December 2003 - cypherpunks-legacy

Re: cypherpunks at ietf
by James A. Donald 17 Dec '03

17 Dec '03

> OUR CURRENT PROBLEM IS THAT THE AVERAGE CONSUMER CAN NOT COMPLETE AN ACCURATE > SEARCH ON THE WEB. > > [...] > > AT THIS POINT SO MANY CYBERPUNKS HAVE EMBEDDED SO MUCH GARBAGE ON THE WEB, > THAT YOU CAN NOT COMPLETE AN ACCURATE SEARCH. Gee: Someone who has not learnt to use the caps key on his computer cannot do accurate searches, so will everyone else please get off the net. > > [...] > > BUT MORE IMPORTANT, WE NEED TO CLEANUP THE TRASH THAT THE CYBER-PUNKS ARE > PLACING ON THE WEB. Pleasant comic relief. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: The future will be easy to use
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 15:30 11/28/95 -0500, Carl Ellison wrote: >BTW -- PGP currently lacks a way for me to note, when I sign a key, how it >is that I trust that key (by personal meeting, by attribution, by message >association, ...). A signed attribute record would let me record that >information for myself as well as for others. There is more to this problem than how it is that I trust the key. There is also what I trust it for. I just added a key to my key ring that I will use for sending confidental data to a client site. I trust that no one can access the secret key who is not also inside their firewall. However, the key is on a multi-user system, so I do not trust that it is accessable to only one person. Since the data I intend to send will be publicly available inside the firewall, I don't have to trust more than the firewall. It is hard to see how to record the information about how much I trust the receipent's systems security. Bill ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

2 1

Re: key for Alice as promised (not)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Wed, 29 Nov 1995, Adam Shostack wrote: > > PGP is really not the issue. The issue is more my security and the > > environment that I use PGP in. I don't have a trusted machine to run PGP > > on. Anyone who wants to can come up to machine and copy my secret keyring > > or they can even watch me typing my password in. > > Threat, please?? Do people often stand over your shoulder as > you type? Yes. > Enter your office, Yep, especially my night cleaning staff. > point guns at you, Not recently ... I'd co-operate fully in that situation, though. > and take a backup of your entire computer? You mean like the on-site backups that I have in the filing cabinet beside me, or the off-site backups that aren't here (in case of fire, or such) nd are completely outside my control? > Have you considered putting the secret keyring > on a floppy and locking it in your desk/safe when you're not actually > in the office? (Or home..) Yep, I've considerred it. It's still not all that helpful. Cleaning staff has plenty of time when I'm not around to deal with that. > > So, I don't fool myself, and I don't use PGP, except for things like > > exchanging a one-time pad with someone when I've already sent the message > > out across another delivery mechanism, like on a floppy delivered my > > courier. > > I don't follow. You're claiming that PGP is good enough to > transfer OTPads, but not good enough to sign pseudononymous messages? Sure. Two different situations. If I take a message or a data tape and encrypt it with a one time pad. And then I send the message out to someone via Greyhound or DHL. And once they've confirmed that they have the encrypted message safely in hand, then I'll call them and ask them to call me with their public key delivered by voice via telephone. Which I then use to encrypt the one-time-pad, using the PGP key only once. Then, I'm comfortable sending it (not the message, but the pad) over the Internet encrypted with PGP. And I think at that point, I have Pretty Good Privacy. > Adam > > -- > "It is seldom that liberty of any kind is lost all at once." Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: key for Alice as promised (not) (fwd)
by Adam Shostack 17 Dec '03

17 Dec '03

>On Wed, 29 Nov 1995, Adam Shostack wrote: > >> > PGP is really not the issue. The issue is more my security and the >> > environment that I use PGP in. I don't have a trusted machine to run PGP >> Threat, please?? Do people often stand over your shoulder as >> you type? > >Yes. And you can't ask them to leave, as you send anonymous messages? Or does your whole office know your one of those who post to cypherpunks as Alice d' nonymouys? >> Have you considered putting the secret keyring >> on a floppy and locking it in your desk/safe when you're not actually >> in the office? (Or home..) > >Yep, I've considerred it. It's still not all that helpful. Cleaning >staff has plenty of time when I'm not around to deal with that. Of course, if the cleaning staff cut your safe open, you have a good indication of that in the morning. Not that you've demonstrated that the level of effort to do all of this at all equates to what is gained, namely, the ability to impersonate you. Which everyone in the world has today. >> > So, I don't fool myself, and I don't use PGP, except for things like >> > exchanging a one-time pad with someone when I've already sent the message >> > out across another delivery mechanism, like on a floppy delivered my >> > courier. >> >> I don't follow. You're claiming that PGP is good enough to >> transfer OTPads, but not good enough to sign pseudononymous messages? > >Sure. Two different situations. [...] >And once they've confirmed that they have the encrypted message safely in >hand, then I'll call them and ask them to call me with their public key >delivered by voice via telephone. >Which I then use to encrypt the one-time-pad, using the PGP key only once. > >Then, I'm comfortable sending it (not the message, but the pad) over the >Internet encrypted with PGP. And I think at that point, I have Pretty >Good Privacy. Of course, then your message only has 128 bits of security, because the Greyhound or DHL employee could be easily comprimised, as could the message in their office. So you encrypt the pad with IDEA, getting you IDEA level security, and think you're working with one time pads?? I'm flabbergasted.

1 0

Re: ecash lottery (Was: ecash casino)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:20 AM 11/30/95, Ian Goldberg wrote: >[Disclaimer: The following post is a gedanken experiment. It should not > be interpreted as condoning or encouraging anyone to break any > laws, no matter how stupid the laws are.] I, on the other hand, have no compunctions about "condoning or encouraging" various kinds of actions. When condoning and encouraging becomes criminal, I hope I'll be gone. (Wiseacres will cite hypos in which encouraging a crime, such as a rape, makes the encouragers culpable. A far cry from condoning and encouraging tax evasion, gambling, etc.) On to Ian's proposal: ... >Now: there's likely no Web-of-Trust to the various PGP keys involved, >so the lottery's Reputation will have to be built up. A good way to >do this is to have smaller prizes being won fairly often (e.g. by matching >the last digit/few bits), so that it's obvious the lottery is not just >collecting money without awarding prizes. Have to be _very_ careful here. A variety of scams can be developed which show lots of "small" winners, but which fail to show any large winners. The lottery operators can make a lot of extra bucks by simply not paying off the large winnings, in various ways. More robust protocols may be possible. In particular, I recall that Eric Hughes was working on something he called "encrypted open books." While banking was the obvious domain, it seems plausible that the same methodologies could be adapted for lotteries (some isomorphisms between accounts/balances and tickets/winnings?). I don't follow Ian's proposal in enough detail to comment on it, but thought I should point out the scams over nonpayment of winnings and the "encrypted open books" notions (from sometime in '93, as I recall). Personally, I have long had great _hopes_ for using crypto for non-sanctioned gambling, but I'm pretty skeptical that many people will do it. For one thing, anyone knowledgeable enough to be comfortable with the crytography knows that gambling when a house cut exists is a lose. (And gambling with no house cut is, at best, a wash.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: y2k as ideological opportunity
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Blanc wrot: >On the PBS daily economics news report the other day, and an economist was >warning that this y2k problem could lead to a recession (don't remember if >he said it would be mild or what). This is a possibility that the rest of >us ought prepare for (guess I'll have to see what Harry Brown has to say >about it). A recession? Say that 20 million people figure out that they don't have to pay their taxes. Those 20 million will stay wealthy. The 25 million people employed by the federal govt in some parasitic capacity or another will find themselves without enough money to go around. So, that means the FBI, DEA, BATF, Secret Service, Treasury and all the other heavily armed, officially sponsored gangs can't feed their habits. They look at their badges and weapons and they get hard-ons and decide to extort more money from the drug traders. Only now they want 50% instead of the 25% they take today. Net result: the street price of drugs will rise, causing more crime. It'll be anarchy in the streets. Look for Tim May carrying this sign: +--------------------+ | I Told You | | The End Was Near | | Seven Years Ago, | | Check The Archives | +---------++---------+ || || The only hope for America? Buy more drugs to keep the traders cash flowing. An artificial drug-induced happiness will descend upon the land, and we all reelect Gore in 2004, because we're STILL STUPID SHEEPLE. THE DRUGS WON'T HELP! Some things will never change. GangMongrel

1 0

RE: ecash lottery (Was: ecash casino)
by Pete Loshin 17 Dec '03

17 Dec '03

Ian Goldberg wrote: > >Here's an off-the-cuff idea: > >[Disclaimer: The following post is a gedanken experiment. It should not > be interpreted as condoning or encouraging anyone to break any > laws, no matter how stupid the laws are.] > >Anonymous email lotteries: [details deleted] >A lottery consists simply of displaying the winning number and random >noise, whose hash was previously posted (so the participants know >you're not cheating). Traditional illegal numbers rackets usually use some publicly available number so everyone knows it's all on the up and up (I used to know what the source for the winning numbers actually _is_, though I think it has something to do with the stock market, e.g., the last three digits of the number of oddlot trades, or something else that is usually essentially random. In any case, using such a "public" and daily number eliminates the problem of proving the game isn't fixed. -Pete Loshin pete(a)loshin.com

1 0

Because they want to be "players"
by Tim May 17 Dec '03

17 Dec '03

At 5:53 PM -0700 9/18/97, Declan McCullagh wrote: >But wait... The version of SAFE "as is" contains the ***FIRST EVER*** >domestic restrictions on encryption! Why should it be passed intact? For >the sake of Beltway politicking and deal-cutting? > >It includes very, very troubling severe criminal penalties for the use of >encryption in a crime. When encryption is in everything from light switches >to door knobs, any crime will include crypto, no? It would be like >criminalizing "breathing air in the commission of a crime..." Yes, SAFE is an evil bill. And anyone who supports the "use a cipher, go to prison" language (*) is guilty of a most serious crime. (* Some object to this slogan, saying that crypto use is not actually outlawed. Well, neither were guns outlawed when the billboards went up in California and other states: "Use a gun, go to prison." The meaning is clear.) >Why not just say "stop SAFE altogether?" No new laws are better than bad >new laws. And even if the crypto-in-a-crime provisions are yanked, SAFE may >be a bad bill. I wrote about this in June: Indeed, I also condemned it earlier this year. .... >Why are these organizations -- CDT, VTW, Wired, EFF, ATR -- urging it be >passed intact, as is? Why should Americans give up their rights so business >can make more money on encryption exports? > Because they want to be "players." And to be "players," they feel they have to get in their at the pork barrel and bargain away our rights. Fuck them all. They are all scum. (The ACLU is far from perfect, but I am gaining new respect for their absolutist stance on most civil liberties issues. I am assuming that the ACLU will not support the "speak in Spanish while committing a crime and get an extra 10 years" language? This, by the way, is what the "use a cipher" language is exactly parallel to.) --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: ecash lottery (Was: ecash casino)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:00 AM 11/30/95, Dr. Dimitri Vulis wrote: >iagoldbe(a)csclub.uwaterloo.ca (Ian Goldberg) writes: >> So; is there a problem with the implementation outlined above? > >What about the income tax on winnings? That's a good one! A bit subtle as humor, though. (For many of us, even most of us, the whole _attraction_ of such gambling schemes--to the extent any gambling scheme can ever be attractive to a rational person--is the tax avoidance. And any scheme that allows taxation of winnings, but not losses on individual bets, would kill this proposal dead.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Fertile ground for papers....
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:22 AM 11/30/95, Pete Loshin wrote: >In any case, using such a "public" and daily number >eliminates the problem of proving the game isn't fixed. Maybe. In passing, the whole field of cryptography is filled with interesting papers with titles like "How to toss a fair coin over the telephone" and "Avoiding double spenders in digital money systems." Meaning, how robust cryptographic protocols can be used to avoid scams familiar to the most junior grifter. The theme of "proving anonymous betting schemes are not fixed" is in the same vein, and could establish the reputation of any budding Amos Fiats or David Chaums out there. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0