December 2003 - cypherpunks-legacy

re: Re: Secret Clearance (was: re: NIST GAK export meeting, sv)
by Christopher Kleiman 17 Dec '03

17 Dec '03

Bill Stewart <stewarts(a)ix.netcom.com> said: >>BS> secret clearances are _expensive_, usually take a long time to get, >>BS> and the military only gives them to people who need them. > Strange, the military processed a SECRET clearance on me even >before I signed on the dotted line. Now a TS, that's expensive, but >they didn't have much on me other than my SSAN and, I think, my prints >to process the SECRET, so they couldn't have done much more than run be >through the FBI criminal database. >#include <disclaimer.h> /* Sten Drescher Actually, you filled out some paperwork when you signed up that was sent forward; it wasn't much more than a check against all of the govts "evil type people" databases. However, I understand that it depends on what Level of background check as well. A limited background investigation involves filling out a long form saying that you've been a good boy/girl; it goes up from there. "Civilians" are different from military as well; after all, in one they own you, in the other, you can actually go home at night.;-) ** Nothing I say can be held as the viewpoint of my employer; I'm a short-timer any, so I really don't care what they think! Chris **

1 0

Re: Still more on the Digicash protocol
by Hal 17 Dec '03

17 Dec '03

From: Mark Twain Ecash Support <support(a)marktwain.com> > Let us contemplate in which type of situation the payee will send such a > wildcard coin. To pay a shop via TCP? No. The payment request comes in with > the shop ID. The resulting payment won't be done with a wildcard coin. > > So when will the user pay with a wildcard coin? To make a payment to a party > that is (pseudo-) anonymous to the payor. That is, if the payor sends the > payment via anonymous remailer, in which case the messages should be > encrypted anyway. There might be some situations where it is useful to send a wildcard coin even via a TCP connection. For example, a pseudonymous server might pop up at some internet address different from its real one, make some transactions, and then go away. Or someone might set up an anonymous account at some public server (like c2.org) and conduct business anonymously on an ongoing basis. In either case the payee would be anonymous to the payor even though they communicated via TCP. The shop would have to send its payment request using "@" as the shop_accID field (I have heard of an undocumented "-X <payee>" switch in the Unix ecash program which allows the shop software to control this field in the payment request). We have also discussed the "pipe-net" which would allow anonymous TCP connections. This does not look like it can be as secure as the remailer net but for occasional or short-term use it can provide considerable privacy protection. I am glad that DigiCash supports this type of cash which anyone can deposit. Actually, I am surprised and puzzled that it does, given Chaum's apparent reluctance to endorse schemes to allow payee anonymity (due to political problems, apparently). It would be interesting to hear how DigiCash envisions this feature being used, and whether they plan to continue to allow it. Since it is not well documented (if at all) it's possible that they don't plan to keep it. But if they do, I think it would be good to adapt the protocols so this feature is usable over TCP connections. Hal

1 0

Re: Responding to Exon -- technology is not enough
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"Bill.Humphries(a)msn.fullfeed.com" 6-DEC-1995 20:16:17.29 >Anyone wish to comment on the prospect of a double blind server, set >outside U.S. borders, that can act as an interface to the rest of the >world, perhaps encrypting or stego'ing the data transfered between it and >the user? Basically, an anonymous remailer that acts as a cross between >an NNTP, POP3, and SMTP servers. ------------------------------ Encrypting data between the server and the user would probably not work very well, due to the lack of cryptographic knowledge among most users (_I_ don't know how to set up PGP for a VAX (even if I had the room to store it in my quota), and I have some interests in this stuff). However, something where someone did a standard http link in, typed in a destination, and got put there in a way that would look like the person was coming in from the server should work. For best bookmarking results, the added link should probably be inside the link that it looked to the user like they were on. For instance, http://www.anonserve.net/http/www.hotsex.com/ should bookmark properly, and be interpretable by the server as being a command to do a http link to that that web location. I am admittedly not that familiar with the root mechanism of the WWW, but I believe this would work. -Allen

1 0

Re: Still more on the Digicash protocol
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Thu, 7 Dec 1995, Mark Twain Ecash Support wrote: > >Anyhow, the obvious solution is encryption. Our new observation is > >that encrypting deposits & cancellations with the mint's public key > >is not enough to solve the problem. > [Argument in support of claim elided... I am not conviced.] I think he means you shouldn't use a stream cipher like RC4 that XORs the plaintext with the generated keystream, since if you know part of the plaintext, you can XOR those bytes with (the id you want) XOR (the id being sent) and change the encrypted data so that the payment goes into your account and not theirs. This is a tough, but potentially feasible attack if you use that kind of encryption scheme. Is there anywhere that you could use a similar attack on SSL ? Mark

1 0

Re: FW: websurfer 4.6
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

On 7 Dec 95 at 18:06, Enzo Michelangeli wrote: > On Sat, 2 Dec 1995, Michael Froomkin wrote: > > > so much for compatibility....guess I'm sticking with netscape > > for now. > > These guys at Netmanage's support seem to confuse Trumpet's > version number with the Winsock version... Trumpet 2.0b (as, > AFAIK, any other Winsock package presently available) is > Winsock 1.1 compliant. Not surprising. They confuse random doodling with software, too. The real problem with NetManage is a severe case of brain death. The Sampler TCP/IP sucks, the paid-up TCP/IP is so-so, but of the clients, only ftp is fair, and the rest bite. All the NetManage clients I've tried crater, Mail can't rebuild its index structures if they are corrupted (uh, what was it that rebuild was supposed to do, Harvey?), the version of WebSurfer I evaluated took longer and longer to load and shut down, revealed on inspection to be due to loading/storing a very wordy global history in its, ahem, config file! Delete it and your config is gone. I wouldn't concern myself with what crypto is or isn't in a NetManage product -- they are not players as far as I'm concerned. They've been riding the wave of their TCP/IP not crashing as often as some others, but otherwise they're vacuum packed, untouched by coherent human thought.

1 0

Re: 1)Age etc CA 2)Swedish Digicash
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"jk(a)digit.ee" "Jyri Kaljundi" 7-DEC-1995 12:45:37.27 What about Estonia :) The taxes are low, there are a very few government regulations, the currency is very stable (based on German mark) ... One interesting law in Estonia is that the state budget must be balanced, so there is no way for the government to spend more money than it really has. Technological level here is also quite good, and Internet is more popular than in any other Eastern Europe or ex-USSR country. I think Estonia is an ideal place for such projects: high-tech companies testing their new technological ideas, inventions and business assumptions in real-life conditions. Just get yourself here ! -------- The various Eastern European countries have been targeted before as banking secrecy (read tax haven in the Feds' opinion) countries. Some others might include Malta, although the Catholic influence there may make pornography-related ventures problematic. On the other hand, using Malta would make the conspiracy theorists go nuts... -Allen

1 0

Who Protects Us from the "Protectors?"
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

Who Protects Us from the "Protectors?" The Case of Father Ritter from Covenant House (and the Relevance to the Crypto/G.A.K. Debate) The issue of the need to "protect children" is used as a major attack on quality crypto. The "kiddie pornographers" are described as one of the "four horsemen" who will, we are told, hide behind the crypto. Yet a review of the character and activities (medically, psychotherapeutically, ethically) of the very child protectors shows a tendency for some to be involved in the very activities they are ostensibly opposing. Worse, the public reputations built not infrequently serve to shield the individuals against public investigation of their own sexual activities. Father Bruce Ritter, one founder of Covenant House, is an example. Covenant House was originally started in New York City and located in the 42nd St. Times Square "porn district." The announced purpose of the organization was to protect runaway youth, arriving in NYC at the nearby interstate bus station, from sexual and other predations by the Square's denizens. Ritter soon developed a national reputation as a leading child protector. He was, for example, appointed a member of the President's Commission on Pornography ("Meese Commission.") There was only one fly in the ointment: Fr. Ritter was sexually involved with the very youth he was "protecting." So Ritter's anti-sexual persona (no sex education, "just say 'no'," anti-condom distribution, anti-birth control, anti- abortion, clerical celibacy, anti-porn) covered his sexual practices. Ritter's fundraising to protect the children raised money for his hotel rooms. Worse, his public persona served to protect him as charges of his sexual proclivities surfaced. Ritter's supporters in the "save the children" coalitions did not investigate Ritter. They attacked the youth bringing charges against their saint. Some critics were charged with being fronts for the Times Square porn industry. Others had their honesty and their sanity questioned. Only when additional charges from additional youth surfaced and journalists "followed the money" trail did the true story of Ritter's sexual proclivities and masquerade develop. Critics of quality crypto and the internet demand that supporters of these things answer questions about what the supporters are doing to fight the "kiddie porn" forces. We should ask them the same question(s) about their own movement. Equally we should demand answers to the question of what they are doing to expose forces -- like Ritter -- who use the "protect the children" industry as camouflage for the very predations the industry ostensibly exists to fight.

1 0

Re: Inherent Insecurity of Internet Commerce! (was RE: SecretClearance)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"pete(a)loshin.com" "Pete Loshin" 7-DEC-1995 14:37:13.07 OK, I'll try again. First, as I recall, SECRET clearance is actually not very high: when I got it, I had to answer a bunch of questions (do you abuse illegal drugs? are you now or have you ever been a member of any organizations? have you ever been _arrested_ for anything?) ---------------------- I suspect I know what organizations they're interested in (CPUSA et al), but did they ask about any specific organizations? -Allen

1 0

Multiple questions
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello again cypherpunks: [In order to conserve bandwidth, I am going to ask for 5 things at once which have nothing to do with each-other in this post. Please reply to me privately if it's at all possible. <liberty(a)gate.net> ] 1. I have searched the archives for the author/artist of the "Rose on Random Bits" logo, and I have e-mailed many cypherpunks "old-timers" with no luck. [The logo appears at the top of the archives, but I am well aware that, as an anarchy, cypherpunks has no "official logo."] I have seen a number of beautiful logos during this search, but no- body has pointed me to the author of this particular logo. Any help finding this person would be _much_ appreciated. TIA. 2. I keep hearing every once-in-a-while about PGP3.0 (coming "real- soon-now") but there's nothing specific about what's delaying it. I would urge the developers (whoever they are) to release version 3.0 *before* the upcoming US presidential election, and I am interested in finding out more. TIA. 3. I have been asked by a Libertarian Party presidential candidate for a proposed platform plank in favor of strong, private, non-"GAK" encryption. [OK! I've stopped saying "FUCKED"!<g>] Of course, I want the maximum cypherpunk input possible, so feel free to suggest. The wording must *not* be too technical in nature and should (of course) condemn ITAR. <spit!> It should explain the real meaning of "escrow" and the "Newspeak" version in as few words as possible. TIA for any help on this. I'll post my final version if there's enough interest. 4. Has anyone in France been prosecuted for civilly-disobeying their anti-strong-crypto law by using PGP? What happened? Did the French people just roll over? TIA for any pointers (in English, please). 5. [A comment] Assuming the "secret clearance" requirement, how fast could an escrow agency be decertified if the "secret" person dies or is fired or heads for Anguilla, etc.? [Of course, I would not give a secret key to such a system, considering the effectiveness of simple attacks like "the honey trap" (ask Mordechai Vanunu how this attack works).] JMR - ---------------------------------------------------------------------- Regards, Jim Ray http://www.shopmiami.com/prs/jimray - ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 (key on homepage & servers) <liberty(a)gate.net> PGP encrypted mail enjoyed, even if it's _not_ "important." IANAL - ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or http://www.netresponse.com/zldf _______________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMMdHO21lp8bpvW01AQEZDgP9Hw8Ymf2zHMY59+TUE6N8+v+WHSeAXsQk Kg7j3Z5jWwPSZopVL2joXolW2t41vDbFEgr5eclweGJXHkLiJdnlPEwGhr+rtf/n dqv/m/o99kBf92D7nCME3nzMxJ1c4eQcGwFBjBZRvysQZ6PU/s0sSo5xqd5g2Qku icleREE+aVc= =4NSh -----END PGP SIGNATURE-----

1 0

Re: Solution for US/Foreign Software?
by jim bell 17 Dec '03

17 Dec '03

At 10:26 AM 12/7/95 -0600, you wrote: >jimbell(a)pacifier.com (jim bell) said: > >jb> 1. Write a program limited to keysize, carefully constructed to >jb> isolate those portions of the program which define key size, >jb> GAKedness, etc. > >jb> 2. Get it export approved. Export it. > >jb> THEN > >jb> 3. Announce that a "US-only" version of the same program is being >jb> released, and include the minimal component which replaces the >jb> limited software. Release it, only in the US of course! > > As has been pointed out, this would prolly doom geting export >approval for version 2.0. However, let's keep the developer/publisher >out of the loop. How about someone developing a 'binary diff', using >the functionality of nm to find subroutine entry points, and then doing >the binary diff from those starting points? Presumably, for most of the >program the diff would mostly be changed entry points, with the bulk of >diff being the crypto module. Then the bdiff gets exported, and >bpatch-ed into the export binary. Of course, this wouldn't work if they >strip the binary, but who is going to force them to do that? Okay, that was basically what I was suggesting. A full binary difference file wouldn't even need to have any information about the internals of the program anyway. Basically, what needs to be achieved is a way to allow the software manufacturer to sell an approved product outside the country, but allow the foreign buyer to (easily) convert it into a GOOD encryption product. Once that works, laws against the export of encryption are meaningless. In fact, the legally-exported program obviously wouldn't even need to HAVE encryption in it at all, so it won't fall under ITAR classification, and thus won't need any kind of export license.

1 0