December 2003 - cypherpunks-legacy

Forged "unsubscribe"
by Timothy C. May 17 Dec '03

17 Dec '03

Though I am avoiding commenting on the continuing Vulis nonsense, something has come up which necessitates my comment. I received a message from majordomotoad.com saying that my (alleged/purported) message, "unsubscribe cypherpunks dlv(a)bwalk.dm.com", is being forwarded for processing. The full message is included below. It appears that someone is attempting to make it look like I am trying to unsubscribe Dmitri Vulis! I assure you all that I have sent no such message to majordomo(a)toad.com. I'm cc:ing Hugh Daniel to make sure he sees this. Perhaps he can look at the full headers and path information of the alleged message from me and figure out who is playing this kind of game. --Tim May >Received: from you for tcmay > with Cubic Circle's cucipop (v1.10 1996/09/06) Fri Oct 11 14:26:44 1996 >X-From_: Majordomo-Owner(a)toad.com Fri Oct 11 13:46:54 1996 >Received: from toad.com (toad.com [140.174.2.1]) by you (8.7.6/8.7.3) with >ESMTP id NAA13723 for <tcmay(a)got.net>; Fri, 11 Oct 1996 13:46:54 -0700 >Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id NAA00496; >Fri, 11 Oct 1996 13:53:05 -0700 (PDT) >Date: Fri, 11 Oct 1996 13:53:05 -0700 (PDT) >Message-Id: <199610112053.NAA00496(a)toad.com> >To: tcmay(a)got.net >From: Majordomo(a)toad.com >Subject: Your Majordomo request results: unsubscribe >Reply-To: Majordomo(a)toad.com > >-- > >Your request of Majordomo was: >>>>> unsubscribe cypherpunks dlv(a)bwalk.dm.com >Your request to Majordomo(a)toad.com: > > unsubscribe cypherpunks dlv(a)bwalk.dm.com > >has been forwarded to the owner of the "cypherpunks" list for approval. >This could be for any of several reasons: > > You might have asked to subscribe to a "closed" list, where all new > additions must be approved by the list owner. > > You might have asked to subscribe or unsubscribe an address other than > the one that appears in the headers of your mail message. > >When the list owner approves your request, you will be notified. > >If you have any questions about the policy of the list owner, please >contact "cypherpunks-approval(a)toad.com". > > >Thanks! > >Majordomo(a)toad.com > > > "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Crypto AG - Secret GAK Partner ?
by um＠c2.net 17 Dec '03

17 Dec '03

>> Some one recently gave me a copy of an article in Der Spiegel >> (unfortunately in german!) stating that Crypto AG of Switzerland >> had passed the keys to the German Govt without informing the >> customer. > >This is nothing new. But how about faxing the article to John Young, so >we all may benefit? There is no need to. They have an archive at http://www.spiegel.de/archiv/ (you have to register before you can use it). The article was in Der Spiegel 36/1996.

1 0

RE: "Internet II" and Clinton
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May * a government attempt to reassert some sort of control over the Internet, a la the "we paid for the Arpanet, so we can control what it's used for." ................................................................ That's also what I've been thinking about, regarding the efforts to get all the schools wired. "It's our project and we can control it if we want to." I could almost paranoically get cause & effect confused, thinking that the program for free internet access is merely an excuse for assuming the control over the internet that the governors are aspiring to achieve, rather than it being merely a contingent consequence of their involvement with it. I deplore the fact that so many people are lured into signing up for internet access ( Hurry, Hurry, you don't know what you're missing on Usenet!!!) without being mentally prepared for what they can expect to see there. Then they must suffer the shock of realization of what is available, free & uninhibited. (Ooops. "They didn't tell us about *that* stuff being there, (whine) take it way!") But you just have to know that, once the governors decide to become the Determining Factor in setting up everyone for internet access, they will also become the determining factor in what everyone gets to see, and therefore gets to post or send through the channels. .. Blanc

1 0

Prove it in Court First
by Duncan Frissell 17 Dec '03

17 Dec '03

>From the Software Publisher's Association Code of Conduct for ISPs: "It is also a violation of the copyright owners rights for an ISP to post, or to allow others to use its server(s) to post, materials, like serial numbers or cracker utilities, that make it possible for others to execute and use pirated software. Such acts, which either induce or materially contribute to copyright infringement by someone else, constitute contributory infringement, and expose ISPs to the same liability for damages, penalties and injunctive relief as a direct infringer." Here is how you violate the copyright of the book "Unix for Dummies" : 1) Get copy of book 2) Go to copy machine 3) Copy the book I hereby demand that you copraphageous cretins sue me immediately for providing this information. DCF

3 2

Re: AW: Binding cryptography - a fraud-detectible alternative to key-esc
by Hal Finney 17 Dec '03

17 Dec '03

Another flaw with schemes of this time (in terms of failing to meet their goals) is that they cannot detect superencryption and other forms of non-standard encryption of the message body proper. All they can really do is verify from the outside that the same session key is encrypted for the two recipients (the intended recipient and the Government Access to Keys Party - let's not abuse the term by calling him a Trusted Third Party). But they can't be sure that the session key is sufficient information to decrypt the message. The session key could itself be a PK encrypted form of the actual message session key, so that the true recipient would have to run the PK decryption algorithm through two iterations before he actually got the real message session key. Or the message could be simply superencrypted using a non-escrowed encryption system, then encrypted using the GAK technique so that it looks fine from the outside. These kind of techniques could be detected by the recipient, but as Adam Back points out there are much simpler techniques if we just want the recipient to be able to tell whether the key has been encrypted for the GAKP. For that matter if *he*'s really concerned about it he can forward the plaintext to whatever governments he likes. Hal

1 0

Constitutional Convention
by azur＠netcom.com 17 Dec '03

17 Dec '03

Have any on the list been following ballot measures aimed at term limits? In Nevada, one of (I believe 45 states) with such initiatives on the November ballot, the measure seeks to limit some state offices and requires the state to call for a Consititutional Convention to limit terms of Federal Senators and Reps. If these pass we could be in for some wild times as every disaffected group (e.g., pro-life) seeks to codify new Amendments in agreement with their pet cause. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

1 0

Re: Burma bans modems
by azur＠netcom.com 17 Dec '03

17 Dec '03

> UPI reports that in July a diplomat, Leo Nichols, died in prison > after he was sentenced to a lengthy term for illegal possession of > fax machines. > > It's clear from this action that the SLORC, i.e. the "State Law and > Order Restoration Committee" (sic!) understands full well the > benefits and importance of the Internet and other forms of > electronic communication to open societies, and is determined to > deny these benefits to its citizens. Given its recent history and > the quasi-imprisonment of Daw Aung San Suu Kyi, this new action is > perfectly consistent with the government's previous abysmal > record. > Look, look, up in the sky! Its a B2, not its an F-117, no it AP-man! The Great Mandala is in motion. Ladies and gentleman place your bets. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

1 0

[RANT] Re: Why not PGP?
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: apteryx(a)super.zippo.com, cypherpunks(a)toad.com Date: Sat Oct 12 00:48:23 1996 Mark wrote: <snip> > Does this mean that exporting Private Idaho, PGPfront, WinPGP, etc. > would > be a violation of ITAR because they function only when combined with PGP > and contain "hooks" for using PGP? To the best of my understanding, "maybe, it depends" A lousy answer to a good question, and NOT legal advice of course. One of the big problems with regs. like ITAR (and others of questionable Constitutionality) is uncertainty. Certainty and simplicity would lead to less FUD, and hence less power on the part of regulators, so it's not in their interest to be definite or even rational. One of the things "it depends" on may be the time-proximity of an election, of course. Folks seem to have disturbingly short memories regarding governmental abuse these days. > I don't recall any restrictions on who could download these files from > their host sites. At least in the case of Private Idaho, which seems to be the standard for using & chaining remailers (with John Doe in a close second place) there seems to be no restriction. AFAIK, Joelm couldn't keep a program as nice and as widespread and as popular from getting exported no matter what he did. Joey Grasty tried (really!) to keep WinSock from getting exported, but it was overseas anyway, within days. [I didn't do it.] Is remailer software somehow different than remailer-using software under ITAR? Again, I don't know. <sigh> It is quite likely, IMO, that the next governmental attack on privacy will come on the chained, encrypted remailers, like WinSock, which I'm running as I type now. :) I am a strong believer in privacy, but only for peaceful and good purposes. Running a remailer, like running for office, is an experience that will change your outlook on things. I encourage doing both. As everyone knows, I would be likely to begin keeping logs and cooperate with law-enforcement (even the lying, "evidence" planting, biased assholes at B.A.T.F.) if I were to somehow discover violent abuse, like Mr. Bell's "assassination politics" scheme, going on inside WinSock. Presently, only a rejected message file is kept. With proper encryption and chaining, I am not sure how much good cooperation would do anyway, and I would be certain to take considerable pains to avoid compromising the privacy of legitimate users. OTOH, I would shut down, or go to jail for contempt, or both, rather than cooperate even one little bit in the enforcement of the failed, corrupting, tax-and-spend drugwar. I am sure that different remailer-operators all feel differently about the issue, and it is certainly a touchy one, but I am sure that some operators do agree with me. I will not initiate, or advocate, or abet violence in a failed attempt to achieve political or social goals, no matter who or what wants me to. I hope that abusers don't "ruin it for the rest of us." I would also hope (though it sometimes seems that no rational argument stands a chance) that those who are tempted by violent, simpleminded "solutions" would understand from recent and not-so-recent history that transforming jerks into martyrs is an incredibly simple way of cementing those jerks' policies *permanently* into law. There is no free political lunch -- peaceful change requires hard work and money. JMR One of the "legitimate concerns of law enforcement" seems to be that I was born innocent until proven guilty and not the other way around. -- me Defeat the Duopoly! Vote Harry & Jo http://www.HarryBrowne96.org/ ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 I will generate a new (and bigger) PGP key-pair on election night. <mailto:jmr@shopmiami.com> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMl8jHG1lp8bpvW01AQFWnwP+MhhHkTt9f3GbkjPlf+w7aZuzPMEt5xEi vMDSiu5cHjXeCFKZgVlb/8jXfin7hiGjoEEeeq0ntIb0POTKfbFUI/EB3nURrj8u aABvshBGVOfLNJzO/+6nqAgJeVMgyhjJYBkjWSvuJDHhphCfUtpyLKkvI3V8Ps4k h8ZHM2t95q8= =K6Lo -----END PGP SIGNATURE-----

1 0

Re: exporting signatures only/CAPI (was Re: Why not PGP?)
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Jim Bell <jimbell(a)pacifier.com> writes: >> At 08:49 AM 10/11/96 +0100, Adam Back wrote: >> > [...]. Microsoft's CAPI arrangement is that they will not >> > sign non-US CAPI compliant crypto modules (Examples of enforcement of >> > no-hooks interpretation). >> >> Does that fix the "export only the signature" problem (for the >> government)/opportunity (for the rest of us)? You know, present Microsoft >> with the software, don't tell them it's already out of the US, and they sign >> it. Export the signature only (who cares if this is legal!) and edit the >> international software to contain the signature. > >Export the lot, signature included :-) > >(I doubt exporting only the signature once the story came out would >offer you any more protection legally than exporting the software). > >As you say who cares if it's illegal: things get exported all the >time. > >The problem however, is finding a non-US site to hold the hot potato >once it has been exported. For example 128 bit Netscape beta was >exported a while ago. I don't see it on any non-US sites. This is >due to Netscape's licensing requirements, you need a license to be a >netscape distribution site, the license doesn't include the right to >mirror non-exportable versions on non-US sites. > That's one good application for remailers, and .warez newsgroups. at. >If the exported software is `PGP3.0 for CAPI' or whatever, I think it >should be fair to conclude it will be cheerfully mirrored by all, and >Phil Zimmermann won't be complaining. (PGPfone is on ftp.ox.ac.uk, >plus other places, for example.) So yes, I agree, for software with >appropriate distribution licenses. > >Another approach, which has been discussed lately is the use of a >patch to usurp Microsoft as the signatory for CAPI modules. I wonder >what Microsoft would say about an unauthorised patch, to fix an ITAR >induced `bug' in windows. Bill Gates doesn't sound pro-GAK. If they >aren't going to complain, perhaps such patches could be distributed >widely outside the US also. > >The new owner of the CAPI signatory key would need a good reputation, >and presumably a policy of signing any (non-GAKked) CAPI modules >signed by microsoft, and anything else that anyone wants signed. > An excellent suggestion.

6 6

[URGENT] Secure envelopes
by nobody＠replay.com 17 Dec '03

17 Dec '03

There's a rumor that Timmy C. Mayflower sells his dead relatives as fertilizer as they constitute the best shit in California.

1 0