December 2003 - cypherpunks-legacy

BIX musings on Zimmermann
by peace＠BIX.com 17 Dec '03

17 Dec '03

Reposted from bix.com ========================== security/encryption #695, from gnikoloff, 2722 chars, Tue Feb 22 19:24:18 1994 This is a comment to message 694. -------------------------- I think many of us want to know anything that happens. (About the Zimmermann Grand Jury). If Phil Zimmermann is indicted for what he did, then I can't see how the US can differ from any third-world police state. I can remember reading about how 'Fusion' magazine, which is a publication dealing with Nuclear Fusion, was prosecuted for allegedly revealing secrets behind the construction of thermonuclear weapons (amazingly, one of the key techniques was the use of Styrofoam to build a stable plasma during detonation). They pointed out that the details had been published 30 years ago in the Encyclopedia Americana. I believe the case was dropped. Phil didn't invent RSA encryption. He just popularised it by providing a great product, professionally designed and written, easy to use. To attempt to suppress this technology now would be as futile as suppressing details on the construction of nuclear weapons. Enough information exists in the public domain for countries such as North Korea to build a bomb. You can't, as one science-fiction writer said in another context, "put the mushroom cloud back in the shiny uranium sphere". Actually, now I think about that, it was Isaac Asimov in his story about an invention which allowed people to see back into time. Suppressed by the Government, it was independently re-invented by a professor who only got curious about the topic when he realised it was classified. The catch; when does time begin? one second ago?, one nano-second ago?. With the invention, privacy became a thing of the past; you could go anywhere, see anything. Its kind of a neat twist on this issue. The government would have us believe encryption is a *bad thing* because bad guys will use it to hide their activities. But,like the time-travel machine, there are good and bad points. Who do you believe?. Myself, I want to use encryption such as PGP for good and legitimate reasons. For example, if I want to send confidential information over the Internet, which is obviously not a secure channel. It is patently ridiculous to suggest that I should not be permitted to do this. But the arguments have been done to death. Like abortion, it boils down to the right of the individual versus the rights of the State (and by implication, society as a whole). I vote for the right to privacy. In fact, I had thought it enshrined in the Constitution. It is a basic tenet of life in a democratic society. If you're reading this, Phil, there are many people backing you 100%. As for the rest of us, make a stand. To the owners of BIX, if you permit these sorts of discussions on your system, you should have the courage to post PGP. There are other US sites on the Internet still holding it. Stand up and be counted!. They can't sue you all.

1 0

Re: RATINGS: Subject tags
by Alexander Chislenko 17 Dec '03

17 Dec '03

For quite a while now, I have been advocating a rating system based on *calculating correlations* of people's interests in each topic domain. This allows to: - give personalized ratings to each user; - filter out any number of "evil tentacles" recommending you junk; - suggest incentives to each user to rate articles; - introduce digicash payments for all messages and ratings; - implicitly use quality criteria that are difficult to formalize; - find like-minded people, even if you never post anything In short, it works like this: you read stuff, if you like it, you pay for it as much as you want; what you pay is considered your rating of the article; the System calculates correlations of your ratings with everybody else's; you can select articles that people with your interests in the given area liked most; so it makes sense for you to pay and be sincere - otherwise the system may not work for you, and you will read too much junk. Also, people whose ratings helped you choose it, can get some share of your payment - another incentive to read early and carefully, and be fair (you can actually earn credits as a critic). Authors can establish minimal payments for their texts, but it will be not their advertizing headers, but the opinions of like-minded with *you* people that will help you choose texts. I have a more or less detailed development proposal for such a system and would be happy to share it if anybody is interested. ------------------------------------------------------------------------------ | Alexander Chislenko | sasha(a)cs.umb.edu | Cambridge, MA | (617) 864-3382 | ------------------------------------------------------------------------------

1 0

RATINGS: an alternative request-based system?
by Seth Morris 17 Dec '03

17 Dec '03

I have been thinking about the proposed ratings system, and thought long and hard about what *I* would want in ratings I receive, and how much I would like to rate articles with ease. The model I arrived at was substantively different, and may reduce overall bandwidth while allowing greater control of my own personal mbox. What I would see is a list which only sent the traffic to a subscriber on _request_ instead of at once (perhaps more digest-oriented). I would send a message to cypherpunks-rated(a)whatever.domain (which could be an independant ratings group subscribed to receive and hold the "normal" 'punks list, and perhaps other related lists) with a command to get the mail I had not yet received. I would prefer that the list handle a database of when I last requested mail, and perhaps had a command to just tell me how MUCH mail was waiting (in both messages and Kb). Then, the messges would arrive, along with any ratings. Perhaps some services could maintain a ratings profile for me, of the signators I trusted to rate and the topics/ratings I prefer (one especial benefit for me would be to raise my filtering level at the transmission end on those days when the volume had increased, as launchpad has _serious_ disk problems, and I'm telnetted in at 2400 bps anyway). The messages would arrive and I could reply to cypherpunks-rated with MY ratings/comments (whichI would like to see batched and transmitted to the author, so comments on saliency/style/flamage would be sent only to her/him and not clutter up anyone's mailbox) to the server to be added to the list. This way, new messages are always sent (although it would be easy to change that, preferably in my profile) to be rated, and old messges have longer accumulated ratings. Actually, this runs more like a mail-based archive than a list, but the end result is similar. Perhaps a couple of days hacking at some archive manager (like the ones at most listserv's... does majordomo have archiving?) could set up a running prototype. It seems that this meets most of the requirements: multiple ratings, multiple ratings services, easily alterable filtering profiles, easily extended to handle keywords (many archivers already o this, of course). Specifics are debatable: the source filtering seems controversial (although I don't know why, unless people are worried about having the list manager know their preferences, in which case they can get everything and its ratings and handle them locally), so maybe the server shouldn't keep persistent profiles, but should receive a request with a profile for that specific request. Perhaps I send a "request on" message, and receive a message containing information on the queue: how many new messages (in however much time, so I know), how many Kb, how many rated messages on which common topics (in any given two-day period, the number of topics stays pretty low), etc, and I reply with numbers ie: >Per: your "request on" message of 940401:1935GMT > Last request 940401:1209GMT >Messges: 12 >Kbytes: 65 >Remember: ar is "Average Rating" of raters accepted in your > "request on" message: Raters id's follow: > exclude: BIFF.DORK(a)BITNET.SHOUT > exclude: ld*@lance* > accept: master.rater(a)text.analysis.god.com > >Keyword: Remailers... 3 messages rated, 1 message unrated, ar:8.2 send all Remailers >Keyword: Libertarian... 2 messages rated, 0 messages unrated, ar:0.6 send above 2.0 >Keyword: PGPTools... 5 messages rated, 1 message unrated, ar:5.2 send above 7.0 send below 1.0 #for chuckle factor > Your messages comments: > msg id: xxxxxx > "Excellent, it changed my life" Rating: 1.1 --SomeOne > "Rehash of old crap" Rating 7.6 --SomeOne Else > msg id: yyyyyy > <no comments> Hmmm... a bit too wordy, but you get the idea. (Get the lucifer? Get the skipjack? (Remember: Ounce for ounce...) ) This would also make receiving multiple lists easier for those of us with no filters (Where does one get pc-elm???????), as we could receive one list, process it, and then get another list, allowing us to not get them mixed up. Seth Morris (seth.morris(a)launchpad.unc.edu)

1 0

Education needed, but what specifics?
by Seth Morris 17 Dec '03

17 Dec '03

I think we all agree that the public needs education on crypto and crypto politics. What specific issues need to be addressed? For some time now, I have been kicking around ideas for games related to crypto, and I have decided that it may be an excellent education/propoganda tool. What I'm thinking of is a BBS door that incorporates encryption ideas (probably without using any actual excryption, to make sysops more comfortable with it -- I'm co-sysop of a local BBS and my "real" sysop refuses to allow crypto software on it, for the same reason he's reluctant to house an adult area, no matter how much he personally would like both (although, admittedly, he's primarily interested in the adult area)). Originally I had thought of a game where encryption was used to transmit messages to units (a space-war-game, perhaps?), and capturing and decrypting your opponents messages was paramount. Ultimately, as your "cryptotech level" increased, you'd get stronger cyphers and develope public-key tech, etc., but this seemed pretty limited in its educational potential and pretty derivative of existing games. My current idea is something more based on the net. Players take the role of corporations pet punks, or freelancers, and use encryption to cover their butts while following traffic analysis trails of opponents (digital) money, setting up services for profit (and perhaps to follow the traffic opponents pass through them... leading to more encryption, etc), leading to ratings services and digital reputations, leading to denial-of-service attacks, etc. This could get exciting to play, and would lead to a cypherpunks-agreeable position in the game, perhaps facilitating "market penetration" of EFF, CPSR, and other cypherpunks-friendly literature. Perhaps the game should make frequent mention of PGP, RSA, Chaum and other sources in the literature (a door with a bibliography!)? What do y'all think of the idea? I think gaming is a wonderful way to spread ideas, and have been looking for a way to use it for some time. What elements of cypherpunks' philosophy and methods should/could be incorporated? I think emphasising the cyBerpunk-like aspects of the game (spoofing to get information, copyiong mail logs to follow message traffic, etc) would make the game more popular, and while it might hurt the game's reputation as a propoganda tool (wow-- a game that's a manual on attacking services on the net... how is that good for people?), it should increase the player's awareness of the _need_ for signatures, reputations, untraceablility, etc. Besides, who wouldn't want to infiltrate Denning Associates Corporation and Stern & Light Pharmaceuticals to funnel money and information to Mayday Publishing or somesuch? Seth Morris (seth.morris(a)launchpad.unc.edu) PS- I'm still having problems with PGP Tools 1.0c. The ptd.exe locks in fifo_destroy when trying to find a private key on the ring. Any suggestions? My first applet to test the library (an MD5 hasher for files on the command line) works fine, though.

2 1

Re: Education needed, but what specifics?
by Seth Morris 17 Dec '03

17 Dec '03

> Seth Morris writes : > > > > For some time now, I have been kicking around ideas for games related to > > crypto, and I have decided that it may be an excellent education/propoganda > > tool. > > Interesting.. Interesting.. > > > > > Perhaps the game should make frequent mention of PGP, RSA, Chaum and > > other sources in the literature (a door with a bibliography!)? > > Getting better... > > > > Whoa... is this thing supposed to be a *game*, or a training school for > net.guerilla.warfare? I may be a minority of one, but I'm not going to Point well made, and I did allude to the possibility that some would see it as that (although I think I was unclear about specifics, I had nothing actually _training_ like in mind certainly!). This is to be a game, primary emphasis on fun. I find that I learn best when I'm having fun, and my experience with rpg's and wargames has been that I think about the implications and inspirations for the games I play. (Has anyone else read the story about the USG using games to manipulate the voters? Where they make a voting game to increase turnout in a manner similar to Monopoly's supposed influence on people during the depression?) > risk *anything* by trying to hack mail systems, trace their logs, or > spoof. Quite frankly, I can't be bothered - apart from a sort of 'James > Bond' thrill, that sort of thing has no appeal whatsoever. Hopefully, I'm > just missing the point here, but I wonder how smart it is to advocate > 'hacking net services' in a game that is supposed to introduce people to Understyood, and agreed. All simulation, not like reality. I haven't ever commited such silliness myself (part of why I'm asking for ideas), and I see no reason for anyone else to. > strong crypto. Although it might not be very thrilling, my hope is that > Mom and Pop Citizen will one day use PGP (or <insert-favorite-crypto-here>) > on their routine e-mail - they may never know or care about telnetting to > port Q-47, and I don't think that matters much. Be careful with the game; > don't overemphasize the cloak-and-dagger to the point that Average Citizen > gets spooked off strong crypto. I'm hoping that the game would emphasize that anyone could _need_ strong crypto, and anonymity, and digital cash, etc. Also that understanding your network makes you and everyone else safer. > Don't take this as flame-bait, please; this just posting just hit me at > the right time to provoke a philosophical outburst. While it is fun for > the cypherpunks to skulk around and spoof each other, we must not lose > sight of a large segment of our intended audience - namely, those people > who might hop on the strong crypto bandwagon so long as the 'skullduggery' > factor does not get too high. I think there is a large market for crypto > services that is completely detached from the 'full blown' cypherpunk > agenda of anonymity, remailers, untraceability, etc. Have you played the game "Neuromancer" based on Wm Gibson's novel? My thought all the while reading the book was that it's make a better game than novel, and I was right. The game focuses on finding and infiltrating systems on the net with emphasis on tracking financial transactions and reaching secure(?) meeting places with other net underworld figures. The game was immensely popular, and could have used more "puzzle-like" elements, more data presented to the player, and an interactive option. That is more like what I'm proposing. The players I know of BBS door games in Tucson, Arizona (where I'm located physically), would like to see more control than would make the game "friendly." Understanding that their sysadmin can follow the sendmail logs might encourage users to use crypto on their mail, and use remailers (even non-anonymous remailers, just designed to take the tracking away from their own sysadmin and put it with one they have CHOSEN to trust). I know a lolt of sysops, and you'd be surprised how much email is read. Also, if more people are thinking about didgital cash, anonymity, encryption, and the lack of proivacy they have (and how public their lives may become if governments/corporations/"unfriendlies" of all types were the ones controlling information entirely vis a vis clipper, storuies of sysops reading mail, stories of corporations reading mail, stories of operators listening in on phone calls, ...), the more solutions will emerge, and the more prepared the people already using computers to exchange ideas will be when confronted with the options that take away privacy as opposed to those which enhance it. Perhaps I should send you a plan of what I'm thinking? Storyboards? I do **NOT** want to be seen as suggetsing/writing a manual on net.warfare, but the cyberpunk novels are already pretty closeto to what I'm thinking of and without presenting real dangers, I don't know how to suggest people use real solutions. Any suggestions are greatly appreciated. (Glad I didn't mention the proto idea of having users use hunter-killer viruses... that'd get me in trouble!) I appreciate criticism. Disagreement isn't flamage. Indignation isn't necessarily ad hominem. Please help me prepare a concept that won't cause these reactions in the non cypherpunks-friendly communities. Ideally, the abstract for the gam,e shouldn't raise too many eyebrows in comp.virus, talk.politics.crypto, or anywhere else. It certainly should be something sysops would be willing to use. Seth Morris (Seth.Morris(a)LaUNChpad.unc.edu)

1 0

Re: Disinformation (or the Truth?) About Clipper
by geoffw＠nexsys.net 17 Dec '03

17 Dec '03

> Phil Karn says: > > >The idea of a disinformation campaign to oppose Clipper really bothers me. > > >Isn't the true about Clipper damning enough? Lying about Clipper seems like > > > > I agree completely. Telling the truth is all that's necessary. You know, I'm a person that rarely lies, I don't lie to aquaintances let alone friends, but in this regard I think I have to side with Tim. We don't have the time or money to flood the media with the truth, this thing has to be STOPPED by any means necessary, The truth will surface one way or the other, It will surface when it is too late and we are all in jail for using illegal crypto, or it will surface when Clipper is finally derailed and the nation/industrialized world is free to be able to have the truth known. "THINK, It ain't illegal... yet." - George Clinton

2 1

Re: Disinformation
by smb＠research.att.com 17 Dec '03

17 Dec '03

How will the development of the Clipper hamper the info-supe-hi? And what is the info-super-hiway anyway, eh? I'll leave out the buzzwords -- but Clipper will definitely hamper the deployment of good networks. Encryption is a vital tool for network management and authentication, even apart from privacy considerations. But Clipper is of necessity hardware-only, which means that most current platforms will never support it, and few future ones will actually have it, whether they're capable of it or not. And on many important boxes -- routers, for example -- just leaving room for Clipper on the boards will be expensive. We have the following dilemma: DES isn't exportable, Clipper isn't suitable, and lots of foreign governments won't allow it in anyway, I suspect. How is one supposed to do authentication on a global Internet? --Steve Bellovin

1 0

Bet it's not encrypted...
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

[The following was snipped from EDUPAGE, the online summary service. Anyone have access to more information? --AW] AND OPTICAL FINGERPRINTS. The National Registry uses an optical scanning technology to create and compare digital maps of the finger surface. The map can be converted to a modified bar code for inclusion on a wallet ID card. The information can also be encoded on circuitry inside a credit or debit card. (Tampa Tribune 2/20/94 B&F1)

2 1

Re: Mac encryption
by Ron Davis 17 Dec '03

17 Dec '03

>> What is everyones opinion of the best encryption software forthe Mac? >> Frederic Halper >> fhalper(a)pilot.njin.net > >MacPGP, available by anonymous ftp from the soda.berkeley.edu site, is >the only one I know of using public key methods, and hence the only >one of real interest to Cypherpunks. I find this to be a strange statement. Do we have no interest in non-public key methods? Seems the Cypherpunks should have an interest in all forms of crypto. Most users don't currently use public key becuase they just want to keep thier boss from sitting down at thier computer and reading the resumes they wrote for other companies. This can be accomplished with symetrical crypto just as well, if not faster than PGP. >Commerical products (like the various "Kent Marsh" products) are >mostly DES-or-weaker and are oriented toward local file protection. >(MacPGP will do that, too, of course). Cryptomatic does come with Triple DES which is still a very strong method. Unfortunatly MacPGP's biggest draw back is that its interface is poor and it is hard to use. There is also MacRIPEM which is written by Raymond Lau, author of Stuffit, and is much easier to use, but weaker than PGP (but legal). > >About six or seven years ago I bought "Sentinel," from SuperMac, and >used it a few times. The problems were obvious: lack of other users >(so my friends couldn't receive or send), and the symmetric cipher >nature (we had to share keys for a message). Public key systems based >on PGP have solved both problems (though problems of convenience >remain). > Can't stop without mentioning that my company make a product called Citadel which does DES encryption. ___________________________________________________________________________ "I want to know God's thoughts...the rest are details." -- Albert Einstein _________________________________________ Ron Davis rondavis(a)datawatch.com Datawatch, Research Triangle Park, NC (919)549-0711

3 3

Re: Mac encryption
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From: Ron Davis <rondavis(a)datawatch.com> > > >> What is everyones opinion of the best encryption software forthe Mac? > >> Frederic Halper > >> fhalper(a)pilot.njin.net > > > >MacPGP, available by anonymous ftp from the soda.berkeley.edu site, is > >the only one I know of using public key methods, and hence the only > >one of real interest to Cypherpunks. > > I find this to be a strange statement. Do we have no interest > in non-public key methods? Seems the Cypherpunks should have > an interest in all forms of crypto. Most users don't currently > use public key becuase they just want to keep thier boss from > sitting down at thier computer and reading the resumes they wrote > for other companies. This can be accomplished with symetrical > crypto just as well, if not faster than PGP. Cypherpunks do have an interest in all forms of crypto, but there are very good reasons why public key is more desirable than symmetric for "our purposes." This is at the very root of the crypto revolution and the cypherpunk ethos. Have you done the basic reading? (That's a serious question, not sarcasm.) PGP _does_ symmetric crypto. > >Commerical products (like the various "Kent Marsh" products) are > >mostly DES-or-weaker and are oriented toward local file protection. > >(MacPGP will do that, too, of course). > > Cryptomatic does come with Triple DES which is still a very > strong method. And MacPGP comes with IDEA, which is at least as strong (as far as we know). And of course, it does all the public-key encryption and key-management as well. A pretty incredible package, considering its size and cost. > Unfortunatly MacPGP's biggest draw back is that its interface > is poor and it is hard to use. I disagree. > Can't stop without mentioning that my company make a product > called Citadel which does DES encryption. Hmmm... --Dave.

1 0