December 2003 - cypherpunks-legacy

the revolution of microcurrency
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

the topic of "microcurrency" has come up on this list before and is reappearing with considerations being given to small charges for Web pages. I've been thinking about this a bit and thought I'd share some interesting ideas. (YMMV!!) 1st, there was a really excellent article on microcurrency in the Economist I believe that was really touting it as a revolutionary change in the economy. I agree with this wholeheartedly. the possibility that people can - exchange extremely small amounts of cash without the cost of overhead - and virtually instaneously, - over large geographical distances, - potentially even seamlessly with regard to different currency exchanges, - and a large infrastructure exists to distribute intellectual property for free, - (possibly invisibly to governments) will all contribute to a REVOLUTIONARY effect on culture. my key idea on all of this is that the whole idea of copyright is going to melt when you introduce cash, not be strengthened. there are a lot of people out there who think that one has to try to put a lock and chain on web pages or whatever that one is "selling", and the horrible problem of the net is that anything can be copied. and these people are feverishly working on specious "solutions" to this "problem" right now. WRONG!! this is precisely the view from the old ideology that says, "you have to protect what you are selling from other people or you won't make any money". this theme will increasingly be discredited in the cyberspace world, which works inherently differently in a remarkable manner. I submit that things like the release of public domain standards and products like Java and Netscape for free are not merely blips at this moment but increasingly are going to be the marketing plan of the future. the idea is that you give away your product for FREE, and then people pay you if they like it. this new ideology will be relevant to products that are not "things" but in fact are more in the realm of intellectual property, i.e. writing, software, cyberspace web pages, etc. the beauty of this system is that NO LONGER is "unauthorized" distribution" the "enemy". it is your FRIEND, a key aspect of profit!! the company that doesn't think in terms of this new ideology will try to control the distribution of their product. they will set up draconian systems that try to restrict the flow of the product to "authorized users". (i.e. those who pay in advance). our entire society thinks within this paradigm, including the government, which is makes noises about ways to restrict copying on the internet by introduction of actual physical safeguards. NOPE!! a rather extraordinary new economy can replace this, that of voluntary payment. widespread distribution becomes your FRIEND. you DISDAIN things like copyright, because they prevent your "product" from reaching the eyes of potential customers. your goal is actually to distribute the product as far as possible, in a sort of pyramid-like scheme. you want your "customers" to distribute your product to their friends, so that those "friends" potentially become customers in an endless cycle. this approach works amazingly with writing. imagine that if John Markoff suddenly QUIT the NYT and just wrote articles on his own. and imagine that at the bottom, you see a message, "for more of the same, send .5c or more to markoff(a)liberated.com". I submit that in the future, Markoff will probably be able to make more money than he does at NYT, because he is eliminating the middleman. the newspaper company is primarily built as a *distribution* channel. suddenly he doesn't have to pay anything out of his own salary, so to speak, for distribution. distribution is *free*. he doesn't require anyone else to do it for him. he puts his article in an apropriate place on the net and it circulates like a VIRUS if it is well received. the more people that see the article, the more people that pay him money. in an information system, individual objects have no value. what has value is the FLOW of quality information. if Markoff continues to flow with that good information, people will continue to pay for it. they will perceive that "by paying him, the quality information flow from him to me continues or increases". this same idea works with software. you don't see software as an end product. you see it as something that is evolving over time. and whenever you send money to a company for software, in this new system the idea is that "I like this software, and I want to see it grow. here is my contribution to that". another interesting area is that of patents, and I see this dissolving in the same way. a patent is like trying to put a lock on an idea. but gradually people will realize, only ideas that are implemented have any value. you can't profit and lock an idea at the same time. *dissemination* of ideas is what leads to profit, not locking them up. hence there will be an economic incentive to an inventor to give away his ideas for free, at first. in the old system, where one thinks of an idea as a "thing", this sounds preposterous. but in a new culture where ideas are seen as things that need to be cultivated and grown to work, it will seem eminently sensible. the inventor is releasing his idea to the world, saying "I can expand on this idea, even turn it into a reality, if you send me money". other people can of course steal the idea, but there is no value in the idea itself: the value is in the development of it into evolved new states, or the intellectual expertise of the inventor. in short, microcurrency could have quite a liberating and revolutionary effect on economics as we know it. in the current system, people are not paid for tiny contributions to the whole. the contributions have to be "packaged up" into something like a magazine before individuals can get any profit. a new system may allow people to be compensated directly for things that are hard to quantify. how much was Markoff's last article worth in the NYT? that's impossible to figure out. but if you had a microcurrency, you can calculate exactly how much money people sent to Markoff for his last article. say, across the world, it totalled $843.16. such a sum is not inconceivable. and over time it would be enough for him to make a salary over the whole year on, perhaps!! I'm arguing that this is increasingly going to become VIABLE over the next few years with cyberspace and microcurrency. the beauty of this system is that this increased granularity filters down to individual pieces such as a single piece of writing, a single software program, single contributions by individual people that can be rewarded tangibly. that's all that currency is, in its most basic form: a system whereby members of a society say to each other, "please continue to do that for me, do more of it, and do it even better-- because I value it *this* much!!" there is a lot of ink in the press lately about the Netscape/Java assault on the Microsoft bastion. I think there is something more important conceptually going on at a lower level. Microsoft has never released a product for free to the world. they are still in the old paradigm, "you have to control something to prosper". they are at this minute coming out with a PROPRIETARY (read: "you have to lock something to profit from it") alternative to Java. Netscape understands the contrary philosophy BEAUTIFULLY. you write the software, and DISTRIBUTE IT FOR FREE. same with Java: you create OPEN STANDARDS. these companies don't fully understand what direction they are going in (notice how they are only committing to the idea of free software or standards "from the start", but not afterwards), but I think they are the precursors to a radically transformed economic system based on cyberspace microcurrency. the microcurrency situation can even be set up in a company. "whoever codes this computer problem will receive [x] dollars from the company". the whole economic system becomes a fluid, pulsing entity that filters down to the tiniest fraction of value and gives each individual a quantitative value on his contribution. companies talk about "incentive systems" today, but perhaps the entire economy will become an enormous incentive system in this way in the future!! in this system, ultimately, I think the whole concept that someone "buys a product" will dissolve into the idea that "one rewards intellectual productivity to bring more of the same". it's as fundamental and intuitive as the difference between atoms and bits.

1 0

CDT Policy Post No. 29 - Coalition Says New Crypto Policy Flawed
by editor＠cdt.org 17 Dec '03

17 Dec '03

Pardon the massive mailing (I have never posted a full Policy Post to this list before), but I thought a majority of you would find this interesting and relevant. Jonah (editor(a)cdt.org) ------------------------------------------------------------------------ ****** ******** ************* ******** ********* ************* ** ** ** *** POLICY POST ** ** ** *** ** ** ** *** November 9, 1995 ** ** ** *** Number 29 ******** ********* *** ****** ******** *** CENTER FOR DEMOCRACY AND TECHNOLOGY ------------------------------------------------------------------------ A briefing on public policy issues affecting civil liberties online ------------------------------------------------------------------------ CDT POLICY POST Number 29 November 9, 1995 CONTENTS: (1) Public Interest/Industry Coalition Says Administration Crypto Policy Flawed -- Pledges to Develop Alternative (2) Text of CDT-led coalition letter to Vice President Gore (3) How To Subscribe To The CDT Policy Post Distribution List (4) About CDT, Contacting Us This document may be re-distributed freely provided it remains in its entirety. Excerpts may be re-posted by permission (editor(a)cdt.org) ------------------------------------------------------------------------- (1) Public Interest/Industry Coalition Says Administration Crypto Policy Flawed -- Pledges to Develop Alternative A broad coalition of nearly forty public-interest organizations, trade associations, and representatives from the telecommunications and computer hardware and software industries sent the attached letter to Vice President Albert Gore on Wednesday, objecting to the Administration's recently announced cryptography policy. While the letter praised the administration for its efforts to develop a national cryptography policy, the signatories, which include groups such as EFF and companies such as America Online, Apple, AT&T, MCI, Lotus, Microsoft, and Tandem Computer (organized by CDT), expressed concern that the Administration's proposal is weighed heavily in favor of law enforcement and national security while neglecting the privacy and security needs of individuals and the marketplace. The letter states: "A secure, private, and trusted Global Information Infrastructure (GII) is essential to promote economic growth and meet the needs of the Information Age society. Competitive businesses need cryptography to protect proprietary information as it flows across increasingly vulnerable global networks. Individuals require privacy protection in order to build the confidence necessary to use the GII for personal and financial transactions... The undersigned groups recognize that the Administration's recently articulated cryptography initiative was a serious attempt to meet some of these challenges, but the proposed initiative is no substitute for a comprehensive national cryptography policy. To the extent that the current policy becomes a substitute for a more comprehensive policy, the initiative actually risks hindering the development of a secure and trusted GII." The coalition pledged to work together to formulate recommendations for an alternative cryptography policy based on the following principals: * ROBUST SECURITY: access to levels of encryption sufficient to address domestic and international security threats, especially as advances in computing power make currently deployed cryptography systems less secure. * INTERNATIONAL INTEROPERABILITY: the ability to securely interact worldwide. * VOLUNTARY USE: freedom for users to choose encryption solutions, developed in the marketplace, that meet their particular needs. * ACCEPTANCE BY THE MARKETPLACE: commercial viability and ability to meet the expressed needs of cryptography users. * CONSTITUTIONAL PRIVACY PROTECTIONS: safeguards to ensure basic Fourth Amendment privacy protection and regulation of searches, seizures, and interceptions. * RESPECT FOR THE LEGITIMATE NEEDS OF LAW ENFORCEMENT and national security, while recognizing the reality that determined criminals will have access to virtually unbreakable encryption. A second group, composed of conservative/libertarian organizations including Americans for Tax Reform and Citizens for A Sound Economy, issued a similar letter on Wednesday to House Speaker Newt Gingrich. The text of that letter, as well as additional information on the cryptography policy debate, can be found on CDT's Cryptography Issues Page: URL:http://www.cdt.org/crypto.html The letters come as the National Institute of Standards & Technology (NIST) this week announced revisions to the Administration's proposed export criteria announced last September (See CDT Policy Post No. 24). The revised proposal is substantively similar to the previous version, and maintains controversial provisions including: * LIMITS ON KEY LENGTH: The revised proposal would continue to only allow the export of cryptography systems with 64 bit key lengths, but only if the keys are escrowed by an agent approved by the U.S. Government and if the systems meet the other export criteria. * RESTRICTED INTEROPERABILITY: While the revised proposal does clarify the interoperability provision, it would continue to prohibit exportable products from operating with any other cryptographic products that do not meet the NIST criteria. * NO PRIVACY SAFEGUARDS: The proposal contains no mention of the procedures for law enforcement access to escrowed keys, the standards for certifying escrow agents, or the obligations on escrow agents to protect privacy. CDT believes that the NIST proposals fall far short of the promise for a more sensible and comprehensive cryptography policy outlined last July in Vice President Gore's letter to Rep. Maria Cantwell. The current proposal fails to provide adequate security, protect the privacy of individuals, and meet the needs of the global marketplace. CDT believes that a more comprehensive approach to cryptography policy is necessary to address both the immediate need for strong cryptographic applications and the long-term development of a secure and trusted Global Information Infrastructure. CDT will work with the signatories of the letter to over the next six months to develop an alternative to the Administration's proposal. ----------------------------------------------------------------------- (2) Text of CDT-led Coalition Letter to Vice President Gore November 8, 1995 The Honorable Albert Gore, Jr. Office of the Vice President Old Executive Office Building, Room 276 Washington, D.C. 20501 Dear Mr. Vice President: A secure, private, and trusted Global Information Infrastructure (GII) is essential to promote economic growth and meet the needs of the Information Age society. Competitive businesses need cryptography to protect proprietary information as it flows across increasingly vulnerable global networks. Individuals require privacy protection in order to build the confidence necessary to use the GII for personal and financial transactions. Promoting the development of the GII and meeting the needs of the Information Age will require strong, flexible, widely-available cryptography. The undersigned groups recognize that the Administration's recently articulated cryptography initiative was a serious attempt to meet some of these challenges, but the proposed initiative is no substitute for a comprehensive national cryptography policy. To the extent that the current policy becomes a substitute for a more comprehensive policy, the initiative actually risks hindering the development of a secure and trusted GII. A number of the undersigned organizations have already written to express concern about the latest Administration cryptography initiative. As some of us have noted, the Administration's proposed export criteria will not allow users to choose the encryption systems that best suit their security requirements. Government ceilings on key lengths will not provide an adequate level of security for many applications, particularly as advances in computing render current cryptography systems less secure. Competitive international users are steadily adopting stronger foreign encryption in their products and will be unlikely to embrace U.S. restrictions. As they stand, current export restrictions place U.S. hardware manufacturers, software developers, and computer users at a competitive disadvantage, seriously hinder international interoperability, and threaten the strategically important U.S. communications and computer hardware and software industries. Moreover, the Administration policy does not spell out any of the privacy safeguards essential to protect individual liberties and to build the necessary public trust in the GII. The current policy directive also does not address the need for immediate liberalization of current export restrictions. Such liberalization is vital to enable U.S. companies to export state-of-the-art software products during the potentially lengthy process of developing and adopting a comprehensive national cryptography policy. Without relief, industry and individuals alike are faced with an unworkable limit on the level of security available and remain hamstrung by restrictions that will not be viable in the domestic and international marketplace. Many members of the undersigned groups have been working actively with the Administration on a variety of particular applications, products, and programs promoting information security. All of us are united, however, by the concern that the current network and information services environment is not as secure as it should be, and that the current policy direction will delay the secure, private, and trusted environment that is sought. Despite the difficulties of balancing the competing interests involved, the undersigned companies, trade associations, and privacy organizations are commencing a process of collective fact-finding and policy deliberation, aimed at building consensus around a more comprehensive cryptography policy framework that meets the following criteria: * ROBUST SECURITY: access to levels of encryption sufficient to address domestic and international security threats, especially as advances in computing power make currently deployed cryptography systems less secure. * INTERNATIONAL INTEROPERABILITY: the ability to securely interact worldwide. * VOLUNTARY USE: freedom for users to choose encryption solutions, developed in the marketplace, that meet their particular needs. * ACCEPTANCE BY THE MARKETPLACE: commercial viability and ability to meet the expressed needs of cryptography users. * CONSTITUTIONAL PRIVACY PROTECTIONS: safeguards to ensure basic Fourth Amendment privacy protection and regulation of searches, seizures, and interceptions. * RESPECT FOR THE LEGITIMATE NEEDS OF LAW ENFORCEMENT and national security, while recognizing the reality that determined criminals will have access to virtually unbreakable encryption. In six months, we plan to present our initial report to the Administration, the Congress, and the public in the hopes that it will form the basis for a more comprehensive, long-term approach to cryptography on the GII. We look forward to working with the Administration on this matter. Sincerely, American Electronics Association America Online, Inc. Apple Computer, Inc. AT&T Business Software Alliance Center for Democracy & Technology Center for National Security Studies Commercial Internet eXchange Association CompuServe, Inc. Computer & Communications Industry Association Computing Technology Industry Association Crest Industries, Inc. Dun & Bradstreet Eastman Kodak Company Electronic Frontier Foundation Electronic Messaging Association EliaShim Microcomputers, Inc. Formation, Inc. Institute for Electrical and Electronic Engineers - United States Activities Information Industry Association Information Technology Industry Council Information Technology Association of America Lotus Development Corporation MCI Microsoft Corporation Novell, Inc. OKIDATA Corporation Oracle Corporation Securities Industry Association Software Industry Council Software Publishers Association Software Security, Inc. Summa Four, Inc. Sybase, Inc. Tandem Computers, Inc. Telecommunications Industry Association ViON Corporation --------------------------------------------------------------------------- (3) HOW TO SUBSCRIBE TO THE CDT POLICY POST LIST CDT Policy Posts, which is what you have just finished reading, are the regular news publication of the Center For Democracy and Technology. CDT Policy Posts are designed to keep you informed on developments in public policy issues affecting civil liberties online. SUBSCRIPTION INFORMAITON 1. SUBSCRIBING TO THE LIST To subscibe to the policy post distribution list, send mail to "Majordomo(a)cdt.org" with: subscribe policy-posts in the body of the message (leave the subject line blank) 2. UNSUBSCRIBING FROM THE LIST If you ever want to remove yourself from this mailing list, you can send mail to "Majordomo(a)cdt.org" with the following command in the body of your email message: unsubscribe policy-posts youremail(a)local.host (your name) (leave the subject line blank) You can also visit our subscription web page URL:http://www.cdt.org/join.html ----------------------------------------------------------------------- (4) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance constitutional civil liberties and democratic values in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1001 G Street NW * Suite 500 East * Washington, DC 20001 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post No. 29 11/9/95 -----------------------------------------------------------------------

1 0

Meteors [NOISE]
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My car window was taken out 5 years ago in Saint Petersburg, FL by a golf-ball sized meteorite during the Pleaides Meteor Shower. I still have the rock, and the glass cost me $100 (the insurance deductable). Happily, I wasn't in my car at the time, but I no longer think of meteor damage as a rare event. I've come to believe that Republicans could be right, for the wrong reason, about SDI. As a Libertarian, I find the problem of planetary meteor defense/avoidance troubling. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMKKpjG1lp8bpvW01AQFmyQQAkjJXRNhhJtIKEDmxy3tGjy0TiJXpJIw6 MxujSnWgT5N2x+DBEkuVOfJrkqIXDsoO2lqR6SbYOb8NvtB5HdqQkU0sKNwxWe5Y IN6LXKPbfQgfOVETFdRhtgRaYyyaGgdD9++U6wOwl6D5rsRnBcvPWXwzpAKmIC13 iAR0yPNCDNE= =f160 -----END PGP SIGNATURE----- Regards, Jim Ray "When I visit Congress, I feel like Tom Paine in the Court of King George." John Perry Barlow Visit my "Pretty Good Homepage" at http://shopmiami.com/prs/jimray/ ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 (key on page & servers) <liberty(a)gate.net> IANAL ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or http://www.netresponse.com/zldf _______________________________________________________________________

1 0

Cryptographic Random Numbers
by cme＠clark.net 17 Dec '03

17 Dec '03

I'm working on an appendix to the P1363 Public Key Standard draft covering sources for and handling of cryptographic random numbers. I've got a draft on which I'd appreciate comments. It's available as a web page: http://www.clark.net/pub/cme/CRN.html - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

NOISE: Bill Gates view of SW Bugs and new releases - some quotes
by Mark 17 Dec '03

17 Dec '03

Here is some signature fodder. >FOCUS - is a German magazine > > >FOCUS: Every new release of a software which has less bugs than the older > one is also more complex and has more features... >Gates: No, only if that is what'll sell! > >FOCUS: But... >Gates: Only if that is what'll sell! We've never done a piece of software > unless we thought it would sell. That's why everything we do in > software ... it's really amazing: We do it because we think that's > what customers want. That's why we do what we do. > >FOCUS: But on the other hand - you would say: Okay, folks, if you don't > like these new features, stay with the old version, and keep the bugs? >Gates: No! We have lots and lots of competitors. The new version - it's not > there to fix bugs. That's not the reason we come up with a new version. > >FOCUS: But there are bugs an any version which people would really like to > have fixed. >Gates: No! There are no significant bugs in our released software that any > significant number of users want fixed. > >FOCUS: Oh, my God. I always get mad at my computer if MS Word swallows the > page numbers of a document which I printed a couple of times with page > numbers. If I complain to anybody they say "Well, upgrade from > version 5.11 to 6.0". >Gates: No! If you really think there's a bug you should report a bug. Maybe > that you're not using it properly. Have you ever considered that? > >FOCUS: Yeah, I did... >Gates: It turns out Luddites don't know how to use software properly, so > you should look into that. - The reason we come up with new versions > is not to fix bugs. It's absolutely not. It's the stupidest reason to > buy a new version I ever heard. When we do a new version we put in lots > of new things that people are asking for. And so, in no sense, is > stability a reason to move to a new version. It's never a reason. > >FOCUS: How come I keep being told by computer vendors "Well, we know about > this bug, wait till the next version is there, it'll be fixed"? I hear > this all the time. How come? If you're telling me there are no > significant bugs in software and there is no reason to do a new version? >Gates: No. I'm saying: We don't do a new version to fix bugs. We don't. Not > enough people would buy it. You can take a hundred people using Microsoft > Word. Call them up and say "Would you buy a new version because of bugs?" > You won't get a single person to say they'd buy a new version because of > bugs. We'd never be able to sell a release on that basis. > >FOCUS: Probably you have other contacts to your software developers. But if > Mister Anybody, like me, calls up a store or a support line and says, > "Hey listen, there's a bug" ... 90 percent of the time I get the answer > "Oh, well, yeah, that's not too bad, wait to the next version and it'll > be fixed". That's how the system works. > >Gates: Guess how much we spend on phone calls every year. >FOCUS: Hm, a couple of million dollars? > >Gates: 500 million dollars a year. We take every one of these phone calls > and classify them. That's the input we use to do the next version. > So it's like the worlds biggest feedback loop. People call in - we > decide what to do on it. Do you want to know what percentage of those > phonecalls relates to bugs in the software? Less than one percent. > >FOCUS: So people call in to say "Hey listen, I would love to have this and > that feature"? >Gates: Actually, that's about five percent. Most of them call to get advice > on how to do a certain thing with the software. That's the primary thing. > We could have you sit and listen to these phone calls. There are millions > and millions of them. It really isn't statistically significant. Sit in > and listen to Win 95 calls, sit in and listen to Word calls, and wait, > just wait for weeks and weeks for someone to call in and say "Oh, I > found a bug in this thing". >... > >FOCUS: So where does this comon feeling of frustration come from that > unites all the PC users? Everybody experiences it every day that these > things simply don't work like they should. >Gates: Because it's cool. It's like, "Yeah, been there done that - oh, > yeah, I know that bug." - I can understand that phenomenon > sociologically, not technically.

1 0

Above The "Minimum"
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, The following excerpt is reposted by permission of editor(a)cdt.org (cdt = Center for Democracy and Technology). CDT POLICY POST Number 28 November 6, 1995 CONTENTS: (1) Senator Leahy Calls on FBI to Justify Surveillance Capacity Request (2) Text of Senator Leahy's Letter to FBI Director Freeh (3) Review of Digital Telephony Implementation to Date (4) How To Subscribe To The CDT Policy Post Distribution List (5) About CDT, Contacting Us This document may be re-distributed freely provided it remains in its entirety. Excerpts may be re-posted by permission (editor(a)cdt.org) [snip] (3) REVIEW OF DIGITAL TELEPHONY PROCESS TO DATE [snip] * DIRECT NEGOTIATIONS WITH TELECOMMUNICATIONS CARRIERS FOR SURVEILLANCE CAPACITY ABOVE THE NATIONAL MINIMUM? The FBI has proposed to undertake direct negotiations with telecommunications carriers for surveillance capacity beyond the proposed national minimum standard requested in the notice. When Congress passed CALEA last year, it created a public process to bring law enforcement's electronic surveillance ability under public scrutiny in order to balance the new authority to influence the design of telecommunications networks. The public accountability provisions of CALEA require the FBI to publish *all* surveillance capacity requests. Congress must take a critical look at this aspect of the FBI's proposal, and should not appropriate funds until the FBI agrees to disclose all capacity requests, as required by the law. [snip] To subscibe to the policy post distribution list, send mail to "Majordomo(a)cdt.org" with: subscribe policy-posts in the body of the message (leave the subject line blank) ---- Cordially, Jim

1 0

Win95 A Hacker's Net Dream
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

Windows 95 Is A Hacker's Dream Over The Internet Central, Hong Kong, Nov 9 (NB) -- Windows 95, combined with the Internet, could be a dream made in hacker heaven. From seasoned propeller heads Newsbytes has contacted, it looks like Windows 95 could be more of a security nightmare than was first thought. This is especially true where fixed link companies are concerned. An investigation of the new operating system, when hooked onto the Internet, leaves computers wide open. Executing a series of simple, uncomplicated commands opens up company and private users' computers to hacking the moment they access the Internet, claim some analysts. Worse, they may never know it has been done. Using a simple Unix command, a hacker can locate the IP (Internet protocol) address of the subscriber logged into an Internet service provider. Then he needs only one more thing; a logged-on Internet user using Microsoft's new operating system. For businesses with leased line Internet links, it can happen at any time, day or night. Once the IP address has been noted, the hacker simply creates a file through DOS on his own system, specifying the address and naming it. Using two other commands -- which purge the remote names on the IP, or Internet provider's port -- the system then refreshes and remaps itself in preparation to be accessed by the hacker's computer. Because Windows 95 is designed with a networking capability, it leaves all computers in the office open to illegal access. Once the hacker has called up his Map Network Drive, the hard disk on his own machine cannot be differentiated from that of the genuine user. All that need be done then is to put in a common drive name, most obviously "C:\." For networked machines, the default "C$" is common. This gives access to all files on the subscriber's drive. While Windows 95 allows the user to protect the drive by giving it a password, computer experts Newsbytes talked to said that device won't necessarily lock out intruders. Because the operating system has no "audit" trail -- in other words, it does not log who or how someone is accessing the drive -- a hacker can spend weeks trying to discover the password. Password search programs, like Cracker, are readily available and can break through most simple password sequences. -----

1 0

Diffie-Hellman in GF(2^n)?
by Wei Dai 17 Dec '03

17 Dec '03

Most Diffie-Hellman implementations currently use the multiplicative group of prime fields. However, the multiplicative group of finite fields of characteristic 2 (GF(2^n)) can also be used and should be easier to implement. Is there any reason why they should not be used? Does anyone know the asymptotic running time of the best algorithm for calculating discrete logarithms in GF(2^n)? Wei Dai

1 0

Re: INFO BLACKOUT _fwd_
by j.d.stumbles＠reading.ac.uk 17 Dec '03

17 Dec '03

I saw this on the NZ.general newsgroup and had to share it with the list. 'fraid it's just the reply - the original must've expired by the time I got there (and I couldn't be bothered to go looking for an archive to track it down in). Enjoy... >ab330(a)torfree.net (Bob Allisat) wrote: > > >>Powerful national security insiders have established effective control >>over the entrance gateways to the Internet. Disturbing signs are now >>emerging that the "information superhighway" has been targeted for >>systematic surveillance and political dossier-building on Americans' >>opinions. > > Oh, really? > >>SAIC is a $2 billion defense and FBI contractor with a board of >>directors that reads like a Who's Who of the intelligence community. >>Board members include Admiral Bobby Ray Inman, the former director of >>the National Security Agency (NSA) and deputy director of the CIA; Melvin >>Laird, defense secretary under Richard Nixon; Donald Hicks, former head >>of research and development for the Pentagon; Donald Kerr, former head >>of the Los Alamos National Laboratory; and General Maxwell Thurman >>(ret.), the commander of the U.S. invasion of Panama. > >>The corporation also has a legion of computer network specialists and >>an entire division of computer consultants. > > As does IBM, DEC, AT&T, MicroSoft, shal I go on? > >>SAIC currently holds contracts >>for re-engineering the Pentagon's information systems, automating the >>FBI's computerized fingerprint identification system, and building a >>national criminal history and information system. > > Nope, I believe that's DISA's job now (was DCA) > >>The Internet is a marvel of computer softward technology. It was designed >>to survive a nuclear attach on the United States--like the Post Office, >>it's literally smart enough to find a way to get the mail through even if >>most of the network is missing. > > Wow, TCP/IP is a marvel? this guy must hate Novell. > >>But control of the Internet domain name registration means the ability >>to remove troublesome--or outspoken--computer systems from the network. >>Potentially, this control also confers the power to insinuate "phantom" >>domains into the network--for surveillance purposes, for example,--or >>for real-time, automatic censorship. > So the government can wipe out all nameservers at once? This is >geting better.... > >>Furthermore, anecdotal evidence gathered by this author (Matthews) >>suggests that actual "truth control" is taking place on the net now. >>E-mail messages with controversial contents--including details of the >>SAIC takeover of domain names--have consistently disappeared as they >>travel across the network. News items concerning the Vincent Foster >>"suicide" investigation and allegations of NSA bank spying through >>compromised Inslaw softward are being quickly and automatically >>cancelled. And the cancellations are not by their authors. > > Must be a bad MX server somewhere. > >>With domain names under the control of secret government insiders, it >>is even theoretically possible that large parts of the Internet could >>be shut down and silenced at critical times. This could be accomplished >>by suddenly altering domain name registration or interposing compromised >>"domains" at critical points. These compromised systems could serve as >>"black holes" at critical times, stopping e-mail and important news >>from reaching the world -- or the rest of the country. > > Well that means well just have to use IP addresses, right? > >>Exercises in "turning the Internet off" have already taken place in >>Taiwan and Hong Kong. In Taiwan the 'net was successfully shut down. >>All network traffic--including news, opinions, and e-mail sent by computer >>users was successfully "bottled up" on the island and prevented from >>reaching the world. > > It sure is easy to cut an island off, but a continent or more? > >>In Hong Kong the Internet wasn't quite strangled, but the British auth- >>orities who control that colony managed to throttle free electronic speech >>with the rest of the world until everything was bottlenecked into a few >>little-known satellite links. > >>These are alarming precedents and sure signs that powerful, shadowy >>forces are preparing to chop at the very roots of America's new Liberty >>Tree. The secretive people on the board of directors of SAIC are intelli- >>gence professionals skilled at manufacturing events--and then >>manufacturing public opinion and consent by controlling the truth. Will >>Internet disinformation, censor-ship or "shutdowns" signal the next American >>crisis? > > So, you basically said that the government is willing to cripple >itself by shutting down the Internet and MILNET. This guy needs a >kick in the teeth or something to wake him up. Next thing you know is >that he'l claim to be abducted but CIA agents posing as Elvis >impersonators. And he'll start believing elis still lives. > > -Dale > John Stumbles j.d.stumbles(a)reading.ac.uk Computer Services, University of Reading http://www.rdg.ac.uk/~suqstmbl +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

1 0

Re: Timed-release crypto and information economics
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >From: "Beavis B. Thoopit" <beavis(a)bioanalytical.com> >Date: Thu, 9 Nov 1995 10:58:03 -0500 (EST) >I have not yet convinced myself that a time-release information device >is impossible.... > >Does there exist a storage device that, due to _dynamics_ (or other >factor), prevents the total contents being read in one instance? > >Bubble memory device? Torsion wire memory device? The only one I've been able to think of (from this thread on sci.crypt several years ago) was a message, e.g., PGP encrypted with two different public keys K1 and K2: E(K1, E(K2, E(K1, E(K2, ..., E(K1, X)...)))) with private key 1 here on Earth and private key 2 a reasonable distance away -- e.g., Mars. The time it takes to decrypt this *can* be lower-bounded, assuming the private keys remain secret. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)tis.com http://www.clark.net/pub/cme | |Trusted Information Systems, Inc. http://www.tis.com/ | |3060 Washington Road PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2| |Glenwood MD 21738 Tel:(301)854-6889 FAX:(301)854-5363 | +--------------------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMKNleVQXJENzYr45AQH9VQP/ddsthyo+HERj85a9vjAVVfQN/37wTZae oz0qlT3iQbdTWeYlTuCjWdpfknZBqrfb3JkiUI1wGuCc7d5UZc9rCm5aB0kRL83q IpSx5KQTaELQDULwaHcdPjbGIkCdvtpjQPHumm1lFy1XgM2zo+LbEoiyvlld6d+W pxSIppefmvA= =Bcs+ -----END PGP SIGNATURE-----

1 0