December 2003 - cypherpunks-legacy

BYTE on PGP WoT
by John Young 17 Dec '03

17 Dec '03

William Stallings writes in the BYTE February issue on "The PGP Web of Trust."

1 0

Re: Key backup (was: How do I know . ..)
by Dr. D.C. Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- 'Adam Shostack' was reported to have written: > Putting the UPC's on things other than cards (such as books) > makes it easier to hide in the open. `UPC' stickers on, say, a few > books are easier to miss than UPC stickers on index cards. Exactly. If the intention is to keep them out in the open, then making labels which resemble UPCs is preferred. However, if I'm going to dig a hole in the ground at a secret location and bury my barcoded key in a special container, a different format might be indicated. > Invisible ink draws attention to the correct UPC's once they > know you're using it. See Kahn for a discussion of secret inks being > developed during the second world war. I'll do that, but I think you might be intermixing ideas. Pseudo-UPCs in invisible ink wouldn't be a good combination. Pseudo-UPCs should probably be printed exactly like normal UPCs. If you want the "invisible ink" process, it should probably blend into the ambient environment as much as possible. Even if "they" know you're using secret ink, don't "they" have to find the printed key first? How much work is required to check every page of every book and every sheet of paper you might have access to? You could mail your key anywhere in the world invisibly printed on the outside of an envelope. Better yet, send someone a special document (wedding announcement, legal document, 21st birthday card, whatever; the important part is to send something that the recipient will keep) with your keyring invisibly printed on it. Variations on this theme (there are many) are encouraged. Have a friend check out a library book and let you stamp your key somewhere inside. It's the number of possible variations that make this seemingly impossible to attack. Apologies if this "secret ink" stuff is way off base ;-) . Most people (myself included) would opt for the "split and disguise" or "hidden/buried" key schemes where secret ink wouldn't add much security. > If you want to hide bits, they > should be stripped of low entropy parts and hidden with a stego > program. The idea was to use something other than magnetic media. A new and different optical encoding method could be devised to hide a key in a halftone, but the barcode example was offered as one possibility using an existing standard. The basis for this thread was the perceived need for a relatively simple key backup system that didn't require the active participation of a whole hoard of people. =D.C. Williams <dcwill(a)ee.unr.edu> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLx2rEyoZzwIn1bdtAQEBVAGAzJc1fOAchLGEIlnbQBiJXV2cICE2WK8e 8FnXnP8ztcWEdUCYY0vjDewiLI2iW4bt =tUR2 -----END PGP SIGNATURE-----

4 3

Re: (none)
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

Mats Bergstrom wrote: >On Tue, 17 Jan 1995, Name withheld on request wrote: > >> wonders to what end remailers are being put by people who are worried >> about being "sold out". > >The fundamental principle here is that an e-mail message is just so >many bits of 1's and 0's. It can never, in it's own capacity, steal, >molest or kill. It is therefore not unethical to run a no-log 'fortress >remailer' and auto-delete ALL complaints, without exception. It might >not be feasible to do so if one wants to stay out of jail, but hope- >fully this will change with the rapid increase in country domains >and the soon-to-come digicash market. Discussions of programming to >make fortress remailers work and to make them easily exportable to >African Linux-boxes are interesting. So are discussions of expected >repercussions on society. Ethical discussions of what is abuse or not >are better left to the clergy. Here comes the clergy! :-) I'm sure that when your hypothetical remailer comes up and I decide to spam you with your own words (now I wouldn't do that, now would I? ;-), your sysadmin will be comforted by knowing that it's only ones and zeros filling his hard disk. He would be especially comforted if I spammed postmaster(a)wherever.you.are rather than your own account in a move to protect your own anonymity. Advocating a remailer such as you describe is only possible in a world where anonymity is considered the supreme good, a goal to achieve no matter how many other ethical rules we break. In the real world, however, there will always be problems with "acceptable use" and "abuse", along with the additional problems with establishing policy and so on.

3 2

Re: Cone of silence update
by Rich Salz 17 Dec '03

17 Dec '03

---------- Begin Forwarded Message ---------- Date: Wed, 18 Jan 95 21:03:02 -0500 From: burton(a)het.brown.edu (Joshua W. Burton) To: silent-tristero(a)world.std.com Subject: Cone of silence update I haven't been able to turn up the original New York Times article I saw, but our own Providence (RI) Journal today reprinted an article from the Washington Post, no date given, that tells substantially the same story, though without any mention of the cost of Intelink. Since a few people have asked me for details, I thought I'd better post this verbatim. Be sure to save a copy, in case this article disappears the way the first one I saw did.... GOVERNMENT'S SECRETS FLOW THROUGH AN INTERNET CLONE WASHINGTON - When the US intelligence community recently decided to modernize the way it communicates, it did what countless other government agencies, businesses and individuals have done over the last few years: it turned to the Internet. But the regular Internet wouldn't do. For spies and other government officials concerned about secrecy, that very public, very uncontrollable global mesh of computer networks was too risky a place to do business. So the intelligence community created its own Internet. Dubbed Intelink and based on the same technology used to run and navigate the original Internet, this new network for sharing supersecret information---including satellite imagery and video footage---officially began operating just a few weeks ago. When the bugs are worked out and a final system is in place, it will allow analysts, policy-makers, military officials and soldiers in the field to tap quickly and directly into classified information at the Central Intelligence Agency, the National Security Agency, the Pentagon and diverse other parts of the national security bureaucracy. Those familiar with Intelink say it could promote cooperation in a business characterized by internecine rivalry, and that at the very least it will centralize and speed up information retrieval. ``This is a major breakthrough,'' said Barry Horton, principal deputy assistant secretary of defense for command, control, communications and intelligence. ``Intelink for the first time, in a user-friendly environment, allows every element of the intelligence community and every element of the Department of Defense to reach into every other element,'' he said. As one might imagine, it's not for everybody. Horton said the system is now available only to people with ``Top Secret'' or higher security clearances. Moreover, those who run the system eventually will have to confront a major issue of how to make Intelink flexible enough to accommodate users with a variety of clearances. There are many levels of classification higher than Top Secret, and for Intelink to be useful to those working on the most secret programs, the officials responsible would have to be comfortable placing such information on the system. And, while Pentagon and CIA officials spoke of how Intelink promises to improve communication and cooperation among the agencies and reduce duplication of effort, others said there is good reason to be skeptical. The intelligence community has made innumerable attempts to eliminate redundancy and streamline information channels, but there has been little progress. ``It's gone like gangbusters since its inception, but any Internet-like thing grows overnight. The question is, is it going to mature well? And how will it operate in a time of crisis?'' said Ross Stapleton-Gray, who recently left the CIA to start a business providing Internet services to embassies in Washington. In a way it is fitting that what some call an Internet ``clone'' should come out of the national security bureaucracy. Internet itself was started under Department of Defense sponsorship in the 1960s, as an attack-proof communications link among military, corporate and university research centers. ``Remember, Internet is a DoD creation,'' said Neil Munro, a reporter for Washington_Technology, a local business newspaper, who recently broke the story about Intelink's start-up. ``This is the prodigal son....They created it and now it comes back in much stronger fashion.'' All those familiar with the system said it is totally walled off from the Internet, and designed never to be penetrated. But several experts familiar with Intelink noted that no system is ever totally secure. ``This would obviously be a Mount Everest for hackers,'' said John E. Pike of the Federation of American Scientists. But Pike, who said he thinks Intelink has the potential to ``revolutionize'' the intelligence community, added that it would be so difficult to crack he doubts many will try. The network now operates among several dozen intelligence agencies and centers. But it is the talk of the intelligence community, and its reach is expected to grow rapidly. Those who now have regular access to it number in the hundreds, estimated Martin C. Faga, general manager of the Center for Integrated Intelligence Systems at the Mitre Corp., the company that helped the intelligence agencies set up the system. ----------- End Forwarded Message -----------

1 0

"Time" Magazine and "Future Shock" Author
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

[I'm into my daily "blackout" of toad mail to Netcom, so am posting blind, as usual. If this article has already been posted, my condolences.] The January 23rd issue of "Time," this week's issue, features a cover story on talk shows, Limbaugh, Gingrich, and "HyperDemocracy." I haven't seen the physical issue yet, but have skimmed the Web version at: http://www.timeinc.com/time/magazine/magazine.html Point your browser at it and have fun. Lots of folks are flaming the article, in the usual newsgroups (e.g., alt.data-highway). Me, I'm as scared as "Time" is about "direct, electronic democracy," though perhaps for different reasons. On a related note, the article and sidebars touch heavily on the "cybergurus" who are advising Newt Gingrich on his journey into cyberscpace, notably Alvin Toffler ("Future Shock," "The Third Wave," "Powershift," etc.) and George Gilder ("Beyond Wealth and Poverty," "Macrocosm," lots of essays on the Net). As it happens, I spent some time talking to Alvin and Heidi Toffler at an interview last Friday in L.A.--they were being interviewed before and after me. Not enough time to really get into issues, and of course they did most of the talking (Heidi is especially opinionated, and had just been in a highly publicized battle with newage guru Arianne Huffington, spacey wife of losing candiate in California, Michael H.). Anyway, we talked about John Brunner (as you all know, Brunner's seminal "The Shockwave Rider," was inspired by "Future Shock") and his ideas. (And we all agreed that "Stand on Zanzibar" was his crowning achievement...even Shalmaneser admitted "Christ, what an imagination he's got.") Tidbits: * on digital cash: Heidi: "Oh, we're for it! Did you hear what I just told the interviewer?" (I didn't, as I was in the adjacent room. Later comments lead me to believe that neither of the Tofflers has a clear idea of what's going to happen with digital cash and crypto anarchy.) * on the NSA and the t-shirt I showed them ("Cypherpunks: putting the NSA out of business"): "Oh, no, we need a strong NSA now more than ever!" (What else would I expect? They view the NSA as the main bastion against terrorists plotting to blow up the World Trade Center. Alvin was generally more reserved and thoughtful. When I pointed out that the very hotel room we were in could be used to plot crimes, even nuclear terrorism, and that the solution to stop this would have to be an Orwellian regime of continuous monitoring, Alvin nodded thoughtfully, but Heidi just sniffed. I mention this to give a flavor, just a whiff, of what senior advisors to the most influential man in America are thinking.) * I gave Alvin a copy of my "Crypto Anarchy and Virtual Communities" paper. * My interview was pretty disappointing, by the way. Lots of sitting around, delays in getting my laptop hooked up to Netcom (outside calls had to be unblocked). The interviewer wanted memorable, quotable stuff from me, but I felt constricted sitting around and being expected to spout on cue. Maybe they'll get a few minutes of usable stuff.... (Print media is so much better. An interviewer can let the tape recorder run for hours, can edit the containing material of a quote, and can thus produce clear, coherent quotes. A video interview is more constrained in lots of ways, and offending gestures or rambling interjections cannot be easily edited out. As one example, at one point I naturally (to me at least) said something about "As we just saw...." Well, this made this quote unusable. And so it goes.) I was generally unhappy with the whole thing. Four hours to get there, two hours spend waiting around, an hour to resolve problems, an hour under the camera lights (being told not to move, to "use the mouse," to "tell us why cryptography is important," etc.), and five hours to get home. All for a few minutes at most on a t.v. show. Oh, the show is the BBC's "Horizons" science series, which may also get sold to U.S. outlets, etc. I think the title will be "The Information Bomb," and features segments on information warfare, a la Winn Schwartau's views, the Tofflers, some military planners, and--maybe--me. I don't have high hopes for my segment. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

1 0

"Disclosing" private email
by Arthur Chandler 17 Dec '03

17 Dec '03

Greetings! I'd like to solicit your/our best thoughts on the following message. San Francisco State University is considering a policy of "disclosing" private email to outside agencies. I'm aware that such a policy is yet another argument for using crypto; and the last cypherpunks meeting gave some encouraging instances of "transparent" encryption schemes that are not a hassle or a fear-barrier for newbies. But if you could post or private email me your thoughts about the legal/ethical aspects of "disclosure," I'd be much obliged. I've put a few of my own concerns at the end of the enclosed quote. ---------- Forwarded message ---------- >From: "Deirdre C. Donovan" <deirdre(a)mercury.sfsu.edu> > >I am rewriting the information handouts which we here in San Francisco >give out to our students when they apply for Internet access accounts. >The issue with which I am struggling is one of privacy. I have heard of >universities (anecdotally only) where the administration reserves the >right to read E-mail. Here, we are leaning more toward something like the >paragraph below, which is taken verbatim from an Indiana University draft >document. > > IU computing centers will maintain the confidentiality of all > information stored on their computing resources. Requests for > disclosure of confidential information will be reviewed by the > administrator of the computer system involved. Such requests > will be honored only when approved by University officials > authorized by the [President] of the campus involved, or when > required by state or federal law. Except when inappropriate, > computer users will receive prior notice of such disclosures. > I'm uneasy about the chain of "prior notice": 1) Does this policy give university administrators the power to read private email before the decision is made to "disclose" it to outside persons or agencies? 2) Does this "prior notice" mean "We're going to do it" or "We plan to do it, and if you disagree, let's discuss it before we release it"? 3) What constitutes "inappropriate"?

1 0

Re: Electronic cash illegal?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Within the United States (and most other sovereign states) Hal Finney is > correct to point out that the power to print currency is reserved to the > government. I would think that e-cash is a currency and therefore illegal > TO ISSUE WITHIN the geographical (legal) domain of the US. He didn't say it was illegal to print private banknotes, just taxable. Anybody can issue paper or metal tokens or whatever - the difference with goverment-issue currency is that they can pass laws saying you must accept it as payment for debts, even though your contract specified repayment in real money instead of private bogons like green paper IOUs or lightweight impure-metal coins with politician's pictures on them. As far as I know, the legal definition of a "dollar" in the US is still a certain weight of silver, and payment in silver legally satisfies debts; under current silver prices, that probably costs more than a $1 US Federal Reserve Note, so nobody bothers. Bill

3 2

EE Times on PRZ
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Jan 16 issue of EE Times has an excellent article on the legal controversy surrounding Phil Zimmermann and PGP, positioned top-right front-cover for maximal exposure. It describes the aftermath of a meeting last week between Phil's attorney, Philip Dubois, and the government lawyer handling the case. "'We told the prosecutor our concerns,' Dubois said. 'He agreed to consider them. We might hear back in a month or two. He didn't make any promises.'" (Sometimes it seems like the gov't is dragging this case out intentionally. I believe the uncertainty does have a chilling effect on private development of strong crypto, which would be gone if the government announced it was not going to pursue the case, or if they did bring charges and lost.) Another interesting quote: "Zimmermann is not in danger of being indicted for willfully exporting PGP. Rather, the U.S. attorney's office, here, is considering charging him for making PGP available in such a manner that it could be exported by a third party." What the hell is this? Can anyone point to the statute they may be referring to here? This seems awfully broad. This, from a sidebar, is really surprising: "In contrast, public keys allow the overt publication of an encryption key, because decryption keys can only be derived through a mathematically difficult process, such as large prime-number factoring. Contrary to popular belief, the NSA can decrypt public keys of most practical key sizes." I wonder what this means? If it is a claim that the NSA can factor 1024 bit moduli that would certainly come as a big surprise. If they are saying that they can do 512 bits that would be more believable although of interest. It is strange that the author would include a statement like this without attribution or evidence. Generally, the article is very favorable towards Phil and an excellent overview of the case. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLxytnBnMLJtOy9MBAQHGnAH/TAOr6TNchZjCyMESeDdOf1seXTkfMbMY 3qrL91OmjwxDIBDkzszrgizwadKwWYn65yOY3yJ4Wk/xUcNwKFnk1Q== =PoYj -----END PGP SIGNATURE-----

3 2

Re: The Remailer Crisis
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

>For example, the Linux mavens could tell us if Linux-based remailer >boxes could be hung on dedicated connections to The Little Garden >network, as a specific example. A "black box remailer" such as several >folks have suggested (Chaum (in 1981), me, Eric Hughes, others) might be >buildable for under a grand. We could ask here for contributions, and >might even raise this amount of money. Then each of us who contributed >could have "accounts," maybe several of them. Imagine 100 or more >"remailers" all on this one machine--I'm deliberately ignoring the >security issue for now. Little Garden has stated categorically that >they will not tell users what they can or can't do with their machines >(though I can think of some cases where they might have to, as with >spamming, etc.). Anyway, you can see where I'm headed. The "Linux mavens" followed by the "black box" stuff sparked an idea... First, before delving into dreamland: I'm sure Linux could be hung off just about any store-and-forward (a la UUCP) or TCP/IP-based network there is with a minimum of trouble. Linux junkies are familiar with the concept of "distributions". For the uninitiated, Linux itself is just a kernel; Linus Torvalds doesn't hold anyone's hand when it comes to actually turning that kernel into a working system. As a result, people have done this job themselves: they build their own working systems painstakingly from scratch and then archive it off to disk or CD-ROM, which they sell or give away. Most of the time, when you get Linux, you're actually getting one of these "distributions" of Linux, complete with all the frills that don't come with the kernel (like the shell, basic utils, and so on). Now how 'bout this: Consider a new distribution of Linux, the "Cypherpunk" distribution (if ya don't like the name, make up yer own!). This would be a bare minimum of a distribution, with nothing fancy: bash, misc. utils like ls, etc. This can fit (tightly) in 20 MB. The supplied kernel would have every networking option under the sun turned on, but would be otherwise bare of frills as well. Now let's add minimal network utils (telnet and telnetd for connecting and sendmail for obvious reasons), perl, PGP, and a remailer package. To make it as easy as possible, I'd use the UMSDOS filesystem, so that Linux could be installed on a DOS machine without any reformatting, repartitioning, or similar headaches. We could make this available via FTP or press some CD-ROMs if we were ambitious. Better yet, the cool Linux thing to do now is to install via NFS; this makes installing Linux as easy as sticking in a boot disk and pointing the install program at the NFS server (well, not quite, but pretty close). After adding in the cute little install program (like the Slackware distribution already has) and some boot options, you'd have an "instant remailer" software package, able to transform any 386SX/4MB RAM DOS machine or better into a Linux-based remailer site, complete with aliases, logging policies, etc. already configured for you. I bet even Tim May could install this if it were done right. :-) So, am I dreaming, or does this sound viable to y'all?

4 4

Re: MS Office NT
by Chris Claborne 17 Dec '03

17 Dec '03

Re: Office for NT, kahuna(a)fc.net writes: >I installed it yesterday, and played with it for about 5 minutes. ... I >wasn't able to save more than 8.3 in powerpoint, but Word did recognize this >feature, and I saved a file as 13456789012345.doc without a porblem. ...yay? This is one of the major features in NT, why the hell would they bother shipping it if it didn't support 255 char names??? ... __o .. `\<, Chris.Claborne@SanDiegoCA.ATTGIS.COM...(_)/(_). CI$: 76340.2422 --------------------------------------------------------------------------- PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Available on any Pub Key server. PGP encrypted mail welcome.

1 0