December 2003 - cypherpunks-legacy

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by an253398＠anon.penet.fi 17 Dec '03

17 Dec '03

Ray Arachelian writes: > Hell, at this point, my guess is that the mafia(s) doesn't use crypto, or > that if it does, it can be caught via other means. A strong, well > developed crypto system in use by the mafia would more than likely never > happen... not until mobsters get into computers. Ditto for terrorists. Sounds like an untapped market segment. In which periodicals should one advertise consulting services in order to cover the mobster market? Seriously, I imagine that organized crime, like any other business, uses computers. Their level of crypto usage could be impressive, given the incentives. > If they did use crypto, I suspect they wouldn't get caught. (For the > paranoid, assuming they used crypto, and they didn't get caught, then the > FBI or other TLA is doing the same as the gov't in Farenheight 451... > pick someone else, and jail them. Otherwise, how do you explain all the > jailbird mobsters?) "There is no honor among thieves." Wiretaps, bugs, tails, informants, and good, old-fashioned, physical intimidation probably produce plenty of leads. I wasn't entirely facetious above about working for the mob, they probably pay well and don't bother with FICA and such. Plus there's that "family" atmosphere.... ---------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. If you reply to this message, your message WILL be *automatically* anonymized and you are allocated an anon id. Read the help file to prevent this. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

"Cypherpunks Write Code" as a Putdown
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 5:25 PM 7/20/95, Patrick J. LoPresti wrote: > If it is ever feasible to >do what you suggest, someone will do it; your musings will have no >effect on that. If you want to make a difference, try writing some >code yourself... I want to comment on this latest version of the "Cypherpunks write code" universal putdown. It's become common for debates on what is possible, what is likely, and what should be done for someone to "trump" the argument with the mantra of "Cypherpunks write code." In my posting on why I think Netscape and related operating environments represent the likeliest targets for widespread crypto use (the "big win" I used in my title), I did not whine that others ought to write code for me. I said that this is where users were going in massive numbers. Take it or leave it, as an analysis, but the "try writing some code" is a meaningless insult. The world is made up of bridge designers, legal experts, authors, chip designers, and on and on. Not just programmers. The line "Cypherpunks write code"--which is sometimes treated here with a reverence its origins do not support--was a reference to our view that technology, meaning actual deployment, was more important and interesting than yet more gabbing about liberty and privacy. And what is "writing code"? Is it only Perl and C? Or does defining what a remailer needs to do count as writing code? (Attendees at the first Cypherpunks meeting, almost 3 years ago, can confirm that I was the one who spend about two hours describing Chaum's mix work, and running the "remailer experiment"...we debated how a remailer could actually work, and Eric Hughes took on the task of writing the first one.) The "BlackNet" experiment I ran actually worked...the keys worked, the mechanisms worked, and the experiment has been used by many as an actual concrete illustration of how untraceable information markets will develop. An actual demonstration is worth more than mere speculation, and this was an actual demonstration. I call this "writing code," albeit not C code. (My actual code writing, in real computer languages, is oriented toward Mathematica, on my Mac, and Smalltalk Agents. Not all programming is oriented toward writing Unix tools, and I think the narrow interpretation of "Cypherpunks write code" to mean this is misleading.) In any case, even the ur-crypto hacker Zimmermann is writing very little actual code in PGP these days...does this mean he should "try writing some code" instead of doing what he apparently does best? In short, the insulting tone of many Cypherpunks these days is saddening. I plan to continue to speak my mind, to point out what I think are the more important routes to a desirable future, and to criticize what I think are dead ends and ghettoized approaches. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

8 7

Re: "Hey Phil! Stop telling people *not* to use PGP!"
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:00 PM 7/19/95 -0500, Robert A. Hayden wrote: >> I am fond of saying that we PGP enthusiasts have two choices ahead of us >> within a couple of years: either 5,000 enthusiasts using PGP with >> MAXIMAL SECURITY at all times, or 5,000 enthusiasts with MAXIMAL >> SECURITY and 10,000,000 computer-illiterate e-mail users using PGP with >> push-button interfaces and multi-user remote systems. >I said it last week, and I'll say it again. From a sociological >standpoint, it's those 10,000,000 computer-illiterate e-mail users that we >need to focus all of our efforts towards. Those 5,000 literate people we >really don't have to care about. But there are two different classes of issues here - the convenience-only issues, which can be fixed with bells and whistles and GUIs and audio-enhanced-RTFM-buttons, and the security-related issues. For security, there are three classes of users: 1 - folks with standalone systems and dial-up mail - no problem This is a _lot_ of users - AOL, Compuserve, etc. 2 - folks with single-user systems on networks - they need to make sure they've got PGP installed right (relatively easy, with local disks, but fancy install widgets may help), but beyond that they've got to know that PGP is only as secure as their machine and network configuration. Mostly ok, and to the extent it's not, they've got other serious problems. This is also a lot of users. 3 - folks with shared machines - these folks (mostly Unix users and college students, plus people who have web-space they need to telnet to, like me) do need to know their limitations, and currently have the most problems with convenience, having to haul files back to a secure machine to encrypt securely. The first step is education - manuals that say "Don't Panic Unless You Need To Be Paranoid" instead of "Panic Immediately", that can make them aware of the risks and tradeoffs. It's about two pages of well-written stuff, if someone wants to write it. The next step is either building convenient tools to help them with encryption, or building convenient installation scripts for the tools that already exist (e.g. mail, or scriptable terminal emulators which can automate a lot of the hauling around.) The big payoffs are for groups 1 and 2, but a lot of the technically savvy people who read manuals and have to convince system administrators to install stuff are in group 3. So this is basically a writing job, plus talking the PGP 3.0 people and maybe Phil into including the discussion with the manuals. Remailers, btw, are in this class, since they need to leave their passphrases out in relatively unprotected shell scripts. I used to run PGP on a diskless workstation (at least I was one of the people with the root password :-), but I was aware of the risks. I'm now using it both on my Netcom+Eudora+PrivateIdaho system and on the machine where I have web space, which I have to telnet to across Netcom. I take care of the trust problem there by using a short key with a big ugly "untrustable" string in the user name, and using S/Key to log in; if I had an encrypted telnet to run on both ends I'd probably want to use it, so I'm watching the Stel and other new stuff coming out. Bill Stewart -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: You can get PGP by anonymous ftp from ftp.ox.ac.uk iQBVAwUBMA4HvfthU5e7emAFAQFrMwH9Hh1oYQKvsuV/IyVUskv2aZbmuh8fXQgK XpSpucrJV27tlFbjIDVqmapMR77arZVOm2Hs0/NTB2uT2jDG1r5+Lw== =fRtS -----END PGP SIGNATURE----- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: Is it legal for commercial companies to use PGP?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 10:30 PM 7/19/95 -0400, tim werner wrote: >>From stewarts(a)ix.netcom.com Tue Jul 18 02:51:50 1995 >>Selling software containing the code is pretty clearly commercial. >>Non-commercial messages from your personal non-business machine are >>clearly non-commercial. Providing a service of encrypting and decrypting >>messages for people for money sounds like it's _very_ probably commercial. >>Encrypting and decrypting messages to/from your business that deal with money >>are a very gray area. > >Maybe "commercial company" is the wrong expression. All I meant was >that my company is not non-profit, or a university, or a government >organization. It is an engineering firm. What I have in mind is >nothing to do with a commercial use of encryption per se. That's what I thought you meant. >1) I have some email pen-pals that I would like to be able to use PGP to That would be fine to use PGP 2.6.2 for; there's realky no question. >2) It's entirely likely that people within the company may wish to get > into the habit of transmitting company data in encrypted form. This > is not a question of incorporating the encryption technology into a > product, or even into the sale of a product -- it's just a question > of keeping intra-company information transfers private. >The first is the one I'm really concerned with. The second would be >sort of a natural extension that, if legal, would be nice. I can't >imagine that these uses are subject to the ViaCrypt license, but I need >some reassurance/ammunition in order to be a little more open about >getting it installed on the machines in my department. The ViaCrypt license only matters if you're using ViaCrypt. The question of whether you can use PGP 2.6.2 for these is something you _do_ need to read the RSAREF license about, and maybe ask Jim Bidzos <jim(a)rsa.com> or a company lawyer-type about; encrypted mail within the company is probably ok, encrypted mail sending credit card numbers to pay for stuff is more questionable. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: Java (was Netscape: the big win)
by Hal 17 Dec '03

17 Dec '03

So, what would be a "cypherpunk" thing you could do with Java? I know I can use it to download little applets to my system to do animations. What can it do to enhance my privacy? What would be the Java equivalent of PGP? Hal

2 1

Name misspelling
by perry＠imsi.com 17 Dec '03

17 Dec '03

I've been informed that the proper spelling was Taher Elgamal. Perry

1 0

BUS_gut
by John Young 17 Dec '03

17 Dec '03

7-20-95. NYPaper: "Clinton Assails Officers' Racist Event. Gathering Is Defended by the Organizer as Get-Acquainted Party." Mr. Rightmyer, organizer of the event, said he believed the criticism of the roundups was part of a politically motivated "setup" by the paramilitary group, the Gadsden Minutemen, who harbor intense hostility toward the ATF for its role in regulating the manufacture and sale of guns. Morris Dees, head of a prominent civil-rights organization, supported his view, and one Federal law-enforcement official said Mr. Rightmyer might be correct. JIV_tun "Montana Tax Protester Is Shot During a Raid." Local law-enforcement authorities, who had waited for more than three years to arrest a tax protester, Gordon Sellner, accused of trying to kill a lawman, shot and wounded him in a raid on his home. JAK_but [OpEd] "Terror In Montana: Judges do their jobs and risk their lives." Martha A. Bethel has been a municipal judge in Montana for nine years. This article is adapted from a statement she made last week at a Congressional forum on the militia movement. JUG_hug Trio: BUS_gut

1 0

IITF Report
by Carl Ellison 17 Dec '03

17 Dec '03

The Information Infrastructure Task Force (IITF) National Information Infrastructure Security Issues Forum draft report can be found at: http://ntiaunix1.ntia.doc.gov:70/0/iitf/security/fedrole.txt

1 0

Re: Netscape the Big Win
by Rich Salz 17 Dec '03

17 Dec '03

> Luckily, Netscape recently hired Taher Elgamal > and he's a smart guy. Unfortunately, he seems to be in a > position where he has to defend the fairly bad work they did already. When I first saw him speak at the Danvers IETF I thought "gee, does this bozo know he shares the same last name as a real bright guy"? I think it was Perry, for example, that pointed out that using one RC4 stream for each comm half was more-or-less obvious and standard practice. At last month's World Wide Web Consortium working group meeting on security, everyone trashed SSL. Everyone trashed the W3C for not just picking SHTTP but instead trying to invent something new that "borrowed from" SHTTP. Tahir was silent on the former, but didn't disagree on the latter. During a break, in the hallway he mentioned how he's gonna have to do some politicking back at the office, and that he's glad someone reasonable like him came, and not other folks he could name. > Netscape is a closed system. You can't write code for it unless you > work for Netscape. I thought they announced their intent to support java. /r$

1 0

Re: Netscape the Big Win
by Rich Salz 17 Dec '03

17 Dec '03

> I'm not sure what this is getting at. SSL does use a separate RC4 stream > for each comm half. Is this a suggestion that a single key should be > used for both directions? No. They were saying "look, we use two keys." And Perry went "duh." /r$

1 0