December 2003 - cypherpunks-legacy

Re: Net and Terrorism.
by jim bell 17 Dec '03

17 Dec '03

At 07:29 AM 7/5/96 -0700, Timothy C. May wrote: >At 2:37 AM 7/5/96, vinnie moscaritolo wrote: > >>>There is no cure for the "revolutionary" terrorists .. >>> If we do not even print their obit, there is no glory! >> >>Tim, you are asking for the liberal media to act responsibly.. what were >>you thinking? > >I did not write that. > >However, I wouldn't think that "not printing their obit" is acting >responsibly. As far as I'm concerned, I want the full news, or at least >some reasonable approximation of it, not propaganda. >--Tim May Well, whoever wrote those two lines above, he hit upon something I've long believed: The ability to force other people to (in effect) ignore dissent up to and including "terrorism" is extraordinarily valuable. Remember the old philosophical question, "If a tree falls in the forest and there's nobody there to hear, does it make a sound?" Scientifically, the answer's obvious. But _politically_ it isn't so obvious: If an act of "terrorism" occurs and the government can cover it up (or merely cover up the terroristic cause), the government is probably actually better off (considering _only_ the government's own interests) ignoring it and not exposing an embarrassing vulnerability, or possibly an embarrassing guilt, which induced the terrorist to attack. The government would probably have much preferred, for example, for 160+ people to be killed in an airliner that just happened to disappear off the radar screen and fall into the ocean, than the bombing in Oklahoma City, because the latter incident puts a powerful onus on the government to "do something" while an unexplained event (or one where the cause is covered up) has no such imperative. And I'm not talking primarily of retribution or punishment, either: Today, the government's under some pressure to simply stop doing things that would be expected to lead to retribution, like Waco and Ruby Ridge, and the government's misbehavior is highlighted by incidents such as the OKC bombing. In addition, a potential "terrorist" is less likely to try something if the government is likely to be able to cover it up. Ironically, this probably tends to induce such people to do things (like huge bombings) which _can't_ be covered up, rather than smaller, more individualized strikes. That makes the non-governmental public less safe, which is a serious conflict of interest between the government and the citizenry. I consider it axiomatic that whoever bombed the OKC building, he would have preferred killing one to two dozen people most responsible for Waco or Ruby Ridge than those who actually died. The public has every reason to prefer this alterative as well. The only people who can be expected to disapprove are government employees, who don't want to be held responsible (legally or "illegally") for what they did. If anything, I think the public would be far better off if there was a mechanism to allow even these "terrorists" to speak directly to the public, without censorship by the governments or heightened risk of capture. Jim Bell jimbell(a)pacifier.com

2 1

Re: Word lists for passphrases
by Erik E. Fair 17 Dec '03

17 Dec '03

You could just snarf up a week's worth of netnews... Erik

2 1

Re: SAFE Forum--some comments
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 08:44 PM 7/2/96 -0700, Martin Minow wrote: >It's not quite that bad. Here are a few (more or less strong) crypto >products you might not know you have: > >1. Every Macintosh made since at least 1988 has a secure authentication > client module in the AppleShare Chooser dialog. When you use it to > connect to a remote server, it notes that the user information > is "two-way scrambled." (The server sends a random number challenge > that the client uses to encrypt the username and password. The > encrypted information is sent to the server.) All Macintosh systems > running System 7 or later have the corresponding server software. > What is interesting about this is that the encryption is completely > invisible to the user. I hear this as the server sends out a key which the client uses to encrypt the username/password. This algorithm makes less sense than the one I thought I heard at the SAFE forum on Monday which was: (1) The server sends out a challenge/salt (different each time) (2) The client uses a secure hash to compute hash(salt||password) and returns the username and the hash. (3) The server computes hash(salt||password) and compares the hashes. Given that there is still some interest in algorithms and protocols on this list, can you describe what is really happening? Thanks - Bill ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

2 1

Re: Restrictions on crypto overseas
by sameer 17 Dec '03

17 Dec '03

In many countries there are none. France is pretty bad. > Greetings. > > I am looking for a concise description of the restrictions overseas on the > use of cryptography, and how those restrictions affect the operation of a > cryptographically-enabled web server. > > I have been told that users of programs like PGP in france are required by > law to register their secret keys with the state security apparatus. Does > this mean that users of secure web servers need to register their secret > keys as well? Is anybody doing this? Is the law enforced? > > What about other nations that have recently passed restrictions on the use > of crypto? Other than Russia, which are they? Is there a list anywhere? > > Thanks. > > > ====== > Simson's Summer Info: > > Mailing: 304 Newbury Street, #503, Boston, MA 02115. 617-876-6111 > Summer Salon: 236 Marlborough St. #2 Boston MA 02116. > > -- Sameer Parekh Voice: 510-986-8770 Community ConneXion, Inc. FAX: 510-986-8777 The Internet Privacy Provider http://www.c2.net/ sameer(a)c2.net

2 1

Re: What remains to be done.
by Deranged Mutant 17 Dec '03

17 Dec '03

Another need is for file/disk-encryption utilities. I'm not familiar with what's out there for Macs, but for PCs there's SFS and ASPICRYP for SCSI drives (with no source!) and SFS, SecureDrive and SecureDevice for HD (or FD). The latter won't work on Win95. AFAIK, SFS and SecureDrive aren't 100% friendly with Win95 either, though they'll work. There's a need for something that will work under Win95, WinNT, and/or OS/2 for encrypting partitions. Aside from a few commercial or shareware apps which use some variant of DES, there's little out there. (One problem is that DD kits for Win95/NT and OS/2 cost $$$.) Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

3 3

Re: SAFE forum -- remarks of Herb Lin
by Herb Lin 17 Dec '03

17 Dec '03

You're entitled to any spin you wish (see your [...] below). But my original intent was to say the part about "and it is" in any event; unfortunately, the audience started snickering before I got to it. In the future, I will say "Crime prevention ought to be, and is, a part of the FBI's mission", thereby pre-empting premature snickering by an audience pre-disposed to be unfriendly or derisive to law enforcement. Begin personal comment from herb: The "overview and recommendations" document summarizing the report notes that "Input from [..] diverse sources demonstrated to the committee a considerable amount of confrontation and disconnect between interest groups (e.g., information technology vendors, businesses, law enforcement, private individuals, national security) that fail to understand or appreciate the validity of each other's policy needs and interests with respect to cryptography. . . . Public debate based on hyperbole is unproductive. All of the stakes described above -- privacy for individuals, protection of sensitive or proprietary information for businesses, ensuring the continuing reliability and integrity of nationally critical information systems and networks, law enforcement access to stored and communicated information for purposes of investigating and prosecuting crime, and national security access to information stored or communicated by foreign powers or other entities and organizations whose interests and intentions are relevant to the national security and the foreign policy interests of the United Statesare legitimate; informed public discussion of the issues must begin by acknowledging the legitimacy both of information security for law-abiding individuals and businesses and of information gathering for law enforcement and national security purposes." My experience with the FBI and other law enforcement officials is that they are honorable people trying to do a very hard job. You may disagree with them on policy grounds -- indeed, the NRC report does disagree with the Administration in certain important ways -- but in my personal opinion, law enforcement deserves credit rather than censure for trying to anticipate a future problem, You may believe the proposed solution to be inappropriate, but I'd ask those of you who follow the debate to engage it on substantive rather than ad hominem grounds, Many of you in the cypherpunk community have done so, and I applaud such efforts. [End personal comment] herb == On Wed, 3 Jul 1996, Herb Lin wrote: > Folks -- I object to the characterization of my remarks about crime prevention > being made with sarcasm. The complete remark was "Crime prevention ought > to be part of the FBI's mission, ... and it is -- ask them, and they acknowledge > that." OK, sorry, my reading. I'd certainly hate to jeopardize any professional relationships by implying that you'd been poking fun at them on purpose. There's already far too much distrust to go around. As I recall, the sequence went "Crime prevention ought to be part of the FBI's mission [audience snickers, Herb realizes what he just said and smiles]... and it is -- ask them, and they acknowledge that." The best standup comics are the genuine straight men, I guess. To avoid any trouble, I'll be using that line *without* specific attribution from now on. -rich

2 1

Re: Opiated file systems
by Deranged Mutant 17 Dec '03

17 Dec '03

A problem with a c'punk-style encrypted fs with source code and wide distribution is, of course, that attackers will KNOW that there is a duress key. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

4 3

Gorelick GAKs away on CSPAN2
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I managed to miss seeing the Deputy Attorney General, whose name I will resist [with great effort] making a very tasteless joke about, but I've decided to briefly delurk to ask a question I have wondered about for some time: Who (an *individual's name*, not a department, please) came up with my unfavorite Orwellian-term, "key escrow"? I think it was likely a Bush administration official, and probably an attorney [ie. should have known better]. I am, as many of you know, trying to redefine the terms of the debate to our favored term, "GAK" -- although I must say the temptation was strong to try for "Federal Usurpation of Crypto Keys [etc.]" but I feel it's important to try to keep the debate polite until they reach the "cold, dead neurons" stage... Anyway, I assume this Bush administration official, like David Kessler, <spit!> is still a government employee -- and I would very much like to write a polite (believe it or not) letter to him or her, concerning the origin of the term. I will, of course, report back to the list if I get a reply. PS Loren Riddel(sp?) - I am back in south Florida, please send me your key and the secret word(s) in a PGPmessage. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "The president has kept the promises he meant to keep." -- George Stephanopoulos (tells the truth, for once). ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray Coming soon, "Pennies For Perot" page! CYA with http://www.anonymizer.com ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMeo56G1lp8bpvW01AQFWcQQAsw/oUk57ljTKzO8lNgXoV7Lmoo2vWzw0 bk6fxGalAkDXtcgsPDdHBZ/ZV6EIpUhoIgAXi1G9ByI3jG36gxvWDD8eh2mr/ize 5HD9SKkgqCp09zwjKyBKwKAfZPGAT8oWlE0QOeBbp4ayGt+KRYk2llxultkYVlIS 4KQ5r+WQg6U= =dymZ -----END PGP SIGNATURE-----

1 0

Netscape download requirements
by Julian Burke 17 Dec '03

17 Dec '03

Jeff Weinstein wrote: > We received written permission from the State Department for our >download verification mechanism. What exactly is the reason for Netscape asking for the name, address, e-mail address, and telephone number of anyone who wishes to download the US-browser? If I remember correctly MIT in distributing PGP only asks that you affirmatively assent to obeying export laws (and the terms of the rsa license). I have not heard at any point that the MIT system does not meet the legal requirements of ITAR. Is there perhaps some other reason Netscape wishes to have this information? --Julian Burke

10 14

Re: #E-CASH: PRODUCT OR SERVICE?
by bryce＠digicash.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- David G.W. Birch <daveb(a)hyperion.co.uk> wrote: > > Johan, > > >Careful there. At least ecash is a registered trademark. And as far as I know > > It is alleged that a trademark has been applied for on the term "ecash" > in some countries: that's why Robert was careful (as we always are) to > use the term "e-cash" instead. "Ecash" is a registered trademark of DigiCash. It is registered with the Benelux trademark office and the United States trademark office. I believe that it is considered unwise to use minor variations on trademarked names, but I'm not an intellectual property rights lawyer. > >Mondex isn't one of the true electronic cash systems. Please correct me if > >I'm wrong, but isn't mondex an electronic debit card system? > > Mondex is _the only_ true electronic cash system in the world that I know > of, precisely because it isn't an electronic debit card system (like > Avant) or digital travellers' cheques (like Digicash). I think it would behoove us all to clarify our terms. I call Ecash(tm) coins "electronic cash" for several reasons. Ecash(tm) has all of the following characteristics in common with conventional cash, in descending order of importance: 1. Unforgeability. Ecash(tm) coins have intrinsic value because they are cryptographically impossible to forge. 2. Finality. Payments are cleared on the spot. No outstanding payment obligations remain after a purchase. 3. Bi-directionality. Payers and recipients use the same software and the same protocol. It is not necessary for recipients to be specially trusted by the bank or by the payers. 4. Privacy. The privacy of Ecash(tm) payers is mathematically unconditional. 5. Composability. You can make large Ecash(tm) payments out of a collection of smaller Ecash(tm) coins. This is in contrast to a check-based system where you typically draw a check for the exact amount and transfer only a single check. 6. Small payments. Ecash(tm) coins are cheap enough to use that they are practical for small payments. (As a note, I do not use the word "micropayments" here, because I am beginning to think that a good technical definition of "micropayments" is "payments whose value is less than the cost of using current electronic coins". This qualifies schemes like Shamir's and disqualifies, well... current electronic coins.) There might be other angles we should talk about here. I think that the first quality is the defining one, technically. So, could a knowledgeable person e.g. Mr. Birch tell us why Mondex should be considered to be "electronic cash"? And similarly I would like to hear an informed opinion about why Ecash(tm) should not be considered "electronic cash". I tend to agree that Ecash(tm) would be even _more_ cashlike if it were cleared off-line, but I don't consider that difference very fundamental. (_Any_ digital money based on our current understandings will have to be cleared at a central clearer eventually, since digital information is perfectly copyable.) Thank you for your correspondance. Regards, Bryce Ecash 2.x Team -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMepI/UjbHy8sKZitAQEiJwL/VnpQEHL1rOQ6Hm9JIEgAfCGjSKOPaIiC Jp7EVjvPoFYEsQAS4iUWybNLpxi/23uaqpXMCSNMrEwqd8WeC5ZSISldIEK/BnYE 2bULeAeMhIqm92bP6o64ok1NBGPfvK5X =ANO4 -----END PGP SIGNATURE-----

1 0