December 2003 - cypherpunks-legacy

Re: DejaNews all over again--a URL for Usenet Searching
by Kevin S. Van Horn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- tcmay(a)got.net (Timothy C. May) wrote: > >Paul Robichaux pointed me to another searcher, http://www.excite.com/, >which _does_ index the alt groups. I'm sure more are coming, reaching >further and further back in time. A small point of information. I work for Architext, the company that provides the excite service. We only keep the last two weeks of USENET news around, and don't keep any archives going further back than that. USENET is just too damn huge for us to go to the trouble of keeping comprehensive archives around without good evidence of demand for it among our target audience. - ------------------------------------------------------------------------------ Kevin S. Van Horn | Uncle Sam needs YOU! vanhorn(a)atext.com | But not vice versa. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMKEY8ioZzwIn1bdtAQFFEgGA1e12AazfexoLEvlrQDWFGPqFOXafAgBZ NxKKd+nWATgsUQhwI7jQ0P8pTQ9XvI1k =7sgB -----END PGP SIGNATURE-----

1 0

Return of the Cyber-Censors
by John Young 17 Dec '03

17 Dec '03

The Washington Post, November 8, 1995. Return of the Cyber-Censors [Editorial] When the Senate passed its ill-advised "Exon amendment" to the telecommunications bill last spring, which would criminalize the transmission of obscene, pornographic or "indecent" material on the Internet, the measure got an overwhelming 84 votes, many of them from senators who didn't understand the implications of the move. Only a few weeks later, the House went even more overwhelmingly the other way, voting 420 to 4 for an amendment (co-sponsored by Reps. Ron Wyden and Christopher Cox) that would bar the Federal Communications Commission from regulating cyberspace and would instead make it legally easier for commercial Internet providers to use their own technical tools to regulate questionable material. The contrast was the result of a burst of public discussion in which more technologically astute members, including House Speaker Newt Gingrich, caught on to the disturbing fact that the kinds of far-reaching liability imposed by Sen. James Exon's formulation -- hastily adapted from an existing measure on telephone transmission -- would cripple practically any commercial Internet provider and effectively lame the new medium as a venue for moneymaking activity. Now these vastly different measures are in conference committee along with the rest of the telecommunications bill (in other areas of which, we remind readers once again, The Washington Post Co. has some interests). But the seeming clarity afforded by the House response to the Exon amendment and by Mr. Gingrich's appreciation of the need for untrammeled development of the new medium is nowhere to be seen. A letter from Christian Coalition head Ralph Reed, Phyllis Schlafly and other prominent spokesmen for the religious right is urging the conferees toward an Exon-style approach that's as destructive now as it ever was. The House bill also could end up including an amendment sponsored by Rep. Henry Hyde that adds some criminal liability to the transmission of obscene (but not "indecent") images via the new technologies. The argument against "criminalizing" the transmission of "indecent" images via the Internet remains stark and simple, and it goes not to the awfulness of child pornography or even to the ability of parents to control what their children do on the computer (a wide variety of off-the-shelf technological filters now exist that let parents do this themselves) but to the impossibility of regulation by the electronic middleman industries that are developing. Commercial providers such as America Online continue to pass along millions of messages a day, the interactive "newsgroups" unfold quickly and internationally, and the kind of central filtering envisioned by would-be regulators erases the very quality that makes the Internet a live and promising medium -- its inexpensive accessibility. If the Internet were like a telephone system, there would at least be the possibility of identifying a specific "sender" and "recipient." On the Internet it's "receivers" who do the selecting of what to look at and where. Giving those recipients the tools they need remains the way to go. The conferees should resist the urge to censor cyberspace.

1 0

Cybercensor in Singapore
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

NY Times, November 8, 1995, Editorial Cyberspace in Singapore. The Internet Threat to Official Censorship "The Internet is like fire," Mr. Yeo said. "If you don't learn how to control it, it will burn you." In Singapore, a little democracy can be a dangerous thing. Singapore. From his 37th-floor office overlooking Singapore Strait, George Yeo can survey the oil refineries and bustling dockyards that helped make Singapore the trade and financial center of Southeast Asia. But the view that interests the Minister of Information and the Arts these days is not the vista beyond his window. It is the image on the computer terminal at his desk. Mr. Yeo, like the rest of Singapore's top politicians, wants his country to be a leader in the manufacture and use of computer technology without relinquishing the Government's chokehold on the dissemination of information in Singapore. Singapore's effort to find a balance point will be closely watched by other Asian countries that mix capitalist economics with authoritarian politics. The difficulty was underlined last week. Even as Mr. Yeo worried about the perils of the Internet, the Government announced it was relocating 500 industrial enterprises to make room for the development of advanced electronics manufacturing plants. Contradictions like that abound in Singapore, a country that eludes simple classification. With its gleaming skyscrapers and shopping arcades, it can seem like Dallas transplanted to the South China Sea. Conversely, the dominance of one political party and the presence of a paternalistic Government can make it feel like a remnant of the Soviet bloc. Salman Rushdie's "Satanic Verses" and Cosmopolitan magazine are banned, yet the city's largest bookstore stocks a selection of contemporary literature and the works of Chee Soon Juan, Singapore's opposition leader. Singapore's gaudy prosperity challenges the American faith that individual liberty is essential for a vital marketplace. George Yeo is the personification of that challenge. Born in Singapore in 1954, educated at Cambridge University and Harvard Business School, he is disdainful of the cacophony and untidiness of American democracy. Like Lee Kuan Yew, the architect and ruler of modern Singapore, he believes the vulnerabilities of his ethnically divcrse city-state can be best handled by a strong government that encourages a sense of community and limits individual rights. But controlling semiconductors is not the same as controlling newspapers, television networks or political opponents. With the aggressive use of libel and slander statutes Singapore's leaders have intimidated the newspapers that publish here, including The International Herald Tribune. To control television broadcasting, the Government has banned household use of satellite dishes. Some political pluralism is permitted, but no one doubts the primacy of Mr. Lee's People's Action Party. Recognizing the risk of bottling up public demand for foreign television broadcasts, Singapore's leaders are wiring the country for cable television. That way viewers will receive many more channels, including MTV, while the Government will still be able to screen out programming it finds objectionable. It is the quintessential Singapore solution. Singapore's approach to controlling cyberspace is equally ingenious, but harder to enforce. Mr. Yeo, essentially, hopes to control the Internet by embracing it. He is encouraging use of the Internet by equipping schools with computers, and establishing systems that allow Singaporeans to link up with the computer network by dialing a local phone number. The catch is that the Government will be able to monitor use of the Internet that goes through local servers, and is already intervening to block material it considers pornographic. The Government has blunted an uncensored Internet forum on Singapore political life by assembling a group of users who make sure the Government's views are represented. Mr. Yeo concedes that more sophisticated and affluent users can outflank many of his defenses by dialing into the Internet through foreign phone systems. His purpose, he says, is to lay down markers for citizens, expecting that most will abide by them. "The Internet is like fire," he said. "If you don't learn how to control it, it will burn you." In Singapore, a little democracy can be a dangerous thing. Philip Taubman -----

1 0

Re: expiration dates on cryptography
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:21 PM 11/8/95, John Curtis wrote: >The discussion between Mr. May and Mr. Shields concerning >time-release cryptograhy raised an interesting question in my >mind. > >Given that trust is often of an ephemeral nature, it would be >quite useful to set time limits on secrets. Would it be possible >to cryptographically protect a secret such that it could not be >decrypted after a certain time? An interesting twist. There are two broad things to consider: 1. Cryptography, what can mathematically be done. 2. Economics and social systems, what "business ecologies" can do. Pure cryptography is about #1, with minimal consideration of #2. Much of what interests me involves #2. How this relates to your interesting question goes as follows. Even the "timed-release cryptography" is NOT a pure cryptographic system, as the idea of "temporal state" in crypto is iffy. That is, clocks can be jiggered. Even "sealed clocks" can be jiggered. But just as Haber and Stornetta's "digital timestamps" use time, such a thing is possible once _economic agents_ enter the picture. And once economic considerations are used. The "timed-release crypto" system depends for its security on the likelihood that N agents holding pieces of something--something they don't know the value of--will likely hold those pieces for as long as they are being paid. (If you want to discuss why this is likely, even in a world of mistrust and malice, we can discuss it.) "Self-destruct crypto" would work roughly the same way: -- N agents holding pieces of puzzle, contracted to destroy those pieces on such-and-such date. It is likely that some or even all of them would comply, if properly paid. Caveats: 1. Sure, they could make backups. Probably do. But just as archival files are shredded, a system for eliminating "expired" files would be possible. 2. Sure, they could cheat. Ditto for "timed-release crypto." (Time is symmetric for this problem.) 3. Again, the security of the system to a large extent depends on the N agents not knowing what the pieces are part of, nor knowing who the other holders are. They never know whether a given piece is part of an audit, a test, etc. 4. There is a slight asymmetry, despite what I said, in that one can "test" agents to see if they'll release their pieces as contractually obligated to, but one can never be sure that agents have actually destroyed their pieces. 5. Still, distributing a secret amongst, say, 30 agents and having them "agree" to destroy their pieces on January 20, 2002, seems pretty likely to result in the collective secret (n-out-of-m pieces) being recoverable after that date. Such a system would need more consideration of backup strategies, etc. (If everyone is carefully backing up and the backup tapes are somewhere, then quite clearly the secret would not be gone; hence the issue of backup strategies.) >I suspect that the laws of thermodynamics might prohibit this >in classical cryptography because as a message expired the >amount of entropy would decrease. Quantum cryptography >might work, but that will be science fiction for some time to >come. I'm always interested in the links between information theory, algorithmic complexity, and notions of entropy, but I am skeptical in the extreme that the "laws of thermodynamics" have anything to do with whether one can throw away bits. If I make a list on my computer, and then erase it, have I violated a "law of thermodynamics"? Of course not. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

Re: expiration dates on cryptography
by Bill Stewart 17 Dec '03

17 Dec '03

[ Hmmm, maybe I'd better get this message out quickly, before it expires... :-] At 07:21 AM 11/8/95 -0500, John Curtis <jbell(a)capecod.net> wrote: >The discussion between Mr. May and Mr. Shields concerning >time-release cryptography raised an interesting question in my >mind. > >Given that trust is often of an ephemeral nature, it would be >quite useful to set time limits on secrets. Would it be possible >to cryptographically protect a secret such that it could not be >decrypted after a certain time? Decryption is equivalent to knowing a secret plus doing some work. There are two ways to make information available/unavailable - by depending on calculations from known data, or by having people agree to publish/delete it. The former method is trustable, but doesn't have time built in to it - either you know stuff or you don't. The latter method is harder to trust - you can build contractual mechanisms to encourage people to keep their commitments, and use crypto methods like splitting shared secrets to limit the impact of some of them not keeping them - but it's basically not cryptographic. Getting people to keep information secret for a while and then publish is possible; that's within their control. Getting people to keep information public, and then delete all the copies they own is possible, but if the information is _public_, anybody in the world could have a copy - deleting it requires finding them all, and getting them all to agree to delete it. That's _much_ harder. You could build a system where an escrow agent keeps a piece of information private, but available upon request, and deletes it on a certain date. That lets you know that _if_ nobody's asked for the information by then, and the agent has done its job, that nobody else will be able to decrypt it. Again, you can secret-share among multiple agents to decrease the impact of defaults (either failure-to-delete or failure-to-deliver.) A related approach is for the agent to provide a service of decrypting data encrypted with the agent's public key, and agreeing only to decrypt data before or after some date specified in the message. Another technique you can use is to for the agent to keep the data until paid for delivery; the retrieval token includes a digital check with an expiration date. In this case, you're trusting the bank to not honor the check after its expiration date, and the escrow agent not to deliver the data without getting paid. For this service, you want checks rather than cash - if the check goes stale, the money is still in your account. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Re: PGP Comment feature weakens remailer security
by Patrick J. LoPresti 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- bill.stewart> So, for safety, either turn off PGP comments before bill.stewart> using it with remailers, or wipe out the comments by bill.stewart> hand before each layer of encryption (easy to do with bill.stewart> GUI-based systems like Private Idaho; I don't know if bill.stewart> premail lets you do this or not.) Incidentally, Mailcrypt's remailer support strips the comment field after each encryption, and has done so since version 3.2. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAwUBMKEmVHr7ES8bepftAQEPSgP9FJYeKUSZKyFN/VWIwLjKIaDVzPtzyqHR tbj1UqbDl1trrKCoV6uud5qfK/FQwqQylnv1YsYNIVPPav66ImUvgSaXUMvZJBvC 8vinQI66s3M1PBJ8VIaLuVtay826JDazGHEexHpDLwNVGLdJq0RrNLVr2H9oLA8g 5aE9MHVfAcM= =MdHQ -----END PGP SIGNATURE-----

1 0

RE: using pgp to make an otp
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- -----BEGIN PGP SIGNED MESSAGE----- From: John Curtis \ Internet: (jbell(a)capecod.net) To: amp \ Internet: (alan.pugh(a)internetmci.com) Subject: RE: using pgp to make an otp JC> I was confused and answered a question you didn't ask. I guess you JC> can use PGP to generate a set of pseudorandom numbers. I'm not sure JC> that this would be different from using the IDEA cypher (the JC> underlying PGP cypher) to generate random numbers. I am also not JC> convinced that this would be quicker or cheaper than any number of JC> other mechanisms. JC> If I really wanted a true one-time pad, I'm inclined to explore the JC> thermal noise of a zener diode. isn't the noise generated by such a diode more accurately described as chaotic rather than random? i would think that there might be potential problems with using chaos as a random number source. it might be somewhat less random than you may think as most chaotic system's 'noise' operates within definable parameters. (like a lorenz system). i _would_ think that it would act as a most excellent prng, but exactly how _truely_ random it actually would be i couldn't say. while it may not be _truely_ random, it would most likely be cryptographically secure though. i think generating _true_ randomness is pretty difficult without measuring something similar to radioactive decay. the system that i proposed setting up is, admittedly, a p-otp at best. i'm much more convinced of this than i was when i initially proposed it. the comments i've gotten on it were most enlightening. amp <0003701548(a)mcimail.com> (since 10/31/88) <alan.pugh(a)internetmci.com> PGP Key = 57957C9D PGP FP = FA 02 84 7D 82 57 78 E4 E2 1C 7B 88 62 A6 F9 F7 November 9, 1995 11:41 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMKIvRIdTfgZXlXydAQG0zAf/Y0qX8X6mFa932Egm0PdBZr4RCBHqPccx 5Nb5KZi1jQPRFnoAoEgU6Z6P+SLWCGhZisn1UxvlD2eX6HbbPB/B0mHReoWw/qp2 hI7rWCn+JtSwUvxeno88zFmZ/AreAukm8LNi/PdJp+5lunDgclrOWoR5BklglqT8 iE2nxd6dhbUEKUYXzsN6yEXDRl/tUDiriEVev2YhttTZuyUg9krMa32VtyxyUCeB UfhidSjgwkNkSO3QQaHVHUCby8NHQJPRdKR4ym8tDfFjNXxieUQKwxi8r/0ofo5g 1UxtBwJICd+/LxOZovtKGYDqHJc4vPRqdY7x4VbTff0FM4i4W0ZpUQ== =6ty1 -----END PGP SIGNATURE-----

1 0

DUF_ibf
by John Young 17 Dec '03

17 Dec '03

Pal has provided a gopher-FBI paper: "Computer Crime Categories: How Techno-criminals Operate." By David L. Carter, a professor in the School of Criminal Justice, Michigan State University Types of Computer Crimes Computer As the Target Computer As the Instrumentality of the Crime Computer Is Incidental to Other Crimes Crimes Associated With the Prevalence of Computers Perspective on Legal Issues Special Problems with Computer-Related Crime Intellectual Property Malfeasance by Computer International Issues Conclusion Criminals have adapted the advancements of computer technology to further their own illegal activities. Unfortunately, their actions have far out-paced the ability of police to respond effectively. DUF_ibf (21 kb in two parts)

1 0

Re: DejaNews all over again
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Wed, 8 Nov 1995, Perry E. Metzger wrote: > anonymous-remailer(a)shell.portal.com writes: > > I wish that Detweiler could (seriously) go back to wherever he came from. > > What a fascinating statement to make, considering that you are > probably Detweiler. Fascinating. First, I'm accused of being noted computer viral expert, Dr. Frederick B. Cohen, (simply because he agrees with my assessment of the critical algorithm flaw in Netscape Navigator) and now I'm accused of perhaps being at the other end of the spectrum. Of being Detweiler, simply because he can take my signature and identity by signing an email, as Alice de 'nonymous or simply accusing me of posting in his "style". I see that the character assassination sport continues, and I am now a targetted. Hunter become hunted. I wonder why?? And why, by of all people, Perry? Is it perhaps because, I speak the truth, and the truth makes people very, very nervous. Is it because the flaw which is in the Navigator product is woven into the code fabric, and can't be *fixed*. Afterall, Netscape (and AT&T) have had, over THREE WEEKS to work on this problem or to make some form of public comment, and have done nothing, but put some of their programmers -- unofficially ... speaking for myself ... not speaking for the Company -- programmers on this list Meanwhile people are having their PGP keyrings collected, their passwords monitorred, and all of the information -- even information which they have NOT posted to Usenet, information that is simply on their personal hard drives, or on a private corporate network that is behind a firewall -- collected by anyone who actualy understands *how* to use Netscape Navigator's standard features to do it. And so the question is: Why am I having my character asassinated while this threat continues?? And while the loss and damage continues. Why are Netscape and AT&T not mitigating the damage? Is it because what I say is simple common sense stripped of the veneer of "technical language" and jargon?? And can't be *commented* on or *fixed*. Is this the fear which any truth teller faces, not only on the Internet, but in any forum where they try to challenge Goliath. Maybe, that's one reason to post anonymously. To clear the record definitively, I am neither Detweiler nor Dr. Frederick B. Cohen, and I am not the issue. I am simply myself, and I will _reveal_ my identity to the international public once the timing is appropriate. If anyone wants to know who I am, they can contact the PR department of AT&T or Netscape and ask. (Their address can be requested from either postmaster(a)att.com or postmaster(a)netscape.com, respectively.) Both companies have an email address for me, and would _likely_ *cough* forward any email enquiries to me without any editing. That way, everything is done clearly and out in the open. Nothing hidden, and nothing private, and none of my comments will become "their sole property to be used in their sole discretion". Neither company can accuse me of attacking them with daggers in the dark of night, from behind a shield of anonymity, when I advocate public open disclosure and commentary. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

True Random (short c-source)
by Frank Andrew Stevenson 17 Dec '03

17 Dec '03

I have written a short random number generator which appears to produce reasonable random numbers even in DOS, at the heart of the code is the short function fGetRand, the amount of entropy derived from this function varies from >1 to >>6 depending on system load, I haven't made any effort to whiten it at all. I am not making any claims about its usefulness. I am only trying to demonstrate the ease at which good random number may be obtained. Any comments and analysis will be mostly welcome, the source is hereby placed in the public domain: I have used WATCOM10 to compile and test under DOS/WIN95, where clock is running at 18hz. I have also tested on IRIX with impressive results. --- START ---- #include <time.h> #include <stdio.h> int fGetRand (void); main (void) { long vCount; FILE *out; int byte; int tick; out=fopen("random.bin","wb"); if(out==NULL) { printf("cant write to file random.bin\n"); exit(1); } for(vCount=1;vCount<=512;vCount++) { tick=fGetRand()&0x01; byte=byte+byte+tick; if((vCount & 0x7)==0) fputc((char)byte,out); fputc((char)tick,out); } fclose(out); } int fGetRand (void) { int count; clock_t tick; tick=clock(); while(tick==clock()) count++; return (count); } ----- END ----- PGP encrypted mail preferred, finger for key. The above views are ONLY endorsed by BoggleMind Inc. (not to be confused with MindBoggle Ltd.)

3 2