December 2003 - cypherpunks-legacy

Mother of All Clipper Systems?
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

The trends are ominous. Outside of this forum and my contacts and sources, I've also been corresponding today with Whit Diffie, Jim Bidzos, John Gilmore, and Eric Hughes. How fast could a system happen? Depends on the nature of the "emergency," how far along the code is (my guess: not in the next several months), and all sorts of legal issues. The upcoming conference, which I just excerpted, suggests that international key escrow is very far along. The National Health Care thing could mandate a national ID card (called something else, of course), and this could happen shortly after enabling legislation passes. Combined with growing waves of illegal immigrants.... Anyway, it may or may not all fit together. But if all does, we could be facing the "mother of all Clippers." (The clipper of all mothers?) Here's a well-written piece on national ID cards. I found it in the cpsr group (see, Jim, we *do* read other newsgroups). I've made a few notes and marks, especially in sections mentioning the uses and timing that could fit with a new crypto initiative, such as SKE. --Tim Newsgroups: comp.org.cpsr.talk From: emery(a)tc.fluke.COM (John Emery) Subject: Re: National ID and "slippery slope" Message-ID: <CtMA76.9Bq(a)tc.fluke.COM> Date: Wed, 27 Jul 1994 20:57:02 GMT ... >From the news reports I've seen lately, it does appear we are heading toward a national ID card for all citizens. For instance, PC WEEK had a front page article on May 9th, a couple months ago entitled, "Postal Service, IRS developing national identity cards; Clinton may give OK": "The Clinton administration is working on creating an identification card that every American will need to interact with any federal government agency. The card initiative came into the forefront at last month's CardTech/SecureTech Conference in Crystal City, Va..." "Sources close to the administration said President Clinton is also considering signing a pair of executive orders that would facilitate ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the connection of individuals' bank accounts and federal records to ^^^^^^^^^^^^^ a government identification card..." "At the conference, postal representative Chuck Chamberlain outlined how an individual's U.S. Card would be automatically connected with the Department of Health and Human Services, the U.S. Treasury, the IRS, the banking system, and a central database of digital signatures ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ for use in authenticating E-mail and other transactions." ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ (Tim: This would fit nicely with an SKE system, don't you think?) "While the U.S. Card is only a proposal, the Postal Service is prepared to put more than 100 million of the cards in citizens' pockets within months of administration approval, which could come at any time." ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ As long as one doesn't interact with the Postal Service (e.g. doesn't use mail), the IRS (doesn't earn taxable income), and doesn't have a bank account then it won't be a "must carry" card. However, this doesn't include very many people in America. Another source says "Digital Media reports that the Clinton administration is laying plans to create an encoded national identity card. Every citizen would be obliged to use the new "U.S. Card" in all dealings with any federal agency and in 'virtually every other legally binding electronic transaction made by U.S. citizens.'" "...To further increase electronic surveillance of citizens, Clinton has reportedly prepared two executive orders that would allow the IRS to monitor personal bank accounts and 'automatically collect taxes based on the results." ("Clinton readies national identity card," _Strategic Investment_, June 22, 1994, p. 2) The Seattle Times reported on July 13, 1994 that "The United States, in a response to its ability to control illegal immigration, may soon ask every American to carry a national identity card..." So the answer is yes, it is intended to be a national ID card. I find it hard to believe that every citizen will not have to carry one of these cards. For all practical purposes, given these proposals implemented, it would be quite inconvenient to leave home without it. This is something that we should all take seriously. -- John Emery emery(a)tc.fluke.COM -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Catch-22
by trollins＠debbie.telos.com 17 Dec '03

17 Dec '03

Well, Since E-mailing a few copys of my 3DEA-PGP.ZIP file and having said file posted on two FTP sites. "ftp.wimsey.bc.ca" and "ripem.msu.edu" It seems that the tax man sees $ in his eyes. I received a nice package with letter from... United States Department of State Bureau of Politico-Militart Affairs Office of Defence Trade Controls So, it came to their attention that I need to pony up $250 in order to "register" with said office. Problem is they want proof of my business in order to register. But, I don't have a business. What is it then. 1 - I have to register because I modify code and handed it out for free. 2 - I Don't have to register because I don't have a business. 3 - I have to register and form a business. Thanks, tom rollins <trollins(a)debbie.telos.com>

3 2

Signature Stripping a Bad Idea
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Reasons why attempts to automatically strip signatures a bad idea: * Breaks the assumpton that remailers are not reaching in and twiddling internals of a message. * Maybe a signature is _desired_ at some point. * Can lead to various problems, especially if implemented badly. We've had this debate before, and the consensus was that treating a remailed block as inviolate is a "win." Certainly anyone can announce this "feature" as a service, sort of a "Dummie's Remailer." Like censor services (that screen your mail), such things are easily imaginable, but should never become the norm, and should never be mandated. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: Catch-22
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>Since E-mailing a few copys of my 3DEA-PGP.ZIP file >and having said file posted on two FTP sites. >"ftp.wimsey.bc.ca" and "ripem.msu.edu" >It seems that the tax man sees $ in his eyes. >I received a nice package with letter from... > United States Department of State > Bureau of Politico-Militart Affairs > Office of Defence Trade Controls >So, it came to their attention that I need to pony up $250 >in order to "register" with said office. Problem is they >want proof of my business in order to register. But, I don't >have a business. What is it then. When bureacracies do silly things, the best recourse is to seek media attention.

1 0

L D WELLER
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, For what it's worth, CompuServe lists L D Weller (71011,1743) as being in American Fork, UT (between Salt Lake City and Provo). S a n d y

1 0

Re: Catch-22
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>You lucky guy. >I'd suggest talking with someone who _has_ had to report to one said >offices in the past and enlist their suggestions, perhaps Grady Ward. Thats what comes from putting your real address and name on stuff you give away.

1 0

Tuna fish and spam sandwich
by cjl 17 Dec '03

17 Dec '03

I am curious about what is happening on alt.test. Someone is apparently forging letters containing the line: I am (insert True Name and address here) from a large list of account names and sending them through anon(a)penet.fi to alt.test. If the address is not previously registered with penet.fi it generates a new acct number (thus the long list of messages with sequential acct nums anXXXXXX) however every once in a while there will be a message (they are all 43 lines long, and have the subject "tuna fish test numero nnn" making them easy to spot from real anon.testers) that will have an account number that is out of sequence (e.g. a much lower number). It would seem that this is revealing the anon acct numbers of people who have already got accts at penet.fi. There are a number of messages posted to alt.test from apparently real acct addresses saying that they never requested anon accts. and generally disavowing all knowledge of how the "tuna fish" messages ended up posted. Does this form of "lunch-sack" attack really work? By spamming penet.fi with "tuna fish" messages with forged From: lines can one really get the true names and corresponding anon acct numbers of people from a list of addresses? If this is possible then I'm sure it wouldn't take long for one of you mail-gurus to whip up some code to download a "who cypherpunks" and feed it through a spam grinder to recover true names. So much for trusting a Finnish Identity Escrow Agent. HH C. J. Leonard ( / "DNA is groovy" \ / - Watson & Crick <cjl(a)welchlink.welch.jhu.edu> / \ <-- major groove ( \ Finger for public key \ ) Strong-arm for secret key / <-- minor groove Thumb-screws for pass-phrase / )

2 1

No SKE in Daytona and other goodies
by an25067＠anon.penet.fi 17 Dec '03

17 Dec '03

1) I've got Daytona running on a machine right next to me. It doesn't feature any type of key escrow. Come to think of it, it doesn't support data encryption. The version I have is build 683, which is supposed to be the next-to-last, so it's unlikely MS will suddenly start adding new stuff, especially since they're already late. The _real_ danger is that SKE will be added to "Microsoft At Work," their proposed protocol for tying copiers, fax machines, and other office gear to computers. 2) Word on the street is that someone already holds a trademark for the term "Tessera" and that they have told NSA to cease and desist. Anyone with access to one of the trademark search services can confirm this, but I haven't yet. 3) Food for thought: we've seen hardware & software key escrow, but I don't remember seeing any mention of DNA or blood escrow, like what Judge Ito has ordered in the Simpson case. Get those samples stashed away now. I wonder if I can get Duncan to supply a DNA sample on my behalf? - that one guy ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

Re: (fwd) Possible compromise of anon.penet.fi
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Roy wrote about the attack on annon.penet.fi: > >I think this might be a forked attack... trying to flood penet with >traffic, and also outing people who have used penet for anonymous >traffic previously. This is a good argument against maintaining a >double-blind database (and in favor of systems like soda.berkeley.edu's >remailer with its 'response block' strategy). > I am not sure I understand the outing part of the attack. If you have a PW set for your anon ID then how can someone else fake your mail? If you use no PW, then you need to wake up anyway. Perhaps outing would be what it takes. -- Lucky Green <shamrock(a)netcom.com> PGP public key by finger

1 0

Just say NYET to kneejerking
by nzook＠math.utexas.edu 17 Dec '03

17 Dec '03

I must admit that I'm disappointed. I figured that I would take some hits, but for people to only scan a post before reaching for the lighter... Highlights of the post: 0- I'm a pro-elctronic privacy religous rightist. (Someone didn't even get THAT right...) 1- We are rapidly approaching a point that there will be a broad-based demand for censorship. If the net is to survive in a recognizable form, we have to head this off. Specifically, BBS sysops have been drug into court on porno or aiding the deliquency of a minor charges. I advance the proposition that we need to establish a system that will allow sysops to be able to brush these attacks off. 2- The censorship that I advance is censorship _by parents_ _for their own children_. Only. People have talked about cable boxxes and telephones. Are you not aware that many cable companies offer boxes with a (physical) key that must be present in order for certain channels to come through? That the phone companies currently allow customers to disallow outgoing 900 calls? My idea is to implement a net-equivalent system--household by household determination of what will be allowed into their homes. 3- In this system, the work to determine which parts of the net to allow/ disallow access to falls entirely on the parents. 4- I believe that this system could be used to gain the protection sysops deserve. Look at the system. Imagine you were trying to sue/prosecute a sysop who utilized such a system. One what basis could you attack? All decisions to allow access were determined by the parent. The sysop genuinely attempts to verify that adults are adults. Let me repeat. This system is an attempt to cut of an almost certain attempt by some to censor the net. If we can get this in place, if we can get legislatures to recognize the system, we should be able to defeat censorship attempts by people who, from the net's point of view, are on the margins of society, but, from the nations point of view, are only slightly "right" of center. For those of you who wish to attack me on this, I must insist that you read my proposal, _in its entirety_. I am re-posting the article in case you deleted it. I want the net to continue to function as is, with further extensions. I want to be able to let my kids (when I have them) on this same net, w/o being asked "What's bestiality?" I am not about to demand that net users modify their behavior to accomdate me. I want a system in place so that sysops aren't forced to constantly overlook their entire system in order to avoid legal hassles. Nathan A nation that fears guns in the hands of its citzens.... should.

4 3