December 2003 - cypherpunks-legacy

Re: Secret Clearance
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"hal9001(a)panix.com" "Robert A. Rosenberg" 6-DEC-1995 12:50:58.52 The problem is that they are subject to blackmailed/bribed/subversion ONLY because the employer will use the info as an excuse for firing/restricting the employee. If someone has a "skeleton in the closet" such as being gay, so long as the employer does not discrimate against gays who INFORM the employer of their sexual orientation or if the employer does not care about the person being gay (ie: removes it a potential blackmail threat) there is no problem so far as I can see. It is only when there is something that is WORK RELATED which would affect the person's performance if not known that the question of a background check is relevant. ------------------- Unfortunately, this only works if one assumes that work is the only thing that is valuable in the person's life. Blackmail can easily be used against someone who is afraid of some information emerging to their family, for instance. This perspective still isn't an excuse for disallowing gays, however... the person who should be held responsible for such problems is the person who responds negatively to the revelation. In other words, if the person's family would react negatively to the person being gay, that's the family's problem, and should be treated as such. -Allen

1 0

unsuscribe
by Mary Rose 17 Dec '03

17 Dec '03

unsuscribe

1 0

Note on "Barring Netscape"
by Richard Charles Graves 17 Dec '03

17 Dec '03

The Microsoft Internet Explorer sends the user-agent "Mozilla 1.22 (compatible" to hte server, which triggers an incorrect response from, e.g., www.c2.org. This little fraud has the potential to make you look silly if left unexplained. If you get the string "compatible;" (or Compatible;?), you should instead pop up Netscapisms that show that Microsoft is lying. Or maybe Billisms. <font face="Symbol">, which affects only MSIE, might be appropriate. -rich

3 2

Re: PGP
by DANIEL CHARPENTIER 17 Dec '03

17 Dec '03

> you really ought to be more thoughtful about what and how you write on > the cypherpunks list... The how is referring to not double spacing isn't it. Sorry, I've been up for the last couple of days and didn't even realize it. What do you mean what I write about? > > anyway, the PGP code from MIT should compile on nearly all unix > machines. i'm not sure it will compile with a g++ compiler though. all > unix type machines should have uncompress, tar, (g)cc. just get the > source from MIT. I am not an idiot. I must have downloaded PGP from about 20 million different places. They are all either missing files, some times the darn code won't compile, or when I "tar xvf" half of the files bring up an error and the computer says it can not create the file. I'll try the address that you've sent. Hopefully I will have better luck. In the persuit of constructing a stable cryptographic program that uses PGP what features should be included. Obviously all of the ones that PGP has and encrypting/decrypting e-mail but what else?

1 0

Re: News on Congressional Debate on Exon
by Peter Trei 17 Dec '03

17 Dec '03

> (Controlling Web page accesses is a much tougher problem, of course. so I > wouldn't expect much action on this at first.) > > By the way, I recently discovered a new twist on "age credentials": the use > of credit cards to prove age. One image site is asking for a "valid credit > card number" to be given...not to use for charges, but just to do a quick > verification (they claim a few minutes or less) that the card is valid and > in the name of the person accessing their site. > Timothy C. May | Crypto Anarchy: encryption, digital money, Actually, I've been thinking about this quite a bit recently. I'm building an SSL enabled server, and clent-side authentication may provide some help. I could see a user getting his or her public key certificate signed with different CA keys which assert any number of conditions, such as: Key holder was born before (some particular date). Key holder has access to sales data for XYZ corp. Key holder is an adult who takes the first amendment seriously. ... and the server would recognize different CA signatures as permitting different levels of access. If your browser permitted you to select the key certificate used in setting up the encrypted link (and different certs or sets of certs could be protected with different passphrases), then Mom or Dad could use their I-am-an-adult credential to read www.xxx.com, while Junior could not. There *is* a loss of anonymity in this scheme, however. I realize that digital credentials are old hat on this list. The point I am making is that the pieces for doing this are here - we just need to assemble them. (This is not to suggest that I am in favor of Exon/Coates in any way - I am not. ) Speaking for myself alone.... Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

2 1

Inherent Insecurity of Internet Commerce! (was RE: Secret Clearance)
by Pete Loshin 17 Dec '03

17 Dec '03

OK, I'll try again. First, as I recall, SECRET clearance is actually not very high: when I got it, I had to answer a bunch of questions (do you abuse illegal drugs? are you now or have you ever been a member of any organizations? have you ever been _arrested_ for anything?) and fill out some forms and get fingerprinted. They probably did a credit check, and that was about it. Nobody I knew got any calls asking about my habits (that is reserved for higher clearances). So now I'll rename the thread again: "Inherent Insecurity of Internet Commerce" -- <sarcasm>maybe now the NYT will feature me on the front page for "discovering" this inherent flaw in the Internet.</sarcasm> My purpose in renaming the thread in the first place was to start another thread relating to the types of security in places like, say, Netscape or Spyglass or CyberCash or First Virtual or Interramp or any other ISP or software company. Because I want to know how susceptible these companies are to hiring the wrong people. So, here's the "bug": if some agency of crime/espionage wants to subvert any of these systems, all they need do is employ the same blackmail/bribe techniques used to recruit actual spies on some employees of these companies. They then slip in some hacked versions of the software with the good ones, or modify distribution servers, or slip code into servers that forwards every tenth credit card number somewhere. Or how about getting a janitor to plug a wireless tap into one of the major Internet backbones to sniff for cc#s as well as interesting e-mail? Also, since there's enough noise here already (and even I don't see that much crypto-relevance) I won't post again on this topic, but I am very interested in hearing concrete examples of how Internet companies are protecting themselves, and also in hearing about specific instances of security failing (e.g., has anyone ever found a tap on a backbone?) -Pete Loshin pete(a)loshin.com

1 0

Re: News on Congressional Debate on Exon
by Kevin S. Van Horn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- tcmay(a)got.net (Timothy C. May) wrote: > >I just heard (12:15 EST) that the House has adopted language similar to the >original Exon-Coates language in the Senate I consider it unlikely in the extreme that this passed without Gingrich's sanction. So I guess the Newt's much-publicized opposition to the Exon amendment was just a show. - --------------------------------------------------------------------------- Kevin S. Van Horn | Uncle Sam needs YOU! vanhorn(a)atext.com | But not vice versa. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMYBmCoZzwIn1bdtAQE9lwGA1w4SUuzkxqcrIWu2EJq65rspqg7PVL6Y FcMbibELAnFrZOUKNVtQNXxtpfaItIGR =QI3W -----END PGP SIGNATURE-----

1 0

Re: Solution for US/Foreign Software?
by Rich Salz 17 Dec '03

17 Dec '03

You would not be allowed to export a browser where the crypto library is a dynamically-loaded library. If you wrote a "browser toolkit", you would have to take special care to hide even the names of the crypto functions in the library symbol table. If you want to do offshore crypto development, your best bet is to document the required interfaces and protocols in a publication which is available to anyone, as this is supposedly protected by the First Amendment. On the other hand, I encourage you to try to do otherwise. /r$

1 0

Kim Philby in Washington
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

Burgess, Philby, and Maclean in Washington A Comment on Clipper and G.A.K. It is historically indisputable that Guy Burgess, Harold "Kim" Philby, and Donald Maclean were agents for Soviet intelligence. What is far less known is the role that these three individuals played in the U.S.A. and how this related to their access to U.S. secret material. Maclean, at one time, was the Head of Chancery of the British Embassy in Washington D.C. As such, he was the head of the code room at the Embassy and thus had access to *all* encrypted traffic passing through the Embassy. This included everything available through the considerable Anglo-U.S. co-operative ventures during the immediately-post W.W. II period. Guy Burgess was also assigned to the British Embassy where one job was as a liaison agent with the U.S.A. It has been reported during this period that he had a pass from the Atomic Energy Commission that gave him 24-hour-a-day access unaccompanied by any U.S. "overseer." This was a higher level of A.E.C. security than held by J. Edgar Hoover at the time. Kim Philby was the U.K.'s liaison to the Central Intelligence Agency. He was personally close ("a drinking buddy") to then head of C.I.A. Counter-Intelligence James Jesus Angleton. Angleton was, to all accounts, a psychopathologically paranoid individual, seeing Soviet spies and disinformation attempts in almost all areas of life with the exception of his one-time bar companion. He might be likened to one of those hysterical Victorian "feminists" who thought "all men are pigs" with the exception of one real gentleman she knew. (The gentleman would, of course, be Jack the Ripper.) I write this not out of any sense that Key Escrow or Clipper are "communist plots." Far from it, especially during this period. But the presence of Burgess, Philby, and Maclean in Washington shows how unable the governments have been to protect their own secrets. It is unreasonable to suggest -- as do supporters of Clipper and G.A.K. -- that governments will be any better protecting ours. --tallpaul

1 0

Roger Schlafly's court hearing today
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

Roger Schlafly had a brief hearing this morning in Judge Williams federal court on summary judgements with respect to the validity of the various public key patents, and alleged anti-trust and unfair trade practices. Bob Wells and I were the only pro-tossing-the-patents out people there, although sometimes-cypherpunk-meeting-attender Whit Diffie was there as well. The judge said right at the outset that he would not be making a decision today, that he wanted guidance from Roger and the other sides lawyers about the relevant issues, to help him wade through the tremendous amounts of documentation provided. I suppose that this could be expected, but the issues here seemed to me, at least, to be relatively clear-cut. There were basically four issues to be discussed, the Diffie-Hellman, Hellman-Merkle, and RSA patents, and these unfair trade practices. The judge had only allocated an hour for this discussion, and then showed up 20 minutes late, which proved inadequate. Still, I thought that everyone was remarkably clear and concise with their answers, and the judge asked reasonable questions. First discussed were the unfair trade practices, where the lawyer for what used to be PKP dragged in a lot of dirty laundry from the past, describing why Roger got interested in this in the first place. I don't understand what the complaint here was, the PKP lawyer said that since Roger didn't have a product, what was he complaining about, anyway? It seemed like an odd defense to me, but again, I don't know exactly what Roger's complaint was. Roger agreed with the judge that yes, everything he wanted to say was in his submission. Next discussed was the Diffie-Hellman patent. Roger stated that he had four clear instances where the an "enabling disclosure" was made about Diffie-Hellman; three were presentations to large audiences, and one was a pre-print of the famous "New Directions in Cryptography" paper. Roger actually had the viewgraphs that Diffie used in his presentations. These disclosures were all made more than 1 year before the patent was filed, which is the limit in the US. The lawyer from CalCan (something like that) handled this one. He said that the law specifically mentioned publication, and that none of these was a publication. I'm not sure what the law says, and Roger disputed the claim that that is what the law says. Disappointingly to me, it appears that neither Diffie or Hellman have any recollection of when, to whom, or how many preprints of the article were sent out. It's terrible how the law seems to cloud people's minds, isn't it? What little I do know about patent law tends to support Roger on this one, I think that it should be an open and shut case, but we'll see. Then we came to the Hellman-Merkle patent, which basically claims all of public-key cryptography. Roger's claim here was that the mechanism described doesn't work, because knapsacks don't work, that is, the invention is supposed to make generation of the decryption key infeasable, by a very specific description of infeasability in the claims of the patent. (10^30 arithmetic operation necessary) Well, that's not true. The same lawyer for the other side took this on two different ways: 1) that nobody knew that knapsacks were insecure at the time that the patent was filed, how could the patent be found invalid based on something that happened later 2) and some variations (dense, iterated knapsacks) might still be secure. Roger presented an analogy. Say someone was able to persuade the patent office that a drug cured cancer, and so he was able to obtain a patent on it. Later, it was found that the drug killed everybody who took it. Should the patent be valid, if it really didn't do what it said that it would? Roger could have gotten melodramatic, and said that bad cryptography could really kill people, and has many times, but he didn't; as I said, everybody was remarkably concise and to the point. Even so, we were out of time here, not having discussed the RSA patent or the Schnorr patent at all. The judge said that he will call another hearing if he feels that it is required. I thought, in my incredible naivete, that it went really well for Roger, although I didn't have time to hang around and ask him how he thought it went. I think that his arguements are good, and if the law is sensible he will prevail. thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-2244

1 0