December 2003 - cypherpunks-legacy

spam is good for you
by Zooko Journeyman 17 Dec '03

17 Dec '03

I like it when spam is sent to the cpunks list because it makes the list less accessible to lamers and wanna-be censors while not really hurting its value to people who are familiar with configurable/ scriptable mail agents. (Heck, I've considered 99% of cpunks traffic to be about the same flavor as spam on my palate for years, so I'm already comfortable with using heavy filtering as a matter of course.) In other news, I'm going to HIP and I'm thinking I should have a t-shirt made to piss off the self-righteous socialist anti-spam activists. My favorite slogan so far is "I may disagree with every spam you send, but I will defend to the death your right to spam it. --Voltaire". I consider this to be a powerful meme to broadcast at those low-tech lawmongers, but it isn't sufficiently.. um.. offensive. Any suggestions from the peanut gallery? Of course I have to include my e-mail address on the shirt so that those who are offended by my advocacy of absolute freedom of speech can try to mailbomb me. Over, Zooko

1 0

tcs_gateway2.treas.gov (IRS Harrassment of Cypherpunks List?)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

After failing to find in the list archives previous posts from the treas.gov address I was surprised to come across an example in a book about the cypherpunks that was sent to the list some months ago. Although I seem to recall this post as being authentic I am unable to confirm this since my browser doesn't seem to be getting along with the search engines for some reason or another. Can anyone confirm that the message below is an authentic message that was sent to the list at the time stated and with the same message ID? The reason I ask is that I have found and corelated messages from the same server which indicate that if the message came to the list with the message ID below then it was indeed composed and initially sent the day before the article quoted actually appeared in the newspaper. If someone could confirm that the following message appeared on the list with the same header as indicated below I would appreciate it. (There are some other strange discrepancies I have found in Jim Bells case too but I will refrain from commenting until I have had a chance to confirm them.) The message as portrayed in the book is as follows: Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id RAA03183 for cypherpunks-unedited-outgoing; Wed, 2 Apr 1997 17:40:11 -0800 (PST) Received: from tcs_gateway2.treas.gov (tcs-gateway2.treas.gov [204.151.246.2]) by toad.com (8.7.5/8.7.3) with SMTP id RAA03178 for <cypherpunks(a)toad.com>; Wed, 2 Apr 1997 17:40:04 -0800 (PST) From: IRSNWPR(a)net.insp.irs.gov Date: Tue, 1 Apr 1997 15:18:46 -0500 Message-Id: <199704012018.PAA00555(a)net.insp.irs.gov> To: Interested_Parties(a)net.insp.irs.gov Subject: Something of interest... Sender: owner-cypherpunks(a)toad.com The Oregonian, Wednesday, April 2, 1997 20 armed federal agents raid home in Vancouver By John Painter Jr. of The Oregonian staff VANCOUVER, Wash. - About 20 armed agents from at least three federal agencies in four states raided a Vancouver home Tuesday, apparently looking for evidence of a plot to kill government officials. ....

1 0

CIA Report on UFOs
by John Young 17 Dec '03

17 Dec '03

The New York Times reports today on a declassified CIA report on UFOs which discloses that over half of the public sightings in the 1950s and '60s were lied about by the US Government to protect dark secret spy planes and programs, primarily those of the U-2 and SR-71. "The admission raised questions about other Federal cover-ups involving U.F.O.s." The CIA report is at: http://www.odci.gov/csi/studies/97unclas/ufo.html For those who wish to avoid the CIA Web site, we put a copy at: http://jyx.com/ciaufo.htm The NYT Web site: http://www.nytimes.com In you cannot access it, see the story at: http://jyx.com/ufonews.htm

1 0

Re: bulk postage fine (was Re: non-censorous spam control)
by Adam Back 17 Dec '03

17 Dec '03

jf_avon(a)citenet.net writes: > On 3 Aug 97 at 2:34, Adam Back wrote: > > Eg. Say I spam you via an anonymous remailer. So now who are you > > going to sue? > > > > Spammers use remailers already. > > > > So your suggest has dire consequences for remailers. > > What you would sue is the entity that is advertized in the > message, not the ISP (or remailer) of course. If you get harassing > mail through the paper mail, would you sue the postal service? Here's the sequence of events as I see it: 1. spammer spams you with adverisement for phone sex line 2. you try to sue phone sex line company 3. phone sex company denies all knowledge 4. government says all email must be authenticated 5. government issues internet drivers license 6. anonymous remailers work around authentication requirement 7. government outlaws remailers See any flaws in that logical and undesirable sequence of events? Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Banished JYA
by John Young 17 Dec '03

17 Dec '03

From: http://jyx.com/index.htm JYX 3 August 1997 This site, JYX.COM, was set up on July 26, 1997 to substitute for JYA.COM which vanished on July 24, 1997, and thereby denied access to the site's architectural and public services. For a week technical and sales personnel of the ISP for JYA, AOL/PrimeHost, could not explain the disappearance. On August 1, 1997, AOL/PrimeHost representative Steven Graham stated that JYA.COM had been "intentionally pulled" for undisclosed reasons. Mr. Graham's telephone: (703) 265-4464. Reinstitution of JYA's architectural and public services should occur shortly, either by restart of JYA.COM with PrimeHost, or via another ISP. In the event that AOL/PrimeHost pulls JYX as well, announcement of alternative hosting and reasons for the change will be made on several mail lists: <cypherpunks(a)toad.com> <cryptography(a)c2.net> <ukcrypto(a)maillist.ox.ac.uk> <cyberia-l(a)aol.com> <design-l(a)psuvm.psu.edu> <wam-l(a)arch-mag.com> <the several Spoon lists @jefferson.village.virginia.edu> <wire(a)monkey-boy.com> and other lists and news groups as appropriate. This site is hosted by PrimeHost, which provided excellent service for JYA.COM for a year -- until now with this mysterious vanishing action. ------------------------------------------------------------------ Vanished JYA.COM Denied Services Denied Files (80MB) Architectural Natsios Young Architect http://jya.com/nya.htm John Young Architect http://jya.com/jya.htm Public / Urban Deadline Cryptography Archives http://jya.com/crypto.htm http://jya.com/cryptomb.htm Architectural Archives http://jya.com/arch.htm ------------------------------------------------------------------ For now offering only: Cryptox.htm

1 0

JYA Axed
by John Young 17 Dec '03

17 Dec '03

The ISP for jya.com, PrimeHost, an AOL subisidiary, has axed the site. We learned of this today after trying for a week to get an answer to why the site vanished. Tech said call Sales, Sales said it's not us, it's got to be Tech. Tech said it's definitely not us, and if it's not Sales or us it must be Bosses. Finally, a Boss was reached who said the site was "intentionally pulled." He claimed that it was "not a serious problem, so don't be alarmed," and sang cheerily about "some files" without elaboration. Maybe more next week, and we pray it turns out to be hysterically alarming and not merely a pissed Intel Prop owner seeking pay. JYX.com is still up, thanks to PrimeHost's autosub. Ten files there -- so far. We're humping to get the latest 60-page package of the RSA v. PGP suit there this weekend, thanks to Nobody.

3 2

Re: Tim Misfires / Re: Joichi Ito as a Junior Policeman
by Joichi Ito 17 Dec '03

17 Dec '03

At 01:56 97/08/03 -0600, Toto wrote: > It is clearly up to Joichi Ito to decide how he can best work toward > cypherpunk goals under his system of government, but he would do well > to listen to those on the list who have seen more than a few crusaders > sink into the swill when they make the mistake of talking to the piggies > too close to the trough. > A good sign that you have not yet been co-opted is if you still take > that "extra" briefcase to the meetings, just in case. > {"I've got to run out to my car for a moment with my briefcase, but I > will be leaving my _other_ briefcase here." <tick-tock-tick-tock>} > > TruthMonger Point well taken. I understand that it is easy to get misdirected when you are "dancing with the devil"... Currently, as one of the primary supporters of privacy and free access to cryptography in Japan, I have much more to lose and very little to gain from being "co-opted." by "the bad guys" (who aren't looking out for the interests of the people). In addition, although the Japanese Self Defense Force may be militaristic (they are the military so they probably are pretty militaristic), Japan does not have the equivalent of the NSA. It really is in Japanese national security interests to consider minimizing risk by distributing it since they obviously do not have the ability to control it in the way that the US does. Anyone who has been following the statements by the Japanese at the OECD should note that Japan has alway lagged behind in supporting government control of crypto. In addition (although this article is very seldom sited in actual cases) the Japanese constitution provides for privacy of communications for citizens. Also, most of the crypto technology is held in private companies. Really, what I am try to do is two things: 1) Make sure that Japan makes the right decision about crypto policy so that they do no stifle commercial development of crypto or put at risk national and individual security/privacy by implementing a weak system because of political pressure or domestic surveilance requirements. 2) Make sure that Japan does not repeat the US "Hacker Crackdown" and more recent Australian crackdowns which I think can cause a rift between hackers and society. Right now I think the risk of weak security from the point of view of IWar and just plain network failure is much more important than cracking down on hackers/crackers. I'm trying to head off such "crackdown" movements by trying to put threats and risks into perspective at the National Security level and take the focus away from the activities of hackers who I think can help improve security and lower risks in the long term. As for Tim's message... I keep worrying (when I am in Japan) that I'm too radical, so it's nice to hear from someone who is really hardcore to put a wimp like me in my place. ;-P I guess I still believe in trying to redirect the process of government before "dropping out"... I'm not making it any easier for the "bad guys" giving them my opinion and I can alway "drop out" when I think no one's listening anymore... Anyway, I'm going to stop writing now before all of the government people reading this list decide to put me in their kill file. Then no one will be listening to me. ;-P - Joi P.S. I wrote an article in the Daily Yomiuri about a year ago that outlines where I am coming from. Please take a look if you are interested. The Daily Yomiuri is a national Japanese newspaper. <http://www.garage.co.jp/~jito/article.html> -- Finger jito(a)nsm.eccosys.com or jito(a)garage.co.jp for PGP Key Fingerprint for RSA PGP Key ID 0x0EE23A2D 0D3A 7AAA 3DA8 E7B3 3AF1 C6FA B7ED D834 Fingerprint for DSS/Diffie-Hellman PGP Key ID 0x2D9461F1 58F3 CA9A EFB8 EB9D DF18 6B16 E48D AF2A 2D94 61F1 Home Page: http://domino.garage.co.jp/jito/joihome.nsf To subscribe to my personal mailing list send mailto:friends-subscribe@ito.com

2 2

Microsoft RAS encryption?
by Mike 17 Dec '03

17 Dec '03

Does anybody know how Microsoft RAS implements data encryption? Apparently (http://www.microsoft.com/kb/articles/q136/6/34.htm) they use RC4, but is this stuff documented somewhere, like in an RFC? Mike.

2 2

August Cypherpunks Meeting Announcement
by Lucky Green 17 Dec '03

17 Dec '03

This month's SF Bay Area Cypherpunks meeting will take place at a new location. Please pay close attention to the directions. We will have several interesting topics to talk about, but have very limited time. Please be there on schedule or you will miss the good stuff. When: Saturday, August 9, 1997 at 1:00 PM PDT. [22:00 local] Where: The Workshop tent, HIP'97 Campground, Almere, The Netherlands. How to get there: Take any plane from SFO to Shipol. Then follow the directions at http://www.hip97.nl/route.html This month's topics include: o The electronic release of the PGP 5.0 platform independent source code. o An introduction to the PGPcdk, a cryptographic toolkit. o The Onion Router beta release. o Practical phone encryption. o Fast crypto on a smartcard. What to do if you get lost: Call me at my cell phone. +31 (0)6 5373-5125. See you there, --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. Be HIP and join us for HIP'97 in Amsterdam. http://www.hip97.nl/

2 1

Canada's Entrust does end-run around ITAR
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

------- Forwarded Message Date: Fri, 01 Aug 1997 18:13:20 -0700 From: kalliste(a)aci.net (J. Orlin Grabbe) To: snetnews(a)world.std.com Subject: SNET: [Fwd: Another torpedo slams into Clinton crypto policy] - -> SearchNet's SNETNEWS Mailing List Path: news.alt.net!news1.alt.net!news-chi-13.sprintlink.net!news-east.sprintlink.net!news-dc-26.sprintlink.net!news-peer.sprintlink.net!news-pull.sprintlink.net!news-in-east.sprintlink.net!news.sprintlink.net!Sprint!205.185.79.4!zdc!super.zippo.com!lotsanews.com!szdc!newsp.zippo.com!news1 From: jqp(a)globaldialog.com Newsgroups: alt.current-events.clinton.whitewater,alt.politics.clinton Subject: Another torpedo slams into Clinton crypto policy Date: Fri, 01 Aug 1997 00:21:25 -0500 Organization: None Message-ID: <33E17255.18BB(a)globaldialog.com> Reply-To: jqp(a)globaldialog.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: Mozilla 3.0Gold (Win95; I) Xref: news.alt.net alt.current-events.clinton.whitewater:189839 alt.politics.clinton:338125 NY Times August 1, 1997 Canadian Product Puts New Spin on Encryption Debate By PETER WAYNER Canadian company's recent release of a new encryption product and subsequent announcement that it had received a license from Canada to export the product has surprised many companies and U.S. officials. The release was startling because the United States and Canada historically regulated the encryption- exporting issue in synchrony. The company, Entrust Technologies Ltd., released a free version of its Entrust/Solo software on Tuesday, and announced that they had received a license from the Canadian government to export it to almost all of the world. - -=- [TABLE] -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= THE MOVE BY ENTRUST SEEMS TO EXPLOIT A DIFFERENCE IN THE REGULATIONS BETWEEN THE UNITED STATES AND CANADA. - -=- [TABLE] -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This decision by Canada could signal a major rift developing between two allies over an issue that is becoming increasingly important to the computer software industry. In fact, the move seemed to startle the [*]Bureau of Export Affairs at the U.S. Department of Commerce. James Lewis, director of strategic trade at the bureau, would only issue a one-sentence statement through a spokeswoman: "This is under review as a potential enforcement matter." He offered no insight into which American laws were being violated. Shauna White, a spokeswoman for the company, said "We believe we are in full compliance with all the Canadian laws that apply." In the past, the United States and Canada enforced their encryption regulations with such cooperation that most controlled products are shipped in boxes announcing, "For U.S. and Canada only." The U.S. government was certain that Canadian regulations would block anyone from shipping the product out of Canada. Those regulations are still in place and there has been no change in the effect on products built in the United States. Programs written by Canadians, however, are another matter. Entrust was able to qualify for a license because their software contained what John Ryan, the company president and chief executive, said was "100 percent Canadian content." That is, it was developed in Canada by Canadian citizens. Entrust Technologies Inc. was spun off on Jan. 2, 1997, from Nortel (Northern Telecom) after Nortel developed the Entrust product. Entrust Technologies Inc. is based in Dallas, but most of the development work is done in Ottawa, Ontario, where the Canadian subsidiary, Entrust Technologies Ltd. has its offices. Ryan, for instance, is a Canadian citizen. The move by Entrust seems to exploit a difference in the regulations between the United States and Canada. Both countries are members of the Wassenar Arrangement on Arms Export Controls, a set of loosely controlled rules that took the place of Cold War- era regulations designed to reign in conventional arms and dual-use technologies. The arrangement regulates the export of encryption software but provided an exemption for general- use software that was freely available through either the public domain or widespread public channels like stores. Ryan explained: "Many countries have chosen to 'to turn that part off.' Canada has not chosen to turn that part off." The existence of this regulatory difference may have come as a surprise to many people in the United States because the Canadian software industry has not yet produced a top-rank international competitor. The academic computer science departments at colleges like the University of Toronto are first rate, but there are no companies with the same public presence as Microsoft or IBM. But Entrust Technology's emergence shows how quickly the public perception can become obsolete in the swiftly moving world of technology. The company is clearly hoping that its free version of the Entrust/Solo software will build acceptance for the commercial versions, which are also freely exportable. Many other companies follow the same strategy of releasing free versions to the public in order to publicize the commercial versions, which usually come with more features. Entrust allows people to download free copies of Entrust/Solo for personal use from their Web site, but they block requests from seven restricted countries: Libya, Iran, Iraq, Cuba, Angola, Syria and North Korea. France and Singapore are also blocked because they have restrictions on the import of technology. Entrust is already in heavy competition against a U.S. company, [*]Pretty Good Privacy Inc., which is circulating a free version of its encryption package, PGP 5.0. This version is available for home and non-commercial use without charge. The software, however, was developed in the United States and can't be exported without a license. The company has worked closely with the U.S. Commerce Department to smooth licenses for major U.S. companies seeking to use the software with their subsidiaries, but an individual license must still be granted in each case. Kelly Huebner Blough, director of government relations for Pretty Good Privacy, said: "Well, of course we would like the U.S. to license exports more liberally. Most of the other countries in the world license encryption software more freely. They may have strong policies on the books, but when it comes to implementation, the U.S. is the most restrictive." - -=- [TABLE] -=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ALL OF THE MAJOR SOFTWARE COMPANIES LIKE MICROSOFT, IBM AND SUN CONTINUE TO PRESS THE U.S. GOVERNMENT FOR RELIEF OF THE EXPORT CONTROL LAWS, ARGUING THAT BETTER AND BETTER SOFTWARE IS EMERGING THROUGHOUT THE WORLD. - -=- [TABLE] -=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Other companies will also be feeling the pressure. Ray Ozzie, the president of Iris, the developer of Lotus Notes, which is now owned by IBM, said: "This is further proof that easy-to-use, high-grade encryption products are available worldwide, and that U.S. companies continue to be at a disadvantage in the world marketplace. U.S. policy needs to change in order to take these realities into account." One of the most vexing parts of the regulatory equation involves unraveling whether the U.S. government can exert any pressure on Entrust Technologies Ltd. through its U.S.-based corporate parent, Entrust Technologies Inc. The current version of the regulations restrict U.S. companies from providing "technical assistance" to their foreign companies--a rule that would seemingly not apply to a product developed completely by Canadians. Earlier drafts were more vague and seemed to target any relationship or aid, but the final version focused on technical assistance. Companies with close relationships with the U.S. government are still circumspect. Steve Walker, president of the Glenwood, Md.-based [*]Trusted Information Systems, works closely with the Commerce Department to seek approval for all of its work done in Europe. They ask for a license for all of the software being developed by their subsidiary in Britain. "We've tried to be very careful about this, perhaps more careful about it than we need to be," Walker said and then pointed out, "We're getting approval." [*]Sun Microsystems is pursuing a strategy with a different corporate structure. The company bought a minority stake in a Russian network software company in 1993 and recently asked them to develop encryption software for the world market. The deal is undergoing scrutiny from the U.S. Department of Commerce, but no announcement has been made about the resolution. Sun announced that they hope to ship the software on August 15. Still, the range of a government is hard to measure. Greg Katsas, a lawyer in the Washington office of Jones, Day, Reavis, and Pogue, said: "Generally, the rules of jurisdiction of the place of incorporation apply, but there are cases where U.S. law reaches outside the boundaries. For instance, anti-trust law can cover acts done outside the U.S. intended to have an impact inside the U.S." All of the major software companies like Microsoft, IBM and Sun continue to press the U.S. government for relief of the export control laws, arguing that better and better software is emerging throughout the world. In the House of Representatives, legislation sponsored by Representative Bob Goodlatte, a Republican from Virginia, to liberalize export laws has found wide support, while similar legislation in the Senate has died. One of the major initiatives offered by the Clinton administration would ease export licenses for software that made it possible for law enforcement officials to obtain the software's keys with a court order. They propose lifting the restrictions for exporting the software using 56-bit keys with DES. A number of businesses have joined together what they call the Key Recovery Alliance to help negotiate with the government about the final implementation of this plan. Most major software vendors, including Entrust and Sun, are part of the alliance. While the companies are committed to producing software that helps recover encryption keys in emergencies, there is a great deal of debate about how this will be carried out. Entrust's product for office groups does offer key recovery, but it is a far cry from what the U.S. government would like to see implemented. Copies of the keys are only stored on the hard disk of the employee responsible for overseeing the network. There is no capability right now for interfacing with trusted third parties who would serve as recovery agents for the police. Still, Entrust also seems to be working to meet U.S. regulations. Their enterprise-wide system for larger companies has been granted a license for U.S. export even though it uses 56-bit keys. This license was recently granted as part of the United States' push for key recovery. It signifies that the U.S. Commerce Department felt that Entrust was moving toward compliance with the policy of smoothing access for the police. In two years, Entrust may integrate their key recovery system with licensed recovery agents or it could face losing its U.S. license. In the long run, this strategy continues to receive heavy resistance. While many businesses welcome key-recovery solutions for internal use, they seem to resist making it too easy for the police to access their documents. Corporations, after all, can be found guilty as well. The same rules apply to countries, which are finding themselves in an increasingly brutal worldwide competition for dominance. Countries with the most liberal export laws may be rewarded with a strong fraction of the market share and this is the crucial time when the decisions about product acceptance are being decided. Many MIS managers may choose Entrust's products simply because they don't need to fill out forms with the U.S. government in order to supply it to all of their foreign subsidiaries. Andrew Csinger is the President of Xcert, a Vancouver- based Canadian software company that manufactures encryption technology used for certification authorities. He expects that any difference between U.S. and Canadian encryption laws will be short-lived. "I think that market pressures are going to force the U.S. administration to respond more quickly, " he said. "In reality, cryptography is widely available throughout the world." Copyright 1997 The New York Times Company - -> Send "subscribe snetnews " to majordomo(a)world.std.com - -> Posted by: kalliste(a)aci.net (J. Orlin Grabbe) ------- End of Forwarded Message

2 1