December 2003 - cypherpunks-legacy

[NOISE] Interesting statement by Alameda County DA
by John Young 17 Dec '03

17 Dec '03

Responding to msg by iang(a)cory.EECS.Berkeley.EDU (Ian Goldberg) on Tue, 21 Nov 1:50 PM >One of the speakers was Don Ingraham, Assistant >District Attorney, Alameda County. In responding to a >question from the audience, he said: > >"You're making a distinction between criminals and big >business. > That is not my experience." Assistant Devil's Angel Ingraham cites two out of three, the other is the omnipresent public safety racket -- his temp job in train to future peace by salubrious punishment of the other two overtense sinners. Often, a backlasher rep in one leads to a pretend- thrasher slot in the others. RICO, for instance, is an ingenious selective-caning law for flyswatting one conspirator by another but to not go so far as to bruise flesh and foreclose franchises for prosecutorial "shiatsu." This ancient soft-drubbing by one of the others is meant to conceal their common-origin ritual of corporeal writhings, manipulations, strokings, caresses and digitizers to debase from upright to bent to kneeling to prone succeeding down ladder, applying lubricants, linguants, unguents, balms, dental whiteners and body hair to head, to rest six under. Criminal, financial, legal -- indistinguishable from any other mortality-salving levitationism. -- From The One Outback Truth. > "Hey, Ian _said_ it was noise."

1 0

Proving I'm not Bob.
by s1113645＠tesla.cc.uottawa.ca 17 Dec '03

17 Dec '03

I had an idea for an advertising based net-payment scheme that has a particular security flaw making it totally untrustworthy unless it is possible to prove that you are not a particular person (the publisher receiving the ad money) when consuming (viewing or otherwise) the ads. All its other flaws seem to based on the same sort of identity denial problem. Damn! Any protocols, cryptographic or otherwise? TIA

5 5

Re: Pedophiles use encoding devices to make secret use of Internet
by Weld Pond 17 Dec '03

17 Dec '03

I guess they moved the URL. Try this one. http://www.nando.net/newsroom/ntn/info/112195/info429_4.html Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/ L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

1 0

Syrinx Remailer is no more
by skaplin＠mirage.skypoint.com 17 Dec '03

17 Dec '03

Effective immediately syrinx(a)c2.org is no more. I no longer have the time to keep this remailer up and running. Perhaps somewhere down the line I will set up another one. Please remove Syrinx from your chains. Sam

1 0

Re: PKZIP - Encryption
by L. DEkel 17 Dec '03

17 Dec '03

"L. DEkel" writes: >> PKZIP Encryption: >> >> PKZIP encryption is often said to be: Weak, "a joke" ,"a deception" etc. >> Maybe it's time to put things in the right perspective. >> >> One must realize (yet again) the difference between: >> Theoretical Cryptography - and - Practical Cryptography: "Perry E. Metzger" writes: > I could see why one would want to use a weak encryption system if it > bought you something. However, good encryption systems are as cheap to > use as bad ones. Therefore, why ever use a bad one? If the top of the > line lock costs the same amount as a toy lock, why buy a toy? Your remark is basically correct, here are few clarifications: I didn't recommended PKZIP for encryption, I said it's an Archiver that has an option to encrypt it's files, and that Practically this encryption is not so bad as people think. About costs: a complete system, including hardware, to support "full armor" for a computer, is far more expensive than using PKZIP, so the question is again of money, but that depends of what you're trying to encrypt. If you are a bank for example, it would make sense to spend several thousands on such a system, if you just send your friend a letter once in a while, containing a movies lists, than PKZIP is enough, you don't have do use say PGP. An good opposite example is PGP: you could define it as an Encrypter which has an archiving option (Of course it archives for the purpose of encryption), so why not use PGP as an archiver instead of PKZIP ? Because: There is the question of convenience (security=1/convenience - postulate), people don't like to pass their plaintext through several utils, where one compresses it, the other encrypts etc., they want a convenient util to use. But: Who says this old postulate (security=1/convenience) is correct today ? you can write a program/script/batch to do all sorts of dirty jobs, why not write a multi-purpose: compression/encryption/mailing/etc. system ? or just use a simple script/batch util to "glue" the different utils together ? Of course it has been done: (here are some examples) compression/encryption system - with HPACK archiver which uses PGP, the UC2 (PRO) archiver which uses 3DES. encryption/mailing(sometimes with compression) system - PEM, RIPEM etc. More problems there: These utils are not "standard" as yet, many people say they want a popular archiver where they know "everybody" use, and PKZIP is among the popular and multi-featured among the archivers, so why,they say, would they bother to adopt an esoteric encrypter or archiver ? The main problem: people are not "privacy protecting" oriented, they don't care too much about the subject. ("who will bother to crack this system just to read my mail ?") What do we do ? Educate them of course. That is why the spread of knowledge in the subject is so important. (Knowledge, not unsubstantiated rumors). All in all, there is no reason not to use a crypto system, if you think your privacy/safety are in danger. I claim that in this world of compromises, choosing PKZIP is not as bad as presented, knowledge should be passed to all user about the risks involving the use of one system or the other, but there is too much rumors that obscure the subject and can misguide a user, not versed in the field of cryptography. And if you "must", choose PKZIP (it is better encrypting then none, and better than some, like ARJ, but certainly not among the best). ,,,,,,,,,,,,, DEkel (noXys) '''''''''''''

2 1

Re: Design proposal: crypto-capable generic interface
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Wed, 22 Nov 1995 10:11:00 -0800 (PST) >From: Raph Levien <raph(a)c2.org> >Subject: Re: Design proposal: crypto-capable generic interface >Message-Id: <Pine.SUN.3.91.951122094209.29001A-100000(a)infinity.c2.org> > In restrospect, "daemon" was a poor choice of words to describe my >proposal. "Slave process" gets the idea across much better, I'm a great fan of programming by cooperating processes -- but I still worry when it comes to crypto. What we need to do, if we want real security, is hold all the crypto secrets (therefore the crypto itself) in a device (PCMCIA card?) in the physical posession of the user. The cooperating-process model could make that easier -- but, if designed wrong, it could call for the device to give up a secret to be sent by IPC over to the slave process. >> > This requires that >> >keys have some nonforgeable names, which is unfortunately not a >> >feature of PGP 2.6.2. S/MIME will do it just fine, if you buy into the >> >Certifcation Authority (<wink> at Nick Szabo). >> >> Public keys, if that's what you're talking about, have perfectly good >> nonforgeable names -- themselves. They are unique. They are the proper >> name which can collect all the attributes of that key which are of interest >> (e.g., permission to spend $, name of a human who knows the private key, >> attributes about that human, etc.). > > Ok. But public keys have one serious disadvantage: their size. [...] > I propose using the MD5 hash of the whitespace-free MOSS >representation of the public key, in hex. It's simple enough to be >described in one sentence, but does everything I want. That sounds fine -- but why deal with a text MOSS representation? It's the modulus which is unique -- so just hash the binary bytes of the modulus, MSB first. There's no need to force anyone checking a key to have all the MOSS printing software in the loop. You might also consider using SHA instead of MD5 -- but that adds to the character count on your business card. [I printed up my own business cards with PGP fingerprints for my 2 primary keys -- and it took up about 1/4 of the card, in a readable font.] > Note that PGP 2.6.2 does _not_ allow the use of a public key as the >name of a public key, unless you do a horrible hack such as replace the >pubring.pgp file with the one public key of interest. PGP keyring structures do use the key as its own name, I believe. The UserID is a separate entity, associated with the stand-alone key. A signature applies to a pair (UserID,Key). If I could change the PGP keyring structure, I'd add a new entity -- an Attribute block -- a string and my key ID, with a signature on the Attribute+ObjectKey. This can be done today with the UserID and signature -- and I've even tried it. It works, but PGP is used to accessing keys by the text in a UserID field and that's not appropriate. The Attribute would give a statement I'm prepared to stand by, giving testimony about the key being signed or the person who has demonstrated the ability to sign something I've verified with that key. We might need to add something like MOSS's aliases, for my use only, to let me access keys. If I know someone as Bobby -- that's an association in my own head -- not applicable to anyone else. When I access him by that alias, that's for my use. Therefore, only I should define it and only I should sign the association. This is what I'd use instead of PGP's UserID blocks -- alias blocks. I commend TIS/MOSS's aliases to people's study. The MOSS guys have used the alias structure not only to define nicknames of importance only to me but also to define crypto-lists (like mailing lists). Needless to say, the assignment of aliases needs to be protected. An attacker mustn't be allowed to slip a new alias and/or new key into your ring -- especially if it's a crypto-list definition. > Thanks for the suggestion. However, my concerns are with >implementation and deployment, not research. I am perfectly willing to >consider cryptographic algorithms to be black boxes that do what they say >they will. I think the charter exists to start a new list. John Gilmore >has already offered to start a "coderpunks" list on toad.com. Shall we >take him up on it? My suggestion is that if you want this limited in content, it'll have to be moderated. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)tis.com http://www.clark.net/pub/cme | |Trusted Information Systems, Inc. http://www.tis.com/ | |3060 Washington Road PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2| |Glenwood MD 21738 Tel:(301)854-6889 FAX:(301)854-5363 | +--------------------------------------------------------------------------+

2 1

Re: PROPOSAL: cypherpunks-news@toad.com? (was: rand-test)
by post＠txcc.net 17 Dec '03

17 Dec '03

At 01:28 PM 11/22/95 -0500, you wrote: > >A.Back(a)exeter.ac.uk writes: >> It is much more efficient of list bandwidth to post short pointers >> only, of the style John Young <jya(a)pipeline.com> posts. > >I agree with you. John's posts are not always strictly on topic but >they are always just pointers, and he typically posts them in a single >group a day. They are also always very high quality information. I >find them to be perfectly fine. > >The recent "Friend;" stuff just annoyed me, though. > >Perry > > I agree with you. Sid

1 0

Re: Spam the Sign!
by Jeff Simmons 17 Dec '03

17 Dec '03

> > > > I do what RSADSI does with ftp.rsa.com. It requires a cronjob > > and sed. I didn't get the NSA to approve it, but I figure if it's good > > enough for RSADSI it's good enough for me. > > Do you have a legal opinion to support this statement? Our lawyers > tell us that executives of netscape could go to jail if we make the > 128bit version of netscape available from an "export controlled" > ftp or http server. We are working to clarify the situation with > the government or figure out an alternative distribution scheme that > will remove us from the grey area. > > Getting the US version of netscape widely available is one of my > highest priorities, but I can't tell Barksdale that he should go to > jail over it. I'm constantly pushing from within the company to keep > things moving forward. Actually ;-) Barksdale going to jail would probably advance the cause of strong cryptography more than anything I can think of. Can you imagine the media circus when he's led out the door in handcuffs? A man worth somewhere around a billion dollars being arrested for trying to give away his product? Court reporters trying to explain ITAR to the public? The mind boggles. ... and he looked over at me and said, "What are ya in for?" and I said, "Giving away free software," and they all moved away from me on the bench ... You guys didn't get to where you are now waiting around for HTML v3.0 to be approved. There must be some way to challenge an attempt to use ITAR to stop the DOMESTIC spread of strong crypto that doesn't involve the incarceration of your top executives ... -- Jeff Simmons jsimmons(a)goblin.punk.net

1 0

Re: Junk E-Mail
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, People are complaining about junk mail. No problem... 11 21 95 The Electronic Telegraph reports: THE European Parliament will decide today whether to ban junk mail. Euro MPs are also considering whether to outlaw credit card transactions by phone and whether direct selling via E-mail should be curbed. Today's vote has been triggered by proposals from the European Commission to protect consumers buying goods without seeing them. Your complaints are highly valued at Minute Mortuary at 2d & Main, which advertises "Privacy Knows No Limits." Cordially, Jim NOTE. The Electronic Telegraph website's URL: http://www.telegraph.co.uk The newsstory's headline: Junk mail faces last post Its online filename: wjunk21.html

1 0

Re: Junk E-Mail - Part 2
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, People are complaining about junk mail now. Wait until they find out what real JUNK mail is... 11 21 95 Associated Press reports: To make electronic mail as universally available in the United States as telephones, the federal government and business would need to work together, the [RAND] report said. RAND is known for generating options, but... ...the study recommended using public funding.... The government --I mean, RAND-- isn't too happy about people owning their own computers: As a way to reach people who don't own computers, the study recommended that terminals be located in public places -- street corners, community centers, libraries, hotels -- just as pay phones are, so people can send and receive electronic messages. What if people find out that this "private study," as AP calls it, is really JUNK mail from Joint Underhanded 'Net Kill-off? Cordially, Jim NOTE. The NandO News website's URL: http://www.nando.net The newsstory's head- and datelines: Study: Every American should have mailbox in cyberspace WASHINGTON (Nov 21, 1995 - 11:01 EST) Its online filename: nation611_4.html

1 0