December 2003 - cypherpunks-legacy

Re: art encryption...
by Pierre Uszynski 17 Dec '03

17 Dec '03

> From: John Young <jya(a)pipeline.com> > > Responding to msg by pierre(a)shell.portal.com (Pierre Uszynski) > on Mon, 19 Sep 6:32 PM > > >What would be ideal in all these cases is a > >steganographic process that would map to the whole as > >much as to the parts. Fractal steganography. > > The fractal steganography sounds promising. Is this yours or > has it been done? Let me reassure you: I have never heard the idea seriously explored before, and I'm not certain it leads anywhere really useful (as in satisfying from a security point of view.) Mostly, though, the interest in crypto has been so far toward standard message digests made to detect *any* tampering with the message. On the other hand, there has been work on ad-hoc steganographic marks with the purpose of tracking leaks and dumb or hurried copyright violators, and in that case it is useful to keep in mind: no point in protecting only the whole, or only some parts. Still, nothing close to what I described that I know of (I have no read yet about the work at one of the bell labs :-) on marks in text for leak tracking.) Again, as I pointed out, there must be serious tradeoffs in implementations of the idea, to the point where I don't know if it is realizable, or useful. And so far, art signature ideas have been fairly limited and not really explored to their conclusion. Besides, I'm in the "copyright is dead" camp, and for artwork I would tend to put value in physical objects (whether single original, or editions intrinsically limited because of the process). An electronic copy is an electronic copy is an electronic copy. There is value in timeliness too, and that's the main incentive for new ideas and work. Especially nowadays, being there first has value in itself, we don't need legislation to prop that up. I am however interested in such robust message digest ideas in an information retrieval context: How do you index documents without deciding in advance what the retrieval will be based on: words, parts of speech, lines, sentences, paragraphs, digest, exact, approximate, phonetic, relevance feedback... The whole or the part. See also the recent announcement about an NSA product to match similar texts without prior knowledge of topic or even language (as claimed). > The need for authentic sigs on architectural and engineering > drawings is not merely aesthetic. Right now municipal agencies > will not accept digital documents because of the lack of > verifiable authorship to establish responsibility, and > liability, for the health and safety of the design and > construction. Hard copy with original seal is required to > prevent unauthorized manipulation. In this case, a signed message digest would do just fine. If the agency really wants paper, they can have a seal on a form with a printed public key. They can verify that the signature and digest match when the drawing is first delivered, and that's it. No unauthorized manipulation can happen and not be detected (if the drawing digest is checked before the drawing is used.) And the author need not be allowed to repudiate a signature on old drawings. If he destroys the private key after having used it on a project, no new drawings can be filed that fit the same published public key either. So that should do it. Date-stamping is relatively well understood too. > Beyond copyright protection, architectural and engineering > documents are means to guide actual construction, rather than > end products like paintings and drawings in the art world. Actually, they only wish the painting was the end product. Instead it can get ripped off, copied, changed, printed, appropriated in many ways. > If there could be a way for buildings themselves to convey > authenticity, say, that they are healthy and safe, by a kind > decryption by the public that could help prevent concealment of > shoddy construction. It's not the drawings that assure safety > but field verification of the end result that construction work > was done right. > > What a great help if a building could convey its own message of > authenticity about its fitness and safety for habitation and > use. > [...] > Any other thoughts? Yes, we are nowhere close to that, but it's fun to think about it. However, "healthy and safe" is not an authenticity problem. Whether a building is an original or a copy is, so, maybe, is whether the building is according to drawing or not. "Healthy and safe" is very subjective, especially in an over-regulated society where "meeting the code" is essentially impossible. So "healthy and safe" is a certificate granted by an agency that can be duped and/or is lazy and/or has other agenda^H^H^H^H^H^H priorities. (:-) what's the plural for agenda ?) A building according to drawing need not be "healthy and safe". Finally (and then I'll stop, promised) verifying a message digest relies on the verifier having access to at least all that needs to be verified. And only what is available can be verified, of course. So shoddy construction is unlikely to become verifiable because it is hidden from whoever would have done something about it. Transparent finances and more efficient use of reputation may help you more. Pierre. pierre(a)shell.portal.com

1 0

Re: (fwd) "Will You Be a Terrorist?"
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 01:53 PM 9/17/94 -0700, Timothy C. May wrote: >(In this interpretation, the remailers that many of us have talked >about, designed, written software, run on our systems, etc., could be >considered to be part of a conspiracy, should Bidzos, Mykotronx, >ClariNet, the Feds, etc., choose to focus on remailers as "a >continuing criminal enterprise.") But we designed and deployed the remailers not as part of a criminal enterprise but in an attempt to *generally* protect privacy. We may also have wanted to weaken some of the control measures inherent in the TCP/IP protocols. The TCP/IP protocols are *not* a government. It is legal to weaken them. Additionally, federal courts have explicitly held that anonymous communications (and anonymous associations) are protected by the First Amendment. No US Attorney is going to be interested in the sort of messy political case that would be involved in remailer prosecutions. What we are doing in any case is more like sedition than a normal criminal conspiracy. The Feds have only brought two sedition cases in this century (WWII isolationists and white supremicists in the 1980s) and didn't do too well. Sedition cases are real hard to win because in order to prove intent to overthrow the government you have to prove some realistic capabilities. Like Professor Crampton said when he saw my "Fuck the State" button in 1971 -- "That would be a rather large job, wouldn't it?" DCF

1 0

Re: On the crime bill and remailers
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 8:29 PM 9/19/94 -0700, Anonymous wrote: >(As for others who are as quick to damn as to praise...watch your >cholestorol!) Ah. Yes. Well. I seem to have been fried, now. <hyuk!> I'd better stand back a bit. This looks like it's going to be interesting. I may even learn something... >SOLONg Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Patient Privacy at Risk (FWD)
by David Banisar 17 Dec '03

17 Dec '03

Fwd from the Coalition for Patient Rights (CPRMA(a)aol.com) Alert Patient Privacy at Risk Contact the ACLU The ACLU appears on a list of endorsers of the Wofford/Dodd amendment which amends one of the Senate health care reform bills. Major portions of W/D would have a severely adverse impact on the confidentiality of medical records. Although W/D has been rendered partly obsolete as newer health care reform bills are advanced under new names and new coalitions, many of its principal features remain intact in the new bills. It has become a reference point. It is for this reason that the signature of the ACLU on a list of endorsers of W/D (on a document entitled "Wofford/Dodd Fact Sheet") is so troubling and so damaging. The amendment creates federal standards for the disclosure of personally identifiable health care information and establishes a framework for a national health care data network. On the surface, the goals seem good. Who wouldn't be for establishing strict federal guidelines to ensure privacy where none existed before? For that matter, why not support a data network that would allow a treating physician to have immediate access to all pertinent medical information? Clearly we have to look beyond the advertisement and into the details of the bills for the answers to these questions. For example, in Sec. 508(a) of Mitchell 3 (the bill offered by the Senate majority leader), the "health information network service" is made the agent of the provider. This means that once a third party bureaucratic agency receives the information electronically, it is deemed the same as the health care provider in making decisions about the release of the information. Sensitive medical information, including intimate psychological information, would be available electronically to an increasing number of people legally--not to mention the well-documented risks of illegal access. Among those with enhanced access would be law enforcement officials and government agencies. Even researchers could access personally identifiable health information, if an institutional review board holds that the project is "of sufficient importance to outweigh the intrusion into the privacy of the person who is the subject of the information." The patient has no right to refuse such disclosure even though it includes his or her name. There are many examples of person-identified medical information, including sensitive personal information, that have been shared with health care providers with the expectation of privacy that would now be legally accessible to many third parties. The argument is made that this kind of access already exists, so why not codify it. The logic is faulty. It is true we already have serious problems protecting the privacy of medical records in this country. Legally sanctioning medical access to an ever enlarging list of third parties is not the solution. It will only compound an already serious problem. A compelling argument has been made that the establishment of a national health care data network that requires all providers to disclose information about every patient contact would violate the Fourth Amendment's prohibition of "unreasonable searches and seizures" of the person. Many organizations have raised serious concerns about Wofford/Dodd, including the American Psychiatric Association, the American Psychoanalytic Association, Coalition for Patient Rights, National Organization of Women, and the AIDS Action Council. We hope that the ACLU joins us in support of genuine privacy legislation. We hope that there was an error when it appeared on a short list of supporters of Wofford/Dodd (June 10, 1994) Call your state chapter of the ACLU. It is listed as Civil Liberties Union of (your state) in the white pages. Let them know of your concern.If possible, also fax Laura Murphy Lee at the ACLU in Washington (202-546-0738) and let her know your concern regarding the position of the ACLU in supporting W/D. This alert is provided by the Coalition for Patient Rights, Massachusetts (617, 433-0114).

1 0

Re: Unicorn??
by Jeff Barber 17 Dec '03

17 Dec '03

Black Unicorn writes: [ spelling errors, usage errors, grammatical errors, ill-reasoned arguments... ] This is not the same Black Unicorn we knew last spring. Has someone hijacked his account? Regardless of whether you agreed with his points, Unicorn always "spoke" eloquently and carefully, and with a distinctive style that has not been present in the posts emanating from this account in the last week or two. Uni's reputation is being rapidly squandered. Could this be Detweiler's revenge? -- Jeff

2 1

FOUR TIMES AROUND THE WHEEL
by Jeff Gostin 17 Dec '03

17 Dec '03

Sandy Sandfort <sandfort(a)crl.com> writes: > Today is my birthday. I've circled the Chinese zodiac four > times--from Year of the Dog 1946, to Year of the Dog 1992. Happy Birthday to ya!! Here's wishing for many more!! :-) --jeff PS: How'd that PRZ get-together work out? -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

Re: On the crime bill and remailers
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tcmay(a)netcom.com (Timothy C. May) on Tue, 20 Sep 10:40 AM >I agree with Hal Finney's point that current remailers >are far from the "ideal mix" described by Chaum and >are basically not very good at what they are supposed >to do. [Snip] >[Hal says] >> Claims here that remailers are designed to support sedition or to >> prevent government surveillance are both wrong and harmful. This kind >> of material could show up at some future prosecution of a remailer >> operator. [Snip] [Tim says] >Maybe. This is why I brought up the "supporting >terrorists" language of the Crime Act. Hal and Tim point to the vulnerability of the person running the remailer to being threatened through the equipment owner (like John Perry's recent experience) or squeezed by government agents into playing along with surveillors. This isolation and elimination (or co-optation) of a target has worked again and again to destroy networks once they become serious threats to law and order. Hal's warning is wisely heeded until all the remailer beneficiaries are bear an equal share of the risks of being charged a "supporting terrorist". John

1 0

RE: American Survival Guide
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Stanton McCandlish writes: >Oct. issue of _American_Survival_ has an article called "Clipper >Inside". >Dunno anything else about it, might be good, might suck rocks. CLIPPER INSIDE "CLinton's Orwellian plan to bug every compute,telephone,and fax... * Does a fair job on clipper. * mentions Matt Blaze's paper but gets it wrong. * does a side blurb on the EFF. * does another side blurb on PGP. * mentions Digital Telephony but doesn't mention EFF/FBI collaboration. * essentially very Anti-clipper * picture on page 46 alone worth the price of admission hehe... Typical issue, even better is the article "Liberalism as a form of codependency." Even better was last month's article "Make mine a Shotgun!" Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced communication is indistinguishable from noise." --Steve Witham "Have you ever had your phones tapped by the government? YOU WILL and the company that'll bring it to you.... AT&T" --James Speth -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLn79rlmp8FjpRfTVAQFgEAP+JMxaoOGcn9/nbCDwFCuSHuEmYf0ljI8I /HCkLmOOTOooVi0mLgQrSfFUA7DvwV/N9IwqkY6Th4l2Q1jw8MmOThShzL/RpRND sl/VJTbbhV/z0rdbHB2yc/DU10bBvrpQZyI0fVS5g/uouKsYEXoj0TB3ytXwo/aI dedfaVwGQOc= =+8W5 -----END PGP SIGNATURE-----

1 0

any CP going to the International Cryptography Institute this week?
by Carl Ellison 17 Dec '03

17 Dec '03

I have the program in front of me and it looks ominous. - Carl

2 1

Laws Outside the U.S.
by usura＠vox.xs4all.nl 17 Dec '03

17 Dec '03

tcmay(a)netcom.com (Timothy C. May) writes: : > It would be interesting for those in other jurisdictions to comment about : > how *their* rulers might view anonymous communications and strong crypto. : : I heartily agree with Duncan here! There has been very little said by : the good residents of France, Germany, Sweden, Holland, Italy, etc. : about just what the crypto-related laws of their countries are. [..] : So, I appreciate that some of our European readers may be tired of : hearing about U.S. policy or proposed laws, but the proper solution is : _competing speech_. That is, give us something new to talk about. Tell : us about what *your* country is doing. Tell us about any laws limiting : what kind of modems can be hooked up to your PTTs, as a concrete : example. Tell us about the raids on BBSs in Italy. Tell us about the : rumor that the Netherlands plans to ban unapproved crypto. There was a draft for a proposal for a law that would have outlawed crypto in the Netherlands. It would only be legal to use crypto if you had deposited the KEYs and if you had received a license. The use, trade and possesion of crypto was forbidden. It would be illegal (to dutch law) to have cryptosoftware available at some ftp-site (somewhere in the world) that would be accesable from the Netherlands (really!). (laws and enforcement of those laws are two -totally- different things in Holland :)) The draft was revoked, due to the huge amount of protest', the good thing is that we are in the proces of founding the dutch equivelant of the EFF: "de db.nl". -- Some loose thoughts any comments ? -- There are basicly four scenario's that a state can follow to regulate crypto: - outlaw it totally This was the path Holland choose briefly. - key depositing This is what the US is trying to do with Clipper et al. - try to develop a standart This is what the US did with DES and is trying to do now with Clipper. - do nothing The most prosperous scenario. Crypto use will boom, but lawenforcement agencies will be deprived from a useful tool, they can't bug phones any more. That will hinder their investigations but advancements in hardware/software could balance that: it is more easy to localise phonecalls, bugging equipment has become smaller and more powerful. Lawenforcement agencies have computerised databases that can link fingerprints, names etc in near "real-time". Large scale use of crypto could balance out some of the recent advancements in information technology that have given them a clear edge. -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0