December 2003 - cypherpunks-legacy

Ames Criminal Complaint
by John Young 17 Dec '03

17 Dec '03

We've put the 39-page criminal complaint against Aldrich Ames and Rosario Ames, with arrest warrant and requests for search and seizure at: http://jya.com/ames.htm (93K) Which may be compared to those of Jim Bell, in order, as Bob Hettinga merrily portends, to ready us to ponder each our own upcoming toilet plunge. Too bad that Jim didn't get (or hasn't yet gotten) the kind of swell-solitary-cell Rick and Rosario briefly enjoyed for CIA toilet diving (a la Trainspotting).

1 0

Re: opinions on RSA Secure?
by Bill Stewart 17 Dec '03

17 Dec '03

>> The fact that the key is only 80 is *major* compromise. I would >> recommend that package to no-one. With only a 80 bit key you dont >> *need* trapdoors, granted they may be more "convenient" but the fact is >> the 80 key *can* [and certainly will] be broken... 80 is an interesting number. Clipper-sized :-) It's much less than 128, which seems to be popular for other software and works well with MD5-based random session key generators. It's also interestingly bigger than 64, which the Feds are trying to tell us is good enough for non-government work. Are RSA giving in to the Feds? Or are they trying to up the bid, at least allowing us something as good as Clipper if we can't get 128? Not my poker game. Let's look at some threat models. It's probably more than strong enough for any data you're willing to keep on a machine running MS-DOS, where serious attackers will go around it; it's about right for random "left your laptop in the airport" security, and for business use, if the police are going to confiscate your machine, they can probably subpoena the keys from somebody in your company anyway. Random hackers aren't going to be able to crack it, unlike 40-48 or maybe 56. It's big enough that the NSA probably can't break it right now, but in 10-20 years of computer speed growth they'll be able to if they want. It's probably fine for dealing with amounts less than $1-100M for maybe 10 years, and for misdemeanors and light felonies if you're not using the key escrow :-) And in 5 years, you'll be using a different operating system (even if it _is_ named "Windows"), so you'll need a new version, and you can re-encrypt your data when you move it to a decent-sized disk instead of that wimpy 9GB mechanical drive. Anybody who's got a 5-year-old dump of your system has probably stolen any secrets you care about long since anyway. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: A problem with anonymity
by Bill Stewart 17 Dec '03

17 Dec '03

Scott Brickner's example has fairly close analogies today. Corporations, cash, and assets with variable value are already useful. Alice is the dying parent who runs a business or has a good credit-rating. Bob is the irresponsible kid, Carol is the about-to-be unlucky creditor. Alice borrows lots of money from Carol, tells Bob that it's in the mattress / numbered Swiss Bank Account / collection of $$$$ artwork at home. Alice dies, and Bob absconds with the money (probate isn't needed for Swiss bank accounts or unrecorded stuff in mattresses) or sells the paintings to the highest bidder of Dave, Eve, and Freddie (with a bribe to all of them, and a kickback from Dave when he finally sells the painting for its real value.) (Or maybe it's not bribery and kickbacks, he's just a major shareholder in the Glorkspitz corporation, which is a major shareholder in their businesses.) Carol is stuck trying to get money out of The Alice Estate, which turns out to be surprisingly broke. If she lent the money to The Alice Company (which looks more creditworthy than Chronologically Challenged Widow Alice), Alice would have had to leave Bob the yellow-sticky with the store safe combination instead of leaving the cash in her mattress. Now, one reason we have probate courts is to try to stop this sort of fraud, making sure creditors get paid and heirs get their shares. Another reason, of course, is to make sure "Uncle" Sammy gets to inherit part of it, even though he's not a relative. (That's of course one of the reasons for having Swiss bank accounts you didn't remember to mention on your tax forms, fireproof mattresses, foreign corporations, and friends in the art dealer business :-) Does good anonymity make this easier? Sure. And if all the heirs are cooperative, they can conspire to rip off their parents' creditors, if they're dishonest, or at least to avoid taxes, if they're not tax-believers. Of course, if they're dishonest, they'll have plenty of opportunities without having anybody die, and that'll probably affect bankruptcy law and increase Federal self-justification for watching the money supply long before anonymous estate ripoffs become common. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: Canarypunk: Jim Bell in a coalmine
by Blanc 17 Dec '03

17 Dec '03

>From Robert Hettinga: >Well, if he's still in there, and Vince Cate is up for it, we can probably >give you a scholarship, which, for FC98, means we let you in the door free. [.....] Mostly it's to show that I, and maybe Vince, if >not the rest of the FC++ organization, realize that there, for the grace of >the net, go us, too, someday, if we don't do something to show that people >like Jim Bell, however loony or repugnant their ideas are to us personally, >are not alone. ........................................................................ I was kidding, but that's awful nice of you, even if I still must pay for the rest of it. Yes, I'll still go visit JimBob - I'll have to find out about his location, hours, etc. Again, if any of you in this area would like to make the trip or meet there, perhaps meeting later as well for dinner and scholaryly discussion on the perils of free speech and such, please let me know. .. Blanc .. Blanc

3 3

Re: Phil Zimmermann/Amnesty International?
by rudy (r.) rawlins 17 Dec '03

17 Dec '03

In message "Phil Zimmermann/Amnesty International?", rrothenb(a)ic.sunysb.edu writes: > > > > I was wondering if the Zimmermann case would be a proper concern of > > Amnesty International. [snip] > > > I've heard that A.I. does not discuss political persecution as much in > the countries that are doing it, since they do not want to offend the > powers-that-be in that country, though they will note a case in another > country. (In other words, if A.I. did note the PRZ case they'd only > discuss it outside the United States.) > > This is just speculation though... > You're right on the speculation; A.I. has no such policy. As a matter of fact, they will meet face to face with government officials to seek the release of 'prisoners of conscious' - which is a possible category for Phil Z. Though Phil, despite what we may think, is not a prisoner, yet..

1 0

Fuhrman needed a digital pseudonym!
by tcmay＠got.net 17 Dec '03

17 Dec '03

Before you folks jump on the "racist" Mark Fuhrman, think about the "surveillance state" issues. While it was not any government organization that taped Fuhrman's comments, there are some real issues involved in how deeply and how far back we want to "mine" comments made by people. Some real issues of privacy. The Mark Fuhrmans of the future may be interested in using technologies to protect their privacy, to give them "plausible deniability" should their recorded words come back to haunt them. Brief comments: * This post is primarily about the role of pseudonyms, not the OJ trial or the testimony/tapes involving Mark Fuhrman. * And the issue of "mining" of ancient records, especially as technology makes the recording of sounds, the taping of sights, and the archiving of electronic messages so much easier. * Those who think this is off-topic because it has nothing to do with coding in C are hereby invited to hit the "D" key, or whatever passes for it, right now. Caveat: I've watched entirely too much of the OJ trial on CNN, as I sit here at home and surf the Net every morning. It's easy to have the television on, and the OJ trial has had many interesting twists. When the stuff gets boring, I switch to music or perhaps to the financial network CNBC. So, I've see nearly everything being talked about here. Opinion on OJ: ***elided by Tim to head off debates about OJ's guilt or innoncence***. (I state this to show my prejudices, not to start an "OJ debate" on this list. Actually, I just elided (deleted) the opinion I had expressed, so as not to inflame anyone here.) What really bothers me, as it relates to the pro-privacy themes of this list, is the reaching back many years to comments made by a witness--Mark Fuhrman--to a screenplay writer. Because she kept audiotapes, going back 10 years, these comments may likely strongly influence the verdict in this "trial of the century." Anyone in favor of heading off the "surveillance society" should be alarmed at this development. As tape recorders and video cameras proliferate, comments may be compiled, taken out of context, and used as evidence. (Who amongst us has not said "nigger"? Does it count if I am asking why the rap group "Niggas with Attitude" chooses to label themselves as niggers? I figure that if blacks routinely call themselves niggers and call folks like me "honkies," then it's fair to call _them_ niggers. Not that I do this, but I don't see the term as so horrifying as to cause a killer like OJ to get off as this spectacle unfolds. Besides, it's become "permissable" for black leaders to refer to New York City as "Hymietown" in a way that would result in public stoning for a white to refer to a city as "Niggertown." The old double standard.) The point: Fuhrman should have used a pseudonym, should have taken steps to protect his identity. Of course, in 1985 this would have been harder. But have people given up the right to speak "for themselves" in private? If there is no solid evidence that Fuhrman actually committed any crimes, but only appeared to be puffing himself up, a la a Wambaugh wannabee, then why are his "racist" and "sexist" comments deemed so important as to have derailed the trial for the last couple of weeks? I have said an awful lot of inflammatory things at Cypherpunks meetings, at parties, in political discussions, and so forth. I don't claim that there should be a law against people bringing these issues up, or even a law against tape-recording various kinds of meetings. I just argue that we are devolving into a surveillanc To be sure, there are valid trial issues: -- Did he misspeak, misremember, or lie when he said he had "never" used the word "nigger" in the past 10 years? (I recall at the time, circa Feb-March, thinking to myself "Oh, sure!," when he said he had not used the word nigger in the past 10 years.) -- If this is perjury, how does it affect other evidence? (I'm not a lawyer, but I grok from the comments on CNN that this has to do with whether his testimony was supportive of other evidence, "cumulative," and related issues.) -- Does this possible misspeaking, misremembering, or lying have anything to do with whether he planted the bloody glove? -- etc. There are various valid issues. Spending a few weeks on these issues is another matter, though, IMHO. In my view, if I were the judge I'd have forced this issue to be resolved in hours, not weeks. Anyway, I am greatly disturbed by this "mining" of ancient comments, made to a screenwriter. Whether Fuhrman is a "racist" or not, this witch trial is a diversion from the real issues. And some real privacy issues are raised. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

TestTest
by Anonymous 17 Dec '03

17 Dec '03

Test

1 0

No Subject
by Pasquale Piombino 17 Dec '03

17 Dec '03

Hi all, I am searching PGP software. Does anyone know where I can download it? Thanks for answers. -+-+------------------->->--------------------------------:-Q------------ ° Pasquale Piombino | | Via Colombo, 35 Email: mr.xxx(a)ce.flashnet.it ° ° I-81100 CASERTA Phone - Fax: 0039 823 329152 | | ITALY ° +-+-------------8-)---------------------:-))-----------------:-o---------

1 0

Re: Some details on RSA Secure
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:48 AM 8/31/95 PST, "baldwin" <baldwin(a)RSA.COM (Robert W. Baldwin)> wrote: >Here are my biased comments on RSA Secure. They are biased by >the fact that I an a techie who works for RSA Data Security. >Neatest Features: >- It is integrated with the File Manager on Windows and the > Finder on Mac System 7. It's an interesting approach - simpler than installing as a file system (I'm not using SecDrv because it needs a separate partition), but so far it seems relatively useable. On the other hand, since there are file types it refuses to encrypt, like DLLs, there are some things it can't protect (like DLLs with passwords embedded in them.) >- A settable list of files can be automatically decrypted (or > encrypted) on system startup (or shutdown). I've got mixed feelings about this - since my password has normally timed out by the time I shut down, it demands a password before shutting down, and if I had any large amount of data there, I assume it would take a while to reencrypt on my 386-box. (Laptops are generally slower than similar-age desktops, and you often want to shut them down quickly, even when they aren't shutting themselves down to save power.) I haven't tried powering it off during this process, but I assume that at best the files would be unencrypted and at worst there'd be one half-decrypted and sitting in limbo to be trashed the next time the system starts up? >Technical Features: >- The user's passphrase unlocks a master key that is used to unlock > the file encryption key for each file. Since the documentation mentions 512-bit and 1024-bit RSA keys, I'd guess that each file has a separate random RC4 key which is stored in the file header, encrypted with the user and escrow RSA keys plus the MD5 hash, plus the encrypted real filename? (The alternative would be that the userpref.!!! file contains an RC4 key encrypted with RSA, which is used to encrypt the file keys, but that would lead to much shorter headers, and cracking that master RC4 key would then allow cracking of all documents on the system, so I'm guessing that's not the approach used.) >Request for Improvements: 1) The "Emergency" menu item in the File Manager is annoying. Could it be combined with the RSA menu item, eliminated, or at least have the option of abbreviating the name? 2) Can keys and files be shared between multiple machines, i.e. the same user keys on a desktop and laptop, so that individual encrypted files can easily be moved back and forth? #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: Canarypunk: Jim Bell in a coalmine
by John Young 17 Dec '03

17 Dec '03

>From the Privacy Act Online via GPO Access [wais.access.gpo.gov] [DOCID:tres_irs-99] DEPARTMENT OF TREASURY Treasury/IRS 60.001 System name: Assault and Threat Investigation Files, Inspection--Treasury/IRS. System location: Office of the Chief Inspector, National Office; Regional Inspectors' Offices; as well as offices of the District Directors. (See IRS appendix A for addresses.) Categories of individuals covered by the system: Individuals attempting to interfere with the administration of Internal Revenue laws through threats, assaults or forcible interference of any officer or employee while discharging the official duties of his position, or individuals classified as potentially dangerous taxpayers, based on verifiable evidence or information that fit the following criteria: (1) Taxpayers who physically assault an employee; (2) taxpayers who have on hand a deadly or dangerous weapon when meeting with an employee and it is apparent their purpose is to intimidate the employee; (3) taxpayers who make specific threats to do bodily harm to an employee; (4) taxpayers who use animals to threaten or intimidate an employee; (5) taxpayers who have committed the acts set forth in any of the above criteria (1) through (4), but whose acts have been directed against employees of other governmental agencies at Federal, state, county, or local levels; (6) taxpayers who are not classifiable as potentially dangerous through application of the above criteria (1) through (5), but who have demonstrated a clear propensity toward violence through acts of violent behavior to a serious and extreme degree within the five (5) year period immediately preceding the time of classification as potentially dangerous; and (7) persons who are active members in chapters of tax protest groups that advocate violence against IRS employees. ...

1 0