December 2003 - cypherpunks-legacy

Re: Netscape 3.0 and encryption choices
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:04 AM 8/20/96 -0700, Ted Cabeen wrote: >In Netscape 3.0, the program allows the user to specify which encryption >standards to allow connections with. It allows encryption with 128-bit RC4, >128-bit RC2, and 156-bit(I think)3DES. Of these three, which would be the >most secure method? The gereral consensus of the experts is that 168 bit 3DES is the best choice. DES has been well studied, 168 bit keys are large enough to be safe, and the ITAR forbids its export. (ITAR also forbids export of 128 bit cyphers as well, but ITAR is the only NSA approved reputation agent for crypto, so we use what we have.) ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0

Re: CS First Boston lawsuit
by Greg Broiles 17 Dec '03

17 Dec '03

At 12:03 PM 8/19/96 -0400, Black Unicorn wrote: >On Sun, 18 Aug 1996, Timothy C. May wrote: > >> At 3:29 AM 8/19/96, Alan Horowitz wrote: >> >I suspect they are trying to get a judgement against "John Doe", in the >> >hopes of tracking him down later. >> > >> >Actually, if I had a sizeable judgement against such a John Doe, I could >> >probably find a private detective who would find the dude for a >> >contingent fee. Wow, a whole new class of factoring (commerce definition) >> >opens up. Get me a lawyer.... Sure, there are collection people who do this regularly; it's also possible to sell judgements for a fraction of their face value. >> Lawyers out there can and should correct me if I'm wrong, but I don't >> believe either the criminal or civil justice system has the concept of a >> "John Doe" trial! The ability to have the advice of an attorney, to >> confront one's accusers, cross-examine witnesses, and mount a defense, and >> all that constitutional stuff. Rather hard to do if the trial is in the >> past tense. >> >> Can you cite an example of such a "John Doe" trial in the U.S.? > >Not exactly, but judgements against John Doe's or even "$956,334.34" are >common. Typically they are default judgements where a property seizure is >involved. > >"The United States of America v. $534,444.00" and "The United States of >AMerica v. One Red Porsche" is a common theme. It is possible to name unknown defendants in a suit - the tradition is to name them as, literally, "John Doe" or "John Does 1-6, unknown Washington County Sheriff's Deputies". The idea is that at some point prior to trial you'll learn the names of the defendants and then ask the court for permission to amend your complaint to add the newly found names. (e.g., Oregon Rule of Civil Procedure 20(H): "Fictitious Parties. When a party is ignorant of the name of an opposing party and so alleges in a pleading, the opposing party may be designated by any name, and when such party's true name is discovered, the process and all pleadings and proceedings in the action may be amended by substituting the true name.") But naming someone in a suit is not sufficient to give them notice that they've been sued, so that they know to file an answer and otherwise defend themselves. At least in Oregon (state & Fed courts, since Fed courts borrow the state's rules for service of process, Fed Rul Civ Pro 4(e)(1)), service by publication (as mentioned in another message) is only allowed where the plaintiff files an affidavit that they have tried every other appropriate means of service and they have been unsuccessful, or that they have reason to know it will be unsuccessful. ORCP 7(D)(7). Service by publication is relatively rare. So Tim's correct (at least as far as I know, and I sure don't know everything) when he says that John Doe *trials* are essentially unknown - because if defendant(s) don't appear for trial but have been served, the plaintiff can get a default judgement against them - which makes a trial unnecessary, at least for those defendants. It's also possible (sometimes) for a defendant to overturn a default judgement and ask for a real trial, if they can show that there was a good reason why they didn't respond initially. Bad (or unattempted) service of process is usually a good reason. The John Doe lawsuits are more likely to falter at the service-of-process stage; before you get to ask for a default judgment, you've got to prove that the defendant was served. And if you don't even know their name, it's tough to serve them with the summons & complaint. No service, no judgement. The connection between the service-of-process problem and the in rem cases Black Unicorn mentioned (e.g., "United States v. $405,089.23") is that the owner of the property is supposedly put on notice by the seizure or attachment of the property itself. A court can exercise jurisdiction over *stuff* (e.g., property) and enter a judgement against the stuff even if it hasn't gained jurisdiction (via service of process) over the person who owns the stuff. In the most common seizures, the stuff is seized from one or more people; those people are also given notice of the seizure and their right to contest it. (which is not to say that I'm a fan of forfeiture - I'm not - but the cases I've seen/worked on haven't suggested that lack of notice is a problem. Claimants/owners/possessors don't always understand the notice they're given at seizure, and they don't always bother to act within the awfully short deadlines (10-15 days, in some cases) required to file a claim. But people do get (arguably inadequate) notice.) To some extent, in rem jurisdiction is practically necessary - otherwise it'd be possible to have property in a wrong place, or creating unwanted/harmful effects, which could not be legally moved or changed without service of process on the owner - who may be dead or travelling or uninterested or just hard to find. If cryptoanarchy becomes more prevalent, and it becomes more difficult to trace ownership and control of interesting stuff (e.g., physical or intellectual property, and/or "bots" of one flavor or another), look for more in rem actions, not fewer. (I can't think of an example of a John Doe criminal proceeding, except that I believe grand juries can hear testimony and investigate crimes where a target has not yet been identified. But that's a very early stage of criminal proceedings where the defendant doesn't have many rights even if they are identified; so the lack of notice isn't much of an injury.) -- Greg Broiles |"Post-rotational nystagmus was the subject of gbroiles(a)netbox.com |an in-court demonstration by the People http://www.io.com/~gbroiles |wherein Sgt Page was spun around by Sgt |Studdard." People v. Quinn 580 NYS2d 818,825.

3 4

Re: US Taxes on X-Pats (getting off topic)
by Stephen Cobb 17 Dec '03

17 Dec '03

At 05:32 PM 8/19/96 -0400, you wrote: >It sounds unfair, for sure. However, the whole thing is a fraud based >upon a myth. FICA witholding is NOT credited to an individual's account, >or even to Social Security benefits in general. By statutory law, all >such receipts go into the Treasury's general fund. > >So, they are NOT "social security contributions". Period. > Very true...what I am saying is that, as far as my reading goes, LEGAL aliens are going to be required to pay social security "taxes" while not having any "entitlement" in return. They pay income taxes and get certain things, like law and order, in return. They will be paying soc sec money to the government without getting anything in return. This sounds not only unfair but wrong, part of an isolationist, "we killed the natives so this land is our land and the rest of you f@*k-off" revival that includes the recent posting about requiring proof of citizenship before issuing drivers licenses. Stephen

4 4

Re: CS First Boston lawsuit
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:29 AM 8/19/96, Alan Horowitz wrote: >I suspect they are trying to get a judgement against "John Doe", in the >hopes of tracking him down later. > >Actually, if I had a sizeable judgement against such a John Doe, I could >probably find a private detective who would find the dude for a >contingent fee. Wow, a whole new class of factoring (commerce definition) >opens up. Get me a lawyer.... Lawyers out there can and should correct me if I'm wrong, but I don't believe either the criminal or civil justice system has the concept of a "John Doe" trial! The ability to have the advice of an attorney, to confront one's accusers, cross-examine witnesses, and mount a defense, and all that constitutional stuff. Rather hard to do if the trial is in the past tense. Can you cite an example of such a "John Doe" trial in the U.S.? (There may be trials "in absentia," more so in other countries than in the U.S., but not when no persons have been identified at all!) --Tim May, who hopes he is never identified as the "John Doe" indicted, tried, convicted, and sentenced in 1979 in Washington County, Oregon, for the crime of unlawful foddering in a public place. Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4

Re: Indonesia detains democracy activist after post to mailing list (fwd)
by Sean McGrath 17 Dec '03

17 Dec '03

> ...llike the Berkeley administration's reading student email ... This was a paranoid fantasy that became a rumor and is on its was to an urban ledgend. The UC administration does not have the inclination, interest or resources to monitor email. Sean McGrath

2 1

Re: Key Length Correlation
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:02 PM 8/20/96 -0700, Jeff Davis wrote: >I've read Blaze and diffie's paper on Semetric Key Length. I'm currious >how semetric key length correlates to public key cryptography length. Does >public key length have to be much longer, (assuming the algorithms are strong), >to provide the same level of security as a shorter semetric key? TIA According to Applied Cryptography V2, Symmetric and Public-key Key Lengths with Similar Resistances to Brute-Force Attacks Symmetric Public-key Key Length Key Length 56 bits 348 bits 64 bits 512 bits 80 bits 768 bits 112 bits 1792 bits 128 bits 2304 bits Regards - Bill ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0

cryptoanalysis 002
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

I agree on expanding the symbols to represent the alphabet. For example, if the crypto-alphabet for e is 23, 45, 190, 200, etc, one can remove some of the frequency for a letter. This definately makes it harder to attack with the frequency analysis method because the "resolution" of the distribution for the letter is lessened to a near randomness. (So it looks, there are still clues, eh?)

1 0

Re: Hackers invade DOJ web site
by Lynne L. Harrison 17 Dec '03

17 Dec '03

At 07:08 PM 8/19/96 -0500, Igor Chudov wrote: > >I personally find the web page very well and artistically done, and >extremely funny. The guy who did it had a good taste. I personally found the page to be offensive and disagree highly with the person having "good taste". Following the premise that another posted to this list, there were ways of focusing on opposing the CDA without insulting women and/or minorities. I also agree that this act is going to backfire by giving the DOJ fodder when the case reaches the Supreme Court. IMO, it was patently obvious that it was a kid or kids that did it who gave no substantial thought on the consequences of his/their act. ************************************************************ Lynne L. Harrison, Esq. | "The key to life: Poughkeepsie, New York | - Get up; lharrison(a)mhv.net | - Survive; http://www.dueprocess.com | - Go to bed." ************************************************************ DISCLAIMER: I am not your attorney; you are not my client. Accordingly, the above is *NOT* legal advice.

2 1

Re: Pappieren, bitte! (and Taxes, National Debt)
by jim bell 17 Dec '03

17 Dec '03

At 12:18 PM 8/20/96 -0700, Timothy C. May wrote: >One estimate I have seen places the overall national debt, counting >obligations and promised payments, at $20 trillion, or four times the >official number. And it is still increasing every year. To see how large >this is, there are 100 million taxpayers in the U.S., roughly. This means >each of these taxpayers has an average indebtedness of $200,000. Most >American households do not have this amount of money in total net worth, >obviously. Thus, they "owe" much more than they are worth. > >Obviously enough, the portion of this debt is not distributed uniformly >amongst households, or won't be if it is ever collected. But you get the >drift. The country has been spending far more than it has been taking in >for many years, and is far worse shape than "official" figures about the >National Debt would tend to suggest. > >Neither Dole nor Clinton appear to want to talk about this, both having >done their parts to make the situation what it is today. This is exactly why I'm astonished when a few people occasionally (and, prematurely) reject my "Assassination Politics" idea. If the problem is as big as all that (and it is!) then these people are well and truly guilty of way more than enough crimes to merit their deaths. Jim Bell jimbell(a)pacifier.com

1 0

Re: Phoneco vs X-Phone
by jim bell 17 Dec '03

17 Dec '03

At 04:02 AM 8/20/96 +0000, Vipul Ved Prakash wrote: >> >> Well, let's consider such costs. Most of which (maintenance, management, >> rolling stock) are unrelated to amount of telephone usage. So there is no >> reason that these costs should be unequally attributed to a person who makes >> local calls 1 hour per day, as opposed to another who only calls 15 minutes >> per day, for example. >> >> As for the "laying new pipes" issue: Years ago in the the US, when >> inter-central-office trunk connections were all implemented using large >> bundles of copper pairs, it would have been _correct_ to say that higher >> telephone usage resulted in larger costs, since more trunk lines were >> necessary. Today, on the other hand, inter-office trunks (at least the new >> ones, and I presume that even many of the old ones have been switched over) >> are implemented in fiber optics. Extra capacity is either automatically >> available (since the capacity of a given fiber is unlikely to be fully used) >> or can be fairly simply added by converting old fiber from about 450 >> megabits per second to 2.4 gigabits, or even faster rates which have become >> more recently available. >> > >Your view point doesn't really fit the facts, but since it is not the >issue here, I'll let it go. What do you mean, "doesn't really fit the facts"?!? What part of it was incorrect? Fiber-optic _is_ commonly used in inter-office trunks, right? It doesn't wear out, right? Higher usage doesn't entail greater costs, right? The capacity, while not strictly infinite, is high enough so expanded usage doesn't strain most links, right? Finally, modern phone switches have sufficient connect capacity so that they can handle usage which would have been considered "unusual" by yesteryear's standards. All of this points to an obvious conclusion: Telephone companies do not, in general, have increased costs as a consequence of increased telephone usage. Here's what I think is _really_ going on: You have decided that you think the costs of the telephone system should be apportioned by usage EVEN IF higher usage is no more costly to provide. That's why you don't want to disprove my claims. You're afraid that you'll have to say, "Yes, you're right Jim, but I _still_ think billing should be porportional to use." >Can't resist like someone has to pay those 80,000+ >employees at AT+T. Some of whom are probably unnecessary. Interestingly enough, the rumor is that half the costs for LD are in billing and customer service. Most of these costs would disappear if LD was unmetered. > >> >But you miss my point, if a phoneco is not getting a penny for its long >> distanceservices (which subsidise the flat rate local calls) then the choice >> would >> >be to close down. Which would be a severe attack to the local internet usage. >> >> That's an entirely unsupported claim. Nobody claims that telephone usage >> (term used generically) is on the way out. "Closing down" is only going to >> happen if local phonecos cease to be able to provide a service that people >> are willing to pay for. > >Exactly! Once "X-Phone" has its servers in US Cities, and its charging 10 cents >a minute for long distance calls, I don't see if the phonecos would be able to provide any service that people are willing to pay for, I mean they won't >be able to provide matching lucrative rates. I am confident that local phonecos can remain competitive even against "free" Internet telephone service. What they need to do is simple: Entirely remove the LD/local subsidy, remove metering on LD (as well as local), bill yearly for far lower costs, etc. Once this is done, LD will be "free", at least on a marginal basis, so no customer will have any motivation to move to "Internet telephone" service. >You mean to say that, X-Phone will take advantage of the phoneco and mint >money for a minimal investment, whereas the phoneco who spent billions on the >infrastructure will be just whistle down the road, and let the X-Phone >indulge in its own cyberdo. In the US, the current telephone company infrastructure is ALREADY PAID FOR. It was paid for by over-inflated rates during a monopolized era. If anything, the locals have an "unfair advantage" over the rest of the companies: Only they have a copper pair into every home. Jim Bell jimbell(a)pacifier.com

2 1