December 2003 - cypherpunks-legacy

Re: All our eggs in one basket?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Alan (Gesture Man) Wexelblat writes: > Today we use paper cash and paper forms. I go to the bank to > make a withdrawal, I fill out a paper form requesting > money. They take the form, fail to give me cash, claim that > I have been given cash. What recourse do I have? (Several > is the answer, but the point is that it's not a problem new > to digicash.) > > Today I order from a supplier. I send a paper form of > payment (P.O., check, paper copy of my CC #, etc.). They > cash such form and do not send me goods (or claim that they > did and they were lost in transit). What recourse do I > have? (Again, several. Again the point is that digicash > does not seem to be introducing new problems; rather it's > giving us new forms of old ones.) > I agree these problems are not new to digicash, but if we can design a digicash system that eliminates these problems, then we should. I don't know if it has been designed yet, or even if it's possible, but I would like to see a digicash system that does not force the user or the merchant to trust the bank. The merchant and user should be able to use an arbitrator to solve any dispute that may arrise. (assuming it gets that far) I don't feel it is good enough to trust in a reputation mechanism to prevent banks (or anyone) from cheating. We shoud try to do better. Actually, disputes may arrise without any cheating involved. Hardware and software failures may create situations that appear to be attempts to cheat. (I don't know this as a fact. Just my gut feel.) The less trust required, the easier it will be for all parties to settle disputes. (another gut feel) Jim_Miller(a)suite.com

1 0

(fwd) Re: Prosody Release Cancelled Under "NSA" Pressure
by kelly＠netcom.com 17 Dec '03

17 Dec '03

Organization: NETCOM On-line Communication Services (408 241-9760 guest) Xref: netcom.com sci.crypt:19346 talk.politics.crypto:1241 Path: netcom.com!csus.edu!csulb.edu!library.ucla.edu!europa.eng.gtefsd.com!howland.reston.ans.net!spool.mu.edu!nigel.msen.com!yale.edu!cmcl2!mcclb0!huff From: huff(a)mcclb0.med.nyu.edu (Edward J. Huff) Newsgroups: sci.crypt,talk.politics.crypto Subject: Re: Prosody Release Cancelled Under "NSA" Pressure Followup-To: talk.politics.crypto Date: 13 Nov 93 04:25:15 EST Organization: NYU Medical Center, New York, NY 10016, USA Lines: 43 Distribution: world Message-ID: <1993Nov13.042515.1@mcclb0> References: <931112.49291.KEITHWRITERS(a)delphi.com> NNTP-Posting-Host: mcclb0.med.nyu.edu Followups to talk.politics.crypto In article <931112.49291.KEITHWRITERS(a)delphi.com>, KEITHWRITERS(a)delphi.com writes: Technosys Press Release For More Information, Contact: Keith Boyle, marketing director keithwriters(a)delphi.com limetwig(a)mindvox.phantom.com For Release 10:47 AMEST November 12, 1993 Mirrorshades & Prosody Release Cancelled The scheduled release of Technosys' text composition program Mirrorshades and text revision/encryption program Prosody has been cancelled because of pressure from a governmental group claiming to be the National Security Administration (NSA) wishing to prevent the release of Prosody as an encryption program. The "NSA" has expressed concern over the encryption method used by Prosody. They feel that it may be using an encryption technology similar enough to another method of natural language encryption that Prosody might be able to be used to break that coding method. Therefore, they would like Technosys to hand over all existing copies of the software, technical & development notes, and software related to Prosody (i.e. Mirrorshades) for their research. Since the next step, if Technosys were to refuse, would be the seizure of all of the above materials by search warrant and criminal charges, Technosys has chosen to consent to their request and will cancel the release of these programs. However, THE MAN can't seize what's in our brain cells... (Technosys is looking for good information law representation. Anyone interested?) -=-=-=-=-=-=-=--=-=-=-=--=-=-=-=-=30-=-=-=-=-=-=-=-=-=-=---=-==-=--=-=-=-=-

1 0

Re: (fwd) Re: Prosody Release Cancelled Under "NSA" Pressure
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I thought the "Prosody cancellation" post was a hoax. Anyone know anything more about it? Jim_Miller(a)suite.com

1 0

Re: Key Servers
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> `wherever there is trust, there is betrayal.' Therefore, reducing your dependency on trust will reduce the opportunities for betrayal. Jim_Miller(a)suite.com

1 0

Re: "True Identities"
by lex＠mindvox.phantom.com 17 Dec '03

17 Dec '03

mg5n+(a)andrew.cmu.edu (Matthew J Ghio) Writes: >> >> I find it particularily interesting that on the internet (in contrast to >> almost every other net in existance), people have this strange fettish >> for worrying about anonymnity and "true names". My question is why? >> People on other nets never give the using of a handle or nym a second >> thought. (By other nets I mean Fidonet, WWIVnet, TEAMnet, C-Link, >> Oggnet, fvnet etc) A name is just a way of identifying a paritcular >> person. I don't see why people are so opposed to the use of nyms like >> Wonderer or Black Unicorn because those don't fit your image of what a >> name should be. These names identify the senders in a manner that is >> adequate to the discussion on Cypherpunks. Would it be any better if >> these people used names like Mike or John or something? Would it really >> make any relevant difference to the discussion on cypherpunks? >> Douglas Barnes Writes: > >I think the problem stems from the way most people initially got access >through the Internet, which was through fairly conservative affiliations >such as the military, government or academia; I've seen relatively few >military, government or academic environments that encouraged or allowed >people to go by "Black Unicorn". > >Increasingly, however, people are using the Internet for solely personal >reasons, independent of such affiliations. (Which is how Fidnonet, WWIVnet, >etc. have always been.) Now, no big surprise, we have Black Unicorn, >Wanderer, etc. I think it's a great testimoney to the rapidly increasing >diviersity of the net. (Although CERTAIN PEOPLE I'm sure will tell me that >such alleged diversity is only a PERVERTED SHAM and the number of REAL >people on the net is RAPIDLY DROPPING.) > I agree, background is the key. This whole conversation about Nyms, pseudospoofing, etc. is interesting. >From DAY ONE of me using a computer/modem/BBS/EMAIL in 1983 all I ever knew was to use a handle/pseudonym. On the underground BBS systems, using a real name or even a real-sounding name (even if it was a handle) would cause a good deal of suspicion and would make getting verified for full access difficult. I am constantly amazed how people routinely use their real names in conversations over the internet. I don't judge them however, I don't think they are stupid either, its just DIFFERENT than the way I am used to operating. The complete opposite viewpoint seems to be prevalent among those who have been using the internet for years -- before the general public started to overrun it. Those people have been accustomed to communicating with people who seemed to be real, at least they had real sounding names. Now an increasing number of pseudo-entities are appearing on the Internet. Some are disturbed by this. To me, its more like "what took so long". With irresponsible people sending mail bombs, using personal information from 'finger' to harass people they don't agree with, etc. it isn't hard to see why some people have reservations about various anonymous or pseudo- anonymous entities. The problem lies in the fact that creating a new identity on the internet either by creating additional user accounts or through the use of anonymous remailers is so easily accomplished that the concept of trust and reputation has been eroded. This is different from my background whereas reputation was essentially EVERYTHING and the creation of a new identity that allowed one to use desirable systems/services (ie, 'elite' systems) took long periods of time. The benefit of this type of social structure was that it naturally kept abuse, deception, and harassment to a minimum. I am not sure what my ultimate point is (as you may have surmised by now) other than there are inherent differences in each Internet user's background just as there are cultural differences among races in real life. There unfortunately will always be some prejudice against those who are different. Isn't a lot of energy saved simply by basing judgement on what others SAY and DO rather than what they LOOK LIKE or in this case, what their 'name' or 'nym' is? Lex

1 0

EFF's Kapor on Political Philosophy
by L. Detweiler 17 Dec '03

17 Dec '03

Mr. Kapor's words of wisdom. I will not comment except to say that I don't think he has accurately characterized the Cypherpunk position. ===cut=here=== Date: Sat, 20 Nov 1993 11:46:50 -0500 From: mkapor(a)kei.com (Mitchell Kapor) Rich Karlgaard <0005096930(a)mcimail.com> wisely observes: > ...the range of >political opinion in the U.S. is not always spread >along a single axis of left to right. I believe >there is another axis ascendant. It is >authoritarian/libertarian. > Try this exercise. Draw a left-to-right >line across a page. Then draw a vertical line from >top to bottom, labeling it Authoritarian on top, >Libertarian on bottom. You have just created a >grid with four quadrants. I have tried to illustrate his point. My deficiencies as a graphic artist are equaled only by the impoverished of ASCII as a graphical medium. Karlgaard's two axes: -----------authoritarian------------ | ^ | | | | |<----left------|------ right----> | | | | | v | -----------libertarian-------------- I want to substitute "anti-authoritarian" for "libertarian", as follows: ----------- authoritarian---------- | ^ | | | | |<----left------|------ right----> | | | | | v | -----------anti-authoritarian------- Doing this permits distinguishing two varieties of anti-authoritarian, the decentralist and the libertarian. -------------------------------------- | | | | | | |-------------------------------------| | decentralist | libertarian | | | | --------------------------------------- In my terminology Libertarian is used to refer more specifically to the right quadrant of the anti-authoritarian position. The left side of the anti-authoritarian space I have chosen to call decentralist. As Rich indicates, on some issues, like NAFTA and, I might add, the Clipper Chip, the opposing sides are divided, not on liberal-conservative political lines, but on the horizontal axis. I would claim that the lower half of the political space simply be called anti-authoritarian and that it is divided into two quadrants: on the left, the decentralist, and on the right, the libertarian. You can see how this works on Clipper chip and other privacy issues related to encryption. EFF chairs a coalition of 60 organizations, from the American Petroleum Institute to the ACLU, which opposes government control of encryption. You have cypherpunks and corporate interests aligned on this issue, because they all want decentralization of control over encryption technology. On issues where the goal is to remove government-imposed barriers, like privacy, there is easy agreement between left-leaning decentralists and right-leaning libertarians. The coherence of EFF's Board resides in the libertarian-decentralist commonality of interest which is more important than conventional divisions of left-right politics. On the other hand, the sometimes fractious nature of the public interest community, of which EFF is part, can be seen to in splits along the same horizontal axis. EFF supports private sector ownership and operation of the National Information Infrastructure,, Many other public interest organizations share the same general goals of openness for the NII as EFF but prefer approaches lying above the horizontal midline, e.g., through direct government ownership or operation of the NII. Infrastructure is a trickier issue than privacy. All anti-authoritarians would agree that a government-built NII is the wrong approach. However, there seems to be more willingness among many on the net who think of themselves as libertarians to leave it entirely to private industry to build the NII, where government abandons any role, even as referee. If we wound up with an NII controlled by an oligopoly of enormous corporate interests which resulted in centralized control over content, it would be a bad thing. If independent content providers can't easily get on the network, it would be a huge catastrophe. It seems to me that, in principle, corporate authoritarianism is as dangerous as government authoritarianism, and this is an issue which may separate left-quadrant and right-quadrant anti-authoritarians. A libertarian would argue that if government got out of the way, e.g., deregulated telecommunications and let everybody compete, it would be sufficient to achieve the right kind of NII. Personally, I think that's naive. A more considered libertarian view would be that either the market will produce the desired result by itself OR IT WON'T, but there is nothing anybody can do to alter the outcome. Thus government should stay out of it, and the public interest community should go home. To me, this is both fatalistic and simplistic. A decentralist would say that deregulation alone is not necessarily going to be sufficient to produce a decentralized NII. It might be and it might not. But if it is not, we do not need to be fatalists about it. We have the opportunity to try to influence the outcome both by working at the level of raising consciousness and through the possibility legislation which ratifies some sort of hard-fought compromise that achieves certain goals (e.g. for new common carriage or new universal service). This embodies the EFF approach. We may all get lucky in the sense that the architecture of consumer broadband networks winds up following a model which is more, rather than less, like the Internet in its openness and decentralization. This appears to be the general direction Bell Atlantic is taking. However, while their system is open (in terms of common carriage or system architecture), it is heavily asymmetrical with a big downstream pipe and a small upstream pipe, at least for the foreseeable future. If the TCI merger goes through, and if they are able to rationalize two different networks, business models, and corporate cultures, what obtains for BA will hold for TCI too. There are some mighty big ifs here, and in any event Bell Atlantic/TCI only serves 25% of the country. Other carriers, who have a different business model which does not emphasize revenue from transport a la Bell Atlantic, but revenue from content, may choose to go with closed, channelized systems. We have to see what other cable companies and telcos actually offer. Increasingly I am going to focus my efforts on understanding the likely architectural deployments of the carriers and how close they come to EFF's model of an open platform. The pragmatic question which faces us as we fill in the picture with details will be what, if anything, can be done, to nudge the system into providing alternatives which are closer to open platforms. All in all, I'd prefer to try to catalyze any necessary changes in mindset of carriers in order to secure voluntary moves. But as a pragmatist I believe that government action, or certainly the threat of it, may be useful or, in the worst case, necessary, to achieve the desired end. Further, since the whole process is already highly politicized, I think involvement to prevent bad governmental solutions from being imposed and screwing things up is clearly necessary. Thus politics is inevitably involved to carry out a an anti-authoritarian mission. At least in my view. ................................................................... Mitchell Kapor, Chairman <mkapor(a)kei.com> Electronic Frontier Foundation *** Join EFF!!! Send mail to membership(a)eff.org for information ***

1 0

Duress Codes
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

> From: baldwin(a)LAT.COM (Bob Baldwin) > A fellow I know has a central-office alarm in his home. When > the alarm goes off, the office calls his house to ask if it was a false > alarm. They ask for a password to verify, and no matter what password > you give they say "OK, I'll log it as a false alarm." If you gave the > wrong password, they call the police and notify them of a crime in > progress with hostages. For many years, I worked for a small company that provided various protective services to government, diplomatic and executive accounts. One of the services was electronic security and direct monitoring of emergency EDCs [electronic digital communicators] and other signalling devices connected to security equipment. At the beginning of my employment, the procedure you mention above was standard throughout the more mainstream electronic security industry. A series of unusually violent robberies changed this in the mid-1980s. The problem with the system is that call-backs on "panic button" or duress code activations make it clear - or at least suggest - that the victims have alerted the authorities. In an increasing number of cases, answering the callback was literally the last thing the victims ever did. In spite of frequent complaints due to false-alarm fines levied by the police and moments of great embarrassment, the common procedure became immediate notification of of the police or "other security," with no callback then or later. All duress codes on our electronic equipment was modified to perform the exact functions as non-duress codes, but activated silent duress alarms. Since that time, most manufacturers and programmers of security devices have taken that approach - identical function, but with silent alarms.

1 0

strong crypto => increase in rubber-hose attacks?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I remember seeing a news report a while back that said the number of violent car thefts has increased because more people are using sophisticated car alarms and/or car tracking devices. According to the news report, instead of breaking into cars when the owners were away, car thieves would wait until the owner shows up and deactivates the car alarm. The thieves then pounce on the owner, killing or severely injuring him/her, and take the car. Regardless of the actually magnitude of this problem (the media would call increase of 1 a major new trend) this did get me to thinking. Assume you use strong crypto to protect your secrets. Assume a lot of people start using crypto to protect their secrets. Assume there are people who want to discover these secrets. Might we some day see an increase in the number physical attacks as bad guys resort to rubber-hose methods to get at the keys that protect the secrets? Don't get me wrong, I'm still in favor of using strong crypto. I'm just wondering about some of the social implications. Jim_Miller(a)suite.com

4 3

unsubscribe
by markvoor＠mindvox.phantom.com 17 Dec '03

17 Dec '03

unsubscribe cypherpunks subscribe announce Mark Voorhees ////////////////////// // Mark Voorhees // markvoor(a)phantom.com \\\\\\\\\\\\\\\

1 0

Does someone know about irc "/on"?
by Sameer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Like I posted earlier, I'm working a bit to do diffie-hellman key exchange for the IRC. I was hoping to incorporate it into the source, and implement it via /dcc, but that's too tough. I've figured out a scheme which will work, but I don't know how to implement it in irc.. I'm wondering if anyone here knows how to do what I want-- (I still don't have my RNG working correctly, but I could probably grab one from someplace.. or leech off the ~/pgp/randseed.bin file.) Here's my scheme: Suppose I want to initiate an encrypted conversation with Alice. In irc, I do /startdh Alice What startdh does is call "ircdh Alice" "ircdh Alice" computes XB, saves it to a file /tmp/dh.Alice, and outputs to stdout, YB. startdh should then take the output of ircdh Alice and send it to alice, as a /ctcp send of type "dh-key" When Alice receives the /ctcp of type "dh-key" irc automatically should call: "ircdh Sameer YB" (YB is the information in the ctcp packet. ircdh will create an XA, and output YA and the key to stdout. on getting this information, irc should send YA to Sameer, and do /encrypt Sameer <key>. (The standard encryption routine in irc is insecure, but there's a facility for an external crypt program..) When I receive the /ctcp of type "dh-key" irc automatically should call "ircdh Alice YA" (where YA is the information Alice sent me) ircdh will see that a /tmp/dh.Alice already exists, so it will grab the XB from that file, and then compute a key, which it returns. Then irc should take the output of "ircdh Alice YA" and have it do /encrypt Alice <key> where <key> is the output from ircdh Alice YA. So I have the program ircdh working, except for my RNG. I need help with the interface with irc. Any ircII wizards out there? Thanks. - -Sameer -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLO/jAni7eNFdXppdAQH2FgP+OtP68BVfli92iPLBH7x+d7AV+GdTXkie 4Gy4BqlbiVwcSUERehZKcvnrrI0sm22Fb2YSNMLGQIekJDQczcSXu04NkJHoKFMY cig6f4MvySaHedqX3Sfvtg9vh8QM0g0/i4TAtWKq0w0WaTNgvJGQPDP/B4Bl5Zyf 9JI/e3jGIP0= =tv31 -----END PGP SIGNATURE-----

2 1