December 2003 - cypherpunks-legacy

Re: e$ Signorage
by James Gleick 17 Dec '03

17 Dec '03

>I believe money which is never redeemed back at the bank is called >signorage in the currency biz. Whatever signorage *actually* is, Kawika >Daquio of the ABA (B for "Banking"), the Fed makes $20 billion a year on >it. Not much against a trillion dollar federal budget, but, hey, every >little bit helps... Seigniorage is actually the Government's interest income on all the currency in circulation. It's not obvious, but it's true, that the Fed collects the "float" on dollar bills you carry in your pocket, exactly as American Express collects the float on traveler's checks. And, I don't know, call me crazy, but $20 billion sounds like a lot of money to me. -- James Gleick gleick(a)around.com http://www.around.com

3 2

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 11:34 PM 4/3/96 -0800, Bill Stewart wrote: >>As usual, Unicorn is FOS. Not entirely in his facts, but in his >>conclusions. To "forbit third parties to reveal prosecution inquiries" is >>an obvious violation of freedom of speech, and in fact is PRIOR RESTRAINT. >>Maybe Unicorn can't see what's wrong with that, but I can. It is unclear >>whether this has ever been tested in court, or whether that test occurred >>recently. > >Black Unicorn is absolutely correct that this is generally the law. >Jim Bell is absolutely correct that laws like this are offensive and outrageous. >Unfortunately, Jim then rants at Unicorn for suggesting that this >would be the case; you'd think he'd be the first to realize that >there are laws out there that are offensive and outrageous and enforced. I really don't think you're giving me enough credit. I am fully aware that in the past, the organizations on which wire-tap-type subpoenas were served (primarily AT+T, "The phone company") were very cooperative with the police and probably "never" challenged the subpoena. There is the law, and there is the usual reaction to that law, and I expect that much of Unicorn's position is based on a (false) assumption that this reaction will necessarily continue unchanged. Besides, that phone company had a monopoly, so it wasn't possible for citizens to shop around for a phoneco that was known to make it hard for police. But that's changing, and that's my point. Now and in the future, it's going to be harder and harder for the police to get a bend-over-backwards level of cooperation, and in fact phonecos (and especially ISP's) might reasonably want to build up a reputation that they will defend a customer's security in court long before a wiretap is installed. Imaginative phonecos will find ways to inform the target legally, including naming the target as a non-hostile defendant in a court challenge to that wiretap, and noticing that target since he's now a party to a court action that must be noticed under civil procedure rules. In short, there is a drastic difference between blind obeisance and enthusiastic hostility, even if you exclude actions by the ISP or phoneco that would rise to the level of some crime. It is this difference which will change the previous ability of the police to get wiretaps done secretly. My point in the first paragraph that I am quoted in above is that many of the challenges that have never been made against wiretap subpoenas, due to a closer-than-arms-length relationship between the phoneco and the government, _will_ be challenged. Precedent, to the extent precedent exists, will be challenged on (among other things) the basis of the fact that this precedent was formulated during an era when essentially all telecommunications was monopolized and regulated, and there is no reason to believe that a previous telecom monopoly would have been diligent at protecting the rights of their captive customers against the interest of the government at that time. >>For example, if I ask my ISP to send me an anonymous, encrypted message with >>the word, "Rosebud" in it to me if he receives any requests to tap my >>connection, he can do so with no fear of being discovered, because no third >>party can decrypt the message, know who is is from, or know the real meaning >>of the word, "Rosebud" in the context of an encrypted, anonymized message. >>Further, since the whole thing is by pre-arrangement, even I cannot prove >>(to the satisfaction of a third party) that the message really meant what I >>would interpret it to mean. The message is useful to me, as a warning, but >>it could never turn around and "bite" the ISP. > >Now that's an interesting wrinkle to the problem. I suspect that, >as you suggest, there will be ISPs, especially in non-US jurisdictions, >that are willing to send out "Rosebud" messages to anonymous remailers, >or to fail to send "Remarque" messages, or to debit anonymous accounts >for data retrieval services rendered while also supporting billing-status >checking by anonymous remailers. From a crypto-anarchist dogmatic perspective, >it'll definitely happen, though there may be a rough transition until >there's enough critical mass to make it undetectable (and note that >"undetectable" is a tougher standard than "untraceable"...) I think we need to start challenging all the previously-assumed issues that have been interpretated to benefit the government. If my ISP has agreed, for instance, to send me daily certifications that he hasn't received any "official" inquiries about my account, and one day he receives such an inquiry and is forced to install some sort of a tap, it is hard for me to imagine what kind of legal precedent would allow (and, even, REQUIRE) him to continue to send false certifications when the alternative, simply failing to send any certifications whatever, is also "legal." (and, in fact, may be required under my contract with him, should he be obligated to do a tap or know one exists.) The fact that I'd likely interpret his failure to send those messages as meaning that my access is tapped is not within his control, and if he's unwilling to screw me I find it hard to believe that he can't act on this fact even if those actions have an indirect effect of alerting me. These are the kinds of issues that have either rarely or never been challenged in court, simply because the organization(s) that would normally do those challenges was in the hip pocket of government. It's going to be a brave new world very soon. Jim Bell jimbell(a)pacifier.com

3 4

Re: "Contempt" charges likely to increase
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:57 AM 4/5/96 -0800, Timothy C. May wrote: >If the secrets or assets _cannot_ be retrieved--a scenario which is >possible, if the protocol is so written (clauses for court action)--then >contempt charges are meaningless and would not stand, IMNALO. The Black Unicorn indicates that if the reason the secrets _cannot_ be retrieved is because they are in a jurisdiction which refuses to reveal them when the owner is under compulsion, the owner can still be punished for contempt (A contractual situation). I don't know what would happen if they _cannot_ be retrieved for technical reasons. If a communication key was aggreeded to be DH exchange and then discarded, I would think this would be analogous to asking for a document that was destroyed (before the subpoena) as part of a policy of destroying obsolete documents. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: e$ Signorage
by John Young 17 Dec '03

17 Dec '03

Perry is closest to Webster's Third New International Dictionary: ----- seigniorage or seignorage also seigneurage [ME seigneurage, fr. MF, right of the lord, esp. to coin money, fr. seigneur + age] 1: a government revenue derived from the manufacture of coins that is calculated in the U.S. as the difference between the monetary and the bullion value of the silver contained in silver coins disregarding any alloy metal, all the metals contained in minor coins (as teh nickel and the cent), or the silver bullion that is held as backing for silver certificates -- compare brassage. 2 archaic: Dominion, Power. ----- brassage 1: a charge made to an individual under a system of free coinage for the minting of any gold or silver he may bring to the mint and usu. calculated to cover various costs -- compare seigniorage. ----- Still, Jim Gleick seems to be citing a special extension of this general definition, wherein government capitalizes on its money-coining power to reap any ancillary benefit, such as the float on money transactions. Is it not likely that there are other seigniorages of running the public till, as Kawika Gaguio suggests, or even such as pleasurably performed a la droit du seigneur cited by Simon? Another definition of seigniorage is that of any means to generate benefits for the lord. Along that line, I wonder if governments might not apply brassage to E-money.

1 0

Re: unsubscrive
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:21 PM 4/5/96, robalo wrote: >unsubscrive * robalo(a)elogica.com.br > unsubscrive * robalo(a)elogica.com.br > unsubscrive * robalo(a)elogica.com.br Maybe these dweebs are posting from an alternate universe? A universe in which not even messages explaining that "unsubscrive," "unsuscribe," "undescribe," "unscribe," and "unimbibe" are not valid alternate spellings of "unsubscribe." I've copied my short explanation of how to subscribe and unsubcribe too many times to do it again; and it is clear that these folks are either doing this out of spite, are not reading any of the messages we send them, or think it funny. This may kill off the Cypherpunks list even where Detweiler's massive rants failed. (Now that Detweiler's cabin in Montana has been raided, and one of his tentacles carried off, who will fill his shoes? Vlad the VZNuri is well on his way to matching Detweiler's volume, if not his obsessiveness.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Was Cohen the first?
by tcmay＠got.net 17 Dec '03

17 Dec '03

Little CP relevance, except as re: a former (maybe current, but no longer actively participating) list member, so I'll be brief. At 4:24 PM 4/5/96, Michael Wilson wrote: >I ran across the following article, and it set me to wondering--did >Dr. Cohen actually publish on 'computer viruses' before anybody else? >He continues to use it as the bedrock of his reputation capital, so if >this pre-dates his 'seminal' article, please let me know. > >Included message: >For Liz Bass or Reg Gale >Discovery >9:31 AM Friday, April 5, 1996 >By Lou Dolinar > > This is still my favorite computer story. I'm not saying it was the first >piece ever written about computer viruses, but I won't say that it isn't. I >still have the original, dated April 16, 1985. In some ways I wish I hadn't ... Much work was done in the 70s on "worms," which are related to viruses. John Shoch (spelling may be wrong) at Xerox PARC developed a "worm" which propagated from machine to machine, circa 1974 (give or take a year). John Brunner immortalized this in "The Shockwave Rider," his 1975 novel in which uber-hacker Nickie Halflinger uses worms to disable Big Brother's panopticon network. Having said this, Fred Cohen deserves credit for seriously studying properties of replicating programs, including viruses. (And I believe he coined the term virus, and also showed how it differs from a worm.) I will make no particular claims about how _much_ credit he deserves, as this seems petty. Nearly all discoveries have precursors, of course. The work on worms clearly was a precursor. Also, general biological work on replicating patterns was already going on, and Richard Dawkins' "The Selfish Gene" had been published in the 1970s (and I believe the work on replicating information patterns--memes--was important). His views should be taken on their merits, not on whether or not he was the first to study viruses or replicating programs in general. As it happens, I find much of what Fred Cohen writes to be tedious and repetitive, but not because he has gotten "too much" credit for his early work. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

coderpunks questions
by Jack Mott 17 Dec '03

17 Dec '03

I am really into programming and the math involved in crypto, and could care less about the politics. I assume that coderpunks are more into that sort of thing. I have heard they are invitation only. How can I get an invite? -- thecrow(a)iconn.net "It can't rain all the time"

1 0

Re: Using crypt()
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:47 PM 4/4/96 -0400, Eric Eden <erice(a)internic.net> wrote: >I'm testing a encryption program that includes use of crypt(). Out of curiousity, why use crypt() instead of, say, MD5, which is stronger and allows arbitrarily long passphrase input? You could add a crypt()-like salt to it as well, if that helps. And just as crypt() lets you distinguish between input and output based on length and character set, if you use MD5, you know the output is 128 bits, rendered either as raw bits or 32 hexes depending on your program environment. With crypt(), for users who don't remember their passwords, you can run crack to try and recover them. This doesn't work, of course, if your stored "encrypted password" is really an unencrypted non-13-byte string which wouldn't ever be the output of crypt(). MD5, on the other hand, allows enough passphrase space that a brute force search would take much longer.

1 0

PICS required by law
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

What was I saying a while back about mandatory PICS through liability? As I recall, various people such as TCMay were saying that it wouldn't happen. Looks like I need to get out that article against PICS that I was working on and rewrite it a bit. I would remind people that PICS allows parents (or whoever else is holding the reins, such as an ISP - or the Chinese firewall) to filter on such content as material (including scientific studies) stating that a given illegal drug is not as harmful as some would claim, any idea futures market - even a simulated one, on homosexual content separately from heterosexual, and against criticisms of religions (such as Scientology). To their credit, the ACLU (in the CDA court case) has stated that they will not put a PICS rating on their web site, even if it contains "indecent" or allegedly "harmful to minors" material. I agree strongly with their position. -Allen Computer underground Digest Wed Mar 27, 1996 Volume 8 : Issue 25 ISSN 1004-042X [...] Date: Thu, 14 Mar 1996 11:47:33 -0800 From: telstar(a)WIRED.COM(--Todd Lappin-->) Subject: File 1--CONGRESS: Online Parental Control Act of 1996 [...] Maintains the Communications Act of 1934's legal defenses against liability for people who choose to give parents technology that: 1) blocks or restricts access to online materials deemed obscene or harmful to minors, and 2) restricts access to such materials through adult access codes or credit card numbers; Adds two new defenses: 1) the use of labeling or segregating systems to restrict access to online materials, such as systems developed using the standards designed by the Platform for Internet Content Selection project (PICS), and 2) the use of other systems that serve the same function of the other defenses if they are as reasonable, effective, and appropriate as blocking, adult access code, and labeling technologies; and Protects providers or users of interactive computer services, information content providers, and access software providers from civil or criminal liability under state law for making available to minors materials that are indecent or harmful to minors if they take actions to qualify for the defenses mentioned above. [...] PICS is a cross-industry working group assembled under the auspices of MIT's World Wide Web Consortium to develop an easy-to-use content labeling and selection platform that empowers people worldwide to selectively control online content they receive through personal computers. The Recreational Software Advisory Council recently announced that it will soon implement a detailed voluntary ratings system, using PICS standards, that will let computer users filter out varying degrees of sex, violence, nudity, and foul language. Companies and groups supporting PICS include Apple, America Online, AT&T, the Center for Democracy and Technology, CompuServe, IBM, France Telecom, Prodigy, Providence Systems/Parental Guidance, Surf Watch Software, and Time Warner Pathfinder.

2 1

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 12:37 PM 4/5/96 -0800, sameer(a)c2.org wrote: >> Where I differ with Mr. Bell is that he seems to think the ISPs of the >> world are going to rise and unite to quash the oppressive hand of big >> government at their own expense in order to satisify some sense of >> personal ethics or customer goodwill. >> > > I urge Mr. Bell to start a business of his own with that >model, and see how much fun he has. (Or, worded differently, how long >it takes for him to go bankrupt. Perhaps we can setup betting >pools. That could be fun.) By now, you've probably seen my comment to Unicorn, that ISP's could easily pool their resources, in a form of insurance, to guarantee that any test case will be fully litigated to ensure that a bad precedent isn't set. What if it cost a million dollars? That's only about 5 cents per American Internet user. You were saying about "going bankrupt"? Jim Bell jimbell(a)pacifier.com

2 1