December 2003 - cypherpunks-legacy

Re: French crypto restricti
by Joe Tardo 17 Dec '03

17 Dec '03

Reply to: RE>>French crypto restrictions - update ? Would this imply that Netscape supplied source code to SCSSI? From: Laurent Demailly > Yes Netscape got the authorisation to sell Netscape navigator in > France (40 bits) but there is no policy changes or whatever, it is > still a tedious product by product process to get auth for crypto and

1 0

Re: Info on Netscape's key escrow position
by blancw＠accessone.com 17 Dec '03

17 Dec '03

From: "James M. Cobb" Blanc, On 12 02 95 you pointed to: ...an underlying problem, which is of not having a sense of freedom to stand up to the Dark Side. You have put your finger on perhaps THE problem: Why did we cast aside our sense of freedom? How may we re-ignite the spirit of freedom? ......................................................... Yes, I think it's a pretty important element to ponder, this lack of the sense of freedom. I don't think that "we" all (especially on this list!) have cast it aside. I do notice that it seems to dissipitate the closer that one gets to govmt agencies (or vice versa). I have often heard people say "well, if it becomes a law, we'll have to uphold it". That seems to be the end of all effort towards reality, as though no further advancements toward truth were possible. It's a continual problem, fostered from being in the lower rungs of the pecking order of "authority" and then beginning to think that one rightly belongs there. Yet how often, especially lately, does technological progress make obsolete what yesterday was an "important" social/political issue requiring "offical intervention" from higher authorities to impose the lowest standards of functioning so that everyone could "get along". Sometimes the issue just goes away from atrophy or obsolescence, once certain talented individuals discover new, improved ways of getting things done. Of course, there's still always another social fear to overcome, and the more that inventors & scientists & techonologists push back the envelope of what is possible (especially in the field of electronics & communication), the closer they get to the gist of the problem with people's attitudes & behavior toward each other, and the closer also to the governing agencies which were created to deal with these concerns. Some things I know which inspire the sense of freedom to stand up to the Dark Side is to have definite knowledge, integrity, a personal vision of the future (an ideal), and some really useful tools (be they hardware or software). This list is intended to focus on the tools of cryptography in relation to privacy, James, and far-off digressions are discouraged because of the volume of mail which this would result in. So do try to focus on that, won't you, or you'll continue to hear from Perry, who works tirelessly to keep everyone in line. :>) .. Blanc

1 0

re: NIST GAK export meeting, sv
by tcmay＠got.net 17 Dec '03

17 Dec '03

Hieronymous(a)bosch.art wrote: > (Thanks for the summary, Pat.) I concure. Nice summary. I hope Pat doesn't run out of steam before getting the full version out (writing summaries can sometimes do that). > This last bit is really rich. I can't think of a single publically >defensible reason for the stipulation that every escrow agent must employ >someone with SECRET clearance, but I *can* think of a publically >indefensible reason for it -- to facilitate those spooky non-court wiretap >authorizations that've been alluded to in the fine print of the GAK >proposals. One "defensible" (and maybe even good) reason is because someone with government clearance can then be prosecuted for leaking what they know, whereas ordinary citizens are harder to prosecute for this. I doubt this is the main reason, but it makes a certain kind of sense. But there are other more interesting links between Secret clearances and wiretaps. The "Foreign Intelligence Surveillance Court" meets in Arlington, VA as the need arises to authorize wiretaps in private, for intelligence collection reasons. I think this has been discussed a couple of times on the list, so a search of the archives might be useful to those who are curious. (Also, a couple of the recent book on the Intelligence Support Activity, Ruby Fruit, etc., have details on how this court operates.) Though little of how GAK has been released (or reported here, or in the press), there is no doubt in my mind that this Foreign Intelligence court would of course continue to get its own wiretap authorizations. (And not only "foreigners" are involved: anyone who is believed to have importance to an intelligence matter is fair game for this court to consider. Which is not surprising, really, as the goal is partly to catch spies and plug security leaks--before someone goes ballistic and accuses me of Betraying the Cause, I'm just describing things as they are. And surely some security measures are warranted, even to Cypherpunks!) > Of course, just because escrow agents would be required to hire >*someone* with a SECRET clearance doesn't mean that *anyone* with a SECRET >clearance would fill the bill. And that's the rub: the administration of >clearing people-with-SECRET-clearances for escrow agent employment would >be conducted -- where else? -- *in secret*. SECRET clearance, of course, >wouldn't be the salient criterion; after all, there are people on the >Cypherpunks list -- and a few who aren't on it but are like-minded -- >who'd be, uh, reluctant to deliver keys in the absence of a a wiretap >authorized by a judge. > And, as a petty aside, it's nice to see that the gov't had cooked up >yet another way to force potentially legitimate businesses to pay its >stoolpigeons to chip away out our civil rights. Many think tanks and defense contractors have "sheep-dipped" retired intelligence officials working for them and continuing to report (in various ways) to their former paymasters. Sometimes these sheep-dipped agents are just there to keep tabs on what's going on, sometimes they're there to nudge these companies in certain directions, and sometimes they are actually running "deniable" applications from the private sector. (Recall Hughes, Air America, Castle Bank, etc.) I can imagine that if some companies talked about in connection with certain questionable activities (Banker's Trust, Bank of America, Wackenhut, SAIC, etc.) were to bid for the contract to be a GAK Agent, then there would be contacts back to the intelligence agencies. But most GAK accesses would be handled through normal channels, albeit secret. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

New version of SSL 3.0
by Phil Karlton 17 Dec '03

17 Dec '03

[This is the second try at sending this message.] SSL 3.0 protocol has been substantially changed from earlier drafts to fix a number of performance and cyrptographic issues. The latest version can be found as PostScript in a compressed tar file on ftp://ftp<N>.netscape.com/pub/review/ssl-spec.tar.Z where <N> is a digit in the range [2-8]. An HTML version should be available in a day or two. I will post the URL when that happens. Netscape is also in the process of submitting this draft to IETF. Questions and comments about this specification should all be directed to ssl-talk(a)netscape.com. Answers and replies will be posted there. We are quite interested in your feedback. As new eyes see the spec for the first time, I suspect that we will be notified about typos and areas that are not as clear as they should be. As a result, there will probably be an update in 2 weeks or so. PK -- Philip L. Karlton karlton(a)netscape.com Principal Curmudgeon http://www.netscape.com/people/karlton Netscape Communications

1 0

CFP '96
by Rev. Ben 17 Dec '03

17 Dec '03

I'm going to CFP '96 and was wondering if any cpunks wanted to share a hotel room with me(or even better, offer me crash space on the floor). If so, mail me and we'll work something out. And now back to your regularly scheduled rants and GAK'ing. Ben. ____ Ben Samman..............................................samman(a)cs.yale.edu "If what Proust says is true, that happiness is the absence of fever, then I will never know happiness. For I am possessed by a fever for knowledge, experience, and creation." -Anais Nin PGP Encrypted Mail Welcomed Finger samman(a)powered.cs.yale.edu for key

1 0

hack microsoft?
by Perry E. Metzger 17 Dec '03

17 Dec '03

So, are the folks that broke the Microsoft password stupidity getting "Hack Microsoft" T shirts? .pm

2 1

re: NIST GAK export meeting, sv
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May 12/5/95 6:25 PM: >> This last bit is really rich. I can't think of a single publically >>defensible reason for the stipulation that every escrow agent must employ >>someone with SECRET clearance, <<etc.>> > >One "defensible" (and maybe even good) reason is because someone with >government clearance can then be prosecuted for leaking what they know, >whereas ordinary citizens are harder to prosecute for this. I doubt this is >the main reason, but it makes a certain kind of sense. Nice point, though I too doubt that's the reason: if *every* agent needed to be cleared, then this clearance stipulation would serve nicely, but if only *one* at every escrow agency needs to be cleared... >But there are other more interesting links between Secret clearances and >wiretaps. > >The "Foreign Intelligence Surveillance Court" meets in Arlington, VA as the >need arises to authorize wiretaps in private, <interesting but etc.> >> Of course, just because escrow agents would be required to hire >>*someone* with a SECRET clearance doesn't mean that *anyone* with a SECRET >>clearance would fill the bill. <etc.> >Many think tanks and defense contractors have "sheep-dipped" retired >intelligence officials working for them and continuing to report (in >various ways) to their former paymasters. > >Sometimes these sheep-dipped agents are just there to keep tabs on what's >going on, sometimes they're there to nudge these companies in certain >directions, and sometimes they are actually running "deniable" applications >from the private sector. (Recall Hughes, Air America, Castle Bank, etc.) > >I can imagine that if some companies talked about in connection with >certain questionable activities (Banker's Trust, Bank of America, >Wackenhut, SAIC, etc.) were to bid for the contract to be a GAK Agent, then >there would be contacts back to the intelligence agencies. Organizations like SAIC seem like "naturals" for GAK escrow agents -- and they're a forgone conclusion as far as spookery is concerned. What troubles me is the suggestion that *every* agent *must* hire someone who might answer to a higher authority, as it were. And what troubles me more is watching this paragovernment's transparent efforts to reproduce itself step by step, always trying to elude efforts to make it accountable or subordinate to civil authorities. >But most GAK accesses would be handled through normal channels, albeit secret. Of course. But most cops and prosecutors haven't developed the "national security" verbal tic. Yet. GAK stinks, but this security-clearance stipulation *really* stinks. Of course, I'm preaching to the choir... Hieronymous -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMMUMXL3g0mNE55u1AQHR0wIAj/86ga/1T0FJ7gZt5ZVwlCLt4pq2g0Nt QpoDWlul6q9ub51k3wwA6Kn1np3NMoYpjLS/bdPew0XUBMJpQs/l/Q== =AdMm -----END PGP SIGNATURE-----

2 1

<no subject>
by McGrath 17 Dec '03

17 Dec '03

is this a mailing list or somthing if it is send it st954a65(a)post.drexel.edu

1 0

Secret Clearance (was: re: NIST GAK export meeting, sv)
by Pete Loshin 17 Dec '03

17 Dec '03

I'm definitely opposed to GAK, but the conspiracy theory approach to considering what it means to employ people with SECRET clearance may be getting a bit paranoid. >From working at an organization that did a lot of government work, my understanding of the process of clearing employees is this: -certain tasks require knowledge or access that must be restricted -you have to have a high degree of trust in the people doing those tasks -people with money troubles, out-of-control addictions, skeletons in the closet, and histories of "troubles" are prime targets for subversion -doing a clearance check (in theory) eliminates the possibility that these people will be blackmailed/bribed into revealing their secrets Not that this stuff always works in practice, considering that Aldrich Ames was an alcoholic with money troubles who then turned up with a lavish lifestyle, and no one he worked with noticed until it was pretty much too late. The point is, if you want to keep your organization's systems secure, you need some mechanism to do so. Security clearance is one way; banks and other financial institutions do other things (like finger prints, background checks, etc.) My big question is, do any of the companies providing Internet services, or Internet software, or digital commerce services/software, employ any of these security mechanisms on their employees? Comments or (preferably) references to actual practices? -Pete Loshin pete(a)loshin.com

1 0

Re: The "Future" Fallacy
by blancw＠accessone.com 17 Dec '03

17 Dec '03

From: Duncan Frissell Bill Gates (like Mister Newt before him) committed what I call the Future Fallacy in "The Road Ahead." Page 106. "Soon any child old enough to use a computer will be able to transmit coded messages that no government on earth will find easy to decipher." ................................................... Billg is an optimist. What's wrong with this picture, Duncan? .. Blanc

1 0