December 2003 - cypherpunks-legacy

Inexpensive Crypto Boxes...
by Jim Choate 17 Dec '03

17 Dec '03

Hi all, The recent discussion on the <$1000 computer/appliance/digital-widget got me to thinking and I had a spasm... The new Sony Play Station is operating under a stripped down Unix. Considering the speed that these boxes are designed to run at it seems a natural for somebody to come up with a crypto workbench on ROM to install in one of these babies. Could program one of the game controller ports as a serial port and hook it to a Linux box (for example). Ta ta

3 2

Re: The future will be easy to use
by Jonathan Zamick 17 Dec '03

17 Dec '03

>* Clear goals. > >* A leader, someone who would call the shots, and would also serve as the >person you'd have to convince. > >* Open communications. Shrouding a project in secrecy is a good way to >kill it. This is one potential advantage we have over the spooks. > >It _is_ doable. I know the skill is out there. Wei Dai, Eric Young, Peter >Gutmann, and others have proved themselves quit capable of writing good >solid code. Sameer Parekh has done an incredible job with PR. Phil Karn, >Dan Bernstein, and some others (who I'm not sure want to be named) are >talking to the government. GUI I'm less sure about, but I'd hope that some >cpunks would come out of the woodwork. > >It is not a matter of ability, but of will. It is also a matter of funding of course. While development can be donated time, the rest often takes money. Still, its something to look into. Handling RSAREF is sapping much of my time, otherwise I'd jump right in, however I like to always pause before committing my time to endeavors. I wouldn't mind helping out though. Certainly Consensus probably has some resources with its own contacts to contribute. I agree with your points though. Another thing to consider, are some alternate methods of enterprise design that involve better communication, iteration of goals vs product, etc. (Actually I need to work on a speech about this that is coming up soon. Yet another project. :) Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

3 2

Judge won't drop Netcom from suit
by Joey Grasty X3697 P6611 17 Dec '03

17 Dec '03

Check out the story on the Scientology suit. http://www.sjmercury.com/scie1127.htm

2 1

Netscape 2.0b2 allows for invasion of privacy (fwd)
by Graeme Cross 17 Dec '03

17 Dec '03

Talking of Netscape - this posting prompted me to forward it given the security and privacy implications inherent in the problem. Cheers Graeme ------- Start of forwarded message ------- >From: Scott Weston <scott(a)tripleg.com.au> >Subject: Netscape 2.0b2 allows for invasion of privacy >Newsgroups: aus.net.announce,comp.privacy >Date: Fri, 01 Dec 1995 11:09:06 +1100 Hi 'Net Dwellers, First off - I've posted this before (however not to this group) and only got a response from the Netscape Corp. They were glad I found the problem and said that they would fix it, however I feel that people should know about it. Also I would like people to help me spread this document around, i.e. if you know of a newsgroup (or people) that would find this interesting then please re-postit. On with the problem... I've recently got hold of the latest netscape, and was (at first) very excited about the new "LiveScripts" that it supports. If people don't yet know - these "LiveScripts" allow you to put small programs into your web page that is then executed by the Netscape client. There is no DIRECT way for these programs to send information back to the owner of the web page, however I was able to do it in a not-so-direct way. The "LiveScript" that I wrote extracts ALL the history of the current netscape window. By history I mean ALL the pages that you have visited to get to my page, it then generates a string of these and forces the Netscape client to load a URL that is a CGI script with the QUERY_STRING set to the users History. The CGI script then adds this information to a log file. Now if this hasn't quite CLICKED yet lets do a little example. Johnny Mnemonic starts up his newly acquired version of Netscape2.0b2 to start his daily "surf" session. First he decides to check his CD-NOW purchase and uses the handy Auto-Login URL. Then he decides to go to Lycos and do a search. In his search he find my page, which he decides to visit. Suddenly he is transported, not to my main page but to one of my CGI scripts, which in turn happens to have ALL the URL's he just been to in it. This means that in my log will be: - the URL to use to get into CD-NOW as Johnny Mnemonic, including username and password. - The exact search params he used on Lycos (i.e. exactly what he searched for) - plus any other places he happened to visit. I do this in a way that the user will KNOW that it has happened and will _hopefully_ email Netscape and tell them they are NOT impressed. But it would be EASY for me to change the CGI script so that the user is unaware that it has actually happened, unless they closely examine their URL history (in fact they'll probably just think its a netscape bug). If you're skeptical about this then do the test yourself. Get netscape 2.0b2 and do some normal surfing, and then go to Lycos. Do a search for: scotts car boot sale which should return the URL - http://www.tripleg.com.au/staff/scott Click on the URL and sit back an watch. First my main page will show up but a little while later you should be transported to a CGI bin script that will show you your URL history. I have tested this with both the Linux 2.0b2, and Solaris 2.0b2 versions and both have done the same thing. I would be interested in knowing if it happens for ALL versions of Netscape2.0b2. The log file does log the User Agent (i.e. the name of the platform you are using) so by simply going to the page I will know that your version of Netscape is also open to this form of attack. Currently I can find no way to configure Netscape2.0b2 to NOT run LiveScripts - and at the very least this option should be quickly added to the next version of netscape to be released. But a far better solution (IMHO) would be for netscape to pop up a window before running the LiveScript and let you know what the LiveScript wants access to, e.g. if it only wants to print out the current time then that's OK, but if it wants to read my history list and then transport me to a CGI script and add me to a logfile then maybe I would say NO. I think I've said enough.... If you've got any further questions, or want some more information just email me : scott(a)tripleg.com.au -- Scott. Quote from a car accident insurance claim: "I told the police that I was not injured, but on removing my hat, I found that I had a skull fracture." ------- End of forwarded message -------

6 6

Q: Legal liability for Certification Authority
by Greg Rose 17 Dec '03

17 Dec '03

In the last few weeks, mostly under the subject of creating a Cypherpunks Certification Authority, someone mentioned legal liability of a CA if a certified identity was misused. I am looking for material to pass on to a REAL, PAID net-savvy lawyer relating to this question. In return for the money we pay him, he will return an opinion on just what liability exposure would be for, say, a large technical users group who got into the CA business for PGP keys. And/or what disclaimers or indemnities would be needed. I would be happy to make his legal opinion available to the list. IANAL, so I don't know just what precedents, decisions, regulations, and so on might be relevent. More information is always a good thing. Please: 1. reply to me by mail, not the list, unless there is more general relevence to Cypherpunks. I'll summarise. 2. Speculation is not useful. thanks, Greg. -- Greg Rose INTERNET: greg_rose(a)sydney.sterling.com Sterling Software VOICE: +61-2-9975 4777 FAX: +61-2-9975 2921 28 Rodborough Rd. http://www.sydney.sterling.com:8080/~ggr/ French's Forest 35 0A 79 7D 5E 21 8D 47 E3 53 75 66 AC FB D9 45 NSW 2086 Australia. co-mod sci.crypt.research, USENIX Director.

1 0

META: Lycos & Searchable archives
by Leslie Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Someone has expressed concern to me that the cypherpunks archives are searchable via Lycos. Said person doesn't mind having the archives searchable to the smaller audience of people who go to the we-site, but is unhappy about net-wide searches turning up cypherpunks articles. Can we try to find a consensus on this? My initial inclination was to shrug the concern off (properties of information, etc, as well as c'punks being a more-or-less anarchy and the express desire for some sort of searching mechanism for c'punks), but I thought I'd double check as I've been mostly out of touch for the better part of a year. - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBML1HiCoZzwIn1bdtAQEtjgF/d7GBzgELk41OE+/pZxnZkzn+qYLRHmTn 8mbScBdkko83n4sxGjwFRQJyN5IlPCJQ =nFDi -----END PGP SIGNATURE-----

2 1

Re: Netscape gives in to key escrow
by Jeff Hupp 17 Dec '03

17 Dec '03

On 30 Nov 95 at 13:30, Timothy C. May wrote: : At 7:26 PM 11/30/95, Ravi Pandya wrote: : >If you're looking for an alternative Web browser for Windows, we just made : >ours available for free at www.netmanage.com. It's fast and reliable, and : >supports HTML 3.0, inline video, software distribution, VRML (NT version), : >Real Audio, TrueSpeech, etc. : : This shows the price Netscape could pay for taking a pro-surveillance, : anti-privacy stance. : The word is getting out. Both brokers I have system support contracts with have called me asking for my take. -- JHupp(a)gensys.com |For PGP Public Key: http://gensys.com |finger jhupp(a)gensys.com Waking a person unnecessarily should not be considered a capital crime. For a first offence, that is

1 0

key escrow compromise
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

to most on the list, the subject of this message would be an oxymoron. ("there is no compromise!") regarding the recent Netscape brouhaha: I tend to agree with Clark in only one regard: the government is going to get into the key storage/retrieval business in some form or another eventually & inevitably; it's just not stoppable. like one of the NSA spooks said after the Clipper fiasco, "well, we had to try". the aspect that is up for grabs is whether these systems will be *mandatory* for all private communication. here's a quick idea. the post office is getting into certification authorization come hell or high water (ETA summer, 96). now, frankly I think this is a good thing. someday we will need some kind of legal agency to deal with citizen keys, so that we could have cryptographic dealings with federal agencies such as the motor vehicles department, etc. many are going to blast me to oblivion for saying this, though. but don't you think there are some benign government services that you would like to have access to via your "state" or "legal identity" key? this would prevent other people from faking your identity in front of the state, e.g. voter fraud, and other miscellaneous things. it seems to me the problem is when a government begins to insist that the only authorized encryption you can use must be based on the secret key they give you is where all the problems arise. so, what we could advocate as a compromise (given that the post office is absolutely not going to *not* get in this business, from what I can tell). we encourage the idea of KEY FREEDOM this would be a heading for the idea that we are in support of the (our) government creating cryptographic infrastructures and key authentication services, as long as we always have the total freedom to encrypt according to however we please in private communications. in other words, we are willing to have an official state identity/key as long as it is not required in our private transactions, only those involving the state. (yes of course I know "state" is a pornographic word here, heh). if you don't like this imagine it as a "stopgap measure" on the way toward full cryptoanarchic infocalypse that government bureacrats might buy. another idea is that we might reasonably support a system that has such a thing as "key escrow" but we only use the keys they give us as part of our signatures to other people if we want to reveal our "official" state identity, not to encode the communication itself. in this way someone else could verify your identity for e.g. legal/ contractual purposes, but the overall communication would remain private. in other words, we agree that the government does have the authority to link people to their "official numbers", but we have a choice about when to use those official numbers in any private communication, and by law businesses do not ever have to *require* authentication in this way. the numbers of course would be required in communication between the individual and government. the situation is that the government *now* requires that it knows who we are when we communicate with it in any official context. therefore I submit that the above system would not take away any rights, and in fact might lead to privacy advocates being able to use a massive government key-infrastructure but still retain communication privacy. in other words, you now have the government actually supporting your cryptographic freedom by giving you a massive "official" key distribution system you can use any way you like. another possible compromise is that by default, keys would be insecure, in the sense the government stores them for "key escrow" purposes, but people are always recognized as having the right as "tunneled encryption" (a great term for private encryption within the state encryption). you see, cypherpunks often recognize that most of the world is so clueless that they don't protect themselves, and they almost don't deserve to have privacy by the default if they are entirely clueless or apathetic about obtaining. so what we might be able to accomplish is a system in which all the clueless people use the government-supplied keys, the FBI cracks some percentage of "clueless" criminal communication, and non-clueless people go ahead and bypass it all. now, before you hotly flame my eyebrows off, I say these things not because I like key escrow, but that I suspect the post office is going to move into certification no matter what, and the idea of key escrow is closely related to that. with a little finetuning the cypherpunk position could help define the actual rights of individuals relative to these new government systems in a way that is totally compatible with all our core privacy beliefs. what I am getting at is that we could twist the words "key escrow" to mean that the government provides some infrastructure for storing & accessing public keys (similar to phone books), and we could simultaneously vehemently deny that "key escrow" legitimately allows the government to actually *have* our secret keys. in other words, we say, "yes we support key escrow. of course it is a good idea to let the government have simple phonebooks of keys. oh, wait, you mean we have to USE THESE KEYS? in the official STATE ENCRYPTION ALGORITHM? we have to STAMP OUR SSN# ON EVERY TRANSACTION WITH EVERY BUSINESS? sorry buster, what I do with my key is my private matter. this would be again to having official government phones that allowed the government to call any number and start surveilling the room the phone is in."

2 1

Re: Getting a copy of the Jim Clark speech
by loki＠obscura.com 17 Dec '03

17 Dec '03

If he has not clarified his position by tomorrow evening, I will set up some web pages explaining the situation and decrying Netscape's apparent position on key escrow (GAK). I have the quotes that L. McCarthy posted, and Jeff Weinstein's response. I have not been able to get the article off the server yet (possible all the cypherpunks downloading it?). Any other documents I should include? -Lance At 1:24 PM 11/30/95, Jim Gillogly wrote: >> Raph Levien <raph(a)c2.org> writes: >> I called Netscape public relations. Here's what I found out: > >> 1. Netscape PR does not keep transcripts, etc., of Jim Clark's speeches. >> 2. You can order a tape of the speech from Conference Copy for... > >Good initiative, but we needn't wait for 6 weeks to get a copy of it. >All that needs to happen is for Jim Clark to explain what he meant, if >it's different from what was reported. No need for all the to-ing and >fro-ing. > >Perhaps what he meant was simply reiterating the announcement of October >when they said they'd support the TESSERA crypto API. If it's worse than >this, he should explain what's going on. If not, October was the time to >get excited rather than now. > >Waiting with bated breath... > > Jim Gillogly > Highday, 10 Foreyule S.R. 1995, 21:24 ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: Netscape gives in to key escrow
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11/30/95 3:07 AM, Futplex quoted: >> http://www.cnet.com/Central/News/govt.html ... >--------------------------------------------- ... > said Clark. He added that an invincible security system for the Net is > possible, but such a system won't be built unless the government has a stake > in it. "That's where key escrow comes in," said Clark. >--------------------------------------------- "A stake in its heart," more like. Futplex then wrote: ... >Netscape's web pages. I hope they will at least have the courage to put out a >"We Support Clipper II" press release. Now the question is, how much of a >role does Netscape Communications intend to play in implementing GAK, and >what can we do to counter it ? Well, spamming the sign won't do. Aleph One's suggestion -- an NS-hack or "virus" -- doesn't make any sense: if Perry or someone would vet a hacked copy, I'd use it in a second. But hacking it would involve a violation of the license, so hacked versions couldn't be offered in any above-ground way: there'd be no way to certify a hacked copy with a trusted nym's key. Netscape is between a rock and a hard place: I think it's safe to say that, were all things equal, NS would support strong crypto. The fact that NS has decided otherwise suggests that some pressure was applied: Clark says as much. This leads me to believe that one possibly effective (and possibly dangerous) tactic might lie in a seriously sustained attack on NS's reputation -- keeping up a meme-drumbeat of "you can't trust Netscape, that's all, you'll get ripped off." I think we should try it -- TODAY, now, persistently and loudly, until NS comes around. I'm not saying that this'll be enough, but it's a start. TODAY. And I really don't care what it takes: calling cronies in the press, spreading innuendo, redoing NS icon sets so there's a spy from "Spy Versus Spy" loitering behind the N... I've seen some nice "NO Netscape" tags on GNU-related pages. Let's do it. Hieronymous FB DD B5 C8 FB F4 52 41 F0 0F A0 6E 99 43 75 06 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBML1vc73g0mNE55u1AQGfdgIAsldR3e9UQZG9//38B9LrU/HnCSzaY1kB RMOcBdab5EZ2X9BXkA7lIdDJUUqHOykuv1oyFDtitWRsXxmaTb0cuw== =0FmD -----END PGP SIGNATURE-----

2 1