December 2003 - cypherpunks-legacy

Q: Legal liability for Certification Authority
by Greg Rose 17 Dec '03

17 Dec '03

In the last few weeks, mostly under the subject of creating a Cypherpunks Certification Authority, someone mentioned legal liability of a CA if a certified identity was misused. I am looking for material to pass on to a REAL, PAID net-savvy lawyer relating to this question. In return for the money we pay him, he will return an opinion on just what liability exposure would be for, say, a large technical users group who got into the CA business for PGP keys. And/or what disclaimers or indemnities would be needed. I would be happy to make his legal opinion available to the list. IANAL, so I don't know just what precedents, decisions, regulations, and so on might be relevent. More information is always a good thing. Please: 1. reply to me by mail, not the list, unless there is more general relevence to Cypherpunks. I'll summarise. 2. Speculation is not useful. thanks, Greg. -- Greg Rose INTERNET: greg_rose(a)sydney.sterling.com Sterling Software VOICE: +61-2-9975 4777 FAX: +61-2-9975 2921 28 Rodborough Rd. http://www.sydney.sterling.com:8080/~ggr/ French's Forest 35 0A 79 7D 5E 21 8D 47 E3 53 75 66 AC FB D9 45 NSW 2086 Australia. co-mod sci.crypt.research, USENIX Director.

1 0

META: Lycos & Searchable archives
by Leslie Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Someone has expressed concern to me that the cypherpunks archives are searchable via Lycos. Said person doesn't mind having the archives searchable to the smaller audience of people who go to the we-site, but is unhappy about net-wide searches turning up cypherpunks articles. Can we try to find a consensus on this? My initial inclination was to shrug the concern off (properties of information, etc, as well as c'punks being a more-or-less anarchy and the express desire for some sort of searching mechanism for c'punks), but I thought I'd double check as I've been mostly out of touch for the better part of a year. - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBML1HiCoZzwIn1bdtAQEtjgF/d7GBzgELk41OE+/pZxnZkzn+qYLRHmTn 8mbScBdkko83n4sxGjwFRQJyN5IlPCJQ =nFDi -----END PGP SIGNATURE-----

2 1

Re: Netscape gives in to key escrow
by Jeff Hupp 17 Dec '03

17 Dec '03

On 30 Nov 95 at 13:30, Timothy C. May wrote: : At 7:26 PM 11/30/95, Ravi Pandya wrote: : >If you're looking for an alternative Web browser for Windows, we just made : >ours available for free at www.netmanage.com. It's fast and reliable, and : >supports HTML 3.0, inline video, software distribution, VRML (NT version), : >Real Audio, TrueSpeech, etc. : : This shows the price Netscape could pay for taking a pro-surveillance, : anti-privacy stance. : The word is getting out. Both brokers I have system support contracts with have called me asking for my take. -- JHupp(a)gensys.com |For PGP Public Key: http://gensys.com |finger jhupp(a)gensys.com Waking a person unnecessarily should not be considered a capital crime. For a first offence, that is

1 0

key escrow compromise
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

to most on the list, the subject of this message would be an oxymoron. ("there is no compromise!") regarding the recent Netscape brouhaha: I tend to agree with Clark in only one regard: the government is going to get into the key storage/retrieval business in some form or another eventually & inevitably; it's just not stoppable. like one of the NSA spooks said after the Clipper fiasco, "well, we had to try". the aspect that is up for grabs is whether these systems will be *mandatory* for all private communication. here's a quick idea. the post office is getting into certification authorization come hell or high water (ETA summer, 96). now, frankly I think this is a good thing. someday we will need some kind of legal agency to deal with citizen keys, so that we could have cryptographic dealings with federal agencies such as the motor vehicles department, etc. many are going to blast me to oblivion for saying this, though. but don't you think there are some benign government services that you would like to have access to via your "state" or "legal identity" key? this would prevent other people from faking your identity in front of the state, e.g. voter fraud, and other miscellaneous things. it seems to me the problem is when a government begins to insist that the only authorized encryption you can use must be based on the secret key they give you is where all the problems arise. so, what we could advocate as a compromise (given that the post office is absolutely not going to *not* get in this business, from what I can tell). we encourage the idea of KEY FREEDOM this would be a heading for the idea that we are in support of the (our) government creating cryptographic infrastructures and key authentication services, as long as we always have the total freedom to encrypt according to however we please in private communications. in other words, we are willing to have an official state identity/key as long as it is not required in our private transactions, only those involving the state. (yes of course I know "state" is a pornographic word here, heh). if you don't like this imagine it as a "stopgap measure" on the way toward full cryptoanarchic infocalypse that government bureacrats might buy. another idea is that we might reasonably support a system that has such a thing as "key escrow" but we only use the keys they give us as part of our signatures to other people if we want to reveal our "official" state identity, not to encode the communication itself. in this way someone else could verify your identity for e.g. legal/ contractual purposes, but the overall communication would remain private. in other words, we agree that the government does have the authority to link people to their "official numbers", but we have a choice about when to use those official numbers in any private communication, and by law businesses do not ever have to *require* authentication in this way. the numbers of course would be required in communication between the individual and government. the situation is that the government *now* requires that it knows who we are when we communicate with it in any official context. therefore I submit that the above system would not take away any rights, and in fact might lead to privacy advocates being able to use a massive government key-infrastructure but still retain communication privacy. in other words, you now have the government actually supporting your cryptographic freedom by giving you a massive "official" key distribution system you can use any way you like. another possible compromise is that by default, keys would be insecure, in the sense the government stores them for "key escrow" purposes, but people are always recognized as having the right as "tunneled encryption" (a great term for private encryption within the state encryption). you see, cypherpunks often recognize that most of the world is so clueless that they don't protect themselves, and they almost don't deserve to have privacy by the default if they are entirely clueless or apathetic about obtaining. so what we might be able to accomplish is a system in which all the clueless people use the government-supplied keys, the FBI cracks some percentage of "clueless" criminal communication, and non-clueless people go ahead and bypass it all. now, before you hotly flame my eyebrows off, I say these things not because I like key escrow, but that I suspect the post office is going to move into certification no matter what, and the idea of key escrow is closely related to that. with a little finetuning the cypherpunk position could help define the actual rights of individuals relative to these new government systems in a way that is totally compatible with all our core privacy beliefs. what I am getting at is that we could twist the words "key escrow" to mean that the government provides some infrastructure for storing & accessing public keys (similar to phone books), and we could simultaneously vehemently deny that "key escrow" legitimately allows the government to actually *have* our secret keys. in other words, we say, "yes we support key escrow. of course it is a good idea to let the government have simple phonebooks of keys. oh, wait, you mean we have to USE THESE KEYS? in the official STATE ENCRYPTION ALGORITHM? we have to STAMP OUR SSN# ON EVERY TRANSACTION WITH EVERY BUSINESS? sorry buster, what I do with my key is my private matter. this would be again to having official government phones that allowed the government to call any number and start surveilling the room the phone is in."

2 1

Re: Getting a copy of the Jim Clark speech
by loki＠obscura.com 17 Dec '03

17 Dec '03

If he has not clarified his position by tomorrow evening, I will set up some web pages explaining the situation and decrying Netscape's apparent position on key escrow (GAK). I have the quotes that L. McCarthy posted, and Jeff Weinstein's response. I have not been able to get the article off the server yet (possible all the cypherpunks downloading it?). Any other documents I should include? -Lance At 1:24 PM 11/30/95, Jim Gillogly wrote: >> Raph Levien <raph(a)c2.org> writes: >> I called Netscape public relations. Here's what I found out: > >> 1. Netscape PR does not keep transcripts, etc., of Jim Clark's speeches. >> 2. You can order a tape of the speech from Conference Copy for... > >Good initiative, but we needn't wait for 6 weeks to get a copy of it. >All that needs to happen is for Jim Clark to explain what he meant, if >it's different from what was reported. No need for all the to-ing and >fro-ing. > >Perhaps what he meant was simply reiterating the announcement of October >when they said they'd support the TESSERA crypto API. If it's worse than >this, he should explain what's going on. If not, October was the time to >get excited rather than now. > >Waiting with bated breath... > > Jim Gillogly > Highday, 10 Foreyule S.R. 1995, 21:24 ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: Netscape gives in to key escrow
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11/30/95 3:07 AM, Futplex quoted: >> http://www.cnet.com/Central/News/govt.html ... >--------------------------------------------- ... > said Clark. He added that an invincible security system for the Net is > possible, but such a system won't be built unless the government has a stake > in it. "That's where key escrow comes in," said Clark. >--------------------------------------------- "A stake in its heart," more like. Futplex then wrote: ... >Netscape's web pages. I hope they will at least have the courage to put out a >"We Support Clipper II" press release. Now the question is, how much of a >role does Netscape Communications intend to play in implementing GAK, and >what can we do to counter it ? Well, spamming the sign won't do. Aleph One's suggestion -- an NS-hack or "virus" -- doesn't make any sense: if Perry or someone would vet a hacked copy, I'd use it in a second. But hacking it would involve a violation of the license, so hacked versions couldn't be offered in any above-ground way: there'd be no way to certify a hacked copy with a trusted nym's key. Netscape is between a rock and a hard place: I think it's safe to say that, were all things equal, NS would support strong crypto. The fact that NS has decided otherwise suggests that some pressure was applied: Clark says as much. This leads me to believe that one possibly effective (and possibly dangerous) tactic might lie in a seriously sustained attack on NS's reputation -- keeping up a meme-drumbeat of "you can't trust Netscape, that's all, you'll get ripped off." I think we should try it -- TODAY, now, persistently and loudly, until NS comes around. I'm not saying that this'll be enough, but it's a start. TODAY. And I really don't care what it takes: calling cronies in the press, spreading innuendo, redoing NS icon sets so there's a spy from "Spy Versus Spy" loitering behind the N... I've seen some nice "NO Netscape" tags on GNU-related pages. Let's do it. Hieronymous FB DD B5 C8 FB F4 52 41 F0 0F A0 6E 99 43 75 06 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBML1vc73g0mNE55u1AQGfdgIAsldR3e9UQZG9//38B9LrU/HnCSzaY1kB RMOcBdab5EZ2X9BXkA7lIdDJUUqHOykuv1oyFDtitWRsXxmaTb0cuw== =0FmD -----END PGP SIGNATURE-----

2 1

Re: The future will be easy to use
by James A. Donald 17 Dec '03

17 Dec '03

On Mon, 27 Nov 1995, James A. Donald wrote: >> You are making the same erroneous assumption that Phil made when he >> designed the Web of trust: You assume that it is important and >> interesting to link key ID's to physical bodies. This is usually >> not the case: Linking key ID's to home web pages etc is not only >> easier -- it is also usually more interesting and important. At 02:46 PM 11/29/95 -0500, Jon Lasser wrote: >Not if you're encrypting a Credit Card transaction to ship physical >goods. In that case, I'm going to certainly want to link a key ID to a >physical body (or at least address) if I'm the seller, so as to limit >liability as best I can. Not at all: All you need to do is be able to prove you shipped to the address requested: You do not have to know what the relationship is between the address requested and identity paying you to ship. > However, if you have optional linking of ID and name, shippers will only > ship to keys with such attributes. Because just ID and address, it could > be a "hit and run" type attack shipped to a safe maildrop. This argument makes no sense at all: I am going to attack my enemies by paying people to send books, computers, and stuff to them? --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

9 9

Re: ecash lottery (Was: ecash casino)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"s1113645(a)tesla.cc.uottawa.ca" 30-NOV-1995 00:22:29.15 Isn't there also some Scandinavian bank that's handling ecash? It might be hard to explain to US tax authorities how large amounts of anon currency are ending up in one's marktwain account. In that case it might be ------------------- There are essentially two things that one can do with tax-suspicious ecash (or cash, for that matter). The first is to expend it in non-traceable, non-predictable ways. The second is to disguise it so it looks non-tax-suspicious. The first includes spending, of course. In regards to the non-predictible, I am meaning avoiding spending it for things such as groceries that someone can easily estimate a minimum bound for how much can be spent. Spending it to add quality (such as low-fat foods) to those groceries would be harder to prove. The first also includes charity and investment. Investment does have the problem that the income one gets out will have to then be treated by the same sort of process. The second will vary in method depending on one's individual skills and situation. However, I will note that it will be easier for those with independent earning skills- a self-owned business, for instance. I will note in regards to the above that while I have been doing some reading on the underground/black economy, I have not actually attempted any of the maneuvers discussed. Thus, what I say should be taken with at least a grain of salt. -Allen

1 0

nsa and netscape
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

The following came from a government source. I thought it might be of interest. Bob -------------------------------------------------------------------------- At yesterdays FNC (Federal Networking Council) meeting it was mentioned in passing that NSA has given Netscape a grant of $5 Million (yes $5M) to beef up the security features of Netscape. More info will be forthcoming on this.

5 4

Re: Netscape gives in to key escrow
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Thu, 30 Nov 1995, Mike McNally wrote: > Jeff Weinstein writes: > > have lots of stuff attributed to Jim, but very little of it is actual > > quotes. > > Well, if there was in fact a speech made from which the pseudo-quotes > in the article were taken, then surely the full text of that speech > will be made available somewhere for clarification. I read this article, and thought it to be quite a twist. It's suicidal from Netscape to say this. It's almost like a couple of stock promotions I was at yesterday at the Calgary Petroleum Club. Horrible nasty stuff. Suicidal speeches. Especially the one guy from Neutrino Resources (an Oil and Gas Company) who decided to explain what a Neutrino was before he started his "spiel" and talking about how great his company was and how cashflow wasn't a good measure of a company's worth. Netscape could well learn from that. (Unfortunately, I doubt that anyone was there.) People in these audiences DO listen. Press, investment analysts, and the like who do pepper the audience didn't all just fall off the turnip truck. Jim Clark, should have seen or heard this. If he did, then he might be a bit more careful with what he says ... but then again, I'm not sure how involved he is in daily operations. But nothing that Netscape does any longer surprises this writer ... look at how they handled the revelation back on Friday, October Thirteenth that the emperor's product had no clothes. Did they respond to the claims?? No. All they did was spam this list with noise "unofficially, not speaking for the company, but I work for Netscape" noise, and then continued distributing their product. Maybe these revelations will help to get the Netscape product pulled from people's machines, but I'm not gonna hold my breath on that one. The momentum which is behind their stock and product promotion now has a life of its own. Stopping Netscape (and the stock from advancing) is like trying to stop a steam-roller. But for now, I'm busy setting up an email account to allow people to send replies to me, and to settle this "reputation" stuff once and for all. I should be back to posting very soon. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E. > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > | Nobody's going to listen to you if you just | Mike McNally (m5(a)tivoli.com) | > | stand there and flap your arms like a fish. | Tivoli Systems, Austin TX | > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >

1 0