December 2003 - cypherpunks-legacy

CPSR Alert 2.03
by Dave Banisar 17 Dec '03

17 Dec '03

CPSR Alert 2.03 ============================================================= @@@@ @@@@ @@@ @@@@ @ @ @@@@ @@@@ @@@@@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @@@ @ @@@ @@@@@ @ @@@ @@@ @ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @ @@@ @ @ @ @ @@@@ @@@@ @ @ @ ============================================================= Volume 2.03 October 12, 1993 ------------------------------------------------------------- Published by Computer Professionals for Social Responsibility Washington Office (Alert(a)washofc.cpsr.org) ------------------------------------------------------------- Contents [1] Administration Continues NII Initiative [2] White House Announces New FOIA Procedures [3] Health Care and Privacy [4] CPSR Panel on Medical Privacy [5] CPSR Annual Meeting - October 16-17 [6] New Documents in the CPSR Internet Library [7] Upcoming Conferences and Events ------------------------------------------------------------- [1] Administration Continues NII Initiative Following the announcement of the "The National Information Infrastructure: Agenda for Action" in mid-September, the Administration is pushing forward the NII program. An open forum was held at the Department of Commerce at the end of September with high ranking officials, private sector representatives, and public advocates exchanging views on the NII program. The National Telecommunications and Information Administration is planning a series of hearings later this year on an updated concept of "universal service," and the Information Infrastructure Task Force working group on privacy has already held several meetings to examine privacy implications of the NII program. To obtain a copy of the NII report, FTP the document from ftp.ntia.doc.gov. Log in as "anonymous" with the password "guest" and change to directory "pub." Retrieve "niiagenda.asc." (The document is also available from the CPSR FTP site). CPSR will be submitting formal comments on the NII program later this month. To send comments directly to the administration, send email to nii(a)ntia.doc.gov. ------------------------------------------------------------- [2] Clinton Issues FOIA Directive Noting that "openness in government is essential to accountability," President Clinton issued a memorandum to all federal agencies on October 4 directing them to comply with "both the letter and spirit" of the Freedom of Information Act (FOIA). Clinton noted that the FOIA "is a vital part of the participatory system of government" and stated that "I am committed to enhancing its effectiveness in my Administration." The President also urged federal agencies "to enhance public access through the use of electronic information systems." The Clinton memorandum is a marked departure from directives issued during the Reagan and Bush Administrations, when most official pronouncements on FOIA tended to discourage agency disclosures. Attorney General Janet Reno simultaneously rescinded the Justice Department's 1981 guidelines for the defense of federal agencies in FOIA litigation. Under those guidelines, issued in the early months of the Reagan administration, the Department defended agency decisions to withhold information if there was merely a "substantial legal basis" for the withholding. Under the new Reno guidelines, the Department will only defend FOIA actions in which agencies can demonstrate that disclosure would result in some specific harm. Under the new policy, "Where an item of information might technically or arguably fall within an exemption, it ought not to be withheld from a FOIA requester unless it need be." The Attorney General directed that all pending FOIA cases be reviewed to determine compliance with the new policy and also called for a government-wide review of processing "backlogs" that have resulted in substantial delays in the disclosure of requested information. CPSR has several FOIA cases pending in federal court and has long urged that the federal information disclosure process be reformed to maximize the disclosure of requested agency records. The NII initiative also provide an opportunity to improve citizen access to government information. A copy of the White House and Atty General's memos is available at the CPSR Internet Library /cpsr/foia/clinton_foia_10_93.txt. ------------------------------------------------------------- [3] Health Care Reform and Privacy The recently released President's Health Security Plan includes important new provisions on privacy protection. The plan recommends new federal legislation based on a Code of Fair Information Practices. Currently, there is no federal protection for medical records. The new proposal also includes a provision for a national medical identity card, which is described in the plan as "like ATM cards, the health security card allows access to information about health coverage through an integrated national network. The card itself contains a minimal amount of information." President Clinton was asked about the privacy implications of the medical security card at a town hall meeting in Sacramento, CA on October 4. He replied that the card will be used to ensure that in an emergency that a person could be identified and that it "will have the same sort of protections that a Social Security card would..." He recalled opposition to the past attempts to expand the use of the SSN and noted that the card was only "for the purposes of establishing that you belong to the health care system." Another important aspect of the proposal is the identifying number. The proposal calls for the establishment of "a system of universal identifiers for the health care system." The proposal notes that "The unique identifier may be the Social Security Number or a newly created number limited to the health care system...In either case, the national privacy policy explicitly forbids the linking of health care and other information through the identification number." This will be determined by the National Health Board. In April 1992 CPSR sent a letter to Hillary Clinton with the endorsement of over two dozen privacy and computer experts requesting that the SSN not be used as the identifier. The letter cited privacy, security, and fraud problems and pointed out that other countries, such as Canada, have created limited purpose identifiers for medical record information. Other Privacy Provisions o The creation of mechanisms for effective enforcement including significant penalties. o Establishing a privacy framework based on the Code of Fair Information Practices including a right to know about and approve the uses of the data, assurance of no secret data systems, right to review and correct data, assurances that the data is only collected for legitimate purposes. o Issue effective security standards and guidance for health care information o Establishing as Data Protection and Security Panel to set privacy and security standards and monitor implementation of the standards, sponsor of conduct research, studies and investigations, and developing of fair consent forms. The relevant privacy provisions of the health care plan are available at the CPSR Internet Library /medical_privacy/ clinton_health_reform_plan.txt. A copy of the letter sent to Hillary Clinton is also available as hillary_letter.txt ------------------------------------------------------------- [4] CPSR Panel on Health Care and Privacy CPSR Annual Meeting - Sunday Evening - Special Session - Free to the general public 7:30 - 9:30 Special Panel Discussion "Health Care Reform and the National Information Infrastructure: Opportunities and Risks" The White House Task Force on Health Care reform has called for the development of community-based health data-management systems. A working paper from the task force notes: "Workgroup has vision for a community health information systems (CHIS) based on a computerized medical record. The CHIS will link all key parties in the healthcare delivery systems and service all their clinical and administrative requirements." The task force has estimated that the following areas: 1. Medical Electronic Data Interchange networking 2. Community Health Information Networks 3. Outcomes Analysis and 4. Computerized Patient Records. offer the near term potential (less than 5 years) to save 100 billion dollars a year via the development of standards, administrative reform, and federal leadership in using the existing networking infrastructure to promote electronic medical commerce. However, with these opportunities for improved efficiency and cost containment come risks - specifically privacy and access. The panel will include experts in medical information systems and privacy advocates. Come and learn about this important area. Join in this national discussion. Be part of the solution. Panelists: Richard Reuben, Executive Director, Foundation for Healthcare Quality Lance Heineccius, Director of Policy, Washington Health Services Commission David Flaherty, Information and Privacy Commissioner, British Columbia Irwin Goverman, CIO, Group Health Cooperative This special event is free and open to the public. It will be held in Kane Building room 210, University of Washington ------------------------------------------------------------- [5] CPSR Annual Meeting - October 16-17 COMPUTER PROFESSIONALS FOR SOCIAL RESPONSIBILITY ANNUAL MEETING October 16 - 17, 1993 University of Washington, South Campus Center Seattle, Washington, USA Envisioning the Future: A National Forum on the National Information Infrastructure and Community Access The National Information Infrastructure (NII) is the proposed medium or "electronic highway" that will connect schools, libraries, government agencies, and citizens using state-of-the-art computer and communications technology. Media, computer, and telecommunications companies are also acutely interested in the NII as it dramatically increases their opportunity for delivery of communication, services, and entertainment. CPSR is convening this meeting for both computer professionals and the informed public to discuss the broad range of choices facing society regarding the NII. Saturday, October 16 Keynote Address - Bruce McConnell, Office of Management and Budget "Shaping National Information Infrastructure Policy" Bruce McConnell, Chief of Information Policy at the Office of Information and Regulatory Affairs in the Office of Management and Budget (OMB), will present his views on the major NII issues now facing the administration. He has been with OMB since 1985 and became head of Information Policy in 1992. He now chairs the inter-agency task force responsible for developing federal information policy for the Information Infrastructure Task Force. Other Panels: "Public Access to Internetworks" Public access to the Internet (and other major networks) is a critical issue in any discussion about an "electronic highway". Panelists representing a wide variety of perspectives, including representatives from the Pacific Northwest, will present their views. "Municipal Information Infrastructure" City and other government agencies are exploring possibilities for developing municipal networks. In this panel a city official as well as a representative from the state regulatory agency and a representative of commercial interests will offer their insights and interests. "Networking in the Community" Community networks exist and are being developed all over the U.S. Panelists from various community networks will present their perspectives on the state of community networking now and in the future. "Computers and Democracy - What's the Connection?" How might computers facilitate the democratic process? How might they pervert it? "Electronic Democracy" is currently in the public eye and aspects of it will probably be tested soon. What can be done to promote wise uses of computers in this critical area? + Presentation of the 1993 Norbert Wiener Award to The Institute for Global Communications (IGC) + Banquet Address and Interactive Event - Kit Galloway, Electronic Cafe International Kit Galloway of Electronic Cafe International in Santa Monica, California will present his innovative approach to electronic communication using phone lines, slow-scan television, and other technology. Using videotapes and a live demonstration with CPSR chapters in Los Angeles and other locations, Kit will discus how the Electronic Cafe concept has been used in a variety of settings. Electronic Cafe International has staged global events with poets, children, and communities in France, Nicaragua, Japan, as well as a variety of American cities. Sunday, October 17th The second day of the conference will feature a more interactive format including several workshops, a discussion of CPSR's NII vision, and a special - free and open to the public - panel discussion on "Privacy Implications of Health Care Reform" Sunday evening. Gender Relations in Networking Information Policy: A Framework for Action Computer Professionals and Social Action Towards Participatory Design of Community Oriented Systems and Services CPSR NII Vision Document Discussion "Health Care Reform and the National Information Infrastructure: Opportunities and Risks" For more information, contact the National Office at cpsr(a)cpsr.org, or Aki Namioka, Annual Meeting Chair, at aki(a)cpsr.org. ------------------------------------------------------------- [6] The CPSR Internet Library Nearly 40 people who submitted comments to NIST have forwarded their remarks to CPSR. These comments are now archived by last name in /crypto/clipper/call-for-comments/ Submit your comments to clipper(a)washofc.cpsr.org Dr. Dorothy Denning and several law enforcement officials have prepared a paper on the law enforcement perspective on wiretapping and procedures need to obtain permission for conducting a wiretap. /communications_privacy/wiretap/denning_wiretap_procedure.txt The CPSR Internet Library is available via FTP/WAIS/Gopher from cpsr.org /cpsr. Materials from Privacy International, the Taxpayers Assets Project and the Cypherpunks are also archived. For more information, contact: Al Whaley (al(a)sunnyside.com) ------------------------------------------------------------- [7] Upcoming Conferences and Events "Universal Service: New Challenges and New Options in Tomorrow's Network of Networks." Sponsored by the Benton Foundation & the Columbia Institute for Tele-Information. Washington, DC October 15. Contact: Andy Blau (ablau(a)cap.gwu.edu) CPSR Annual Meeting, "Envisioning the Future: The National Information Infrastructure and Local Access." Seattle, WA. October 16-17, Contact: Aki Namioka (aki(a)atc.boeing.com) "International Symposium on Technology and Society '93." Washington DC. October 22-23. Deadline for submission: February 28. Contact: m16805(a)mwvm.mitre.org. "Technology: Whose Cost?. . .Whose Benefits?" Sponsored by IEEE, George Washington University, MITRE. Washington, DC. October 22-23. Contact: wjkelly(a)mitre.org "Cyberculture Houston 93." Houston, Tx. December 10-12, Contact: cyber(a)fisher.psych.uh.edu "Computers, Freedom and Privacy 94." Chicago, Il. March 23-26. Sponsored by ACM and The John Marshall Law School. Contact: George Trubow, 312-987-1445 (CFP94(a)jmls.edu) DIAC-94 "Developing an Effective, Equitable, and Enlightened Information Infrastructure." MIT Media Lab, Cambridge, MA. April 1994 (tentative). Contact: Doug Schuler (douglas(a)grace.rt.cs.boeing.com) 5th Conference On Women Work And Computerization "Breaking Old Boundaries: Building New Forms." UMIST, Manchester, UK. July 2-5. Abstracts by 10/1/93. Contact: Andrew Clement (clement(a)vax.ox.ac.uk) (Send calendar submissions to Alert(a)washofc.cpsr.org) ============================================================== To subscribe to the Alert, send the message: "subscribe cpsr <your name>" (without quotes or brackets) to listserv(a)gwuvm.gwu.edu. Back issues of the Alert are available at the CPSR Internet Library FTP/WAIS/Gopher cpsr.org /cpsr/alert Computer Professionals for Social Responsibility is a national, non-partisan, public-interest organization dedicated to understanding and directing the impact of computers on society. Founded in 1981, CPSR has 2000 members from all over the world and 22 chapters across the country. Our National Advisory Board includes a Nobel laureate and three winners of the Turing Award, the highest honor in computer science. Membership is open to everyone. For more information, please contact: cpsr(a)cpsr.org ============================================================== CPSR MEMBERSHIP FORM Name ______________________________________________________________ Address ___________________________________________________________ ___________________________________________________________ City/State/Zip ____________________________________________________ Home phone _____________________ Work phone _____________________ Company ___________________________________________________________ Type of work ______________________________________________________ E-mail address ____________________________________________________ CPSR Chapter __ Acadiana __ Austin __ Berkeley __ Boston __ Chicago __ Denver/Boulder __ Los Angeles __ Madison __ Maine __ Milwaukee __ Minnesota __ New Haven __ New York __ Palo Alto __ Philadelphia __ Pittsburgh __ Portland __ San Diego __ Santa Cruz __ Seattle __ Washington, DC __ No chapter in my area CPSR Membership Categories __ $ 75 REGULAR MEMBER __ $ 50 Basic member __ $ 200 Supporting member __ $ 500 Sponsoring member __ $1000 Lifetime member __ $ 20 Student/low income member __ $ 50 Foreign subscriber __ $ 50 Library/institutional subscriber Additional tax-deductible contribution to support CPSR projects: __ $50 __ $75 __ $100 __ $250 __ $500 __ $1000 __ Other Total Enclosed: $ ________ Make check out to CPSR and mail to: CPSR P.O. Box 717 Palo Alto, CA 94301 ------------------------ END CPSR Alert 2.03-----------------------

1 0

Re: Breaking DES
by doug＠netcom.com 17 Dec '03

17 Dec '03

pmetzger(a)lehman.com said: >Karl Lui Barrus says: >> plaintext with 2^56 keys, and decrypt the ciphertext with 2^56 keys. > >Tell you what, Karl -- when you build the device that can store 2^56 >encryptions, let us know. 2^56 bytes equals 10^7 gigabytes. At roughly $1000 per gigabyte, that equals 10^10 bucks...10 billion dollars. Or say there's a quantity discount in orders totalling a million units, and you get the whole capacity for 1 billion dollars. Well, that's a bit steep for me, but there's no question but that the NSA could afford it. Still, what do you say I wait a few years until it comes down to 10 million dollars, which I happen to have available in the year 2003 in my company budget? Ten years should do it, estimating conservatively. > Also let us know how you'll index and fetch the encryptions >in any reasonable time while you are at it, but by comparison thats a >tiny problem. That ten years also means that rather than searching 10^7 units in parallel, we will then be searching only 10^5 units in parallel. It'll still take a few hours, but that's ok. This all suggests that the NSA could do such a thing *now* if they *really* cared to, and could do so fairly trivially in 10 years. >> The work for this attack is 2^56 + 2^56 = 2^57, which suggests that >> double encryption doesn't increase the complexity of breaking your >> text very much. > >Karl, are you sure that you want people to think you believe this? I did a double take on this at first too, since naively one would expect the search to be (2^56)^2. However, this can be improved, for instance by sorting each set in N lg N time (56 * 2^56 operations), and then doing interleaved comparisons in N lg N time again, which can be mostly parallelized over those 10^5 computers that are running those 10^5 disks, so that the total time would be (since 10^16 = 2^56) 10^16 / 10^5 machines = 10^11 cycles, and given 10^3 MIP machines, this gives 10^4 seconds (20 minutes) for each phase...call it an hour total. (In other words, as a first approximation, Karl is accurate to assume linear rather than quadratic speed for this.) This neglects coordination of the networked machines, which one might expect to add a factor of 5 to 10 to those numbers. This rough analysis demonstrates that Karl's scenario is merely expensive now, and "cheap" (by NSA standards) ten years from now, rather than completely inconceivable. I guess the weakest point of the above back-of-the-envelope estimate is that each e.g. plaintext & cyphertext is assumed to be representable within one byte, but that's *not* fatal. You could use hashing to get down to one byte, and when a hit is detected, try again using two bytes. When hits are detected there, use four bytes...and so on. That approach allows the real world scheme to be reasonably close to the back of the envelope gross assumptions. Doug

2 1

Spread-spectrum net (vulnerability of)
by Robert J Woodhead 17 Dec '03

17 Dec '03

You can put up such a network, but given that your boxes have to receive the signal, it will be detectable (but not understandable) to 3rd parties. Anyone who wants to take you down will only need (1) a detector that can point out your boxes and (2) a small caliber rifle. Since the cost to find and destroy is much less than the cost to make and deploy, a covert network of this sort wouldn't last long. An _overt_ network, perhaps a commercial entity that networks an entire city, would be an interesting prospect. The techniques for maintaining location information on actual machines connected to the net, and for updating them as they move, are actually quite simple and well understood (cellular telephones are a simple, dumb version of the technology). The trick is to find out a way that the network can know where you are but not give that information out (even to the owners of the network), without unacceptable overheads.

4 4

Re: distributed autonomous networks
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Obviously, if we do a radio solution, the equipment ought to be attached to cans marked W.A.S.T.E :-) At least in the US, you don't have to pirate radio frequencies; there are a few bands that are available for uncensored low-power use, though some of them may require spread-spectrum. Meteor Burst is real stuff, though the last time I knew a little about it the bandwidth was pretty low; e.g. you got 300 baud average throughput doing bursts of 4800 baud with really heavy-duty forward error correction, since it's a pretty sporadic medium. Power usage is really low, and typical applications are things like telemetry from snow-depth recorders out in the mountains, where line-of-sight is essentially unavailable. I don't know how much bandwidth or area you get out of it, or how traceable it is - our meteor expert retired years ago, and was looking at problems like how to build radio data networks that weren't bothered by nuclear explosions. If there's a spare satellite slot available, ALOHANET technology is a reasonably efficient way to use it.

2 1

The Bank of the Internet!? (fwd)
by zeek＠IO.COM 17 Dec '03

17 Dec '03

No, I didn't read this entire message, but I thought it may be relevant... Forwarded message: *> From dummy Wed Feb 29 12:12:12 1990 *> X-EB: ------------------------------ *> Date: Fri, 8 Oct 1993 16:01:46 -0700 *> From: Arthur Chandler <arthurc(a)SFSUVAX1.SFSU.EDU> *> Subject: The Bank of the Internet!? *> *> Yesterday I went to hear a very interesting talk by Eric Hughes, one of *> the founding members of the Cypherpunk list/organization. Unlike most *> encryption pop journalists, who seem to limit themselves to PGP, this *> fellow brought up several boggling ideas: *> 1) "Cryptography is all economics." *> In other words, all encryption schemes come down to: how much $ am I *> willing to spend to keep you from getting into my secret info, and how *> much $ are you willing to spend to get it?" *> 2) There are two methods to keeping secrets on the NET (or IRL): trust *> some one, or trust an algorithm. And, in general, human trust is cheaper *> than technology. *> 3) The US government classifies encryption schemes as munitions, and is *> accordingly places all encryption technology under export restrictions *> controlled by the state department. *> 4) Claude Shannon's two basic principles of encryption: confusion and *> diffusion. *> *> He also mentioned something called a "blind signature" -- a special form *> of digital signature that keeps users unknown (through encryption) to both *> the bank they deposit with and sellers they transact with. I didn't *> understand this "blind digital signature" idea. Can anyone out here explain? *> *> But the real boggler is that this fellow Eric is, with the backing of *> the Electronic Frontier Foundation, going to start a Credit Union based on *> up-to-date encryption schemes and using the Internet as the monetary *> highway! It involves using something called digital money -- a system of *> encrypted data that expires over time, but that a highly flexible ability *> to purchase quantities or services. The data itself will be located *> over several nodes, so that no one site has all the info about your *> account, but that any "quorum number" of bank nodes can reconstruct the *> whole picture of your assets. Anyone trying to crack the system would *> have to crack, not just one or two nodes, but a quorum number. Such nodes *> will be distributed internationally, though favoring nations with *> encryption-favorable legislation. *> ************************************** *> I'm oversimplifying all this. But the whole notion of a Bank of the *> Internet, backed by the EFF and running encrypted international monetary *> transactions seems... well, this is Future Culture: what do you think? *>

9 13

Re: Cypherwaffle on spoofing
by jrk＠sys.uea.ac.uk 17 Dec '03

17 Dec '03

Arthur Chandler writes: > What I find odd is the number and vehemence of posts ON A LIST DEVOTED >TO ENCRYPTION saying "Hey, it's a fact of life, accept it" -- even >dragging out Machiavelli's profoundly mistaken "if you can't enforce >it, don't prohibit it." "It's a fact of life" is a fact central to the, ahem, cypherpunk cause. Virtual personas are here. The only question is how this will change the way people deal with each other over the net. >Of all the groups on the Internet, I would >think that this one would be in a special position to say "put your >digital John Hancock on your post if you want to to taken seriously." That is one possibility: people start signing posts with IDs that verifiably mean something over a wider range of net and RL spaces than just a single small world like cypherpunks(a)com.toad. Personas which consist only of postings here might come to be taken less seriously, even if their content appears useful and constructive. I do not see what authoritarian action is needed, desirable, or practical. I would rather see a consensus emerge over how to behave in this new environment. I notice you didn't sign your post. Can I conclude that you do not want it to be taken seriously? -- ____ Richard Kennaway __\_ / School of Information Systems Internet: jrk(a)sys.uea.ac.uk \ X/ University of East Anglia uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K.

1 0

German "NSA" has a Clipper plan too? + News of German conf.
by Stanton McCandlish 17 Dec '03

17 Dec '03

More int'l. news of some interest. **** Begin Forwarded message **** From: Reiner Perivolaris <tutlaibe(a)w250zrz.zrz.TU-Berlin.DE> Message-Id: <9310082023.AA03362(a)w250zrz.zrz.TU-Berlin.DE> Subject: CCC'93 and You ... To: fig(a)well.sf.ca.us Date: Fri, 8 Oct 1993 13:23:34 -0700 Re-To: reiner(a)physik.tu-berlin.de X-Mailer: ELM [version 2.4 PL5] Content-Type: text Content-Length: 1827 The plan of the Clinton administration for the ISDN-Net (?!) will be a part of a workshop or a own theme and the fight for private cryptos (eg. PGP), include the trouble of P. Zimmerman. The 'Clipper/Skipjack'-Chip can/will be a theme, because storys are "on their way", that german BSI (*my* translation:Federal Office for Security of Informationsystems) and the TELEKOM (Telephoncompany) have a plan like the NSA. Where all this and more? At the CCC'93 (10. Chaos Communication Congress 1993). 27. -29. Dec. 1993 Eidelstedter Buergerhaus Alte Elbgaustr. 12 Hamburg-Eidelstedt Germany Organization: Choas Computer Club e.V. Address: CCC e.V. (Orga-CCC'93) Schwenckestr. 85 20255 Hamburg Germany I am one of the guys who organize this workshop and the congress. We are reading 'comp.org.eff.news', 'comp.org.eff.talk' and other information we can get. But only to talk about the EFF *we thing* is not enough. It would be nice, if members of Your organization will be there and have the chance to explain what EFF is doing. And when You get new members *we hope so* it will be good for Your movement and the 'global village'. **** End Forwarded Message **** -- -=> mech(a)eff.org <=- Stanton McCandlish Electronic Frontier Foundation Online Activist & SysOp "A nation that is afraid to let its people judge the truth and falsehood of ideas in an open market is a nation that is afraid of its people." -JFK NitV-DC BBS 202-232-2715, Fido 1:109/? IndraNet 369:111/1, 14.4V32b 16.8ZyX

1 0

Re: Uniqueness and "is-a-person" credentials
by hal＠alumni.cco.caltech.edu 17 Dec '03

17 Dec '03

I remembered about is-a-person credentials after I posted. I had thought this idea came from Chaum but I didn't see it in his 1985 paper. I don't recall the details of this credentialling mechanism, so take what I say here with a grain of salt. I hope someone can post a cite. One point is, there is no need to associate these with states. Private corporations could easily issue is-a-person credentials. You show up and let them take your thumbprint (retina print, DNA scan, ...), and they give you the credential. They don't need to know your name, just that you don't already have a credential. (The different agencies would have to share a database as is done in many industries today.) Then, if L. Detweiler wants to accuse Eric and Jamie of being the same person, they can disprove it by exhibiting their different is-a-person credentials. (They might not "exhibit" them, they might use some kind of zero-knowledge proof to show they are different.) If anonymity and spoofing get to be too bad a problem, most people may refuse to have net.dealings with anyone who is not willing to show an is-a-person credential. Among your pseudonyms, only one can show it, otherwise they will be linked. This would force all but one of your pseudonyms into second-class citizenhood on the net. This may seem unfortunate, but as those who just got through flaming Detweiler remind us, if something like this is possible then just because you don't like it, that won't stop it from happening. It may be that in the future the net is not a very anonymous environment, just because the technology exists to catch spoofers. L. Detweiler may get his wish after all. Hal Finney hfinney(a)shell.portal.com

1 0

Re: on anonymity, identity, reputation, and spoofing
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

I believe it is very valuable to have an anonymous identity that nobody can associate with your actual one. Besides asking embarsassing newbie questions (which I will become more and more famous for), I am learning a lot about what it means to build up an anonymous reputation. I have posted to a few other newsgroups as well, and I am having dialogues with people through e-mail. I feel as though I have a real identity. My actual identity also has reasons for not wanting to appear on this mailing list. I wonder if I am catching some strain of multiple personality disorder... Wonderer ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

jrk@sys.uea.ac.uk (Richard Kennaway)
by smb＠research.att.com 17 Dec '03

17 Dec '03

I have a fairly strong bias these days towards staying out of meta- discussions on mailing lists and newsgroups, and primarily contributing when I have some particular expertise I can bring to bear. I'll break that rule now... There's a persistent tendency on this list to confuse technical feasibility, political feasibility, and ultimate desirability. The whole business about pseudonyms is a good example. Guess what -- the ability to use pseudonyms is not new. Yes, the Net makes it easier, but they're far from rare in the ``real world''. The potential for abuse is obvious -- and that's why the government has tried to make it harder and harder to create truly-functional aliases, to the point of criminalizing many aspects of it. Nor is the concept of an anoymous spending mechanism new. We speak of ``digital cash'' for a reason -- its essential properties are modeled on those of real cash. Of course, when real cash became problematic for the government, they did the obvious -- they promulgated laws and regulations regarding what you can do with it (i.e., the rules on forms to be filled out when leaving the country, the bank rules on large cash transactions, etc.). Are any of these laws 100% effective? Or even substantially effective? Of course not -- but they've accomplished two things. One, they've raised the ante for playing certain games that the government doesn't want played. Two -- and probably more important -- they've provided the government with a new weapon to use against you. Can't convict Al Capone of racketeering? No problem; just charge him with tax evasion. So it is with the net. When email and digital cash become social forces in the larger community, as opposed to our electronic subcommunity, you'll start to see more regulation. It might not even be purely governmental; the large companies that want to run ``the'' net have their own agendas, which concern things like large profits and keeping the government away, and have little to do with privacy. Remember Prodigy? I haven't noticed that it's lacking for customers because of their policies. Or -- envision, if you will, an ukase that the FCC will regulate the Internet, and that anyone who wants to connect will have to agree to an acceptable use policy that includes the requirement that all mail be digitally signed, both by the individual and by the site, and that mailers enforce this requirement. Can't happen? Nor do I think that ``offshore data havens'' will help. Apart from the fact that most major governments are basically in accord on the question of who makes the rules (them, not the people -- or did you see any governments denouncing Clipper? I saw lots of endorsements), there is a potent weapon that can be used: mandatory disconnection from the net for any country that doesn't co-operate enough. (Even the famed Swiss banking system is under a lot of pressure these days on such issues, and they and the Swiss government are co-operating a lot more with other countries. Wanna place any bets on creating a whole new anonymity structure?) For that matter, international bandwidth is a matter for diplomats as well as technicians; permission to create new circuits will simply be withheld. If you doubt me, try placing a call to Cuba, or to the former USSR. After your Nth ``circuits busy'' message, don't bother asking why the long distance carriers haven't installed more trunks, when there's obviously a demand for them. Certainly, there are ways around some restrictions. The inability to call directly between Israel and the Arab countries has bred call- forwarders. But to the extent that these have come to official notice of governments that care to suppress the traffic, they've been shut down. This is force majeure, friends, not bits on a wire. Cryptographic technology is an enabling mechanism for various social changes. It by no means makes them inevitable. Don't delude yourself on that; the political will to do something is more important when various alternatives exist. To allude to fiction again, I've heard people cite Margaret Atwater's ``The Handmaid's Tale'' as an argument against electronic banking and the like. In the book, at the stroke of a pen all women's bank accounts were cancelled. But that's the wrong lesson; the real issue was the governmental decision to take the action. And throughout the centuries, governments have had no trouble stripping hated minority groups of their assets, without any need for computers. If you want a Brave New Digital World, it isn't sufficient to build the tools. You also have to convince people that it's a good idea. Oh, the online world is coming; no doubt about that. But people have to be convinced that privacy and the like is in their interests, that it will solve problems that *they* will have. Equally important, they have to be convinced that it will not create new problems, to their perception (and the perception may have little to do with reality. 500 -- nay, 500,000 -- channels of digital information to the home will do nothing to educate those who prefer to learn about the world from McData Services, or from CBS/NBC/ABC/Fox/AP/UPI. There are myriad sources of information right now that most folks never see, because they don't know of them, don't trust them, or just don't want to bother. Face it, it's easier to let someone else do the editing -- but then you have to trust them. Do you want an example? Here's how to shut down an anonymous remailer. First, find a name for a host that no longer exists. Send a note through the remailer to someone putatively on that host, making it appear like a stolen account (bin(a)foo.bar.edu, or some such). The mail should appear to discuss criminal activity, and be signed with a name from the proper ethnic group. The message will be queued forever, of course, and will likely be stored on the backup tapes for the mail spool directory. Next, send a message through the remailer to president(a)whitehouse.gov, threatening the president. Poof -- the Secret Service *will* come investigating (those guys have no sense of humor). They may or may not believe that the planted note is genuine. But they will approach the appropriate dean to demand that this tool of criminal activity be shut down. Quick -- how many remailers have the support of the university? How many boards of trustees -- at state universities, often linked to the government -- will back them, if the Secret Service ``requests'' that they be shut down. The answer, of course, is to have a defense ready in terms that such people can accept. Show the good remailers can do (i.e., alt.abuse.recovery, though I know of the controversy surrounding it). Show them as a paradigm for privacy. And show that abuses are not tolerated by the community. The recent ``traitor mail'' here is actually a good example. While there have been refreshingly few calls for limiting anonymity, there's also been no tolerance for the ideas expressed. I've gone on too long, and this message has started to ramble. Enough for now. --Steve Bellovin

1 0