December 2003 - cypherpunks-legacy

Re: Bidzos (RSA) on "Primetime Live" (was: cellular)
by swc＠uc1.ucsu.edu 17 Dec '03

17 Dec '03

Voice registry is far easier than you imagine. I am in defense contracting and have seen demos here at Rome Laboratory. I will NEVER feel secure on the phone again. They can easily identify speakers, languages, keywords and gists of conversations. Now they are working on dialiects. ------------------------------------------------------------------------ Stuart W. Card, Consultant, Card & Associates -- Research & Development Box 153 RR 1 Newport Rd Utica NY 13502 315-735-1717 / FAX -8469 swc(a)uc1.ucsu.edu or cards(a)top.cis.syr.edu "Who is John Galt?"

1 0

Net Regulation
by Duncan Frissell 17 Dec '03

17 Dec '03

I know that this was a long time ago but I've been cut off from cyberspace for *days* (months in net time) while PANIX was down. S >From: smb(a)research.att.com S >Or -- envision, if you will, an ukase that the FCC will regulate the S >Internet, and that anyone who wants to connect will have to agree to an S >acceptable use policy that includes the requirement that all mail be S >digitally signed, both by the individual and by the site, and that S >mailers enforce this requirement. Can't happen? Since the Internet is an international entity, it is probably not subject to FCC regulation. Even if domestic accounts are somehow regulated, it is no problem to telenet from my regulated account, (or make a long distance phone call) to Demon Internet Services in London and access my account there automatically downloading encrypted mail and news files. As most of the comments on the Bell Atlantic/TCI merger suggest, there is little appetite even in the Clinton Administration for telecommunications reregulation. Such a move would seem to run counter to the domestic and international trends in telecoms policy. If the Bundesposte has had to surrender *its* monopoly, I doubt if mere US regulatory authorities can prevail in the winds that are blowing now. Further, such rules do not now govern private networks and setting up a secure, encrypted "enterprise network" is simple and cheap these days. The regulators will have enough on their plate trying to chase down all those people downloading porno from Zimbabwae and setting up their very own private "virtual" phone companies to compete with the licensed monopolies. Each node on a network can be a network of its own as large or larger than the network of which it is a part. S >Nor do I think that ``offshore data havens'' will help. Apart from S >the fact that most major governments are basically in accord on the S >question of who makes the rules (them, not the people -- or did you S >see any governments denouncing Clipper? I saw lots of endorsements), S >there is a potent weapon that can be used: mandatory disconnection S >from the net for any country that doesn't co-operate enough. The Feds can't even keep *me* off the nets (without arresting me), how can they keep a whole country off the nets. Shutting off the nets would be the equivalent of shutting down the phone system (since those will both soon be the same thing). You couldn't do that to one of the OECD countries at this point. It would be an Act of War. It would also cause a total financial panic since everyone would worry about other shutoffs and investors involved in the shutoff country would engage in a run to cash. Global liquidity depends on a microsecond by microsecond flow of data. This flow is bound to increase as time goes on. There is not even an international authority capable of imposing that sort of ban. It would also be technically difficult since the nets are topologically complex. S >Wanna place any bets on creating a whole new S >anonymity structure?) For that matter, international bandwidth is a S >matter for diplomats as well as technicians; permission to create new S >circuits will simply be withheld. If you doubt me, try placing a S >call to Cuba, or to the former USSR. After your Nth ``circuits busy" S >message, don't bother asking why the long distance carriers haven't S >installed more trunks, when there's obviously a demand for them. That was then. This is now. There is a guy in Havana right now selling satellite dishes. Thousands of Russian computers a month are joining Internet since the links were opened up a few months ago. With all of the dark fiber now going into the ground/ocean and data compression and multiplexing continuing to improve, I doubt that the regulators will have much effect on bandwidth allocation which is a child of scarcity. When lines are expensive, you can support expensive central switching and large monopolies. When virtual "lines" are nearly free, even force majure can't cope with 5 billion people shopping 'till they drop for cheap telecoms. S >Cryptographic technology is an enabling mechanism for various social S >changes. It by no means makes them inevitable. Don't delude S >yourself on that; the political will to do something is more important S >when various alternatives exist. I've always considered the "action at a distance" capabilities of the nets to be more important than encryption per se. Since governments are geographically-based entities, technologies which enable us to weaken the bonds of place reduce the ability of states to exact a "monopoly rent" based on their control of certain land areas. S >And throughout the centuries, governments have had no trouble stripping S >hated minority groups of their assets, without any need for computers. True. Computers, and jet travel, and other things don't make the government enormously more powerful than it's ever been but they *do* make us vastly more powerful than *we've* ever been. Louis XIV and Slick Willy could both destroy a village "so that no stone was standing upon a stone" but we are not bound to the soil like the peasants of 18th century France. S >If you want a Brave New Digital World, it isn't sufficient to build S >the tools. You also have to convince people that it's a good idea. S >Oh, the online world is coming; no doubt about that. But people have S >to be convinced that privacy and the like is in their interests, that S >it will solve problems that *they* will have. I think that a 30% to 50% increase in income via elimination of effective tax liability is quite an inducement. The artificial profitability of untaxed over taxed income has been enough to support thousands of offshore financial subsidiaries of all the world's banks for years now. This when they have had to pay substantial costs associated with offshore operations. When the Bank of the Internet brings offshore banking as close as your terminal, such "arbitrage" between taxed and untaxed transactions will grow explosively. S >Equally important, they have to be convinced that it will not create S >new problems, to their perception (and the perception may have little S >to do with reality. 500 -- nay, 500,000 -- channels of digital S >information to the home will do nothing to educate those who prefer to S >learn about the world from McData Services, or from S >CBS/NBC/ABC/Fox/AP/UPI. What's this got to do with the price of Yak butter in Ulan Bator? What does it matter what other people think in the fibersphere (thanks George) in which everyone who wants to controls their own switching capabilities. In which there is no effective central control and no way to prevent communication between or among any individuals or groups that want to communicate. "Early adopters" such as ourselves will develop the fibersphere and lots of others will follow. As soon as they discover that they can make "free" LD video calls anywhere on earth, see any pictures, play any games, find work, "sex", and all things imaginable and unimaginable many more will come. What they will find is freedom. They will not be convinced by a close reading of "Human Action," they will *live* it. Freedom is what you get when human interactions cannot be blocked. And don't tell me that we still have to live in the physical world. If 90% of the GWP (including *almost all* the money) consists of non-physical goods and services on the nets, government control over the remaining 10% is not statistically significant. Since "unbundling" of services from physical goods is already going on and will be accelerated as people discover the tax consequences of non-physical services performed on the nets, large chunks of the GWP are bound to transfer to the nets. Look at the explosion in the forex market on the nets (tripled in size since 1986) once it "slipped the surly bonds of earth." S > --Steve Bellovin Duncan Frissell "Prediction -- The global information/communications phenomenon as highlighted by this week's Bell Atlantic-TCI merger will be at least as big in its impact on human society as the Industrial Revolution. You heard it here first." -- John McLaughlin "The McLaughlin Group" NBC Sunday 17 October 1993 --- WinQwk 2.0b#1165

2 1

Re: ADMIN: proposed new policy on the mailing list
by Matt Blaze 17 Dec '03

17 Dec '03

Oops, forgot to cc this to the list: While I'm all for encouraging the use of digital signatures, I think this is a bad idea. The fact is there is not yet a truely generally available method for digitally signing messages, and there are two competing standards from which to choose as it is. Just how should messages be signed? PEM? PGP? What consititues a valid certificate? (Actually, this question when applied to your proposal underscores the inadequacy of both systems in processing heterogeneous signatures - pgp imposes too little structure and pem imposes too much. But that's another story). Then there's the practical problem that some people simply can't use a particular signature technique with exisiting software and systems. These people include: - People outside the US and Canada, who can't legally use any PEM implementation of which I'm aware because of restrictions on RSAREF. - People in the US who can't use PGP because they're afraid to. - People in the US who want to use PGP but can't because the people who own/operate the computers they use won't let them. Some people on public access and university systems and many people in lawsuit-conscious large companies with deep pockets are included here. - People who would love to use PGP or PEM but don't see the point because they don't fully trust the system on which they would sign their messages. Anyone who uses anything but a private, single-user workstation SHOULD be in this category. - People who would love to use PGP or PEM but can't because they don't have a working implementation of their secure mailer of choice for their particular machine/OS. Do we really want to exclude these people from full participation? If so, I suspect this would eliminate a few of the most valuable contributors to the list. Again, I don't thing this CONCEPT is a bad one, only that this particular IMPLEMENTATION is premature in the absence of better and more ubiquitous signature tools. -matt (also unsigned, also known as mab(a)research.att.com)

1 0

Re: Warning about exposing anon id
by catalyst＠netcom.com 17 Dec '03

17 Dec '03

Wonderer says: >[direct replies to an anon id reveal _your_ anon id] To avoid this, instead of replying to e.g., an41418(a)anon.penet.fi, reverse the first two letters (mnemonic 'not anonymous') and thus reply instead to na41418(a)anon.penet.fi. It will go to the same person, but your reply will not by anonymized, and thus your identity will not be revealed. Hope this helps, Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

3 2

DC-nets
by Douglas Sinclair 17 Dec '03

17 Dec '03

My thanks to Tim Newsham and Tim May for sending me information on DC-networks. It appears the modifications that I had been thinking about were not discussed by Chaum in his original paper, which gives me some hope I may have stumbled across something new. Chaum proposes the use of public key cryptography for secure communication between vertices in a DC-net. This leads to the problem of secure key exchange, and the possibility that the public key algorithm is not sound. Instead, the interference properties of a DC-net may be used to give unconditional security. Say Alice wishes to send a message M to Bob. 1. Alice computes the hash of M, and appends it to M to produce a packet P of p bits. 2. Alice transmits on the net "Message of p bits for Bob" 3. Bob receives this message, and prepares a packet R composed of p random bits. 4. Alice transmits packet P. Simultaniously, Bob transmits packet R. The output of the DCnet is now X, where X = P XOR R 5. Bob, computes P = X XOR R. He verifies that the last bits of P are a valid hash for the first portion. If so, he has succesfully recieved M and the transfer is over. If not, there must have been interference from another party. He would then transmit "Alice, resend message", and the procedure would be repeated. All that Carol, another vertex in the net, can see is X. She cannot derive P from X as it has been encrypted with the equivalent of a one-time pad. Thus, P is unconditionally secure. Alice and Bob need no nothing about each other for this transfer to work. Indeed, Alice and Bob may well be pseudonyms. The worst that can happen is that two sites respond to the pseudonym of Bob, and the transfer suffers from interference. Hence the built in hash. Note that only Bob can see the valid hash, and only then if the transfer has worked perfectly. Thus, the hash need not be secure. I have not looked at the efffects of collusion on this protocol. My gut feeling is that sufficient collusion would bring it down in flames. However, this is also true of the basic operation of a DC-net. I cannot claim that I came up with this protocol alone. It was concieved this summer at a seminar I taught on cryptography. After sitting around a table and flipping coins to prove that it actually did work, we started looking at the problems of un-intentional interference. This is the result of half an hour of me trying to remember what little I had read of DC-nets and the students making me look like a fool for not having studied as much as I should have. So, my first question to you is, does it work? The next question is has it been thought of before? And finally, is it useful? -- PGP 2.3a Key by finger

1 0

ADMIN: proposed new policy on the mailing list
by hughes＠ah.com 17 Dec '03

17 Dec '03

Cypherpunks is an experiment in anarchy whose participants share overlapping concerns with respect to privacy and cryptography. One of the commonly shared goals of the participants in this group is to change the technical context of the political debate about cryptography. This goal has not been reached, nor even has very close approach been made as yet. I believe that we have been successful in inculcating, at least in ourselves, a set of values and attitudes toward encryption . Unfortunately this mental presence has not blossomed into actual culture and practice, although we have attempted and practiced. Not all systems are self-organizing, and ours is not dissipative in the right way. Therefore in true micro-Keynesian fashion, I am considering creating an artificial inducement toward cryptography on this list. You will be, of course, free not to participate. The rule I am considering is the following: Digitally sign your articles or their transmission will be delayed. In terms of email privacy, we have not yet even reached the level where content encryption is standard. Since software to make digital signatures is almost always the same software needed for encryption, and likewise for signature verification and decryption, an inducement to sign one's posts will be also an inducement to encrypt. At the very least it requires some change in the status quo of one's own email system. The hampering above will not be outright rejection, since the cost of rejection creates a step function to participation, an insurmountable hurdle for most of us. Rather I am considering hampering posts by delaying their transmission, by destroying some of their timeliness. Timeliness, as I analyze it, will be one of the few things that have economic worth in a post-copyright environment. Delaying unsigned posts does not prevent people from participating, merely from getting very close the topicality of discussion. If you are debating delayed against an undelayed correspondent, you will be at a disadvantage, as your points may be immediately responded to, but the other's points will stand unopposed for longer. Truth, in other words what _you_ believe, might triumph eventually, but practical epistemology is more a matter of rhetoric than of validity. Nor does it prevent occasional use of the forum by lurkers and learners. The first article on any new subject has very little time value, rhetorically, but the question still gets asked. Furthermore, it will tend to slow down debate, at least for a while. My initial thoughts are that the delay should be about six hours, which would limit the number of salient responses of the unverifiable to about one per topic per day. As more and more people begin to sign their posts, that delay would be increased. I have considered more sophisticated schemes, such as allowing automatic delayed moderation, which sends you back a ticket that allows immediate posting, but after some number of hours, or perhaps longer delays for unsigned repsonses to signed articles, but I think that a simpler system will work better, certainly at the outset where people are coming to grips with delay's effect on the discussion. I invite discussion of this proposal on the list itself. If you only wish to express approval or disapproval, that is, to "vote", please do so only in private e-mail to me. I welcome further analysis of this idea as well as evaluations of its desirability or odiousness in your own value system. Unsigned, Eric

5 4

pirate radio
by nobody＠alumni.cco.caltech.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There's an article on this morning's front page of the New York Times (10/24/93) about a guy in Berkeley who runs a pirate station and gives seminars on how to do likewise on the cheap. Better get judgement proof first, though - FCC is trying to fine him $20,000. Eternal!Optimist(a)anon.penet.fi (copyright 1993, Eternal Optimist [Ha Ha Ha]) 0) 0) =:()]-< <na26522(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLMpc04jvfLxJbYYtAQEtuAP9FRirBlZXmVzHXXqgFyQklDkqPfJtxSl7 Kz4Qn5aL/sghgM68w7OLTw6AYpeNMc2Te0aABRorEATlJISnAOHiUJnP/7+IH9oS XmwY1xJ5NfKWAHu2BzKoTd6eDKrZsPZ60ECLZ5ODEVDb8kmCuUPZo7rOFEzABmFK YBGOpH0I1Pg= =peuY -----END PGP SIGNATURE-----

1 0

Paper Shredders
by Panzer Boy 17 Dec '03

17 Dec '03

Awhile back someone asked about the cost of shredders. Since I do some work for a company that sells Mita copiers/fax/shredders, I talk to the sales people and asked. They sell a shredder that takes up to 5 sheets a paper at a time and turns it into 1/8" x 7/8" particles. This is considered low volume, and will run you around $800.00 USD. This is not suggested price, this is the standard "good" discount that the sales people can give. I wasn't able to find out the price of the next step up. But the sales brochure says that NSA and DOD standard is 1/32" x 7/16" particles. Standards for what classification of paper, I don't know. -Matt (panzer(a)drown.slip.andrew.cmu.edu) "That which can never be enforced should not be prohibited."

1 0

Sign this!
by Matthew J Miszewski 17 Dec '03

17 Dec '03

All due respect Eric, ...but requiring signatures could hinder this lists performance for several reasons. 1. New members of the list may have little knowledge of signing and may become frustrated at the delay that results thus minimizing the income of fresh talent to the list. 2. Those with aversion to open system storage will have a harder time signing their messages and thus security minded people will have their comments delayed. 3. A false sense of security may actually result in this forum since there is no _real_ compelling reason for me to check...lets say... L. Detweiller's signature everytime he posts. In a corporate contractual situation there is an economically compelling reason to check. ...and with regard to 3. I would _suggest_ that for all 'sensitive' or 'meant to be relied upon' information be signed by the author. For example I value Eric's vast knowledge of mathematical theory, and if 'he' published an article to the list on some new breakthrough algorithm I would be compelled to check his sig. But, If he is just flaming the hell out of LD, it is irrelevant to me if it is him or anyone else. --Matt ______________________________________________________________________________ "This new technology (the printing press) threatened the Crown, which shuddered at the thought of widespread dissemination of works advocating religious heresy and political upheaval. The Crown's solution to the problem was a system of regulation designed to control this "dangerous" art." -From my Copyright Law Text (refrencing the Statute of Anne - the first Copyright Statute) (c)1993 ______________________/___________________________________mjmiski(a)macc.wisc.edu

1 0

Re: Warning about exposing anon id
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

I agree with Alan's position that anonymization not be done automatically on reply to mailers, but in fairness Julf has argued that the "least astonishment" position goes the other way. Apparently for several years anonymous/pseudonymous servers have operated on the talk groups which do the automatic anonymization. People there have come to expect that when they reply to an anonymous message their own identity will be protected. Providing an anonymous server for which this established behavior does not occur will no doubt astonish many experienced users of these services. Still, I think the current behavior is wrong, and IMO the sooner people learn a new way of using anonymous servers, the better. When we do deploy anonymous servers which allow replies, it will be important to include disclaimers which remind people that their replies will not be anonymous. Unfortunately, some or most newsreaders do not show header fields, and I dislike sticking disclaimers into the message body itself. Hal

5 5