December 2003 - cypherpunks-legacy

First Virtual, Nathaniel Boorenstein
by nobody＠valhalla.phoenix.net 17 Dec '03

17 Dec '03

Mr. Borenstein's text production rate is truly amazing. We should induct him into the Internet Hall-of-Fame immediately. He rivals Kibo in his ability to detect messages about himself or his company. He rivals Sternlight in his ability to generate endless streams of minor points. Crypto-relevance: 1) What technique could be used to differentiate Boorenstein's rants from automatic rant generator output? Has First Virtual done this? If someone wanted to generate a Borenstein rant-generator, god knows that there's enough low-entropy sample material out there. 2) If you're looking for keywords to insert into your M-x spook-the-spooks generator, try Borenstein and First Virtual.

1 0

Re: CDT report on Senate and House hearings on Online Pornography
by James A. Donald 17 Dec '03

17 Dec '03

Crypto relevance: Absolutely none. At 03:52 PM 7/28/95 -0700, Christopher E. Stefan wrote: > Somewhat interesting it seems, an ultra-conservative House is the First > Amendment's bigest friend on the [...] If ultra conservatives are folk who only increase school lunch funding by 4.5% (reducing the planned increase by 0.8%), who reduce the marriage penalty by $500, reduce government controlled broadcasting by 8%, and so forth, What then would you call people who would reduce the marriage penalty by $4000, abolish school lunch funding, and end government controlled broadcasting. Lunatic fringe ultra Nazis? --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: First Virtual, Nathaniel Boorenstein
by Donald M. Kitchen 17 Dec '03

17 Dec '03

Anonymous: > Mr. Borenstein's text production rate is truly amazing. We should > induct him into the Internet Hall-of-Fame immediately. > > He rivals Kibo in his ability to detect messages about himself or his > company. He rivals Sternlight in his ability to generate endless > streams of minor points. This whole thread has me wondering what "ELL DEE" is up to these days. Ooops, I think I just added another msg to the thread. Good thing it's not signed, I'll deny I sent it. In order to give this message an ObCrypto, might I mention that we actually had some traffic on the #crypto/#cpunks channels recently. No alt.conspiracy or rant-o-matics either!! Don

1 0

More about HTTP proxying: Harvest cache
by Enzo Michelangeli 17 Dec '03

17 Dec '03

Hal and others interested in HTTP proxying: I've just found an interesting alternative to CERN httpd at http://excalibur.usc.edu/ . I haven't yet played with it, but it looks promising. Caching should also play a useful role defeating traffic analysis, besides increasing the throughput. [...] HIERARCHY The Harvest cache implements hierarchical caching: your cache at home can resolve URLs through your lab cache, which in turn can resolve requests through your institutional cache, which in turn can resolve requests through your regional network cache. The cache resolution algorithm, at each stage in the hierarchy, distinguishes parents from neighbor caches. A parent cache is a cache higher up the hierarchy, while a neighbor cache is one at the same level in the hierarchy. [...]

1 0

Re: Zimmerman legal fund
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Nathaniel Borenstein <nsb(a)nsb.fv.com> writes on cpunks: > The relationship is a completely open and friendly one, Not intending to infer otherwise (indeed I think I said this). > without any strings attached that I'm aware of. > [...] > So, FV has been a friend of Phil's for a long time. We launched the > Yellow Ribbon campaign and the FV-based fundraising drive in that > spirit, though clearly it doesn't exactly hurt us if people sign up > for FV in order to donate to Phil. That really wasn't our > motivation, however, and we sought to underscore that fact by making > a donation to Phil's defense fund every time people sign up for a > new account expressly in order to donate to ZLDF. In other words, > if you are a Zimmerman supporter and you were thinking it might be > nice to have an FV account anyway, you can help Phil even more by > signing up and paying your $2 fee through the ZLDF pages. Okay so far so good. Sounds good for Phil Z which sounds cool to me. > Well, only on the cypherpunks list would you be likely to find > general agreement that PGP'ed credit card numbers are "easier" than > First Virtual. Many thousands of extremely naive net citizens are > now happy FV customers, and I seriously doubt that most of them > could master PGP without a full-day tutorial. (We're not talking > about rocket scientists here, folks.) I dunno you know... sci.crypt, alt.security.pgp, alt.privacy,anon-server, etc, etc. are I think the most common people to be using the yellow-ribbon sig, and hence the places they post to (mainly the same) are likely to be the people who see, it and are hence likely to contribute. The URL being used is http://www.netresponse.com/zldf, and nowhere does it mention using PGP and CC #'s. Most people who can't use PGP aren't going to be interested I would have thought. When I read the URL I thought, hmm, okay, got fired up and thought I'd donate something right then... but when it came to it, I had to sign up for a fv account. I cooled. It has to be instant, for best effect. > There are two web sites basically because they are taking care of > the informational aspects and we're concentrating (pro bono) on the > online fundraising aspects. If www.netresponse.com is someone else (although you did say you started the Yello Ribbon campaign), I guess the comments are directed to them rather than you, as if your link is just "the FV method to donate to the PZLDF", then fair enough. Maybe I should try target at the zldf(a)clark.net email. (I think there is a human one if I remember rightly. Also note that this was _not_ an attack on FV, but rather a plea to improve the amount of money the yellow ribbon campaign draws for the PZLDF, by providing alternatives which will suit some people better for a one-off, instant payment). > If we've overly stressed FV as a collection mechanism, I apologize, > but you must bear in mind that we've been living and breathing the > FV payment system for 18 months now, and it would be kind of hard > for us not to even *mention* it. :-) Okay, now separate issue, really talking about FV now. For me, the main thing holding me back from using it is that I'm not in the US, and don't have a US bank account to open a FV seller acct. (I would have liked to use it as one of the few net payment systems actually up and running, as a payment method for the RSA T-shirts, it would have been a nice system, allowing me to effectively accept VISA payments which I have otherwise been unable to do.) Any news on this front? Last I looked on your WWW page, you were investigating this and payments in other currencies. US$ would be fine though, as long as it was possible for the seller to create a US account, or have it paid to a non-US account (would it not be possible to pay to non-US account?). Adam -- HAVE *YOU* EXPORTED RSA TODAY? --> http://dcs.ex.ac.uk/~aba/rsa/ --rsa--------------------------8<------------------------------- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) -------------------------------8<------------------------------- TRY: rsa -k=3 -n=7537d365 < msg | rsa -d -k=4e243e33 -n=7537d365

2 1

NO reasno whatsoever for the MILITARY to use an intentionally WEAK encryption system. (fwd)
by fc＠all.net 17 Dec '03

17 Dec '03

Forwarded message: >From fc Sat Jul 29 07:18:30 1995 Subject: NO reasno whatsoever for the MILITARY to use an intentionally WEAK encryption system. To: pgf(a)tyrell.net (Phil Fraering) Date: Sat, 29 Jul 1995 07:18:30 -0400 (EDT) In-Reply-To: <199507282019.AA27619(a)tyrell.net> from "Phil Fraering" at Jul 28, 95 03:19:45 pm X-Mailer: ELM [version 2.4 PL22] Content-Type: text Content-Length: 3694 ... > You misunderstand. With public key encryption, the proliferation of processor > power and bandwidth, and their funding, there is NO reason whatsoever for the > MILITARY to use an intentionally WEAK encryption system. The military doesn't have that much funding for this sort of thing. There are more than 2.5 million computers (est.) in the DoD, and to put in and manage a cryptosystem for this large a network is a very difficult and expensive proposition. At $100 per computer (including only purchase price and installation) that's $250 million, but that only covers relatively low bandwidth communications. The vast majority of systems use Ethernets and similar things where encryption is far more expensive - but we'll ignore that for now. You also have the key management problem. You need to create a secure distributed key management database capable of handling 2.5 million public keys. No current system I am aware of can do this, so there is a substantial R+D problem out there. Then we have to put hooks into every different OS used in the DoD to allow this to work properly. Then we have issues like synchorinization and man-in-the-middle attacks to worry about. Any of these could take out the crypto-systems, which are (in today's world) less reliable than standard communications. This means we are sacrificing availability for confidentiality, which in the military domain means we will lose the war, but nobody will be able to tell us why, because they will never be able to decrypt all the details. The DoD does use cryptography extensively, but only to protect information worthy of the real costs and complexities associated with the technology - just as any organization should strive to do. ... > I think you misunderstood: if we want a military in the first place > (yes, I realize that's an open question to many people on this list) > it needs to have as much of its communications encrypted as possible. > Without back doors or intentionally weakened algorithms. Otherwise > we're just stuck with a standard conventional force that isn't _that_ > great compared to the combined assets of a reasonable assembly of > enemy forces. Secrecy isn't the only military advantage in information warfare. The pace of the action is far more important, the availability of select information at the right place at the right time is far more important, the ability to deny information to the enemy is far more important, the accuracy and timeliness of the information is far more important, and on and on. If you really want to know more about this, you should read: "Protection and Security on the Information Superhighway" John Wiley and Sons, 1995 ISBN 0-471-11389-1, 320 pp, $24.95 Furthermore, backdoors are very useful, for example, when we sell the equipment to other nations who resell them to those who try to use the techynology against us. The best cryptosystem for the NSA is one that only they can break. > I would go even farther: since so many of the troops sent over to the Gulf > in the war there went with K-Mart-purchased GPS receivers that the military > had to turn off selective availability, I am willing to bet that in future > conflicts the U.S. soldier's ability to have secure communications (with > no backdoors or weakened algorithms) is dependent on civilians having access > to the same technology. Because the only way they might have it is if Ma > and Pa go down to the local K-Mart and buy one for their son/daughter about > to go overseas. How much would you like to make that bet for? -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236 -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

2 4

Re: copyrighting algorithms
by Alan Pugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Date sent: Thu, 27 Jul 1995 21:43:07 -0700 From: Bill Trost <trost(a)cloud.rain.com> Subject: copyrighting algorithms To: Wolfgang Roeckelein <wolfgang(a)wi.WHU-Koblenz.de> Copies to: rross(a)sci.dixie.edu (Russell Ross), ssl-talk(a)netscape.com, cypherpunks(a)toad.com Wolfgang Roeckelein writes: >I wasn't aware that you could copyright an algorithm. Patent, >yes, but not copyright. Intellectual property meens secret, >right? Aren't there any precendence cases involving propriety >schemes that are reverse engineered? =snipped= bt> As for the quoted material, "Intellectual property meens [sic] bt> secret" is quite mistaken. Copyright and patents are the two most bt> common forms of intellectual property (AFAIK), and neither of them are bt> secret (unless they're classified patents, but never mind...). from _computer_digest_ (raleigh,nc edition) august 1995... "In the past, the office (U.S. Patent Office) has contended that because software is a mathematical process, it can only be - -protected- and not -patented- by copyright law. However, the U.S. Court of Appeals for the D.C. Circuit has ruled in several recent cases that inventors deserve patents because the programming was integral to the machine." ... The office announced in March that it would propose new rules for embedded software patents and published them in the June 2 Federal Register..." Spokesman Richard Maulsby said the agency hopes to have final quidelines in place by September. Under law, the office issues patents for 'machines', 'articles of manufacture' and 'processes'. The proposed rules tell patent examiners how to determine whether software proposed for patenting meets the criteria. Under the proposed rules: 'A computer or other programmable apparatus whose actions are directed by a computer program or other form of software is a statutory "machine". A computer-readable memory that can be used to direct a computer to function in a particular manner when used by the computer is a statutory "article of manufacture". A series of specific operational steps to be performed on or with the aid of a computer is a statutory "process." What isn't patentable? According to the rules: 'A compilation or arrangement of data independent of any physical element,' meaning no hardware. ... The guidelines are available on the patent office's World Wide Web server at http://www.uspto.gov. The patent office is accepting comments on the proposed guidelines through July 31. ... Comments can ... be sent by Internet electronic mail to: comments-softwarepro.gov. ============================= obcrypto: would this give any more ammunition to companies like rsa in protecting their algorythm? amp <0003701548(a)mcimail.com> <alan.pugh(a)internetmci.com> PGP Key = 4A2683C1 July 29, 1995 12:35 -----BEGIN PGP SIGNATURE----- Version: 2.61 iQEVAwUBMBo5NigP1O9KJoPBAQG53wf/e1/gO4BxqZ1DTEv6/XQ13amQtQ9iKnr6 tgQJ37XwwR45fd87X+du68yDVjFZSKp6A27PCtfxkGmi8v0gHdGYKenaWnv4CWs7 KhP+7f/ZyVND5oYd4HEMDnVJCVsRA2Kd1BaXbFlxmp+URH9XZkr0aOdvtOqngyCA qgpQ8jD4duu1HwwHQyj47mxgkncEfN1H5mAFyaLA+Lgx6yhvaZqedzMZokGkqOPR bZMKhodYhOatmtyEwxciS2sqj3DYq7w+XC57sSSz+raOEmDhfq8/UNctJ6+d4vuH PWk26vbfxMAKKzsq5VRwf3XvAjvT4ky+KJgCDaFezmBa2dXvw/K+Lw== =SNY7 -----END PGP SIGNATURE----- ********************************************* * / Only God can see the whole * * O[%\%\%{<>===========================- * * \ Mandlebrot Set at Once! * * amp * * <0003701548(a)mcimail.com> * * <alan.pugh(a)internetmci.com> * ********************************************* Key fingerprint = A7 97 70 0F E2 5B 95 7C DB 7C 2B BF 0F E1 69 1D

1 0

The little sex kitten
by Philip Zimmermann 17 Dec '03

17 Dec '03

I don't know if this item has been posted here yet, but someone just emailed it to me, and I thought you folks might enjoy it. -prz ---- Date: Thu, 27 Jul 1995 13:53:02 -0400 Subject: The little sex kitten JUDGE RULES ON E-MAIL PRIVACY CASE TULSA, OKLA -- The Oklahoma Supreme Court has ruled on a case that many legal experts believe clearly delineates the e-mail privacy rights of computer users in the workplace. Judge Stan Musing declared that employees have a right to expect that their empolyers will refrain from monitoring e-mail messages transmitted on company systems. The case went to court after programmer Augustus Lindsey's supervisor monitored his e-mail and intercepted a message from Lindsey to a colleague. The message read: "That little sex kitten has been driving me wild. She's moaning and begging for it every minute. Last night I was afraid someone would hear, and we'd be thrown out of the building. But don't worry -- all is arranged. Wednesday she gets the knife". Lindsey's supervisor alerted authorities, suspecting that a crime was in the making. Lindsey was arrested on the spot and spent an uncomfortable night discussing the situation with the police. However, he was released in the morning, just in time to get his female cat to the vet for spaying. Lindsey sued his boss for invasion of privacy and sought punitive damages as well. ----

1 0

MIT PGP distribution site accessible from Canada
by jis＠mit.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- MIT PGP distribution site accessible from Canada July 29, 1995 MIT is pleased to announce that, after consulting with the US State Office of Defense Trade Controls, we have clarified procedures that permit us to make our PGP distribution site accessible from Canada. We would like to thank ODTC for helping us to make this possible. People in Canada attempting to download PGP from MIT will be required to assert that they are Canadian citizens and that they are obtaining the software for end-use in Canada by Canadian citizens, or for return to the United States. You can obtain PGP via the World Wide Web at http://web.mit.edu/network/pgp.html You can also obtain PGP via anonymous FTP to net-dist.mit.edu. Connect to the directory pub/PGP and get and read the README file. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMBqHC8UtR20Nv5BtAQHYKwP9EOZ+E9ZtX6oRmrstl+JzHUUgMPMZp5by zOVuBJtPCNPeQekv+A5lJWzaJVxdJePHvvRttbLv3VYH6i5I/TGwoe0zLyiBsl5B piSkC6ERLRR1052DC6ki8xj7C1SR5LKlhRY8k9fFn7UwkPw6JDNRAPY4Qh+T3vzX IUZG0XomYMA= =Yaww -----END PGP SIGNATURE-----

1 0

Re: The little sex kitten
by dmandl＠panix.com 17 Dec '03

17 Dec '03

At 11:57 AM 7/29/95, Philip Zimmermann wrote: >JUDGE RULES ON E-MAIL PRIVACY CASE > >TULSA, OKLA -- The Oklahoma Supreme Court has ruled on a case that many >legal experts believe clearly delineates the e-mail privacy rights of >computer users in the workplace. Judge Stan Musing declared that employees >have a right to expect that their empolyers will refrain from monitoring >e-mail messages transmitted on company systems. Far as I can tell, this is meaningless. If you sign a paper "consenting" to email monitoring by your employer, they've got a green light, period. And under those circumstances, I'd think very few companies would be foolish enough not to just ask you to sign. So the only ones who have to worry are those who don't get your "permission" first, and probably more and more companies will just be more up front about it in the future. The tightwad, privacy-loathing scumbags I work for sprang just such a document on us recently, and after squirming and bitching about it for a while, I actually did sign, simply because I wasn't prepared to lose my job at that point. My fear, based on well-established tradition, is that eventually this will become widespread and more and more employers will monitor email, with coerced "consent." --Dave. -- Dave Mandl dmandl(a)panix.com http://wfmu.org/~davem

3 2