December 2003 - cypherpunks-legacy

Re: GAK/weak crypto rationale?
by Hal 17 Dec '03

17 Dec '03

Responding to msg by futplex(a)pseudonym.com (Futplex) on Wed, 13 Sep 2:11 AM >Your paraphrase of Nelson's statement strikes me as >remarkable. Doesn't "we are not concerned with bad >people using crypto among themselves" run completely >counter to all the hyperbole about terrorists planning >OKC II with PGP ? Does anyone have an exact quotation >? At any rate, sign me up as a "bad person".... I think this is setting up the rationale for software key escrow. One of the big loopholes in this idea has always been that it would be easy for bad guys to superencrypt or otherwise bypass the legal encryption. The response has been that the systems will be designed so that compliant systems will not interoperate with rogue systems. And the counter-response to that was that criminals (and privacy advocates) would use software which would operate compliantly with conventional programs and maintain privacy when talking to other rogue programs. This new line will be used to respond to this argument, I think. Even if it is admitted that there is no way for the government to be able to tell what the criminals say amongst themselves, it will still be useful to be able to tell what they say to other people. Therefore software key escrow will be argued to still be useful even though it can be defeated. Hal

1 0

FUZ_fat
by John Young 17 Dec '03

17 Dec '03

9-13-95. W$Japer: "Software May Dry Up Money Laundering." Can artificial intelligence be used to combat crime by ferreting out money laundering? Officials at law enforcement, defense and intelligence agencies like to think so. They have suggested creating a sophisticated computer program to screen records of the more than 700,000 electronic money transfers involving U.S. institutions each day and to flag suspicious ones for further investigation. By using AI, they hope to stop some of the $300 billion in profits from drug deals and other illegal activities that they estimate is laundered world-wide each year. But in a report issued yesterday, the congressional Office of Technology Assessment says any such plan would face considerable obstacles. [Cyberian Joel Reidenberg, an OTA advisor, is quoted.] FUZ_fat

1 0

Recent articles
by Rich Salz 17 Dec '03

17 Dec '03

Jon Bentley's column in this month's Unix Review talks about protecting data. As with all this columns, it's short but manages to touch on a large number of issues; in this case, using page faults to guess passwords, threat models, and so on. Upside, "The Business Magazine for the Technology Elite" (http://www.upside.com) has an interview with Jim Clark that took place two weeks before the IPO. He discusses in a couple of places how using crypto over the Internet is critical for businesses that can't afford private nets, and how this is an important part of their business plan. (Prof Froomkin: Upside also has an article on "ITEF infighting" you might want to read.) /r$

1 0

Re: Whitehouse "dissident" web site monitoring?
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > Sure. I'll respect their privacy as much as they, and the > organizations they oversee, respect mine. I'll use as the > respresentative organizations the IRS and the Social Security > Administration, which respects my pricvacy so much that they use > prison inmates to process paperwork. > > If I was in a nasty mood, I'd add the USPS. > > Sarcasm aside, they show no interest in other people's > privacy. Why should we go out of our way to do anything but show them > how bad the situation is? > > Adam Oh please! Some clerk browses the internet and you don't want to respect their privacy because of the IRS? This makes sense how? I suppose that you're going to dig up information about me and spread it around the internet because you have issues about the company I work for? Suppose someone did something bad to you and justified it by saying that harvard is an elitist school that once did something bad to their uncle. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

2 1

Software vs Money Laundering
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:48 AM 9/13/95 -0400, John Young wrote: > Can artificial intelligence be used to combat crime by > ferreting out money laundering? Officials at law > enforcement, defense and intelligence agencies like to > think so. They have suggested creating a sophisticated > computer program to screen records of the more than > 700,000 electronic money transfers involving U.S. > institutions each day and to flag suspicious ones for > further investigation. By using AI, they hope to stop > some of the $300 billion in profits from drug deals and > other illegal activities that they estimate is laundered > world-wide each year. But in a report issued yesterday, > the congressional Office of Technology Assessment says > any such plan would face considerable obstacles. > [Cyberian Joel Reidenberg, an OTA advisor, is quoted.] > Not the least of which is that money launderers can use "AI Software" to generate a stream of real and dummy money transfers that emulates "normal" money transfers. Not to mention the fact that monopoly money transfer networks that can be surveilled by the Feds (FEDWIRE and SWIFT) are not long for this world. They will be replaced by encrypted, open, net-based systems. DCF "Yes Virginia, one *can* have an encrypted, open system. In fact, that's the best way to have an open system."

2 1

Web Proxy Servers
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:26 PM 9/12/95 -0400, hallam(a)w3.org wrote: >If they ever want an anonymous proxy server they are wellcome to use ours. So where's a pointer to it? Others might be interested. Even willing to pay. DCF

1 0

An opportunity not to be missed
by David C. Lambert 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It has occurred to me with the approach of the presidential campaign in the US (and its attendant press frenzy), that there is an an unprecedentedly vast opportunity to bring certain items on the cypherpunk platform into the public spotlight. There are two planks of this platform that I believe: 1. would benefit from this exposure; 2. would be relatively easy to inoculate among the press and/or the candidates (actually, inoculation of the candidates, with subsequent propagation by the rabid campaign press). The first of these has to do with net.censorship, and formal recognition under law of ISPs' common carrier status. The second concerns remailers. I'll deal with each in turn. I believe that, given the hunger of the candidates for as much exposure as possible, that one of them might be persuaded to take a part in the Scientology fracas. (This would have to happen fairly soon, since it looks like the Church <spit> is losing some major battles lately - the brand new news from Denver re:FACTnet and the ruling in VA concerning Arnie Lerma and the Washington Post). The desirable features of such a candidate might include: a certain amount of current power, marginal current press exposure, fairly deep pocketed financing, an anti- regulatory stance, and a smidgeon of net awareness. It should be fairly straightforward to convince such a candidate that: 1. there would be tremendous increase in exposure due to the songs of praise from netizens (whose influence is most likely to be overly discounted by campaign strategists, IMHO, at this point in time), and from the mainstream press (especially Time magazine and the Washington Post, for obvious reasons). 2. that the exposure would be worth the peril of inviting the wrath of the Church <spit>. The payback of the press coverage of such a candidate would be infection of John Q. Public with the idea that ISPs are no more responsible for content of carried messages than the phone company, and an anti-censorship stance that does not make him (John Q.) pro-porn. This last is a huge flaw in the current battle for free speech on the net, IMO. (Thank you Marty Rimm.) If this issue could be refocused, I think that John Q. (and Jane) would find it much easier to support. The second plank that could be potentially advanced is anonymity. Anonymous remailers in particular, but the benefits of anonymity to users of the Net in general as well. I propose that we get some likely candidate (actually, a similar candidate to the one above) to advocate the benefits of anonymity on the net. The "spin" that would have to be used would depend on the particular candidate, but let's for example we have: Candidate Posturing Required Spin ----------------------------------------------------------------- Pro-business, tough on crime anonymous crime tip e-mail a la Fed whistleblower stuff, and the SPA Pro-choice, womens' vote anonymous support services Of course, there are many more examples, but we'd have to see which postures this campaign's candidates are going to pick. Of course, I am somewhat cynical in my advocation of the particular "Required Spins" (the SPA support, especially), but I feel that the threats to privacy and public use of strong encryption (which walks hand in hand with the use of the remailers, naturally) are worth the potential risk on other fronts (the burgeoning software patent silliness, eg). You may ask why these candidates would be interested in this type of thing, and my response is that they can be forced. The religious right has no problem bringing their agenda into the public spotlight and forcing their issues onto candidates because of their willingness to use hyperbole and fanaticism (not to mention pressure on advertisers and other sponsors). I believe that netizens in general, and cypherpunks in particular can bring similar, and more reasoned, pressure to bear. I think that our job is easier than the religious right because it should be trivial to enlist the support of the mainstream press on these issues, and to direct the anti-federal ire that has been building in the US. In addition, Democratic candidates that are currently in office would love to have some way of attacking the Republican plans for this session of Congress. An attack on net.censorship via the CDA and the telecomm bill could be seen as the ideal place to attack the Republican agenda, and thereby the success of Republican candidates in the presidential race. <whew.> Let the flames begin. - - David C. Lambert dcl(a)panix.com (finger for public key) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFcB+qpplsfgM88VAQFdewP9G0aHVTweUeCMa7J7Xhtu2R4cID6yP/J3 7WS5OicRWfl/hPRXj1Db74A9tDrkStEfobbL/2H6CsO9N4wZNgcDLQAa5MjX8ujf 0EF6v57nlcANb1qLJ5kmwfGj96PUMDtw00409tin3KssRAL0uz/lL9SWP/Mhj9q5 emZHYW3VC3c= =bTsO -----END PGP SIGNATURE-----

2 1

Dirty Pix Ad
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

Financial Times, Sept 13, 1995. Scientist urges action on Internet pornography By Clive Cookson Pornography accounts for about half of non-academic use of the Internet, the global computer network, the British Association science conference heard yesterday. Prof Harold Thimbleby, professor of computing research at Middlesex University, said most parents, politicians and educators had no idea how easy it was to find graphic descriptions of horrific perversions, through any personal computer linked to the net. "If you want to know about any perversion, you can find full details," Prof Thimbleby said, "and they are described in deceitful and evil ways." He was particularly upset by Internet porn sites that masquerade as victim support groups, such as those for child abuse that tell paedophiles how to entrap children. "I have found text, film and sound material that I find extremely disturbing, for example instructions for killing minors for sexual gratification." Prof Thimbleby has been researching the pattern of traffic on the Internet since the beginning of the year. It is impossible to monitor how more than a tiny fraction of the estimated 30m to 40m users utilise the net. But Prof Thimbleby analysed a representative sample of "bulletin boards" and of searches made via so-called "web crawlers" which act like telephone directories for the World Wide Web, the fastest growing part of the Internet. He said his conclusion - that pornography accounted for about 50 per cent of the searches - tallied with recent US findings about the dominance of porn on the net. "There is no reliable way, technical or otherwise, to detect or intercept pornography," Prof Thimbleby said. Censorship of the Internet was impossible, because pornographers could easily disguise their material. And censoring programs such as SurfWatch and Internet Filter could not cope with all the fast-changing pornographic material. Because censorship was technically and politically impractical, Prof Thimbleby suggested that a better response was to dilute the pornography with other material. "The Internet has very little interesting material for the non-specialist user. It needs more," he said. "When it has more, it is just possible that pornography will slip into its statistically appropriate place, one aspect of humanity but not the most prominent on the Internet." -----

1 0

Re: GAK/weak crypto rationale?
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Brain Davis writes: [...snip...] > Particularly effective were the court-approved video and audio > tapes of the Speaker taking a bribe in exchange for certain action > on legislation [...snip...] > Wiretaps, hidden microphones, and hidden cameras put corrupt > politicians (I know - redundant) out of business. Encryption does little to protect you from hidden cameras and microphones (or informants!). If you already know your target then you can probably get around encryption (sure it's not as simple as a wiretap, but hey, nobody said it had to be easy). Encryption prevents 'fishing expeditions' and unauthorized monitoring; this is what the LEAs don't want to admit. andrew

1 0

Can GAK be made "not interoperable" with PGP?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:34 PM 9/13/95, Hal wrote: >I think this is setting up the rationale for software key escrow. One of >the big loopholes in this idea has always been that it would be easy for >bad guys to superencrypt or otherwise bypass the legal encryption. The >response has been that the systems will be designed so that compliant >systems will not interoperate with rogue systems. And the counter-response ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >to that was that criminals (and privacy advocates) would use software >which would operate compliantly with conventional programs and maintain >privacy when talking to other rogue programs. But is this even possible, to make a GAK system "not interoperable" with, say, PGP? Unless the GAK system has some sort of entropy analyzer, and can recognize high-entropy sources which it presumes to be encrypted data (*), one can of course PGP-encrypt a text file and then GAK the resulting file. Many of us are already using PGP mostly in this way, i.e., writing files in text editors, PGP-encryting and getting an ASCII file back, and then sending. GAK will still have to deal with this mode. (* On the idea of entropy analyzers. This is implausible, for many reasons. Any high-entropy file could have the entropy reduced by padding with low-entropy sources. And there would be "false positives." Some ostensibly plaintext posts are so incoherent (;-}) they might be "rejected" by such a GAKalyzer.) So, is any conceivable GAK escrow system possible that cannot be used with other crypto programs? Text is text, unless the GAK program purports to accept or reject the text based on entropy considerations. And I can't imagine that part of the GAK program would be robust against hacking. >This new line will be used to respond to this argument, I think. Even if >it is admitted that there is no way for the government to be able to tell >what the criminals say amongst themselves, it will still be useful to be >able to tell what they say to other people. Therefore software key >escrow will be argued to still be useful even though it can be defeated. But such traffic analyis is made moot by remailers, as we all know. What I think we may be facing, if the folks pushing GAK are really serious about all this, are restrictions on *who we may mail to*!!! For if Alice is "allowed" to send a message, GAKked or not, to a remailer.... (I can speculate about laws saying only "internationally registered" sites can use e-mail, but this seems impractical in the extreme...lots of issues.) The GAK advocates need to realize that superencryption will be as easy as it is today to use PGP, and that even traffic analysis will be defeated if remailers are used. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0