December 2003 - cypherpunks-legacy

Re: Leahy bill nightmare scenario?
by Gary Howland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Dan Weinstein writes: Dan says "you" wrote: > > Question: What, exactly, is the motivation of a person running an > > anonymous remailer? His motivation is clear: To allow people to > > send anonymously untraceable messages. Assuming he's of ordinary > > levels of intelligence or beyond, he is aware that somebody may some > > day use his system for illegal purposes. You're going to have to > > explain why a court _CAN'T_ interpret this as being in violation of > > the law. > > If I rent cars, someone might one day use a car rented from me in a > robbery. Does that make my an accessary? NO. This is an unfair analogy. Now if you had said that you rented cars without asking for proof of identification, thus making your car hire centre very useful to robbers, that may more closely resemble the anon-remailer situation. Gary - -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)kampai.euronet.nl> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06 - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMUQKsCoZzwIn1bdtAQFvMgF+M2YV6V31uBGswLkZtltCnwZ+Gwn3gavf 2KeYva5tb1+myr3plgxgXEvHe8wt3lXZ =vQMv -----END PGP SIGNATURE-----

1 0

Re: Remailer passphrases
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:51 PM 3/12/96 -0500, Perry E. Metzger wrote: >Bill Frantz writes: >> One of the reasons classical (government) crypto users change keys >> frequently is to minimize the amount of data compromised by a broken key. >> We keep hearing about NSA decrypting 20 year old cyphertext and showing >> more of the workings of the atomic spy rings operating in the 40s and 50s. >> If an opponent can rubber hose the key, her job is easy. If she has to >> perform cryptoanalysis, it is much harder. Remailers should regularly >> change their keys to avoid compromising previously recorded traffic. (They >> can have a long lived key for signing their traffic keys.) > >Signed Diffie-Hellman key exchanges have the property known as >"Perfect Forward Secrecy". Even if the opponent gets your public keys >it still will not decrypt any traffic for him at all -- it just lets >him pretend to be you. Thats one reason why protocols like Photuris >and Oakley use the technique. Unless I am badly mistaken, these exchanges need interaction, which makes them unsuitable for simple remailers. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

4 4

Re: What about PGP? (was Re: Leahy Bill a Move to Slow Crypto Exports as Much as Possible)
by shabbir＠vtw.org 17 Dec '03

17 Dec '03

Mutant Rob writes: >Timothy C. May wrote: >> I think this is showing that one of the intended purposes of the Leahy bill >> is to slow down exports of crypto for as long as possible, and then only to >> grant export licenses when competition from abroad threatens to undo the >> effects of the stalling process anyway. I think this is somewhat skewed. Let's look at our situation now: We don't get to export much crypto software. The Leahy bill takes us to: We get to export lots of software that is "generally available", "in the public domain or publicly available", or if similar products exist already in other countries. (That's a lot of stuff, but it's not the whole enchilada.) We want to be at: We get to export all crypto software. (I mean legally; I think we all know that export controls don't work against someone with enough brains to post news, send mail, or use ftp) This is a pretty good improvement in the situation, and will hopefully pave the way for the "whole enchilada". It's not good strategy though to criticize this because it's not the ultimate crypto bill. Let's be honest with ourselves here, this is Congress we're talking about and this is a pretty bold step. We need to educate them to see the facts we understand so thoroughly: that crypto export controls do not work, endanger our own requirements for confidentiality, and aren't helping contain this technology in the rest of the world. Forcing Congress to have this debate will lay bare these facts and hopefully embarass the Administration for their absurd policy approach on encryption. They say that liberty is seldom lost all at once, but a little at a time. Regaining it is probably done this way as well. In this case, the Leahy bill gives us back a mouthful. -S > >Hmmm. > >But what about the case of PGP? It's a relatively strong product, and >an international version exists. I'd guess that PGP 3.0 may implement >other algorithms (PK and symmetric), and likely an international PGP3 >would follow... so how could the Commerce Dept rationalize not giving >an export license to ViaCrypt? > >And would a similar, but non-compatible, utility that used RSA and/or >IDEA, 3DES, etc. also be exportable? ... > -Shabbir J. Safdar * Online Representative * Voters Telecomm. Watch (VTW) http://www.vtw.org/ * Defending Your Rights In Cyberspace

1 0

re: Video resolution
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

Note: this refers to the IBM PC & clones only > The point is that they do a lousy job on dithering. So does Microsoft > explorer. They probably purchased the identical code from some clot. Have been watching this go back and forth & get further from the original question as usual. I suspect that if the original poster looks in her/his/ its/other SYSTEM.INI file, the line "display.drv=vga.drv" will be found in the [boot] section. This is the default 16 color driver installed by Windows to be compatible with every 256k 640x480 VGA card. This makes a decent GIF or JPEG - even "64 gray scale" such as the QuickCam produces - look like olifactory solid waste products. To do better, you need three things: 1) A video card with higher resolution (usually at least 1 Mb of video memory is necessary). 2) A video monitor capable of supporting the card's output. 3) An increased resolution (at least 256 colors as the first responder mentioned) video driver to replace vga.drv (YMMV). If any of these are missing, see the second paragraph above. Warmly, Padgett ps the CDA does nothing to block really creative insults 8*).

1 0

TWP on Crypto Keys
by John Young 17 Dec '03

17 Dec '03

The Washington Post, March 11, 1996, p. A18. Security and Software [Editorial] The number of computer users continues to grow, but use of the Internet for business and financial transactions isn't keeping pace. At least, that's the complaint of many who expected a flood of Americans to go on-line for banking, publishing and mail-ordering -- with tremendous profits to the on-line industries that handle these services. One big reason for the lag is customer concern about the safety of information, from credit-card numbers to bank balances and business secrets, in the hacker-rich environment of the Internet -- an eminently reasonable concern that many in the industry believe can be addressed only by the wider use and availability of sophisticated "encryption software," which scrambles information en route, making it indecipherable to anyone who doesn't hold the key to the code. The sense that encryption technology holds the key to future economic growth on the Internet is pushing an arcane but intense argument between the Clinton administration and the computer industry over whether to lift existing restrictions on the export of the most powerful encryption software. The administration, especially its law enforcement agencies, bars on national security grounds the export of encryption software above a certain difficulty level, saying that it needs to be able, if neqessary, to seek and obtain the equivalent of a permit to wiretap. The makers of the software argue that these restrictions are ruinous for U.S. competitiveness in the international market because foreign customers want the most secure encryption available. Some civil liberties organizations argue that the restrictions are an invasion of customers' privacy rights. Legislation introduced this month in both the House and the Senate would ease the export restrictions while attempting to meet some of the government's security concerns. Code makers would deposit a "spare key" to any exported encryption software with a trusted third-party agency -- a compromise the Justice Department and national security agencies also have been pursuing in talks with the industry, but at which the industry hesitates because it fears that the existence of "spare keys lying around" would cause potential customers to balk. (The Justice Department also would like a spare-key agreement for encryption software sold domestically, but has less leverage because such sales require no license.) The legislation would heavily penalize any "key holder" agency that provides an unauthorized copy to anyone besides the government. But it also would make it legal to export any encryption technology that is already "generally available" -- for instance, in stores or on domestic computer bulletin boards. Such a sweeping change, law enforcement authorities fear, could render the other barriers and safeguards in the bill close to academic in the borderless, lightning-quick world of Internet transmission. Once it's widely available overseas, "uncrackable" software or hardware can't be recalled. The U.S. intelligence agencies with their superior computing power can still crack most coded software, if not immediately, then much faster than 99.9 percent of ordinary commercial hackers. But that doesn't mean their concerns should be shrugged off. Like arms sales, encryption technology sales have implications for traditional national security interests as well as the economic kind. The urgent interest both sides share is to get this resolved soon. [End]

1 0

Re: Vexatious Litigants (was: SurfWatch)
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- E. ALLEN SMITH wrote: > > From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 10-MAR-1996 04:29:37.67 > > >Presumably, almost nobody in Europe is going to add these silly Yankee > >rating labels to their web pages, except a few commercial content providers > >who want to sell advertising or services into markets that block > >un-rated web pages. So schoolkids behind rating-mandatory sites > >will have to ask their teachers why the "World-Wide-Web" is just American --- > >"It's got All 50 States, Johnny!" <Exonive deleted>! > > The WWW consortium is approaching European governments about their > rating system - the one found at SafeSurf. > -Allen Disclaimer: I don't work on PICS and I don't speak for the consortium. Actually the European govts are far more likely to see labels being used. In the US a piece of crackpot legislaion has been passed which has some clearly unconstitutional parts. The ban on abortion related speach for example which the justice dept isn't going to defend in any way. I expect that the Exon amendment will eventually be ruled unconstitutional through being overbroad. The problem is that it is difficult to get people to do something voluntarily after ordering them to do so and being overuled by the courts. This is the kind of small minded, foot stomping politics that the US congress is famous for worldwide. In Europe the governments tend to be more aware of their impotence. There is also much less hysteria about kids seing pornography, the main concern is violence and in particular amoral US TV shows for kids, the sort where people beat each other up but nobody ever gets hurt. In France one can buy hard core porn in the supermarket. The govt. is far more concerned about foreign language material. The whole point about PICs is that it is not bound to a single rating scheme. I had a go at producing a spec for a rating scheme back in '94 but gave up since life is too short to waste. The Web is decentralised and anyone can set up shop in it. Now we have a scheme in which anyone can set up a rating scheme. So we will have the kook brigade filtering out material on evolution and the concerned parents preventing their five year olds from viewing the alt.tv.very.scary gifs. Actually this is the main point of the exercise. I can't think of any system which is going to defeat determined 14+ kids from finding porn but its a bit easier to stop the 7 and unders from accidentially seeing stuff that will give them nightmares. Phill - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMURLKSoZzwIn1bdtAQGeWgGA0n4wmvgI8F4UspSxmWJ3Q9C2+LaxVPl7 xy+H0/0QN66VneWZg+h+pNZd3kmLdgOj =+z3H -----END PGP SIGNATURE-----

1 0

Leahy and Mrs. Bemmis (now that's a subject line)
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

First, would like to comment that some people do not like some of my beliefs. Tough. Do try to be honest and consistant about them. One of them is that while the US is imperfect, it is better than anything else I have seen (and have seen more than a few) and has the potential to remain great. Do believe in the "sovereign right of nations" to be a fact. Also believe in human rights personally but do not expect governments to agree merely because I say so. Some favor direct action. I prefer the "theater of the absurd" & have found that most people are able to recognize absurdity when they see it, particularly if carried to extreems. Most of life is absurd to those who are able to really enjoy it. The Leahy bill is flawed in two areas. Sent a message with proposed wording to Sen. Leahy via his web page but have not gotten a response. Have a bad habit of reading laws without thought since this is how LEA and prosecutors are told to enforce them - as written, not as believed. If an area is vague, a court is required to decide how to interpret it, not LEA. If badly written *everyone* loses. At the same time am pragmatic enough to accept the idea that it will have no effect unless it passes and to be passed today it must have something like the criminalization statement. The goal here should not be to throw it out since that would simply cause the whole bill to fail, but to word it carefully enough that it satisfies those who reguire laws while being narrow enough to avoid exploitation. IMNSHO the best way to do that is to require that: 1) A felony occured (curiously misdemeanors were ommitted) and 2) That the individual to be charged was an active participant (before, during, or after the fact) and 3) That encryption was used in furtherance. Note: that in the US (1) and (2) seem sufficient for a criminal charge to be brought, so does (3) really add anything except words or possibly severity ? Seizure seems to be a great concern of the group with the point of the Bemmis Pontiac being brought up. For someone providing a free remailer, that is a valid concern since the first question a court might ask is "what was the motivation". I suspect that someone providing a remailer and charging a reasonable fee to all who might want to use the service might be in a much better position (not a lawyer so not allowed to know). One indicator might be easy to check: Has there ever been a seizure involving a rental car (Hertz, Avis, etc.) and if so, what was the disposition ? Warmly, Padgett

1 0

noise levels
by Perry E. Metzger 17 Dec '03

17 Dec '03

Noise levels have been rising fast again. I encourage people to think about whether things are on topic before they post. Perry

1 0

Re: Fertilizer & fuel oil as cause for suspicion - similar to cryptography?
by Silcock, Stephen 17 Dec '03

17 Dec '03

On Friday 8th March Allen wrote: <quote> In the below article, the cops seem to be claiming that fuel oil, fertilizer, and bomb-making knowledge = illegal explosives possession. This idea doesn't make sense. Crypto relevance? An example of how governmental idiots are likely to take cryptography. -Allen ----------------- Copyright &copy 1996 Nando.net Copyright &copy 1996 The Associated Press CORVALLIS, Ore. (Mar 8, 1996 11:09 a.m. EST) -- Ingredients for a fertilizer bomb like the one that killed 169 people in Oklahoma City were found on a farm along with bomb-making instructions, guns and drugs, police said. Four people were arrested on weapons and drug charges. Charges involving illegal explosives were expected to be filed later, police Sgt. Dennis Carson said Thursday. Officers seized a large quantity of fuel oil and the fertilizer ammonium nitrate, two key ingredients in the April 19 Oklahoma City bombing. "My understanding is it could have made a large bomb and a rather large explosion had it been detonated," Carson said. "All they had to do was mix the parts. It would take just a few minutes." He wouldn't say how much fertilizer was found in the raid Wednesday night near this city about 80 miles south of Portland. The fertilizer, found in an 8,000-square-foot barn, was removed in a state police bomb-squad truck. Carson said investigators were trying to determine whether those arrested had plans to bomb a building or had ties to any anti-government groups. The federal Bureau of Alcohol Tobacco and Firearms is investigating. Along with the material for the fertilizer bomb, officers found 29 guns, including eight assault rifles, and material to make pipe bombs. Three ounces of marijuana and some methamphetamine were also found. [...] All were charged with drug possession and Luehring and the younger Bradley were also charged with being ex-convicts in possession of weapons. Carson didn't have details on their criminal past. [...] <unquote> I would be the first to admit that fertilizer and petrol are freely available and quite possibly innocent enough, but when the people involved are ex-convicts also in possession (apparently illegally; I don't know US law that well) of TWENTY-NINE firearms including EIGHT ASSAULT RIFLES, then I think police concern is quite reasonably warranted.

1 0

Re: Leahy bill nightmare scenario?
by jim bell 17 Dec '03

17 Dec '03

At 06:12 AM 3/11/96 -0500, Gary Howland wrote: >Dan Weinstein writes: >Dan says "you" wrote: >> > Question: What, exactly, is the motivation of a person running an >> > anonymous remailer? His motivation is clear: To allow people to >> > send anonymously untraceable messages. Assuming he's of ordinary >> > levels of intelligence or beyond, he is aware that somebody may some >> > day use his system for illegal purposes. You're going to have to >> > explain why a court _CAN'T_ interpret this as being in violation of >> > the law. >> >> If I rent cars, someone might one day use a car rented from me in a >> robbery. Does that make my an accessary? NO. > >This is an unfair analogy. Now if you had said that you rented cars >without asking for proof of identification, thus making your car hire >centre very useful to robbers, that may more closely resemble the >anon-remailer situation. >Gary Exactly! I'm glad you noticed, and commented. As you've noticed, I keep getting faulty reasoning from people who SHOULD know better. Analogies are extremely useful, but if they are poorly crafted, they do little more than show the limitations of their author.

1 0