December 2003 - cypherpunks-legacy

Re: The problem of playing politics with our constitutional rights
by phelix＠vallnet.com 17 Dec '03

17 Dec '03

On 18 Sep 1997 22:49:04 -0500, fnorky(a)geocities.com (Douglas L. Peterson) wrote: > >On Mon, 15 Sep 1997 10:40:30 -0700, you wrote: > >>At 10:09 AM 9/15/97 -0700, sameer wrote: >>>> >>>> Writing the code is no longer enough. The code must be usable by the >>>> sheeple to work. How do we do that? >>> >>> Sell code. >>> >>Marketing. >> >>It's not enough to have a great product -- you must also have great >>marketing. In the case of memewar, you need to get people to want to use >>something, enough to change their habits, even slightly. The less they need >>to change, relative to the benefit they get, the better. >> >>PGP/Eudora is a wonderful example of this. All that is needed to use it is >>one extra step (after install) -- typing your passphrase to sign a message >>before it is sent. Otherwise, it works the same as it always has. As a side >>effect, you can right-click to encrypt any file you can see in Explorer. >>Simple, quick, and usable even by the brain-dead, once you've convinced >>them TO use it. (And I forgot to bring my key file to work, so my Eudora >>here is useless for those purposes. Bother.) > >Too bad I use Agent. PGP is not out for it. > There are some third party programs that make using PGP with Agent easy. I use PGPeep( http://kakadu.rz.uni-passau.de/~w4hoff01/pgpeep/ ). With it, all I have to do to decrypt a message or verify a signature is hit CTRL+ALT+Enter. It's not as good as having true integration, but at least I don't have to copy to the clipboard each time. -- Phelix

2 1

Re: ecash lottery (Was: ecash casino)
by James A. Donald 17 Dec '03

17 Dec '03

At 11:53 PM 11/30/95 +0100, Laurent Demailly wrote: >'small' questions about inet gambling > > + How do you complain that you didn't got your win without revealing > your ID ? > > + Alternatively, How do you prevent false complains or nasty > concurrent trying to trash gambling co reputation ? Gambler submits a value that contains a hash of his guess, plus random noise, plus some random numbers resembling random noise that if signed by the bank will become anonymous ecash (once deblinded). Lottery has to acknowledge payments by signing the hashed guess, After the drawing, if the lottery cheats, the winner can prove that the lottery cheated by anonymously revealing the values that when hashed yield the number signed by the lottery. If a disgruntled person makes such an allegation, then in order to prove they did not cheat the lottery must anonymously reveal the numbers signed by the bank. If the reveal this, this proves they are fine, and also pays the gambler, because he holds the deblinding factor which will turn those bank signed numbers into money. Thus not only can it be carried out anonymously, but disputes can be fought anonymously. > >regards >ps: it would be easier that the game is legal so ppl can play without >being hidden... In my current casino, most people do complain when >there is a problem, and I think that those who don't aren't because >its monopoly money or just they aren't paying much attention... > >dl >-- >Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|... Freedom >Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept > >jihad Ortega Qaddafi Legion of Doom South Africa KGB Uzi > > --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

sooner or later
by Wei Dai 17 Dec '03

17 Dec '03

Many of us believe that a crypto ban is inevitable. The only question for us is whether it'll happen sooner or later. Seen in this perspective, all that industry and civil liberties lobbies can do is delay the ban. But is this necessarily a good thing? Here are some reasons to believe that an ealier ban might be preferable to cypherpunks. 1. An earlier ban will do less damage to existing infrastructure. 2. A ban can not and will not stop crypto. It will force people to work around it, but ultimately it will not achieve its goal. We might as well start working around it sooner. 3. A ban will eventually be lifted, because of the impracticality of GAK, abuses, wide-spread security problems caused by added complexity or hackers stealing the master keys, ineffectiveness, sympathetic courts etc. The sooner it comes into effect, the sooner it goes away. 4. A ban will focus public attention on crypto, especially if it creates some of the problems mentioned above. This will accelerate deployment of crypto after the ban is lifted. In summary, the government is obligated to try and eventually fail to ban crypto. We might as well let them get it over with. I'm not suggesting that the professional lobbists stop their efforts (they shouldn't, if only for appearances sake), but it might be time for the rest of us to focus our attention on more important matters.

4 6

Re: Netscape gives in to key escrow
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- sameer wrote: >http://www.cnet.com/Central/News/govt.html > > Bad. Very Bad. And I was almost starting to like > Netscape. Yes, bad. Yes, almost. Like a psychotic, Netscape has been teasing people with annoyingly buggy "betas," seeming to be well-intentioned, innocently clumsy, forgivable for its enthusiasm. Now the mask drops and we see the feral beast. tcmay wrote: > Jim Clark is actively working for the enemies of liberty and > freedom. As usual, Tim states it concisely, even elegantly. > I wonder what discussions Jim Clark has been having with the > Feds? I can assure those who doubt this that Jim did not wake up one morning saying, "Gee, this security thing is just so-o-o-o big a nut to crack that we need to bump it upstairs to the Big Boys. Yeah! That's it! Uncle Sam will make the Internet safe for commerce! Boy, this is going to be a great day! Hey, Mom! Can I have a slice of your great apple pie for breakfast? B-r-r-r! It's brisk this morning! Mom, Where did you put my flag?" With Netscape's sudden and surprising rise to prominence, its executives have no doubt been getting a crash course on what it's like to live in the world of people who take power and money VERY seriously. They've no doubt been disabused of childish notions and shown the glint of steely knives in the recesses of three-piece suits. No doubt more than one stomach plummeted to the sub-basement as they learned that Wonderland is populated by dark and deadly predators who don't just meekly make room for a new player. Jim may not even be important enough to have been the one visited, but we can be sure someone was visited and explained some of the rules by which the full-contact professional game is played. What we are witnessing here is the loss of innocence, noticeable only because the time scale is so compressed by Netscape's explosive rise. It's not even so much their caving that disgusts -- it's the hypocrisy. It's the lack of balls to say, "Guess what? We got a most unusual visit by so-and-so who spoke unofficially for so-and-so, who wants us to know that we'll be toast if we push this issue of strong crypto." It's as if someone you know suddenly takes up living with the creepy-crawlies in dark, damp places under rocks. One day you lift a rock and discover them there with some surprise, but instead of emerging or explaining, they say, "I like it here! This is the proper way to live!" and pull the rock back into place. It's not natural. rjc wrote: > What's the point? Surely Clark must realize that even if > Netscape adds key escrow to SSL/Secure Courier, it is still > possible to tunnel and > The genie is out of the bottle. The Feds' approach to this kind of thing will be to make circumvention of escrow punishable by, say, a $10 million fine and 30 years in prison, with a teensy little provision that it doesn't matter how it comes to their attention. That way, you not only run the risk that they find out by virtue of you having become a target of authorized eavesdropping, you run the risk that a, um, mistaken or, er, collateral eavesdrop reveals that your communications are circumventing escrow. People in Montana and Nevada probably once thought the highway speed genie was out of the bottle, but all it took was fuel-shortage hype to enact a law effectively instituting a "national" speed limit, even though federal control of travel on roads outside federal reservations is wholly without constitutional authority. Most people have some contact with issues of cars, gasoline, speed, and fuel economy, yet there was barely a whimper. How likely is it that more than a few percent of the population will even grasp what is being done to them with key escrow and the PR flim-flam that will be used to spackle over the real issues? jsw wrote: > Please don't give up on us yet. I have. I'll reconsider when Jim reveals who inoculated him with GAK juice and when Netscape own up to how they caved and publicly disavow the position he advanced. > All press accounts I've read so far have lots of stuff > attributed to Jim, but very little of it is actual quotes. > There appears to be lots of paraphrasing and interpretation > being done on the part of the reporters. The impression that > I'm getting is that the press has blown a couple of small sound > bites way out of proportion. Not to be overly dramatic, but this sounds like a non-policy German expatriate might have sounded in the late 1930's, trying to quell alarm over reports of atrocities filtering out of the Reich. It may be well-intentioned, but it's out of the loop. > The infoworld article that covers the same speech only > devotes about 20% of the article to the key escrow topic, > and is similarly devoid of actual quotes. This is the "turd in the punchbowl" principle, Jeff. Suppose your Presidential candidate sounded fine in 95% of his coverage, and only in 5% is he reported to advocate raising human children on farms for organ harvest? How big a turd does there have to be in the punchbowl before you will consider the punch unfit to drink? "Well, hell! There's only the ONE, and it's not even as big as the ice cubes!" Right. > I have not spoken to Jim about this, Uh-huh... > and I did not hear the talk myself, Uh-huh... > so I'm mostly reading between the lines here. Uh-huh. > After I saw the story earlier today I started asking around > to see if the company had made any major policy shift in the > direction of GAK, and wasn't able to turn up anything. So we're supposed to operate on the same blind faith you display. Right. > My feelings about key escrow, which were echo'd by several > folks in management when I spoke to them today are... Jeff, what you're revealing is a bit of confusion with respect to who runs the company. With all due respect, and taking your statements at face value without reading subterfuge into them, I believe you're in the dark, and positioned to get a hard lesson in real world corporate politics. Do you like your job? Do you have a mortgage? If this doesn't go down the way you think it's going, will YOU tell all? > I don't want to go down in history as a facilitator of the > totalitarian state, and I don't think anyone else here does either. Dark periods of history are full of well-intentioned people who, in the crunch, opted to save their own skins and facilitated whatever they were told to facilitate. > ...and I hope everyone will judge us by what we do. You can be sure of that. Meanwhile, if you really have principles, start taking names. Names, dates, places, things. If you're right, you can throw it all away later. If we're right, you'll have an opportunity to shed light on the process sometime down the road. We Jurgar Din (that will have to suffice: I do not yet live in a free country) +"The battle, Sir, is not to the strong alone. It is to the+ +vigilant, the active, the brave. Besides, Sir, we have no + +election. If we were base enough to desire it, it is now + +too late to retire from the contest." -Patrick Henry 1775 + -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBML6LT0jw99YhtpnhAQF7IgIAhHkHuYNJ0ncTEw27ZLU4FUSYQoxNJdyy Ki08cJka/nAyD/D4iQyYB5Y3Jmppb5okFr+UxvdYmS+RZYFnNLfy8A== =mCuE -----END PGP SIGNATURE-----

1 0

Re: politics aren't all or nothing
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Mark Hedges wrote: > Does anyone know who is behind this crap that the Empire's pushing on the > committees? Louis Freeh is the only name I've heard. I've not heard > Tenet's name mentioned in any of this. It would be interesting to research > the other people involved, to try to find some dirt. Sameer and the Dark Allies: This alert brought to you by The Voters Telecommunications Watch, The Center for Democracy & Technology, the Electronic Frontier Foundation, Wired Magazine, and Americans for Tax Reform

1 0

Netscape 2.0b2 allows for invasion of privacy (fwd)
by Graeme Cross 17 Dec '03

17 Dec '03

Talking of Netscape - this posting prompted me to forward it given the security and privacy implications inherent in the problem. Cheers Graeme ------- Start of forwarded message ------- >From: Scott Weston <scott(a)tripleg.com.au> >Subject: Netscape 2.0b2 allows for invasion of privacy >Newsgroups: aus.net.announce,comp.privacy >Date: Fri, 01 Dec 1995 11:09:06 +1100 Hi 'Net Dwellers, First off - I've posted this before (however not to this group) and only got a response from the Netscape Corp. They were glad I found the problem and said that they would fix it, however I feel that people should know about it. Also I would like people to help me spread this document around, i.e. if you know of a newsgroup (or people) that would find this interesting then please re-postit. On with the problem... I've recently got hold of the latest netscape, and was (at first) very excited about the new "LiveScripts" that it supports. If people don't yet know - these "LiveScripts" allow you to put small programs into your web page that is then executed by the Netscape client. There is no DIRECT way for these programs to send information back to the owner of the web page, however I was able to do it in a not-so-direct way. The "LiveScript" that I wrote extracts ALL the history of the current netscape window. By history I mean ALL the pages that you have visited to get to my page, it then generates a string of these and forces the Netscape client to load a URL that is a CGI script with the QUERY_STRING set to the users History. The CGI script then adds this information to a log file. Now if this hasn't quite CLICKED yet lets do a little example. Johnny Mnemonic starts up his newly acquired version of Netscape2.0b2 to start his daily "surf" session. First he decides to check his CD-NOW purchase and uses the handy Auto-Login URL. Then he decides to go to Lycos and do a search. In his search he find my page, which he decides to visit. Suddenly he is transported, not to my main page but to one of my CGI scripts, which in turn happens to have ALL the URL's he just been to in it. This means that in my log will be: - the URL to use to get into CD-NOW as Johnny Mnemonic, including username and password. - The exact search params he used on Lycos (i.e. exactly what he searched for) - plus any other places he happened to visit. I do this in a way that the user will KNOW that it has happened and will _hopefully_ email Netscape and tell them they are NOT impressed. But it would be EASY for me to change the CGI script so that the user is unaware that it has actually happened, unless they closely examine their URL history (in fact they'll probably just think its a netscape bug). If you're skeptical about this then do the test yourself. Get netscape 2.0b2 and do some normal surfing, and then go to Lycos. Do a search for: scotts car boot sale which should return the URL - http://www.tripleg.com.au/staff/scott Click on the URL and sit back an watch. First my main page will show up but a little while later you should be transported to a CGI bin script that will show you your URL history. I have tested this with both the Linux 2.0b2, and Solaris 2.0b2 versions and both have done the same thing. I would be interested in knowing if it happens for ALL versions of Netscape2.0b2. The log file does log the User Agent (i.e. the name of the platform you are using) so by simply going to the page I will know that your version of Netscape is also open to this form of attack. Currently I can find no way to configure Netscape2.0b2 to NOT run LiveScripts - and at the very least this option should be quickly added to the next version of netscape to be released. But a far better solution (IMHO) would be for netscape to pop up a window before running the LiveScript and let you know what the LiveScript wants access to, e.g. if it only wants to print out the current time then that's OK, but if it wants to read my history list and then transport me to a CGI script and add me to a logfile then maybe I would say NO. I think I've said enough.... If you've got any further questions, or want some more information just email me : scott(a)tripleg.com.au -- Scott. Quote from a car accident insurance claim: "I told the police that I was not injured, but on removing my hat, I found that I had a skull fracture." ------- End of forwarded message -------

6 6

Re: Medical Records
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"adam(a)homeport.org" "Adam Shostack" 29-NOV-1995 14:05:58.31 It seems that they use signatures & hashes; nice work, a good advance for medical records storage, but I'd ask how keys are managed, and also what prevents me exploiting the 'hash-only' mode of sending in what I'm cliaming to be is an emergency. (Not that these invalidate the system; they're just interesting areas to work on.) ---------------------- Good questions. I would encourage anyone in San Fransisco to go by and talk to them (or, of course, if anyone can find the researcher's email address, that would be excellent). -Allen

1 0

Re: New Computer Security Act
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Declan McCullagh wrote: > At 11:44 -0700 9/18/97, Tim May wrote: > >I doubt Clinton will be at the Fort Meade HQ for a ceremony, as he's on his > >way to Stanford, where both of us will, amazingly enough, be tomorrow. Wish > >me luck! > Tim, just promise me if you're arrested, you'll call me (collect) from jail > and tell me the story. (After you call your lawyer, of course.) Better to call Declan first... Everything is tried in the press these days. The courts are merely an anachronism waiting to be declared dead when Court TV replaces the Department of Justice. (Rumor has it that Janet Reno will be 'turning the letters' as the defendants try to guess their sentence.) TruthMonger

1 0

digital receipts and cash
by David A Wagner 17 Dec '03

17 Dec '03

Digital cash protocols are starting to look like they could become very popular and useful. But under current proposals, there's one thing you don't get when you spend digital cash: a digital receipt. (Later, if the vendor reneges on the transaction, you'd have the digital receipt to prove that you paid & the vendor is cheating you.) This seems like it would be a really useful feature. Does anyone know if there are any *practical* protocols to do this? ObCypherpunks relevance: digital receipts seem (IMHO) important to the emergence of fair and robust reputation markets. Discuss. ObCrypto relevance: I've looked through _Applied Cryptography_, but the protocols listed there aren't practical -- they require something like 100 rounds of interaction! Can this be improved?

2 1

Re: key for Alice as promised (not)
by ahupp＠primenet.com 17 Dec '03

17 Dec '03

>On Tue, 28 Nov 1995, Adam Hupp wrote: > >> >Can you imagine?? I'm simply not willing to fool myself into thinking >> >that I ahve security by posting a key and using PGP. >> >> Unless you can post some proof that PGP is insecure, stop insisting it is. > >Hold on a minute. Alice is, here, 100% correct. > >If I use PGP to read messages and there's a videocamera trained on the >keyboard, and other people have access to the machine, PGP is not >secure. Similarly, if PGP is on a computer which other people may use >without my supervision, they can monitor keystrokes, etc. and PGP is not >secure. > >A chain is only as strong as its weakest link; Alice recognizes this, and >makes no claim that PGP itself is the weak link. The weak link is the >physical security of the system which Alice claims to use. > >Jon >------------------------------------------------------------------------------ >Jon Lasser <jlasser(a)rwd.goucher.edu> (410)494-3072 > Visit my home page at http://www.goucher.edu/~jlasser/ > You have a friend at the NSA: Big Brother is watching. Finger for PGP key. > > I guess I missed Alice's point, but I gave it more thought and Alice is still wrong: 1) If someone DID monitor Alice, that almost defanitly means the remailer chain was compromised. The weakest link here is the remailer chain, not Alice's computer's physical security.* If Alice's true address is not known, there cannot be any monitoring of his/her computer (unless it for some other reason than "Alice"). 2) This whole deal is about Alice signing his/her messages, not encrypting them. What Alice would be giving up if his/her computer were compromised would not be security, but identity. The most Alice could lose, IF the remailer chain were compromised and IF his/her computer's physical security were compromised is his/her's reputation by spoofing (loss of pseudo-anonaminity is a given if the attacker gets that far). Those are some really big Ifs. *BTW, the chain is NOT as strong as it's weakest link. If I send mail to a remailer, and it strips the headers like it's supposed to, but sends the mail to a compromised remailer (the weak link), I am just as secure as before. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQBtAzCNppQAAAEDALhWZl7IuGZ9zZT5bACo0b/1L0Nv0C72vKHIO3IHh+cwpHHa 2Ozb9aeO0UvXGwkkZIYgUm0EvmzKh7yb1GTLvBp5kXpR3I9w+Yj4LGlBDERpUWw6 x4ED49pwDnz1Hl5FBQAFEbQYYXNoIDxhaHVwcEBwcmltZW5ldC5jb20+ =PtJK -----END PGP PUBLIC KEY BLOCK-----

1 0