December 2003 - cypherpunks-legacy

Report on Privacy Loss
by John Young 17 Dec '03

17 Dec '03

NYT has a front page special report today on the booming computer investigative industry which is using legal and illegal means to mine and peddle personal, corporate and political data, dirt and damaging secrets. As one nabbed dick says, it's no longer ex-intel and ex-feebs who are doing it, now the techies and beagles of all sorts have rubbed their eyes at the amazing golddust on their screens. It might boost the demand for crypto and other essential tools for privacy, or it may just lead to more cyber-TLAs and -bounties willfully busting the wrong Jim Bells while warning their still-connected buddies of "court-okayed" wiretaps and traps. http://www.nytimes.com

1 0

Access to Plaintext: An Obvious Consequence
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: Somebody Date: Tue, 16 Sep 1997 10:12:47 -0400 (EDT) To: rah(a)shipwright.com Subject: Access to Plaintext: An Obvious Consequence Bob, If no encryption product can be sold that can't decrypt everything it encrypts, then no public key systems can come to market. That would effectively eliminate the entire range of encryption products of interest to you. Surely, this is clear? <Somebody's .sig> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

What version of PGP?
by bret＠bjohns.win.net 17 Dec '03

17 Dec '03

I got PGP 262 off MIT. The file was PGP262si.tar Is this the international version with week crypto? os is it the US version? Thanks....

2 1

Re: Defense against a class of programming bugs
by Rich Salz 17 Dec '03

17 Dec '03

>Unfortunately, strdup is not posix compliant. If you want to use >it and maintain portability, you'll have to write your own. Er, you're kidding, right? drand48 isn't in Posix either, for example. Someone who runs on Motif and Mac has strdup as the least of their worries. But just in case it's stopping anyone: char *strdup(const char *x) { char *p; return (p = malloc(strlen(x) + 1)) ? strcpy(p, x) : 0; } (Deliberately written too-cleverly. Lame compilers will need to cast to 0)

1 0

John Deutsch
by Rev. Ben 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Is coming to Yale tomorrow and I'm going to get the opportunity to have tea with him(and about 10 other folks). Is there anyone here that has anything that they want me to ask the man? Ben. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed with Bryce's Auto-PGP v1.0beta3 iQB1AwUBMGYm+r5ALmeTVXAJAQFeIQL9FmuCB93W4XANBdyQBOg224WW/sVetRI8 AZhM3HHjvNJ41YT7LCnRjLeRU1nUeBX1cI5MWBLNmKQXqR8+XmqboVU/k3jOxndy bNhH4rqb/zgH1cD65lo7IbTsVOJoHeDe =18Lm -----END PGP SIGNATURE-----

1 0

Re: Patents and trade secrets was: Encryption algorithms used in PrivaSoft
by David Van Wie 17 Dec '03

17 Dec '03

Perry E. Metzger at Sep 22, 95 01:19:37 am wrote: >David Van Wie writes: >> It just moves the prior art date from the date of invention to the date >> of filing the patent application. >What happens if the chronology goes like this ? > >(0) Alice invents a snaffleblort. >(1) Bob invents a snaffleblort. >(2) Bob files for a patent on a snaffleblort. > >From what you said, it would appear that Alice's prior art won't count when >it comes to considering the validity of Bob's patent claim. Is that correct ? Unless Alice made public statements about her invention, you are right. Something becomes prior art when it is made public. If she (like most patent lawyers will advise) kept her mouth shut about what she had invented until her patent application was filed, she would lose under first to file rules (assuming step three is that Alice files a patent application). A quick trip to the soapbox: First to files rules are good for big companies, and bad for small inventors. Big companies have many lawyers, and know exactly how each step of the process works. Small inventors usually don't know the process as well, usually have to scrape together the thousands of dollars necessary to pursue a patent, and then find a good lawyer that they can trust -- all while ensuring that they don't break one of the rules about how you must treat your invention before filing. Moral: First to invent rules, like "natural copyright," are good for the little guy because they base patent decisions on when the important things (i.e. invention and reduction to practice) happened, not administrative things (i.e. complex documents filed with dotted i's and crossed t's).

3 2

Re: John Deutsch
by Rich Salz 17 Dec '03

17 Dec '03

>Is there anyone here that has anything that they want me to ask the man? Why did he argue against MIT getting rid of Lincoln Labs?

1 0

real randomness for netscape - user clicking mouse
by Vincent Cate 17 Dec '03

17 Dec '03

Jeff Weinstein <jsw(a)neon.netscape.com> >If anyone has specific suggestions I would love to hear them so that we >can do a better job. Why not just do something similar to what PGP does? For netscape you could have a user make circling motions with the mouse and clicking at random times. For each click of the mouse you could get a few bits of randomness from the time, the X position, and the Y position. You could get random bits really fast this way. You only need to do this the first time a user uses encryption, or you might just go ahead and force all users to do this as part of starting up netscape the first time. On subsequent times you use your encryption algorithm to make your next seed. To be safe you could make up two seeds, encrypt each of them to mix them up a bit, and then XOR the results together. A random bit XORed with a non-random bit still produces a random bit. Actually there is probably a better way to just encrypt each input whole (padding to block size) and XORing as you go along - that way you would get whatever randomness was there to be had. Anyway, do something so you have as many or more bits of randomness in your seed as there are bits in your key or it will still be a weak link in your security chain. You could even get the randomness during regular mouse use. Unless the first thing a user did was try to use encryption I am sure you would have enough by the time he did use encryption (keep track). You must get the random bits from something that nobody else could watch. Network packets, process IDs, date, time, etc are not secure. On the other hand, an attacker would have to have broken the machine to get the mouse info used above, in which case netscape would have no security no matter what. -- Vince PS I want a free netscape server site license if you use this idea! :-)

5 5

Net KiddiePorn Hype on TV
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

Yet Another Alarmist TV Show About Child Molesters on the Net: During their coverage of an NFL game on Sunday, the Fox announcers plugged an upcoming episode (sometime this week) of _New York Undercover_. They used a depressing line like "Think the Net is a safe place to play ? Think again !" Apparently the show will portray a child molester luring kids via the Net, etc., etc. "In a story pulled straight from today's headlines !" Anyway, the mainstream media trashing of the Net continues. Check your local listings. -Futplex <futplex(a)pseudonym.com>

1 0

Re: macworld crypto articles
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

In article <4444rl$nrh(a)life.ai.mit.edu> Chen writes: > It's truly a deplorable state of affairs. For the next version, include PGP free with every version of Quicken, and have Quicken just "call" PGP. Of course, users can encrypt their files now with PGP. Is there an Intuit bboard where someone could post instructions? -- --- Concurrent VLSI Arch. Group 545 Technology Sq., Rm. 610 MIT AI Lab Cambridge, MA 02139 (617)-253-0972

3 2