December 2003 - cypherpunks-legacy

Re: "Got a subpoena?"
by Jay Campbell 17 Dec '03

17 Dec '03

>> "finessing" laws will become more important. In short, they WILL have >> a subpoena--then what? > > Then they'll find out that I don't have any information that >could help them, anyway. What about a court order to (a) start comprehensive logging, and (b) not tell anyone under penalty of ______ . -- Jay Campbell edge(a)got.net - Operations Manager -=-=-=-=-=-=- Sense Networking, Santa Cruz Node Jay(a)Campbell.net got.net? PGP MIT KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

4 3

Re: Info on Netscape's key escrow position
by James A. Donald 17 Dec '03

17 Dec '03

At 11:01 PM 12/1/95 -0800, Jeff Weinstein wrote: > > I think the gist > of it is that if governments require key escrow, we will have to do it > in order to sell our products with encryption into those countries. Jim Clark wrote: >> But if we do not come up with a solution to this problem that is >> acceptable to each government, we will not be able to export our products, >> except with a short key length (e.g. 40 bit keys), and that will not be >> acceptable to corporate customers in other countries. I read it as saying: "Let us help the government invade the privacy of our customers, so that the government will do us some favors in export licensing", rather than "Well if they stick it to us at gunpoint, we will submit." I would appreciate some further "clarification". --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

prototype slot-machine
by sameer 17 Dec '03

17 Dec '03

I've written up a slot-machine thing for ecash, very experimental, very buggy, not very slick, (i'd like to get the technical bugs worked out before i put a fancy wrapper on it) and i'd *like* to announce it here for testing, but I'm worrying about gambling laws.. any thoughts? -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

2 1

Talking to Jim
by wiltship＠iccu6.ipswich.gil.com.au 17 Dec '03

17 Dec '03

Gidday all I emailed Jim Clark day before yesterday about his comments re key escrow. He responded. As it's not good form to post private email, might I suggest that one of the 'elders' here put to Jim a list of questions on the proviso that his answers can be posted to the list. You never know, a lot of speculation might be confirmed or denied. cheers Peter Flight to Quality Wiltshire Productions Pty Ltd Brisbane, Queensland, Australia Intl Voice 61 7 3376 3535 Intl Fax 61 7 3279 4027 Email wiltship(a)gil.com.au PGP Key ID 3E584C7D PGP Fingerprint 01 03 FB F4 BE F8 2B F3 5D 84 6B 69 37 80 FE 10

4 3

info?
by j.miranda3＠genie.com 17 Dec '03

17 Dec '03

Can you send me information about your organization? --Joseph Miranda

1 0

Re: GAK, Netscape, CyberDog, and you.
by Ed Carp 17 Dec '03

17 Dec '03

> Date: Fri, 1 Dec 1995 11:58:26 -0500 > To: semper.fi(a)solutions.apple.com > From: rah(a)shipwright.com (Robert Hettinga) > Subject: GAK, Netscape, CyberDog, and you. > Cc: cypherpunks(a)toad.com, mcip(a)deepeddy.com, www-buyinfo(a)allegra.att.com, > ecm(a)ai.mit.edu, bsdc(a)ai.mit.edu > I hear that with CyberDog, building a secure Netscape-compatible browser in > OpenDoc is now pretty simple. That adding economically useful -- and Where can one get more information on CyberDog?

1 0

No Subject
by David Downey 17 Dec '03

17 Dec '03

test ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Re: Info on Netscape's key escrow position
by blancw＠accessone.com 17 Dec '03

17 Dec '03

>From Hal Finney: [in regard to Jim Clark "preaching acquiescence"]: Where is the recognition that the right to tap communications is not granted by God but an accident of technology, one which can be taken away by technological progress as easily as it was granted? .............................................................. I agree with Hal's comments. If Netscape acquiesced to the use of GAK, it would be very easy for cypherpunks and others to switch browsers; they could re-direct interest to Mosaic or even create their own. Netscape is in a prominent position, however, in the net community, which is looking to prevent government control of their electronic communication. The NSA and other government agencies are looking for excuses to give their decisions the appearance of legitimacy. Any perceived weakness on the part of the commercial key players in cyberspace can be perceived as conducive towards the implementation of mandatory security plans, in disregard of the actual desires of internet users. It appears that Netscape is stuck between a rock and a hard place: . if they adamantly resist GAK, they're in trouble with "the Law" . if they appear agreeable to complying with future legal mandates, they're in trouble in with their customers in cyberspace. Losing the fight intellectually precedes losing it in fact. This is more likely to result when the distinction between government "authority" vs citizen "rights" is obscured from the general consciousness (as in: whose business is it, anyway?). Anyone who provides a communication service which can be made accessible to "the Law" becomes by default a representative of the issue, which to me amounts to what someone want to promote in the U.S. (or the world) in terms of ideals; in terms of a way of life. It would promote an atmosphere of intellectual integrity to have explicitly definite statements about the objections to GAK, but barring that it is useful to know that these representatives appreciate why the difference is important. . is it because money is being lost? . because privacy is at stake? . because the ideal of self-determination is being muddled, along with . an understanding of where the concept of "individual unit citizens" stands in relation to concepts of "government authority"? . because of the consequences of that obfuscation? The caution with which this GAK business is being dealt with I think is symptomatic of an underlying problem, which is of not having a sense of freedom to stand up to the Dark Side. .. Blanc

1 0

RE: Do the Right Thing
by Pat Farrell 17 Dec '03

17 Dec '03

I personally believe that this topic does not deserve the heat that it has generated on this list. This opinion could change. I'll have a much better idea Tuesday evening when I've had a chance to hear the latest from NIST on GAK for export. Much of the complaining in September was that vendors didn't want to build two versions, one domestic and one for "export" Netscape is currently doing at least two, and probably closer to ten if you count Windows 16, 32, Mac, Motif, etc. tcmay(a)got.net (Timothy C. May) writes: > Netscape, being the dominant browser company, and Microsoft, being the > dominant OS company, are in special positions to "build in Big Brother." > I'm not claiming they are, just that they are clearly in a position to > make it technologically more feasible to make non-GAK illegal. They both > need to carefully think about the role that's been "given" to them > (whether by fortune, hard work, or being in the right place at the right > time) and do what's right. Except for Louis Freeh and Dorrthy Denning, I haven't heard real people support GAK domestically, although Geoff Grevildinger's pitch at the Sept NIST meeting was 99 & 44/100% domestic. I'll be listening pretty carefully this Tuesday. I think we need to save out fury for real statements about making non-GAK illegal for domestic use. If this starts to condense out of the Ether, I expect that the civil liberties lobbies will get real loud. the ACLU and VTW were both vocal at the September meeting, and EPIC was there, along with folks like Proffessor Hoffman of GW. > And what Netscape agrees to put in future releases of its browsers or its > servers could have dramatic effects on the whole climate. I have no problem with Netscape having a GAK-ified browser in addition to a real one. At least as long as the GAK'd version is clearly identified -- a logo saying "big brother inside" covering 25% of the screen should do it for me. > And if export laws demand GAK in exported products, Netscape should "do > the right thing" and have two versions. It may add to their costs a > little, but it's better than building in the machinery for a GAK law to > later be passed. Netscape is currently doing two (or ten) version. This simple fact seems to have been lost by most of the posters in the past few days. If the issue is just that people don't like the idea that the free, downloadable is GAK'd and that they have to pay $50 for a browser with strong crypto, please take your whining off list. Or find one you like (Netmanage's is too buggy for me, but Mosaic version 2 is quite usable, as is Microsoft's, IMHO) > (Explain something to me. I have never, ever understood why it is a > concern of the U.S. government that we help build in GAK for foreign > governments, that we make sure that products intended for export to > France or Syria have GAK that allows those governments to read the > traffic of their citizens. And if the concern is that exported versions > of software must be readable to the _United States_, then this is a > non-starter in terms of sales in many or even most foreign countries! I'm > sure France will welcome with open arms a version of Netscape that allows > the NSA to read the traffic of French citizens. Oh, by the way, what > legal jurisdictions will be involved in obtaining the escrowed keys of > foreigners? The answers are both clear and murky, if you catch my drift.) The "criteria" (see my http://www.isse.gmu.edu/~pfarrell/nistmeeting.html page) clearly say that approved systems can _not_ interoperate with unapproved systems. This means that exportable systems can not interoperate with, say, PGP. There was talk about having multinational treaties so the French, Iranian, and other "friends" could access the GAK's messages, but that was recognized as being many years out. Diplomacy is slow. It was quite clear from multinational vendors that they thought that non-US corporations would _absolutely not_ accept GAK in the US. The main effect of this stupid export stuff is to drive crypto development offshore. > If the U.S. insists on GAK _within the U.S._, as many of us fear is the > long-term danger, then all bets are off anyway. But I would hope that > Netscape does nothing to make it _easier_ to make this the case! It was quite clearly implied at the September meetings that the Government expected that vendors would do only one version, GAK'd. This would allow the LEAs to tromple all over US civil liberties at will. > A viable thing for Netscape to do is to announce forthrightly that it will > separate the issue of export from what it sells in the U.S., that there > will be NO GAK included in any U.S.-sold packages. The quest for an "all > world" version, freely exportable, should not take precedence over the > civil liberties issues. And I predict that any slight losses in market > share or slight increases in product cost will be _less_ than the effects > Netscape will see if their product comes to be associated with "Big > Brother Inside." I've been developing software too long to accept that the increases in product support costs will be "slight". But I agree that Netscape should _continue_ to have three separate versions, one for domestic use, a second one for export from the US, and the third with Fortessa for sale to Govie agancies that want it. They probably need to add a fourth version, a strong foreign version developed offshore. Tim's suggestion of a formal statement that separates domestic product from export, and clearly leaves GAK out of US products, is a very good one. It is close to what Netscape is doing now, it is completely consistant with current and publically announced policies, and it would let this list return to discussions that are relevant to cryptography. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

2 1

Pegasus Mail PGP Extensions?
by Adam Hupp 17 Dec '03

17 Dec '03

Does anyone know if there are any PGP extensions for WinPMail, and where to get them? -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQBtAzCNppQAAAEDALhWZl7IuGZ9zZT5bACo0b/1L0Nv0C72vKHIO3IHh+cwpHHa 2Ozb9aeO0UvXGwkkZIYgUm0EvmzKh7yb1GTLvBp5kXpR3I9w+Yj4LGlBDERpUWw6 x4ED49pwDnz1Hl5FBQAFEbQYYXNoIDxhaHVwcEBwcmltZW5ldC5jb20+ =PtJK -----END PGP PUBLIC KEY BLOCK-----

1 0