December 2003 - cypherpunks-legacy

RSA Patent valid?
by Mike Ingle 17 Dec '03

17 Dec '03

We were having a discussion in my Computers and Society class about intellectual property, and the professor pointed out that the courts have consistently upheld patents of devices and processes which involve computers, but have shot down patents on algorithms. With that in mind, would the RSA patent stand up in court? Maybe that's why RSA has never sued anyone. They know the patent might not hold up, and it's easier to just keep their licensing fees lower than the cost of a lawsuit. If this is the case, it's good news for cypherpunks, because it means they will never take any action against us.

1 0

McCarthyism vs. Watergate vs. Kennedy Assassination
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

In all cases the people at the top could have insisted there was a paranoid `witchhunt' or `hysteria' going on. But in all cases, there *were* some intensely subversive and corrupt conspiracies going on. In the 50's, the Rosenberg-Soviet espionage ring was in full circle, stealing pricelessly valuable Atom Bomb secrets. The Rosenbergs were executed as traitors despite massive public uproar and appeals all the way to the Supreme Court and President Eisenhower (who was unmoved). The problem with McCarthyism was not that it was completely illegitimate (it was fueled by some actual conspiracies), but that it was carried to extremes. In Watergate, we had a corruption to the very highest levels of our executive branch of government, and a grotesque coverup that has so deeply shakened and poisoned honest people's trust in government for decades. The probes by Congress were met with evasion, stonewalling, and counterattacks. Nixon has been viewed as one of the most damaging presidents (to the institution of the presidency) ever to have been elected. In the Kennedy Assassination, according to a recent Newsweek, again there were coverups, but only by our own government to try to suppress the leaking of any information that might upset the American public into calling for retaliation against e.g. Cuba or the Soviet Union. They tried to comfort the public with a rapid investigation with foregone conclusions, rather than any systematic inquiry into the Truth. It seems to me that all are examples of how evasion, stonewalling, and counterattacks on Truth-seeking probes, by high-ranking officials seeking to promote unsavory or criminal personal `agendas' and their own respectability at all costs, led to monstrous consequences that demolished public trust in their most delicate and hallowed institutions for decades. Truly black consequences. Cypherpunks, you call it. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

Key vs. Signature revocation & Trust Webs
by L. Detweiler 17 Dec '03

17 Dec '03

*key* revocation certificates are in PGP. This an author issues if his key has been compromised. *signature* revocation certificates are not. this a signor issues (in theory) if he thinks he has been betrayed (spoofed or pseudospoofed). also, notice how keys spread between servers `like a virus'. the revocation certificates should do so as well. I don't know if key revocation certificates do so in today's servers. I don't really trust these servers! Also, I do not buy arguments that `I cannot ever be fooled, the web of trust is infallible, key signature revocation is superfluous'. Anywhere there is trust, there can be betrayal. Believe me, PRZ tried quite a few of these `I am infallible, I can never be fooled' arguments on me yesterday! But, PRZ is God. He knows a good idea when he sees one and will not be influenced by some pseudospoofing campaign by Medusa's snakes or dangles (double agents) in his `inner circle'. * * * I am proposing a completely dynamic, two-way, interactive trust system. Not something like you inscribe in a book, but something like the Internet. I was talking to another person at this meeting. I described how today there is only a one-way, tenuous trust system associated with e.g. commercial transactions and credit reports. For example: if a company rips me off, I stop doing business with them, my trust level for them plunges. But wouldn't other's wish to know of my problem? (Just as if *I* find that someone is pseudospoofing, shouldn't others be informed? <g>). Sure, I can send everyone email saying I was ripped off, but this all happens informally. What about a *formal* system? Suppose that I put a black mark on the company in the `web of trust' in a public database -- others may revise their own trust with that company when they hear they Ripped Off L. Detweiler. Most of the cypherpunks would probably revise their trust upwards <g>. This database would be like a yellow pages; anyone can read it when the go to do business with different companies. This obviously would be a powerful incentive to a company to mind their p's and q's, eh? Individuals should be careful though about making specific claims like `I was unsatisfied with service on date [x]' and not things like `company [x] rips people off routinely -- I should know'. Also, consider that a company puts a black mark on your credit record, erroneously. You contest it, and win. No consequence happens to the company. What if there was a negative reaction in their `trust level'? What if there was a public notice entered, `L. Detweiler was molested by company [x]'? All the trust levels associated with that company's entries decrease. Dynamic, two-way systems such as these are what will give consumers torque over Big Companies. Just as Big Companies make databases about you to influence their interactions, you can make databases about Big Companies to influence your own. These are inevitable developments. Psychopunks would rather fool Big Oppressive Companies into dealing with fake identities. But this is not acceptable. The company has a right to know who you are, as much as you have a right to know who they are. Psychopunk hypocrites, would you do business with an `anonymous bank'? hee, hee. Want to get really scared? Public web-of-trust databases will be developed for *individuals*--e.g., if you post *anywhere* public, others have a right to tabulate your actions into a central database, and even comment on them. (hee, hee, next few messages J. Dinkelacker will pop up and say `this has a very NSA feel to it.'). Others may even comment on your *private* actions in these databases if they are particularly offensive or socially dangerous, e.g. `stay away from His Royal Eminence, while he has made some contributions he is a raving lunatic, has mailbombed me, harassed my postmaster, and is really promoting the tax evasion and the collapse of governments and anarchy under the guise of Liberating Privacy.' Thanks for letting me talk about this, it all gives me some really interesting ideas about how to achieve this database. One might set up a `trust link' in a database whereby each party agrees to a transaction, and that either can later post a message to that public `link' regarding the status of that transaction. E.g., individual [x] can say `I got great service' on the `trust link' or the company can say `customer [x] failed to pay us'. Links could be cross referenced to find deadbeats and all that. People would decide who to do business with based on their trust link policies. But see how this system benefits *everyone*? You have power over the company, and the company has power over you. You trust the company, and vice versa. You can zap their reputation if they betray you, and vice versa. Another interesting idea is that of `dueling reputations'-- If I have a high reputation in some area, and I attack someone else in that area, their trust levels in that area should plummet more than if I had no reputation in the area. Today, one has to do all this informally, like posting to newsgroups trying to influence other people that one has been betrayed. Cypherpunks, this `web of trust' thing is just in its infancy. In a few years, we will have a Psychopunk's Worst Nightmare. Or an Honest Person's Civilization.

2 1

Re: Key Servers
by L. Detweiler 17 Dec '03

17 Dec '03

>I would like to remind you that a great deal of the noise on this list >is seeded by your posts. I dont disagree with everything you say but >your assessment of this list is incorrect. Mr. Newsham, please tell me how you know this list is not a HOTBED OF PSEUDOSPOOFING. What, because no *honest* people would do such a thing? because it would take too much time, patience, and money to insideously manipuate other's trust? what policy can you point to on the list that discourages pseudospoofing? `wherever there is trust, there is betrayal.'

1 0

J. Gilmore on Pseudospoofing
by L. Detweiler 17 Dec '03

17 Dec '03

I appreciate Mr. Gilmore informing me of his opinion on pseudospoofing. He does not specifically address the issue of whether he is personally aware of any on the cypherpunks list, unfortunately. Many people still don't get the pseudonymity vs. pseudanonymity. >I think that your artificial distinction between "pseudonyms" and >"pseudospoofing" is the root of where your thinking took a wrong turn. clearly, a pseudonym on a book cover does not involve active lying. more treacherous uses of pseudonyms, which I have described in detail, *do*. there is a difference between `not being obligated to reveal who you are' (anonymous or pseudonymous) and `lying about who you are' (pseudoanonymous). but I see I have failed to convince you of that. ===cut=here=== Date: Thu, 18 Nov 93 02:31:26 -0800 From: gnu(a)toad.com Subject: Re: RISKS15.25 To: "L. Detweiler" <ld231782(a)longs.lance.colostate.edu>, gnu(a)toad.com Hi... I just took the time to read your rant in RISKS 15.25. I think you're way off base on several counts. * Electronic media are no different from paper media in making it possible to use multiple names. Talk to Mark Twain, Dr. Seuss, Alice Cooper, Poor Richard, Paul French, or Franklin W. Dixon if you don't believe me. My experience is that references among aliases in literary works are seen as `in-jokes', which only the truly educated (in that particular realm, like science fiction) can notice and chuckle over. It's legal to use multiple names as long as you don't use them to defraud people. I use multiple names daily. Each magazine I subscribe to, or organization I belong to, knows me as "EE Gilmore" or "CPSR Gilmore". Then when I get a mailing from some random place, I know which organization sold my name to them, and if the volume of trash becomes excessive, I can write to the offending organization to have my name removed. My girlfriend didn't do this, and she now has a foot-deep stack of glossy catalogs that were mailed to her over the last month. And she doesn't know how to stop them coming (and we don't have a woodstove :-). * Your examples imply that some of the people on cypherpunks are using pseudonyms to deceive people: > I have become aware of these serious abuses possible with pseudoanonymous > posting from my long affiliation with the Cypherpunks, an allegiance I have > now severed because of my realization of their basic hidden agenda in > promoting the practice of pseudospoofing, or using pseudoanonymous identities > in the aforementioned ways to manipulate and systematically deceive others in > cyberspace. I think that you mistake an honest advocacy of the right to use multiple names, for an advocacy of deceit. The main reason to use multiple names is so that your "enemies" cannot correlate your activities so that they can punish you in one part of your life for things they don't like in some other part. For example, if you are gay, you might use a pen name when writing for local gay publications, so your prejudiced employer won't fire you. If you drive a car, you might want to use a different name on your driver's license so that "smoke a joint, lose your license" laws will not find a record of your license if they catch you with a joint. (There is no correlation between marijuana smoking and hazardous driving -- it's simply a punishment technique that happens to be considered legal because the "right to drive" is not a right guaranteed in any constitution nearby.) Another reason to use multiple names is to track what is being done with the name you supply, as in my example above. David Chaum was the first person I noticed advocating the use of a different pseudonym for transactions with each different organization. (This was automatically done by a smart-card in his design.) Is he part of the evil conspiracy too, or does he have a point worth hearing? How would *you* turn back the trend toward having every bit of information about each person accessible to anyone who knows their name, date of birth, fingerprint, license number, license plate, vehicle ID number, passport number, genotype, bank account number, retina print, credit card number, photo, or social security number? Or do you think that this is a *good* thing? I'm not sure why you trust _me_ in this, actually, if you think that Tim May and Eric Hughes are fake people or possibly the same person. I think that your artificial distinction between "pseudonyms" and "pseudospoofing" is the root of where your thinking took a wrong turn. People are under no obligation to tell you whether the name you know them by is their only name -- the same way that they don't have to tell you that though you only know them as "captain of the baseball team", they are also "clerk in the bank" and "father of three". By assuming that "the right way for things to be" is for everyone to have a single name, uniformly used, you have found a conspiracy where there was simply a difference of opinion. You can quote this (in its entirety) to the cypherpunks if you want. Copyright 1993 John Gilmore. Reproduction permitted only in entirety. John

1 0

Re: Key Servers
by L. Detweiler 17 Dec '03

17 Dec '03

>I dont think this list should have a policy against "pseudo spoofing". >Even if it did, there would be virtually no way of upholding such a >policy. If you are so concerned by this phenomenon then you should >come up with a technological solution. there isn't a solution to enforcing honesty. that's why we have criminals. do you think there is a `code of ethics' in maintaining privacy among cypherpunks over their email? why can't we insert into that, `thou shalt not pseudospoof your fellow cypherpunks'? I can't wait to see the Cypherpunks Code of Ethics. hee, hee. Suddenly I am having visions of snowballs and Hell. I would volunteer to start a list of everyone who agrees not to pseudospoof each other on this list or in private email and distribute it. But I won't, because the pseudospoofers (esp. those at the top) will not apply. The pseudospoofers were quite amused by my pseudospoofing survey. Imagine -- even revealing that they are doing it, without revealing the identities? What kind of idiot do I think I am? Hey pseudospoofers -- you are nothing but hypocrites wrapping yourselves in the flag of privacy while urinating on it. *maybe* you have a right to imaginary identities in quarantined playpens, like the Pseudospoofing Game, but not in any serious forum. But why are you such slime in not revealing to others that you are doing it? because you want to embezzle, and part of embezzlement is never getting caught. You think you are getting back at Big Corrupt Businesses. But you are doing nothing but betraying *everyone* you come in contact with, with your little identity arsenal fantasies. The Psychopunk Code of Ethics Nothing Is Wrong. Nothing I Ever Do is Wrong. I can Never Admit To Anything because I have Never Done Anything Wrong. Privacy is Sacred -- Even if You are a Criminal -- Especially if You are a Criminal. bastards. I used to think that 1/3 of the Royalty was Pure. But it is 3/3rds Corruption. Not only rotten *at* the core, rotten *to* the core. <vomit>

1 0

Secure Drive 1.0 is here!
by Mike Ingle 17 Dec '03

17 Dec '03

INTRODUCING S E C U R E D R I V E 1 . 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ AVAILABLE NOW Do you have confidential or sensitive information on your DOS/Windows PC or laptop? Imagine what could happen if that data were to fall into the wrong hands through theft or unauthorized access. Protect your privacy with SecureDrive. SecureDrive allows you to create an encrypted hard drive partition and encrypted floppy disks. All of your sensitive data is automatically encrypted with the state-of-the-art IDEA cipher. You simply log in with your passphrase, and the program is completely transparent to your applications. The TSR uses only 2K RAM, and encrypts at the sector level. An intruder gets nothing - not even your directory listing. You can decrypt your disks at any time. The program automatically switches on and off as you access encrypted and unencrypted floppies. Invalid passwords will cause a Drive Not Ready error, locking out writes and protecting your data from damage. The program is Copylefted under the GNU General Public License, and source code in C and assembly language is included. This program is free and always will be. This program may be freely distributed within the U.S. and Canada; do not export it. Cypherpunks Write Code! Thanks to everyone who helped me beta test this program. Note: This version is compatible with the beta version. To receive your copy: send e-mail to <mikeingle(a)delphi.com> Specify uuencode or pgp ascii armor formats. I will make a list and broadcast the code.

4 6

Re: Privacy/Money Orders
by Jef Poskanzer 17 Dec '03

17 Dec '03

>You can get some information on bills via telnet to locis.loc.gov, >the Library of Congress Information Service. Still a few bugs in this system - amusing transcript appended. --- Jef Script started on Fri Nov 19 17:42:01 1993 % telnet locis.loc.gov Trying 140.147.254.3... Connected to locis.loc.gov. Escape character is '^]'. L O C I S : LIBRARY OF CONGRESS INFORMATION SYSTEM To make a choice: type a number, then press ENTER 1 Library of Congress Catalog 4 Braille and Audio 2 Federal Legislation 5 Organizations 3 Copyright Information 6 Foreign Law * * * * * * * * * * * * 7 Searching Hours and Basics 8 Documentation and Classes 9 Library of Congress General Information 12 Comments and Logoff Choice: 2 FEDERAL LEGISLATION These files track and describe legislation (bills and resolutions) introduced in the US Congress, from 1973 (93rd Congress) to the current Congress (the current Congress is the 103rd). Each file covers a separate Congress. CHOICE FILE 1 Congress, 1981-82 (97th) CG97 2 Congress, 1983-84 (98th) CG98 3 Congress, 1985-86 (99th) CG99 4 Congress, 1987-88 (100th) C100 5 Congress, 1989-90 (101st) C101 6 Congress, 1991-92 (102nd) C102 7 Current Congress, 1993- (103rd) C103 8 Search all Congresses from 1981-->current 9 Search all Congresses on LOCIS 1973-->current Earlier Congresses: press ENTER 12 Return to LOCIS MENU screen. Choice: 7 FRIDAY, 11/19/93 08:43 P.M. ***C103- THE LEGISLATIVE INFORMATION FILE FOR THE 103RD CONGRESS, which was updated on 11/19/93 and contains 7,958 records, is now available for your search. CURRENCY: All information is NOT current through the above date, which is machine generated when ANY information is added to the file. Bill numbers, official titles, sponsors, and status (STEP) added within 48 hours. Indexing terms and digests added later, in some cases several weeks after the bill is added to the file. TO START RETRIEVE to find: EXAMPLES: SEARCH: member name --------------> retrieve rep gingrich retrieve sen kennedy bill number --------------> retrieve h.r. 1 subject keywords ---------> retrieve day care FOR HELP: Type the word HELP and press the ENTER key. READY FOR NEW COMMAND: retrieve assault guns DFH2206I TRANSACTION BGNS ABEND AZI4 . BACKOUT SUCCESSFUL 20:44:36 help DFH2001I INVALID TRANSACTION IDENTIFICATION HELP - PLEASE RESUBMIT 20:45:34 ? DFH2001I INVALID TRANSACTION IDENTIFICATION ? - PLEASE RESUBMIT 20:45:39 oh boy DFH2001I INVALID TRANSACTION IDENTIFICATION OH - PLEASE RESUBMIT 20:45:48 select * from all DFH2206I TRANSACTION SELE ABEND SECV . BACKOUT SUCCESSFUL 20:46:05 quit DFH2001I INVALID TRANSACTION IDENTIFICATION QUIT - PLEASE RESUBMIT 20:46:23 logout DFH2312 - WELCOME TO CICS/MVS - FRIDAY NOVEMBER 19, 1993. 08:46 PM UX01 ACFAE138: ENTER YOUR PASSWORD: XXXXXXXXXXXXXXXXX EEEEEEEEEEEEEEEEE OOOOOOOOOOOOOOOOO IIIIIIIIIIIIIIIII foo ACF01004 LOGONID UT NOT FOUND DFH2312 - WELCOME TO CICS/MVS - FRIDAY NOVEMBER 19, 1993. 08:46 PM UX01 ACFAE133: ENTER LOGON ID: quit ACFAE138: ENTER YOUR PASSWORD: XXXXXXXXXXXXXXXXX EEEEEEEEEEEEEEEEE OOOOOOOOOOOOOOOOO IIIIIIIIIIIIIIIII foo ACF01004 LOGONID QUIT NOT FOUND DFH2312 - WELCOME TO CICS/MVS - FRIDAY NOVEMBER 19, 1993. 08:46 PM UX01 ACFAE133: ENTER LOGON ID: ^] telnet> close Connection closed. % exit script done on Fri Nov 19 17:46:43 1993

2 1

"IDENTITY CHALLENGE!"
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

jrk(a)sys.uea.ac.uk (Richard Kennaway) says: + Anonymity brings a new class of useless message, of which the + following from Black Unicorn <unicorn(a)net.digex.access> is a recent + example. I quote it in its entirety: + + Having worked in Liechtenstein banks, I can assure you numbered + accounts exist. + + "Black Unicorn" is an obvious pseudonym, and I'm assuming that it is + not one with an established reputation. (For all I know, "Black + Unicorn" might be as famous as the Legion of Doom, but for the sake of + argument I'll assume that it isn't.) + + What is the use of an unsubstantiated assertion, from an unreputed[*] + source, with no means of verification? Having read Black Unicorn's + bald asertion, I am as ignorant as before of whether numbered accounts + exist, in Liechtenstein or elsewhere. Well, that's as may be, but I would suggest to you that "actual identities" are unreliable. I believe that many here could trivially spoof almost any identity and that in any case, you would personally be unable to either verify the identity of your correspondent or hold him accountable for his output. A couple of recent examples: * A "Rikiya Asano" <ra01+(a)andrew.cmu.edu>, apparently a severely disturbed Japanese student at Carnegie-Mellon University, has been filling several newsgroups with a remarkable torrent of cross-posted flamebait for several weeks, including racist insults against whites and Chinese, physical threats and various assaults on American institutions. These rants are composed in hilariously fractured English and gain oceans of angry responses which disrupt the normal progress of the newsgroups to which they are posted. Today, I read a post by someone who makes a convincing case that Asano isn't Japanese and that the whole thing is a spoof. Maybe "Asano" exists and maybe he doesn't, but there seems to be no way of either verifying his true identity or making him stop disrupting these newsgroups. * On the other coast, "Andy Freeman" <andy(a)cs.stanford.edu> authored a particularly nasty piece of netmail forwarded on to me by its original recipient. In it, "Andy Freeman" attacks the practice of anonymity on Internet and claims to be in the government employ, implicitly in law enforcement, surveying Internet for illegal activity. He avers that all of those who post anonymously have been investigated and identified by their true names and are on a government hitlist, presumably thanks to his participation. Maybe "Andy Freeman" really is an unhinged cop involved in an illegal investigation of remailers or maybe he is just one of those sick fucks who like to impersonate policemen and bully people. * I personally challenge you, or anyone else on the net, to establish who these creatures actually are and whether they are what they claim. I've given you their "real" names and "real" addresses. In that both are bona fide assholes in any case, there's no need to be concerned with injuring or harassing them - they've got it coming.

1 0

Re: War of the Worlds
by nobody＠cicada.berkeley.edu 17 Dec '03

17 Dec '03

>taken to ensure that no one took the dramatization seriously. Also, NBC >ran into intensely unpleasant repercussions for their `fake exploding >pickup' piece (didn't someone resign over this)? > Eh? I don't think you're talking about the same case: 1) GM lost a $100 million dollar lawsuit: parents of a dead teen sued GM, they alleged faulty design caused the truck to explode. 2) NBC ran a story about these exploding trucks. 3) GM claimed the trucks were rigged to explode. 4) NBC consistently denied anything of the sort. 5) GM did their OWN extensive investigation and proved NBC fudged the results. 6) NBC finally admitted to rigging the experiment. They fired three top execs of "DateLine" to COVER THEIR ASS. >The point is that the media takes Truth very seriously. They go to the >greatest lengths to achieve it. This is crap. NBC went through great lengths to cover the truth until it became clear GM had them. If for some reason you think eliminating ``pseudospoofing'' will eliminate disinformation, you're way off since if happens ALL the time NOW.

1 0