December 2003 - cypherpunks-legacy

No Subject
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Can a registered crypto FTP account at RIPEM.MSU.EDU be accessed via a USA-based FTP-by-mail server, assuming the correct account ID and password are used, and the FTPed file is destined for the original, USA-based email address? Or will the use of the intermediate server cause the request to be rejected because the host ID does not match the original one specified when the account was opened? If so, can PGP 2.6 be FTPed from another anonymous FTP site, either in the USA or abroad? Thanks. ====

3 2

Re: Email security user survey (fwd)
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: Yes, please do give me more info. I am trying to get all of the : responses I can in hand by Friday of this week (June 10, 1994), before : finishing the writing. So speak now, or ... Of course, if you speak later, : that is still interesting, but it won't get into the publication. Thanks : for the broadcast, John. Have you read the article in the UK 'Computer Weekly', May 5? It quotes the Ferris Email Analyzer in an article on p32 which gives every impression that the world of email is entirely running on commercial software and that 'the market' is defined really as 'the commercial market'. The article went on to give recommendations for what software to get to run email and *not one* of the 10 packages cited was freeware. Yet 99% of the people I talk to across the world on email are using free mailer software. So is your article going to give equal time to net.freeware or will it be another marketing puff? (or was the Computer Weekly article not representative of the FEA piece it was based on?) If you are going to cover pgp properly, I'm available for interviews; I work for a company that will be using pgp to protect medical patient records for the UK national health system, and I hacked a version of the standard Unix mailer so that it does pgp transparently. G PS CC'd to cypherpunks where I saw the original request. PPS I've sent in the pro forma answers in a separate mail.

1 0

Re: Sternlight & PGP
by Tom Allard 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- greg(a)ideath.goldenbear.com (Greg Broiles) wrote: > [...] > > Derek's list is incomplete; Sternlight also alleged that there were > "copyright problems" with PGP, insinuating that some of the code in PGP > had been copied (or derived from) RSAREF code - he backed down pretty > quickly when asked for substantiation. He also wrote to the administrators > of US-based FTP sites, suggesting that PKP/RSADSI was contemplating legal > action against them if they didn't stop making PGP available via FTP. I > suspect (but cannot prove) that he was also the person who reported those > FTP sites to Bidzos, thus creating the lawsuit threat that he then pretended > to protect the FTP sites from. > > He also recently wrote to Netcom administrators, encouraging them to take > action against a user who included a public key marked 2.3a in his > .plan file. Re: copyrights, I have yet to hear Herr Sternlight say that pgp23a does not have copyright problems. He may not be asserting that as much, but he has yet to recant. It all started in a discussion about NAFTA, GATT and patents. Someone posted a passage from GATT about expansion of copyrights (NOT patents). He then used that post to assert that pgp23a infringes in Europe. When it was pointed out that the discussion had been about patents, he asserted that pgp23a also violated copyrights (I think he was just too embarrassed to admit confusing patents and copyrights). When I last asked him directly about why he thought pgp23a violated, he used the fact that the pgp doc's referred to itself as "contraband" as evidence. Re: SternCop, he wrote to support(a)netcom.com complaining that he had found a pgp23a key in beker(a)netcom.com's .plan file. Netcom told him that he should take the matter up with PKP/RSADSI. Beker posted Sternlight's message here and I forwarded it to alt.security.pgp. This really bugged Sternlight and he then wrote ANOTHER letter to support(a)netcom.com asserting that beker had violated his copyright. He also sent me a similair message and told me that he knew the Chairman of the Federal Reserve Board and that I had better publicly apologize to him. He warned me that his complaints about me would not go to postmaster but rather to his own contacts. Why he thought economists would care about usenet is beyond me. Anyway... support(a)netcom.com told him they didn't think beker violated his copyright and if he wanted to pursue the matter further he should sue beker. I have yet to hear about his complaints about me. If he did complain to anyone about me, they must've completely blown him off. Anyway, my all-time favorite Sternlight quote follows: > Newsgroups: sci.crypt > From: strnlght(a)netcom.com (David Sternlight) > Message-ID: <strnlghtCpH991.8GK(a)netcom.com> > Reply-To: david(a)sternlight.com (David Sternlight) > Organization: DSI/USCRPAC > Date: Sun, 8 May 94 05:34:13 EDT > [...] Something did snap, and it did so > with the death of Richard Nixon. On thinking of his achievements, and the > way he was savagely hounded by the left all his life (not without cause, but > not deserving of the extreme demonizing he got), I decided it was time to > stop pussy-footing around here, and start calling jerks, cowards, hoodlums, > and defamers for what they were. [...] rgds-- TA (tallard(a)frb.gov) I don't speak for the Federal Reserve Board, they don't speak for me. pgp fingerprint: 10 49 F5 24 F1 D9 A7 D6 DE 14 25 C8 C0 E2 57 9D -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLfORNKAudFplx0TNAQHVeAP5AXttXRYS9gyp5xoCIRA9q91Bl6+XhKYk nCcFxFBeSsOzde6pOXpAD5Gnyl1H3p7Dnw6vveYBtjYY06x3iG5S8ZRodkbwPIG/ PbCE+y2K155ORm+jV/Yz6ZmTtKMeS/oXWiOrvtSbabTYqH2HM3Wzp7PbNMlQ0h1b j9PRTDDmtG4= =Z20z -----END PGP SIGNATURE-----

1 0

Re: Cyberspace is by nature crime-free
by jamesd＠netcom.com 17 Dec '03

17 Dec '03

Matthew Gream writes > I have to disagree with this, especially the title 'is by > nature'. Cyberspace as a communications forum still > presents many opportunities for crime as are present in > physical and related communications media. To rattle a few > off the top of my head without thinking to broadly: > > - break and enter --> cracking/hacking (whatever you want > to call it) Can be limited to acceptable levels by normal precautions. The owner ultimately has physical control, the cracker does not. > - vilification, discrimination Not a crime. > - sedition Not a crime. > - inciting violence Not a crime. > - fraud (as you've mentioned) There is plenty of fraud, but it can be controlled by common sense and cryptographic precautions. (Gasp - this post is actually slightly relevant to the Cyberpunks list.) > - transfering funds, tax evasion Not a crime. Neither of these are extraditable offenses. > - illegal business activity, false advertising Not a crime, except for fraud, discussed above. > - contempt of court There is plenty of contempt of court. Courts are coming to accept the reality that cyberspace is beyond their power, hence not a crime. Note that contempt of court has never been an extraditable offense. > - copyright infringment There is plenty of copyright infringement, but the old concept of copyright does not fit well on the net, because information is separated from its physical embodiment and is endlessly mutable. The concept of "copyright" has limited usefulness in cyberspace. We are returning to the older concepts of "plagiarism" and "authenticity". Notice how many people were reluctant to accept PGP 2.6 until it was blessed by Zimmerman. > Admittedly by the nature of cyberspace, detecting and > gaining evidence for these crimes can be more complicated > than in a tangible physical medium, but none the less these > actions are still criminal. If a law cannot be enforced, or cannot be enforced except by grossly violating someone's rights, then it is no law. But cyberspace does make new offenses possible. The two new offenses of cyberspace are spamming and spoofing. Both of these seem to be controlled at acceptable levels. Spamming is controlled by vengeance campaigns of the silicon cowboys and the cyber vigilantes. The green card lawyers were run off the net. The Armenian genocide guy is almost within net custom, he pushes the edge but does not obviously exceed it. Serious spoofing seems rare. In every spoofing that I have seen the spoofer has made his true identity fairly obvious, which is why we call it spoofing, not impersonation. If anyone is in real danger of malicious spoofing - for example David Sternlight - then he should PGP sign all his messages, thus eliminating the problem. -- --------------------------------------------------------------------- We have the right to defend ourselves and our | property, because of the kind of animals that we | James A. Donald are. True law derives from this right, not from | the arbitrary power of the omnipotent state. | jamesd(a)netcom.com

3 4

Clipper alternatives debated
by thad＠pdi.com 17 Dec '03

17 Dec '03

This was in the Mercury News business section yesterday, June 7 1994. It looks to me like a bunch of beltway sharks circling a big pile of money that will soon be available again... Reprinted without permission. Clipper substitutes suggested * Computer and telephone industries offer alternatives to controversial encoding system. By Robert S. Boyd WASHINGTON - The Clinton administration and the computer and telephone industries are discussing ways to resolve their conflicts over the government's plan to enable it to eavesdrop on coded communication. Industry representatives hope the discussions will produce a substitute for the controversial Clipper chip, an electronic encoding and decoding system that the government is pushing over opposition from the computing community and privacy advocates. Several alternatives were suggested Monday at a conference on cryptography and privacy attended by government and industry officials. At the conference, Lynn McNulty, associate director for computer security at the National Institute of Standards and Technology, said the administration is "willing to discuss alternatives to Clipper." McNulty said the Commerce Department is asking industry to join in cooperative research projects to develop cryptographic methods, both hardware and software, that would satisfy law enforcement agencies and also be acceptable to private business. One industry proposal woud provide computer software to law enforcement officials that would allow them to decode encrypted messages by suspected criminals or terrorists. The software would replace the Clipper Chip, a hardware device costing about $1,000 that can be placed in telephones to scramble conversations electronically. "Software is much cheaper than hardware," said Steve Lipner of Trusted Information Systems, the Glenwood Md. firm that set up the White House computer security system. Low-cost cryptographic software could be embedded in widely used computer applications, such as word processors or data bases, Lipner said. "This would be a market-acceptable way to build cryptography into high-volume products." Another proposal discussed at Monday's conference would let private companies, instead of the government, keep the electronic "keys" required to decode encrypted data and conversations. Police or the FBI could get the key by court order, such as is now required for wiretaps, according to Jon Roberts, president of TECSEC Inc., a security consulting form in Vienna, Va. "The government could subpoena the key from the bank that holds Mafia records or from the fraudulent government contractor," Roberts said. Under the Clipper chip system favored by the Clinton administration, the key would be held "in escrow" by the government, but, to minimize the risk of abuse, it would be split in half. One have would be held by the Treasury Department, the other half by the Commerce Department. A court order would be needed to get both halves to decode a message. Privacy experts protest that splitting the key between two departments of the executive branch offers little protection against a rogue administration. A third proposal discussed Monday, therefore, was to give one half of the electronic key to the legislative or judicial branch of government. The Department of Justice has already ordered 9,000 Clipper chips for distribution to federal, state, and local law enforcement agencies. McNulty said no decision has yet been made to use the chip in other departments. A gloomy note was struck by Susan Landau, a staff member of a special government-industry committee on cryptography that was created to give Congress recommendations on how to balance the government's needs with those of business. After months of study, the committee, organized by the ACM, a major industry trade group, was unable to agree on what should be done. The committee will publish a report in July that simply identifies unresolved issues for continued debate. They include the cost of cryptographic security, the needs of law enforcement, national security, international trade, privacy and civil liberties, Landau said. Thad Beier Pacific Data Images 408)745-6755 thad(a)pdi.com

1 0

Remail: It's impossible to make anything foolproof, because fools are so ingenious
by ghio＠cmu.edu 17 Dec '03

17 Dec '03

I've had a lot of people make mistakes when using my remailer. Maybe this is common to happen to most people who run remailers, but the large number of mistakes surprised me. To eliminate the clutter in my inbox, I modified my remailer to check the first line of the message for an Anon-To: or Request-Remailing-To: header, in case the person forgot the double colon. If the first line is blank, it checks the second. This seems to have taken care of most of the problems. But somehow, someone figured out how to defeat my efforts and mess up anyway: They began with the header Encrypted: PGP and then followed it with an unencrypted message...

1 0

Re: The Crypto Home Shopping Network
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

I think RC4 is the 32 bit cypher used in cellular phones throughout Europe. Rumour has it it can be cracked in realtime. The actual cypher is secret though, which makes it *very* interesting that it'll be available in a software product. The phones use custom chips... G

5 6

Re: Crime and punishment in cyberspace - 3 of 3
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>If we accept the need for wiretapping, than the only problem is to find a way >to make Clipper/DTII as protective of privacy as current analog-tapping laws; >as inconvenient as current analog tapping. If we accept the need for >wiretapping, we can find such ways. Variants of Micali's fair crypto; an open, >publicly available no-trapdoor algorithm; a requirement that, as with primitive >exchanges, DTII'd ones would still have to be visited by LEOs to work a tap, >etc. We can then respond to the various (non-serious) calls from Freeh, Denning >et al for an 'alternative'. The problem is that the Genie of strong cryptography is out of the bag. A large part of the internet community is capable of implementing strong crypto. Given a publicly available no-trapdoor algorithm, requiring the 'source' be visited, denies wiretap capabilities. The LEO follows the flow of information further and further upstream/down stream, noting that encryption is used. Eventually one follows the communications media directly to someones office/residence/car/pocket (which implies bugs instead of wiretaps). On the pro-wiretap side this is unacceptable. On the anti-wiretap side, what we see is the result of haggling over the price, provisions for wire and control records, which provide for fishing expeditions in the event the traffic is not particularly enlightening. As a corallary, allowing wiretapping but making them extremely expensive and dangerous to use could be explored - again haggling over the price. One can imagine making the LEO requesting a tap personally at risk for draconian retribution in terms both civil and criminal. It is unclear whether the antis should be prepared to negotiate at all. There is historical precedence by the U.S. supreme court to suggest that the right to privacy is absolute. The problem is that contrary to the Radio Act of 1934 and various other statutes covering public utility provided communications, the right to privacy is not being respected for electronic forms of expression. Before negotiating to give anything away, this issue should be satisfied. Hence the direction of a lot of groups like EFF, etc. The arguments go that no one has an expectation of privacy on unprotected media. The answer to that is to use strong crypto. The second level argument is that this denies the 'traditional' monitoring for law enforcement purposes of communications that had no expectation of privacy. Well I expect privacy with strong encryption. Tough teat. But then criminals will have privacy! (It may be their constitutional right.) I'm not particularly shocked to hear that someone may commit a crime in private. There should be compelling proof to show the needs of society overide the rights of the individual (in a republic). The arguments put forth by the pro-wiretap sides are inadequate to that determination, relying instead of emotional appeals and other propaganda.

1 0

Crime and punishment in cyberspace - 1 of 3
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Uhh. When I started this thread with "Cyberspace is by nature crime-free," I meant crime as what at least _I_ perceive as morally wrong enough to justify the intervention of society as a whole, usually represented by functionaries of the state - police, judiciary, etc.; and NOT what may or not be wrong in the eyes of existing law, which as we all know, is an ass. Unless we want a totally "everyone for him/herself" society (which is contradictory - society is a framework or protocol by which individuals interact with each other), and become like Rwanda, say, we need the intervention of [police/state/society/collective] to ensure that basic social agreements are kept - thou shalt not rape, for instance. Even anarchist Tim May has in previous posts conceded the possible need for a police force to investigate murders. Now to cyberspace... I greatly believe in the Internet as a model for society. While there are incompatibilities between a society on cyberspace and one on the streets, what is needed is an adaption of cybersociety to the "real world" NOT vice versa. Out of all 'crimes' listed in previous posts by Matthew Gream and others, the only one I accept as possibly requiring society intervention in the information age is that of intellectual property. The extent of such intervention is debatable. I will summarize my attitude to the other points with this: saying that cracking an ordinary Unix system is fraud is like saying that walking into a field protected perhaps by a tattered hedge is 'breaking in.' Unless you want a nanny state, you have to protect yourself, and your rights. Unless you want a jungle, you have to accept intervention by agents of the society you live in, when protection is far to difficult for an individual. You expect police help to catch a murderer. You don't expect police help to catch someone who stole money that fell out of your torn pocket. (_I_ don't.) Continued... ----------------------------------------------------------------------------- Rishab Aiyer Ghosh They came for the Jews, and I was silent because I was not a Jew; rishab(a)dxm.ernet.in They came for the Trade Unionists, and I did not protest, because I did not Voice/Fax/Data +91 11 6853410 belong to a trade union; Voicemail +91 11 3760335 They came for the Catholics, and I said nothing because I was not a Catholic; H 34C Saket And then they came for me. New Delhi There was no one left to say anything... INDIA ----Father Niemoeller

4 3

No Subject
by Anonymous 17 Dec '03

17 Dec '03

> From: Anthony Garcia <agarcia(a)sugar.neosoft.com> > P.S. Larry, if you're still lurking around here: the "Yay Sedition!" and > "Yay Tax Evasion!" are especially for *yoooouuu*. funny think about garcia, his first time ever post on c'punx was about larry too...... strange times indeed when a newbie bursts on the scene knowing all about us Date: Wed, 19 Jan 1994 23:18:22 -0600 From: Anthony Garcia <agarcia(a)sugar.neosoft.com> Message-Id: <199401200518.AA05127(a)sugar.NeoSoft.COM> Cc: agarcia(a)sugar.neosoft.com Subject: Detweiler's SQUISH broadcast: can remailers filter out addressee? I'm not familiar with anonymous remailer internals. Would it be cheap in terms of hack-time to add the capability for an anonymous remailer to maintain a list of addresses (or address regexp's) which do not wish to receive anonymous remailed messages? That way, if Detweiler is sending unwanted msgs to say, "chess-fans(a)foo.bar.com" via an anonymous remailer, and the readers of chess-fans complained to the (hopefully responsive) remailer operator, the remailer operator could add the "chess-fans" address to a "don't- remail-to-these-folks" list so that the nice readers of chess-fans can read mail in peace. However, if the "Don't-mail-to-these-folks" list gets too long, it would probably degrade remailer performance... sigh. (remailer authors: is this a correct assumption?) (Perhaps the "don't-mail" addresses could be tagged with amount of time somebody last attempted them; addresses that no one's attempted to hit in say, a year, could be expired.) -Anthony Garcia agarcia(a)sugar.neosoft.com NeoSoft is a commercial access provider, not my employer. (They didn't demand identity verification when I signed up, either. Yay, capitalism!) P.S. Larry: I didn't make the "tentacle" list in your SQUISH post? I feel slighted! Please correct in the next version.

5 4