel medusa) (cracker redneck) (nym lcs) (valdeez arrid hera) This remailer list is somewhat phooey. Go check out http://www.publius.net/rlist.html for a good one. Last update: Thu 23 Oct 97 15:48:06 PDT remailer email address history latency uptime ----------------------------------------------------------------------- hera goddesshera(a)juno.com ------------ 5:03:45 99.86% nym config(a)nym.alias.net +*#**#**### :34 95.82% redneck config(a)anon.efga.org #*##*+#**** 2:00 95.44% mix mixmaster(a)remail.obscura.com +++ ++++++* 19:18 95.27% squirrel mix(a)squirrel.owl.de -- ---+--- 2:34:19 95.16% cyber alias(a)alias.cyberpass.net *++***+ ++ 11:26 95.11% replay remailer(a)replay.com **** *** 10:06 94.93% arrid arrid(a)juno.com ----.------ 8:50:34 94.41% bureau42 remailer(a)bureau42.ml.org --------- 3:38:29 93.53% cracker remailer(a)anon.efga.org + +*+*+*+ 16:32 92.80% jam remailer(a)cypherpunks.ca + +*-++++ 24:14 92.79% winsock winsock(a)rigel.cyberpass.net -..-..---- 9:59:18 92.22% neva remailer(a)neva.org ------****+ 1:03:02 90.39% valdeez valdeez(a)juno.com 4:58:22 -36.97% reno middleman(a)cyberpass.net 1:01:28 -2.65% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: Another of Gary Burnore's Lies Exposed
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

rashidk(a)mailexcite.com (Rashid Kaman) > X-No-Archive: yes > >Shades of McCarthyism.... > > Such big words, my my! :-) Sorry, I forgot you were from DataBasix, where most words are four letters in length. (Hint: I wasn't talking about CHARLIE McCarthy...) > >Strangely enough, a search of the public database of listed telephone numbers > >turns up nothing for you. > > Why did you look for it? To be a champion of privacy you first have > to respect privacy. Of course I respect privacy. Your phone number would only have been there if you'd CHOSEN to have it listed by the phone company, right? And if you'd chosen to have it listed, then it would be logical to assume that you WANTED people to have it. It's not like I went to your phone company and demanded that they turn over a listing of their unlisted numbers. (Your buddy Burnore, OTOH, did demand a list of all the users of the Huge Cajones Remailer from their logs. In case you're unclear on the concept, people use remailers so that people like Gary and Belinda WON'T have access to their e-mail addresses.) It was Gary Burnore and Belinda Bryan who've been denouncing "hiding behind" anything, so I found it sort of ironic that all of them have unlisted phone numbers while whining about my unlisted e-mail address. (Should I adopt Burnore's tactics and start calling the denizens of DataBasix "Unlisted Assholes"? Nah!) > >> >If remailers were shut down, I'd lose my ability to post. > >> > >> Why is that? > > > >For the same reason you'd no longer be able to post from mailexcite.com if > >someone decided to shut it down! > > That's not an answer, it's a cope out. "Cope out"? Sorry, I don't have a DataBasix-speak dictionary, and am not familiar with your in-house (or outhouse) jargon. Regardless of whether it is a "cope out" or not, it is an answer. Sorry if you don't approve. If the remailer I use for posting were to shut down, I obviously would no longer be able to utilize that resource, just as you'd no longer be able to use mailexcite.com if that were to be shut down. Something about that too difficult for you to understand? You might feel differently if Billy "Wotan" McClatchie had gone after Mailexcite rather than Mailmasher.

1 0

The closed Nym list
by Daniel J. Boone 17 Dec '03

17 Dec '03

Tim May wrote: > Declan decided that rebroadcasting articles out of Nym would not be > allowed, but he said nothing about not mentioning its existence. (Nor would > I have agreed to be on a list whose very existence I could not disclose.) > Anyway, tonight when I mentioned its existence as I was posting an article > here that I wrote for the Nym list, I half-expected some comments from > Dimitri. > > But I didn't expect someone to post the subscription instructions > (anonymously, of course). Hint: it wasn't I. > > Anyway, I suppose that by mid-morning tomorrow Declan is going to have to > decide how to deal with subscriptions by Vulis, Human Gus-Peter, Toto, and > all the others. The Nym list appears to be closed. (The web page says so -- so I didn't try.) This state of affairs may even be my fault. The history, for those who care, is appended. It's a shame -- if David Brin really is posting there as one of Tim's recent messages suggested I'd be very interested in seeing his posts. (Thanks, Tim, for reposting yours here.) I still don't think it makes much sense to have a conversation about the use of nyms and then try to protect the posters' words from public view. If posters are concerned about public scrutiny, why not use a nym? Not to mention the fact that one would have to keep the list closed to have a prayer of enforcing the no-repost rule. --Daniel Boone History: Robert Hettinga was briefly forwarding "nym" posts to e$pam, where I saw them. Declan publically requested that posts not be forwarded. I sent Robert a message asking if he was going to comply -- and expressed (to Robert) my lack of respect for a no-forwarding policy. Robert (that notorious cross-pollinizer that he is) forwarded my message to Declan, which was unfortunate -- as Declan no doubt considered my message insulting. (Addressed to Declan, it would have been.) I got a very chilly "response" from Declan about how he had no duty to entertain me with his list traffic. I took the opportunity to ask him how his no-repost rule would fare when someone using a nym started reposting the traffic publicly. He responded with "the list is now closed" or words to that effect. I realized too late he may have thought _I_ was threating to do the evil reposting deed.

2 1

No Subject
by Anonymous 17 Dec '03

17 Dec '03

If I live in the US and put the perl RSA code in my sig, then post in an international newsgroup, have I illegally exported encryption? If I put that same code on my web site, then post requests to view my site in an international newsgroup, have I exported it? What is the penalty for exporting powerful encryption?

2 1

Re: hashcash spam prevention & firewalls
by Antonomasia 17 Dec '03

17 Dec '03

Adam Back <aba(a)dcs.ex.ac.uk>: > How about this alternative which achieves the same functionality and > removes the juicy supeona target: > Turn on hashash database for all mails. That means hashcash gets put > in the database to prevent double spending. .... > So now when you reply to a message, on it's way out via the mail hub, > you remove that hashcash token from the double spending database. > This means that the sender can cache sent hashcash tokens, and re-use > them when after he gets a reply. Doesn't this invite the spammer to Bcc an accomplice with the target ISP ? The accomplice replies; thereby freeing the coin for reuse. > I am told by one subscriber to look at TIS firewall toolkits imap > program. You may have meant "smap". -- ############################################################## # Antonomasia ant(a)notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # ##############################################################

1 0

Encrypted Magic Folders
by Alex Woolfson 17 Dec '03

17 Dec '03

Hello! First of all let me go on record by saying that I really like the idea and the interface you've designed for your product, Encrypted Magic Folders. The interface is easy to use and efficient. Job well done! There are, however, some security concerns I'd like resolved before I would be interested in purchasing your product. You scramble filenames which is an excellent idea. I might suggest that you also scramble the directory names as well. When using the freeware program Directory Snoop 1.1 designed by Kent Briggs (www.briggsoft.com) in Windows 95, I was easily able to find the directories that EMF had hidden. I wasn't able to access them, but I could see they were there *and also what their names were*. I don't know if it is possible to hide these directories from such a program (although, obviously, that would be ideal), but it seems that we should at least be able to scramble the directory filenames so that little information is gleaned about which directories are worth attacking by cryptanalysis and which are not worth the attackers' trouble. On the question of encryption algorithms, let me add my voice to those who have been suggesting that you use strong and tested algorithms like IDEA or Blowfish. I feel very strongly that this is essential to any product that purports to provide true security to its users. If your product were meant to merely keep your kid sister from reading your files, then the security through obscurity your product seems to offer would be sufficient. But your marketing materials suggest that you wish to offer a greater level of security than that. Not being a cryptologist, I consulted with members of the Cypherpunk mailing list to aid me in evaluating the security of your software referring them to the "How Secure Is It?" section of your Help file. These guys really know their stuff. The verdict was unanimous--that the security of Encrypted Magic Folders was not sufficient for anything but the most casual uses. I have included below one of the more thorough and detailed of the replies in the hopes that it will be useful in improving the strength of your software. I would also feel more comfortable if you were willing to have the source code of your product reviewed by industry experts (such as Bruce Schneier of Counterpane Systems who wrote the very well respected Applied Cryptography book as well as Blowfish). If you are concerned about someone stealing your idea, non-disclosure agreements should be able to offer sufficient legal protection. Truly secure algorithms and programs can withstand this kind of scrutiny without compromising their security. Relying on the fact that your company is "too small and obscure" for an attacker to develop an prepackaged attack offers little comfort--if someone really wants to have access to my files, I imagine they'll devote the time to attempt to crack your product--copyright infringement notwithstanding! If you haven't already, I would strongly suggest that your developers read Schneier's book Applied Cryptography. It does a much better job of explaining the difference between true security and security through obscurity. And it's written for programmers who wish to use cryptography in their programs. It's not a bad read, either. :-) I am really interested in purchasing a product like Encrypted Magic Folders, but for such an application, security is obviously the biggest priority. I believe others who have not taken the trouble to write you feel the same way. If EMF makes use of strong encryption and is willing to have the source code of its product reviewed by industry experts, I would be interested in paying for it. For a $60.00 product, I believe it is fair to expect this kind of protection. Yours Alex Woolfson Below is the response of Ray Arachelian of the Cypherpunks list. There is a bit of sarcasm involved, but I trust you'll be able to see beyond it to the valid criticism he makes. I hope you find it useful. On Thu, 4 Dec 1997, Alex Woolfson wrote: > EMF's encryption offers good protection and excellent speed. It > hasn't been broken yet. It is, as far as we know, exportable. THERE > IS NO BACKDOOR. Should you forget your password there is nothing we > can do to decrypt your encrypted files. If it is exportable, then it is weak encryption by definition. The question is how weak. Reading their marketting crap provides more insights in just how lame this is: > Quite a few people ask us how big EMF's key size is. They've learned > from other encryption programs that the bigger the key the stronger > the encryption. This really doesn't apply to EMF. > > We developed our own encryption instead of using a standard because > we wanted EMF to be able to decrypt at the byte level. In this way > we only need to decrypt/encrypt the data your programs require and > not the entire file. In other words: security through obscurity. Smells like snake oil, looks like snake oil, it even has bits of snake scales in it. Heck, if they say that the key size is not important, it's likely very tiny, or regardless of what key size you'd use (if you had any choice), it's such a weak cypher that it wouldn't get you anything. > In theory, because we decrypt at the byte level, the biggest key we > could use would be 8 bits - which is a joke. So instead of > decrypting every hunk of data using the same key, as most other > encryption programs do, we developed an algorithm to vary the key > based on the data's location within the file. In this way we get > both high security and high speed. We are trying to patent EMF's > encryption method. Whoop. so the key is the location of the data? At most, this means a 32 bit key on most file systems, 64 bits on newer file systems. This assumes that your file is long enough for that. But as a key, this is totally useless as the key is the location which is visible to all. Likely they would be wise to "mix" this location key with the passphrase. This offers little more than CBC would. The only difference is that CBC is based on the previous block, where this is based on the location of a byte in the file (which is known) whereas a CBC depedns on knowledge of the previous block. If they did it the right way, they'd use the passphrase to build a lookup table of large keys based on the byte location within a file, but because this depends on your passphrase, your security is still that of the passphrase at maximum. There may be ways to weaken this. > Having said all that, truth is, most encryption isn't "cracked" by > breaking the algorithm, it's done by guessing the password. Brute > guessing of passwords tends to level the playing field tremendously. > We actually have an advantage because we aren't an established > standard. Because we're small and relatively obscure chances are no > one will take the effort to write a password guessing program (which > incidentally would violate copyright and intellectual property laws.) > Even if someone were to go thru all this effort we could easily > change the encryption method for the next update. This is total bullshit. It's Grade A, government approved exportable snake oil. Just because they are small and obscure it doesn't guarantee you any extra safety. Just because nobody has bothered to write a brute forcer for their code doens't mean nobody can do so. And no, this would not violate any of their copyright if the author of the brute forcer proggie wrote it without copying their code. It might violate intellectual property laws if they had a patent on it, but they can't get one since they're going by security through obscurity. They claim to be applying for a patent, but if they do, their code is published and their weaknesses will be displayed. It might violate trade secret laws if someone who has the source or the algorithm shares it, but not if someone reverse engineers it (depending on reverse engineering laws of course.) Just because they could "rewrite" the code in the next update against cracking or brute force attacks does not buy you security. FYI: If you use this crap and someone steals a copy of the encrypted files off your hard drive, it doesn't matter what new updates this company produces. The fact is you used the older breakable version, the attacker has your cyphertext and will decode it. > If we used an established encryption method like DES or Blowfish then > your files would probably have to be fully decrypted when opened, > would exist on disk as unencrypted while you're using them, and then > would need to be encrypted when closed. Translation: We don't use CBC, because that would be more work and slow down our crappy cypher. Deeper translation: break any portion of any encrypted file and you'll likely break the whole thing if not huge parts of it. "Established encryption methods (sic)" use CBC because it adds security. Their algorithms are well published and well known so people can find their weaknesses and publicise them. Whatever weaknesses there are in this thing are hidden from those who can't or won't reverse engineer it. But there are plenty of those who can and will, and have no qualms about releasing it anonymously, or worse: keeping the expolit to themselves so as to exploit those stupid enough to use this lame shit. It only takes one cracker with a good disassembler to reverse engineer their code and find all the holes, and they'll be out of business. If what protects your data is the cypher, and not the key, then breaking the cypher is all you need to do. Heck, I'd bet they use something really shitty like this: (since "key size is not important", and "depends on location".) char code(char *passphrase, char data, long location); { int i; char c; for (i=0; passphrase[i]>0; c^=passphrase[i++]); return (data ^ c ^ (char)(location & 0xff)); } Gee, I probably violated their "intellectual" property by guessing their code, heh. > This has multiple > disadvantages. First, if your computer shuts down while you have > "encrypted" files open, then those files would be unencrypted. This > doesn't happen with EMF as your encrypted files are always encrypted > as stored on disk. The second disadvantage is that it slows things > down tremendously. Not if you use an encrypted disk driver. then, all your data is encrypted all the time. (You get into other issues such as keeping the passphrase or key from falling into the pagefiles, etc...) [Meaningless babble deleted.] =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\. ..\|/..|sunder(a)sundernet.com|you once again. I thought you were |/\|/\ <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/ ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/. .+.v.+.|God of screwdrivers"|my eye and there we were.... |..... ======================= http://www.sundernet.com ==========================

1 0

You Could Earn $100 Every Time the Phone Rings!!
by 44096770＠15605.com 17 Dec '03

17 Dec '03

Double your money to infinity! Let professional salespeople close your contacts! Fortune 5000 is a rock-solid program that pays big checks every Friday! Friendly pros offer great support! You'll get guaranteed lowest prices on over 250,000 name-brand products and services in time for Christmas giving. YOU CAN'T BEAT THIS PROGRAM!!! Call 800 811-2141 code #47990 for the details and start creating your fortune TODAY! Please don't allow yourself to miss this incredible opportunity! Fortune 5000 is head-and-shoulders above the crowd of other opportunities! Pick up the phone NOW while the thought is fresh in your mind and start earning a SUBSTANTIAL income. You will be HAPPY you did! Call (800) 811-2141 code #47990 and say hello to a bright future!

1 0

Re: The Joys of Being Canadian
by Matt Elliott 17 Dec '03

17 Dec '03

>Cable Company Rep: "What's your Social Security number? >Answer: "I don't have one. I'm Canadian." For my cable company I asked why they wanted it. For a security check when you call in was the response. Does it need to be an actuall social security number? No, just something you can remember when you call up. 012-01-0123 I replied. They were quite happy to use that as my "Social Security Number" in their database. As far as cable goes they don't want your social security number. I wonder how many others would be happy to substitute something. Matt <mailto:melliott@itmail.ncsa.uiuc.edu>

4 3

Super Cool Site!
by lori＠6t9.com 17 Dec '03

17 Dec '03

Hi, I'm Lori. My girlfriends and I have created this way cool site. We would love you to check it out. http://www.6t9.com/dsnm/alpg/ Love, Lori P.S. Being new to this, we were told that if you NEVER want to hear from us again, reply with the subject "Remove" and you won't. That would make us really sad though.

1 0

Re: Identity, Persistence, Anonymity, and Accountability--Part I of II
by Brian B. Riley 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 12/14/97 6:54 PM, Tim May (tcmay(a)got.net) passed this wisdom: >But note that there absolutely is no requirement in the United >States for ageneral form of identification. Non-drivers need not >have any form of I.D. And as we have seen in court cases, a la >Lawson v. Kolender (where a blackman in dreadlocks used to like to >walk the streets of San Diego...the copsstopped him many times and >jailed him for not having I.D. on him...the court ruled that people >don't have to present credentials issued by the state to walk the >public streets). In New Jersey there is a criminal offense called "failure to properly identify" ... I don't know if its ever been tested, or if it is still on the books, but as of ten years ago it was there. I think it was a misdemeanor (in NJ the term is "petty disorderly persons offense) I cannot imagine it as a felony. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQEVAwUBNJXIij7r4fUXwraZAQEMvAf9FzhcodfycwA3BSV4cB5nPAqyR+6+hguK 9VG1/b7CEvEyZleD1HzRbB7i8+ycwxvtZr959FPpume5LW3eWhSsVGLEb8A9EzW3 FQXqmxa6X6LLUcPIrhfSaO8JQdPV0LXOfXwW7ZZh7s02pUmTRgpXOuM5MdHSf0nG kKTGntI5JbaEmDgvyANXETV4EomZ/0Zm3zJiGw3M9G4aZpFl3LIgFPcOUSY1MwJI TMGbNCS/DveeAhmM2J+oa8DbUwqVYGGhA27YHNve5rtxqkDbobsF9OMY8ssU70D0 K0uHEq+ZoobSlNHHrFP+I52RxXiKtP4blGxn8riYmjBp8H4ih6Hsbw== =41Ml -----END PGP SIGNATURE----- Brian B. Riley --> http://members.macconnect.com/~brianbr For PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "to be yourself in a world that tries, night and day, to make you just like everybody else - is to fight the greatest battle there ever is to fight and keep on fighting" - e.e. cummings

3 2

ENCRYPT XXX PICZ
by kozmo killah 17 Dec '03

17 Dec '03

D3AR S|RZ, H0W D0 | ENCRYPT NUDIE GIFS? W3RD _________________________________________________________ DO YOU YAHOO!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0

Security of Encrypted Magic Folders
by Secret Squirrel 17 Dec '03

17 Dec '03

From: "Alex Woolfson" <abdiel(a)worldnet.att.net> Subject: Security of Encrypted Magic Folders >I just downloaded Encrypted Magic Folders--a program that hides Windows 95 >folders and then encrypts them to prevent a disk utility from revealing >their content. In their help file, they try to answer the question "How >Secure is it?"--and, of course, they say *very*, but I can't tell if this is >so or if they're just blowing smoke. Particularly, their claim that key >size doesn't matter. (My mom taught me size always matters... ) If >someone with a stronger cryptography background than me could take a look at >this and let me know, I would greatly appreciate it. >* How Secure is it? > EMF's encryption offers good protection and excellent speed. It > hasn't been broken yet. It is, as far as we know, exportable. THERE > IS NO BACKDOOR. Should you forget your password there is nothing we > can do to decrypt your encrypted files. How do we know this? > Quite a few people ask us how big EMF's key size is. They've learned > from other encryption programs that the bigger the key the stronger > the encryption. This really doesn't apply to EMF. How do we know this? > We developed our own encryption instead of using a standard because > we wanted EMF to be able to decrypt at the byte level. In this way > we only need to decrypt/encrypt the data your programs require and > not the entire file. How do we know this? > In theory, because we decrypt at the byte level, the biggest key we > could use would be 8 bits - which is a joke. So instead of > decrypting every hunk of data using the same key, as most other > encryption programs do, we developed an algorithm to vary the key > based on the data's location within the file. In this way we get > both high security and high speed. We are trying to patent EMF's > encryption method. How do we know this? And why are they trying to patent a mathematical algorithm? (The fact they can do it is irrelevent. Patenting a mathematical algorithm, much like patenting something like XORing pixels on a screen, is stupid.) And is the fact that they're trying to patent it supposed to make us feel safer? > Having said all that, truth is, most encryption isn't "cracked" by > breaking the algorithm, it's done by guessing the password. Brute > guessing of passwords tends to level the playing field tremendously. Cool. But since we have to disassemble the program to figure out how your program really handles keys...how do we know this? > We actually have an advantage because we aren't an established > standard. Because we're small and relatively obscure chances are no > one will take the effort to write a password guessing program FUD and smokescreen. Security through obscurity. > (which > incidentally would violate copyright and intellectual property laws.) FUD and smokescreen. The fact that creating a password program allegidly violates intellectual property and copyright laws in some country isn't going to keep somebody from writing one. > Even if someone were to go thru all this effort we could easily > change the encryption method for the next update. I doubt it's much effort. For example it can take 3 weeks for a group of programmers to write a copy protection algorithm for their new PC game and about 8 hours for a cracker to break it. Further, if they're patenting this algorithm it will be public. FUD. > If we used an established encryption method like DES or Blowfish then > your files would probably have to be fully decrypted when opened, > would exist on disk as unencrypted while you're using them, and then > would need to be encrypted when closed. This has multiple FUD. Decrypt in relatively small pages and cache in memory. Since they've apparently added an encryption/decryption layer between the filesystem and the userspace libraries to begin with this shouldn't be too hard. Well, then again, considering this is Windows which is probably the worst attempt at an operating system this decade maybe it isn't. >disadvantages. First, if your computer shuts down while you have > "encrypted" files open, then those files would be unencrypted. This Not an issue if the operating system and/or encryption program are/is properly designed. > doesn't happen with EMF as your encrypted files are always encrypted > as stored on disk. The second disadvantage is that it slows things > down tremendously. As an example, let's say you retrieve your email > and your email program needs to add today's message to the end of > your 3MB email file. If we used a standard encryption method > requiring the decryption of the file before use then the entire 3 MB > file would have to be decrypted, your 300 byte message added to the > end and then the entire file encrypted again. With EMF, no > decryption would need to take place, and the only data needing > encryption would be the 300 byte message. MUCH faster. Around > 20,000 times faster in this example! Finally something which might actually be valid. > If you still think you'd like to see us use a standard encryption > method like DES or Blowfish, or have any other suggestions, let us > know and we will consider your input in future updates Unless these people have released source this program should be avoided. The algorithm is unknown, they aren't telling what it is or how it works, it hasn't been submitted for review by cryptographers (at least this list hasn't heard about it), and they aren't releasing source so you can see what's going on. They're hyping security through obscurity as a valid security method, while simultaneously applying for a patent on their security method and saying "Well, if it's cracked we'll just change to another algorithm whenever we get around to releasing the next binary-only distribution. Hope nobody gets your data in the meantime." Further, it is designed for use on an operating system which is notorious for insecurity, where everybody and everything is root (except under NT, where you actually have to make some syscalls to get admin privlidges from an unprivlidged account), where nobody releases source for anything, and where there is no source available for the OS so you can modify it to fix security holes or "features," much less add security enhancements of your own. This entire thing reads like this: "We've developed our own proprietary encryption method which nobody has ever heard of. We don't really know how good it is, but you should believe us when we say it's really, really good. In fact it's so good that we're patenting it just like RSA! Nobody will ever be able to break it because our algorithm isn't in wide use and we aren't releasing source! However if somebody actually does break it your data won't be in the open for long because we'll use some other algorithm which is just as good as the one we came up with originally and got a patent on. Hope you didn't need security in that interim and we hope that when somebody breaks this algorithm they'll tell us rather than taking advantage of all the (for them) plaintext data laying around."

1 0

Redmond to Judge [Expletive Deleted]
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- http://www.wired.com/news/news/business/story/9178.html hot off the wire an hour ago! Redmond to Judge - [Expletive Deleted] well, I would expect nothing less than "Fuck You" from Micro$lop --they consider themselves above the law. give Jackson credit for realizing the greater scope of the problem, and for appointing the special master. M$' attitude in and of itself is prima facie evidence of theit market intent --including tossing out the option that OEMs will still be able to but the _original_ version of W95 if they elect not to take IE4. damn white of them boys up there... Analysis: Redmond to Judge - [Expletive Deleted] by Kaitlin Quistgaard and Dan Brekke 4:20pm 15.Dec.97.PST It took two of Microsoft's biggest guns more than 60 minutes to utter a reply to US District Court Judge Thomas Penfield Jackson that most of us sum up in two hard syllables. The second of which is "you." For daring to draw a line last week and forbidding the company to cross for the time being, Jackson was treated to a marathon rebuke from Brad Chase, Microsoft's vice president of Internet marketing, and William Neukom, senior vice president for law and corporate affairs. ... Chase made it clear that neither Jackson nor anyone else would keep Microsoft from readying its planned spring release of Windows 98 - in which Internet Explorer 4.0 and the Windows desktop are inextricably bound. ... Neukom did mention one other alternative that actually merits the name, and one that government the company finds itself at war with might actually recognize as viable: Manufacturers could, he said, install a Netscape browser on their Windows/IE machines. >>> what a fuckin' joke. proves their intent to be a monopoly and fuck the public interest --it's my way, or no way! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQBVAwUBNJXd/LR8UA6T6u61AQG9bQH/fkE3TKRYOmc+y9RZTsLJYjuISYDYqB47 +G0axtsdcumv7Q09bTYOf8b3K36+ik8/RFdngce6HWXDGrrlmtbd4g== =UuqU -----END PGP SIGNATURE-----

1 0

Re: wilkenrules.html
by geeman＠best.com 17 Dec '03

17 Dec '03

This entire issue speaks to whether we neeed government or not. The power of the judiciary is part and parcel of the power of Government, and in many cases -this is an excellent example- is all that stands between The Oligarchy and Freedom. Imagine if there _were_ no government per-se, and it was the Disney, or Westinghouse, or GE, or whoever the fuck, corporate security forces taking action on their own against FRB. At 09:08 AM 12/14/97 -0600, Jim Choate wrote: > > JUDGE WILKEN DENIES FCC MOTION FOR SUMMARY JUDGEMENT!!! > > Press Release Follows. To Go Directly To The Full Text Of Judge Wilken's > Decision, Click Here > > > >National Lawyers Guild Committee on Democratic Communications > > 558 Capp Street, San Francisco 94110 > > FOR IMMEDIATE RELEASE > > > COURT REJECTS FCC'S CONSTITUTIONAL CATCH 22 > > United States District Court Judge Claudia Wilken has rejected > another attempt by the Federal Communications Commission to silence > Berkeley Micro Radio Broadcaster Stephen Dunifer, founder of Free > Radio Berkeley. > > In a 13 page opinion released on November 12, 1997, Judge Wilken > once again rejected the government's motion for an injunction to > silence micro radio broadcasts by local radio pioneer Stephen > Dunifer. > > In 1995, Judge Wilken rejected the government's first motion for a > preliminary injunction against Dunifer's broadcasts. At that time > the Court found merit in Dunifer's argument that the FCC's ban on > low power, affordable FM broadcasting was a violation of the First > Amendment's guarantee of free speech to all in the United States. > > In a blatant attempt to avoid facing its First Amendment obligations > the FCC then urged Wilken to permanently enjoin Dunifer from > Broadcasting and at the same time argued that she could not even > consider the issue of whether its rules, which prevent him from > getting a license, are unconstitutional. In a Kafkaesqe argument, > the Commission argued that Wilken had jurisdiction to issue an > injunction, but no jurisdiction to hear Dunifer's constitutional > arguments. The government claimed that only the higher federal > courts could consider the constitutional question. > > In her November 12 decision rejecting the Government's position, > Judge Wilken pointed to the fact that the FCC had taken exactly the > opposite position in the 1994 case of Dougan vs FCC. In that case, > an Arizona micro radio broadcaster had appealed an FCC fine (for > broadcasting without a license) to the 9th Circuit Federal Court of > Appeal, and the FCC had argued that the Court of Appeal had no > jurisdiction over the case, and that it had to be heard by the > District Court. The Court of Appeals agreed with the FCC and sent > the case back to the District Court. > > Judge Wilken noted that the Arizona broadcaster had raised the same > constitutional arguments in the Court of Appeals that Dunifer is > raising. The Court ruled that in sending all of the issues in the > Arizona case to the District Court, the Appeals Court recognized > that the District Court had jurisdiction over all aspects of the > case. > > In denying the Government's motion for an injunction "without > prejudice," Judge Wilken ordered the Government to file a further > brief on the question of whether the unconstitutionality of the > FCC's ban on micro radio is a valid legal defense to an injunction > against broadcasting at low power without a license. Dunifer's > attorneys, Louis Hiken and Allen Hopper of San Francisco, will have > an opportunity to rebut the government's arguments on this point. > > In response to pressure from the commercial broadcaster's lobby, the > National Association of Broadcasters (N.A.B.), the FCC has in recent > months been stepping up its campaign of harassment against the > thousands of micro radio stations now on the air in this country. > Hiken commented "The broadcast industry is clearly afraid of these > little community stations which are speaking truth to its power. In > trying to do the N.A.B.'s bidding, the FCC demonstrates that it is > nothing but an enforcement arm of the commercial broadcast industry > and the multi-national corporations which own it." > > The National Lawyers Guild's Committee on Democratic Communications > has represented the Lawyers Guild, San Francisco's Media Alliance, > and the Women's International News Gathering Services as a "Friend > of the Court" (Amicus) in this case. In its Friend of the Court > brief the Lawyers Guild pointed out that FCC regulations make it > impossible for all but the very wealthy to even apply for a > broadcast license. This, they told the Court, is the equivalent of > saying anyone could speak from a soap box in the park, but the box > had to be made of gold. Guild attorney Peter Franck commented "In an > era when Disney owns ABC, the world's largest defense contractor > owns NBC and CNN merges with Time which merges with Warner, and when > 'public' broadcasting is told to get its money from corporations, > micro radio may be our last best hope for democracy on the air > ways." He continued "Judge Wilken's decision is a courageous > rejection of the Government's attempt to use a legal Catch-22 to > avoid facing the fact that its ban on micro radio flies in the face > of the Constitution." > > The legal team representing Dunifer and the Amicae are very pleased > with Judge Wilken's reasoned and thorough decision denying the FCC's > motion to have the case resolved without a trial on the merits. For > almost 70 years, the FCC has catered solely to the interests of > commercial corporate giants, through their mouthpiece, the National > Association of Broadcasters. These are the pirates, who have stolen > the airwaves from the American people, and who represent corporate > interests valued at more than 60 billion dollars. Only the Pentagon, > the Silicon Valley and the transportation industries possess the > financial wallop represented by the NAB and its constituents. > > Judge Wilken's decision represents a vision of what it would be like > for the American people to be given back their own voice. The > decision suggests the likely unconstitutionality of the entire > regulatory structure underlying the FCC's ban on low power radio. It > forewarns of the total failure of that agency to carry out its > statutory obligation to regulate the airwaves in the public interest > -- that is, in the interest of the American people, rather than the > media monopolies that control our airwaves. > > The legal team welcomes the opportunity to have a court identify the > real pirates of the airwaves -- not the thousands of microradio > broadcasters who seek to communicate with the people of their > communities, but rather the billionaire commercial interests that > control the airwaves as if they own them. Is it General Electric, > Westinghouse and the Disney Corporation that have the right to > control local community radio, or is that a right that belongs to > all of the American people, regardless of economic status? > > FOR MORE INFORMATION, CONTACT: > > Peter Franck, Counsel for Amicus > 415-415-995-5055 > pfranck(a)hbmvr.com (days) > pfranck(a)a.crl.com(evs, wknds) > http://www.368Hayes.com/nlg.cdc.html > > Alan Korn, Counsel for Amicus > 415-362-5700 > aakorn(a)igc.org > > Stephen Dunifer, Free Radio Berkeley > 415-644-3779 > frbspd(a)crl.com > http://www.freeradio.org > > Louis Hiken > Counsel for Stephen Dunifer > 415-575-3220 > hiken(a)igc.org > http://www.368Hayes.com > > Allen Hopper > Counsel for Stephen Dunifer > 415-575-3222 > lazlo(a)igc.org > http://www.368Hayes.com > > >SEE THE FULL TEXT OF JUDGE WILKEN'S DECISION > > TO STEPHEN DUNIFER/FREE RADIO BERKELEY INFORMATION PAGE > > TO FREE RADIO BERKELEY LEGAL BATTLE PAGE > > TO NATIONAL LAWYERS GUILD INFORMATION PAGE > > TO THE OFFICIAL NATIONAL LAWYERS GUILD WEB SITE > > TO NLG COMMITTEE ON DEMOCRATIC COMMUNICATIONS PAGE > > TO FREE RADIO BERKELEY WEB SITE > >BACK TO LAW OFFICES AT 368 HAYES STREET > > >

2 1

Christmas greetings from Pauline Hanson
by Global Web Builders 17 Dec '03

17 Dec '03

Dear Pauline Hanson's One Nation Supporter in NSW, 1997 has been an eventful year in Australian politics. 1997 will be remembered as the year when Australians at last said that they had had enough. Enough of the lies and deception churned out by the major political parties. 1997 will be remembered as the year that Pauline Hanson's One Nation grew from a fledgling party launched in April to a major political force with a branch network of over 200 branches. A quite remarkable achievement. An achievement which could not have been realised without the dedication and commitment of national director David Ettridge and his Manly office team. 1997 will be remembered as a year of intimidation. Intimidation by well-organised protesters with strong links to the Australian Labor Party. The violence of these protesters against the Australian way of life - giving everyone a 'fair-go' and the media's blatantly biased reporting against One Nation failed to destroy the will and desire of the people to support me. 1997 will be remembered as the year in which a few tried to cause a split in the One Nation party. They knew that the media would report anything negative about the party. And they did. No matter that in all cases it was just a handful of troublemakers who tried to hijack the party for their own political gain. They failed. Today One Nation is more than just a phenomenon it is a real living party. It is made up of people like you and me. It is part of the political fabric in Australia. Looking ahead we will face many challenges together. We must continue to fight for equality for all Australians. We must continue to fight to protect our country from becoming a slave to the multinationals and international bodies. During this Christmas break we all have the opportunity to look back and see what we have achieved and to look forward to see what has still got to be done in the coming years. I wish you and your family all the best over Christmas and the New Year. God bless and may all your dreams come true. Pauline Hanson

1 0

Pitney Bowes Sponsors World's Only Center for AppliedCryptographic Research
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: clairew(a)mediaone.net Date: Mon, 15 Dec 1997 21:09:22 -0500 MIME-Version: 1.0 To: rah(a)shipwright.com Subject: Pitney Bowes Sponsors World's Only Center for Applied Cryptographic Research X-Priority: 3 (Normal) Pitney Bowes Sponsors World's Only Center for Applied Cryptographic Research STAMFORD, Conn.--(BUSINESS WIRE)--Dec. 15, 1997-- Messaging Leader Teams With The University of Waterloo, Certicom Corp. and The National Science Education and Research Council of Canada In an age of explosive growth of electronic commerce, effective protection of data storage and communications is vital. Pitney Bowes Inc. (NYSE:PBI), is supporting and funding critical research into protection of electronic commerce at one of the most highly acclaimed academic sources of cryptographic knowledge, the University of Waterloo in Ontario, Canada. Pitney Bowes is partnering with Certicom Corp. of Toronto, to found the Centre for Applied Cryptographic Research at the University of Waterloo. Both companies are joined by the National Science Education and Research Council of Canada (NSERC) and Communication and Information Technology Ontario (CITO) in the creation of two Industrial Research Chairs in Cryptography. Cryptographic research delves into the process of coding data for its protection and secure transfer. Cryptography, in all of its applications including data confidentiality, data integrity, and user authentication, is an extremely powerful tool for protecting information. Increasing research and knowledge of cryptography can ultimately increase the efficiency with which businesses operate and open up new business opportunities. Cryptography is one of the keys to doing business in the 21st century according to Dr. Joseph Wall, chief technology officer of Pitney Bowes Inc. "We are proud to help create this research center and anticipate significant advances in the technology and its understanding. We look forward to combining these advances with our understanding of business applications to deliver solutions which enhance confidentiality, security and integrity in the electronic marketplace. "Pitney Bowes has been researching and using cryptographic applications to help customers securely transmit data and funds since the 1960s. Cryptography will continue to be one of our technological cornerstones as we design solutions which help customers manage efficiently in their information-rich environment." Pitney Bowes is one of the largest users of applied cryptography in the world. For example, cryptographic technology is an important component in the system which Pitney Bowes used to securely download over $10 billion in postage revenues worldwide in 1996. Known commercially as Postage by Phone(R), Pitney Bowes developed and patented the system in the 1960s, received U.S. postal approval to introduce it to the marketplace in 1978, and expanded its usage to a variety of applications in 18 countries. The chair at the University of Waterloo will be established in association with the Natural Sciences Engineering Research Council (NSERC). The NSERC/Pitney Bowes chairholder will be Dr. Scott Vanstone, a faculty member at St. Jerome's College, University of Waterloo and Chief Cryptographer of Certicom Corp. Professor Vanstone will take up the chair on Jan. 1, 1998. He is one of the world's leading cryptographers and is co-author of the 1997 book Handbook of Applied Cryptography. The other chair at the University will be sponsored by Certicom Corp., which researches, develops and licenses advanced cryptographic technologies. The Certicom/NSERC chair will be Dr. Douglas Stinson, author of Cryptography: Theory and Practice. With regard to mathematical cryptography and combinatorics, the University of Waterloo is the leading university in Canada and with the establishment of the Centre for Applied Cryptographic Research, will be one of the top research and educational facilities in the world. Along with the core research group of Dr. Vanstone and Dr. Stinson, Dr. Leon Pintsov of Pitney Bowes will be a member of the scientific advisory board of the Centre. Pitney Bowes is a $3.9 billion provider of products and services that support the efficient management of messages and packages in physical and digital form. for more information about the company, visit the company's Web site at: http://www.pitneybowes.com . --30--CB/np* JS/np RG/KDB/ny CONTACT: Pitney Bowes, Stamford Sheryl Y. Battles, 203/351-6808 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

Re: Identity, Persistence, Anonymity, and Accountability--Part I of II
by Brian B. Riley 17 Dec '03

17 Dec '03

On 12/15/97 11:13 PM, Greg Broiles (gbroiles(a)netbox.com) passed this wisdom: >>>But note that there absolutely is no requirement in the United >>>States for ageneral form of identification. Non-drivers need not >>>have any form of I.D. And as we have seen in court cases, a la >>>Lawson v. Kolender (where a blackman in dreadlocks used to like to >>>walk the streets of San Diego...the copsstopped him many times and >>>jailed him for not having I.D. on him...the court ruled that people >>>don't have to present credentials issued by the state to walk the >>>public streets). >> >> In New Jersey there is a criminal offense called "failure to >>properly identify" ... I don't know if its ever been tested, or if it >>is still on the books, but as of ten years ago it was there. I think >>it was a misdemeanor (in NJ the term is "petty disorderly persons >>offense) I cannot imagine it as a felony. > >There's an important distinction between a requirement that you identify >yourself accurately, and a requirement that you carry a particular form of >identification. It is constitutional for the police to ask you what your >name is, under certain circumstances - and you can face criminal charges if >you lie. It is not, however, constitutional to require that you keep or >carry identity cards or documents. (Modulo, of course, participation in >activities like carrying a concealed weapon or driving. There are some >people who believe that carrying special credentials should not be required >when undertaking those activities, but very few or none of those people sit >as judges, so their beliefs are comforting or pleasing but also >insufficient to prevent conviction.) I guess I am curious about being required to identify yourself ... if the cops have no probable cause to arrest you then what right do they have to know who you are? ... and should they have probable cause, why should you have to help them know who you are. I could see circumstances where forcing you to identify yourself would come under self-incrimination. I am sure they have ways of dealing with this ... what legal precedents are there concerning this? Brian B. Riley --> http://members.macconnect.com/~brianbr For PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "One of the deep mysteries to me is our logo, the symbol of lust and knowledge, bitten into, all crossed with in the colors of the rainbow in the wrong order. You couldn't dream of a more appropriate logo: lust, knowledge, hope, and anarchy." -- Gassee - Apple Logo

3 2

Re: Fw: Jim Bell Sentenced (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 15 Dec 1997 16:57:22 -0800 > From: Steve Schear <schear(a)lvdi.net> > Subject: Re: Fw: Jim Bell Sentenced (fwd) > > I think both you and Bell are in relatively good agreement on the problem,= > differing mainly on the means of a solution. Well that is the litmus test after all, not the goals but rather the means. > Although, like you I have= > never considerd engaging in acts of violence to right the wrongs in our= > legal structure, I wouldn't say that. I just can't justify them unless under direct physical attack. I am *not* a pacifist. > I also do not believe that the changes you wish can= > reasonably be expected to be achieved through legal and democratic means= > within our lifetimes. I hadn't really entertained the condition that the 'fight' necessarily has to end in my life time. It certainly didn't end in Thomas Jeffersons. I do know that if we don't try we have zero chance of gaining any of them, let alone all of them. And who knows what the future may bring. Personaly I give the US about 20 years before a general political - economic - societal breakdown occurs. I believe that it will be even less violent but just as radical a change as the fall of the CCCP. I further believe that movement will *demand* ethical and reasonably justifiable reference to the respective constitutional documents. I also believe that within about a period of 10 years there will be a significant increase in the number of federal amendments clarifying many of the very issues we discuss today. I believe many things will drive the change. Among them medical technology which will re-grow cloned organs to replace any damaged or diseased ones you may have. I suspect that instead of terra-forming people will clone themselves and geneticaly engineer the embryo to adapt to the relevant environemt (Hint: Dougal Dixon). I believe this technology will fine tune the legal issues we ponder today to a fine edge. I believe the 9th and 10th will be recognized for the defining tests of all federal, state, and individual jurisdictional issues. I believe that as a result of those changes individuals will benefit by being considered equaly with federal and state views. > Almost from the start of our nation, the actions of the Federal branches= > have proven that the Anti-Federalists were right, that the Constitution (as= > accepted) would not prevent their power grab. Wasn't it Article 2, Section= > 18 which was intended to prevent such abuse, and which was easily overcome= > by the SC's liberal interpretation in Maubery vs. Madison? =20 I believe that people will recognize the totality of the current issues as the exact same excesses. People will realize that the camp that demanded specific bills of rights have the right idea. As a result we will get through indipendant state action several amendments. Those movements will be very goal specific and short lived. They will further depend on the Internet for their existance. I believe they will start with individuals in specific points across the US getting in touch and defining a small and specific set of goals (ie Demonstrate constitutionaly that individuals have a right to doctor assisted suicide and that it is an invasion of individual privacy.). As those goals percolate via passive and active processes across the Internet a commen experience will grow. An important question to consider: How long must you hold a sufficient totality of state representation to consider and pass a constitutional amendment? > Little has changed, nor it it likely to, within the system. There's too= > much inertia and entrenched economic and political interest, including the= > electorate's acquiessence to limitations of their liberties in exchange for= > real or imagined protection from harm. I can think of no instance when= > changes, of the magnitude of which you speak, were made during a peaceful= > transition. Can you? No. However, that proves nothing. Simply because something has not happened is no guarantee it won't happen. In all of human history this is the first time that the Internet has existed, photon transportation didn't exist as a verifiable process until just recently, there is now a movement in the dog lovers camp to save clonable samples of favorite pets in the hopes of cloning their best loved pooch. Technology as succesful as ours breeds a technocracy if it doesn't kill us. ____________________________________________________________________ | | | | | We built your fort. We will not have it used against us. | | | | John Wayne - Allegheny Uprising | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Radio Free Cypherpunks... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 15 Dec 1997 15:49:40 -0800 > From: Steve Schear <schear(a)lvdi.net> > Subject: Re: Radio Free Cypherpunks... (fwd) > > Over a year ago I started a heated thread on the Telecom Regulation list,= > "Basis of FCC jurisdiction," which posited that the Commerce Clause basis= > for FCC authority might not hold for very low power and tens of GHz= > transmissions. My argument, in short, was that if a transmission couldn't= > reasonably be expected to be detectable (using common receiver technology)= > across state lines then the FCC shouldn't have jurisdition. So, are you considering such a broadcast? What I envision is a text-to-speech and/or a digital format. ____________________________________________________________________ | | | | | We built your fort. We will not have it used against us. | | | | John Wayne - Allegheny Uprising | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

4 3

"where would you find"
by succuba97＠hotmail.com 17 Dec '03

17 Dec '03

The latest virtual XXX entertainment that is as good...well ALMOST as good as the REAL THING? HERE http://www.succuba.com WARNING: 1. YOU MUST BE OVER 18 YEARS OF AGE 2. YOU MUST HAVE A STRONG HEART ;) 3. IT'S HOTTTTTTTT ;}

1 0

Re: Identity, Persistence, Anonymity, and Accountability--Part I of II (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: Identity, Persistence, Anonymity, and Accountability--Part I of II > Date: Mon, 15 Dec 97 23:47:07 -0500 > From: "Brian B. Riley" <brianbr(a)together.net> > >identification. It is constitutional for the police to ask you what your > >name is, under certain circumstances - and you can face criminal charges if > >you lie. Where in the Constitution is the relevant sentence(s)? There is no mention of police rights in the Constitution and therefor they have no more rights than you do. ____________________________________________________________________ | | | | | We built your fort. We will not have it used against us. | | | | John Wayne - Allegheny Uprising | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

A gauntlet thrown down by PC-Magic?
by Alex Woolfson 17 Dec '03

17 Dec '03

Hey guys Just FYI here is the response I got from PC-Magic. -----Original Message----- From: Scott Chaney <scott(a)pc-magic.com> To: Alex Woolfson <abdiel(a)worldnet.att.net> Date: Monday, December 15, 1997 4:02 PM Subject: Re: Encrypted Magic Folders >Thanks for the feedback. We are considering an established standard. > >BTW, for all the "crap" we get from supposed crypto experts no one has >come close to breaking our method. It does make for humorous reading >tho. > >Scott > > Anyone care to take him up on his challenge? Please say yes. :-) Alex

3 2

Could you please PGP sign this MD5 sum?
by ichudov＠Algebra.COM 17 Dec '03

17 Dec '03

I would like to kindly ask you to sign this md5 sum with your PGP keys, and return it to me signed. I would also appreciate a copy of your PGP key. Thank you very much. ``I testify that I did see this MD5 checksum around Dec 16, 1997. f3bffc327bf88846bc1d790c56da0ffb caleidoscope.fixed.txt. '' Signed, -

2 1

UK spooks invent RSA, DH in 1973
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

There's an interesting paper at http://www.cesg.gov.uk/ellisint.htm which claims that UK spooks invented both RSA and DH in 1973 and 1974 respectively. The summary info is: >This paper by James Ellis was written in 1987. It was commissioned shortly >after his retirement to provide a first-hand historical account of the early >work by James and others in CESG, discovering the techniques that were later >to become known as Public Key Cryptography. Although there would have been >some academic interest in the paper back in 1987, it was decided on balance >to keep the record internal and accordingly the paper was given a low >classification and retained within CESG. > >Since 1987 there have been three aspects which have created enormous changes >for CESG. First, the growth in the need for secure communications for >confidentiality and authentication has vastly increased key management >requirements. Second, the increase in processing speed has enabled large >arithmetical computations to be practicable. Third, the 1994 RPS gave CESG >responsibility for the communications security of the entire UK government >market. PKC is now seen as the best if not the only method for allowing wide >area many-user secure communications. With this increase in CESG's external >visibility there has been a growing desire for greater openness. > >During the past 11 years there had been no urgency to publish the paper, but >the necessary spark came when Clifford Cocks solved an important problem that >had been highlighted at a recent 'RSA' conference. Cliff is presenting this >solution in a paper at the IMA Conference on Cryptography and Coding in >Cirencester. Since he was one of the main contributors to our early work it >was clearly the right opportunity to set the record straight. As the paper >was being prepared for publication we heard that James had become very ill. >He died before the paper was published. We now publish it as a testament to >his imaginative and ground-breaking work. (The paper was mentioned on a UK crypto list, but I've lost the original reference). Peter.

1 0

http://www.nuyenta.com
by NuYenta 17 Dec '03

17 Dec '03

Dear Friend, NuYenta (www.nuyenta.com) is an online service designed to provide traditional Jewish matchmaking to the Gay, Lesbian, Bisexual and Transgender friends and members of the world-wide Jewish community. As a guest you can look for a match and get your own profile... and it's FREE! At NuYenta members and guests begin to know about each other by matching profiles. You can even include a photograph of yourself. NuYenta provides you with anonymous email and chat rooms for contacting other members and guests. We even have a bookstore specializing in books specifically written for the Gay, Lesbian, Bisexual and Transgender friends and members of the Jewish community. If you are looking for that special someone or would like to make some new friends then visit NuYenta. As a guest you can look for a match and get your own profile... and it's FREE! Visit NuYenta at http://www.nuyenta.com

1 0

The Joys of Being Canadian
by Anonymous 17 Dec '03

17 Dec '03

>Phone Company Rep: "What's your Social Security number? >Answer: "I don't have one. I'm Canadian." > >Power Company Rep: "What's your Social Security number? >Answer: "I don't have one. I'm Canadian." > >Cable Company Rep: "What's your Social Security number? >Answer: "I don't have one. I'm Canadian." > >Doctor to Seasoned Citizen: "I can't treat you privately or I'll be barred >from taking Medicare patients for two years." >Answer: "Sure you can. I'm Canadian." Now the question is: When they find out you lied will they care?

3 2

Re: Comparing PGP to Symantec's Secret Stuff
by Vin McLellan 17 Dec '03

17 Dec '03

(I just posted this in a discussion on alt.security.pgp, and thought it might also be of interest to the List. _Vin) ALCO Jakarta <alcojkt(a)bit.net.id> queried the Newsgroup: > Could anyone give me a quick trun-down on the difference between these two > programs and which one is more secure? Is the latter more practical to use > than PGP 2.6.2? That's comparing real crypto vs a sophisticated version of the Captain Crunch crypto ring. PGP in all of its forms uses strong crypto, which is why it is difficult to legally export it from the US to any overseas entity, except branches and subsidiaries of US firms. (Thus, the effort to sustain the international version of PGP, and PhilZ's long travail while the US govt tried to investigate how those sneaky non-Yanks got their hands on this oh-so-useful RSA/IDEA utility.) Norton Secret Stuff secures the data using the 32-bit Blowfish encryption algorithm -- which is why it's approved for unrestricted export outside the US by the U.S. government. It's far better than, say, ROT13 -- but it would not provide meaningful confidentiality or security for anything of any worth, or anything which might otherwise spur a curious and clever grad student to spend somewhere between a couple hours (with a college computer lab at his proposal) to a few days (on a fast PC) doing a brute force search of all possible 32-bit keys. A more complex comparison would put PGP against Norton's YEO, but that too is an apples to oranges matchup, albiet with strong crypto on both sides. PGP was designed to be a mail encyptor. YEO -- with RSA + RC4, RC5, DES, DES3, and Blowfish too, I think -- was designed as a file and disk encryptor. Each is optimized for its primary function. The lack of published source code is an issue, but if you see such a product being purchased by multinationals or US defense contractors you can be certain the implementation -- which is the real arena of vulnerability, once the algorithm is chosen -- has been carefully studied by informed cryptographers. (For non-American product, look for similar purchases by government-connected agencies in the vendor's nation.) You don't sound like the source code is going to do _you_ any good, right? Like most buyers, you have to trust the judgement of talented pros somewhere. > > I use PGP and don't find it's use so difficult to master even as a rookie > in cryptographic matters. But this Secret Stuff program is commerical so I > don't trust it's degree of security to gov't snooping based on my suspicion > of corporate submission to gov't will. Is that a reasonable assumption? Actually, corporate or commercial products are better than that. Secret Stuff is overtly weak crypto. It's also free from Symantec. Norton YEO from Symantec, or any competitive heavy-duty product like RSA SecurPC, will be clearly labelled as to the relative strength (key length) of their crypto -- strong for domestic user; weak for the intl mass market -- in terms anyone with a basic understanding of crypto and crypto export regs can understand. Export permits for the strong domestic versions of products like these will be all but impossible to obtain for mass market sales to non-American individuals. (Neither of these firms probably sells or even tries to sell the export version overseas; the weaker products exist largely because US corporate buyers demand an interoperable product that _can_ be shipped to overseas associates.) Export permits to ship the strong-crypto version of these products American corporations will require that the vendor have a key recovery mechanism -- no big deal, since we are dealing with stored files, so backup access is a standard requirement for disaster recovery -- which is to be held by the US firm in a location which makes it accessible to legal US court orders. Any and all US firms will respond to a legal court order to provide information. (Commercial firms in other nations will provide any info they hold when confronted with a court order too, right?) It is always rash to expect any commercial firm in any nation to be either a martyr or an arbiter of moral or political issues. Corporate officers have fiduciary responsibilities and they can be replaced. Corporations get a set of rules from the society in which they operate, and then -- within the context of those rules -- they seek to maximize their profit and their stockholders' return on investment with a certain degree of ruthless intensity. That's the nature of the beast. When corporate self-interest and some corporate executive's personal philosophy line up, we get some interesting fireworks -- sometimes even heroic moments which dramatically change the course of a government's industrial policy, as in the US banks vehement rejection of the NSA's CCEP and Clipper programs. The apparent exception really validates the rule. It's really rare for the US govt to try to overtly challenge or crush an American firm like they did with RSADSI for a decade. The NSA tried to bully the US banking industry and got handed its collective head -- and got branded as naive and turned into something of a laughingstock as well. On the other hand, commercial vendors which provide a product for sale have to describe and warranty that product as having certain properties. If those products are used by individuals or commercial customers and fail to measure up to their advance billing, the vendor is thereafter liable for significant (even company-threatening) losses, in both recompense and punitive damages. That's commercial law in the US -- no matter what sort of mealy-mouth language might be in the shrink-wrap license. US lawyers get a blueprint of an altar upon which they can sacrifice such firms when they get their law degree. Corporate "submission to gov't will" is a real issue, particularly for vendors of privacy and security tech -- but for US firms, it is far more likely to play out formally (as with a court order for a message recovery key) or in some negotiated backroom deal where the government demands some feature added, or asks for some feature to be removed from free-market product, before the vendor is given some commercial advantage like a government contract, or GSA approval, or an export permit. You see the whole American IT industry being put through this sort of blackmail in the current US crypto export policy. Only vendors which have or agree to design key/message "recovery" mechanisms in file or communications crypto apps get export permits to ship their 56-bit versions of their crypto products -- or (among other vendors,) crypto-enhanced applications like RDBSs and operating systems -- to the international market. Nothing subtle or secret about that -- and historically, the model has probably been pretty much the same, if less blatent. US export controls in crypto exist to bludgeon the vendors, so that the US govt can obtain something it wants in that company's domestic or overseas product lines. (It certainly does not restrict the international bad guy's access to strong crypto, no matter what the latest Four Horseman propaganda is.) Today, I think this leverage is probably being applied more on the big US vendors of operating systems and networking software and major applications -- all of which require crypto for their commercial products today -- than it is upon the puny crypto vendors (who are, relatively speaking, small potatos and aren't allowed to sell strong versions of their products -- even with message-recovery -- to anyone interesting, anyway;-) In commercial encryption products, the hidden backdoors of myth and legend are far less likely, given the liability issue and US commercial law. Overt and well-labelled backdoors are a different story. <sigh> Surete, _Vin "Cryptography is like literacy in the Dark Ages. Infinitely potent, for good and ill... yet basically an intellectual construct, an idea, which by its nature will resist efforts to restrict it to bureaucrats and others who deem only themselves worthy of such Privilege." _ A thinking man's Creed for Crypto/ vbm. * Vin McLellan + The Privacy Guild + <vin(a)shore.net> * 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548

4 5

Re: UCENET II and Peter duh Silva
by Charlie Comsec 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Information Security <The(a)NSA.sucks> wrote: > : While that's technically true, it's even more true of non-anonymous e-mail > : addresses. Usenet posts are much easier to forge than PGP signatures, and > : it's quite simple to sign up for a throwaway e-mail account under an assumed > : name. It's not very secure from a privacy standpoint, but it's even less > : secure from a "positive ID" POV. > : > : At least with a PGP-signed anonymous post, readers are alerted up front that > : they are reading the work of an author who is withholding his/her identity. > : But if you read a post from "john_smith(a)hotmail.com", is it really someone > : named "John Smith" or not? > > I'm not following this...anyone can generate PGP keys, and digital signatures > are not necessary to indentify an account... Sure, anyone can generate a PGP key. It's almost as easy as generating a throwaway e-mail address. And what does posting from a certain e-mail address or signing one's post with a certain PGP key prove? It proves that the poster KNEW a certain piece of INFORMATION, either an account password or a PGP secret key. It's usually inferred that the person who possesses that information is the person who generated it. Of the two, guessing a PGP secret key is orders of magnitude harder than guessing someone's password, logging on, and impersonating them. In addition, PGP signing is "portable". No matter where I post from, if I sign my post with the same key, you can assume it's me who posted it. It's more difficult to do that with an e-mail address. Let's say that you have a common name like "John Smith" and you post as jsmith(a)someisp.com. Are you saying that's your "identity"? What if Someisp, Inc. suddenly files for bankruptcy and shuts down without warning? Did you lose your identity? You could open a new account as "jsmith" somewhere else and claim you are the same person who previously posted as jsmith(a)someisp.com, but so could anyone else who desired to impersonate you. If you were signing your posts with a PGP key, then all you'd have to do is make a post from your new ISP, sign it with the same key, and your "identity" is "transferred". - --- Finger <comsec(a)nym.alias.net> for PGP public key (Key ID=19BE8B0D) -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBNJahmQbp0h8ZvosNAQEqmAf+IG/gtP4flSv/RPP7530NuD5MeMgH8WGo 75E/o+3GkN5Ksl0hL0bdpUhDvqeHnwsdc2xO5j0UEzqIZGKapa1YvJGK0wrUU/FB UrUzcrHkvtXAdJD8GRTaA/Xgzjh2eJGOImzaIHbPOZBa4MPxYm7bEZaroHR2G2IP AkNFbJzBETP9nLmePupRSqmhN8GwC5BLRLjkXLDDXJ/9s04vNoBGUEsv4aA0iRad cdkHjHSs9FfOOTJPPG+GdDA+Z1LuyjnugcoTfYPtsu7PwgWE/tAxOCVPI6sHrhze I1a4KZSVn1AoNd0ii7Mcw4Fp73SUcuZ74+EJovToOyBu++bqZdOYsA== =jF0X -----END PGP SIGNATURE-----

1 0

Re: UCENET II and Peter duh Silva
by Charlie Comsec 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- politas(a)dynamite.com.au (Politas) wrote: > Surely that isn't the important thing. More important is that the > person really has an email address of "john_smith(a)hotmail.com". Then > it's up to Hotmail to be able to trace that email address back to the > previous step, assuming that they are being forced to do so by a > warrant or some other legal reason. > > Personally, I think that all messages should be able to be traced to a > real person, although this tracing should not be possible without > legal action. Are you saying that Hotmail should be made a guarantor of the identity of its accountholders, or merely that they could be required, under certain circumstances, to divulge what information (if any) it possesses, regardless of its accuracy? AFAIK, the latter case is currently operative, since Hotmail's records are presumably already subject to subpoena (in the USA, at least -- I just realized you're posting from an Aussie domain). IOW, when you sign up for a hotmail.com account, you're presumably required to give them a "name". If I signed up as "John Smith", should they be required to verify that I'm really John Smith, or merely disclose that the account belongs to someone who identified him/herself as "John Smith"? If you're saying what I hope you're NOT saying, it would amount to a form of "identity escrow", and I suspect that Hotmail would probably choose to discontinue offering free e-mail accounts rather than take on that sort of responsibility. - --- Finger <comsec(a)nym.alias.net> for PGP public key (Key ID=19BE8B0D) -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBNJaaXwbp0h8ZvosNAQHqtQf+LGGPWLQFPGfGgwKIHKOTAXQ74S08rGqt i8yiuSY2RgC+CXzbXJaMmDQ9gAcPMmCKJqzc2O4bkresg+hz6/Cl6d+m+3FO4Nz+ HKeaEMlg3EXHuxTnhsx4vSAWubdbpC+OfkU6kQHf1YU1zWZnIV9c7SbWmSNeaYhq sXLl6+YlPFwwZ0N5bUBqNkOsAQQveNFd/91mYGAZBi2R6P95F+RDV3/Jv3elhXgu egBb2Igf7imK/U6zFhgm6+jCdFdpGOfJ030UAMulezFi/czaiNdLNR3jE4nnfrwQ 4qexxqUkwzNrNWX0M9T/YQ7wl+jIWi3KKj4s4QLHTKXhoHNDY7hPsw== =W6Zl -----END PGP SIGNATURE-----

1 0

Clinton announces NEW GVT PROGRAMS to develop technology
by Declan McCullagh 17 Dec '03

17 Dec '03

WASHINGTON (AP) - Honoring 14 American scientists' "passion for discovery," President Clinton today announced $96 million in new government-assisted programs to develop chip-sized supercomputers, hand-held video phones and radio-transmitting ID cards to locate lost children. "Who knows what will be known in only 25 years," Clinton marveled, pointing to recent innovations on the Internet and human genome research. "We must rise to master the forces of change and progress as we move forward." The $96 million already provided by Congress for this budget year, combined with industry funds, would leverage roughly $200 million for research and development, Clinton said. "The discoveries of tomorrow will be made possible by the scientists of today and by our continued commitment to their passionate quest," Clinton said. The Defense Department and semiconductor industry are teaming up to pay for long-term university projects meant to eventually allow U.S. companies to manufacture fingernail-sized silicon chips containing billions of transistors. A Commerce Department initiative offers, through competitions, funds to small companies working on breakthroughs in areas such as portable video communications, radio transmitters to keep track of children and affordable DNA diagnostics. [...]

1 0