December 2003 - cypherpunks-legacy

Re: Junk E-Mail
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, People are complaining about junk mail. No problem... 11 21 95 The Electronic Telegraph reports: THE European Parliament will decide today whether to ban junk mail. Euro MPs are also considering whether to outlaw credit card transactions by phone and whether direct selling via E-mail should be curbed. Today's vote has been triggered by proposals from the European Commission to protect consumers buying goods without seeing them. Your complaints are highly valued at Minute Mortuary at 2d & Main, which advertises "Privacy Knows No Limits." Cordially, Jim NOTE. The Electronic Telegraph website's URL: http://www.telegraph.co.uk The newsstory's headline: Junk mail faces last post Its online filename: wjunk21.html

1 0

rand-test
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, The following information from CIAC Bulletin G-04: X Authentication Vulnerability November 20, 1995 22:00 GMT may be of use to you: If you cannot use DES, you can determine your expo- sure to remote attackers by testing the strength of your rand() function using the program rand-test; the source is available as ftp://ftp.x.org/pub/DOCS/rand-test/rand-test.c Cordially, Jim NOTE. To subscribe to CIAC Bulletin, email to ciac-listproc(a)llnl.gov the one-line message subscribe ciac-bulletin <your last name>, <your first name> <your phone number> for example: subscribe ciac-bulletin Adolphus, Gustavus 000-000-0000 x00

3 3

Re: Junk E-Mail - Part 2
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, People are complaining about junk mail now. Wait until they find out what real JUNK mail is... 11 21 95 Associated Press reports: To make electronic mail as universally available in the United States as telephones, the federal government and business would need to work together, the [RAND] report said. RAND is known for generating options, but... ...the study recommended using public funding.... The government --I mean, RAND-- isn't too happy about people owning their own computers: As a way to reach people who don't own computers, the study recommended that terminals be located in public places -- street corners, community centers, libraries, hotels -- just as pay phones are, so people can send and receive electronic messages. What if people find out that this "private study," as AP calls it, is really JUNK mail from Joint Underhanded 'Net Kill-off? Cordially, Jim NOTE. The NandO News website's URL: http://www.nando.net The newsstory's head- and datelines: Study: Every American should have mailbox in cyberspace WASHINGTON (Nov 21, 1995 - 11:01 EST) Its online filename: nation611_4.html

1 0

Re: Mandarins, Lifers, and Talents
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 21 Nov 1995, Lou Poppler wrote: > Mandarins were involved in the genesis, certainly, both of our little > college network, and of the military's arpanet. The mandarins provided > our subsidies, and some of them found ways to use the net in doing their > academic work. Very many of them ignored us. Or tried their uptmost best to ... until we came a knocking. > Among us paid computer staff, > the mandarins held occasional blue-sky meetings to plot the future and > standards for the future; the lifers went about their business of feeding > hollerith cards to the mainframes; and the talents immediately set about > exploring this orthogonal new quirk of their machine. All the edges were > rough in the beginning, and for a long time after the beginning. Gee, I thought, err ... uhhm, shoot, aren't we still at the beginning?? Not the very beginning, but the beginning. Wasn't all of the NII stuff simply a true mandarin plot^H^H^H^H scheme^H^H^H^H^H^H contingency to get enough money to continue "The Project" during some very lean budgetary years? Or am I behind in my reading again ... > Network > code arrived in huge inspired chunks from our eccentric talents. Other > talents, staff and user alike, would go out to play on the network and > find little suggestions for the eccentric talents responsible. All talents are by definition _irresponsible_. They have to be in order to take the risks, sometimes some very silly risks in hindsight. > I think the early networks were less than satisfying for the mandarins. A satisfied mandarin?? Hmmm. That'll take a couple of cycles to compute. ;-) > It required arcane mandarin accounting schemes to rationalize our > perpetual defecits, even in a 'funny money' accounting world. Well, they've saved my butt (I think) when someone hung up the phone on me. And for this, they've certainly got *some* of my allegiance. ;-) And they have my gratitude. > Policies and standards were strained by the sudden accessibility of > the foreign operations, under alien chains of command. The networks > were immediately untidy and required compromise from the user. > > The biggest contribution from the mandarins, and I mean this with > all gratitude, is that they chose, again and again, not to shut us down. Chin. chin. > ObCrypto: we were still getting the bugs out of rot13 back then. Ahh, before they broke the code on what a baker's dozen REALLY was all about. Way back in the days when one-half was still working on rot12. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Nicholas Negroponte interview in MEME
by banjo, lord of the sea monkeys 17 Dec '03

17 Dec '03

The latest issue of MEME has a pretty good interview with Nicholas Negroponte of the MIT Media Lab. Some privacy issues are discussed, the idea of intellectual property is touched on, as well as some other good stuff. I'm not sure if it's on the web, but I'll forward the interview to anyone who would like to have it. K. Ellis OBCrypto: How's it going, Perry? <grin> Kathleen M. Ellis http://zeus.towson.edu/~kelli/ kelli(a)zeus.towson.edu Diverse Sexual Orientation Collec. Towson State University DSOC(a)zeus.towson.edu "Your friends are really just enemies who don't have the guts to kill you" -J. Tenuta

1 0

crypto for porno users
by Carl Ellison 17 Dec '03

17 Dec '03

I hear occasional uproar from LE types about porno traffickers using strong crypto like PGP. [I've been known occasionally to say things for their shock value, but this time I'm quite serious.] ------------------------------ As a society wanting to limit the spread of porn, we should encourage those trafficking in porn to use strong crypto. 1. If two people are sending porn from one to another over the net, the net is so insecure that many people along the way could see it. The recipient field could be mistyped, as well. Either way, someone who doesn't want the porn could receive it and be offended. Strong crypto wrapping that porn protects the innocent accidental recipient from exposure to the porn. 2. If cops want to track down some pornographer (e.g., because he's dealing in child porn), the net and strong crypto provide two opportunities to the police: a) "no one on the net knows you're a dog" implies that police can pose as a fellow porn producer or consumer and get away with it more easily. b) strong crypto for communications between porn users encourages them to speak more freely. When one of the two is a police officer in disguise, that encourages the other (the suspect) to reveal more, making the investigation proceed more quickly. Knowing that the crypto is strong enough to keep government eavesdroppers out, the sender is given a false sense of security -- is distracted from thinking about the trustworthiness of the receiver while thinking about the security of the channel itself. 3. Encryption of porn would work against the kind of porn distribution found on the alt.binary.pictures.erotic... newsgroups. Encryption requires that recipients be identified. 4. Personal file encryption encourages individuals dealing with porn to encrypt and keep personal diaries which might contain evidence. Since PGP is subject to brute force passphrase attacks, this gives an attack which will open *some* of these diaries. Without the encryption, the suspect is less likely to keep the diary in the first place. This isn't a guaranteed opening into all such diaries. There is no such guarantee possible. Rather, this suggests that strong crypto has a chance to maximize the effective "take" by LE forces. These advantages are balanced against the possibility that there is some group of pornographers who communciate together, who are identified by the police, who would be wiretapped *and* who are not infiltrated -- and therefore whose conversations are unavailable to the police. The larger such a group, the less likely it will remain non-infiltrated, so these groups are probably very small. There might be some of these -- just as there might be a few pornographers who have diaries that are encrypted and unbreakable. However, strong crypto opens a number of opportunities for successful investigation -- and it's my guess that in the balance, strong crypto adds up as a net advantage to the police rather than a net drawback. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Encryption Politics (was Re: "Dear Newt" Letter...)
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Phill <hallam(a)w3.org> wrote: <snip + slight reformat> >If you make it a party issue you will not only lose but risk turning the >clock the other way. At the moment everyone knows that the export control >laws are not stopping people from getting PGP. It is not a good idea to >rub peoples noses in it. Why not? It gets the issue talked about when it otherwise wouldn't be. The cypherpunks are the Dr. Kevorkians of stupid US export laws. >It is easy to ignore export violations by turning a blind eye. It is >difficult to turn a blind eye when people are so anxious to announce what >is going on. Exactly. I plan to go to the Nandotimes article at URL http://www2.nando.net/newsroom/ntn/info/info429_4.html and see what it looks like with a few substitutions like "cars," "highways," and "doorlocks" for words like "encode" or "encrypt." Sarcasm is often the last refuge libertarians have in these humor-impaired times, but it keeps me sane. :) >Phil Z. is not having problems because he wrote PGP, he >is having problems because he made sure the FBI couldn't pretend they >did not know what was going on. Well, not exactly. I believe from what I've seen here before that it was Kelly Goen(sp?) who did this. Of course, I've advocated everyone taking legal responsibility for Kelly's actions as a kind of protest against creeping Naziism in "our" government (see my "An Old Idea" post, buried somewhere in the c-punk archives). >If you make encryption a party issue then one of those Grassley bills >will pass and the President in power may not veto it. Encryption _IS_ a party issue, and quite possibly an effective one if we used it correctly, for the *Libertarian* Party! The actions of both "major" parties would have been [IMO] bad PR if the media decided to do their jobs (I know, big "if"). There is, of course, institutional L. party resistance to putting the individual right to strong encryption on the "front burner" because our "generals," despite a consistent record of losing battles, insist on fighting the last war (that is, when we aren't busy fighting eachother). <sigh> JMR [Who takes this opportunity to remind SO FL cypherpunks of the party at 7:30PM on Wed. Nov. 29th.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMLMw9m1lp8bpvW01AQEYggP/R/2nI8TurElr/c1haz6XNzWhUjVxZXtG bQRs9FkHX54300G5tYW1BSe37eQ+5AT6LyjjljLdtx4nYKUSDRUHqYCs/qQkspOU jFxfTAV8TOwMaopL4odBfgDeBVBhXRcjtsYu2rQ6WFF759TCTVYpxjhr7B8JDnR8 LoTFhEBAdTk= =wBjX -----END PGP SIGNATURE----- Regards, Jim Ray -- http://www.shopmiami.com/prs/jimray "This year will go down in history, for the first time a civilized nation has full gun registration! Our streets will be safer, our police more efficient, and the world will follow our lead in the future." -- Adolf Hitler, 1935 ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 (key on page & servers) <liberty(a)gate.net> IANAL ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or http://www.netresponse.com/zldf _______________________________________________________________________

1 0

Re: crypto for porno users
by Jay Campbell 17 Dec '03

17 Dec '03

> a) "no one on the net knows you're a dog" implies that police can > pose as a fellow porn producer or consumer and get away with it > more easily. > > b) strong crypto for communications between porn users encourages > them to speak more freely. When one of the two is a police officer > in disguise, that encourages the other (the suspect) to reveal more, > making the investigation proceed more quickly. Knowing that the > crypto is strong enough to keep government eavesdroppers out, the > sender is given a false sense of security -- is distracted from > thinking about the trustworthiness of the receiver while thinking > about the security of the channel itself. A common way to get around prostitution sting operations is to ask the lady to expose sensitive portions of her anatomy to prove her sincerity before the would-be customer commits to any transactions; this sort of thing is also becoming commonplace on the net for pornography or pirated software, too. Would-be trafficers often ask a prospective recipient for a small chunk of fresh files in advance, before passing back anything serious .. partially out of suspicion, mostly out of greed, but to the same end. A law enforcement team would be stepping onto shaky ground if they were forced to transfer illegal images/etc to a suspected trafficer before getting evidence from him. Entrapment is an ugly concept. >3. Encryption of porn would work against the kind of porn distribution > found on the alt.binary.pictures.erotic... newsgroups. Encryption > requires that recipients be identified. Not at all .. a porn distributor could generate a key pair, use part A to encode the images, and dessiminate part B thru a variety of outlets - publicly posted, sold, passed thru an informal network of like-minded netizens... >4. Personal file encryption encourages individuals dealing with porn to > encrypt and keep personal diaries which might contain evidence. > Since PGP is subject to brute force passphrase attacks, this gives > an attack which will open *some* of these diaries. Without the > encryption, the suspect is less likely to keep the diary in the > first place. This isn't a guaranteed opening into all such > diaries. There is no such guarantee possible. Rather, this > suggests that strong crypto has a chance to maximize the effective > "take" by LE forces. I would argue the exact opposite - strong crypto would tend to minimize the effective take, since there's no guarantee that /anything/ on a perp's system will be in the clear. I'll let someone else with a better background pound on the 'brute force' section. -- Jay Campbell edge(a)got.net - Operations Manager -=-=-=-=-=-=- Sense Networking, Santa Cruz Node Jay(a)Campbell.net got.net? PGP MIT KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

2 1

Re: towards a theory of reputation
by James A. Donald 17 Dec '03

17 Dec '03

>On Mon, 20 Nov 1995, James A. Donald wrote: > >> Any attempt to discuss and analyze reputations using >> morally neutral language is bound to wind up as boring long >> winded meaningless complicated word salad. At 12:19 AM 11/22/95 -0800, Wei Dai wrote: >I don't understand what you mean by this. Can you give an example to how >to discuss reputation (i.e., the concept of reputation, not a particular >reputation) using morally non-neutral language? Under current circumstances, where we have a large oversupply of free government supplied retributive violence, the most important from of reputation is "credit rating", which indicates willingness to pay ones legitimate debts and perform contracts. Willingness to fulfill ones obligations is not at all the same thing as willingness to act in a way that improves other peoples utility. Fulfilling an obligation assumes normative criteria. Any attempt to describe credit worthiness in terms of its effect on the utility of creditors misses the point. Before the nineteenth century, when most governments were reluctant to provide adequate retributive violence, and were more concerned with collecting taxes than upholding law and order, the most important form of reputation was the reputation for being a "gentleman" which encompassed both willingness to pay ones just debts and "gentle" conduct, gentle conduct meaning that you were unlikely to kill or harm people without good reason, but did not require that you went around performing good works. Now if someone has a reputation for good workmanship, this might seem non normative, but such a reputation is a mixture of two components: "X has good quality products" which is not normative and is a fact rather than a reputation, because it does not involve a prediction of future behavior" and "X will fulfill the spirit and intention of a contract" which is a reputation, and is normative. For example although in principle X might have simultaneously have reputation for good workmanship and a reputation for not paying his debts and not delivering on contracts, such a combination would seem unusual and surprising. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

key for Alice as promised
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Tue, 21 Nov 1995, I wrote: > On Tue, 21 Nov 1995, Russell Nelson wrote: > > > anonymous-remailer(a)shell.portal.com writes: > > > Alice here ... > > > > How do we know this for a fact? > > We don't. > > As an incentive for Alice to generate herself a PGP key, I hereby > place Alice on notice that if she doesn't sign her next post, and > provide a PGP key, I will create one for her, and steal all the > postive (?) reputation that she has developed so far. > > You have 24 hours Alice, otherwise a key gets posted to here, and to > the keyservers with your nym on it. Well 24 hours have passed, and Alice remains unrepentant: On Tue, 21 Nov 1995, the old Alice de 'nonymous wrote: > Alice here ... > > No, *I* am the real Alice, and I refuse to use PGP signing. So here we go Alice's key: Type bits/keyID Date User ID pub 1024/23292ED1 1995/11/22 Alice de 'nonymous <cypherpunks(a)toad.com> Key fingerprint = CA 76 81 41 54 CE E7 D6 62 EE 6D 65 EE FB A3 55 - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzCzCFsAAAEEAKR2yXr+FeTjjR0YdGboF9KN4nxTRJ1STZ0CEsL5gTHQcCEo +ELfT2ejkFFtoW9y8c1b6YVItstdPTBZ4TomzM2h1bgToKRn0vRliO4DpOF1J1sZ +2PJwSK22OGIIvSTKf15S7vxRRa6Xnw5IM3WzU5lIrh1OwH7RIbu8OQjKS7RAAUR tClBbGljZSBkZSAnbm9ueW1vdXMgPGN5cGhlcnB1bmtzQHRvYWQuY29tPokAlQMF EDCzCdqG7vDkIyku0QEBW2sD/REBXmnHJ6Nr/xEUoJGr3CbH9voIGQkkzINplsrk koqXlI9puVkBkPUtTMnsewDyUumRR54ZDQ+sApi7rYa/DsSpWbiDaDC1kS5qKHT+ gfBfIxCkEt3Zjzot8vWKJgpC4GY5WC7q5bkmqcfrBNBctl5aWI1lD1qV6iIZ/9fW 2PEA =h413 - -----END PGP PUBLIC KEY BLOCK----- Anything posted without being signed by the above key isn't from me. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMLNjIIbu8OQjKS7RAQETOAQAjLmudAEP/z61BylOtyFhCif5U/BrQ2Pd uWLdy12Z16YVpczNEXeHDztsIE1BTNeGrb85OJywqc3G0M5WU9zzIRY+QlgPJzzJ CFx5danXzVr5A6Bmp2TponUZ4mE1qNoDfANlHMt4nSV1Fn4JqU89sJx7WSmQE0o5 KlPw3Yo4E48= =eOri -----END PGP SIGNATURE-----

1 0