December 2003 - cypherpunks-legacy

Re: Netscape speaks with a forked tongue:
by James A. Donald 17 Dec '03

17 Dec '03

At 03:11 AM 12/9/95 GMT, Dan Weinstein wrote: > You are quoting a reporter and attributing it to Jim Clark, do you > understand what is wrong with that? Jim Clark has had ample opportunity to clarify his statements. He has not clarified his statements and he has not disowned the reported version of his comments, despite repeated requests to do so. Once again I request him to do so. Once again I ask what he means, once again I complain that if that is not what he meant, he should now say something that is unambiguously different from what he was reported as saying. >It has been reported by those that attended the Clipper II meeting on >Monday(?) that the Netscape representative read an official statement >very much in opposition to GAK. I have not seen this statement, and I have asked for it: Once again I ask for it. In particular I ask that it be placed on their web if it says what they say that it says. > > Jim Clark's supposedly anti GAK statement was incomprehensible to me. > > Perhaps he needs a punchier ghostwriter: > Clark's statement was certainly something less than clearly in > opposition to GAK, but I think at worst he could be said to be resigned > to GAK, not a supporter of it. It was worse than that: he said nothing at all, the "clarification" statement was a cloudy fog. > > If Jim Clark wishes to persuade us that his heart is in the right > > place, he should put something like the following somewhere on the > > Netscape web pages: > > > > "Our customers do not want government access to > > their cryptographic keys. Mandatory government > > access to keys violates the rights of our > > customers. Therefore we will not foist > > government access to keys on those customers > > who have freedom to communicate securely. > > > > We will only build government access to keys > > into our products for those customers whose > > governments force them to provide such access. > > " > > > > If that really is Netscape's policy, then they should tell the world > > that that really is Netscape's policy, thus instantly relieving the > > fear, uncertainty, and doubt created by the unfortunate widespread > > misinterpretation of Jim Clark's original statements. > Jeff Weinstein has promised that when the representative from the > conference returns to Mountain View, they will publish his statement > on web. Still waiting. I am sure that by now Netscape knows what its policy is on government access to keys: I ask them to tell the world, and to tell the world in such a way that they cannot retract their words without some embarrassment. > Again, you seem fixated on making Clark's opinions equivelent to the > position of Netscape Communications Corp, this is not a reasonable > assumption. Clark is not a Netscape employee. Clark owns a controlling interest in Netscape and is chairman of the board. Netscape's policies are whatever he says they are, except in the highly unlikely event that he is opposed by both Jim Barksdale and Kleiner Perkins plus a substantial majority of the lesser shareholders. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Netscape announces position against GAK
by Jeff Weinstein 17 Dec '03

17 Dec '03

I've included below the official Netscape position against GAK. This page is now available on our web site at the URL below. I'm sorry that we were not able to get this out earlier in the week, but we ran into some delays due to travel schedules (people attending the NIST meeting), and some logistical problems due to large changes on our web site. There is a link to this document on our home page, http://home.netscape.com/, which gets accessed more than 1 million times per day. I would appreciate it if people who forwarded parts of the recent Netscape/GAK discussion to other forums would at least send them the URL for this page. --Jeff http://home.netscape.com/newsref/ref/encryption_export.html > NETSCAPE PRESENTS POLICY ON ENCRYPTION EXPORT TO KEY MEMBERS OF THE > ADMINISTRATION AND CONGRESS > > ---------------------------------------------------------------------- > > This week Netscape representatives attending a government presentation > of the administration's proposed Key Escrow Policy for Export detailed > the company's firm opposition to the proposed policy. Netscape is > opposed to this type of proposal for a number of reasons including its > failure to adequately address the issues of acceptability by foreign > governments and corporations, significant personal privacy concerns, > and the mandatory nature of tying the Exportable Key Size to the Key > Escrow Proposal. > > At present the proposed Key Escrow Policy for Export states that a > U.S. Government-approved key escrow process must be used by U.S. > software manufacturers if they wish to export commodity encryption > products of a key length up to 64 bits. Currently, Netscape can only > provide its non-U.S. customers with products containing a 40-bit key. > It has been Netscape's experience that non-U.S. customers demand > products as cryptographically strong as those that are available to > U.S. customers (i.e., at least 128-bit key length). Hence, the current > U.S. Government proposal is compelling software companies like > Netscape to manufacture two different versions of its products - an > inefficient and noncompetitive posture that does not meet the needs of > the foreign markets. > > Netscape believes that this division in the global marketplace is not > compatible with the nature, structure, and history of the Internet and > its users. In addition, the 64-bit key length size in the U.S. > Government proposal is inadequate for security purposes; recent > experience in the United States and other countries demonstrates that > a 64-bit key can be compromised. Therefore, Netscape believes that the > U.S. Government's proposal does not support the needs of industry. > > In particular: > > 1. The U.S. Government proposal imposes regulations that will not > scale up to the speed at which the information > technology/Internet software industry continues to develop. The > proposed process represents a regulatory burden that is not > consistent with the decentralized and agile nature of the > IT/Internet business. The proposal puts at risk significant > economic stability not just for U.S.-based IT firms but for the > U.S. economy as a whole as every sector's growth is fueled by the > increasing availability and innovative use of information > products and services. > > 2. The U.S. Government proposal would in effect result in the > mandatory use of these export-grade products within the United > States. The proposal includes a non-interoperability criteria > that would make it impossible for a non-escrowed software product > to talk to an escrowed software product. Thus, consumers inside > the United States would be forced to use a government-approved > key-escrow product if they value the ability to communicate with > others outside the United States. > > 3. Corporate and individual rights to privacy are placed in question > by the current U.S. Government escrow proposal and process. This > is so because of the mandatory nature of the proposal resulting > from the key escrow requirement itself and the oversight role > government proposes to play in the accreditation process and > business practices of an escrow agent. > > Netscape will continue to work with industry organizations, partners, > and customers who are in similar opposition to the government's > proposal to ensure that the current administration understands the > unacceptability of this plan. > > ---------------------------------------------------------------------- > > Find out more about Netscape at info(a)netscape.com, or call > 415/528-2555. > Copyright © 1995 Netscape Communications Corporation -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

2 1

Re: Netscape speaks with a forked tongue:
by Tim Cook 17 Dec '03

17 Dec '03

> he is speaking for Jim Clark. It is possible to not believe in > something ethically, yet see a financial advantage in supporting it. > Their is a distinction that must be made, though admitedly the line > does become fuzzy when a senior person makes a statement, this is > because he is often the one driving the policy. > I think you've made our point. <g> He has to make that distinction at the time he says it, or most of us will ASS-U-ME it's company policy as well. Especially when the statement deals so directly with the company's product. Tim Cook, Mindsource(tm) Librarian. "The World is a Database - Mindsource is the Search Engine." ______________________________________________________________ M I N D S O U R C E (TM) I N F O R M A T I O N N E T W O R K Send a blank Email to:mindsource@memo.net for full information Visit our W3 Site http://www.ultimate.org/mindsource/main.html D E S T I N E D FOR G L O B A L D I S T R I B U T I O N! Concept:"The Greatest Untapped Resource is Human Resource(TM)" Mindsource is a Reg. Trademark Copyright(c)1995 by Mindsource

1 0

Re: Netscape announces position against GAK
by tcmay＠got.net 17 Dec '03

17 Dec '03

Credit where credit is due. I for one am satisfied--and even pleased--with the Netscape position on GAK. It remains to be seen how steadfast Netscape, as the major player in the Web browser business, remains in the face of (likely) pressure from the government. It seems to me that we have have been quick to criticize Netscape--which is good, the quickness part--and thus we should be equally quick to praise them. To be sure, various of us might've written the Netscape position statement slightly differently, but this does not change the basic point: that Netscape has come out against the Administration's position on GAK. For this they deserve our praise. --Tim May (slightly drunk at 3 a.m. PST after a Robben Ford concert: highly recommended if you like the blues) Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

E-Mail Privacy (CP boo)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Forwarding Cyberia-L mail by: hayam(a)actcom.co.il (Avraham Hayam) on Sat, 9 Dec 6:16 AM ------------------- Greetings, The only way for E-Mail Privacy on the internet is - ENCRYPTION. You don"t have to be an Internet Expert to understand that data which is not encrypted is open for every one. On Oct. 20 1995 Andy Jonson-Laird <andy(a)jli.com> sent a most interesting data to the list concerning that the user has absulutly no control ever how the data is routed. A Mail that he sent to an address which is at the distance of 11 miles actualy did 1200 miles. It may be " The end of days vision" that privacy will be maintained without encryption. With the ongoing danger from the Cypherpunks, we must use very strong Algorithms. A French "algorithms cracker" recommended not long ago that the commercial sector have to use not less than 128 bytes based algorithms. I will appreciate to receive list members opinion. Avraham Hayam IT Systems Security Consultants - ITSSC P.O.Box 11233 Jerusalem, 91112 ISRAEL Tel: + 972 - 2 - 761 803; Fax: + 972 - 2 - 769 263 E-Mail: hayam(a)actcom.co.il

1 0

Congress vs. the Internet
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

NY Times, 9 Dec 1995, Op-Ed. Congress vs. the Internet The courts have upheld free speech. Why won't legislators? By Shari Steele (EFF staff counsel) San Francisco. While the courts continue to uphold the freedom of speech on the Internet, the First Amendment is under attack on Capitol Hill. On Wednesday, House members of a House-Senate conference committee said they would support a stringent new measure that would not only bar words and ideas on the worldwide computer network that one might hear on TV or read in this newspaper, but would make criminals out of anyone transmitting these materials electronically, including on-line servces. This measure goes against the spirit of three sensible court decisions on copyright law handed down in recent weeks, all involving the Church of Scientology. The first decision, issued by a Federal judge in California last month, held that Internet service providers, the gatekeepers to the information highway, cannot be held liable for copyright infringement when they have no knowledge of the content of their users' messages. This decision is important, because, like the telephone company, the system's providers merely offer a conduit for communications. If they can be held liable for the content of messages, they are more likely to monitor those messages and censor any that include language that might get them in trouble. Just as we don't want the phone company censoring our telephone calls, we should be very troubled by any copyright law interpretation that would assign liability to those who provide Internet service. The second and third decisions were issued last week by a Federal judge in northern Virginia. In those cases, the judge, Leonie M. Brinkema, admonished the Church of Scientology for using lawsuits to silence its on-line critics. After two of its former members posted electronic criticism of Church of Scientology writings, the church brought charges against them, their Internet service providers and The Washington Post for including two sentences from church documents in an article on the case. Judge Brinkema dismissed The Washington Post and two of its reporters from the suit and held the Church of Scientology and its affiliate responsible for the newspaper's legal fees. "Although the Religious Technology Center brought the complaint under traditional secular concepts of copyright and trade secret law, it has become clear that a much broader motivation prevailed -- the stifling of criticism and dissent of the religious practices of Scientology and the destruction of its opponents," the judge wrote. The judge called this motivation "reprehensible." While the results of these preliminary decisions are encouraging, they provide little solace to the larger threat of on-line censorship. Court decisions in the copyright realm, as these are, do not address the damage Congress is doing to the First Amendment h the name of protecting children from obscenity, which remains ill-defind. These early court victories are important, and the on-line world breathed a collective sigh of relief over the wise judgments. But not all battles can be won in court. If Congress presses forward with its attempt to criminalize constitutionally protected speech, I fear that the First Amendment will be left behind as more and more of what we say is in the form of on-line communications. -----

1 0

Re: Win NT proprietary pw encryption (Was: Re: Windows .PW
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Sat, 9 Dec 1995 03:15:51 -0500 (EST) you wrote: >I don't quite agree with the last part. It might be educational to do a spot >of cryptanalysis in an attempt to determine the nature of the proprietary >algorithm used. It wouldn't be "cracking" the password protection, but I >think the general effort to "out" proprietary crypto algorithms is productive, >particularly in the case of major software packages. > > >Anyone feel like putting together some sample plaintext/ciphertext pairs ? > Well, the problem with coming up with plaintext/ciphertext is that I've never been able to find out exactly where the the SAM database is physically stored. Using Registry Editor, it's visible but not accessible as part of the Registry. Microsoft's APIs won't give you access to the stored ciphertext, so some serious hacking is required here, I'm just not sure where to begin. I think a hacked version of the Registry APIs that allow you to read the ciphertext would be a good place to start, but again, I'm not sure where to begin writing such a thing. The second problem is that we're not sure exactly what gets hashed and in what order. Is it username0x00password0x00domainname0x00SID or something similar? Tough to tell and MSoft wants to rely on the "tamper-proofness" of NT rather than on algorithmic security. If anyone has more information on these issues, I'd love to know what's really going on there. Dan *************************************************************** #define private public dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ***************************************************************

1 0

MAG_got
by John Young 17 Dec '03

17 Dec '03

The NYPaper Sunday Mag 12-10-95 has a longish soft-hitter by Tim Weiner about the CIA's never-say-die Deutch-uncle's CPR-wheezing the wormy carcass. MAG_got

1 0

.PWL spin
by Joel McNamara 17 Dec '03

17 Dec '03

The Seattle Times has a rather large article this morning (12/9/95) about Microsoft's .PWL encryption weakness. Selected quotes are provided for your entertainment and enlightenment (give yourself one point for each piece of inaccurate/incomplete information or spin you can find). Security flaw in Windows 95 to be fixed Microsoft got word of the flaw from an Internet e-mail exchange last week that included a short computer program for "hacking," or decrypting, passwords contained in .pwl (password list) files. The company immediately began working on a fix. "We wanted to be proactive on this before it became a problem," said Rob Bennett, Windows 95 product manager. The company has received no customer complaints related to the issue and knows of no security breaches, Bennett said. "There are people out there who will stay up all night cranking out code to break any encryption," Bennett said. (This was followed by some good quotes from Frank Stevenson, who wrote the cracking code, on the seriousness of the weakness. I was a little surprised to see the reporter listed Frank's e-mail address in the article. Frank, if you're reading this, did you give Paul Andrews permission? To me, this seems like listing someone's telephone number and address in the body of an article.) Microsoft said it plans to strengthen the encryption, Bennett said. Password data will be stored randomly, making it harder to find on the computer, he added. Microsoft recommends that information-systems directors disable password storage until the fix is released. One system administrator said the problem would have a greater effect on less-secure environments, such as universities and other institutions, than on corporations.

1 0

Re: More FUD from First Virtual
by jim bell 17 Dec '03

17 Dec '03

At 09:58 AM 12/9/95 -0500, you wrote: > >The real open question about anonymous digital cash is whether people >will want it badly enough to bear that kind of risk. My guess is that a >few people will, and that a few (even fewer) small banks will accept the >risk, so there will indeed be a niche in anonymous cash. But I think >that for better or worse, most people and banks won't value anonymity so >highly as to incur a low-probability catastrophic risk, which I think is >inherent in anonymous cash. I find this hard (read: "impossible") to believe. The significance of the risk is, essentially, its magnitude multiplied by its probability. Assuming that its probability is reduced to an arbitrarily low value, SOMEBODY will be willing to accept the risk in exchange for a return. By way of comparison, most credit card companies charge 2-3% of the value of a transaction, which apparently the market has decided is a "reasonable" cost. The question is, why wouldn't it be possible to raise the reliability of the whole digital cash system simply to the point where somebody is willing to accept the risk for, say, 0.5% of the value of each transaction, which would be a good improvement over credit cards? The answer, I think, it that there would be no problem finding people to take that risk in exchange for the return, ESPECIALLY if they have some input into the design (level of security) of the system. They might insist on 2048-bit RSA keys, instead of 1024-bit, for example. >> Well, maybe I haven't been following those reasons, but I see little or no >> reason privacy should "inevitably carry a high surcharge." If the relevant >> encryptions had to be carried out with a pencil and a piece of paper, that >> claim would make sense, but remember, we've got MICROPROCESSORS on our side! > >The cost isn't the computation. The cost comes primarily from the >efforts (both practical and actuarial) that will be made by the >underwriters to minimize and amortize their risk. As Lloyds of London >has demonstrated, almost any risk can be undertaken at a high enough >premium.... However, the premium only needs to be high enough to cover the actual risk, plus perhaps a little profit on the deal. (Even if the premium was 10x the actual risk, or even 100x, I think it would end up costing well under 1% of each transaction.) Your arguments seem to only be qualitative, not quantitative. Maybe that's why the other guy calls them "FUD."

3 2