December 2003 - cypherpunks-legacy

Re: Junk E-Mail
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Wed, 22 Nov 1995, James M. Cobb wrote: > 11 21 95 The Electronic Telegraph reports: > > THE European Parliament will decide today whether to > ban junk mail. This is not surprising coming from the Europeans. They tend to favour environmental conservation. I beleive that Germany mandates, as an example, that a manufacturing company accept a return of its product for recycling at the cost of the manufacturer. Could you see GM or Ford actively supporting that type of program to deal with the trash problem?? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: Junk E-Mail - Part 3
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, An 11 21 95 Reuter Information Service newsstory, headed Computer illiterates offered new way onto Internet [OR: Junk mail wants to meet computer illiterate for safe sale] reports: Matsushita Electric Industrial Co said on Tuesday it had developed a way of accessing the Internet using the fam- iliar telephone and fax machine.... With the Matsushita system, users can obtain an index via a facsimile machine and choose Internet subjects they are interested in by keying in numbers on their tele- phones.... The telephone and fax are connected to server comput- ers.... Information coming back arrives as ordinary sound over the telephone handset or as printed text off the facsimile. AT&T was offering an index of newsstories in a series of ads in the Wall Street Journal a couple of years ago. You faxed the code numbers of the stories you wanted to read to AT&T; and AT&T faxed back the stories. FIRST RULE OF JUNK MAIL If you can sell it to the elite, you can sell it to the masses. Cordially, Jim NOTE. The NandO News website URL is: http://www.nando.net The newsstory's dateline: TOKYO (Nov 21, 1995 - 08:18 EST) Its online filename: info735_8.html

1 0

Secrets of the Internet
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, 11 21 95 Times of London screams that Pedophiles use encoding devices to make secret use of Internet Its newsstory reports an Interpol conference was told that International pedophile rings are borrowing an encryption system known as PGP -- Pretty Good Privacy -- developed in [where else!] America and Experts estimate that it could take 10 years for computer systems to crack the individual codes. If that's not enough to reduce you to jelly, Police [are] also concerned at the use of a "remailing" service being provided by an Internet expert in Finland who will take material sent to him and remove identifica- tion marks before sending it out again. On Monday, at the start of the two-day conference in Lon- don on crime against children, Detective Chief Inspector Bryan Drew of the UK's National National Criminal Intelli- gence Service said ...although police increasingly realised the difficulties posed by the Internet...as yet no one in Britain had de- cided on a policy for dealing with them. and ...the Internet and computers were among a number [of] subjects being looked at by his unit. Interim measures for "dealing with" computers and the 'Net abound: As part of the Interpol work, a network of 64 liaison offi- cers had been set up round the world to keep contact on investigations. And when the State ("no one") DECIDES...? Cordially, Jim NOTE. The NandO News website URL is: http;//www.nando.net The newsstory's dateline is: LONDON (Nov 21, 1995 - 01:24 EST) Its online filename is: info429_4.html

2 1

Re: Spam the Sign!
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

Jeff Simmons <jsimmons(a)goblin.punk.net> said... >Then suppose you hand software to MIT to put on its export-controlled ftp >site (which would seem to follow your requirements to take reasonable >precautions to observe the ITAR, etc.) and you don't do the nudge, nudge, >wink, wink - BUT you know that it's going to be available on major ftp >sites in Europe within a few hours anyway. The intent to export isn't >there, but the export occurs anyway. Is it the intent, or the knowledge >that's important? > >Obviously the intent, or the MIT server would be in jail. > >So I demonstrate lack of intent to export, by following MIT's model when I >set up my own 'export controlled' ftp server. Am I safe? Or do I need >a note from the NSA or somebody to do this? And if I do need somebody or >something's 'permission', and they refuse to give it, aren't they using >ITAR to restrict the distribution domestically? Do I have any options in >this case other than to give up? > >Or, to bring it down to a practical question, what's stopping Netscape? How >does Netscape setting up an 'export controlled' ftp site based on the MIT >version lead to one of their executives going to jail? > >I have the feeling that we're talking about two different things here - the >law as it's practiced in the courtroom and the law as it's practiced on the >'streets'. Obviously, the fact that I feel I'm doing something 'legal' >won't help much if the government decides to do a Phil Zimmerman on me. >But I would be interested in your comments. I very much agree with the direction you appear to be headed in. It seems to me that Netscape should have no problem devising some sort of scenario in which such a program eventually gets onto the nets, but in a way that is squeaky clean, at least for THEM. In addition, why should they even need to write the encrytion part of their software IN the US? It occurs to me that one way to do this might be to send one of their programmers to a conveniently-located place, such as Vancouver BC , Montreal Canada, or a few other nearby places, with a great deal of fanfare, and tell him to "write some crypto." He does, and brings it back into the US with him, leaving a copy of it "outside" the country for international distribution.

6 5

ACLU Cyber-Liberties Update -- 11/22/95
by ACLUNATL＠aol.com 17 Dec '03

17 Dec '03

---------------------------------------------------------------- November 22, 1995 ACLU CYBER-LIBERTIES UPDATE A bi-weekly e-zine on cyber-liberties cases and controversies at the state and federal level. ---------------------------------------------------------------- IN THIS ISSUE: * New York Civil Liberties Union Opposes Discipline of Cornell Students for Offensive Online Speech * Seattle Negotiates New Franchise Agreement with Cable Network to Offer Internet Access; ACLU of Washington Gives Testimony on Privacy Implications * Watch Out for Cyber-Liberties Infringements in Counter-Terrorism Legislation; House May Consider Bill in Early December * Update and ACTION ALERT on Federal Online Indecency Legislation * Online Discussion Groups on Electronic Access Issues ---------------------------------------------------------------- STATE PAGE (Legislation/Agency/Court Cases) ---------------------------------------------------------------- * New York Civil Liberties Union Opposes Discipline of Cornell Students for Offensive Online Speech The latest controversy over appropriate use of the Internet at universities erupted last week after four Cornell students made a list of "75 reasons why women should not have freedom of speech" and the list got loose on the Internet. Responding to e-mail and phone complaints about the message, Cornell considered disciplinary action against the students. The NYCLU wrote a letter to Cornell on Thursday, November 16th, urging Cornell not to proceed with disciplinary action. The letter said, "Freedom of expression, especially in the academic forum, is designed to encourage truth-seeking by protecting the challenge and response of intellectual discourse. . . . It is understandable that university officials should be concerned about the increase in the use of sexist language. . . . However, no matter how troubling or offensive the message is, the administration of Cornell University should not depart from principles of freedom of expression when addressing the issues surrounding this dispute." The letter went on to note that "the marketplace theory of free expression appears to be in full swing as the wrong-minded e-mail message has apparently already provoked thousands of angry messages' both to Cornell and to the particular four students." On Thursday afternoon, Cornell announced that it would not pursue any disciplinary action against the students. For a copy of the letter that NYCLU sent to Cornell, send a message to infoaclu(a)aclu.org with "NYCLU Letter to Cornell" in the subject line. For more information, contact Beth Haroules, Staff Attorney, NYCLU, at 212-382-0557. ---------------------------------------------------------------- * Seattle Negotiates New Franchise Agreement with Cable Network to Offer Internet Access; ACLU of Washington Testifies at Hearing on Privacy Implications Cities across the country are beginning to renegotiate franchise agreements with cable networks who want to get into the Internet access business. Civil libertarians must work to ensure that strong privacy protections are included in these agreements. The City of Seattle is currently negotiating a new franchise agreement with TCI of Seattle, Inc., and the ACLU of Washington urged the city to include provisions to protect consumer privacy. In a letter dated November 9th, ACLU-W said that "franchisees should be prohibited from collecting any data on individual use of the cable network, including Internet access, except that data minimally needed for billing purposes. . . . [T]he franchisee should be precluded from collecting information about which other Internet sites are accessed through the cable network, which newsgroups are read, which real-time interactive forums are participated in, or any other information that could be used to compile a data profile of the subscriber." The letter also urged the city to require technological protections, like encryption, to guard against unauthorized tapping. For a copy of the letter, send a message to infoaclu(a)aclu.org with "cable franchise agreement" in the subject line. For more information, contact Doug Klunder, ACLU-W Information Technology Committee, dougk(a)eskimo.com. ---------------------------------------------------------------- FEDERAL PAGE (Congress/Agency/Court Cases) ---------------------------------------------------------------- * Watch Out for Cyber-Liberties Infringements in Counter-Terrorism Legislation; House May Consider Bill in Early December The House of Representatives is scheduled to debate a broad counter-terrorism bill in early December. (The Senate passed a similar bill in June 1995.) While the counter-terrorism bill contains many unconstitutional provisions, the net community should be particularly alert to the following: 1. The pending House counter-terrorism bill contains a funding mechanism for vastly expanded wiretap capabilities for federal law enforcement (authorized by the Digital Telephony law passed by Congress last year). The FBI's scheme would give government an unprecedented ability to intrude on privacy through increased wiretaps. The net community should oppose this and any other funding scheme for the FBI's wiretap proposal. (See our 11/8 issue of the Cyber-Liberties Update for an ACLU statement and action alert on the federal wiretap proposal.) 2. The version of counter-terrorism legislation already passed by the Senate contains a revised Feinstein Amendment, which makes it a felony "to distribute by any means information pertaining to, in whole or in part, the manufacture of explosive materials, if the person intends, or knows that such explosive materials or information will likely be used for" criminal purposes. While the legislation applies to all media, it grew out of Senator Feinstein's vilification of the Internet at the Senate's May 11th counter-terrorism hearings. The House version of counter-terrorism legislation does not currently contain language like the Feinstein Amendment, but the online community should stand ready to oppose any effort to include such unconstitutional provisions in the final House bill. For a copy of the ACLU's letter to the Senate in opposition to the original Feinstein Amendment, send a message to infoaclu(a)aclu.org with "Feinstein Amendment" in the subject line. For further information on the ACLU's opposition to counter-terrorism legislation (which would also expand the FBI's powers in electronic surveillance and other areas), visit the ACLU's Constitution Hall on America Online, at keyword ACLU. ---------------------------------------------------------------- * Update and ACTION ALERT on Federal Online Indecency Legislation The Conference Committee on the telecommunications bill is currently considering whether to remove provisions that would make "indecency" and other speech a crime in cyberspace. The Christian Coalition and other anti-free-speech groups continue to heavily lobby the Conferees to make the new speech crimes even stricter than the Exon Amendment. To counter this backlash, the online community must overwhelm the Conference Committee with a loud and clear message -- that parental empowerment tools and not big government censorship are the only effective means to address children's access to online content. While the Conference Committee is home for Thanksgiving, we urge you to call the Conferees in your state. To find a list of the home office phone numbers for the Conferees, see the current ACTION ALERT at http://www.vtw.org/ The ACLU continues to prepare for a constitutional challenge to the online censorship provisions if they become law. Please contact Ann Beeson, beeson(a)aclu.org, if your organization is interested in being a plaintiff in this ground-breaking litigation that will define First Amendment rights in cyberspace. ---------------------------------------------------------------- Online Discussion Groups on Electronic Access Issues ---------------------------------------------------------------- The following discussion groups are actively debating government information and access issues: GOVPUB -- issues related to publishing local and state government information online Subscribe: listserv(a)vm1.nodak.edu Message: subscribe govpub GOVACCESS -- citizen access to government information Subscribe: majordomo(a)well.dom Message: subscribe govaccess PUBPOL-D -- substantive discussion of public policy issues Subscribe: listserv(a)vm1.spcs.umn.edu Message: subscribe pubpol-d [your name] COMMUNET -- issues related to community and civic networks Subscribe: listserv(a)uvmvm.uvm.edu Message: subscribe communet [your name] ---------------------------------------------------------------- ONLINE RESOURCES FROM THE ACLU NATIONAL OFFICE ---------------------------------------------------------------- Stay tuned for news on the ACLU's world wide web site, under construction at http://www.aclu.org. America Online users should check out our live chats, auditorium events, *very* active message boards, and complete news on civil liberties, at keyword ACLU. ---------------------------------------------------------------- ACLU Cyber-Liberties Update Editor: Ann Beeson (beeson(a)aclu.org) American Civil Liberties Union National Office 132 West 43rd Street New York, New York 10036 To subscribe to the ACLU Cyber-Liberties Update, send a message to infoaclu(a)aclu.org with "subscribe Cyber-Liberties Update" in the subject line of your message. To terminate your subscription, send a message to infoaclu(a)aclu.org with "unsubscribe Cyber-Liberties Update" in the subject line. For general information about the ACLU, write to infoaclu(a)aclu.org. ----------------------------------------------------------------

1 0

Re: "The Right To Privacy" by Caroline Kennedy, et. al.
by Rich Salz 17 Dec '03

17 Dec '03

I've heard a couple of media interviews (CNBC Equal Time, and NPR Talk of the Nation). It sounds like a good collection of issues and scare stories. Experienced people on this list might learn a few things to round out the overall picture, but it's probably best for the general public. I hope it does real well.

1 0

PKZIP - Encryption
by L. DEkel 17 Dec '03

17 Dec '03

PKZIP Encryption - Practical approach ===================================== Note: I am discussing PKZIP ver. 2.xx encryption, but the abstracts isn't about a particular encryption. ABSTRACT: Practical security often differs from Theoretical security. If I asked you, would you make the effort of renting a box at the bank's safe for putting only $1 inside, then when you want it you'll have to drive to town, at opening hours, and be escorted by an armed guard to the safe, just to get the $1, I can guess what your answer will be. The same thing goes for Cryptography, What you are trying to protect, it's importance, price, value, determines the steps you would be wiling to take to ensure a safe and strong encryption. If you want to hide a game from your kid brother, you can use some basic algorithm of encryption (say XOR), but say want to hide proofs that you killed someone you better use a stronger algorithm (say IDEA). To conclude: The system you should choose for security depends on: 1. How sensitive is the data you want to hide. 2. Who is the potential cracker of your system. 3. How convenient is the Crypto system for use. (*) (*) This is not so trivial, as security = 1/convenience, you can, for example force users to change their passwords every 2 min. very secure, but that not very Practical. PKZIP Encryption: PKZIP encryption is often said to be: Weak, "a joke" ,"a deception" etc. Maybe it's time to put things in the right perspective. One must realize (yet again) the difference between: Theoretical Cryptography - and - Practical Cryptography: >From the Theoretical side, there is an excellent article: "A Known Plaintext Attack on the PKZIP Stream Cipher", by Eli Biham and Paul C. Kocher., that proposes an attack on the algorithm using known plaintext method. The writers come to the conclusion that: "The PKZIP cipher is weak, and should not be used to protect valuable data". Criticism: 0). Only the you can define what is "valuable data" for yourself, this could be an abstract question. [see above ABSTRACT discussion] 1). The proposed attack is largely Theoretical, in "laboratory conditions", whereas a ciphertext-only attack, more like what we often find in the real world, is Harder. The article doesn't propose any effective ciphertext-only attack. (It seems the writers only tried to give a general assessment of the algorithm strength, which they did very well). Note: A Very limited Known-plaintext attack is possible against PKZIP, as specific information about the Header of the archive file is Known, but this attack is of complexity 2^38 or higher, so it's not very effective, however it is a possible for an expert Cryptanalyst. (This is still Easier than ciphertext-only attack - we meet in the street). Thus, the theoretical attack is good in telling us about the encryption algorithm, it's strength and weaknesses, and knowledge is always better then ignorance, But, in real world, such an attack can be rendered ineffective, or impractical in terms of resources consumed, time spent, money etc. Don't get the wrong impression, in general, Cryptographic research is Good, it helps determine the overall strength of an algorithm, make suggestions as to possible improvements, warn against weak keys, back-doors etc. But we must separate the Practical from the Theoretical, and it works both ways too. A one-time-pad (OTP) for example, is considered theoretically unbreakable, but in practice OTP systems has been broken more than once, as long as there are people making Human mistakes: loosing secret keys, encryption a message with the OTP more than once, etc. So: Theoretical encryption strength != Practical encryption Strength 2). Considering the "many" cracking utilities in the market: there is almost NO ready made, software that really crack the PKZIP algorithm (crack = cryptanalysis, that is Really analyzing the algorithm, not guessing games), in fact there is No software that can really crack Any modern algorithm such as DES, IDEA etc, That is except maybe CBW which is the closest thing to Really cracking the crypt(1) for unix, or some commercial products for cracking WordPerfect encryption or so. (The strength of PKZIP 1.xx/2.xx encryption is much greater than the above crypt(1) and WordPerfect). All the "Great" utilities are just fancy passwords guessers at best, none of them analyze the ciphertext. True, some of them are good guessers, but their "strength" depends on the Weakness of the password (password = The cryptographic Key). The stronger the password the less chance the "cracker-util" will crack it. The best crackers in the market performs a "limited" brute force attack, if they are good. "limited" is referred to "dictionary attacks", such as the cracker doesn't perform a complete Keyspace (brute-force) search, instead it perform a "Subset keysapce search", i.e. choosing some elements of the Keysapce (say english words) and trying them. (There is the option, in some crackers, including crackers for PKZIP, such as FZC, to perform a more "orderd" Keyspace, that is checking sequences of Keys, e.g: All-5-uppercase letters only- keys). The conclusion from this section is, that if you choose a Long enough, Hard to find (say random chars) password such as "x@J60!fv_Zd4%", then you are quite safe from these "horrid" crackers. That last statement is good for choosing passwords in general. Final note: PKZIP is not a crypto system it's an Archiver with a password protection option. If You want to protect your secret cherry cake recipe from your mother, you can safely use PKZIP protection (assuming your mother isn't a top cryptographer working for NSA). If you want to hide the formula for Cold fusion - use PGP. And remember, there is always the "rubber hose" cryptography option. ,,,,, DEkel '''''

2 1

Bitbux could eliminate some domestic currencies?
by John Gilmore 17 Dec '03

17 Dec '03

Date: Mon, 13 Nov 1995 17:35:39 -0500 From: Dave Farber <farber(a)central.cis.upenn.edu> Subject: IP: cybercash! Holy Mackeral, Andy! To: interesting-people(a)eff.org (interesting-people mailing list) >From a letter in [My dog, I mean my software, ate this part of the msg -- gnu] "Sir, Prof Alec Chrystal ... argues that because cash is unimportant, its replacement by smart cards will have little impact. However, cash is virtually the only kind of money issued by government (in the UK, more than 99 per cent). If a government cannot issue cash because e-money facilitates the use of another country's currency for domestic transactions, it will lose virtually all its seignorage. The government will have to issue some =A323 billion extra gilts and then pay about =A32 billion every year in= extra interest. "Moreover, cash circulates much more quickly than bank deposits (it has a high velocity-adjusted weight). Cash was used for almost 15 billion retail transactions in the UK in 1993, versus 4 billion for all other methods. So the currency in which retail transactions is priced is in practice determined by the denomination of cash. E-money would threaten this dominance, allowing people to stop using domestic currency completely (other than for paying taxes). "The importance of e-money replacing cash is greater than possible effects on exchange rates. Rather, it might make certain currencies to all intents and purposes disappear." Giles Keating head of global economics CS First Boston London, UK

1 0

Two 'punky court hearings: Dec 6th, SF and San Jose
by John Gilmore 17 Dec '03

17 Dec '03

At 9AM on December 6 in San Francisco, the 9th District Court of Appeals will finally hear the appeal of my original FOIA case against NSA. At 10AM on December 6 in San Jose, Roger Schlafly's case against RSA Data Security will hold a hearing on the validity of the Diffie-Hellman, Hellman-Merkle, RSA, and Schnorr patents. Mark your calendar! My hearing is the first (and probably only) oral arguments to the Court of Appeals. The overall issue is whether NSA is violating the law by deliberately taking six months to three years to handle ordinary FOIA requests. (And what can/will the courts do about it.) The specific issue that we appealed on is whether the lower-court judge in the case has the discretion to throw out a case in which the government is violating the law, without addressing the problem. The legal theory is that since the courts are peoples' only recourse when the government violates its own laws, the court system can't simply ignore the problem. This would mean that the people have NO recourse against a despotic government (except armed or nonviolent rebellion, which is a terrible solution). There are lots of other ramifications, since NSA has built up a formidible wall of nit-picky procedural defenses. Since the judges will steer the oral hearing, I don't know whether they'll focus on the big issue or the gritty details. I'll work on getting some of the briefs online. This case (CA No. 94-16165) is NOT at the Federal Building; the Court of Appeals is at 121 Spear Street (2 Rincon Center), 4th Floor, Courtroom 2, 9AM. I think Rincon Center is the old Post Office at Mission and Spear Streets. Spear is "0th Street", downtown between the Bay and 1st Street. It probably won't be as much fun as the Bernstein hearings. But if we win (here and in a few other hearings), it could pry NSA open to public accountability. And this would go a long way toward making some real progress in the crypto policy debate. We might actually get to see the other side's concerns! If you come, wear a "good clothes" costume. If I wasn't going to be at my own hearing, I'd be at Roger's. He has sued RSA and PKP in the hope of overturning their patents, which they have been wielding like a club over anyone trying to make progress in public-key cryptography. (RSA's idea of reasonable and non-discriminatory licensing is "How much money do you have?"). Though some companies have disputed RSA's patents, nobody has ever made a court determine whether the patents are really valid. Roger aims to fill that gap. You may even get to see Jim Bidzos ooze through the courtroom. In an earlier hearing in the Schlafly case, Jim claimed that Roger had insufficient honesty and character because he had held a joint talk with *me* at Crypto '94 about our respective lawsuits. Jim described me to the court as an avowed destroyer of intellectual property rights, and strongly implied that I had unlawfully revealed their valuable RC4 trade secret. It ain't so, on any level, and if he says something like it again, I want lots of witnesses. 10AM, San Jose federal court, Judge Williams' courtroom. I hope Roger will post more details, access info for the legal documents in the case, and directions to the building. John Gilmore

1 1

Re: ecash protocol: Part 1
by Mark Twain Ecash Support 17 Dec '03

17 Dec '03

> I know ecash has some proxy support > but I'm not sure how it works. There are SOCKS proxies and http proxies, > and I don't know which it uses. I used a logging httpd proxy to derive > the data for the SSL challenges I did this past summer. It might be > interesting to post the binary data from some ecash transactions. The Ecash firewall support works by sending the messages as multipart MIME messages. The browser is then set to hand the application/ecash message the Ecash front end. > I wonder if it would be legal to write shop software which sent such a > payment request, took the resulting coins, and deposited them in the bank > (if we could figure out all the protocols necessary). IANAL. What would you hope to gain from creating such a piece of software? --Lucky at -- Mark Twain Ecash Support <mailto:support@marktwain.com> <http://www.marktwain.com/ecash.html>

2 1