December 2003 - cypherpunks-legacy

Re: [local] Report on Portland Cpunks meeting
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 16:40 1/23/96, Perry E. Metzger wrote: >Each person gets a sheet. Either each person in the room reads their >fingerprint in turn from their own copy, with each person in the room >checking the read fingerprint against the fingerprint on the handout, >or an appointed reader (or set of readers at the last IETF) read the >fingerprints in turn and ask the owner of the key to then simply say >"yes" or "its mine" or whatever to verify that the fingerprint matches >their own copy of the print. How do they verify that the person confirming the fingerprint is indeed the person supposedly owning the key? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 2

Re: NY State to restrinct netporn?!
by Deranged Mutant 17 Dec '03

17 Dec '03

You wrote: > I heard about it and want to search NY's gopher site for the bill to get > the exact wording. Did the article give any more specifics, i.e., who > proposed it, the specific name of the bill, etc.? Not much info in the article. It wasn't the central focus... actually, the article dealt with the political cynicism of the new measures. More from the article (all that really mentions the bill at all): The cyberspace bill, passed by the Senate last week, could make it a felony to have sexually explicit communication with a minor through a computer network, especially if the communication included pictures of sexual activity or an invitation to have sex. Which doesn't say much about the bills content. Technically this is already illegal, so why pass a cybespce-specific bill? What are the responsibilities of publishers, ISPs, SysAdmins, etc.? What if a minor pretentds not to be a minor? IMO, It sounds like another meaningless bill that looks good on political mailings... What's the NYS gopher address again? Rob. > At 07:23 AM 1/23/96 +0000, you wrote: > >This in today's LI Newsday, p. A6: > > > >Crime Time in Albany > >Bills Reflect now popular get-tough stance > > > >by Liam Pleven, Albany Bureau > > > > Albany - A bill that would restrict sexually explicit material on > >the Internet - which the Assembly took little notice of last year - > >is suddenly headed tothe governor's desk after winning legislative > >approval yesterday. > >... --- "Mutant" Rob <wlkngowl(a)unix.asb.com> Send a blank message with the subject "send pgp-key" (not in quotes) for a copy of my PGP key.

1 0

Re: DigiCash Ecash - 2 security topics
by iagoldbe＠calum.csclub.uwaterloo.ca 17 Dec '03

17 Dec '03

>> > E.g. has there been a DigiCash response to Ian Goldberg's >> > publication of a denial-of-service attack which operates by >> > spending a coin with the same serial number as your victim's >> > coin? >> After discussing things with Ian we came up with several solutions. >> One is encrypting more messages (which we will do in a next revision >> of the protocol), the other is enabling ecash to work over ssl >> servers. You may not see the answer directly in the list, but you >> will see it in the next protocol revision. Actually, my original suggestion was to include 'n' in the value encrypted in the bank's public key. The less we have to _rely_ on ecash-enabled apps having to do their own encryption (like SSL), the better. Of course, extra encryption is OK, too. I wonder if Dave and I will get Digicash's reward for this one... I still haven't seen anything from them (though various individuals keep promising), or from Netscape either, for that matter... [emoticon elided] - Ian "starving grad student (sigh)"

1 0

Your Majordomo request results
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Your request of Majordomo was: >>>> subscribe cypherpunks Succeeded. Your request of Majordomo was: >>>> end END OF COMMANDS

1 0

Re: Crippled Notes export encryption
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:29 AM 1/24/96, Jeff Weinstein wrote: > I suspect that to get around the US government in this way we >would have to develop the entire product outside of the US. That >would be a very drastic move that is not likely to happen any >time soon. We are going to invest some money and effort into >trying to get the current restrictions lifted first. For what it's worth, this is what I've heard several knowledgeable lawyers say is the case, that merely sending the crypto experts abroad is no solution, that the entire product (or some large fraction of it) must be foreign-originated. The usual issue: That if a foreign-originated product even appears to be a standard (so far, none have been), and includes strong crypto, then the NSA and other agencies will simply change the rules. Thus, if extremely strong crypto from "Netscape-Zurich" starts to have a significant market presense in the U.S., then some law will be passed to restrict it. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: Reporting ITAR Violations
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:07 AM 1/24/96 -0500, Futplex wrote: >I would feel a bit more comfortable if violations by non-anonymous entities >were well publicized. Otherwise, we may force the TLAs to cash in the >"weapons export" card against the anonymizers, and hasten a crackdown on >them. Would that the remailer network were significant enough to call forth a legislative response. DCF

1 0

Re: Philip Zimmermann and the Press
by jim bell 17 Dec '03

17 Dec '03

At 08:46 PM 1/23/96 -0500, Perry E. Metzger wrote: > >I contacted Phil about the neo-Nazi attribution in the British >press. He has apparently contacted the newspaper and it appears that >they are probably going to print an article retracting their >statement. I've asked him to comment here but I don't know if he will. > >Perry What _I_ want to see is NOT MERELY an apology and retraction, but ALSO a statement of where the hell this claim came from in the first place. WHY?

1 0

mouse droppings
by joee＠li.net 17 Dec '03

17 Dec '03

In the march '96 issue of macworld there's a "Viewpoint" reporting on the progress of the info superhighway. Privacy and security issues predominate the text, the primary source of which is larry irving --- "a top administration adviser on telecommunications." One issue, "mouse droppings" --- "a trail of every site they visit and for how long [on the www], was highlighted as an example of existing privacy regulations falling short of consumer expectations. Apparently, the amorphous public is shocked, *SHOCKED* I tell you , to discover that their service providers are selling the personal preference information to the highest bidder. More info in article. Would some rocket scientist speak to this terrifying mouse droppings issue? j. ercole <joee(a)li.net> ny, usa pgp public key at: http://www.li.net/~joee/autumn2.html $$$$$$$$$$$$$$$$********************&&&&&&&&&&&&&&&&& Stand By---.sig presently being unearthed in regression therapy.

3 3

Re: IPSEC == end of firewalls
by Frank Willoughby 17 Dec '03

17 Dec '03

While IP level security & authentication will go a long way to help prevent abuses and reduce unauthorized accesses, I doubt if it will provide enough protection by itself. While I would love to be proven wrong, I believe firewalls are here to stay (at least for the next year or two). A couple of reasons why: o Node Spoofing will probably still be possible o The connections will probably also be subject to man-in-the-middle attacks (Never underestimate the creativity of people who want to compromise your networks) o Authentication by itself will *not* provide adequate protection against many abuses o End-to-end encryption by itself won't completely solve the problems either (however, it *does* go a long way to prevent man-in-the-middle attacks o While IP security & authentication helps to secure the pipe between the two systems which want to communicate with each other, it does not provide any security about the applications running over the pipe. (ie - if you and I have a secure pipe between your system and mine & you have a worm running loose on your network, the only thing the secure pipe will do is ensure that other systems (not in the pipe) won't be damaged as the worm propagates out of your network into mine). Also. Which version of sendmail are we up to now? As far as the future of firewalls goes, I would probably guess that the functionality of most firewalls would eventually be an add-on application option for Operating Systems and that eventually it will be a standard part of every Operating System. Until then, we have to punt & keep using firewalls. I suspect even when firewalls are embedded in the O/S, that some type of firewall will still be needed to quasi-isolate a company's network from the Internet (and establish them as one entity) and to contain potential networking problems which arise when someone configures their system with the wrong IP address (or other type of problem). IMHO, the first company to include a firewall as a standard part of their Operating Systems has a real good shot at increasing their market share. Perhaps the O/S vendors are paying attention to this list & will implement this (would be nice). 8^) Of course, it would also help, if their systems were delivered secure - out-of-the-box and we didn't have to spend so much time continually locking them down & keeping up with the latest CERT Advisories. 8^) 8^) Best Regards, Frank Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.

4 3

"PRZ a nazi" to be retracted
by Philip Zimmermann 17 Dec '03

17 Dec '03

The Sunday Telegraph of London printed a story last Sunday about neo-nazis using PGP to encrypt their communications. The story said that PGP was devised by an American neo-nazi sympathizer. As the creator of PGP, and a human rights activist, I was outraged by such a defamation from a major newspaper. I called my lawyer Phil Dubois, who seemed to look forward to having some fun with this newspaper. Not wanting to wait around till the morning, and slow lawyers, I called Robin Gedye, the reporter in Bonn who wrote the story, at 7am Monday morning Bonn time, and woke him up at home. I introduced myself and told him how I felt about it. He had never heard of me, the Clipper chip, the controversies of cryptography, and knew nothing about PGP outside of the couple of sentences in his story that mentioned PGP. He said it wasn't really so bad, because he didn't specifically identify me by name. One can imagine the effectiveness of that excuse with me. I then went into some detail with him to bring him up to speed. I also called his editor in London, who also had never heard of me or PGP. After some checking, they discovered that the Daily Telegraph, a related newspaper, had run an article about my case just a week before. They also found about 20 recent articles on me in the UK press. The editor said that my story "checks out". It was good to know that they now believed that I was not a neo-nazi after all. Anyway, Mr. Gedye says that the Sunday Telegraph will print a retraction next Sunday. Not just a little retraction, but a whole article on the subject, written by Mr. Gedye himself. I'm glad to see that this probably means that he will dig into the subject more, in order to write such an article. I guess this means maybe I'll find some other things to occupy Phil Dubois's time. -Philip Zimmermann 23 Jan 96

1 0