December 2003 - cypherpunks-legacy

Re: A possible solution
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 8:33 PM 11/27/94, Aron Freed wrote: >On Sun, 27 Nov 1994, Mike McNally wrote: > >> So why pick specifically on cryptography? Why not increase penalties >> for criminals who in their crimes are found to have used: >> >> * computers; >> * pagers; >> * cellular phones; >> * Casio watches with multiple alarms; >> * Cars with power windows; >> * Velcro-fastening tennis shoes; >> * Gore-Tex jackets; >> * Ibuprofen pain relievers; >> * Fat-free ice cream; > >Why don't we stick to the topic? Do you have an intelligent reply or are >you going to shoot your mouth off? Or Maybe you can share something >better with us, all knowing and wise one. Something better? I guess most of us think that "something better" would be _not_ having increased penalties for criminals who use cryptography in their crimes. I'm certain that this was the "something better" Mike was suggesting. What rationale is there to have increased penalties for using cryptography to commit a crime, any more then there should be increased penalties for using computers at all? (or do you think there should be?) What reason is there to have increased penalties for using modern technology over using older technology to commit a crime? Using modern technology is somehow "worse" then using older technology? Should we have harsher penalties for someone that uses a getaway automobile after a bank robbery, instead of trying to get away on foot? That might be a better analogy to what's being proposed then Mike's sarcastic ones, if you really want a good analogy. Automobile technology surely makes it easier for a bank robber to escape from the crime scene and not be caught, just as cryptography surely makes it easier for someone selling drugs to close a deal without being caught. So if that somehow justifies harsher penalties for crimes committed with the help of cryptography, does it also justify harsher penalties for crimes committed with automobiles? Why not?

3 2

Zimmerman interrogated
by Jonathan Corbet 17 Dec '03

17 Dec '03

The sad thing is that what happened to Phil in customs is far from exceptional. A lot of us who went to Nicaragua in the early- to mid-eighties found this out... Thereafter, every time I came back into the country from somewhere I would get pulled out, searched, my money counted, and so on. I got to where I would routinely schedule at least three hours for my domestic connection. After five years of "good behavior" this stopped as abruptly as it began. There are cases of people who had their journals confiscated; these then later turned up in places like FBI files, which is highly illegal. jon

1 0

E$ in the Economist
by Jonathan Corbet 17 Dec '03

17 Dec '03

This week's issue of the Economist has an interesting article on electronic money. They talk somewhat about Chaum, tax collection problems, and so on. Some discussion about how encryption standards are lacking on the Internet, but they don't go into why. A worthwhile read anyway. jon

1 0

Re: Cell Phones Security??
by Phil Karn 17 Dec '03

17 Dec '03

In article <94Nov21.08.1184(a)qualcomm.com>, you write: |> As one who will be shopping for a cell phone in the next week, what should |> I look for in terms of security? What features are available in phones on |> the market....if any? Basically, there is *no* security whatsoever in cellular phones, at least with the current analog FM technology. If you want privacy, you'll have to provide it yourself on an end-to-end basis. Not only does this require that the party on the other end to have a secure phone, but it greatly reduces reliability since most dialup modems don't perform very well over cellular radio paths. Phil

1 0

Transparent Email (WAS disable telnet to port 25)
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > I don't have an answer to your question, but you did bring up something > I've been meaning to ask about for some time and I never really got > around to it; Are there any short-term plans to press for an RFC > utilizing digital signatures? With the exponential increase of mail > users, as well and the influx of Compu$erv, AOL, Prodigy and other users, > some methods for the transparent use of digital signatures needs to be > worked out before it becomes too difficult to implement change because > the commercial services have all the power. (or worse, before the > government decides for us.) Some still unformed thoughts on this subject: The big problem with transparent encryption and signatures is key distribution: if you've never sent a letter to me, your mailer will have to get my key (invisibly) before the mail can be sent. The big problem with key distribution is the web of trust: who gets to decide which keys are good? This is a subtle advantage that systems with centralized key generation have over systems like PGP, which let users generate their own keys. If big brother mints all the keys, then big brother can set up an authoritative keyserver. The best answer that I can come up with for this problem is to allow for several webs of trust to function simultaneously. Perhaps we would have a default web, which would have everyone's key in it. The idea behind the default web is that it should be able to return a key as often as possible, so we don't want to make it too difficult to submit keys for this web. But anyone else could devise his or her own web, and administer it however he or she pleased. A request to a keyserver would include a list of webs, in order of preference, that the user would be willing to deal with. At the end of the list would be the default web, in case nothing better was available. A web could be defined by a single top-level public key and a set of rules. Perhaps a text based program -- a sort of "meta-pgp" -- could check chains of signatures to validate a key. Suppose, for example, that I'm administering a web of trust. I set up the web so that I can deputize notaries who can in turn sign user keys. Lets further assume that all signatures are good for a year. A keyserver would return a text file containing: (a) the user's key, concated with a header specifiying the date it was signed by the notary, and (b) the notary's key, concated with a header specifiying the date it was singed by me. We'd want "meta-pgp" to be able to handle complex rules which would give it the flexibility to implement a wide variety of webs. Perhaps it could use prolog-ish style induction to determine if a key was good. Does this make sense? Is it something that was already proposed and discarded? == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtmV+hEpP7+baaPtAQH3kgP8DmycpNrZKQRpyK1rclxJnIY2bdT5m4iM p7IQ7nI07PSMn+ldye2xG5jjms42CR0BVvk4hhdGzDJwcgdd3FHFC7xNHvhk+SOE 4EHqpyW+YdNSe3A7+sMZp30mgWEnvHOpnrU9UiMUIaC8gcLk3GlkXdxDG+SWGwv/ 1yesnbaUxYM= =p2UQ -----END PGP SIGNATURE-----

2 1

CALLING "CAPT'N BOB"
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, BANDWIDTH ALERT: If you are not "Capt'n Bob" this message is a complete waste of your time. "Capt'n Bob, I send a message to your anonymous address; it bounced. Please send me a better address by private e-mail. Thanks, S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Transparent Email (WAS disable telnet to port 25)
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 1:34 AM 11/28/94, Alex Strasheim wrote: .... >The big problem with transparent encryption and signatures is key >distribution: if you've never sent a letter to me, your mailer will have >to get my key (invisibly) before the mail can be sent. The big problem >with key distribution is the web of trust: who gets to decide which keys >are good? .... If I have never sent you mail, consider how I got your e-mail address? You could have sent your public key to me along with your e-mail address. If your public key is too big you could include a phoneticized secure hash of your public key and I could check big brother (the CA). I suspect that initial bits of a public key serve pretty well as a secure hash. Perhaps all email addresses should be accompanied by such a hash. The more initial bits the harder to find a fake public key with sutiable mathematical properties and initial bits that agree with your real pulic key. If an email address and its associated PK are sent thru unauthenticated channels a man in the middle can substitute the PK. In the same situation, however, the man in the middle can substitute the email address! ....

2 1

Re: Transparent Email
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Eric wrote: >I am still considering the "sign-or-delay" proposal for the toad.com >server, that is, sign your articles to the list or they'll be delayed >and eventually rejected. Do it. Either it will work or it will kill the list. If it works, geat. If it kills the list, we would have failed in our mission anyway. - --Lucky -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLtrCYASQkem38rwFAQHTFgP/VrP8GACjMT4amw7Ws1+VP0HftgZUtCGW +xP59b4FDVUuZH/KH0Q0t9eGYyHBqYlhkr3M4eU/149+Q6Jz7u/juOXx5W638UKB Ujz4Mf4MnBHaEU5/famKmFTD/n+dGS2Gzds121SLnW3rmVU2rPcPYBRkvYAQQZ+f Q//TPjhoj5Y= =3+9F -----END PGP SIGNATURE-----

8 7

Re: A possible solution
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 5:35 PM 11/28/94, Aron Freed wrote: >Ok. You all have basically defeated the stiffer fines issue. > >The one issue remaining is do we want to live a life of anarchy. That depends on what you mean by "anarchy." I'm sure there are a few anarchists on the list, but they probably don't mean the same thing as you do by "anarchy". > Do we >want to live in total isolation? Do we want to be completely paranoid and >be always looking over our shoulder? Many of us already are. Except the kind of rules you are describing would increase our paranoia, not lessen it. The people we're already looking over our shoulder for are the people who would be enforcing the rules you are proposing. >You tell me how we solve that >problem. I still don't understand what "that problem" is. How does the existence of cryptography (which is of course what started this discussion. fittingly, since we're on cypherpunks here) make anyone live in total isolation, or be completely paranoid, or be always looking over his shoulder? I don't understand how strong cryptography does any of those things. What exactly is this "problem" that you see, and how is it related to cryptography? >I for one do not want to touch "1984" territory, but I don't >want to live in an anarchy either. About half the people I talk to think we're already "touching" _1984_ territory, and about the other half think we're already living in an "anarchy", so appearantly it's in the eye of the beholder. They mean "anarchy" in a negative sense of course, the same as you. I wouldn't mind living in an anarchy if it's the kind Mikhail Bakunin or Emma Goldman or Alexander Berkman or Petr Kropotkin advocated. You might pick up a book by any of those authors at your local public library, you might be surprised.

2 1

Re: Interfacing PGP with Pine (Script pointer)
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

At 7:47 AM 11/25/94, Michael Handler wrote: > For a well written script to interface PGP with Pine: > > finger slutsky(a)lipschitz.sfasu.edu | pgp -f > mkpgp.txt.uu > > If you don't have finger access, mail me privately, and I'll send >the file to you. If you don't mind, could I have a copy? finger is disabled here... thanks, -j

1 0