December 2003 - cypherpunks-legacy

Re: CONTROL FREAKS
by frissell＠panix.com 17 Dec '03

17 Dec '03

>I think the point isn't that totalitarian states won't last: we know >that. The point is that those trying to establish a totalitarian >state can do a hell of a lot of damage to the rest of us before they >fail. That's not clearly true. The totalitarian states we know of developed years ago in a much less fluid environment. A few years ago, there was a UK TV drama about a contemporary Labour Party Prime Minister. In the course of the show, the new PM announced that he would immediately impose exchange controls to "keep money in Britain." (This was written before the real Labour Party officially eschewed exchange controls in a furtue Labour government.) The joke is that two weeks before the election of a Labour PM, all the loose investment funds would have left the UK anyway. Nothing left to block. I think that a *new* totalitarian state would have a hell of a time borrowing money and all of the existing states are cash poor. They need to borrow. They don't want to be distracted by rioting pensioners. Even the secret police don't work for free. Currency devaluation would hurt as well. After all, there can't be a totalitarian state that doesn't massively change (introduce uncertainly into) the conduct of life and business in its country (and if it is large, in the world). Markets have a way of dealing with uncertainty. Capital flight (seeking safer investments) and high interest rates (to compensate for risk). DCF

3 2

RFC Crypto Anarchist Manifesto
by John Young 17 Dec '03

17 Dec '03

Kudos, Tim, for adept mix of philosophy and gritty specifics, for brevity and wit. When the mood strikes you, an update would be appreciated. And, please, comments from those who have not seen this before or who may have forgotten. John -------------------- The Crypto Anarchist Manifesto Timothy C. May tcmay(a)netcom.com A specter is haunting the modern world, the specter of crypto anarchy. Computer technology is on the verge of providing the ability for individuals and groups to communicate and interact with each other in a totally anonymous manner. Two persons may exchange messages, conduct business, and negotiate electronic contracts without ever knowing the True Name, or legal identity, of the other. Interactions over networks will be untraceable, via extensive re-routing of encrypted packets and tamper-proof boxes which implement cryptographic protocols with nearly perfect assurance against any tampering. Reputations will be of central importance, far more important in dealings than even the credit ratings of today. These developments will alter completely the nature of government regulation, the ability to tax and control economic interactions, the ability to keep information secret, and will even alter the nature of trust and reputation. The technology for this revolution--and it surely will be both a social and economic revolution--has existed in theory for the past decade. The methods are based upon public-key encryption, zero-knowledge interactive proof systems, and various software protocols for interaction, authentication, and verification. The focus has until now been on academic conferences in Europe and the U.S., conferences monitored closely by the National Security Agency. But only recently have computer networks and personal computers attained sufficient speed to make the ideas practically realizable. And the next ten years will bring enough additional speed to make the ideas economically feasible and essentially unstoppable. High-speed networks, ISDN, tamper-proof boxes, smart cards, satellites, Ku-band transmitters, multi-MIPS personal computers, and encryption chips now under development will be some of the enabling technologies. The State will of course try to slow or halt the spread of this technology, citing national security concerns, use of the technology by drug dealers and tax evaders, and fears of societal disintegration. Many of these concerns will be valid; crypto anarchy will allow national secrets to be trade freely and will allow illicit and stolen materials to be traded. An anonymous computerized market will even make possible abhorrent markets for assassinations and extortion. Various criminal and foreign elements will be active users of CryptoNet. But this will not halt the spread of crypto anarchy. Just as the technology of printing altered and reduced the power of medieval guilds and the social power structure, so too will cryptologic methods fundamentally alter the nature of corporations and of government interference in economic transactions. Combined with emerging information markets, crypto anarchy will create a liquid market for any and all material which can be put into words and pictures. And just as a seemingly minor invention like barbed wire made possible the fencing-off of vast ranches and farms, thus altering forever the concepts of land and property rights in the frontier West, so too will the seemingly minor discovery out of an arcane branch of mathematics come to be the wire clippers which dismantle the barbed wire around intellectual property. Arise, you have nothing to lose but your barbed wire fences! -- ................................................................. Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP Public Key: by arrangement

1 0

Re: Proposal for an Electronic Commerce Testbed
by Hal Varian 17 Dec '03

17 Dec '03

Bob Smart <smart(a)mel.dit.csiro.au> > I've speculated above on the possibility of people supporting the > testbed by providing some useful services while charging play > money. We shouldn't depend on that. There is a class of applications > which are fun but need (or at least are helped by) money to give the > measure of success or failure. These are games, competitions and > gambling. I believe that done right they can be sufficiently > interesting with play money that people will want to take part: enough > people to test the scalability of the various proposals. > > Some of the games that can be played between individuals on the > Internet really need the ability to have a bet to make play really > meaningful: poker and backgammon are examples. The question is: will > betting with "play" money work or will people play frivolously because > the money does not have real value? You should take a look at the Iowa Electronic Markets. There have been a few thousand participants betting real money on these markets for two or three years. They would be a natural testbed for Internet dollars. To see what it's like look at telnet://iem.biz.uiowa.edu. --- Hal.Varian(a)umich.edu Hal Varian voice: 313-764-2364 Dept of Economics fax: 313-764-2364 Univ of Michigan Ann Arbor, MI 48109-1220

1 0

Announcement: "CYPHERNOMICON" FAQ available
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

[I haven't received Cypherpunks list mail since Friday. I don't know if the list is down or if Netcom is simply not delivering mail...it's been having severe problems. So I'm sending this blind to the list, and copying Hugh Daniel and Eric Hughes, to make sure it at least gets to _somebody_.] Greetings Cypherpunks, The FAQ I've been working on for many months is now available by anonymous ftp, details below. Because there is no "official" Cypherpunks group, there shouldn't be an "official" Cypherpunks FAQ, as I see it. Thus, others can write their own FAQs as they see fit. Cypherpunks write FAQs? I've decided to give my FAQ a name, to prevent confusion. "THE CYPHERNOMICON" is what I call it. (If the reference is obscure, I can explain.) The main file is 1.3 MB. It takes about 12-15 minutes to transfer with a 14.4 modem, proportionately slower with a slower modem. And of course very fast if you're already on Netcom or on a T1 connection. (I may split the 20 chapters into pieces, later, but this could add unwelcome confusion. And I'm holding off on gzip compressing the file(s) right now, for similar reasons.) Yes, the FAQ is very long. Yes, it is not what others may have wanted (the MFAQ, described below, is the "short" version that newcomers can get, or have mailed to them if they lack anonymous ftp access). It is the FAQ I _wanted_ to write, which is reason enough for the form it's in. The CYPHERNOMICON is especially detailed in the areas that have gotten little coverage in existing books: crypto anarchy, reputations, black merkets, and the uses of digital cash. The crypto and PGP sections are fairly long, but not nearly as long as they could be, given the vast amount of material out there already. (I didn't see the need to cover these areas in great detail.) The "anonymity and remailers" chapter is also very long, and is the most disorganized, in my opinion. The plethora of sites, URLs, various remailers, features, ideas, issues, and miscellaneous cruft is just overwhelming....I hope I've made some order out of it. (The "Release-Notes" and "README" docs have more explanations of the form and rationale, including the meta-FAQ question of why this FAQ is not a Web doc.) Details: anonymous ftp site: ftp.netcom.com cd to pub/tcmay "get" the files in the standard anonymous ftp way (feel free to move it to other sites, but for now it may be best to leave it here; I think the files are all reasonably OK, with no fatal flaws (Harry Bartholomew helped test the access), but wider distribution should perhaps be slowed for several days, to make corrections of serious flaws easier to make) The following 6 files are included: Contents-Long (A detailed table of contents, about 10 KB) CP-FAQ (The complete CYPHERNOMICON, uncompressed for the time being, about 1.3 MB) Contents-Short (A brief table of contents) MFAQ (One of the chapters, the "Most Frequently Asked Questions") Release-Notes (Some comments on the FAQ.) README (Much more detailed comments, also included as the final chapter) Here is the Contents-Short: THE CYPHERNOMICON 1. Introduction 2. MFAQ--Most Frequently Asked Questions 3. Cypherpunks -- History, Organization, Agenda 4. Goals and Ideology -- Privacy, Freedom, New Approaches 5. Cryptology 6. The Need For Strong Crypto 7. PGP -- Pretty Good Privacy 8. Anonymity, Digital Mixes, and Remailers 9. Policy: Clipper,Key Escrow, and Digital Telephony 10. Legal Issues 11. Surveillance, Privacy, And Intelligence Agencies 12. Digital Cash and Net Commerce 13. Activism and Projects 14. Other Advanced Crypto Applications 15. Reputations and Credentials 16. Crypto Anarchy 17. The Future 18. Loose Ends and Miscellaneous Topics 19. Appendices 20. README Comments should be sent to me. Future releases will be coming. Enjoy. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

PRIVACY REGULATIONS
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, When I wrote: >>If you are stopped by the police, you are required to >>identify yourself if asked. Chris Hibbert responded: This is not true. If you're driving a car you are required to have a license. If you're just walking around, you're not required to have a name, or to tell it. Nope, *this* is wrong. In most jurisdictions, you do not have to provide *physical ID* if you are not in a car, but you do have to identify yourself AND give some account as to what you are up to. A cop has to have a probable cause to arrest you, and not giving your name doesn't provide it. /Au contraire/, you are "interfering with an investigation" or "obstructing justice" or whatever it's called in the particular jurisdiction. If you're surly, a cop can take you in, ... Nonsense. Where do you non-lawyers get this stuff? Surly, rude, impolite, etc. are all protected speech. (Threatening *ACTS* or physical resistance, however, is another thing.) ... Just say "Officer, someone is waiting for me. May I go now?" Just say "no"? I *guarantee* this won't work. If you are asking permission ("May I go?"), aren't you ceding to the officer the legal right to say "no"? If you believe you don't have to interact with the nice man, why not just turn your back and walk away without a word? (I wouldn't advise it.) This has been tested in court. There was a black lawyer several years ago who liked to walk a lot. He lived in one of the fashionable neighborhoods in LA, and occasionally got picked up because he "looked like he didn't belong there". He sued them and won in court every time, and got the police to leave him alone. [No, I don't have references.] A little knowledge is a dangerous thing. The gentleman in question was not a lawyer. He was a black man who was dressed and coiffured in dreadlocks and Rasta man clothes. He did not live in Beverly Hills nor Belaire, but he did like to take long walks in those neighborhoods in the middle of the night. He was arrested for not identifying himself with an "official" ID. When he sued, the court issued a temporary injunction against the police for requiring *documentary* identification. The right of the police to require a person to identify himself was never in question. I'm not sure what the disposition of this particular case was, but that's irrelevant, as it only went to the issue of documentary ID. (If memory serves, there was an interesting result of this case. The California legislature attempted to pass, or passed, a law that required to showing of official identification if demanded by a police officer. I don't know how this law ended up, unfortunately.) S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re: PRIVACY REGULATIONS
by Lile Elam 17 Dec '03

17 Dec '03

I just always remember that the cop has the gun, I don't. -lile

1 0

Proposed changes to the Queensland criminal code.
by pkm＠maths.uq.oz.au 17 Dec '03

17 Dec '03

It seems the fight against evil never ends... This is a clipping from the Sunday Mail, the local sunday newspaper (althogh tabloid would be a better word for it). As you can observe, it is one of those papers that have a paragraph:sentence ratio of 1:1. I hope it is of interest to you all. All spelling mistakes are mine. All grammatical awkwardness are his. :-) .... ONLINE MOVES 'OUT OF LINE'. [Date: 11/09/94 - PKM.] (COMPUTERS with Peter Young) [Title of a regular column - PKM.] Proposed changes to the Queensland Criminal Code to crack down on computer networks carrying information used for criminal acts are sparking an outcry. The proposals have been denounced as unworkable by a number of online information providers who claim their businesses will become untenable if the changes are brought in. As part of a sweeping overhaul of the State's criminal code, Attourney-General Wells plans to create two new offences falling into the category of unlawful use of a computer. They would make persons liable for up to 10 years for providing information via computer networks which contributes to a crime. One charge would relate to aiding the commission of a crime and the other would deal with being an accessory before the fact. Instructions on how to make bombs [like gunpowder? -PKM] or set up a child pornography ring are the type of material the proposed legislation wants to target. The laws would apply equally to material downloaded from a local electronic bulleting board system or that acquired by using a commercial gateway to the international Internet system. The legislation is intended to facilitate prosecution of people who knowingly make such information available on their systems, a spokesman for the Attorney-General said. But Australian Internet service providers have condemned the proposals as impractical and unable to be policed and have called for "common carrier" protection similar to that enjoyed by Telecom. Ian Peter, founder of Queensland-headquartered Internet provider Pegasus Networks, branded the proposed laws "unworkable", saying that they were out of touch with overseas thinking on the problem of balancing free speech against the need to control access to unsuitable information. Rhys Weatherley, president to the non-profit Internet access group BrisNet [Brisbane Net, for the geopolitically deprived - PKM], said the proposed laws would give police "licence to arrest" power over any computer network operator merely because offending material was available on their networks. He said the legislation would make scapegoats out of honest network operators while failing to catch real offenders. BrisNet would be forced to shut down rather than run the risk of prosecution if the laws were adopted in their reputed form. Hugh Irvine, a Melbourne businessman, whose company Connect.com.au is a leading commercial gateway to the Internet, said he was happy to co-operate with authorities to prevent hackers or child molesters from using his service to pursue their practices. However, he said that the planned Queensland legislation was equivalent to charging Australia Post executives because criminals used the mail to help plan a bank robbery. "It is heading down the path of the wrong sort of State-run surveillance and Connect.com.au would be unable to continue functioning as a business if laws in the proposed form become a reality, he said. Also wading into the fray is Electronic Frontiers Australia (EFA), a public interest group set up to monitor threats to civil liberties in cyberspace. EFA skokesman Garth Kidd labelled the Queensland proposals "a worrying development that would stifle the implementation of online services in Australia". .... Comments: The article (and also the proposed legislation) were brought to my attention by my father late last night. As a com- puter professional with ~30 years experience, he was as disgusted as I am with the proposals. He also understood quite clearly how it was unworkable in practice. Some time this week, he will be having a little chat on the subject with Wendy Edmonds, the local MLA (Member of the [State] Legislature Assembly). It seems representative cluelessness is the same the world over. :-< Peter Murphy. <pkm(a)maths.uq.oz.au>

1 0

Re: Running PGP on Netcom (an
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

At 3:52 AM 9/12/94, SAMUEL KAPLIN wrote: >What illusion of security? If I have my secret keyring residing someplace >where I can't physically control who has access to it, no way is this >keyring secure!! It goes against the definition of a secret. Once you tell >someone a secret, It no longer is a secret. In effect this person has told >Netcom his secret, therefore it no longer is a secret. Just because you're >paranoid, doesn't mean they're not out to get you. Be paranoid!! But keeping it on your home machine, the bad guys could break into your house, set up a keyboard monitoring program, and get it that way. Or if they wanted to, grab you and force you to reveal your key. It's not black and white. There are degrees of security. I keep my encrypted secret key on dunx1, a UNIX box used by many other people. Anyone who has the ability to can either watch my keystrokes, probe through memory to retrieve my key or message, or probably a few other things I haven't thought of. The benefit, though, of being able to decode messages as soon as I receive them, and being able to send encrypted messages when I'm not at home is major. For me at least, it's a fair trade-off. There isn't anything I send right now that I would find particularly embarassing should it become public knowledge. If I did get into that situation, I'd probably create a second key pair for use only at home, and keep both in use. The bad guys will almost always be able to get your key. Even if they have to get you to get it. The goal is to raise the difficulty such that they aren't willing to do it. Bob -- Bob Snyder N2KGO MIME, PGP, RIPEM mail accepted snyderra(a)post.drexel.edu PGP & RIPEM keys on key servers When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

1 0

Running PGP on Netcom (and Similar)
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

A "Cypherpunk RISK" (apologies to the "RISKS" list) to running PGP on Netcom, Portal, America Online, etc. systems (and on university, corporate, etc. systems), is the obtaiing of *all* records, directories, etc. by court order. This has happened more than once, and will likely happen more and more in the future, as law enforcement realizes what a treasure trove this can be. (The person being monitored may not be told about it, of course.) The latest such case involved Lewis De Payne, a user, and Netcom, his (and my) Internet provider. Details are being discussed in Usenet groups, and were brought up also at yesterday's Cypherpunks meeting. Not that had Mr. De Payne been using PGP on Netcom, with his secret key stored there, the cops would have it. (The passphrase maybe not, depending on whether he stored _that_ there, too. And whether Netcom had logs of keystrokes entered, which strikes me as something they would probably have--we really need a "zero knowledge" kind of "reach-back" for remotely-run PGP.) I just don't think the dangers are worth it. All the theoretical hot air about whether kestroke timings are "random enough" is moot if Netcom is turning over records to investigators. It creates a dangerous illusion of security. (For those with no home machines, and perhaps those who mainly use campus services, workstations, etc., I'm not faulting you; people use what they have to use. Longer term, though, PGP needs to run on secure hardware. Secure meaning not easily grabbed by the authorities without even one's knowledge!!) --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Just In Case You Missed It
by alano＠teleport.com 17 Dec '03

17 Dec '03

>Date: Sun, 11 Sep 1994 18:33:16 -0700 >From: Bruce Baugh <bruceab(a)teleport.com> >To: alano(a)teleport.com >Subject: Just In Case You Missed It > > >>Path: news.teleport.com!news.world.net!news.sprintlink.net!redstone.interpath.net! ddsw1!panix!zip.eecs.umich.edu!newsxfer.itd.umich.edu!europa.eng.gtefsd.com! swiss.ans.net!malgudi.oar.net!news.ysu.edu!doug >>From: acbul1(a)penfold.cc.monash.edu.au (Andrew Bulhak) >>Newsgroups: alt.humor.best-of-usenet >>Subject: [alt.discordia] "official" Discordian secret code >>Followup-To: alt.humor.best-of-usenet.d >>Date: 12 Sep 1994 01:09:02 GMT >>Organization: best of usenet humor >>Lines: 89 >>Approved: best(a)cc.ysu.edu >>Message-ID: <3509ne$4rm(a)news.ysu.edu> >>NNTP-Posting-Host: unix1.cc.ysu.edu >>X-Disclaimer: the "Approved" header verifies header information for article transmission and does not imply approval of content. See .sig below. >>Originator: doug(a)unix1.cc.ysu.edu > >From: snorri(a)nwu.edu (Snorri Abrahamsen) >Newsgroups: alt.discordia >Subject: "official" Discordian secret code > > > In these days of NSA and Clipper and Key/Escrow and PGP and Wilkesman >Kid Ranger Decoder Rings, it seems one of the things most on everyone's >collective hive-like minds must be security. Security and privacy, make >that. > Now Discordians have always had a versatile and powerful secret code, >one that has defied the efforts of the world's greatest spy-masters and >crypto-fiends to crack for countless centuries (or at least since 1962 or >so). It goes like this: > > A B C D E F G H I J K L M N O P Q R S T U V W X Y Z > 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 > > It's a damn fine code, and whoever invented it should get a big gold >star, lots of LDD medals, and a beefy slap on the ass for good effort and >sheer genius. But I'm afraid that now I have some *SHOCKING NEWS*! > > I have reason to believe that the Discordian secret code has been >_compromised_. You know, "Loose lips sink ships" and all that, right? >(Or is it, "Loose lips sink Golden Apple Corps"? I'm never sure...). >Well, it was worse than loose lips. It is my suspiscion that some >traitorous Discordian actually gave the code to the NSA. > > What to do now for all your Discordian encryption needs? I mean, it >would now be insanely dangerous (or at least not very private) to use the >old encryption scheme. > > I therefore propose creating a new Discordian secret code, perhaps based >on a cypher model (where each character is represented by some word), >although other models might work really well, too. Anyway, here's a start >to a Discordian cypher... > > A Andersianism > B Quasimodo > C yorba linda > D colostomy > E chao > F mojo > >etc... > > This is a fun scheme because the utter apparent randomness of it. Or at >least it seems random... Anyway, it's probably not the best possible >scheme for a Discordian Secret Code. Here's are some alternate schemes I >had for encoding messages: > > * Implosion Method. Write message on lightbulb. Implode lightbulb. >Recipient then reverses time continuum and grabs pre-imploded lightbulb >from alternate timeline, reads message, and tosses back for implosion >before anybody notices. > Advantages: NSA Clipper plans (oddly enough) do not extend as far as >including key/escrow chips in all time travel devices. > Disadvantages: Useless against the Great Race of Yith. > > * St. Gulik Method. Write the message in radioactive ink on box paste >and feed to specially trained homing cockroaches. Release the homing >cockroaches to skitter home. Reassemble message from roach entrails. > Advantages: Enemy cryptographers don't like touching roaches. > Disadvantages: Kills the roaches; difficult to train them to go home. > > * O'Leary's Cow Method. Write message on paper and burn to ashes. >Send ashes to recipient. > Advantages: No way for enemy to decode message. > Disadvantages: No way for recipient to decode message. > > * Formless Spawn Method. Write message on outer surface of trained >Shoggoth in really strong permanent ink. As Shoggoth moves, message will >be scrambled on its surface. With the proper command word, recipient can >command shoggoth to assume original form(lessness), descrambling the >message. > Advantages: Message devours any enemy crytographer who tries to decode it. > Disadvantages: No good if recipient fails sanity check. > > > Any other suggestions for good encryption schemes would be welcome... >I'm beginning to feel insecure already, as well as a little on the insane >side (you try training a shoggoth to act as your message-pod...) > > >-- >Postings to alt.humor.best-of-usenet reflect what the submittor considers to be >the best in usenet humor, and the poster is responsible for the content. The >moderator removes duplicates, copyrighted material, posts without headers, but >does not drop articles based on content. See the group charter for more info. >Sigs may be truncated. Moderator address: best(a)cc.ysu.edu >-- >/-------------------------------------------------------------------------\ >|bruceab(a)teleport.com Bruce Baugh, thoroughly unaffiliated with Teleport| >| "An' besides you IS a rabbit." "Not a 'nothing-BUT-a-rabbit', tho'." | >\-------------------------------------------------------------------------/ > > |"I would call him a Beastialic Sadomasochistic | alano(a)teleport.com | |Necrophile but that would be beating a dead | Disclaimer: | |horse." -- Teriyaki (What's up Tiger Lily?) | Ignore the man | | -- PGP 2.61 key available on request -- | behind the keyboard.|

1 0