December 2003 - cypherpunks-legacy

Re: crypto for porno users
by James A. Donald 17 Dec '03

17 Dec '03

At 12:17 AM 11/23/95 -0800, Jay Campbell wrote: > A common way to get around prostitution sting operations > is to ask the lady to expose sensitive portions of her anatomy > to prove her sincerity before the would-be customer commits > to any transactions; this sort of thing is also becoming > commonplace on the net for pornography or pirated software, This protects the customer against stings, but it does not protect the supplier against stings. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

crypto for porno users
by gjeffers＠socketis.net 17 Dec '03

17 Dec '03

crypto for porno users Crypto porno is a wonderful topic for Cypherpunks. Child porno people are a group that definitely needs the very best in computer security. If their computer security problems are solved, then everybodys' computer security problems are solved. COMPUTER SITE DISK SECURITY The SecureDrive 1.4 disk encryptor system solves their computer site disk storage problem. It also gives them the solution to the "rubber hose" problem. With a "damaged" key file and the use of a password, they have an effective defense against court orders demanding keys. (see the docs for SecureDrive 1.4). Also disk encryptors not only encrypt files but also solve the problem of temporary work files that are used by many software packages (They can be reconstructed). TELECOMMUNICATIONS SECURITY MIT's PGP 2.6.2 solves their problem of secure telecommunications. This assumes that the people involved can really trust each other. STATE INFILTRATOR PROBLEM Of course, one of the really big problems for non-STATE approved groups is the problem of state agents infiltrating the group. This gets worse as the group gets bigger. This is also one more thing I have against states - one of their jobs is having their agents make friends with cit- izens and then betray their friends. Has anyone else noticed? - THE STATE HAS NO HONOR! The state prides itself on its cleverness here. Also, of course, once the state has entrapped an individual, they tend to get other members of the group by having their victims get and give evidence against other members. - sort of a domino effect and the group unravels - especially with the conspiracy laws. Drug distribution gangs are famous for falling to these techniques. A possibly unbreakable defense against the above assault would be the use of a Dining Cryptographers protocol. According to Applied Crypto- graphy, PGP may be used to send messages in these protocols. Pretend that a small group of Cypherpunks are child porn enthusiasts and decide to use the Cypherpunk mailing list to exchange pictures and child porn info.. I know little of the theory of Dining Cryptographers but I would think that a good implementation of it would make infiltrators useless. I will leave it for other Cypherpunks to discuss the mechanics (specific and general) for actually doing this. A possible risk would be that this would put the general membership of Cypherpunks at risk - or would it just put the list itself to risk? Does this imply that we need FORTRESS mailing lists or what others would des- cribe as COERCION-FREE mailing lists? Would remailers that allow two way secure communication be a help here? Would they be forced to be FORTRESS or COERCION-FREE to be effective? Should they use expendable lists?:-) Generally, if you wanted to start a discussion group on a forbidden topic on the Internet, and wanted to keep it secure - how would you do it? Today this is an academic question - but tomorrow? :-) Aside from workable anonymous Internet money, the two most needed computer privacy technologies are fortress mailing lists and remailers and workable Dining Cryptographers protocols. THE UNITED STATES "FEDERAL" GOVERNMENT HAS NO LEGITIMACY. The United States "Federal" Government - We'll be even more American without it. PUSH EM BACK! PUSH EM BACK! WWWAAAYYYY BBBAAACCCCK! BBBEEEAAATTTT STATE! Gary Jeffers

2 1

Re: Junk E-Mail - Part 4
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, In its NEWS IN BRIEF summary, 11 22 95 Financial Times reports: BRUSSELS/LONDON - SELLING - A ban on telephone "cold calling" throughout the European Union was on Tuesday approved by Euro-MPs, to the consternation of direct mar- keting and distance selling organisations. In a move de- signed to spare people from what MEPs consider to be ir- ritating telephone calls, a key parliamentary committee voted to make prior consent from consumers obligatory before a seller can approach them by telephone. The proposed ban also applies to communications by e- mail, raising fears among publishing organisations that the development of the information society in Europe could be damaged. Ban fear, for we have nothing to fear but fear itself. Cordially, Jim NOTE. The URL of one Financial Times Group website is: http://www.usa.ft.com

1 0

Re: Spam the Sign!
by James A. Donald 17 Dec '03

17 Dec '03

At 04:02 PM 11/22/95 -0800, Jeff Simmons wrote: > and yet the people with the [balls] > to actually challenge it aren't the big companies who stand to gain the > most financially, it's a bunch of guys (a lot of whom hang around here > sometimes) who are successfully giving away 'export controlled' software, If you have looked at court cases recently, you will notice that most juries will find a corporation guilty of anything, no matter how absurd. At a gut level they feel that the pursuit of profit is itself a crime, and that the pursuit of profit in an organized group is a flagrant and terrible crime, deserving of the most savage punishment, unless that pursuit has been thoroughly and carefully supervised and authorized by the state. They are much more reluctant to punish an individual, which is why the government wants to keep Phil in permanent legal limbo. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: crypto for porno users
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"moroni(a)scranton.com" "Moroni" 24-NOV-1995 14:52:11.13 >I wish we could get off the subject of the kiddie porn , it makes >me wonder what people on this list are doing when they are not >mailing out letters. Not to flame ,BUT it is such a serious issue >and we all as adults and approaching adults should not treat it as >an academic issue . It is the most victimizing of all crimes and >I think of speak for some of us when I say that it would be better >if we all found a way to get back to discussing the problems of >cryptography as related to we not pornographers. I can see one argument that one should not discuss such unpopular topics. That argument is that the person who brought them up may act as a (hopefully inadvertent) _agent provocateur_ for those who would condemn cryptography for protecting child pornography and similarly unaccepted practices. However, I regard self-censorship in reaction to fears of government as as evil as governmental censorship. Consequently, I would like to give two counterarguments to the idea that child pornography is not something that should be cryptographically protected. The first is that one may legitimately disagree with the government on what is child pornography. For instance, one may disagree on what minimum age should be used. Governments are known for being quite incoherent on rules on sexuality and the age of consent. For instance, Britain's age for consent depends on the type of sexuality involved; heterosexual sex receives a more lenient age (18) than homosexual (21). (There are also, of course, difficulties caused by such legal inconsistencies as simultaneously deeming someone not to be of consenting age for sex yet to be considered an adult when charged with murder; I refer to the infamous Bobbit (sp?) trials). The second is that given new image modification technologies, it is possible to produce what will seem child pornography, but with no actual harm done to children. In some ways, this product may reduce harm to children in some respects by providing a "competing product" to actual child pornography, and thus discourage its manufacture. Some will argue that such simulated child pornography is useful by pedophiles in persuading children; this argument appears similar to the one against cryptography that it can be used for purposes generally agreed to be illegitimate. I trust that the list does not find such an argument to be valid. I will mention in this regard that I have no personal want to see child pornography. However, I support the right of those who do to do so, if no harm to others is committed. Sincerely Yours, -Allen

5 4

Re: Spam the Sign!
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>> Jeff Simmons <jsimmons(a)goblin.punk.net> said... >> >> >Then suppose you hand software to MIT to put on its export-controlled ftp >> >site (which would seem to follow your requirements to take reasonable >> >precautions to observe the ITAR, etc.) and you don't do the nudge, nudge, >> >wink, wink - BUT you know that it's going to be available on major ftp >> >sites in Europe within a few hours anyway. The intent to export isn't >> >there, but the export occurs anyway. Is it the intent, or the knowledge >> >that's important? > >What's important to the government is that the crypto not be exported. Actually, that's not true. What's REALLY important to the government is that it not be AVAILABLE outside the country, or perhaps even more accurately, not available anywhere. Problem is, the government doesn't have unlimited authority in this area. >> >Or, to bring it down to a practical question, what's stopping Netscape? How >> >does Netscape setting up an 'export controlled' ftp site based on the MIT >> >version lead to one of their executives going to jail? > >Maybe their executives don't want to deal with the possibility of going to >jail and are staying far from the edge of the law. Maybe they are too busy >trying to find some way to make money. > >> I very much agree with the direction you appear to be headed in. It seems >> to me that Netscape should have no problem devising some sort of scenario in >> which such a program eventually gets onto the nets, but in a way that is >> squeaky clean, at least for THEM. > >But why would they want to risk this? As squeeky clean as it is, we now >all know that they know that making it available this way is exporting >it. NO! The government doesn't even pretend to have authority over non-exported encryption, and they readily admit this. And I'm sure they are also are aware that they can't press their luck with an overbroad interpretation of ITAR. Let's look at REALITY, okay? Export controls on products have been around for many decades. Computers are a classic example. If merely manufacturing a product that (if exported to the wrong place) becomes a violation of such laws/regulations, then practically every computer company that has ever existed violated ITAR. Here's the real "problem": Export regulations were intended to MINIMIZE the number of controlled products "leaking through" the border. There was never any illusion that this could be entirely eliminated. So far so good: They were happy to minimize the number of mainframe computers 1970 (for example) USSR got. Software, by its very nature, is infinitely copiable, which means that even a single export constitutes a complete failure of the system. Thus, a system of regulation that was useful for hardware becomes totally useless for software. >> In addition, why should they even need to write the encrytion part of their >> software IN the US? It occurs to me that one way to do this might be to >> send one of their programmers to a conveniently-located place, such as >> Vancouver BC , Montreal Canada, or a few other nearby places, with a great >> deal of fanfare, and tell him to "write some crypto." He does, and brings >> it back into the US with him, leaving a copy of it "outside" the country for >> international distribution. > >This is illegal as well. No, it isn't. >The programmer is exporting the cryptosystem, No, he isn't. Exporting a book on encryption, including algorithms, for example, is entirely LEGAL. And I think you're misusing the term, "cryptosystem." The government may be attempting to use ITAR to regulate exports of fully-functioning software, but it apparently cannot touch books containing source code for such programming. Thus, "exporting the cryptosystem" is NOT always a violation of ITAR if your definition of "cryptosystem" is so broad as to include source-on-paper, and thus your statement is legally irrelevant. If you tighten up the term "cryptosystem" to include only functioning software, your statement becomes false because said programmer does not need to export same. Note that I'm assuming that the programmer GENUINELY writes the software abroad, as opposed to faking it. Of course, even "faking it" might be legal: If source-on-paper exporting is LEGAL, then taking a copy of an encryption program outside the country on paper, then scanning it into a computer and recompiling there should also be legal. >and may even be guilty of treason (probably not). If you really want >strong crypto, just buy it fom one of the hundreds of legitimate >overseas suppliers. If you want to export strong crypto Netscape, >rewrite Netscape outside the US. It's not that complex a program. That's not a satisfactory solution. The goal, I suggest, is to allow Netscape (or any other manufacturer) to sell a SINGLE product around the world, without violating (even arguably) ITAR.

1 0

CJR_war
by John Young 17 Dec '03

17 Dec '03

SciAm, December, 1995: "Fighting Future Wars. U.S. military planners may be preparing for the wrong conflict." Policy experts, technical gurus and defense contractors have begun to study a range of other potential threats, from a newly hatched superpower to a regional power with dramatically altered fighting tactics, to legions of mercenary hackers that bring down banks and stock exchanges with computer viruses and other malevolent software. The vast array of scenarios is a measure of the speculative turn that has gripped the military-planning establishment. Debate on high-tech fighting culminates in the question of whether information technologies -- a computer virus, for one -- could make conventional military hardware obsolete and whether they would make possible a virtual invasion of the continental U.S. A battle of the bits would be fought by destroying an enemy's information assets, its financial, electrical, telecommunications and air-traffic-control networks. Direct strikes at the military would not be ruled out: cracking a government computer is already a not infrequent hacker rite of passage. In addition, more than 95 percent of military communications travel over public networks. CJR_war

1 0

SEL_ane
by John Young 17 Dec '03

17 Dec '03

As previously noted here: SciAm, December, 1995: "Confidential Communication on the Internet." By Thomas Beth, director of the European Institute for System Security and professor of computer science at the university of Karlsruhe. Chain of certification in the author's scheme, SELANE, extends from local authorities who vouch for an individual's identity and probity up through regional, national and supranational authorities, each vouching for those below it. Digital signatures prevent tampering; anyone who recognizes one signature in the chain can be assured that a signed document is valid. SELANE is compatible with almost every commercial and academic network. It also provides a "smart" card that can carry out the necessary calculations securely for each user. And it addresses the conflicts of government and privacy interests when wire-tapping is needed. SEL_ane

1 0

ANNOUNCE - Amnesia Remailer now public
by Scott Kenney 17 Dec '03

17 Dec '03

PGP message

1 0

Re: real life problems with ITAR (was Spam the Sign!)
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

Attila(a)primenet.com said: > On Thu, 23 Nov 1995, jim bell wrote: > >> I very much agree with the direction you appear to be headed in. It seems >> to me that Netscape should have no problem devising some sort of scenario in >> which such a program eventually gets onto the nets, but in a way that is >> squeaky clean, at least for THEM. >> >> >> In addition, why should they even need to write the encrytion part of their >> software IN the US? It occurs to me that one way to do this might be to >> send one of their programmers to a conveniently-located place, such as >> Vancouver BC , Montreal Canada, or a few other nearby places, with a great >> deal of fanfare, and tell him to "write some crypto." He does, and brings >> it back into the US with him, leaving a copy of it "outside" the country for >> international distribution. >> > <attila sez> I think they have that one covered --not only is it >violation of ITAR's intent to send a programmer out of the U.S. Well, don't assume that because something's a "violation of ITAR's INTENT" it is actually a violation of ITAR. It can't be assumed that ITAR is _perfect_: That it actually prohibits every activity the government that wrote it didn't like. , but is >illegal to hire a foreign national to program for your non-U.S. products. Sure about this?!? > the test is going to be with someone like Sun who "bought" a group of >Russian crypto programmers and left them in Russia. Now, the problem >with ITAR is that if you import that code, you can not then export the >code since it is now covered by ITAR. I didn't say that the code would ever be "re-exported": A copy would be brought into the US for domestic use, and everyone else outside the border would get their own copy from an outside server. > secondly, it appears there is a move afoot to make it an ITAR >violation to hire the foreign nationals to circumvent ITAR --basically, >the Feds want to stop cryptography _everywhere_, including telling >Russians they can not work for U.S. companies! Just where do they think >they are getting off? It is for this kind of problem that I "invented" my concept of "Assassination Politics": If everybody pissed off at this situation was willing to donate $10 to a fund to reward the deaths of a few government officials responsible for ITAR, I can well imagine that this would shake them up a bit.

2 1