December 2003 - cypherpunks-legacy

Re: Runtime info flow in Java
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"frantz(a)netcom.com" 24-MAY-1996 21:22:44.97 >A lot of the answer depends on what you mean by secure. For example, if >the Java run-time can successfully contain Java applets so they can't >access any of the unsecured portions of your OS, then it doesn't matter >that those OS holes exist as far as protection from the applets is >concerned. The proof that the Java run-time actually can do this >containment is left as an exercise for the student :-). This does, of course, depend on one's knowing where the holes in the OS are. The Java approach, at least by default, appears to be to shut all the places where they think a hole might be, while leaving open those which an applet practically has to use. (E.g., it shouldn't be possible under the current design for an untrusted applet to access the disk; since an applet does need to use the CPU, it can consume CPU time.) >We can use certificates (ref: SPKI) to implement network capabilities. >These certificates make statements of the form: The holder of the secret >key which corresponds to this public key is permitted these specific forms >of access to this specific resource on this location (e.g. a URL). These >certificates can act like capabilities. They can be passed by creating a >new certificate for the receiver which gives it the privileges implied by >the old certificate. They can be rescinded in any of a number of ways. I suppose that the new certificate is created through a message signed by the old certificate's private key? -Allen

1 0

Re: Children's Privacy Act
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"llurch(a)networking.stanford.edu" "Rich Graves" 24-MAY-1996 04:18:17.16 >I recognize that criminalizing the free flow of information is like trying >to stick your finger in a dike, but every little bit has an effect. In >this case, I'd call it a positive effect. That's funny, most people would call the German action to censor pro-nazi information a criminalization of the free flow of information with a positive effect. >I was certainly disappointed to hear a couple of cypherpunks the other day >discussing for-profit offshore data havens full of personal information >that is illegal to collect in the US as a business opportunity *they* were >interested in pursuing. I just can't see myself doing that, for anybody. >Gubmint or private, doesn't matter. Why, pray tell, _should_ someone be able to conceal that they declared bankrupcy - e.g., ran out on their debtors that they had freely contracted to repay - more than 7 years ago? Should prison terms to theft be limited to 7 years? Moreover, there are significant negative economic impacts for criminalizing the possession of such information. The above is one instance; another, which is even more of interest to me due to my profession, is that of genetic information and insurance. Genetic screening for insurance purposes decreases the risk to an insurance company. It is therefore possible to issue insurance with less of a pool backing it up (for claims in insurance, for bad debt in the case of credit). This increases the number of businesses who can get into a given market, which will decrease prices for insurance since the current insurance business is quite ogliopolistic. Thus, for the average individual the availablility of such information is beneficial. I would personally be interested in setting up some such business in the future, specifically one with a genetic screening lab. While I would not wish to devote my entire time to it, I would be quite willing to help with setup and updating it - if paid a fee, of course. -Allen

2 1

Re: Announcing CryptaPix 1.0
by jim bell 17 Dec '03

17 Dec '03

At 01:20 PM 5/24/96 CDT, Daniel R. Oelke wrote: >> NEW GRAPHICS VIEWER FOR WINDOWS RELEASED > >> What sets CryptaPix apart from ordinary viewers is its secure >> encryption feature utilizing the same technology found in Puffer >> 2.0. The encryption feature prevents unauthorized use of your >> personal image collection by requiring a password for access. >> Images are decrypted directly into memory for viewing. A secure >> wipe feature will permanently remove unwanted images from your >> disk drive. >> >[...more stuff deleted...] > >Expect to be hearing about this being a problem >with some child porn case real soon now... <sigh> > >However - I can see this becoming VERY popular with the >teenage crowd wanting to keep mom & dad out of their stash ;-) > >That being said - Thumbs up to Kent for another crypto program >that pushes the "genie" even farther out of the bottle. What they ought to do is to "stegofy" this system by binding a picture with a lower-quality, non-suspicious picture which can be brought up with a "duress code." Jim Bell jimbell(a)pacifier.com

1 0

Re: [SCARE]: "If you only knew what we know..."
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

I asked Peter Neumann, of the NRC commission whose report is due very very soon, and they did indeed get "The Briefing". He was very keen to have all appendices of the final report be public, we may get to see the story there. I am just on pins and needles waiting for the report. I thought, when it was announced, that in the year-and-a-half that it would take to write that the war would be won. It hasn't, of course. I think that the NRC report will define the landscape of the debate for the next year or so. We'll see. thad -- Thaddeus Beier thad(a)hammerhead.com Visual Effects Supervisor 408) 286-3376 Hammerhead Productions http://www.got.net/~thad

1 0

RE: Truth is equivalent to law?
by blanc 17 Dec '03

17 Dec '03

From: Jim Choate What you and others offer is a bipolar anthropocentic example of the schism our rapid technology has generated in our lives. ...................................................................... Well you may be right and this may be The Absolute Truth, but I'm not saying anymore because it's hurting my brain to think about it. .. Blanc

1 0

Re: Children's Privacy Act
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:15 AM 5/25/96, Declan B. McCullagh wrote: >But I tend to think of my (and individual) privacy rights as ones that >should receive greater attention than a businesses "privacy rights." If >they have mailing list info on me, I'd like to know where they got it. Well, I'd like a lot of things, but that doesn't mean I'm entitled to them. And I think the confusion between "business rights" and "individual rights" is part of the problem here. That is, I don't see any significant distinction, nor does the Constitution say anything about rights being different. At least not for the rights usually considered to be the central rights. Thus, there is not free speech for individuals, but not for the owner of a company. (There are many quibbles that can be made, about the alleged right of government to regulate business, interstate commerce, etc. And about the various laws that demonstrably apply to businesses, but not to individuals (OSHA, business taxes, etc.). And, regrettably, the government has placed limits on the advertising that companies--or presumably individuals--can do.) Not to sound rude to either Declan or Rich, but here's the bottom line: If I have compiled records, dossiers, etc., as I most assuredly have (got to fill up those MO disks with something), this is "my" information. Mine in the sense that others can't dictate to me what I do with it. What Rich or Declan "wants" is beside the point. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: An alternative to remailer shutdowns
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"unicorn(a)schloss.li" "Black Unicorn" 24-MAY-1996 11:44:01.40 >While a ski-lift ticket could be considered a "license" to use the >property, selling an actual intellectual property ITEM makes the limiting >terms of its purchase a bit easier for a court to stomach. Telling a >licensee that if he gets hurt its too bad, and telling one that he cannot >call a function or copy the work are fairly distinct in this way. Hmm... the first (license vs item) could be argued with by that the remailer operator _is_ sending the recipient a copyrighted work, which the remailer has - so far as it knows - been given proper permission to choose to transfer to the recipient. The second is more bothersome, and is an instance of the unfortunate overuse of liability in the American legal system. As you state, >In the practical world, the plaintiff who is trying to enforce a software >licensing agreement is much better off than a defendant trying to resist >liability for a tort. I would gather that countersuits for violation of a contract - that not to sue - would not be likely to succeed. Unfortunate. >That depends. If there was reason to believe, for instance, that the >message might indeed be four-horseman type (as a plaintiff's attorney I >would jump all over any messages which came from "soandso(a)PLO.com" or >somesuch) then negligence becomes an issue regardless. Perhaps the host >was the site from which other nastiness was mailed? Anything that could >be shown to put the operator on effective, implied, or constructive notice >that something was amiss. A clear reason for demanding that mail come from a recognized remailer before putting it to an output end. In this case, the ouputting remailer never has to worry about it - that's the job of the actual primary inputting remailer. >Remember, technical savvy judges are few and far between. Technical savvy >juries are nearly non-entitites. My concept of what is or is not >suspicious when it comes to such things is going to be much more >sophisticated than that of a judge or jury in most if not all cases. >This is an important point. >The truth of the matter is entirely pointless in the U.S. Judicial system. >The APPEARANCE of the matter is key. >'punks seem to forget this in all their discussion of what a court might >do because, simply put, they know more than 99% of the population about >the subject. The simple way to put this is that juries and, indeed, the voting population, are completely incompetent to be in power. This is always something that one should remember, and an excellent argument as to why democracy is not a good system of government. >From the recipiant? >I would simply put a notice of where complaints can be directed to, and >publish a stated (and carefully worded) policy for addressing abuses. >This will go a LONG way to insulating remailer operators. >"Your honor, my client has made every effort to filter the legitimate >users of his system from the illegitimate. He has a stated policy >regarding complaints and investigates them to the full extent of his >ability in every case in which a complaint is filed. Even as this is so, >he can no more completely assure that harassing messages will never slip >through than can the U.S. post office protect every citizen from mail >bombings." >Or some such. If you can say this in court and back it up, you're in >better shape. Would also doing a respond-back hold harmless agreement, of the form perhaps of: "We do our best to guarantee that this system will not be used illegitimately. Unfortunately, this is not always possible. By responding to this message and requesting us to send you the information in question, you are agreeing to hold us harmless." help any? Or would this be seen by the court as an attempt to reduce liability when the court (incorrectly) believes it should be assigned? -Allen

2 1

Re: Children's Privacy Act
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:36 AM 5/25/96, Rich Graves wrote: >I think forgiveness, within reason, tends to have a positive economic >effect. I'm not the same person I was seven years ago, or even seven >months. (Is it 7 years, btw? Or was it 12? It's arbitrary, in any case.) But "forgiveness" is highly personal. That you set your personal statute of limitations at X years does not mean others do. >I have no objection to allowing someone to become, and remain, a >productive member of society years after fucking up badly. Note there are >no statutes of limitations and no forgive-and-forget mandates for the more >heinous violent crimes. You are of course free to act on your beliefs and forgive such persons. I am of course free to remember what they did and not forgive them. Or, more likely, not give them a job, not lend them money, not enter into business dealings with them, etc. (The likeliest main application of data havens are for such things. Things like "rent deadbeats," credit data extending further back in time than the "Fair Credit Reporting Act" chooses to allow, data bases of bad doctors and lawyers, etc.) Like most laws "banning discrimination," the Fair Credit Reporting Act is a gross violation of freedoms. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: why is no one (apparently) worried about escrowed key length limits?
by Bill Stewart 17 Dec '03

17 Dec '03

Ernest Hua and several others have asked things like: >It appears that (from the responses I have gotten on why there are key >length limits at all on escrowed encryption) I am not forgetting >anything obvious. >So why is no one seriously questioning why this limit has to be there >for key escrow? >One suggestion was: the NSA does not completely trust key escrow. But >if the NSA (who should know all the inner secrets of it) cannot >completely trust key escrow, then why should WE trust key escrow? What the NSA can't trust isn't the key escrow itself - it's the ability of applications to work around the key escrow, so they get decent encryption without escrow. They also can't 100% trust escrow agents; maybe Cosa Nostra Key Escrow has an "accidental" disk crash that wipes out 5% of their clients' keys one week, and discovers that the backup tapes can't be read. Or terrorists who've been using Uncle Sam's Nephew Fred Key Escrow make him an offer he can't refuse, just as the FBI is closing in on the terrorist ring. It's for your own protection, after all! So they need to be able to crack it, just in case. Alternatively, they really Just Don't Get It. Or they hope that industry will get tired of arguing, and take the deal in return for export permission, figuring that they've got the upper hand so they don't need to fold early, while more and more vendors succumb to FUD and make deals like Lotus. <cynicism-mode +3> Or they _know_ that nobody likes it, and industry will refuse to cooperate yet again, so they'll go to Congress saying "OK, we've given the industry three _perfectly reasonable_ choices, and they're too stubborn and hostile to cooperate, so it's time to stop playing around and just make a new law whether they like it or not." # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: Remailers - What exists?
by um＠c2.org 17 Dec '03

17 Dec '03

>Which remailers can be run without root? >Which remailers can be run best on the most systems? >Which remailers are easiest to set up? I guess Mixmaster wins in all categories. -- `Der Staatsanwalt empfiehlt der Lufthansa, die Linie Moskau-Muenchen einzustellen, weil nicht sichergestellt werden kann, dass dort keine BND-Mitarbeiter Plutonium schmuggeln.'

2 1