December 2003 - cypherpunks-legacy

Meet-in-the-middle attack
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

The main difference between Tim Maya and shit is that shit smells better. __[I]__ o-o' __oOo__(-)_oOo__ Tim Maya V

1 0

Re: Child Porn
by Lucky Green 17 Dec '03

17 Dec '03

At 04:48 AM 1/29/97 +0000, Vipul Ved Prakash wrote: >(Forward) >*** NY student charged with sending child sex photos over Internet > >Nathaniel Levy, a psychology major at New York State University, was >charged Wednesday with using the Internet to transmit photos of >infants having sex with adults, the New York state attorney general >said. This is hilarious, given the fact that San Francisco State University's psychology department has what probably amounts to the largest collection of child pornography on the planet. Their collection also includes primary sources on any other type of kink you can imagine. And some that no sane person ever could imagine. [You have to be at least working on a PhD to access the collection.] -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://www.mersenne.org/prime.htm

1 0

Re: Libel/slander & crypto relevancy (fwd)
by Greg Broiles 17 Dec '03

17 Dec '03

At 10:42 AM 1/28/97 -0600, Jim Choate: >> From: Greg Broiles <gbroiles(a)netbox.com> >> Civil actions against people doing "graffiti" are only interesting where >> the defendant has assets worth suing for. This economic dimension >> substantially limits the number of suits which will be brought. > >Thank you for agreeing with my thesis that the legal industry is one >driven by monetary gain and not justice. It is the one major problem >with law today, it ignores those who are not 'worth it'. Justice is >supposed to be blind and until that happens there can be no true >liberty. Law should be involved in rights and wrongs and not 'how much >money do I need to buy that villa in Spain'. Um, I was making the reciprocal of your point - that people with no assets have a special *advantage* with respect to civil suits, they're able to get away with a fair amount of misbehavior because it's not cost-effective for plaintiffs to sue them. If you're a defendant, being ignored as not 'worth it' is a good thing, not a bad thing. >There is also the aspect of 'reputation' of the organization which was >defamed. This will become even more critical to good business over the >Internet in the future than it is now. Now the only really important >'reputation' that one has to worry about is their credit report. I disagree strongly here. Think about the reputations of Odwalla and Sizzler and (Burger King? can't remember) after their E. Coli problems. Think about the reputation of Radio Shack for making mostly crappy products. Think about the reputation of some ISP's (Netcom, AOL) for continuing to charge people's credit cards for months after a cancellation. Reputation has many dimensions beyond credit reports. > Another aspect of this >that keeps coming up is one of 'big' corporations with 'lots' of money, >this monotonicity in legal thought is the reason I refer to the 'legal >industry' and not 'legal profession'. Currently the main force driving >law is how much money is available. Expansions of liberty simply can't >happen in this environment because there is no mechanism to protect >'little' organizations or persons without 'lots' of cash. This problem is >one that is not being addressed by anyone, most especialy lawyers who >will loose income which they aren't apt to do voluntarily. I agree that people get screwed because they can't afford to litigate or they can't afford a [good] attorney. But I think that the economic dimension to litigation is not necessarily all bad - if litigation were costless, what would prevent people from suing over essentially negligible disputes? I think it's good for people to stop and ask themselves "Is this dispute really worth fighting over?" The relatively high cost of litigation is a way to ration access to a relatively expensive resource, e.g., the courts. If litigants don't pay that cost, then taxpayers will. (And shifting more costs to losing litigants makes it easier, not harder, to be effectively judgment-proof by having few assets.) >> Criminal prosecutions for defamation (in the case of "graffiti") are still >> unlikely - a much more straightforward charge would be unauthorized access >> to a computer or some flavor of fraud, depending on the facts. > >This would be hard to do in the situation such as a mailing list because >the parties would have 'authorized access' and it does not include the issue >of inside parties nor 'web bbs's' where parties can enter comments and >other statements in a 'authorized' manner. There are mechanisms to use >computers for abuse of other parties besides hacking. I don't think that that web BBS or mailing list messages alone will lead to much criminal liability for defamation because I think it's difficult to do a lot of harm in that medium. BBS's have existed for 20+ years now - and how many online defamation cases have we seen? Maybe 10, total. Off the top of my head the only ones I remember are _Cubby v. Compuserve_ and _Stratton-Oakmont_, but there are probably others. Still, we're seeing what, at best one reported case for every 2 years? Online defamation liability exists, but I don't think there's ever going to be an avalanche of cases, simply because the damage involved tends to be relatively small compared to the monetary and emotional costs of litigation. >The point is that if joe-six-pack isn't secure in knowing that his views >and expression are not protected from abuse he won't use it. We all loose >in that case. But Joe Sixpack's lack of protection from abuse is also Joe Sixpack's protection from prosecution when he hasn't done anything wrong. Look at how pissed off some people are when Sandy moderates the list - imagine how much worse it would be if prosecutors were sifting through the list, identifying messages they thought were "over the line" with respect to defamation and then prosecuting the wrongdoers. Yow. Some people would be facing three-strikes minimums based on a single day's messages. :) I much prefer a world where we can engage in spirited debate without being afraid of prosecution (or civil suits) over a world where a tiny misstep means jail or litigation. You're of course free to want something else, but it's hard for me to see the logic behind arguing against private moderation but in favor of significant state regulation. Look at the way that big corporations use SLAPP suits to pick on Ma and Pa Kettle now, and imagine what big corporations could do if it was easier to create criminal liability for defamation. I think your proposed strengthening of defamation rules will prove to hurt the "little guys", not help them. >In this example, if party A makes a statement and then B changes it and >then re-distributes it as original comments by A then there is a problem >irrespective of the monetary worth of A or B. Digital signatures in and of >themselves won't help this from happening unless it is required to include >the full text and signature of any quote in any subsequent use of that >material otherwise the quote and the digital signature are out of sync and >therefore worthless. But people who receive the message unsigned know they're getting an unsigned message (or know that it was signed by the quoter, but not the quoted author) and can make the appropriate assumptions about the truth of the attributions, and adjust their assessment of the veracity of the quoter if it turns out that the quoter is a liar, or if someone challenges the quoter to produce a signed version of the statement and they cannot. We seem to have survived OK so far without special rules to punish people for lying - why do we need special ones for the Net? -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Re: [noise] RE: Shave the Whales
by Toto 17 Dec '03

17 Dec '03

Dale Thorn wrote: > > Mullen, Patrick wrote: > > Is there a way we can keep the caricatures w/out getting the rest of the > > message > > w/ these postings? I like the ASCII art, but... > > BTW, some of the recent ones are pretty amazing: a bat, a scorpion, > a cow, etc. Maybe we could have the original cypherpunks list saved as an historical ASCII arts treasure. Toto

1 0

Re: Child Porn
by Lucky Green 17 Dec '03

17 Dec '03

At 04:48 AM 1/29/97 +0000, Vipul Ved Prakash wrote: >(Forward) >*** NY student charged with sending child sex photos over Internet > >Nathaniel Levy, a psychology major at New York State University, was >charged Wednesday with using the Internet to transmit photos of >infants having sex with adults, the New York state attorney general >said. This is hilarious, given the fact that San Francisco State University's psychology department has what probably amounts to the largest collection of child pornography on the planet. Their collection also includes primary sources on any other type of kink you can imagine. And some that no sane person ever could imagine. [You have to be at least working on a PhD to access the collection.] -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://www.mersenne.org/prime.htm

1 0

Re: More Circumventing the ITAR
by Anil Das 17 Dec '03

17 Dec '03

Mark Rosen wrote: > > I'm curious as to exactly what the ITAR/EAR/Whatever says specifically > about "unrestricted FTP sites." My program, Kremlin, is available for > download at the web page below. On my web page, I have some stuff in bold > print that informs about the ITAR and tells people to go away if they're > not from the US or Canada. Does this count as an unrestricted FTP site? > It's not all that much different from what MIT has up for PGP. What you need to do to provide FTP access to crypto software is spelled out in the EAR regulations. Here is a summary. I am not a lawyer. 1) Users (downloaders) should be asked to answer some questions to indicate that: They are aware of the crypto export regulations. They and their computers are in the US/Canada. They intend to follow the the crypto export regulations and not export the software they download. They are US persons as defined in the EAR regulations. 2) The server should check that the client site requesting the download is in the US or Canada. In other words, just displaying a warning is not enough. > Also, back to the question of registration numbers. A registration number > is just a string of letters and numbers, and is essentially the same as a > friendly letter; it contains no cryptographic code. For all anyone knows, I > could just be charging for pseudo-random numbers, again, nothing of > cryptographic significance. Is it illegal for me to mail someone outside of > the US or Canada a registration code? Thanks for any help. I wouldn't try to circumvent the regulations by trying to follow the letter of the law while ignoring its spirit. You don't have to be convicted of a crime to make life a lot difficult. Ask Phil Zimmerman, who never even uploaded pgp to the Internet. -- Anil Das

1 0

Re: Libel/slander & crypto relevancy (fwd)
by Greg Broiles 17 Dec '03

17 Dec '03

At 10:42 AM 1/28/97 -0600, Jim Choate: >> From: Greg Broiles <gbroiles(a)netbox.com> >> Civil actions against people doing "graffiti" are only interesting where >> the defendant has assets worth suing for. This economic dimension >> substantially limits the number of suits which will be brought. > >Thank you for agreeing with my thesis that the legal industry is one >driven by monetary gain and not justice. It is the one major problem >with law today, it ignores those who are not 'worth it'. Justice is >supposed to be blind and until that happens there can be no true >liberty. Law should be involved in rights and wrongs and not 'how much >money do I need to buy that villa in Spain'. Um, I was making the reciprocal of your point - that people with no assets have a special *advantage* with respect to civil suits, they're able to get away with a fair amount of misbehavior because it's not cost-effective for plaintiffs to sue them. If you're a defendant, being ignored as not 'worth it' is a good thing, not a bad thing. >There is also the aspect of 'reputation' of the organization which was >defamed. This will become even more critical to good business over the >Internet in the future than it is now. Now the only really important >'reputation' that one has to worry about is their credit report. I disagree strongly here. Think about the reputations of Odwalla and Sizzler and (Burger King? can't remember) after their E. Coli problems. Think about the reputation of Radio Shack for making mostly crappy products. Think about the reputation of some ISP's (Netcom, AOL) for continuing to charge people's credit cards for months after a cancellation. Reputation has many dimensions beyond credit reports. > Another aspect of this >that keeps coming up is one of 'big' corporations with 'lots' of money, >this monotonicity in legal thought is the reason I refer to the 'legal >industry' and not 'legal profession'. Currently the main force driving >law is how much money is available. Expansions of liberty simply can't >happen in this environment because there is no mechanism to protect >'little' organizations or persons without 'lots' of cash. This problem is >one that is not being addressed by anyone, most especialy lawyers who >will loose income which they aren't apt to do voluntarily. I agree that people get screwed because they can't afford to litigate or they can't afford a [good] attorney. But I think that the economic dimension to litigation is not necessarily all bad - if litigation were costless, what would prevent people from suing over essentially negligible disputes? I think it's good for people to stop and ask themselves "Is this dispute really worth fighting over?" The relatively high cost of litigation is a way to ration access to a relatively expensive resource, e.g., the courts. If litigants don't pay that cost, then taxpayers will. (And shifting more costs to losing litigants makes it easier, not harder, to be effectively judgment-proof by having few assets.) >> Criminal prosecutions for defamation (in the case of "graffiti") are still >> unlikely - a much more straightforward charge would be unauthorized access >> to a computer or some flavor of fraud, depending on the facts. > >This would be hard to do in the situation such as a mailing list because >the parties would have 'authorized access' and it does not include the issue >of inside parties nor 'web bbs's' where parties can enter comments and >other statements in a 'authorized' manner. There are mechanisms to use >computers for abuse of other parties besides hacking. I don't think that that web BBS or mailing list messages alone will lead to much criminal liability for defamation because I think it's difficult to do a lot of harm in that medium. BBS's have existed for 20+ years now - and how many online defamation cases have we seen? Maybe 10, total. Off the top of my head the only ones I remember are _Cubby v. Compuserve_ and _Stratton-Oakmont_, but there are probably others. Still, we're seeing what, at best one reported case for every 2 years? Online defamation liability exists, but I don't think there's ever going to be an avalanche of cases, simply because the damage involved tends to be relatively small compared to the monetary and emotional costs of litigation. >The point is that if joe-six-pack isn't secure in knowing that his views >and expression are not protected from abuse he won't use it. We all loose >in that case. But Joe Sixpack's lack of protection from abuse is also Joe Sixpack's protection from prosecution when he hasn't done anything wrong. Look at how pissed off some people are when Sandy moderates the list - imagine how much worse it would be if prosecutors were sifting through the list, identifying messages they thought were "over the line" with respect to defamation and then prosecuting the wrongdoers. Yow. Some people would be facing three-strikes minimums based on a single day's messages. :) I much prefer a world where we can engage in spirited debate without being afraid of prosecution (or civil suits) over a world where a tiny misstep means jail or litigation. You're of course free to want something else, but it's hard for me to see the logic behind arguing against private moderation but in favor of significant state regulation. Look at the way that big corporations use SLAPP suits to pick on Ma and Pa Kettle now, and imagine what big corporations could do if it was easier to create criminal liability for defamation. I think your proposed strengthening of defamation rules will prove to hurt the "little guys", not help them. >In this example, if party A makes a statement and then B changes it and >then re-distributes it as original comments by A then there is a problem >irrespective of the monetary worth of A or B. Digital signatures in and of >themselves won't help this from happening unless it is required to include >the full text and signature of any quote in any subsequent use of that >material otherwise the quote and the digital signature are out of sync and >therefore worthless. But people who receive the message unsigned know they're getting an unsigned message (or know that it was signed by the quoter, but not the quoted author) and can make the appropriate assumptions about the truth of the attributions, and adjust their assessment of the veracity of the quoter if it turns out that the quoter is a liar, or if someone challenges the quoter to produce a signed version of the statement and they cannot. We seem to have survived OK so far without special rules to punish people for lying - why do we need special ones for the Net? -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Re: Fighting the cybercen
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:dthorn@gte.net to Harka <=- > The Cold War was not won by the arms race, it was won in > Eastern Europe which was never a major participant. The main > instrument that won it was West German TV which broadcast > pictures of supermarkets with full shelves into the homes > of East Germans every night. The viewers could see that it > was not mere propaganda and their relatives confirmed the > fact. As a result the East German guards on the Berlin wall > simply decided to leave their posts one night. In> That's it? The system collapsed because the guards left their posts? In> And no mutiny charges? Incredible. Actually not quite right. On November 9th, 1989 the East-German government established a new law (under pressure from the demonstrating public), that would allow every East-German to go _up to_ 30 days/per year to a western country. Visas to do so would be given out without problems, effective immediately. At the evening press-conference however, the government speaker Guenther Schabowskie (can't recall his exact position at that time) introduced that new law and then he made the BIG error: after hearing the new provisions of the new travel law, a foreign journalist stood up and asked him "Does _that_ mean, that every East-german citizen could right now go to the western border and gain free entry to West-Germany (or West-Berlin) without problems?" And my man Guenther was looking desperately in all his papers (funny as hell! :)) and then, after finding no pre-made answer, he said: "Yeah, I guess so!"... After which the journalists sped out and cabeled their interpretation of the situation: "The wall is open!". Which in fact was quite a dangerous situation then, cause East-Germans heard that and actually went to the west-german border (and West-Berlin as well). The Border-Control guards however were even less informed then my man Guenther :), with the difference, that they had the order to shoot in case of "Desertion of the Republic". But faced with hundreds of people, who were all talking about some new travel law, they just shrugged and opened the gates without being stupid (they after all, were mostly young men in 1 1/2 or 3 year military service/draft, who were normal people just like everybody else). In fact, for acting in such a way, a lot of people gave them flowers and champaigne later on in that wild night of celebration... Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! --> http://www.eff.org */ /* E-mail: harka(a)nycmetro.com (PGP-encrypted mail preferred) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMunadDltEBIEF0MBAQHw5Af9FTchTTk9/G6Nq/StYwwLv3vt5hFmNUjn jyS5eDOM2rlh9107Awv4TwdGnV43RlJVKvNSnYUOg+dRiYhysewfyyJ4klmmsTBP x+9Cn81o1Jqeqp5aovP52YLgdCKUL9l7BOnvQsXzJIJRglj1KC/Hr+5kXWNsyI6l wN7WSnFPLJ0c+q5QXkkpQfWUj4LwOZItbh+I2Sy+kIdJuhVi66L45oCkJyHwfq2+ SgbuqaGabAGVakOMl53yffuhc6TXKcWcs30Vi2axwqXE//hlwO/NFg/OaoMUz+6i fJZmUtI33iCpsTtELPZzIqeP7DM13CaZ5u1r4URVWUOdXFDRs9Hytw== =YiP5 -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

Re: Trigger-Words...
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In> harka(a)nycmetro.com writes: >does anybody know any contact points/Web pages, where I might get >some information on e-mail filtering via trigger-words? I am >interested in how this technology specifically works and a >acollection of trigger-words would be nice too :) Actually, I might not have chosen the correct words for what I wanted... I am looking for sniffer-programs, that analyze e-mail traffic on the Net and filtering out all e-mails potentially interesting for _intelligence services_. For example, I've heard, that if an e-mail contains the words: "assassinate President" (DISCLAIMER: I hope, our President lives a long and happy life, even after his impeachment...:)), it will automatically get filtered and checked out by the Secret Service. Different intelligence agencies might have similar things in place. Where could I get some more information about that? Thanks in advance... Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! --> http://www.eff.org */ /* E-mail: harka(a)nycmetro.com (PGP-encrypted mail preferred) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMunaiDltEBIEF0MBAQHVFAf/TbYVKOSoH4G0GRaHcJJDREUbzkr4nczs Vi7EMagZci3FRx0atVAkMz4GNwBYCf5CJdnDTIR7tOADs1OamMIRhsGV00r3ZbCB dAWTKbjKcXHno+Eztmelk9P5F50ryP2B25mjWT2CJDTZqyml6Bhe5AW8K0lSDPfw AHCGPk701pXB62POXf2rwccQusOFAMaR4X/44xcOdamrWBsKJKaE1Sz/wvzvzxob 7t8Dh7x48oEgMQ68cQz2luZlZlIUzHV3x0npZNetYbEzRTKMEITXfKqzb0iG8pfD r1K13Jlr4Li93f59OKci5Rrz6eiCIvXlII9w4o2ejYJp8EPZdNsTKg== =Mh6f -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

verisign_1.html
by Lynx_User＠linux.nycmetro.com 17 Dec '03

17 Dec '03

Reuters New Media [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Previous Story: Kodak Near Deal With Wang - Report Next Story: AT&T To Build Business Calling Base _________________________________________________________________ Tuesday January 28 9:52 AM EST VeriSign Commercializes New Encryption Standard SAN FRANCISCO - VeriSign, hoping to push some recent Internet encryption research into use, says it has begun commercializing several products based on new industry encryption standards. First it has taken the Secure Electronic Transactions (SET) standard developed last year by an industry group led by Visa and MasterCard and started online distribution of digital IDs based on SET to Visa customers. At a conference in San Francisco sponsored by RSA Data Security, VeriSign also demonstrated digital ID smart cards using a PC/SC standard to get access to Internet sites. In a partnership with Schlumberger, which also manufactures the smart cards, Litronic, which makes readers of smart cards, and Microsoft on whose Internet Explorer 3.0 browser the smart cards will work, VeriSign showed how the smart cards would be useful for providing secure access to restricted Internet sites, or for transactions on the Net. "We are starting to see the industry support this Visa- MasterCard initiative with a lot of product efforts," VeriSign Chief Executive Stratton Sclavos said about SET. Smart cards are credit card-shaped plastic cards that hold a microchip that endows them with computer intelligence and processing capabilities. As officials from VeriSign, Spyrus and others described here, an employee would use the smart card to get access from anywhere to a corporate network and have all the key personal information as if the computer was programmed for that person's use. Likewise, a consumer might use the smart card in many different sites to do Internet-based transactions from kiosks or ATMs and so on. Sclavos forecast that Internet transactions requiring security will gain consumer acceptance in 1998 or 1999. He said 1997 will be the year that security apparatus is installed or deployed by merchants, banks and other companies. Then once deployed, consumers will start using it about a year later. Security remains a key concern of consumers about electronic commerce and Internet transactions, he said. VeriSign also announced its so-called private label digital ID program in which it is making encryption products for large customer-oriented companies, like brokerage firms, to distribute to customers for access to online accounts. And it announced a new service for the Electronic Data Interchange market that allows EDI to take place over the Internet instead of proprietary networks. Mountain View, Calif-based VeriSign considers itself the leader in providing digital certification for Internet access and electronic commerce. It has issued digital IDs based on other encryption technology it developed to about 500,000 people and on 14,000 Web sites, it added. Copyright, Reuters Ltd. All rights reserved _________________________________________________________________ ________________________ ___________ Help _________________________________________________________________ Previous Story: Kodak Near Deal With Wang - Report Next Story: AT&T To Build Business Calling Base _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments

1 0