December 2003 - cypherpunks-legacy

Re: mail software for multiple addrs
by Ross Wright 17 Dec '03

17 Dec '03

On or About 15 Oct 96 at 18:46, Vladimir Z. Nuri wrote: > 1. multiple internet providers > 2. multiple email accounts > 3. multiple mailing lists How about Pegasus? =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

Re: AW: binding cryptography
by roy＠sendai.scytale.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In your mail, you write: > That is correct. Sorry that the BTW-statement is so evident. Some people > did not understand that if you *do* agree, then you *can* be breaking any > rules... Which of course implies that to be effective, the system can't allow anyone to opt out. > >Which they will, and presumably already do. Therefore, your proposal > >does not and cannot hamper criminals. Therefore, your proposal only > >hampers law abiding citizen-units' access to uncompromised crypto. > > I do not agree. For instance, the encryption possibilities of wordperfect, > and MS-word are weak; my mail-system (ms-exchange) does not have any > encryption at all. The security of these important Custom of The Shelf > products can and will be enhanced.. And as I pointed out above, the system only works when compromised-key crypto is all that is available. Where there are more secure options available, people will choose them. Your example is a good one: WordPerfect, MS Word and MS Exchange may well choose key-compromised crypto to gain the approval of the state. Thus, those products will never have real security. I can't agree that key-compromised crypto is secure at all, as it requires that some third party hold key (or the means to recover keys). You may argue that the supposed TRP can actually be trusted. I'm not willing to grant that trust without good cause. In the case of governments, I'm simply not willing to grant that trust at all. (to be fair, I acknowledge that the USA is not the Netherlands, and you may not understand Americans' distrust of our government) > The point is that public available systems should *aid* not them in their > criminal activities, let them search for alternatives. Compare it with the > legislation we have here on the sell of guns. You sort of say: hey, that > does not help cause criminals will get it somewhere. I say, that is true, > but it will make their lifes more difficult, or maybe I should say less > easy. My point is that I, as a member of the public, should not be restricted in *my* choices. Just as gun control laws make it harder for me to lawfully purchase and own a gun, your proposal makes it harder for me to lawfully obtain strong cryptography. The obvious difference is that guns are capable of inflicting fatal damage to humans, where cryptography is not. > >Registration plates do not "stop criminals". Locks do not "stop > >criminals" (although they might slow a criminal down). Neither will > >compromised crypto "stop criminals". But all the above impinge on my > >liberty. Am I to give up yet another freedom? > > Our system slows down criminals too, or maybe I'd better say does > not speed them up. And it also makes me more vulnerable. You are asking me to compromise my own security because some other person might abuse his own capability. Will you also ask that I allow my muscles to atrophy to the point where I cannot inflict damage with a blow from my fist, because others might decide to fight? It is important to remember that cryptography is 100% defensive. It _cannot_ be used in an offensive manner. Any plan to weaken or restrict cryptography is a plan to disallow defenses. How can you ask me to leave myself vulnerable to attackers? > We believe our system gives a solution in which every democratic > country on his own implement to their middle, without losing > connectivity with countries that think otherwise. Repressive states will endeavor not to allow connectivity with non-repressive states. Your plan only facilitates the repressors. Thus, you offer weapons of repression to governments. Still think it's such a good idea? - -- Roy M. Silvernail [ ] roy(a)scytale.com DNRC Minister Plenipotentiary of All Things Confusing, Software Division PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMmRoQxvikii9febJAQHOvAQAhzUvsJapB+lBWM0MNjkOPFg0PtIFIKID 7uhWjzQ7Lwp7WlCeiqcB9+AdZuQMxAC/cq4uJai98jv8/5ba3t1uPiLMIx+ytSAN q8UURDF3CWaX5TAzrC0OvdPUc+LONXVBebX0PMtwHaGZfsJWnebschJA36zRIY8Z in8xv1t78Z8= =GITW -----END PGP SIGNATURE-----

1 0

[Noise] Re: [*CORRECTED* POINTER] On Vulis' net background (fwd)
by Douglas B. Renner 17 Dec '03

17 Dec '03

On Tue, 15 Oct 1996, Rabid Wombat wrote: > Still more on this rather silly topic: > (Hey - at least I put "noise" on it) :) Definitely needed. :) SORRY* I typo'ed the most incriminating link - the following should work: http://www.math.harvard.edu/~verbit/scs/cranks/from-Shlomo.html#vulis (This is a fellow with a rather long & amazing history of net abuse. It's amazing enough to warrant a look. There is a sub-section titled "Who is Dimitri Vulis" that most CP readers would find shockingly familiar. It explains _quite_ a bit.)

1 0

RE: mail software for multiple addrs
by blanc 17 Dec '03

17 Dec '03

I use Win95 and Exchange for email, which works as follows: In Exchange you can set up separate user "profiles", for which you enter all the info for any number of different ISP accounts, including the phone number for access, login name, and also password, if you wish. Then when you open up Exchange you can select which account you want to connect to. You can have a default connection, but after you've downloaded the email from one service, you can then select a different service to connect to and get your mail from there, and so on. Each selection of a service provider will automatically: 1. dial the service 2. log you in 3. enter your password, or allow you to enter it manually each time 4. download your mail 5. disconnect There are bars at the top of the Exchange email list of messages by which you can sort your mail according to Sender, Subject, To, From, Date Sent, Date Received, Attachments, Level of Importance, etc., according as you click on each so-entitled bar. Then you can highlight the messages and put them into folders and sub-folders. Each provider brings up its own window of user-created folders. At this time Exchange does not provide automatic filtering or "rules" to send certain messages to particular folders unless you're connected to an Exchange server, but there is a nifty new mail package front-end coming out very soon which will do this. Then it will be possible to indicate that you want all your Cypherpunk mail going to the 'cpunk' folder, or messages from certain individuals going into a folder by their name (or you can send their email to the 'Delete' folder and set this folder to automatically delete all those messages when you exit the mail program). With Win95 you can also connect to a service provider through a semi-GUI interface for shell-access only (called Hyperterminal, similar to a telnet window) and use whatever software the provider offers (like Pine), and this will appear in all text, except that you can set automatic connections. You can create multiple icons with their own separate automatic connections for this type access as well. Internet Explorer 3.0 also offers mail features similar to Netscape, but they're also still comparatively simple (limited) . .. Blanc

1 0

Re: Royalties
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:31 PM 10/16/96 +0800, pclow(a)pc.jaring.my wrote: >> Thus, PGP Inc. now >> holds the exclusive license on commercial PGP products. > >Even the international version of PGP? There are lots of copyright notices in PGP. If you're trying to sell PGP-derived code in a country that's part of the Berne Copyright Convention or has other international copyright-honoring agreements, it may apply. But you can read it. Copyright is more widely accepted internationally than patents on mathematical algorithms, and the RSA patent in particular is not valid in most of the world because it was disclosed to the public before the patent was applied for (to avoid American government tricks that let the military classify and essentially confiscate processes that are "national security" related when you apply for the patent.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

AW: Binding cryptography - a fraud-detectible alternative to key-escrow
by Eric Verheul 17 Dec '03

17 Dec '03

On dinsdag 15 oktober 1996 22:48, Daniel Pouzzner[SMTP:douzzer@lechter.chautauqua.com] wrote: >"Binding cryptography" does not increase the difficulty of subverting >the key escrow facilities of a messaging system. In order to subvert >such a system, one can either modify the messaging system (as >described by leichter(a)smarts.com, for example), or nest another >cryptosystem inside it; these techniques are not impeded through the >introduction of "binding cryptography." There are no easier subversion >techniques, so "binding cryptography" has zero impact on the viability >of compulsory key escrow implementations. I agree that binding cryptography, or any "recovery" system can be subverted by nesting another cryptosystem into it. However, the advantages gained this way - in my opinion are small; people wanting to do this might as well use/make their own system. Compare this with the simple "recovery" system where users are obliged (*if* they voluntarily agree to *use* the system) to send along a session key encrypted with a public key of a Key Recovery Agent, and where *no* binding data is required. Then it would be trivial to convert this system into a criminally useful one - by a simple manipulation in software - with: - *not* having to build another cryptosystem (and its key-management) into the system; - packets send can by no means be distinguished by third parties from "correct" ones. As we liked the flexibility of choice in Key Recovery Agents of this system (which in our opinion amplifies privacy properties of the scheme) we proposed binding cryptography, as a middle between non-liberal private key escrow and the too liberal simple "recovery" system. > >I am troubled because your research is misdirected, and because by >publicizing your research you are serving to cloud what is >fundamentally a very simple issue. In your announcement you described >"binding cryptography" as an "alternative to key-escrow." This is >misleading to the point of falsehood. It is key escrow with even more >stringent constraints placed upon choice of algorithms and >architecture. The idea of escrowing session keys, rather than >keypairs or passphrases themselves, is hardly new. We know, see above. >The utility of key >escrow itself is indisputable - for example, it is a clear boon when >cryptography is used to secure documents in an institutional >environment. However, your proposed "alternative" adds nothing of >utility to either users or governments, and erodes the freedom of the >software architect. I find any architectural imposition repugnant, as >does any architect whose primary design criterion is quality. I think that architectural problems with key-escrow systems are more difficult than that associated with our scheme. The NRC study in fact raises the question of key-escrow on a large scale is at all possible. >Those of us who know better should not bicker among ourselves. >Compulsory key escrow is plainly unethical and mathematically >untenable. You should be ashamed for every minute you have spent >devising stratagems by which a public less technically knowledgeable, >but no less deserving of fundamental rights, can be duped into >accepting compulsory key escrow thereby abdicating their privacy and >endangering their safety. There is no middle ground. I respect your opinion, but I think there is a middle ground. Maybe you should be ashamed for not realizing the future problems that arise when even the part of the Global information superhighway that is paid for by society can be very conveniently used by criminals to harm society. > >-Daniel Pouzzner > Software Architect > >

1 0

http://www.cryptocard.com/cryptcomp.html
by Amanda McLean 17 Dec '03

17 Dec '03

Has anyone played with the freeware Delphi crypto library at http://www.cryptocard.com/cryptcomp.html? Is it any good? A.

1 0

[ANNOUNCEMENT] PGP
by dustman＠athensnet.com 17 Dec '03

17 Dec '03

Given how Timmy C[rook] May's propensity to molest little children, is it any surprise that the state of California wants to have him castrated?

1 0

AW: Binding cryptography - a fraud-detectible alternative to key-escrow
by douzzer＠MIT.EDU 17 Dec '03

17 Dec '03

oh pooh, you've seen this material run through over and over. perhaps you respect my "opinion" because you know i am right. i know i don't respect your position, because i am irrevocably convinced that you are wrong. acceptable: -tracking of all chemicals which have been or can be manufactured into poisons, explosives, or psychoactives (cannot buy or sell anonymously) -tracking of all automobiles and deadly weapons -restrictions on yelling "fire!" in a crowded movie theater that isn't on fire unacceptable: -restrictions on what i can think, who i can speak to, what i can say, and how i say it, aside from shouting lies in a crowded movie theater or other such crowded public place. -restrictions on how i can defend myself when my life is threatened -prohibitions on drug purchase, sale, or use i'm not ever going to change my position on this. you can drive bamboo shoots under my fingernails and toenails, you can megadose me on LSD, you can pull my teeth and administer electric shocks to my testicles, and i am still going to believe that absolute information privacy, and absolute freedom of thought and conversation, are inalienable human rights. if what you want to stop is airplane explosions, landmines, poisoned water supplies, and mailbombs, please PLEASE make it your personal mission to see that chemicals are more tightly controlled, airports have the latest and greatest nuclear resonance tomographic imagers, landmines aren't manufactured or sold any longer, water supplies are tested around the clock using the latest technology, and everyone knows not to open unsolicited packages. if what you want to stop is drugs-prostitution-gambling, perhaps you had better wake up. organized crime, and the drug lord, are created and empowered by laws which make drug sales, prostitution, and gambling illegal. why are they illegal? who is the victim? if you take away the legal mandates which impose the wills of religious zealots, you take away the structures which grant monopolies to violent criminals. no amount of pontification, education, or legislation is going to rid the world of people who will do whatever is necessary to get drugs, visit prostitutes, and gamble. so if you make them illegal, you instantly create a perpetual menace. and now you expect me to agree that we should help the government listen to everyone's communications, so that they can stop drug dealers, prostitution rings, and betting pools? hello? they created the problem. i don't trust my government. i don't trust ANY government. government is that segment of society that arrogates a monopoly on "legitimate violence." it is composed of powergrabbers, and ass-kissers with sinecures, who are paid with stolen money, some of it stolen from me. the last thing in the world i am going to find acceptable is a law that says i have to tell the government everything i tell my lover over the phone. fuck that! -douzzer

2 1

Re: extortion via digital cash
by Gary Howland 17 Dec '03

17 Dec '03

> Although Digicash's ecash offers anonymity to the payor it does not to the > payee. The reasons have to do with the way coins are blinded. So LE > could, with the bank's cooperation, easily associate the two sides of a > transaction. This was intentional on Chaum's part, either for moral or > practical political considerations. Its probably only a relatively minor > patch to allow one ecash purse (the kidnapper's) to generate the blind > token values so that another (similarly patched) purse (the vicitim's) can > submit them to the mint and return the minted coins to the kidnapper (e.g., > by posting on a popular Usenet group). Probably more than a minor patch, but doable nonetheless. > In this scenario the only > reasonable way left to track the money is via linkage (the size and timing > of deposits and withdrawls in the kidnapper's account). I can't see any reasonable way to track money obtained using the double blind protocol - after all, the kidnapper does not even need to have an account. Best regards, Gary -- "Of course the US Constitution isn't perfect; but it's a lot better than what we have now." -- Unknown. pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

1 0