December 2003 - cypherpunks-legacy

Re: Junk E-Mail - Part 2
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, People are complaining about junk mail now. Wait until they find out what real JUNK mail is... 11 21 95 Associated Press reports: To make electronic mail as universally available in the United States as telephones, the federal government and business would need to work together, the [RAND] report said. RAND is known for generating options, but... ...the study recommended using public funding.... The government --I mean, RAND-- isn't too happy about people owning their own computers: As a way to reach people who don't own computers, the study recommended that terminals be located in public places -- street corners, community centers, libraries, hotels -- just as pay phones are, so people can send and receive electronic messages. What if people find out that this "private study," as AP calls it, is really JUNK mail from Joint Underhanded 'Net Kill-off? Cordially, Jim NOTE. The NandO News website's URL: http://www.nando.net The newsstory's head- and datelines: Study: Every American should have mailbox in cyberspace WASHINGTON (Nov 21, 1995 - 11:01 EST) Its online filename: nation611_4.html

1 0

GOST for sale
by Mats Bergstrom 17 Dec '03

17 Dec '03

According to a short article in a Swedish newspaper (DN) with the title 'Spy Code of KGB can make computers safe', JETICO INC., located in Finland (Tammerfors), introduced a new crypto system on the world market last week. It's based on GOST, the Russian federal standard algorithm. This product, called BestCrypt, is implemented at least partly in hardware. Alledgedly it uses 'GOST 28147-89', whatever that stands for. GOST is probably very secure - a huge keyspace (256 bits) and KGB would not have left a trapdoor for NSA to take advantage of, would they? The newspaper article ends: 'The Finnish entrepreneurs asseverate that their Russian colleagues have never had anything to do with the KGB.' Mats

2 1

Re: Mandarins, Lifers, and Talents
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 21 Nov 1995, Lou Poppler wrote: > Mandarins were involved in the genesis, certainly, both of our little > college network, and of the military's arpanet. The mandarins provided > our subsidies, and some of them found ways to use the net in doing their > academic work. Very many of them ignored us. Or tried their uptmost best to ... until we came a knocking. > Among us paid computer staff, > the mandarins held occasional blue-sky meetings to plot the future and > standards for the future; the lifers went about their business of feeding > hollerith cards to the mainframes; and the talents immediately set about > exploring this orthogonal new quirk of their machine. All the edges were > rough in the beginning, and for a long time after the beginning. Gee, I thought, err ... uhhm, shoot, aren't we still at the beginning?? Not the very beginning, but the beginning. Wasn't all of the NII stuff simply a true mandarin plot^H^H^H^H scheme^H^H^H^H^H^H contingency to get enough money to continue "The Project" during some very lean budgetary years? Or am I behind in my reading again ... > Network > code arrived in huge inspired chunks from our eccentric talents. Other > talents, staff and user alike, would go out to play on the network and > find little suggestions for the eccentric talents responsible. All talents are by definition _irresponsible_. They have to be in order to take the risks, sometimes some very silly risks in hindsight. > I think the early networks were less than satisfying for the mandarins. A satisfied mandarin?? Hmmm. That'll take a couple of cycles to compute. ;-) > It required arcane mandarin accounting schemes to rationalize our > perpetual defecits, even in a 'funny money' accounting world. Well, they've saved my butt (I think) when someone hung up the phone on me. And for this, they've certainly got *some* of my allegiance. ;-) And they have my gratitude. > Policies and standards were strained by the sudden accessibility of > the foreign operations, under alien chains of command. The networks > were immediately untidy and required compromise from the user. > > The biggest contribution from the mandarins, and I mean this with > all gratitude, is that they chose, again and again, not to shut us down. Chin. chin. > ObCrypto: we were still getting the bugs out of rot13 back then. Ahh, before they broke the code on what a baker's dozen REALLY was all about. Way back in the days when one-half was still working on rot12. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Nicholas Negroponte interview in MEME
by banjo, lord of the sea monkeys 17 Dec '03

17 Dec '03

The latest issue of MEME has a pretty good interview with Nicholas Negroponte of the MIT Media Lab. Some privacy issues are discussed, the idea of intellectual property is touched on, as well as some other good stuff. I'm not sure if it's on the web, but I'll forward the interview to anyone who would like to have it. K. Ellis OBCrypto: How's it going, Perry? <grin> Kathleen M. Ellis http://zeus.towson.edu/~kelli/ kelli(a)zeus.towson.edu Diverse Sexual Orientation Collec. Towson State University DSOC(a)zeus.towson.edu "Your friends are really just enemies who don't have the guts to kill you" -J. Tenuta

1 0

crypto for porno users
by Carl Ellison 17 Dec '03

17 Dec '03

I hear occasional uproar from LE types about porno traffickers using strong crypto like PGP. [I've been known occasionally to say things for their shock value, but this time I'm quite serious.] ------------------------------ As a society wanting to limit the spread of porn, we should encourage those trafficking in porn to use strong crypto. 1. If two people are sending porn from one to another over the net, the net is so insecure that many people along the way could see it. The recipient field could be mistyped, as well. Either way, someone who doesn't want the porn could receive it and be offended. Strong crypto wrapping that porn protects the innocent accidental recipient from exposure to the porn. 2. If cops want to track down some pornographer (e.g., because he's dealing in child porn), the net and strong crypto provide two opportunities to the police: a) "no one on the net knows you're a dog" implies that police can pose as a fellow porn producer or consumer and get away with it more easily. b) strong crypto for communications between porn users encourages them to speak more freely. When one of the two is a police officer in disguise, that encourages the other (the suspect) to reveal more, making the investigation proceed more quickly. Knowing that the crypto is strong enough to keep government eavesdroppers out, the sender is given a false sense of security -- is distracted from thinking about the trustworthiness of the receiver while thinking about the security of the channel itself. 3. Encryption of porn would work against the kind of porn distribution found on the alt.binary.pictures.erotic... newsgroups. Encryption requires that recipients be identified. 4. Personal file encryption encourages individuals dealing with porn to encrypt and keep personal diaries which might contain evidence. Since PGP is subject to brute force passphrase attacks, this gives an attack which will open *some* of these diaries. Without the encryption, the suspect is less likely to keep the diary in the first place. This isn't a guaranteed opening into all such diaries. There is no such guarantee possible. Rather, this suggests that strong crypto has a chance to maximize the effective "take" by LE forces. These advantages are balanced against the possibility that there is some group of pornographers who communciate together, who are identified by the police, who would be wiretapped *and* who are not infiltrated -- and therefore whose conversations are unavailable to the police. The larger such a group, the less likely it will remain non-infiltrated, so these groups are probably very small. There might be some of these -- just as there might be a few pornographers who have diaries that are encrypted and unbreakable. However, strong crypto opens a number of opportunities for successful investigation -- and it's my guess that in the balance, strong crypto adds up as a net advantage to the police rather than a net drawback. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Encryption Politics (was Re: "Dear Newt" Letter...)
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Phill <hallam(a)w3.org> wrote: <snip + slight reformat> >If you make it a party issue you will not only lose but risk turning the >clock the other way. At the moment everyone knows that the export control >laws are not stopping people from getting PGP. It is not a good idea to >rub peoples noses in it. Why not? It gets the issue talked about when it otherwise wouldn't be. The cypherpunks are the Dr. Kevorkians of stupid US export laws. >It is easy to ignore export violations by turning a blind eye. It is >difficult to turn a blind eye when people are so anxious to announce what >is going on. Exactly. I plan to go to the Nandotimes article at URL http://www2.nando.net/newsroom/ntn/info/info429_4.html and see what it looks like with a few substitutions like "cars," "highways," and "doorlocks" for words like "encode" or "encrypt." Sarcasm is often the last refuge libertarians have in these humor-impaired times, but it keeps me sane. :) >Phil Z. is not having problems because he wrote PGP, he >is having problems because he made sure the FBI couldn't pretend they >did not know what was going on. Well, not exactly. I believe from what I've seen here before that it was Kelly Goen(sp?) who did this. Of course, I've advocated everyone taking legal responsibility for Kelly's actions as a kind of protest against creeping Naziism in "our" government (see my "An Old Idea" post, buried somewhere in the c-punk archives). >If you make encryption a party issue then one of those Grassley bills >will pass and the President in power may not veto it. Encryption _IS_ a party issue, and quite possibly an effective one if we used it correctly, for the *Libertarian* Party! The actions of both "major" parties would have been [IMO] bad PR if the media decided to do their jobs (I know, big "if"). There is, of course, institutional L. party resistance to putting the individual right to strong encryption on the "front burner" because our "generals," despite a consistent record of losing battles, insist on fighting the last war (that is, when we aren't busy fighting eachother). <sigh> JMR [Who takes this opportunity to remind SO FL cypherpunks of the party at 7:30PM on Wed. Nov. 29th.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMLMw9m1lp8bpvW01AQEYggP/R/2nI8TurElr/c1haz6XNzWhUjVxZXtG bQRs9FkHX54300G5tYW1BSe37eQ+5AT6LyjjljLdtx4nYKUSDRUHqYCs/qQkspOU jFxfTAV8TOwMaopL4odBfgDeBVBhXRcjtsYu2rQ6WFF759TCTVYpxjhr7B8JDnR8 LoTFhEBAdTk= =wBjX -----END PGP SIGNATURE----- Regards, Jim Ray -- http://www.shopmiami.com/prs/jimray "This year will go down in history, for the first time a civilized nation has full gun registration! Our streets will be safer, our police more efficient, and the world will follow our lead in the future." -- Adolf Hitler, 1935 ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 (key on page & servers) <liberty(a)gate.net> IANAL ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or http://www.netresponse.com/zldf _______________________________________________________________________

1 0

Are there enough FBI agents to handle Digital Telephony?????
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

Has anyone ever done the math on the FBI's new wire tapping proposals and determined whether they'll have enough agents to do all of the listening? Doesn't a court ordered wire tap require that people listen in and screen the recordings. Does this have to be in real time? I can't remember, but I think there is a fairly onerous evidentiary chain required to use this technology. For instance, if 1% of America is on the phone during the peak hours of the day, then that puts 2.5 million Americans on the phone or 1.25 million conversations. If the FBI wants access to 1% of that, that is still 12,500 simulataneous conversations. That would seem to imply 12,500 people to listen to the tapes, right? Would that take agents off the streets? 12,500 agents would cost $1.2 billion a year if they each cost about $100,000 in salary and benefits. But we need to account for vacations, shift work and testifying the trials of the drug lords who are sent to jail. Let's assume that you only need 1/10th the people to handle the two evening shifts. That gives you a cost of $1.4 billion before vacations. Adding 40% to cover vacation and weekends puts you close to $2 billion. Let's round up. So it would cost $2 billion just to use the information here. This leads me to believe that they're thinking of building automatic voice recognition equiptment in the future. What does anyone think of the numbers? -Peter Wayner

6 5

Re: Spam the Sign!
by Frank Stuart 17 Dec '03

17 Dec '03

[...] > Do you have a legal opinion to support this statement? Our lawyers >tell us that executives of netscape could go to jail if we make the >128bit version of netscape available from an "export controlled" >ftp or http server. We are working to clarify the situation with >the government or figure out an alternative distribution scheme that >will remove us from the grey area. No legal opinions here, but perhaps you give it to someone who you know is legally entitled to have it and give them permission to redistribute it. For example, MIT, RSA, and c2.org already distribute export-controlled software via FTP, so if they're willing, you could give copies to people there and publish MD5 checksums. > Getting the US version of netscape widely available is one of my >highest priorities, but I can't tell Barksdale that he should go to >jail over it. I'm constantly pushing from within the company to keep >things moving forward. It's appreciated as is your participation here. > In the mean time I appologize to the linux users who can't even >buy the 128 bit version. If something changes on this front I'll >be sure to let people know. | (Douglas) Hofstadter's Law: Frank Stuart | It always takes longer than you expect, even fstuart(a)vetmed.auburn.edu | when you take into account Hofstadter's Law.

2 1

towards a theory of reputation
by Wei Dai 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Many of the topics discussed on this list are economic in nature. Unfortunately cypherpunks haven't attracted the attention of professional economists who might be willing to apply their analytic tools to these issues. Reputation is one of these issues that is especially important. I'm not an economist, so I hope these ramblings do not discourage real economists from tackling reputation as a serious research project. The first step toward a theory of reputation is defining what reputation is. The definition should correspond closely enough to our common sense notion of reputation so that our intuitions about it are not completely useless. I think a good definition is this: Alice's reputation of Bob is her expectation of the results of future interactions with Bob. If these interactions are mainly economic in nature, then we can represent Alice's reputation of Bob by a graph with the horizontal axis labeled price and the vertical axis labeled expected utility. A point (x,y) on the graph means that Alice expects to get y utils in a business transaction where she pays Bob x dollars. Given this definition, it is natural to say the Bob's reputation is the set of all other people's reputations of Bob. A reputation system consists of a set of entities, each of whom has a reputation and a method by which he changes his reputation of others. I believe the most important question for a theory of reputation to answer is what is a good method (reputation algorithm) by which a person changes his reputation of others. A good reputation algorithm must serve his self-interest; it must not be (too) costly to evaluate; its results must be stable; a reputation system where most people use the algorithm must be stable (i.e., the reputation system must be an evolutionarily stable system). In a reputation based market, each entity's reputation has three values. First is the present value of expected future profits, given the reputation (let's call it the operating value). Note that the entity's reputation allows him to make positive economic profits, because it makes him a price-maker to some extent. Second is the profit he could make if he threw away his reputation by cheating all of his customers (throw-away value). Third is the expected cost of recreating an equivalent reputation if he threw away his current one (replacement cost). Now it is clear that if a reputation's throw-away value ever exceeds its operating value or replacement cost, its owner will, in self-interest, throw away his reputation by cheating his customers. In a stable reputation system, this should happen very infrequently. This property may be difficult to achieve, however, because only the reputation's owner knows what its values are, and they may fluctuate widely. For example the operating value may suddenly decrease when his competitor announces a major price cut, or the replacement cost may suddenly decrease when he succeeds subverting a respected reputation agency. One way to answer some of these questions may be to create a model of a reputation system with a simple reputation algorithm and a simplified market, and determine by analysis or simulation whether it has the desirable properties. I hope someone who has an economist friend can persuade him to do this. Wei Dai -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMLI9Ujl0sXKgdnV5AQECCQQAiHq+s3PfsEOJmk0ng9aETQwHVe5EvrA0 +0wimcO2IGf+Bix8J/bLtAlW2eEcXM90pMvBgv+Q4jTkvI5RvGyuMf5cvOgj6rTz wj9aCqoltjHm/l1dfoWWCn4VSIU8OAJ6wKN/HRANQ5B56TPOgEkS2EDSM2C3w4m9 BgwcG5rBeA8= =taTA -----END PGP SIGNATURE-----

4 6

Re: towards a theory of reputation
by James A. Donald 17 Dec '03

17 Dec '03

>On Mon, 20 Nov 1995, James A. Donald wrote: > >> Any attempt to discuss and analyze reputations using >> morally neutral language is bound to wind up as boring long >> winded meaningless complicated word salad. At 12:19 AM 11/22/95 -0800, Wei Dai wrote: >I don't understand what you mean by this. Can you give an example to how >to discuss reputation (i.e., the concept of reputation, not a particular >reputation) using morally non-neutral language? Under current circumstances, where we have a large oversupply of free government supplied retributive violence, the most important from of reputation is "credit rating", which indicates willingness to pay ones legitimate debts and perform contracts. Willingness to fulfill ones obligations is not at all the same thing as willingness to act in a way that improves other peoples utility. Fulfilling an obligation assumes normative criteria. Any attempt to describe credit worthiness in terms of its effect on the utility of creditors misses the point. Before the nineteenth century, when most governments were reluctant to provide adequate retributive violence, and were more concerned with collecting taxes than upholding law and order, the most important form of reputation was the reputation for being a "gentleman" which encompassed both willingness to pay ones just debts and "gentle" conduct, gentle conduct meaning that you were unlikely to kill or harm people without good reason, but did not require that you went around performing good works. Now if someone has a reputation for good workmanship, this might seem non normative, but such a reputation is a mixture of two components: "X has good quality products" which is not normative and is a fact rather than a reputation, because it does not involve a prediction of future behavior" and "X will fulfill the spirit and intention of a contract" which is a reputation, and is normative. For example although in principle X might have simultaneously have reputation for good workmanship and a reputation for not paying his debts and not delivering on contracts, such a combination would seem unusual and surprising. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0