December 2003 - cypherpunks-legacy

EPIC Alert 2.02
by Dave_Banisar.OFFICE＠epic.org 17 Dec '03

17 Dec '03

============================================================= @@@@ @@@@ @@@ @@@@ @ @ @@@@ @@@@ @@@@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @@@ @ @ @@@@@ @ @@@ @@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @ @@@ @@@@ @ @ @@@@ @@@@ @ @ @ ============================================================== Volume 2.02 February 6, 1995 -------------------------------------------------------------- Published by the Electronic Privacy Information Center (EPIC) Washington, DC info(a)epic.org ======================================================================= Table of Contents ======================================================================= [1] IRS Backs Off Compliance 2000 Program [2] New Secrecy Order Needs Work [3] Caller ID Blocking Fails in New York [4] Post Office Partially Limits Access to Addresses [5] Clinton Announces National ID Registry [6] Correction: EU Directive Still Under Consideration [7] Overview of New Congressional Privacy Legislation [8] Upcoming Conferences and Events ======================================================================= [1] IRS Backing Off of Compliance 2000 Program ======================================================================= The Internal Revenue Service announced on Friday, January 20, that it was delaying implemention of the controversial Compliance 2000 program after heated opposition to the proposal from the Electronic Privacy Information Center (EPIC) and other privacy advocates appeared in over two dozen newspapers across the country. The proposal also drew sharp criticism from Senator David Prior. The plan called for IRS collection and use of personal information from commercial databases. This data would not be subject to the requirements of the Privacy Act. IRS officials told the EPIC Alert that the Compliance 2000 notice published in the Federal Register was going to be revised in the next few weeks and then reissued. IRS Privacy Advocate Robert Veeder said that the notice had been drafted more than a year ago and that the program had been revised substantially since then. EPIC has filed a Freedom of Information Act request with the IRS, asking for more information about the types of data that would be collected if Compliance 200 goes forward, the sources of the information and the proposed uses. ======================================================================= [2] Draft Secrecy Order Still Needs Work ======================================================================= The White House recently circulated the latest draft of the President's long-awaited revised Executive Order on the classification of national security information. The current version back-pedals on favorable proposed reforms of the classification system, retreating from an earlier proposal that prohibited secrecy when the "public interest in keeping the information unclassified outweighs the need for classification." Such a standard would permit the public and the news media to challenge classification decisions in court. The draft also fails to go far enough in opening the government's civilian cryptographic activities to public scrutiny. Efforts to revise the current Executive Order (issued by President Reagan in 1982) began almost two years ago, soon after the Clinton Administration assumed office. Several drafts have circulated since then, and the issuance of a final revision was anticipated more than a year ago. The Center for National Security Studies, the Federation of American Scientists, the National Security Archive, and EPIC have all urged the relaxation of classification authority. EPIC has specifically recommended that classification be removed for cryptographic information. In comments submitted to the Information Security Oversight Office in July 1993, EPIC staff urged removal of "cryptology" from the categories of information presumed to be classifiable. The statement said that the "designation of a routine privacy-enhancing technology as presumptively a national security matter is inconsistent with the end of the Cold War and the dramatic growth of commercial and civilian telecommunications networks. ... [Cryptographic] technology today plays an essential role in assuring the security and privacy of a wide range of communications affecting finance, education, research, and personal correspondence." The recent Clinton proposal does indeed narrow the government's classification authority for "cryptology", although the final order should go further. Under the original Reagan Order, "cryptology" was singled out as a separate and independent category. The recent draft drops cryptology as an independent category and instead refers generally to "intelligence activities (including special operations), intelligence sources or methods, or cryptology." This formulation suggests a recognition that information concerning encryption technology should only be classified if it relates to intelligence uses of the technology, as opposed to the increasing use of encryption in civilian applications. The language, however, leaves open the possibility that the government might still attempt to classify information relating to cryptography. This position does not comport with the overwhelming opinion outside of government that cryptography should never be presumptively classified. The classification of cryptographic information has already hampered the public's ability to monitor the government's activities in the area of civilian communications security. Information relating to the Digital Signature Standard (intended for the authentication of unclassified electronic transmissions) has been withheld from disclosure under the Reagan Executive Order. Likewise, key information concerning the Clipper encryption initiative (including the underlying Skipjack algorithm) has been classified and placed beyond public review. Congress sought to prevent such secrecy when it enacted the Computer Security Act of 1987, which limited the civilian role of the National Security Agency (NSA). Congress noted that NSA's "natural tendency to restrict and even deny access to information that it deems important would disqualify that agency from being put in charge of the protection of non-national security information." The Clinton Administration, through further revision of its draft Executive Order, has an opportunity to build upon the openness and accountability that Congress envisioned. ======================================================================= [3] Caller ID Blocking Fails in New York ======================================================================= NYNEX has admitted that the personal phone numbers of at least 30,000 of its customers who requested per-line blocking of Caller ID have been improperly disclosed. The problem resulted from a failure to correctly implement the blocking feature. The New York Times reports that NYNEX had known of the problem for at least a year before any action was taken. The Rhode Island Public Utilities Commission has ordered NYNEX not to allow customers in that state to order new Caller ID services or per line blocking until the problem is resolved. NYNEX must also run ads telling customers about the problem and provide an 800 number for consumers to call. EPIC has received several calls from individuals in New York who have had their phone numbers disclosed. The individuals work in sensitive jobs and have already received threatening phone calls as a result of the disclosures. ======================================================================= [4] Post Office Partially Limits Access to Addresses ======================================================================= The U.S. Postal Service announced on December 28 its final rule on access to names and addresses. The agency announced it was eliminating the service that allows anyone to obtain the new address of any individual for a $3.00 fee. The Postal Service, however, left intact its service that provides the addresses of all postal customers to large mailers such as direct marketers. The notice states "Congress has not given the Postal Service the function of serving as a national registration point for the physical whereabouts of individuals." HR 434, The Postal Privacy Act of 1995, (introduced by Rep. Gary Condit) requires that the Postal Service inform individuals of the uses of information contained in Change of Address cards and mandates that customers be offered an option to not have their names and addresses forwarded. ======================================================================= [5] Clinton Announces National ID Worker Registry ======================================================================= In the annual State of the Union address on January 25, President Clinton announced his support for the creation of a national registry of all citizens and resident aliens to enforce immigration laws. The idea was recommended the U.S. Commission on Immigration Reform, headed by former Rep. Barbara Jordan. The proposal would create a national database of all employees based on Social Security Numbers that every employer would be required to check before hiring. Civil liberties groups believe that this database, once in place, would then be used for other purposes, such as law enforcement, and would eventually lead to the development of a national ID card. The Commission has previously considered requiring the creation of an ID card but backed off in the face of public opposition. Senator Alan Simpson (R-WY) has introduced a bill (S. 269) to implement the registry. Sen. Barbara Boxer (D-CA) told USA Today that Congress was planning to address the issue and that the system is the only way to provide accurate citizenship information and protect privacy. ======================================================================= [6] Overview of New Congressional Privacy Legislation Available ======================================================================= EPIC has produced an overview of current privacy legislation in the 104th Congress. Bills that improve privacy protections or negatively affect privacy are summarized. The summary will be updated regularly as new legislation is introduced or pending bills are revised. A summary will appear in the next issue of the EPIC Alert. Copies of the new bills are available for retrieval from the EPIC Archive at cpsr.org. Also included are floor statements on the legislation when available and updates on the status of the bills. To obtain the overview and copies of the house and Senate bills, ftp/gopher/wais to cpsr.org /cpsr/privacy/epic/104th_congress_bills/ ======================================================================= [7] Upcoming Privacy Related Conferences and Events ======================================================================= AAAS Annual Meeting & Science Innovation Expo. Atlanta. Feb 16-21. A special full-day session on cryptography and privacy will take place on Tuesday, Feb. 21. Contact: Alex Fowler 202/326-7016 or afowler(a)aaas.org Cryptography: Technology, Law and Economics. New York City. Mar. 3, 1995. Sponsored by CITI, Columbia University. Contact: citi(a)research.gsb.columbia.edu Towards an Electronic Patient Record '95. Orlando, FL. Mar. 14-19, 1995. Sponsored by Medical Records Institute. Contact: 617-964-3926 (fax). Access, Privacy, and Commercialism: When States Gather Personal Information. College of William and Mary, Williamsburg, VA, March 17. Contact: Trotter Hardy 804 221-3826. Computers, Freedom and Privacy '95. Palo Alto, Ca. Mar. 28-31, 1995. Sponsored by ACM. Contact: cfp95(a)forsythe.stanford.edu. ETHICOMP95: An international conference on the ethical issues of using Information Technology. DeMontfort University, Leicester, ENGLAND, March 28-30, 1995. Contact: Simon Rogerson srog(a)dmu.ac.uk 44 533 577475 (phone) 44 533 541891 (Fax). "Quality of Life in the Electronic Village," March 30, 1995. Live teleconference, broadcast nationally from Virginia Tech, featuring eminent presenters from the fields of ethics, law, education, anthropology, medicine, and government. Contact 703/231-6476 or choices(a)vt.edu. National Net '95: Reaching Everyone. Washington, DC. Apr. 5-7, 1995. Sponsored by EDUCOM. Contact: net95(a)educom.edu or call 202/872-4200. Information Security and Privacy in the Public Sector. Herndon, VA. Apr. 19-20, 1995. Sponsored by AIC Conferences. Contact: 212/952-1899. 1995 IEEE Symposium on Security and Privacy. Oakland, CA, May 8-10. Contact: sp95(a)itd.nrl.navy.mil. INET '95. Honolulu, HI. June 28-30, 1995. Sponsored by the Internet Society. Contact inet95(a)isoc.org. Key Players in the Introduction of Information Technology: Their Social Responsibility and Professional Training. July 5-6-7, 1995. Namur, Belgium. Sponsored by CREIS. Contact: nolod(a)ccr.jussieu.fr. Advanced Surveillance Technologies. Sept. 4-5, 1995. Copenhagen, Denmark. Sponsored by Privacy International and EPIC. Contact pi(a)epic.org. (Send calendar submissions to Alert(a)epic.org) ======================================================================= The EPIC Alert is a free biweekly publication of the Electronic Privacy Information Center. To subscribe, send the message: SUBSCRIBE CPSR-ANNOUNCE Firstname Lastname to listserv(a)cpsr.org. You may also receive the Alert by reading the USENET newsgroup comp.org.cpsr.announce. Back issues are available via FTP/WAIS/Gopher/HTTP from cpsr.org /cpsr/alert and on Compuserve (Go NCSA), Library 2 (EPIC/Ethics). An HTML version of the current issue is available from epic.digicash.com/epic ======================================================================= The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues relating to the National Information Infrastructure, such as the Clipper Chip, the Digital Telephony proposal, medical record privacy, and the sale of consumer data. EPIC is sponsored by the Fund for Constitutional Government and Computer Professionals for Social Responsibility. EPIC publishes the EPIC Alert and EPIC Reports, pursues Freedom of Information Act litigation, and conducts policy research on emerging privacy issues. For more information, email info(a)epic.org, WWW at HTTP://epic.digicash.com /epic or write EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington, DC 20003. (202) 544-9240 (tel), (202) 547-5482 (fax). The Fund for Constitutional Government is a non-profit organization established in 1974 to protect civil liberties and constitutional rights. Computer Professionals for Social Responsibility is a national membership organization of people concerned about the impact of technology on society. For information contact: cpsr-info(a)cpsr.org If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "The Fund for Constitutional Government" and sent to EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington DC 20003. Your contributions will help support Freedom of Information Act litigation, strong and effective advocacy for the right of privacy and efforts to oppose Clipper and Digital Telephony wiretapping proposals. ------------------------ END EPIC Alert 2.02 ------------------------ _________________________________________________________________________ Subject: EPIC Alert 2.02 _________________________________________________________________________ David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * ftp/gopher/wais cpsr.org Washington, DC 20003 * HTTP://epic.digicash.com/epic

1 0

NYC CPUNKS MEET
by mjwohler＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Attn.: New York City area Cypherpunks NYC C'punks meeting: Sat Feb 11, 3:00 P.M., at the home of Linn & Barbara Stanton 315 West 106 Street Apt 2A (Between West End Ave & Riverside Drive) 212-316-1958. Once again the gracious Stanton's invite local area Cpunks to their lovely home which is smoke free and feline friendly. The agenda is still open and suggestions can be made to mjwohler(a)netcom.com or phone Marc Wohler @ 212-362-0690. Let me know if you plan to attend. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLy+PL2eikzgqLB7pAQGHigP9HW1Py30O2fcZH/f1SAOToOBZYVZMiB9c buGQrujaicGVJlvGb1Le/OjJ872JB69BQD1MMsemABSYi4swL15w9qj1rhoTAHIg yTRDFJD16g1lqqLvEJZ0RijOh1dXLaUg8HNue0JoSAbARkQed8I3+mklP4C4saYn qW2Fa/kDuZY= =Rl9C -----END PGP SIGNATURE----- -- Marc J. Wohler mjwohler(a)netcom.com ***Preserve, Protect and Defend the private use of Strong Crypto*** * * * PGP for the masses * * *

1 0

RE: a new way to do anonymity
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >This is what I wrote: >> Imagine a server that allows you to open a >> low bandwidth (let's say around 100 cps, in order to reduce costs) >> link-encrypted telnet session with it, and provides you with a number >> of services, for example a link-encrypted talk session with another >> user. You'll need to maintain the link 24 hours a day to defend >> against statistical analysis, and of course you can chain a number of >> these servers together in a way similiar to chaining remailers. There are many, many analogies you can draw about a network of this type to an ATM (asynchronous transfer mode) network. By simplifying just slightly from what you describe to only include an encrypted, switched-pipe methodology, you now have a "cloud" type network with service entry points that are defined by a pair of byte streams (one in each direction). The switched path could be set up and torn down dynamically by the user by interacting with the "switch" at each point to select the next hop the encrypted byte stream will follow. Of course, just like in remailer chaining, the data that indicates which hop to follow is encrypted with the data in a form only the switch can decrypt. Alternatively, once a path is set up between switches, it can be assigned a virtual path identifier that has only local significance at each hop, with the switch performing a lookup to forward packets and substituting a new path number with significance at the next hop. The above description is pretty unclear, I think, but many of these concepts have been fleshed out to a significant amount of detail in ATM circles. Fixed length data packets (at the encrypted telnet level) also make it very easy to aggregate individual circuits into higher bandwidth pipes that connect server to server. With these continuously running with cover traffic, individual circuit establishment is much more immune from traffic analysis. Cover traffic is substituted with real traffic as necessary, up to the bandwidth of the pipe. To summarize, what has been described is a method to establish a "network within a network", using encrypted telnet, to provide a connection oriented, unreliable packet switched link layer protocol. Sounds remarkably similar to IP (except for the connection oriented portion of it.) What can you do with a network like this? By layering a TCP process on top of this "Pipe-Net" IP like service, any of the standard TCP based application protocols can function between two end point systems, such as SMTP, FTP, HTTP, etc. What is so neat about this is that it could probably be done in user space, and since the packet based protocol is defined as unreliable, switches could come and go, with some sort of switch-to-switch protocol that propagates route availability. Eric, you could probably chew on the trust implications of all this. Perry, I'm sure all the IPSP/SSL/SOCKS/whatever stuff you know so well could provide a lot of building blocks for this type of thing. Wei, your traffic analysis treatment of this sort of thing would go a long way toward uncovering weaknesses and determining operational requirements and limitations. Tim, what massive social effects would it have if this type of network service were to become widely deployed? :) At first glance, this Pipe-Net idea doesn't seem to take a lot of rocket science; it seems that most of the components or algorithms are are already in use, just in a very different way. I can think of a number of problems already, however. Spamming. Bandwidth limitations. Complexity of client and switch software. Standards. Flow control. In other works, all the stuff the ATM forum is already dealing with :) Come to think of it, has anyone thought of something like this before? == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)aeinet.com -Isaac Asimov WWW: ftp://ftp.netcom.com/pub/jc/jcorgan/home.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLzg6ME1Diok8GKihAQEBygP/do7MnM2Ha/b3nYNeVb/7mpJqAwgke3D6 VlyhtVjxTM2tn42Voz47BtwTMiR+zkiwI5Ha3EQs/fpJGY7x69YGY+arGXAn/VsI Xq7/onQd/LOv8JAjrxrgH2gLTCmfs57+sLJXqghHmSrxgothsK8XRLY1HDoYDfai EgiNUmMTXEM= =ENYC -----END PGP SIGNATURE-----

2 1

Seals and Sealing Waxes
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Perry says: >root says: >> This is the same problem that arose with the original idea of seals once >> the skills of metalworking became commen enough. By the 1500's it was >> nearly impossible to keep a seal confidential more than a few weeks until >> somebody got a impression and built a copy. > >Seals were duplicatable from the start. You just needed clay and a >seal made with the oritinal if you wanted to forge them -- fairly >common stuff. Signatures have been duplicatable from the start, too. "All crypto is economics," and this is what made seals and sealing wax so useful for so long. Saying "seals were duplicatable from the start" does not mean this feat was easy, even if technically possible. In fact, the fine details produced by a good seal are hard to exactly emulate with a copy. Even on a two-dimensional surface. And with the advent of three-dimensional surfaces, which sealing wax made possible, the fine detail of a good seal was in fact very hard to forge. Not impossible, but very costly with the technology of the day. Or even the technology of _today_. After all, paper currency is largely based on seal technology, with various embossing, printing, etc. methods used (on special paper) that remain fairly hard to duplicate. (Not impossible, and counterfeiting flourishes. It's all about economics, and I'm only disputing the claims of easiness. As an added note, transactions in the Far East are still often "sealed" with "chop marks," carved stamps that are uniquely associated with persons or groups.) >Signatures and seals are NOT truly authenticating technologies. They >are just a legal mechanism for an entity to demonstrate that it has >read and agreed to the terms on a document. It was always assumed that >someone might forge a signature, which is why if you had a document >where you cared that people might disclaim their signature, you got >people who could testify to the signature to witness the signing. I think this understates the importance of signatures and seals in these earlier times. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

RE: Effects of S.314 (Communications Decency Act)
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >I just had an interesting conversation with a person who works for an ISP. >Basically their response if S.314 becomes law will be to preprocess all >incoming mail. If it is uuencoded or encrypted, into the bit bucket it will >go. They are still thinking about what to do with telnet and ftp. Sounds like a good application for text stego... >This is starting to get very scary. Indeed. == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)aeinet.com -Isaac Asimov WWW: ftp://ftp.netcom.com/pub/jc/jcorgan/home.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLzgbVU1Diok8GKihAQEfJgQAiDd5ha7WCURlwepHgV8qjBYjoT1MxLsF 219ymsRNe/U0bJwSTgt/sBqNjZIS3aQjEQIu+VE3CivvNcVYz0wuZ5KYVf5IADpF 4qtba3bZwENJNjOm9Y/w2m2mWAkEK0I77IPPFdCts0xg6sWWMOVOv4ry2eOQ59uQ WvTIH1omb58= =srzZ -----END PGP SIGNATURE-----

1 0

Zimmermann
by Philip L. Dubois 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Many of you know that members of Philip Zimmermanns defense team traveled recently to San Jose to meet with the Assistant U.S. Attorney (AUSA) assigned to the Zimmermann investigation. This was done for the purpose of persuading the AUSA not to indict. In the hope of avoiding speculation and misinformation, I write now to report that the meeting was cordial, that the AUSA listened carefully and agreed to consider our arguments, and that we dont know when a decision will be made. The defense effort continues and remains in need of financial support. Before the trip to San Jose, one generous person donated a plane ticket from his own frequent-flyer miles. This contribution was timely and much appreciated and shows a way for people to contribute without digging into their pocketbooks. More travel will be necessary during the next month or two, and if there is an indictment, a great deal of travel will be necessary. Any new contributions, including plane tickets, will be received with gratitude. It may seem odd, given the nature of the case, that the defense effort does not have its own Web page, ftp site, or other electronically-accessible source of information. Keep in mind that youre dealing with a lawyer who tends not to do things without considerable deliberation. The investigation has only been going on for two years. Im working on it. Government investigators may seek to interview people. It would be helpful to us to hear from such people. The government is not required to, and will not, tell us what its up to. Our only source of information is people whove been questioned. There is nothing wrong with such folks telling us about their interviews, and it helps us a great deal. I therefore ask that anyone who has been approached and/or interviewed by any federal investigator about Mr. Zimmermann contact me. My email is dubois(a)csn.org, my phone is 303-444-3885, and my mail address is 2305 Broadway, Boulder, CO, 80304-4132. Ill close by offering thanks. Mr. Zimmermann and I very much appreciate the warm reception we were accorded by the Cypherpunks while we were in California. And we are deeply grateful for all your generous contributions of financial and other support. Your appreciation of the importance of Mr. Zimmermanns case to the wider causes of privacy and individual liberty is encouraging. Philip L. Dubois Lawyer for Philip Zimmermann -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAwUBLze+ebZ7C+AHeDONAQGJbgP9EMCSSQa0nEx2Tyb15IRei4JT3snpui1p nwrfmeXHLMawsXeUqCbsrZPgo6CJMHryiy/2dAMc+jc4KwUSuNudWZ9wbPGWALUg PNKlfpGi/3i7Fa+sE/RcR32PQ3vXixk6vYNHMV/mx/ZpjV4pLb31UgHhnjgDuKjv 73t8Klg8D6I= =lQdU -----END PGP SIGNATURE-----

3 2

Re: noiz-0.5: simple noise-emitting package
by Matt Blaze 17 Dec '03

17 Dec '03

This looks really cute, especially given the ability to "precompute" entropy before the process that needs it is running. An interface I'd rather see is one that allows a process to grab random bits that it can be sure are not correlated to bits that have been given to other processes. Since everything runs asynchronously with cron, you have no way of knowing how much time has elapsed since the last time the file was read or updated, and hence don't know how "fresh" the bits are. Also, /etc/noiz is an attractive target on multi-user machines.... So I'd rather see a /dev/noise, although a portable implementation of somthing like that is out of the question now that there are 10 gazillion unix vendors. Perhaps a more reasonable implementation would be a tcp or rpc service that processes can query to get random bits, where the server delays responding until it can guarantee that its state is sufficiently decorrelated from previous responses. Because you can "bank up" entropy during idle periods, most requests could probably be served without delay, making this technique a real advantage over just implementing the same functions in a library called directly. (Since good randomness is still rather expensive even when you can store it up, and useless when sent over a network, you'd probably want the noise server to refuse requests from outside the local machine.) Anyway, I'm looking forward to playing with it. It's a very nice idea. -matt

1 0

!NYC Cypherpunks meeting 2/11/95!
by Arsen Ray Arachelian 17 Dec '03

17 Dec '03

Incase you're in the NYC area, there is a meeting this Saturday. (If you're already on the list of NYC Cypherpunks, you'd have received the notice with the address.) If you're in NYC, but not on the NYC Cypherpunks list, and you need info, please send email to me, rarachel(a)photon.poly.edu, and I'll give you directions. See you there.. --Ray. =============================================================================== | + ^ + || ' . . . . . . . Ray (Arsen) Arachelian || | \|/ || . . . ' . ' . : . . rarachel(a)photon.poly.edu || |<--+-->||. . . |' '| .' . . ... ___ sunder(a)intercom.com || | /|\ || . . \___/ . . . : .... __[R] || | + v + || . oOOo /o.O\ oOOo :. : .. |A| "And bugs to kill before I sleep"|| =========/---vvvv-------VVVV------------|I|----------------------------------/ / . : . ' : ' |D| This signature pannel is / / The Next Bug to kill(tm) --- now open. / /___________________________________________________________________/ GCS d++(---)(-) H s+++/++ !g !p !au a- w-(+) (!v | v) C+++++ Coherent++++ L+ 3 C+ V+ P? E- N++ K- W W--- M++ V-- po- Y+++ t:[tos+, tng--, ds9+] 5 !j !R G? tv+ b+++ D+ B--- e+(- | *) u--- h+++ f+(++) r++ n+(---) x**(++)

1 0

Fwd: Seals and Sealing Waxes
by Alan Pugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Date: Tue Feb 07, 1995 10:15 PM EST To: cypherpunks(a)toad.com Subject: Fwd: Seals and Sealing Waxes Message-Id: TM> "All crypto is economics," and this is what made seals and sealing wax so TM> useful for so long. Saying "seals were duplicatable from the start" does TM> not mean this feat was easy, even if technically possible. TM> In fact, the fine details produced by a good seal are hard to exactly TM> emulate with a copy. Even on a two-dimensional surface. And with the advent TM> of three-dimensional surfaces, which sealing wax made possible, the fine TM> detail of a good seal was in fact very hard to forge. TM> Not impossible, but very costly with the technology of the day. Or even the TM> technology of _today_. After all, paper currency is largely based on seal TM> technology, with various embossing, printing, etc. methods used (on special TM> paper) that remain fairly hard to duplicate. true. thanks for the reminder of seals. i need to work this analogy into my current 'lecture' on the usefullness of encryption. _puzzle palace_ makes reference to british intellegence making use of people trained into the use of people trained to reproduce seals. this is something for us to look out for from the fine folx at nsa. if there is a way to spoof signatures (as mentioned in another thread recently), they will be perfecting and perhaps using these methods if they feel the need is great enough. i promote encryption using pgp with a lot of stress on the privacy and veracity of documents in business settings. how strong is the hash used by pgp? do you think it will eventually be hashed out in the courts in our favour?(pun semi-intended) i'd like digital signatures w/verifiable timestamps be recognised in a court of law. i don't know of any cases revolving around this issue. if anyone out there knows of one, i'd be interested in hearing of it so i can track it's progress. btw: though it is a pain sometimes to weed the noise off this list due to my (very) limited net access, it has proved to be an excellent resource. my thanks to the regulars. - --if i could code worth a damn i'd be a cypherpunk amp <0003701548(a)mcimail.com> February 7, 1995 22:17 -----BEGIN PGP SIGNATURE----- Version: 2.61 iQEVAwUBLzgN4CgP1O9KJoPBAQETZQf/WAY0I+fvEmevc7iwfVglqjIZ26zDnc33 p8Yjc+uQfagS0wavYLpN+OxMphpdUHHjycb98aYLDax8CUW3iDJ54tZKVnQT3pPx 9+v1gq38UbP8k7hvoGl5lIltmMJ/rMl2lZU87l2biYjmQq8n9S+mMoIOAatcmboG 6JQ4MEsNnZvsQVeaZm87qOGqfkeTbzwsBfz8LjLkgnv7TLUNn5wJgMgiC+apYC0V bJfAHWce3UGEPlaa4JHBbCRyfrC/hk1ggrYKthxHKE+Ceep1O2k7fRkX/tCC2BZC UaY8ZjogZKZJbfdDNmlG7fBN5EBWlj6Mj9Ti2SRYlx4q8lwSHad+gg== =HeNj -----END PGP SIGNATURE-----

1 0

Re: "encrypt tcp connections" hacks
by Chris Claborne 17 Dec '03

17 Dec '03

>> Thats because the providers never package things up cleanly. If they >> sent a client on a disk, a la AOL, and they set things up to >> autoconfigure, they'd never need to speak to the clients. > > You've obviously never attempted to get a Windows product working for >someone whose previous experience with a computer is limited to "Solitaire". > > I've done work with this ISP, and I can tell you it's nearly the most >frustrating experience I've had in my life -- Windows has bizzare >conflicts with software eating other software, ports getting set up >wrong, and just general nastiness. Even the slickest software needs >helpline time - for whatever reason. I hate jumping in when I may be completely off base but... NT and (possibly Winodws97) may solve some of this, mainly through better controll over devices and protected memory. I recently installed some NT services, HTTP server, and Time Service (to get time off a trusted host). The HTTP server was installed and working in 5 minutes. I'm a little more advanced than the typical "Solitare junky", but I was amazed at the ease of install and controll that some of this stuff gives you. I would probably spend atleast 30+ minutes trying to get them properly installed on my UNIX host. ... __o .. `\<, Chris.Claborne@SanDiegoCA.ATTGIS.COM...(_)/(_). CI$: 76340.2422 --------------------------------------------------------------------------- PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Available on any Pub Key server. PGP encrypted mail welcome.

1 0