December 2003 - cypherpunks-legacy

Hypermail & Cypherpunks
by simsong＠vineyard.net 17 Dec '03

17 Dec '03

Have any of your cypherpunks set up a hypermail archive for cypherpunks? If not, I would be willing to set one up on some machine. ============= "Superior technology is no match for superior marketing." ============= Simson on Tour: Feb 2 - Feb 5 - Cambridge: Conference on Freely Redistributable Software Feb 7 - Feb 13 - Baltimore: American Association for the Advancement of Science. Feb. 28 - March 1 - Seybold, Boston. March 23 - NYC. MacFair. March 27 - March 30: Cambridge. Computers, Freedom and Privacy.

1 0

Article on CAs in WebWeek
by olbon＠dynetics.com 17 Dec '03

17 Dec '03

An article on the front page of WebWeek this week discusses digital signatures and CAs. The best point made was that a small company could undercut (pricewise) the post office as a CA. Overall it seemed a pretty fair article. It mentioned UC Berkeley researchers "spoofing" a Netscape server's identity and sending false data to the client. This was news to me, I am curious as to how this was done. The paper article also listed as a "resource on the net" the URL for Tim May's cyphernomicon. Here's the link. Enjoy. Article: Big Step Forward For Authentication URL: http://pubs.iworld.com/ww-online/96Feb/news/authentication.html Clay --------------------------------------------------------------------------- Clay Olbon II | olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: finger olbon(a)mgr.dynetics.com Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 "To escape the evil curse, you must quote a bible verse; thou shalt not ... Doooh" - Homer (Simpson, not the other one) ---------------------------------------------------------------------------

1 0

Re: Fair Credit Reporting Act and Privacy Act
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:21 AM 2/9/96 -0500, Tim Philp wrote: > Private individuals are not what I was refering to. I am more >concerned about corporations who hold information about me and release it >to the highest bidder. When it comes to individual versus corporate >rights, I am clearly on the side of the individual. Remember that there's a major difference between "corporations" and "business"; you seem to be mixing them up. A corporation is a legal fiction that treats a cooperative effort by one or more people as if it were a person in itself, and normally involves limiting the liability of the corporation's investors by putting it all on the fictional person. A business is what one or more people do to make money. Most corporations are businesses, though not all. Governments can legitimately tell corporations what to do because that's part of the price of the legal fiction; a government can't abuse a corporation because you can't beat up a legal fiction, though it can say "Poof! You're not a legal fiction any more", and conversely, if the people who own the legal fiction don't like what the government's telling it to do, they can dissolve it. (Governments also enjoy regulating non-corporate businesses, but they're no longer on solid moral ground.) > I have also not suggested some form of prior restraint that would >require government access to computers. I simply suggest that should a >violation occur, that I have the right of civil and criminal law as a >recourse to both compensate me for my loss of privacy as well as deter >future damage. A company knowing that civil and criminal penalties could >result from a violation would take extra care to ensure the security of >my data. How are you going to _know_ that a "violation" occurred, if company A tells company B your address or favorite liquor? Only by having access to the records of both companies. Getting that through the courts, for only the parts of their information relevant to you, is better than blanket permission for the government to rummage through their files, but after the first lawsuit lets investigators in, everything they've got is clam bait anyway. It's still major privacy violation - for the company whose machines are being violated, and for the non-suing individuals whose data is also on those machines. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs

2 1

RSA-China Crypto
by John Young 17 Dec '03

17 Dec '03

Wall Street Journal, February 8, 1996, p. A10. China, U.S. Firm Challenge U.S. On Encryption-Software Exports By Don Clark RSA Data Security Inc., the dominant supplier of data-privacy software, announced an unusual partnership with the Chinese government that exploits loopholes in U.S. export restrictions on codemaking technology. As part of the deal, RSA, which is based in Redwood City, Calif., plans to fund an effort by Chinese government scientists to develop new encryption software. The Chinese-developed software, based on RSA's general mathematical formula, may be more powerful than versions now permitted for export under U.S. Iaws, said James Bidzos, RSA's president. Two Chinese agencies also will use and distribute RSA data encryption products that may be legally exported from the U.S. The Chinese encryption-development arrangement, which isn't based on those products, appears to be legal as long as RSA doesn't supply the scientists with any other controlled technology, lawyers familiar with export laws said. RSA's move comes at a sensitive time in U.S.-China relations, and opens a new front in the company's long-running campaign against encryption export regulations. The closely held company, and other U.S. software concerns, have attacked the Clinton administration and the National Security Agency for trying to limit the strength of exported U.S. technology, while stronger products increasingly can be purchased from competing foreign companies. "The government has opened export doors a crack, and we sort of drove a Mack truck through them," Mr. Bidzos said of the Chinese deal. "The genie is truly out of the bottle." Stewart Baker, a Washington lawyer and former general counsel of the NSA, said the government "obviously would not be thrilled" by RSA's China venture. China hasn't in the past been party to international agreements governing encryption exports, he noted, and RSA's move could force other countries to consider China as an important player. "It's going to create an interesting strain in the international discussion," he said. Japan, an even more potent force in technology, appears to be leaning toward loosening export controls on encryption, Mr. Baker and other industry executives say. RSA plans to announce the formation of a new company in Japan today, but the venture will be subject to U.S. export controls, Mr. Bidzos said. Encryption uses special mathematical formulas, called algorithms, to scramble voice conversations or data to make them unintelligible to eavesdroppers. RSA's founders developed a popular variant of the technology that helps determine the authenticity of senders and recipients of messages. Both privacy and authentication are widely regarded as crucial to advances in electronic commerce. RSA struck its deal with departments of China's Ministry of Foreign Trade and Economic Cooperation, and the Academy of Sciences. They will use two RSA software products -- one for authentication and one for protecting the contents of PC hard drives -- internally and help distribute them. The Academy scientists who will develop new encryption software also will be paid to try to break RSA's products to test their strength, Mr. Bidzos said. A spokesman at the Commerce Department's bureau of export administration said he was unaware of RSA's China venture, but said the agency would be monitoring developments. Mr. Baker, the former NSA attorney, questioned whether customers in other countries would warm to the idea of Chinese-developed encryption software. Products approved by the U.S. government for export have the stigma that NSA can decode, and Chinese products might be subject to even more suspicion, Mr. Baker said. Still, the RSA deal is likely to be seen as further evidence of slipping U.S. control over encryption. "It is another example of what happens when you try to impose unilateral controls on what is in reality uncontrollable technology," said Bruce Heiman, an outside attorney for the Business Software Alliance. [End]

1 0

e$: Paint it Black
by rah＠shipwright.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- As strange as my politics are ;-), I've never been one for political protests, at least not since I graduated college and grew up. However, it seems that I've done enough protesting for silly causes in my youth to excuse me for doing one small thing about something I still *do* believe in, the freedom to talk about what you want without the threat of someone hauling you off to jail. With that in mind, I'm joining the EFF, VTW, and thousands of other web sites across the world today and making the e$ Home Page black for 48 hours. I'm hoping that others out there will join me in making Black Thursday as memorable as they can for the people who think that censoring the net is even possible, much less conscionable. "The net sees censorship as damage, and routes around it." -- John Gilmore Cheers, Bob Hettinga -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRoPsPgyLN8bw6ZVAQE0rwP+LZu5yNwabfBCyTjjnez5/VooUA5f6zkf gTFKHWDelSZS1RZ8ynoOzYSDJ7KzKQDEvETmeY59VTVODKR0brrDwwwbconFCaCm wEcjuhwPpw3jECMPpFNc0NFAdC4h3uoiG8sBY3Da6RZlEVkxgvj0XDweslbcPC/x 6Kkiy6oUJd4= =F1Vn -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Archives back on line
by Leslie Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The cypherpunks archives are back to being updated regularly. I apologize for the lapse (and repeat my lament on the quality -- or lack thereof -- of hypermail). The URL: http://www.hks.net/cpunks/ - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMRoV3yoZzwIn1bdtAQFlWAF9Ev0ihCGbT6JOGXlKgtrI+ZOk8wmJxnVK NQNsP6J1Td1/2ui3Q8JL3dkhqYwOLHPF =ZBO0 -----END PGP SIGNATURE-----

1 0

Re: Arthur C. Clarke Supports Strong Crypto
by avatar＠mindspring.com 17 Dec '03

17 Dec '03

At 09:06 PM 2/4/96 -0800, you wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >At 08:05 PM 2/4/96 -0800, Timothy C. May wrote: >> >>(Pardon me for mentioning crypto...) >> >>Arthur C. Clarke, known to most of you (author of many SF works, coiner of >>the phrase: "all sufficiently advanced technlogies are indistinguishable >>from magic," mention by Alan Olsen yesterday), has a role in a "Discovery >>Channel" program called "Mysterious Universe." > >Actually, it was _I_ who mentioned this quote, but didn't specifically >recall whom to ascribe it to. Perhaps Tim May didn't see it; a week or so >ago May engaged in a shotgun-type killfile addition, including me when I was >merely ( I still believe...) the victim in a local flamewar. If there is >somebody out there who: > >1. Is on speaking terms with Tim May. >and >2. Has a little respect for my commentary, I would very much appreciate it >if you would forward this comment to him to ensure that he sees it. > >The truly ironic thing is that Tim wrongly ascribes the comment to Alan >Olsen, who is apparently the (recently admitted) perpetrator of at least one >flamewar >against me. > >Jim Bell >jimbell(a)pacifier.com > GROW UP!! Charles Donald Smith Jr. ||The government is my shepherd I need not work. It alloweth me to lie down on a good job. It leadeth me beside stilled factories. It destroyeth my initiative. It leadeth me in the path of a parasite for politics sake. YEA, though I walk through the valley of laziness and deficet spending I shall fear no evil, for the government is with me. It prepareth an economic utopia for me by appropriating the earnings of my grandchildren. It filleth my head with false security. My inefficiency runeth over. Surely, the government should care for me all the days of my life, and I will dwell in a fools paradise forever.................AMEN! || nuke'm if ya got'em||

1 0

[CODE] Signing Web Pages
by Ed Carp, KHIJOL SysAdmin 17 Dec '03

17 Dec '03

Here's a quick script I hacked together in the last few minutes to sign web pages. Very simple-minded, it nonetheless does the job. If you want to see how it looks in action, visit http://dal1820.computek.net #! /bin/sh # # signit - use PGP to sign a web page # Written 02/08/96 by Ed Carp (ecarp(a)netcom.com) # # This could conceptually be used to sign (and optionally verify) # shell scripts, etc. The possibilities are endless... # # # Set up some variables... # # Change this if you're so inclined... PGPHELP="http:\/\/www.yahoo.com\/Computers\/Security_and_Encryption" # Look for a line that starts like this... LOOKFOR="This web page has been signed with" ADDLINE="$LOOKFOR <A HREF=$PGPHELP>PGP<\/A>. To see the digital signature, click <A HREF=$1.asc.html>here<\/A>." # # First, we need to make sure that the page hasn't already been signed... # F=`grep "^$LOOKFOR" $1|wc -l` F="`echo $F`" # If it hasn't already been signed, add signature line if [ "$F" = "0" ]; then echo Adding PGP signature HTML to document echo "s/<\/BODY>/$ADDLINE<\/BODY>/g" > $1.temp.$$ echo "s/<\/body>/$ADDLINE<\/body>/g" >> $1.temp.$$ sed -f $1.temp.$$ < $1 > $1.$$ rm -f $1.temp.$$ mv $1.$$ $1 fi pgp -asb $1 # Add rudimentary HTML echo "<HTML><HEAD><TITLE>PGP Digital Signature of $1</TITLE></HEAD>" > $1.$$ echo "<BODY><I>PGP Digital Signature generated `date`</I><HR><PRE>" >> $1.$$ cat $1.asc >> $1.$$ echo "</PRE></BODY></HTML>" >> $1.$$ mv $1.$$ $1.asc.html rm $1.asc echo Done. -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/digital pager 800/558-3408 SkyPager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi "Past the wounds of childhood, past the fallen dreams and the broken families, through the hurt and the loss and the agony only the night ever hears, is a waiting soul. Patient, permanent, abundant, it opens its infinite heart and asks only one thing of you ... 'Remember who it is you really are.'" -- "Losing Your Mind", Karen Alexander and Rick Boyes The mark of a good conspiracy theory is its untestability. -- Andrew Spring ---------------------------------------------------------------------- According to the Communications Decency Act, these are the words you may no longer use in your Internet correspondence: Shit, piss, fuck, cunt, cock-sucker, mother-fucker and tits. The use of shit, piss, fuck, cunt, cock-sucker, mother-fucker and tits, may now earn you a substantial fine as well as possible jail time, should President Clinton sign this Bill into law. Please refrain from using shit, piss, fuck, cunt, cock-sucker, mother-fucker and tits, to protect your children as well as others, from their evil influence, thus keeping America "ideologically pure".

2 2

Escrow Key Testimony: Witnesses Wanted
by Declan B. McCullagh 17 Dec '03

17 Dec '03

>From Robert Steele: The staff of the Commission on Protecting and Reducing Government Secrecy (primary sponsor is Senator Moynihan from New York) is looking for individuals able to provide authoritative testimony for or against the escrow key concept as it applies to the effectiveness of law enforcement. I suppose this is grand-son of Clipper, but it is a serious aspect of their over-all mandate, and probably a good idea to help them. I recommend direct contact to the deptuy staff director, Jacques Rondeau, whose email address is <fastermover(a)ichange.com>.

1 0

Re: Encryption and Backups
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 08:33 PM 2/4/96 -0800, John Pettitt wrote: > CP Backup (part of PC Tools for Central Point aka Symantec) has DES. As to > how good the implementation is: I have no idea. Broken: I worked on that (well I attended meetings on the implementation of that). It will keep out the average kid sister. Better than rot 13. I protested vociferously, saying that such encryption verged on fraud, and my boss overruled me without explanation or discussion -- odd behavior for him. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0