December 2003 - cypherpunks-legacy

Web Exon A-rate
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

WS Journal, Sept. 8, 1995. Cleaning the Web: Companies to Seek Pornography Blocker Array of Technology Firms Will Join in Effort to Let Parents Screen the Internet By Jared Sandberg Some of the high-tech industry's biggest companies are banding together in a broad-based consortium to develop a way for Internet users to screen out pornography and other offensive material. The group, whose creation is expected to be announced on Monday, is believed to include International Business Machines Corp. and Microsoft Corp., telecommunications giants AT&T Corp. and MCI Communications Corp., on-line firms America Online Inc. and Netscape Communications Corp. Entertainment heavyweights Time Warner Inc. and Viacom Inc. also have been approached. People familiar with the plans said the consortium hopes to develop industrywide standards for obscenity-blocking technology as a way to forestall much-criticized proposals from federal regulators. It amounts to an effort to develop a voluntary Internet equivalent of the "v-chip" that has been proposed as a way for parents block sex-and-violence-laden TV programs. The venture will pursue a system that would allow Internet users -- such as teachers or parents -- to prevent pornography from being accessed by children. The group will be led by the World Wide Web Consortium at the Massachusettes Institute of Technology, executives said. The consortium, funded by roughly 80 companies, aids in the development of the Web, the multimedia portion of the Internet, by producing technical specifications and software. Various companies have worked on ways to shield children from indecent material. The new consortium will pursue an overarching method available to all Internet players -- software firms, access providers and on-line services. MIT will coordinate this "umbrella organization to prevent industry infighting," said one executive. "It's aimed at creating a standard that all the software companies can develop for." A separate project by Microsoft and Netscape, together with two smaller firms, SurfWatch Software Inc. and Progressive Networks Inc., will now be folded into the new consortium, another executive said. The effort follows such proposals as the antipornography provision of Sen. James Exon (D., Neb.), which won overwhelming support in the Senate and would slap prison terms on people who make "indecent" remarks on-line. Most of the proposals have been met with scorn from the Internet industry. Executives have said that legislators could cripple the commercial growth of the Internet before it emerges from infancy. ------

1 0

None
by Anonymous 17 Dec '03

17 Dec '03

http://www.csmonitor.com/todays_paper/graphical/today/us/us.5.html Plan for a New Appeals Court Catches Opponents Off Guard Robert Marquand, Staff writer of The Christian Science Monitor BOSTON -- For Alaska's two senators, the final straw came in December. Like many Republicans from the brawny Northwest, they had long been irked that their state was part of the huge Ninth Circuit Court of Appeals, which has 28 judges and extends from San Diego to Anchorage. It wasn't just that the circuit court's size made it inefficient, they said. It was those liberal judges in San Francisco and what Sen. Ted Stevens (R) of Alaska called the "domination of the court by California lawyers." .... "We cannot subject something as important as the structure of our courts to political gamesmanship," Hyde says. His bipartisan commission, agreed to after a hard battle in the spring, would make the first major review of all federal circuits in many years. "The process must be fair." The Ninth Circuit has long typified liberal activism, yet that image may be somewhat distorted. A new study by Dr. Hellman shows that in the past year, the majority of the judges in cases reversed by the Supreme Court were not from California, but from states considered to be more conservative. Hmm... Judge Patel wouldn't of issued a stay of Bernstein to have placated a Senator or two would she?

1 0

Re: Libertarian Party and Crypto Anarchy
by dsc＠swcp.com 17 Dec '03

17 Dec '03

Timothy May wrote, >And David Friedman (author >of "The Machinery of Freedom," and son of Milton) gave a talk recently in >L.A. entitled "Crypto Anarchy and the State." Is text available for that talk? Dar =========================================================== Dar Scott Home phone: +1 505 299 9497 Dar Scott Consulting Voice: +1 505 299 5790 8637 Horacio Place NE Email: darscott(a)aol.com Albuquerque, NM 87111 dsc(a)swcp.com Fax: +1 505 898 6525 http://www.swcp.com/~correspo/DSC/DarScott.html ===========================================================

1 0

[NOISE/Fun] some 'special' primes
by Laurent Demailly 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I hope this is not extremely already know,... but, seeing on the list a sig with someone claiming to have the 'last' prime, I played a bit this nite and searched for the *first* alphabetically sorted prime (once written as spelled, sorted like with unix's sort) dependending on the language : Easiest: English : 11 : eleven A bit more fun : German : 811 (dunno how to write it, but it starts with an "a") Exotic one : slovenian: 10019 desettisocdevetnajst And..... the tricky one, which I hope is the good one (challenge: find one 'before') : French (and possibly spanish/italian,...too) : 105 105 000 105 167 (it spells cent cinq mille cent cinq milliards cent cinq mille cent soixante sept) [note that 'billion' is not used for numbers in common language, and that soixante-dix has a - and not a space :-) ] More languages ? better results anyone :-) ? Regards dl ps: I used gnu MP lib for my hack when I hit the 2^32 limit, but it's rather slow... (ok, its prolly due to my lasy prime algo too, but...) is there some well-known fast mp lib to play around with primes ? (should I look and extract PGP's ?) - -- Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|... Freedom 105 105 000 105 167 -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAgUBMFEKvXk52/beodHxAQH+cgQAwUzDczvIzXaBzYx/Q5oerXFZ/ABDjp8b Sz20qgBmB3BP9jE8GbibqIF1FOExS2r3irg4PQHhUwuX7wWT/deo8KzWMrb3C2fi X3kMbtWM9hQNHJ1mRpAE41M1NuHgk8xM43WbkZcLyYOPXXWSAAs0qc+bdNamtUDT iujkF9fQxck= =mkaz -----END PGP SIGNATURE-----

2 1

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Received this yesterday. Out of curiousity, anyone know where (810) area code is located? ------Begin Forwarded Message----------- Imagine yourself watching EVERY PREMIUM and basic CHANNEL on your own equipment just two short days from now! Whether your system is Jerrold (TM), General Instrument (TM), Scientific Atlanta (TM), Tocom (TM), Pioneer (TM), Zenith (TM), Hamlin (TM), or Oak (TM) we have the equipment for you. We are Tuxton Wholesale Electronics - America's best source for cable TV converters / descramblers and we stand behind what we sell: 30 day money back guarantee 6 month warranty Technical support hotline All units are: Completely automatic - just hook up and enjoy Completely undetectable - no one outside your home knows it's there Completely bullet proof - only you can shut it down Constructed of the latest micro circuitry - for years of dependability Prices start at just $189 *****SPECIAL INTERNET OFFER***** Call us today at 810-468-2891 M-F 10:00 am to 5:00 pm EST with the make and model number of your cable company's converter / descrambler and second day Federal Express SHIPPING IS FREE!!!!! That's right - in two days you'll have ALL THE CHANNELS and we'll pay the shipping charges! **ONLY THOSE NOTIFIED BY E-MAIL ARE ELIGIBLE **** Hurry, our SPECIAL Internet Promotion ends September 12th, 1997. When calling please provide us with your e-mail address to receive free shipping. Need extra income - everyone wants these boxes - ask about our dealer program (volume discounts). This is the only message that you will receive. Your name will be automatically removed from our database. Thank You. All brand names are registered trademarks of their respective owners and are used for reference only. Tuxton Wholesale Electronics claims no affiliation with any of these companies and uses the names for identification and illustration purposes only. Imagine yourself watching EVERY PREMIUM and basic CHANNEL on your own equipment just two short days from now! ---------End Forwarded Message--------------

4 3

Re: Web Exon A-rate
by dsc＠swcp.com 17 Dec '03

17 Dec '03

Somebody passed this along: >WS Journal, Sept. 8, 1995. > >Cleaning the Web: Companies to Seek Pornography Blocker > >Array of Technology Firms Will Join in Effort to Let >Parents Screen the Internet > >By Jared Sandberg [snip] This is a good idea. And maybe cryptography can get involved--see below. As a parent it is my responsibility to control what comes into the house and to determine what limited view of the net my kids see. The screening software to do this could be in my home or part of a service of my service provider. A few companies have some simple products for doing this. Most are discouraged by threats from congress to reduce the market need. Most products use a simple red list to block access according to literature sent me. Some look for key words. Normally, I would say that it is very premature for standards work. It would be good to see more ideas tried. The Exon threats probably do not allow this, so I see this news as a good thing. One place to start is the web. Depending on the kid's age and other factors I would want to have different limitations on what the kid sees. Older kids might just get warnings. I would like--for the little ones--to limit the view to some combination of sites listed on green lists. The view for slightly older kids might use red lists to exclude sites instead. (I really would want to create some logical combination of lists for each kid.) Organizations can compete for the list market. I might use these in what ever combination I like and also add my own. It is important to note that the kinds of things I would like to screen out or in might be different from what the next person would like to screen out or in. (I put little faith in content screening.) The problem might be in getting huge lists every week. And pages that seemed fine once could have changed. Current red list subscriptions are expensive--it is easier to keep kids off the computer. >>>>>> the part that mentions cryptography >>>>> As an alternative to green lists consumer organizations and do-gooder organizations might certify pages. These might be virtual green lists. Each web page would have the cert built in--perhaps in comments to allow most viewers to work. Instead of checking a list in this case, the screening software would ask the page to verify itself. If the cert was PGP based, then every home doing this would have to have PGP. The screening product could use PGP. Perhaps PGP would be slow. There might be some way to check signatures that is faster and does not have patent limitations. It would be nice if it was possible for the browser to see the first screenful without waiting for the screener to see the entire page. Only those that especially want to make their sites available to kids of picky parents would get the pages certified. Maybe just sending in e$3 would do it. Or e$50 to get to the head of the list. In whatever standards that come about, it is important that only those involved in the screening process pay the price ($, delays). Everybody else should be able to carry on. I do worry that some quick standards would be put into place and that innovation in this area would then become arrested. Dar =========================================================== Dar Scott Home phone: +1 505 299 9497 Dar Scott Consulting Voice: +1 505 299 5790 8637 Horacio Place NE Email: darscott(a)aol.com Albuquerque, NM 87111 dsc(a)swcp.com Fax: +1 505 898 6525 http://www.swcp.com/~correspo/DSC/DarScott.html ===========================================================

1 0

Re: GAK Hacks
by Hal 17 Dec '03

17 Dec '03

It is interesting to see that the proposed solutions to avoiding GAK hacks (URL:http://www.eskimo.com/~joelm/criteria.txt) largely revolve around certificate restrictions. Only keys signed with certificates from accepted escrow agencies can be used, and there is a "root certificate" used to authorize new escrow agencies. This is similar to some of the restrictions in the widely used Netscape web browser. It only accepts certificates from a limited number of agencies (actually only one which is public, the RSA spinoff VeriSign). This limitation is not based on escrow approval as in the GAK papers, but it ends up with something of the same results: interoperability with Netscape is only possible if you go through approved channels. And supposedly VeriSign does not make it too easy to get a certificate if you are not a straight-arrow corporate type. Maybe it would be good practice for a future GAK hack to try fixing these problems with Netscape. I could see two possibilities. One would be to create a patcher which would let you change the set of certificate authorities accepted by the browser. Currently the browser accepts at least one (an internal Netscape test CA) which is not needed by end users. Maybe its public key could be statically overwritten by the patch program with the public key of the replacement CA. This sounds simple and safe. The patch program can confirm that the data being changed matches the test CA. Another idea would be to patch the browser to emit full 128 bit SSL rather than the crippled 40 bit SSL it currently creates. This would be trickier as it requires code changes, but they may not be as bad as it seems. The 40 bit SSL is actually calculated as 128 bits internally. Then 88 bits are sent in the clear. We would need to skip sending those 88 bits, and also change the transmitted bytes which encode which encryption is being used. This shouldn't be too bad as it mostly would eliminate code or change some static values. The one thing I am unsure of is whether the 40 bit version sends the entire 128 bit SSL key in the RSA encrypted data (88 bits of which would be redundant, also being sent in the clear) or whether it sends only the 40 bits RSA encrypted. If the latter it would be somewhat more work to do the patch because now a larger value will have to be packed into the RSA record. If it is sending the 128 bits all the time then the patch would be much easier. This second patch is more advantageous for end users as it allows them to have strong encryption rather than the weak 40 bits which we have been breaking. The first would be a more direct demonstration of the difficulties of using certificate restrictions to limit functionality. The criteria.txt paper suggests checksumming the cryptographic routines to prevent patches like this, but generally I think such checksums can be defeated pretty easily. I doubt that Netscape currently has any such thing, though. Netscape says they will allow some form of user specification of certificates in a future version of the browser, but they have been saying this for quite some time and still it is not here. Hal

2 1

Open letter to Geoff Greiveldinger, DoJ
by Carl Ellison 17 Dec '03

17 Dec '03

I just posted the following. I'll have to wait to see if the moderator accepts it. Date: Sat, 9 Sep 1995 01:11:06 -0400 From: Carl Ellison <cme> To: risks(a)csl.sri.com Subject: Open letter to Geoff Greiveldinger, DoJ NIST (the National Institute of Standards and Technology) held a two day public meeting on September 6 and 7, 1995 to discuss Software Key Escrow as a possible means of achieving export of cryptography. In the morning of 9/7, Goeff Greiveldinger of the Department of Justice gave a description of the kinds of crimes which DoJ wants to use wiretapping to solve. He closed this litany of lawbreaking with the assertion that software manufacturers don't want to provide products which allow such lawbreakers to keep their criminal evidence hidden from law enforcement. I'm sorry to disillusion you, Geoff, but I *do* want to make such systems. Would you have Ryder stop renting trucks because some terrorist decided to fill one with explosives and kill many innocent children? Would you have Americans stop making automobiles because bank robbers have been known to use cars for getaways? Would you have all new buildings constructed with FBI microphones in every wall because some criminals meet in private rooms in order to plan crimes? When an American company sweeps its conference room for bugs, finds some and destroys them, it doesn't matter whether those bugs were planted by industrial spies or the FBI. The company has a right to eliminate them. When that company ties two such conference rooms together by video-conference equipment and encrypts the line between them using strong link encryption, it is performing the same defensive operation in cyberspace. It is protecting itself from spies and it doesn't matter that the wiretaps it frustrates might be illegal ones by industrial spies or legal ones by the FBI. The right to attempt to achieve privacy is a long-standing one in this country and not one to allow to be lost. When I design and build systems for privacy for my customers, I am providing products for law-abiding, honest people. I am aware of criminals, of course. Criminals are the threats against whom I protect my customers. These criminals are usually not in the government but that doesn't mean that I believe I should offer my honest customers up for a strip-search in cyberspace. The law enforcement agencies of this free country have no right to expect blanket access to the ciphertext of citizens. It will take legislation to get that right and I will do everything in my power to keep such legislation from passing. Barring such legislation, I will make sure that honest American citizens have cryptography with which to attempt to maintain their privacy, even from the government. We have the right to attempt to keep a secret from government agencies and continuous demonstration of that right is an important part of this free country. On the other hand, I am sympathetic to law enforcement officers. I have several friends in that business. I have asked my friends and acquaintances who do surveillance (2 IRS agents investigating organized crime for tax evasion; 2 undercover cops in Boston's highest drug neighborhood; 1 DEA agent in the midwest) if they ever encounter encrypted communications or files. They don't. Neither does anyone in their offices. Of course, even if they did it would remain so important to preserve our right to attempt to keep secrets from the government that their frustration would just have to be accepted. The fact that this isn't a real problem makes my decision that much easier. I am left with no moral qualms at all. In summary, criminals are so few that I will not design for them. I will not treat my vast majority of honest users as if they were criminals just because some criminal might someday use my product and frustrate you. ObRisk: We run the risk of losing our fundamental right to attempt to keep a secret from the government -- a practice we need to preserve in order to protect ourselves from criminals in cyberspace. There are powerful forces in the US government attempting to cajole us into giving up that right. [see http://www.clark.net/pub/cme/html/nist-ske.html for more on this subject]

1 0

Confirmation on Diana, please?
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Are there any Cypherpunks mailing list members who can confirm that there was a series of posts related to Princess Diana's death in the days before the event? I am particularly interested in information as to whether Cypherpunks were in any way responsible for a slight delay in the timing of her death. I am particularly interested in communicating with the person who sent me the anonymous messages between 8/24/97 and 8/30/97 using the nym "A'Tak A'Tdorn'. If you have information and an interest in sharing it, please send a post to the Cypherpunks list or the fight-censorship list, indicating such. If you wish for me to contact you through a neutral, third party, indicate that as well. Thank You

2 1

Scientology/Wollersheim as test case for key disclosure
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Andrew Loewenstern writes: > > Modemac writes: > > Mr. Wollersheim has stated that he will go to jail before he reveals > > his encryption key. > [...snip...] > > Call this one: BIG WIN FOR PGP! > > Could this be it? The test case for forced key disclosure? The > Scientologists seem very determined and already have a grudge against > Wollersheim (according to a web page I saw Co$ owes him several million from > a settlement). Has Co$ filed against Wollersheim over this yet? > > If this does go to court and forcing Wollersheim to reveal the key becomes a > central issue, is this the test case "we" want? Is this a "BIG WIN FOR PGP!" > or not? Well, since it's (apparently) a civil case against Wollersheim, the potential Fifth Amendment self-incrimination issues may be murkier, so this may not be a good test case for the criminal context. In federal civil trials, material reasonably likely to lead to the discovery of admissible evidence is discoverable unless there's an applicable privilege - this means that in a civil case, a defendant may be forced to hand over material likely to expose them to liabilty. (The Fifth Amendment privilege against criminal self-incrimination still applies). I'm not sure that key disclosure will even be necessary - the Church (or whatever annoying tentacle of it is suing Wollersheim) is entitled to, for example, "a copy of . . . all documents, data compilations, and tangible things in the possession, custody, or control of the party that are relevant to disputed facts alleged with particularity in the pleadings" (Fed. R. Civ. P. 26(a)(1)(B)). I don't see why Wollersheim couldn't comply with the discovery rules by providing plaintext copies of all relevant information, unless for some reason the passphrase is itself relevant. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFFFG33YhjZY3fMNAQGmLAP/S412cBRTRFRWou6mVjh7jbT9O3CIUPEB oFuDLNy7pQR2ZaR5JOzSsCv9d96CpGdVjIWUxhP/Fz6tN3ZP7LuCXBssoIuiyuEp z2e+LQthjcksUDqipR+QggIhN3hU66esg14WCF61yjwpXCukn13cOISYtBHRjc9g sEiN0SXZ4tw= =knU6 -----END PGP SIGNATURE-----

4 3