December 2003 - cypherpunks-legacy

British Telecom merger with MCI
by Peter D. Junger 17 Dec '03

17 Dec '03

Has anyone figured out how this merger can work, particularly when British Telecom will be the surviving party, when those MCI employees concerned with the security of communications will not be able to disclose any cryptographic software or technical data to their employer, or to their ``foreign'' bosses and colleagues, without first getting permission from the Office of Defense Trade Controls under the ITAR? -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH Internet: junger(a)pdj2-ra.f-remote.cwru.edu junger(a)samsara.law.cwru.edu URL: http://samsara.law.cwru.edu

7 9

PGP3.0 & ElGamal
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

On Fri, 25 Oct 1996 00:32:52 +0100, Adam Back wrote: [snip] > Also I understand, though there appears to be no available > documentation saying as much, that pgp3.0 will not use RSA, nor IDEA, > nor MD5, using instead El Gamal for public key encryption and > signatures, 3DES (unsure?), and SHA1. Can someone confirm that PGP3.0 will use ElGamal? Bert-Jaap

8 10

Re: Kriegsman Furs Website hacked...
by Steve Edwards 17 Dec '03

17 Dec '03

These hacks can be amusing, regardless of your political orientation... But, to bring the thread onto topic, how are these hacks perpetrated and how can a responsible webmaster reduce the exposure? On Wed, 13 Nov 1996, Eraser wrote: > > Hey all.. > > Another commercial hack. > > http://www.kriegsman.com/ which is still live at this posting. not any more. > if it goes down, or is fixed, a mirror exists on > http://www.skeeve.net/kriegsman/ > > nicely done... > > one for the furry creatures. > > ------------------------------------------------------------------- > | Skeeve Stevens - MyInternet personal.url: http://www.skeeve.net/ | > | email://skeeve@skeeve.net/ work.url: http://www.myinternet.net/ | > | phone://612.9869.3334/ mobile://0414.SKEEVE/ [753-383] | > ------------------------------------------------------------------- > Steve Edwards sedwards(a)cts.com

1 0

Supreme Court rules against FCC, MCI, AT&T
by Pzbowen＠aol.com 17 Dec '03

17 Dec '03

Supreme Court Rejects FCC Phone Rule Request WASHINGTON (Reuter) - The Supreme Court Tuesday declined a request by federal regulators and long-distance phone companies to reactivate landmark rules intended to pry open the nation's local phone monopolies to competition. The denial means key terms and conditions for deregulating the $100 billion local phone market will for now depend on the decisions of state regulators in the 50 states -- instead of on uniform rules issued by the Federal Communications Commission. It is a defeat for the FCC and long-distance giants AT&T Corp. and MCI Communications Corp. They sought to reinstate the FCC's "interconnection" order after a U.S. appeals court suspended key provisions pending a challenge to the rules, and Supreme Court Justice Thomas declined to restore them. It is a victory for the Baby Bell companies, GTE Corp., other local carriers and state regulators who are seeking to overturn the regulations in the St. Louis-based appeals court. They argue the FCC unfairly snatched away from the states the power to issue policies governing pricing and other matters. The rules spell out how long-distance companies, cable-TV operators, utilities and others wanting to get into the local phone business can plug into the local network under the new telecommunications law. "For all practical purposes the state have complete control over the prices new entrants will pay to share the existing telephone networks during the critical period when competition is supposed to begin in local telephone markets," FCC Chairman Reed Hundt said after the high court's denial. The appeals court temporarily suspended the rules last month, saying the FCC probably erred when it drafted them. On Oct. 31, Justice Thomas declined a request by the FCC and its long-distance allies to lift the lower court's "stay." They separately asked Justices Ruth Bader Ginsberg and John Paul Stevens to reconsider the request. The justices referred the matter to the entire court. "The stay prevents grossly arbitrary and distored pricing rules from going into effect and ruining the whole process," said GTE General Counsel William Barr. "It does not delay the timetable set forth in the Telecommunications Act of 1996 for the introduction of competition, but instead allows for a more level playing field." Oral arguments in the St. Louis case are set for January. FCC Chairman Hundt conceded Friday it was unlikely the appeals court would decide in favor of the FCC. And he doubts the rules will be put into effect for at least 1 1/2 years, if ever, while they are fought over in the courts. Hundt was encouraged, however, by the actions of state regulators arbitrating interconnection agreements between the Bells and their long-distance rivals. He said key provisions to the arbitration decisions issued so far are similar to the suspended FCC rules. Iowa, Texas, Maryland, Virginia and Pennsylvania have been among the states that have issued decisions that will lay the groundwork for arbitrated agreements between the Bells and AT&T, MCI and No. 3 long-distance company Sprint Corp. "There hasn't been any evidence that the states are going off and doing any wild and crazy stuff," said analyst Robert Mayer of Deloitte & Touche Consulting Group.

1 0

Re: Secrecy: My life as a nym. (Was: nym blown?)
by Benjamin Grosman 17 Dec '03

17 Dec '03

Dear Sir, >>problem avoiding the photo (and thumbprint) on the license. You mean you guys have to have a thumbprint on your drivers licences as well? That is a real entry into the system! Appearances can be changed, but fingerprint changing isn't quite as easy for the average Joe. But who was it who said: "How can you convince people of the need for privacy when they are willing to leave detailed records of their shopping habits for 1/10000th of a flight to somewhere"? I think it may have been Mr.Schneier in his article on why Cryptography is difficult, I can't remember, but it definitely has the ring of truth to it. Yours Sincerely, Benjamin Grosman

1 0

[URGENT] Accounts payable
by nobody＠replay.com 17 Dec '03

17 Dec '03

What a joy to make a public mockery of Tim Mayonnaise!

1 0

RE: So how does the crypto crackdown go?
by nobody＠replay.com 17 Dec '03

17 Dec '03

> >One question is whether they would also try to make it illegal to use >(rather than to distribute) crypto software. On the one hand, if they >don't do that, they have a problem with all the installed base of code. >But the legalities of stopping people from encrypting code on their own >computers, or writing crypto programs for personal use, seem a lot more >questionable to me, and I don't know how much precedent there would be >for that kind of restriction. Not at all questionable. A ban on crypto would follow the current trend in regulating technology. Consider the case of Bernie S. who is in jail for possessing electronic parts that could be used for telco fraud. Any government action towards banning crypto will include possession of crypto as a crime. The "cat's out of the bag" argument is ineffective as well as the governments just don't care. They'll just say in effect: "It's illegal. Destroy it if you got it." Now it's doubtful if enforcement would make unprovoked searches and arrest people solely for possession of crypto. And it is also unlikely that DA's (except perhaps the most bored) would follow up on "My neighbor is using crypto" tips. But it is not uncommon for prosecutors to heap additional charges on criminals (alleged) such as the case in robbery: 1 count robbery, 1 count using a gun in robbery. or perhaps 1 count tax evasion, 1 count using crypto to commit tax evasion. While the former charge may end up being unproven the later often sticks. > >So as I see it the main target of the ban would be distributors of >software rather than end users. This would be in line with the often >stated goal of the law enforcement people that their main concern is with >crypto that is built in, transparent, and trivial to use, rather than >hacker's crypto. Hmmm. Hackers built the ubiquitous CryptoFS for Linux, no? And the nascent S/WAN too. I don't see a distinction between popular and subculture crypto. The two invariably mix. A program may have it's origins in the subculture but it will often meet the needs of the popular culture as well and be adopted, accepted, and so on. Consider PGP and such add-ons as Brainless-PGP, WinPGP, and the various auto PGP tools. It seems to me that banning distribution would just be too generous. What is distribution? Are time share accounts distribution? I created it but many can use it but the actual bits (well are there actual bits?) never left my single computer. But the nature of "distribution" is to move something from one person to another. Now nothing really moved but a few electrons. But multiple people did use it. Book 'em. Distribution is an archaic term here and the regulations will involve controlling what software may be run on personal computers. The stated goal is a posture designed to sound reasonable. Only time will tell if the actual goal is the regulation of computer uses as I suspect. The security establishment fears crypto. Fears loss of control. I suspect that with Clinton back in the White House (was there a choice?) we will enter a period where the Clipper chip seemed like a good idea. In comparison. Unless some fundamental changes occur to the Security, Intelligence and Law Enforcement agencies (a new acronym? SILE? Pronounced with a long E of course <g>) we will see more business as usual and some completely draconian steps taken against strong encryption. The only recourse is to take an active role now. We must go on the offensive and : 1) Deploy S/WAN 2) Write more strong ubiquitous crypto 3) Attack the SILE agencies directly by challenging their purpose, gutting their budgets, exposing their falacies (umm is that almost freudian or what), flooding international communications with strong crypto messages (content need not apply), and of course ridiculing their every effort. 4) Finding allies in the legal community and educating fence sitters, critical judges, legislators, and so on. Now is the time to act. diGriz

1 0

Children & Privacy
by Duncan Frissell 17 Dec '03

17 Dec '03

At 8:26 AM -0800 11/11/96, Hal Finney wrote: > >>I have two kids entering their teens, and I'm sure other list members are >>parents as well. What can we do for our children to help them enter their >>adult lives with better chances to retain privacy? Perfect privacy is very difficult to achieve but with practice, one can learn (and teach one's children) much improved privacy. The following suggestions are not the most radical ones. They represent things that you can do at little cost or risk. Things you can do to teach your children to protect their privacy. 1) Practice privacy yourself. Children learn by example. 2) Don't apply for an SS# for your child. 3) Do apply for a passport for your child (without an SS# of course). Use it as the foundation for an ID pack for your child because passport apps don't contain much useful information on a person and can even be obtained without a birth certificate when the child is an infant. 4) Make up some facially valid SS numbers for future use using a freeware program like ssn.exe. 5) Teach your child to give your accommodation address and voice mail number as his address and phone number whenever asked (just like you do -- you do do that, don't you). 6) In descending order of importance: keep him out of government schools, keep him out of private schools in your country of residence, home school him. (Government schools give the government a direct opening into information about your family. Handing a child over to the government effectively ends any parental rights you might have while he is in school. Additionally, he may never learn to read and write.) 7) Introduce privacy concerns into your ideolect: Whenever you are driving around and see a police car say "There's the Geheime Staatspolizei" and explain who the "Home State Police" were. 8) Play privacy games like: Let's think of things we can say to people who ask us why we're not in school." "Let's think up some neat names to give to people when we don't want them to give them our real name." "Let's practice giving random answers to the question 'What's your name, address, and phone number.'" 9) When driver's license time comes teach them how to get a license in another state or country than their state of residence (and why this is important). 10) Get them a secured credit card in their true name to add to their ID pack. If you like, you can get them one in a nom de guerre as well. Secured credit cards are the best ID money can buy. (Because people think they're ID but they're not). DCF

2 1

anon remailer
by luc pac 17 Dec '03

17 Dec '03

hi -- i'm having a discussion with some people, trying to persuade them to set up an anonymous remailer on an italian server. i need a few technical data about how much computing resources does a remailer take, how much ram, cpu time, average traffic and so. since i can't deal with the huge (though interesting) traffic carried by this list, i'm not going to subscribe. so please if you can help, contact me privately at my address. i feel that if i succeed, a new remailer would be of some help for the entire cypherpunk community worldwide. thanks. --- Key fngrprnt (since 1993) = 52 DB 96 92 FA 1D CE 71 0D 63 96 E5 9A 9B 07 0A http://www.geocities.com/Hollywood/3879

2 1

Make.digital.money.fast
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Rabid Wombat <wombat(a)mcfeely.bsfs.org> writes: > On Sun, 10 Nov 1996, Clay Olbon II wrote: > > > Pyramid schemes could be a growth market in a crypto-anarchic world. It is > > yet another market such as gambling, or the lottery, that could be conducte > > with anonymity. And it appears to be much more widespread on the internet > > How is it like gambling? If I get a pyramid letter instructing me to send > money to five people on the list, add my name to the bottom, send to 5 > people, or whatever, there's nothing stopping me from removing all the > names, adding my name and those of four friends, and passing the letter > along. With an anonymous system, I could easily be all five people, > without even the bother of getting five different post office boxes. > > There's no gambling involved; only blantant stupidity. I agree - MMF is stupid. Gambling in Las Vegas is stupid. Buying lottery tickets is stupid (except in rare cases when the jackpot is very large.) The way most investors play the market is stupid. It's unbelieavble how many billions of dollars move around in non-productive activities which can only be described as stupid. Coming back to MMF, I recall the famous quote from Dave Rhoad's original post which said approximately: "The success of this project depends on the honest and integrity of each participant." (By the way, DR is a real person, living in California.) My small-scale survey indicates that almost all the people who post MMF try to "cheat" in a minor way by not sending the $5 to the 5 people upstream of them. I think this casn be prevented cryptograhicaly if the MMF post includes digitally signed assertions from the 5 upstream people certifying that they've received their $ from this particular poster. A slightly more sophisticated form of "cheating" is described by RW above: the poster generated 5 nyms, generated 5 receipts from these nyms, and effectively starts a new pyramid. A partial response to that would be to require each new nym to be certified by its immediate upstream neighbor: sort of like the web of trust, rooted in Dave Rhoades himself. But that too can be circumvented by a single person "spamming" the pyramid by multiple nyms all belonging to him. There's no good way to ascertain that mutliple nyms don't belong to the same person. > --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1