December 2003 - cypherpunks-legacy

No Subject
by prmoyer＠magpage.com 17 Dec '03

17 Dec '03

Well, I'm discouraged. I'm looking for strongly encrypted cellular telephones, but I can't seem to find many. If you know of some, could you pass along some pointers for me? I would really like to avoid using a GAK enabled product, if there's any way to avoid it (even if it means paying lots of extra $$$). Cheers, Phil

1 0

Reply Blocks and Nyms: newbie question
by bruce＠aracnet.com 17 Dec '03

17 Dec '03

I'm almost certainly going to be changing my address in the next few weeks. I'd like to keep the same nym account. Can someone take a stab at explaining how to feed the relevant info to C2?

2 1

Re: The FV Problem = A Press Problem
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 9:28 PM 01/30/96, Timothy C. May wrote: >At 6:42 PM 1/30/96, Jonathan Rochkind wrote: [...] >>that allowed Bernays to do his thing. Bernays developed expertise in >>"engineering of consent" turned the news into a commercialized and > >Interesting term, similar to Chomsky's "Manufacturing Consent" (which >obviously must've come later...). Chomsky generally takes those terms like that from the (often truly scary) writings of others. "Manufacturing Consent", "Deterring Democracy," etc. I bet Bernays said 'manufacturing consent' at some point too, and this is where Chomsky got it. > [...] >Maybe I've from the old school, the school that says one should be more >modest, objective, and circumspect. Then, if it's really news, and not just >a PR scam, the journalists will come. One _should_ be, but the question is whether that's the way the media actually works. Now, clearly, with thousands of journalists all doing their own thing, no one model of the media is going to be all encompassing. Journalists all believe they are looking for real news, of course--but when it's so much (much, much) easier (and, equally importantly, less time-consuming) to get leads from press releases then from investigation... the key, of course, is for the press releases to convince the journalist that what they're talking about _is_ real news, and not just hype. I'm sure Garfinkel thinks that the FV story is "real news", and is grateful for the "alert" alerting him to it. Although, Borenstein says that the Garfinkel article came first in this case--but he probably just means before the FV 'alert', not before FV 'demonstrated' the issue with a program of their own, which was probably Garfinkel's lead. >I think that the view that "all news is hype" is overly harsh. In fact, >corrective forces tend to slow this headlong rush into P.R. For example, >the reaction here to the Nathaniel Borenstein/First Virtual hyperbole, and >the fatuous, credulous article by Simson Garfinkel (sorry, Simson, but I >call 'em as I see 'em), will undermine their credibility for a long time. >Crying wolf, and all that. It will undermine their credibility among cypherpunks for a long time, certainly. Maybe even among the net--but among the vast majority of the public? It's possible that as "among the net" grows to include increasingly more of the 'the public', things will change. But at present, I don't think things will have changed yet. The FV propaganda will probably net good results for FV, although not among cypherpunks. >The FV "discovery" that insecure machines can cause all sorts of problems >rated at most a brief paragraph in the papers, not the full-page treatment >Garfinkel and his editors gave it in the "San Jose Mercury News" (and maybe >other papers that picked it up, or will in the next few weeks). > >Newspapers and magazines that run "fluff" pieces, taken almost directly >from press releases, lose credibility. >[...] Most people aren't equipped with the knowledge to tell that this was a 'fluff' piece, not meriting a full page story. In fact, most people rely on newspapers themselves to make these sorts of determinations for them--what topics are seriously important and newsworthy, and what topics aren't. Which is why companies can be so succesful when they can use press releases to influences what shows up in the news. Generally, press releases aren't seen by the majority of the public, so they don't realize that a story is taken directly from a press release. Most papers use press releases to write stories--maybe not the NYT, but most local papers. And most people either don't realize it, or don't care. >>If you want to effect what's in the media, maybe you should learn how to >>issue press releases. > >Nope. I think it a very poor model for getting information out. With all >due respect to Sameer, who has done many fine things, I gag every time I >see a press release from Community Connection in which Sameer interviews >himself. > It's a poor model in the sense that it makes us cringe with their tackiness and phoniness, you're right. But the question is whether it _works_, and I suggest it does. The tacky and phony press releases get just enough editing from journalists to appear to be 'real' articles (although if one practices... I think I can spot the articles in the paper written more or less directly from P.R. with reasonable accuracy. ) The fact that there are lots of people payed a lot to do "public relations" is evidence of this, I think, as this is pretty much what 'public relations' is. As tacky and phony as press releases are, I'm glad Sameer writes them, because it's the way to get your issues (and often opinions) covered by the press. It's the way you play the system, unless the system changes. Maybe the system will change because of the Net--I hope so. But, as the net becomes huger and huger, most people will still have to pay others to filter out the good information for them (only the truly diehard can still read most usenet groups--or cypherpunks for that matter.) And odds are, it's newspaper-like organizations we'll be paying (many current newspapers are revisioning themselves in just such a role). And, as you identified in your first post, it's in the interests of both newspapers and commercial interests to continue the P.R. relationship. Whether it's in the intersets of the consuming public (or more importantly, I think, the polity--Bernays wasn't talking about what you buy at the supermarket when he discussed the engineering of consent) is more debatable.

1 0

Re: Random number generator question (& Las Vegas)
by baum＠apple.com 17 Dec '03

17 Dec '03

>>fair(a)clock.org ("Erik E. Fair" (Time Keeper)) writes: >>>does anyone know what sorts of random number generators those >>>electronic games use, and how (if at all) they are measured and regulated >>>by the Nevada Gaming Commission? They might have something to teach us. >>Several people who work in the industry said that electronic machines >>use some sort of PRNG, but with a nice added bit of random input - the >>player's timing of hitting the buttons. One poster described it as the >>machine constantly generating numbers, and choosing the payoff based >>on the last number generated when the user hit a button. According to a friend who started a company that is going to sell gambling machines to Las Vegas: The Nevada Gaming Commission closley regulates the RNGs. They use Chi squared tests and others to verify the randomness. They are not perfect. Todays slot machines use a Psudo RNG that requires a seed number to make sure it doesn't short cycle. They use some time based player input like coin in or handle pulls to pick a number. You must discard lots of numbers or it would be too easy to sync up and predict the answer. (basically confirming the above) Nothing is totally immune to tampering. The gaming commission tries to make sure the machines are reasonable secure. ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, MS/305-3B fax (408)974-0907 * * 1 Infinite Loop * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

1 0

Re: Lotus Notes
by Charlie_Kaufman/Iris.IRIS＠iris.com 17 Dec '03

17 Dec '03

I've been on the road since the RSA conference where the Notes crypto hack was announced. Sorry to have missed the fun. To answer at least some of the speculation on "how does it work", attached is a "Lotus Backgrounder" document that was distributed at the RSA conference. Some of the speculation in this group has had uncanny accuracy. I'd also like to defend the Notes R4 approach. I hate export controls more than most people, in part because I waste a lot of my time trying to figure out how best to deal with them. While I think Notes is doing the right thing given the current constraints, I can't help but be appalled by the current constraints. I don't believe 40-bit crypto is a joke. Even if it costs NSA $.25 to break a 40-bit RC4 key, and I'd speculate it costs them more than that, it means they can't afford to do keyword searches on every encrypted message they can afford to intercept (or at least they couldn't if everyone took the trouble to encrypt). And with a separate 40 bit key on each of your mail messages, an attacker may be able to break a few if he knows they are the good ones, but it's painful to browse. That said, I would not expect anyone to get much comfort from 40 bit crypto. The Notes R4 approach gives the best of two fairly unpleasant worlds. You can export crypto if you either limit yourself to 40 bits (which means anyone can see it if they want it badly enough) or give the government the keys (through escrow - which means the government and anyone else who can "break" the escrow mechanism can see your stuff with no work at all). Notes R4 gives the government part of the key, so they still have some work to do and other attackers have a lot of work to do. This is not a good solution. It's not even an acceptable solution. But it is a better solution than 40 bit crypto. And it's enough better that I think it was worth the hassle it took to get it. Notes R4 didn't give up anything to get this. It is expensive to have the technical complexity of two different interoperable versions of the product, and we could have said... gee, this is really good enough for everybody... why don't we just sell the "International Edition" everywhere? We didn't. The "North American Edition" (euphemistically named to reflect that it's also legal in Canada) still uses real strong crypto. The only valid criticism I've heard of the approach is by making the best of a bad situation, we've reduced the incentive for fundamental reform. That may be true, but once an approach is known (and we aren't the only ones to have thought of it - Adi Shamir's Partial Key Escrow proposal has similar properties), declining to use it does not fuel the pleas for legislative relief. In fact, it supports the argument that people don't even implement the strongest crypto they are allowed... why should they be allowed more? I think it is incumbent on all of us to do the best we can, for the brave to break the law and risk going to jail, for the wimpy to squeeze every last bit out of the allowed options, and for everyone to mouth off in risk-free forums like this one

1 0

Re: Lotus Notes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 19:19 1/30/96, Rich Salz wrote: >>I find this very interesting. RSA prohibits its licencees from using RSA >>software with truly secure keylenghts. > >Hunh? I could find no mention of keylength or keysize in the RSAREF >documents I had around. I'm at home now, but I also recall no mention >of keysize or keylength in the license OSF has, either. So from who did Lotus license RC4? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: The FV Problem = A Press Problem
by tcmay＠got.net 17 Dec '03

17 Dec '03

Jonathan has written a very nice essay, most of which I agree with fully. However, there is one item that I have a different angle on: At 12:41 AM 1/31/96, Jonathan Rochkind wrote: >It will undermine their credibility among cypherpunks for a long time, >certainly. Maybe even among the net--but among the vast majority of the >public? It's possible that as "among the net" grows to include >increasingly more of the 'the public', things will change. But at >present, I don't think things will have changed yet. The FV propaganda >will probably net good results for FV, although not among cypherpunks. .... >Most people aren't equipped with the knowledge to tell that this was a >'fluff' piece, not meriting a full page story. In fact, most people rely >on newspapers themselves to make these sorts of determinations for >them--what topics are seriously important and newsworthy, and what topics >aren't. Which is why companies can be so succesful when they can use press >releases to influences what shows up in the news. Generally, press >releases aren't seen by the majority of the public, so they don't realize >that a story is taken directly from a press release. Most papers use >press releases to write stories--maybe not the NYT, but most local papers. >And most people either don't realize it, or don't care. Here's my different angle on this: I'm not so sure there even _is_ a "public" on stories like this. Certainly my brother won't read about this, nor my sister, nor my parents, nor most of my neighbors. As with political stories that are read mostly by people interested in politics, I'm sure that most potential readers of the "First Virtual" story either skipped right past it or skimmed it lightly. No doubt the FUD of this story, and the FUD of earlier stories about Internet weaknesses, random number attacks, etc., left a vaguely feeling in these casual readers that all is not right with Internet commerce. But, having said this, I wouldn't underestimate the effects of a group such as ours lose respect for First Virtual, Nathaniel Borenstein, and Simson Garfinkel, to the extent we have. We'll be the sorts who keep the story going, who talk to other journalists, and who make decisions for our companies on what products and strategies to use. The "public" has probably already forgotten the story; we have not. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Kill this message too (FV NOISE NOISE NOISE)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

The size of my killfile has increased dramatically in the last couple of days. Can we start talking about something crypto related? --MegaBozo

1 0

No Subject
by Hroller Anonymous Remailer 17 Dec '03

17 Dec '03

Farce Virtual has discovered that some persons using the Internet are not using the names they were born with. We made this discovery in the wake of criticism of our discovery of keyboard sniffing programs, a major discovery we were able to get several reporters to write about. We consider our latest discovery to signal the imminent death of Usenet as we know it. We are taking the unusual step of announcing our discovery to the world, and in a simultaneous series of articles in major newspapers, to alert the world to our discovery. Farce Virtual provides the only reliable solution to this problem. We do not use in encryption, because many of our customers say it is too hard to understand. Instead, we rely on the oldest method in the book: fear, uncertainty, and doubt. We have invented a new term for this: FUD. ``Using the FUD Factor line of products, our customers are protected from those who are not using the names that God gave them,'' said Nathaniel Boringsternlight, Farce Virtual's chief publicist. Asked about women on the Net who are using their married names, Mr. Boringsternlight added, ``It was to deal with married women that I invented Safe-Tickle.'' No further explanation of this comment was offered. There's simply no other way to keep your sanity safe on the net. The program we have demonstrated completely undermines the sanity of all known users of the Internet. -------- Nathaniel Boringsternlight <nsb(a)fvh.fud> Chief Publicist, Farce Virtual Holdings FAQ & PGP key: nsb+faq(a)fvh.fud

1 0

Re: [Fwd: Netscape, CAs, and Verisign]
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:55 PM 1/29/96 -0500, Peter Williams wrote, in response to Alex: >>I'd like to see a less centralized CA that's tied into the existing system >>of notaries. The idea is to make it necessary to spoof a notary in order >>to spoof the CA. That won't make spoofing the CA impossible (nothing >>will), but it will make spoofing the CA illegal. ... >I dont understand how you intend to make CA spoofing illegal. Who >who perform the enforcement? (By illegal, I assume you mean that >there is a criminal offence involved, rather than a tort.) Is providing false documents to a notary criminal fraud, or only civil? >>Fees for the whole procedure ought to be less than $30. The CA ought to >>operate off of the fees from the agents as a non-profit organization, and >>the agents ought to keep the fees paid by the people requesting the >>certificates. >Notary fees might be best controlled by the notary, not the CA. >Seems an unreasonable restriction of trade to price-fix, even at the low-end. Notary fees can be agreed contractually between the notary and the CA; if they want to do a list price / street price system, or a non-profit, or a dog-eat-capitalist-running-dog competitive system, the market can let you pick your favorites. >There is indeed a large body of legal ramifications in this >area. The best way to learn about it is to become a CA and do it. Risk >taking is part of being in the CA business, however you operate it, >even for free. >>Morevover, although I don't think it's reasonable to expect Netscape to >>agree to include a non-existent CA in their browsers sight unseen, at the >>same time it doesn't seem smart to sink money into setting up the CA >>without some indication from Netscape that they're willing to give the >>idea good faith consideration. >Navigator betas seem to already facilitate users configuring their own >trust points in a manner rather similar to adding a key to your >personal PGP keyring. Letting the user decide whom to trust certainly seems like the best approach, and makes it possible to build a Web of Trust on top of Netscape rather than being stuck with hierarchical certifications. Meanwhile, if Netscape wants to sell the top two slots in their CA list to the highest-bidding advertiser like they do with searchers, they still can. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # http://www.idiom.com/~wcs

1 0