December 2003 - cypherpunks-legacy

RE: "bad" government
by Blanc Weber 17 Dec '03

17 Dec '03

From: "Richard F. Dutcher" Do you assume privacy and protection from arbitrary power are solely libertarian concerns? If so, educate yourself and check out the ACLU and Amnesty International ... .................................................. You can check out each group, each organization, each institution, etc. one by one, and eventually arrive at the realization that it's a matter of principle. Anyone can make your life hell, even the "good guys" who are supposed to know better and whose talents are engaged supposedly for the support of great ideals. "Oh Liberty, what crimes have been committed in your name." .. Blanc

1 0

Re: ESP Unix encrypted session protocol software
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> How to do authentication of DH sessions - it's hard to store > a private-key safely on a multi-user server. For now, let's look at this as client-server, rather than peer-peer. One direction of authentication isn't too hard - the remote client can authenticate his half with a PGP (or equivalent) public key, and the server can keep a cache of known clients' public keys, plus maybe have a good connection to a key server, and use web-of-trust to help fill in the gaps. (Getting all the details right is annoying...) (And it increases the protocol a lot, involves post-1997 patent control, and invokes PGP-vs.-RIPEM Public-Key-Implemention political wars. But it's all an exercise for the reader :-) One way to resolve the server direction is to hand-wave it away - the authentication problem you need to solve is the man-in-the-middle; man-at-the-end is a different problem. After all, if the Bad Guys can break into the server well enough to steal root's private key, the server is hosed anyway, and untrustable. (The variant where the server process is user-owned rather than root is really no different.) If there _is_ another way to solve the server direction, it's to do something like input the server's private key or the secret key for root's private-key keyring into the process form a terminal rather than a file, so it isn't stored on disk anywhere; not a big win, but it's something. An alternative to server authentication is to use a well-known published half-key for the server end. (Obviously the server still needs to keep x private while publishing g**x mod m, but that's hard anyway.) The client doesn't have to authenticate it, since it's well-known, though it could be signed with a key not stored on the server, and the server can authenticate the client's signed half-key, so the man-in-the-middle is still unable to fake the session. People have discussed how much this reduces security; I don't remember the conclusions. Bill

1 0

No Subject
by avi baumstein 17 Dec '03

17 Dec '03

sandrew(a)ufl.edu, dart(a)freenet.ufl.edu Subject: WSJ column of 1-26-95 The following refers to the page B1 article in the January 26, 1995 column of The Wall Street Journal titled "Personal Technology" by Walter S. Mossberg. -----BEGIN PGP SIGNED MESSAGE----- Mr. Mossberg: Your editorial warning of the dangers of the online universe, while well written, presents many arguments which do not make sense in the current context of society or the Internet. Your belief that anonymity is ruinous to on-line culture is based on simply incorrect assumptions. The most egregrious of these is that anonymity is anti-democratic and not present in our non-digital society. It is widely known that the Federalist Papers were published under psuedonyms, as have many other works which our culture holds dear (Samuel Clemmons' Mark Twain identity comes to mind). Anonymity can be acheived in the written word very easily today, by simply not signing a letter, and dropping it in the nearest mail box. The White House is one of the biggest receipients of such anonymous mail. Newspapers routinely publish anonymous articles, often credited to "AP Newswire". Most editorials bear no author (although the editorial board can be identified, who is to say which one of them, or even if any of them wrote a specific piece?) It is not uncommon for letters to the editor to be published unsigned, to protect the wishes of the author. The corporation is a form of anonymity. The legal term used to describe a corporation's name screams of anonymity: Fictitious Name. Oil companies routinely print ads in major media under names such as "Coalition to clean our beaches". These are not only anonymous, but misleading. Yet given all these methods of anonymous publishing (in print, none-the-less), our society has existed in it's present form for several centuries. And I am sure that anonymity is by no means a product of modern day America. Your statement "Our democracy and society require accountability, not anonymity." is 100 percent wrong. When you go into a voting booth, do you sign your ballot? Our government is founded on anonymity, and SHARED accountability. We are all responsible for what happens in this country. Perfect accountability is actually acheived only in a dictatorship, where it is known that only the dictator is calling the shots. That's certainly not democracy. Anonymity has many positive uses. The most often mentioned is for victims to be able to discuss their problem without fear of retribution or identification. There are many places on the Internet where such discussions regularly take place. Another use can be where a person wants their opinions to be judged on their merit, rather than their name (have a look at The Economist, which does not publish bylines, but yet it is extremely respected. Possibly there is some connection here). Other uses can be whistleblowers; The state of Florida maintains an anonymous hotline for government workers to tip off the Comptroller about wastes and abuses. The bottom line is that anonymity, rather than being a bane to democracy and freedom, is actually essential to the proper workings of our society. As a last example, I draw your attention to the lines that delineate this email message. They proclaim that this document has been "PGP signed". This is a technology that allows you (or anyone else) to verify with almost certainty that it was I who wrote this letter. This is a counterpart to anonymity in the on-line universe. Were I the president, sending an official document, rather than believing the name I signed or whomever my on-line service claimed to be, you could independantly verify that that signature belonged to me, and that it was indeed I who produced the contents of the message. There is no problem with anonymity OR accountability today, both work perfectly fine, and serve their respective purposes. Sincerely, - -avi Avi Baumstein avi(a)clas.ufl.edu -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLy25T/sIKWn2XtaVAQG5WgH/eNa8RZw4pfjccZJjZU3u2Y6aeulJa3T8 dDgkHr1vZxdCe7pii7CKpa+UKg6irpqwr6RUhYqCsq/svufmtdNkdw== =kENj -----END PGP SIGNATURE-----

1 0

WSJ editorial on anonymity
by avi baumstein 17 Dec '03

17 Dec '03

The article from the January 26, 1995 Wall Street Journal titled "Personal Technology" and dealing with the horrors of anonymity can be found at: <http://www.clas.ufl.edu/~avi/NII/wsj_no-anon.html> my response and other information regarding the NII can be found at: <http://www.clas.ufl.edu/~avi/NII> -avi

1 0

Re: ESP Unix encrypted session protocol software
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 10:02 AM 1/30/95, Matt Blaze wrote: ....>As for the alternatives, I think the picture is pretty bleak, to tell >the truth. The cryptographically sound way to prevent spoofing is >with authentication of the agreed key. But for the remote host to >authenticate itself, it has to have a secret signature key. Where to >store it? A typical machine, especially a multi-user, unattended server >simply has no safe place to store keys. .... There would be on a secure "multi-user, unattended server". They are not easy to come by and they arn't really Unix. I don't get on my soap box very often but I couldn't resist your execelent opportunity. I think that security requires good crypto and good OS security. There are Orange book rated systems that are rated to run hostile software in the same machine with Top Secret information.

6 6

How the cypherpunks nearly got me fired (long)
by dmandl＠panix.com 17 Dec '03

17 Dec '03

This is a true story. Yesterday, I found out that the mail at the company I work for is being read by SAs on a regular basis. The company is so ignorant about the net, so stingy, and so paranoid, that they're terrified by the possibilities of our internet access (which is crippled: email only, with a misconfigured sendmail, no less; no ftp or telnet; no Usenet). People receiving email from outside could be receiving JPEGs or sound files--all non-business-related, and therefore wasteful of company resources and valuable employee time. This in a biggish and very profitable Wall Street firm. These people are serious dinosaurs. So they installed a pathetic scanning program. Since the evil filetypes are "usually uuencoded," their scanner greps all incoming mail for "^begin"--no kidding--and stops the message right there if it's found. I found this out yesterday when my boss got a call from an SA: turns out he'd been mailed a PostScript file from a vendor (some documentation we were waiting for), and a "begin" statement in the file triggered the alarm. After my boss assured him that it was just a user's manual, the SA let it through. Today, I was sitting in my boss's office in a routine meeting when _his_ boss (let's call him Larry) came by. He said that _his_ boss (this is now my boss's boss's boss--let's call her Mary) wanted to talk to me. I had no clue what she wanted, and neither did my direct boss, which seemed particularly strange. One thought that crossed my mind was that they were going to give me a promotion, which I deserve and which it had been obliquely suggested I might be getting soon. Ha. I walked with Larry over to our other building, four blocks away. We went up to Mary's office, and there she was, sitting with another woman I'd never met. The latter was introduced to me as--oh, let's call her "Paula." There was a printout on the table. Glancing at it out of the corner of my eye, I noticed that it was a piece of email and got a chill. Had they intercepted email from me to a friend telling him how much the company I work for sucks (which, ironically, I'd done just yesterday when I found out about the mail-scanning)? Would these three execs actually call me on this and ask me to explain it? I was very nervous, even though they had a piece of MY PRIVATE CORRESPONDENCE in their hands. Paula started off by explaining to me that they'd just installed this nifty scanning program to catch illicit or potentially dangerous software coming in from the outside. Here was a piece of email, sent to me, containing a uuencoded binary file inside of it (actually, it was just C source code, as the header plainly stated). From the comments at the front of the message, it was clear that this was a piece of software intended to circumvent firewalls, breach network security, and intentionally mask the identity of the culprit. (I'm more or less quoting from memory here; I only got to glance at the comments, so I don't know exactly what the code does; it was posted by Matt Ghio a day or two ago). Why was I having a program like this mailed to me? I explained that it was sent to a mailing list that I subscribe to. The mailing list is concerned with encryption and data security. This is just something that someone on the list happened to post. I have no control over what people post to the list. I read and save what's of interest to me on the list and trash the rest, like everyone else does. Why did I have this message forwarded from my private account to my work account? she wanted to know. Because I have all my mail from that particular ("techie") list forwarded to my work account, the same way that I keep all my other technical documentation at work--my Perl manual, my Unix manuals, etc. She actually pointed out that she saw the word "cyberpunk" on the message (that's right, she can't even read), and this also caused her concern. (I would have been interested in hearing her explanation for that.) She started huffing and puffing about how this all made her very very worried. If there's no way to control this kind of thing, she'll just have to turn everyone's internet access off (or just mine). I said, "Look, I'll turn off the forwarding when I get home tonight and not have any of this stuff forwarded to me here any more." She said, "Yes, naturally." The discussion ended with her asking ME what they can do to assuage their fears and prevent evil programs like this from being sent to employees of the company. I said that there wasn't much they could do; this stuff is freely available, and if it isn't emailed in, people can still bring it in on floppy discs. It also could be mailed un-uuencoded (why was it uuencoded anyway?)--and then what would they do, scan everyone's mail for '{'? What I didn't feel like saying at that particular place and time was that people could just as easily bring sledgehammers in, or trash databases using their legitimate access. Unfortunately, the company has just got to trust its employees. I didn't actually say any of that because I just wanted to get out of there. I was getting bad flashbacks of being sent to the principal's office in third grade. My internet access at work is probably history; maybe everyone else's, too. (Our access is so crippled that there are probably only four people who even get mail from the outside; and as I said, there's no news or ftp/telnet access. I use it for nothing more than reading cypherpunks, actually. The system is so badly maintained that I'd never trust it for personal email.) I now have to start receiving and reading cypherpunk mail at home, which presents a problem because my personal time is very limited, whereas at work mail trickles in during the course of the day and is easily managed. This may mean I have to unsubscribe soon, after two and a half years (almost since day one of the list). I love Big Brother. P.S.: I've tried to avoid injecting my personal politics into this story. Yes, I know that as the owner of the connection, they've got the right to do whatever they want (and this seems to be borne out by the ECPA documents, which at a friend's suggestion I read as soon as I got home--too bad, because I'd have seriously considered legal action). I just thought you might enjoy this little story, and would want to keep it in mind if you're ever considering employment at Bear-Stearns. --Dave. -- Dave Mandl dmandl(a)panix.com

1 0

PGP/crypto XCMDs for hypercard...
by Adam Feuer 17 Dec '03

17 Dec '03

anyone know if there are any PGP or general crypto XCMDs for hypercard? i'm prototyping a front-end to control some premail stuff and some secure WWW server apps, and it would be convenient to have something like this. on related notes, anybody know about XCMDs that talk to MacTCP...? and can someone send me status or a pointer to the PGP library for windows? please reply to me personally; i'll summarize to the list. -adam Adam Feuer adamfast(a)seanet.com 206-628-8813

1 0

Is the remailer crisis over?
by skaplin＠mirage.skypoint.com 17 Dec '03

17 Dec '03

Well folks as of 11:30 on 1-30-94 there are 14 remailers with uptimes greater than 99%. What's the consensus...Is the remailer crisis over? Sam -- ============================================================================== skaplin(a)skypoint.com | Finger skaplin(a)infinity.c2.org for | a listing of crypto related files PGP encrypted mail is accepted and | available on my auto-responder. preferred. | (Yes...the faqs are there!) | E-mail key(a)four11.com for PGP Key or | "...vidi vici veni" - Overheard Finger skaplin(a)mirage.skypoint.com | outside a Roman brothel. ============================================================================== And God said: E = *mv* - Ze*/r ...and there *WAS* light!

4 3

RE: "bad" government
by Richard F. Dutcher 17 Dec '03

17 Dec '03

>> Subject: RE: "bad" government >> From: "Richard F. Dutcher" > >> Do you assume privacy and protection from arbitrary power are solely >> libertarian concerns? If so, educate yourself and check out the ACLU >> and Amnesty International ... > .................................................. > > You can check out each group, each organization, each institution, etc. > one by one, and eventually arrive at the realization that it's a matter > of principle. Anyone can make your life hell, even the "good guys" > who are supposed to know better and whose talents are engaged > supposedly for the support of great ideals. > > "Oh Liberty, what crimes have been committed in your name." > > .. > Blanc > All too true. What's your point? Got a principle that *hasn't* been used/abused? Rich Dutcher, San Francisco Greens P.O. Box 77005, San Francisco, California 94107 USA "That's libertarians for you - anarchists who want police protection from their slaves." Kim Stanley Robinson, "Green Mars" Greens, of course, only enslave plants - so weed-whackers work better than cops ...

1 0

The RSA FAQ on http://www.catalog.com/jamesd/rsafaq.html
by jamesd＠netcom.com 17 Dec '03

17 Dec '03

Chris converted the RSA FAQ to html for easy reading. I have placed this faq on http://www.catalog.com/jamesd/rsafaq.html --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.catalog.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the omnipotent state. | jamesd(a)netcom.com

2 1