December 2003 - cypherpunks-legacy

Re: Philosophy of information ownership
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:38 PM 5/28/96, Bruce Baugh wrote: >In many cases, sure it is. I can't see how giving you the information to >establish that I can pay a bill I owe you should be in any sense treated as >a license do anything else with that info. A great many transactions are >finite, and ought not have lingering implications or side deals dangling off >the end. Most lenders are interested in these things: * past history of paying bills, especially for monthly bills such as VISA (and when one applies for and accepts a VISA card, it is explicitly made clear that repayment/deliquency information will be reported to credit agencies...most people of course _want_ this information reported, as this is largely what "establishing a credit history" is all about). * lenders for larger items, such as cars and houses, will want collateral and some evidence that the monthly repayment amounts are achievable (even if a loan is secured by a car, for example, it makes no sense for them to lend money to an unemployed 18-year-old and then have to spend money and time retrieving the car, etc. * other factors which have historically affected loan repayment probabilities, such as age, sex, ethnic group, religion, educational background, etc. (Note: Some of these criteria are of course no longer legal to officially use, even if their strong and clear correlations.) Note that "credit" is not a right. Credit, like insurance, is a kind of "bet" a lender is making. A bet that he will get his principal back, with interest. To help him make this bet, people offer evidence of past good faith in loans, and choose to reveal their current salaries, ownership of other assets, etc. In no way is this coerced. Anyone is free to eschew credit, avoid borrowing money, and pay with cash or checks for all purchases. >In the long run, this is where anonymous payments come in. In the meantime, >I muddle on as best I can. No, anonymous payments have very little to do with credit. See above. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Remailer chain length?
by Hal 17 Dec '03

17 Dec '03

From: Jim Choate <ravage(a)ssz.com> > > From: "Mark M." <markm(a)voicenet.com> > > And besides, the more remailers there are, the > > more difficult it is to do traffic analysis on remailer traffic. Actually, > > its the more remailers people chain messages through, but there are software > > packages that can do this easily. The more remailers there are, the longer > > remailer chains have the possibility of becoming. > > If this is strictly true, why not simply run several instances of a remailer > on the same machine. Then randomly chain them prior to sending them off > site. Or better still, run one remailer on the machine, and use it multiple times in the chain. It seems to me that one remailer on a machine is better than several because it will allow more mixing of messages. If two messages enter a machine and later leave, it may be possible to distinguish them if they went to different remailers and left with different From: addresses (or other header fields) as a result. If they had both gone to the same remailer it would be harder to tell them apart. I understand that there may be political reasons to have the machine owner and remailer operator be separate (although AFAIK the reasoning behind this is untested), but technically it seems better to have one remailer per machine based on traffic analysis issues. Hal

1 0

Re: Philosophy of information ownership [ Re: Children's Privacy Act ]
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 09:24 AM 5/27/96 -0500, Mike McNally wrote: >What if I just *see* your couch, and then back in my garage I use my >couch replicator to make a couch just like yours, complete with fuzzballs >and loose change between the cushions? Now I have your couch, in a sense. >Are you still upset? If the couch design is copyrighted, you have just violated the copyright :-). ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: Remailers - What exists?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 28-MAY-1996 05:27:38.19 >It helps a lot to have an account that isn't your main email >account, because it's going to get lots of junk in it >that you want to discard most of, so you'd be better >off without your real mail going there, unless you're >a procmail wizard. A related question is about the cover traffic generators. With those, I've gathered you've got the two choices of loops and nowhere-ending chains (e.g., directing it to "nobody" on most systems). If it's done using a loop, is there any way for a procmail script to determine that and toss them into /dev/null? >Mixmaster-style remailers are more secure than vanilla ones, >but of course you need to use the Mixmaster client software >to use them, which could be a problem if you're a DOS or Mac user. Or a VAX/VMS user; there are, I have been informed, enough UNIX-specific system calls in Mixmaster that porting it isn't a trivial task. >- ability to mess with the sendmail logs >- ability to tell the backup software not to back up your > spool directory (which would be Really Bad, especially > if your computer provider keeps backups forever.) > The alternative is to put it under /tmp somewhere, > and just make sure it recovers if too much stuff gets > deleted by regular daemons. What mechanisms are available to make sure it will recover if /tmp gets deleted? I suspect also that many ISPs might be quite willing not to bother backing up some directory or another - it saves them time and space. Thanks, -Allen

1 0

Re: Clipper III analysis
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 4:11 PM 5/28/96 -0400, Carl Ellison wrote: >There were a number of flaws in that paper, but perhaps the most glaring to >me is that there are actually 3 classes of key: > >the two you mentioned: > communications key > storage key >and > signature key > >Of these, you want key recovery *only* for storage keys. You want to make >sure no one can get to your signature key. Even the IWG paper notes that. >But the only use for a PKI of any form is for a signature key. Once you >have your identity established somehow for a signature key, you can >generate and sign comm or storage keys at will. Furthermore, if you lose a >signature key, there's no big loss. You generate a new one and get a new >cert for it. So there's *NEVER* a reason for key recovery for a signature >key -- the only keys for which there is a need for a PKI. Carl is right. They want to GAK all keys including signature keys. Now think, to whom in your life are you willing to grant unlimited power of attorney? Your spouse? Your lawyer? Your banker? Your employer? Your government? Giving away your signature key is worse. Not only can any key holder act FOR you, he can act AS you. "We've got you cold perp. You signed this child porn that was posted to alt.binary.etc. You can make your calls from jail." Who needs entrapment. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: Clipper III analysis
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:37 AM 5/29/96, Bill Frantz wrote: >Carl is right. They want to GAK all keys including signature keys. Now >think, to whom in your life are you willing to grant unlimited power of >attorney? Your spouse? Your lawyer? Your banker? Your employer? Your >government? > >Giving away your signature key is worse. Not only can any key holder act >FOR you, he can act AS you. "We've got you cold perp. You signed this >child porn that was posted to alt.binary.etc. You can make your calls from >jail." Who needs entrapment. But, though things have gotten pretty bad these last 40 years, there are still courts, expert witnesses, and standards for signature verification. Experts are called upon to give testimony about the likelihood that a signature is that of the person claimed (by one side or the other). Though there have been few tests of digital signatures that I know of (I think Utah has a law...), this government access to identities (GAI) will throw a spanner in efforts to get digital signatures widely accepted. Once it gets shown in open court that Joe Blow can claim he did not sign a document and the government will have to admit that this is a possibility, and admits that anyone in government with access to the escrowed data base could have done the signing....well, digital signatures will lose much of their value immediately. Inasmuch as unforgeable digital signatures are critical for electronic commerce, a fact even Clinton cannot ignore, I expect this weakness to help sink Clipper III. As Carl noted, Cypherpunk Deep Cover Agent Micali has been doing a good job in planting logic bombs in these schemes...I urge we approve his bonus. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Philosophy of information ownership
by Alan Olsen 17 Dec '03

17 Dec '03

At 12:38 PM 5/28/96 -0700, Bruce Baugh wrote: >A separate problem arises when the government compels the disclosure of >information for one purpose - getting a driver's license, say - and then >turns around and sells it to others. It's much harder to either negotiate a >new contract or go to a competitor when the other party is a government. This is a problem in Oregon. The database of drivers licences and registered automobiles is sold openly by the state. (You can also order a copy on CD-ROM from a company based in Oregon as well...) As far as I know, there is no way to opt out of having your name sold to marketing firms. These records are routinely purchaced by mail order houses for resale to clients all over the country. The cost is pretty minimal (under $200) and you have to provide the media (usually two 9-track tapes). The database includes current address, vehicle licence number and the type of car that you own (among other things). The only way to not be on the list is to not have ID. Not viable in todays society. --- |Coors - For people who don't want to think about what they are drinking.| |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: Philosophy of information ownership
by Bruce Baugh 17 Dec '03

17 Dec '03

At 09:25 AM 5/28/96 -0700, Sandy Sandfort wrote: >that our privacy will be maintained. Generally, it is >incumbunt upon us--not others--to secure our own privacy. I'm in complete agreement here, and I'm willing to drop the thread here - I don't think I have much else to add. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

1 0

Re: Philosophy of information ownership
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:37 AM 5/29/96, Alan Olsen wrote: >At 12:38 PM 5/28/96 -0700, Bruce Baugh wrote: > >>A separate problem arises when the government compels the disclosure of >>information for one purpose - getting a driver's license, say - and then >>turns around and sells it to others. It's much harder to either negotiate a >>new contract or go to a competitor when the other party is a government. > >This is a problem in Oregon. The database of drivers licences and >registered automobiles is sold openly by the state. (You can also order a >copy on CD-ROM from a company based in Oregon as well...) As far as I know, >there is no way to opt out of having your name sold to marketing firms. >These records are routinely purchaced by mail order houses for resale to >clients all over the country. The cost is pretty minimal (under $200) and >you have to provide the media (usually two 9-track tapes). The database >includes current address, vehicle licence number and the type of car that >you own (among other things). As I said, I favor "data privacy laws" when they deal with government use of mandatory data (but not in the case of illegalizing the mere "remembering" of data obtained non-coercively). The problem has been made worse by "revenue enhancement" policies by various govenmental agencies. Local and regional governments have discovered they can make a few extra bucks by selling data bases they acquired through government power. Here in California there are restrictions on DL records, following the use of DL records to allow a guy to track down an actress, Rebecca Shaefer, and then kill her. (But this doesn't stop such abuses. A couple of years ago I obtained the NLETS (National Law Enforcement Telecommunications System) printout for the extremely reclusive and unseen-since-1957 author Thomas Pynchon. He lived a few miles from me, in Aptos, on an old logging road.) The problem of government records being "open to the public" of course is a two-edged sword. We want government to not operate in secret on the one hand, but we are naturally horrified when it is possible to go to the right office of government and look at lists of all the women who received abortions in county hospitals. I place no faith in government to protect my privacy. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Tempest Info [ELECTRICAL NOISE]
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:08 PM 5/28/96 -0500, Andrew Loewenstern <andrew_loewenstern(a)il.us.swissbank.com> wrote: >Bill Stewart writes: >> Also, of course, your electrical power system needs to be >> shielded and filtered, so only 60Hz gets through, unless you >> plan to stick to laptops and bring in spare battery packs. >At HoHoCon a few years ago, someone did a tempest demo and mentioned that >signals could be recovered from water pipes! Fire sprinkler systems were >specifically mentioned... Yup. When you're installing a shielded room with waterpipes, it's best to use a chunk of plastic pipe just outside the shieldwall, and you need to make sure the plumbers use teflon tape instead of pipe dope ( unless it was the other way around; it's been a while.) >Theres a lot of different avenues for your eminations to be recovered, some >you may not have thought of. Like crypto, tempest is economics. And like crypto, there are lots of diddly little things you've got to check to make sure you've done _all_ of them correctly. Unlike crypto, however, it's generally easy to find out if you've made a mistake; big mistakes peg your test meter, little ones require you to wave the meter around everywhere and watch for little motions. Also unlike crypto, little mistakes generally won't lose the whole game for you; if somebody's got to watch for six months to accumulate enough leaked electrons to find out the Secret Plans, and you haven't noticed the black van with all the antennas parked out in your parking lot by then, you've got far more serious troubles than just a few stray electrons :-) You may also notice that you can't park your black antenna-van too near the Pentagon. It's not just because they think you're hauling fertilizer; electromagnetic emanations follow this nice square-law that means that a few hundred meters of extra distance makes it _much_ harder to detect the signal you're looking for, as well as mushing it together with all the other stray signals from the building. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0