December 2003 - cypherpunks-legacy

NSA gets into the ISP business
by nobody＠flame.alias.net 17 Dec '03

17 Dec '03

Recently I went out shopping for a cheaper ISP. I found one which was very inexpensive. Too inexpensive. At first I was thrilled...then I began to wonder how they could charge so little. Pcix.com is offering static ip address, domain name, etc, the whole schebang for $20 a month, or $75 if you want a dedicated line. That's less then TLG, and TLG is a non-profit organization. As the saying goes, if it sounds too good to be true, it probably is. It seems our government friends have found themselves a new hobby. I'm not sure exactly what this sting operation was set up for, but I'm sure you can use your imagination. The user agreement is very interesting. It states: 1) You're not allowed to upload any encryption software (even if you don't export it) or have any strong crypto in your shell account, and 2) They are allowed to monitor anything you send over their network. Spooks' dream ISP. Highlights from the user agreement: Section 2.7(b) > Member further agrees not to upload to the PCIX services any data or > software that cannot be exported without the prior written > government authorization, including, but not limited to, certain > types of encryption software. Section 4.1 > PCIX may elect to electronically monitor any and all traffic > which passes over our Wide Area Network. This monitoring may include > public as well as private communications and data transfers from our > Members and to our Members as well as any and all communications and > data transfers to and from any other internet sites. PCIX will > monitor our Members and those who use or transmit communications or > other data over our network to try and ensure adherence to > international, federal, state and local laws as well as the PCIX > Terms of Service Agreement.

1 0

RE: Why Net Censorship Doesn't Work
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

DCF wrote: >Thought control is a very difficult task. It always has been. The >Inquisition, Nazi Germany, the Soviet Union, and the People's Republic of >China tried but three of the four are no longer with us. Short of >totalitarian controls, thought controls will be ineffective. And >totalitarian controls are difficult to impose these days. While thought control is difficult, one cannot ignore the damage done trying to do it. All of the above examples were expensive in terms of human suffering and death toll for long periods of time. The controls were effective for some time with long periods for recovery. The facists may lose in the end but the price of victory is very high. I fear the current and future efforts at controls will be costly no matter what the outcome. bob

1 0

Re: NYT's _Unmuzzling the Internet_
by Loren James Rittle 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jaron Lanier wrote in the _The New York Times_, January 2, 1996, p. A15: ``The other day, I came up with a way to easily evade the proposed American restrictions. My simple idea would be to create a computer program, dubbed `Unmuzzle,' which would deposit incomprehensible fragments of any forbidden material in different foreign computers (though maybe not Germany's). The contraband communication would only be reassembled into a coherent whole when downloaded in the home of the user back in the United States, where it would become protected speech, as in any other medium.'' Is this the state to which the Internet must evolve to withstand attack from the possible near-future legislation contained within the current draft of the Telecommunications Reregulation Bill? The Internet technology that was designed to withstand network outages by routing around the problem must now, perhaps, also be designed to allow information to be split for storage and transmission to navigate around mere political insanity. I know: "Cypherpunks write code!", but something seems amiss with the technical solution proposed in the opinion editorial quoted above. Many questions are begged in my mind. At first, the Jaron proposal sounds like an interesting thought experiment but a total waste of bandwidth, both CPU and network, to me. The unconstitutional Bill must be defeated in Congress, by that Presidential veto pen that Clinton has become so fond of using recently or the Court system, if absolutely necessary. If none of that happens, then surely technology can be used to route around this "political" problem. It just seems like a shame to have to expend technical effort and valuable network resources to play games to meet the letter of a law, which would so clearly break the direct spirit of the Constitution, if signed into Law and later found during a Supreme Court battle to "pass constitutional muster," as they like to say. Under my model, which may be different than Jaron's, I assume the raw data is useless without a recipe, or algorithm, if you prefer. Jaron doesn't say how the ``incomprehensible fragments of any forbidden material'' are known to be joinable and how they are to be joined so I invented this as the missing glue to discuss his idea in this forum. I assume a recipe would be a new base item fetchable via a standard URL. It would disclose the location of raw data sets, how they should be joined and the resultant data-type of the information, if the recipe were to be followed. In this way, it might be possible to work a decoder directly into Mosaic/NetScape/HotJava/<name your favorite WWW browser here>. (Perhaps a self-imposed rating could be included within the recipe as additional information bits. Or, perhaps the recipe could be signed by one or more reviewers, which may be trusted by end-users. These features are mentioned only as side features, they do not affect the basic operation to circumvent the letter of the proposed Law. Back to the questions begged and partial solutions. For instance, if one provides, in a distributed fashion, data sets --- which taken apart are not indecent in anyone's mind since they appear completely random --- and a recipe to generate information from the data sets --- which may construct something which might be considered indecent --- does anyone violate any portion of the insane Indecent Bill, if passed by Congress and signed into Indecent Law by the President? Does the person who set up the information split get in trouble? Do the people pulling in recipes and various piece of random-looking data sets get in trouble? Do the data set warehousers get in trouble, even if they could have had no direct way to know the raw pieces of data that they stored were to something eventually seen to be indecent when a recipe was followed. Do the recipe warehousers get in trouble, since they could have known what might be created if all data sets were obtained and joined as proscribed by the recipe? What if end-user client software was taught to do all the steps required to follow a recipe automatically? Same as last question, except the user was explicitly asked before any recipe was followed to completion? I think that the Court would be hard-pressed to find a difference between distribution of something indecent and a recipe known to create something indecent from raw data. But, what if recipes were used for everything, not just items thought to be borderline indecent to totally obscene. Under this assumption, if it could be shown that a recipe and raw data warehousers had no knowledge of each other's contents, they could do no self-policing. It appears that raw data warehousers have "no knowledge" of recipe warehousers as long as the raw data contains no reference to the recipe. The recipe warehousers appear to have no such luck since they contain URLs that point to the raw data chunks required to form coherent information. Recipe warehousers could follow the recipe to "check" content. Finally, on a different tangent, why do the raw data pieces have to be stored on different machines in different countries, if by themselves they are unreadable? Since I believe it is the recipe, not the contributing raw data that presents a problem, it seems like this must be the piece to be stored external to the U.S. For example, only the recipe need be stored abroad in a nice little computer in the Netherlands. Assuming the recipe included only URL-style pointers to the data sets' distributed location and mixing method, a recipe should be quite small. Imagine the Government trying to explain to a jury that random looking transmissions taken together in some exotic manner --- as described by a file fetched from outside the U.S. --- equals some filthy text or image or some other unpopular political speech. Using these rules, I could probably find three passages of text in the 100,000's of pages composing the U.S. Code that when XOR'd together generate something obscene. To make the Government's job even harder before a jury, what if the recipe to be fetched from the foreign country always generated the First Amendment text when followed directly. Imagine the Government's surprise when the Defense later shows a recipe involving the exact same information sets that, perhaps, yields the text of the First Amendment, The Indecent Bill itself or another interesting historical document. What if certain implementations of software that decode these recipes could infer another recipe implicitly encoded within the fetched data sets which were required to follow the explicitly given recipe. Since the information required to regenerate the First Amendment text will have always been pulled, in its entirety, an external observer must concluded that the receiver might have plainly followed the directions in the recipe leading to its generation instead of any hidden inferred recipe for the questionably indecent text or image. That sounds like reasonable doubt to me, regardless of the facts of the case. The Defense can always argue that the client was just trying to express the First Amendment in a novel manner, which happens to be true in more ways than one in this case. :-) The Jaron proposal does have some major benefits at least as I have framed the idea. These need to be mentioned explicitly, in case the important side goal was too subtle expressed above. I reverse the location of the bulk of the data required to store the real information. The recipe, which is assumed to be small with respects to the size of the raw data, is stored in any Internet friendly location (i.e. most of the world except the U.S. after the CDA passes) and pulled into the U.S. as required. The raw data is stored within the U.S., randomly spread between data set servers. When arranged in this manner, the bulk of the data continues to be stored as it would have been before stupid U.S. regulations took affect. This final analysis might sound U.S. centric. It was not meant to be. I assume that any information replication scheme that might have been used could continue to be used. For example, one recipe might exist for each regional replication that existed. Hopefully, the recipes themselves would be replicated in many Internet friendly locations. I welcome informed legal comments on this modified proposal. Regards, Loren -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMOpKUv8de8m5izJJAQH+cgP+MDO6TK5s1MkkiWcvSKP9wwoVn0VqMM+U hPRGQJ2MjL3s7r9mPTqlbnPOllI4FO6rBQt5vqmzMnemFG1k94REvmGHuSMxZ7xV zoqYcvZzxdG2KwKBiLWiilirA0IrDV1MQJ4i7xMYYdOoOoeN1VnUbgHW9iWquwKT tIpWzbFFGO0= =m0bM -----END PGP SIGNATURE-----

2 1

Inter-Patch Voice Network
by J. Kent Hastings 17 Dec '03

17 Dec '03

-- [ From: J. Kent Hastings * EMC.Ver #2.5.02 ] -- -----BEGIN PGP SIGNED MESSAGE----- Cpunx, This may be old hat, but now that PGPfone is available, why don't we start an "Inter-Patch" Network using PGP and ecash? Here are features to consider: * Computer users generate pre-paid phone cards for non-geeks. * Rate is say, 2 cents per minute, for near-real-time voice. * "Voice Mail" service is not subject to telco utility regs. * PIN#s can be changed by users, who can also confirm value. * Thus a user can sell remaining time on a card to others. * A local participant to the target number is selected. * Ecash is instantly delivered in exchange for communications. * Perhaps a 50 percent split, 1 cent per minute for example. * Bad participants are removed from the network. Kent - -- J. Kent Hastings Assistant Director of The Agorist Institute zeus(a)pinsight.com, http://www.pinsight.com/~zeus/agorist/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMOn0hTTxxI221vktAQHs3AQAj/uI2xYGSfE9iSVttCncBrS7yDAUaecX +s1U8zF29zx4a/zq6yUOOJncxS7GWXavUhNLcjuruH7f9tHO1Sam8XcT59rwVlvv P+xnrV/NwaDW0q+TxWjnNhVgTJePC6Hq+6bLRiod+hOTuawkJ3vx50CmDoEKC1Fk HrNqiRLzNQc= =O3Bo -----END PGP SIGNATURE-----

1 0

Re: Errata for _Applied Crypto_
by markh＠wimsey.bc.ca 17 Dec '03

17 Dec '03

Wink Junior <winkjr(a)teleport.com> writes: > Bruce Schneier <schneier(a)counterpane.com> has an errata file for the second > edition of _Applied Cryptography_ available on request. Hopefully he will > also make it available via the Web. Hats off to Bruce for making this > information available in a timely, cost-effective manner. It is available from the Wimsey crypto archive (thanks Bruce!) ftp://ftp.wimsey.com/pub/crypto/Doc/applied_cryptography/2nd_ed_errata-1.0 -- Mark Henderson -- markh(a)wimsey.bc.ca, henderso(a)netcom.com, mch(a)squirrel.com PGP 1024/C58015E3 fingerprint=21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 cryptography archive maintainer -- ftp://ftp.wimsey.com/pub/crypto ftp://ftp.wimsey.com/pub/crypto/sun-stuff/change-sun-hostid-1.6.1.tar.gz

1 0

Re: Foiling Traffic Analysis
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:21 1/2/96, Carl Ellison wrote: >This is merely a technical means for producing anonymous communications. > >Anonymity = conspiracy? Poll after poll shows that the majority of Americans is eager to allow warrantless searches of their homes and property to aid the War on Drugs. Every non-CP person that I tell about remailers asks me "This is legal?". Meaning that they would expect it to be illegal. Surely a prohibition against anonymous remailers and especially against DC nets is a small prize to pay for perceived security against the Four Horsemen... Inevitably, a DC net or the Token Ring approach described earlier will be used for illegal purposes. Once, not if, that comes to pass all participants will be guilty of conspiracy and their property subject to forfeiture. No trial needed and it will happen to the applause of the general public. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Guerilla Internet Service Providers (fwd)
by jim bell 17 Dec '03

17 Dec '03

At 05:37 PM 1/2/96 -0800, you wrote: >> It seems to me that phone line costs are turning into a floor price for >> Internet access, when they shouldn't really be. The main asset telephone >> companies have, right now, is in RIGHTS OF WAY. Put an ISP in a business >> park that allows you to run your own dedicated copper pairs, and you've >> bypassed $25/month/line business phone line charges. >> >> At some point, individual urban and suburban blocks could easily be >> "guerilla re-wired" for ISP access without serious trenching, etc. The >> phoneco would still be involved, but in a far lower-profit mode, as the >> supplier of a single T1 to a multi-block area. > >For the "last mile" to the ISP user, wireless could be a better bet. >Have antenna, will surf. Yes, you're absolutely right. It would be great if some entrepreneur could buy a T1, put up a 2000 MHz (or somewhere around that; whatever frequency was allocated appropriately) local "cellular" data system which would be able to connect to up to, say, 100 simultaneous or so local users using modems little more complicated than a current 900 MHz cordless phone. Okay, maybe all this stuff is already being worked on at a few dozen or hundred companies around the globe, but I can't wait... >(Not speaking for Qualcomm, etc.) > >Peter Monta pmonta(a)qualcomm.com >Qualcomm, Inc./Globalstar Question: Is this the "Qualcomm" that does the Internet access software, or the "Qualcomm" who builds the wireless amps/filters/hardware/etc? Or is it all the same company?!?

1 0

Re: [local] Syracuse new york
by Daniel Miskell 17 Dec '03

17 Dec '03

Douglas F. Elznic writes: >Are their any interested people in having a meeting in the syr area? I most certainly would. I currently reside in the western ny state area. Anybody else interested? Munster --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________

1 0

Re: Guerilla Internet Service Providers (fwd)
by Steve Gibbons 17 Dec '03

17 Dec '03

In Article: <v02120d01ad0fdd14e993(a)[192.0.2.1]>, shamrock(a)netcom.com (Lucky Green) wrote: # At 22:51 1/2/96, Steve Gibbons wrote: # >I had a similar thought about a month ago. In particular, I was thinking that # >skyrise office buildings would be a great market for ISPs to target. Rent a # >closet in the basement/top floor close to the telco demarc. Run lots of # >UTP to # >the cients through the existing conduit, ceiling acces, air ducts, or whatever # >and boom, lots of clients, low overhead, telco bills cut to 1/2 of the # >competitions'. Up-front costs might (or might not be) higher, since the wire # >installation would now be the burden of the ISP. # [...] # >FWIW, (and if anyone winds up doing something like this, I want a "finders # >fee" ;-) ) # Sorry, I thought of this months ago :-) But did you post/publish? :) # But there is an even better # business opportunity out there. Wireless T1 service covering a whole # downtown area. I speced the whole system for the last company I worked for # before they ran out of money. My calculations show that you can deliver # close to T1 speed to corporate customers at fraction of the cost using land # lines. In the best case scenario, you can produce the individual connection # at below $200. No land line based ISP can ever touch that. The total cost # for a land line based IPS is at least $395/T1. Set-up fee is lower too. # Best, the whole thing can be set up self financing. If I wasn't so busy # with other projects, I'd implement it myself. I'd be interested in seeing your numbers and cost breakdowns. I'd really be interested in the up-front costs that would be associated with the equipment and set-up time/training that will help "insure" data privacy over wideley broadcast media. The up-front costs for ~T1 capable tranceivers isn't insignificant either. I figure ~$10K up front (maybe half of that, maybe twice when you include management overhead) Amortize over 3 years, and compare. All of this is assuming that the bandwidth is available on the airwaves to handle ~200 ~T1s. (If we're talking $200.00/mo. for T1, sign me up tomorrow, and my neighbor, and his, and hers, and... *poof* no more bandwidth in a "decently" populated metro area or even a downtown. (Back of the envelope calculations show that ~200 T1 ~= 1 TV station [although I might be off by an order of magnitude.]) I apologize if this is off topic, but the crypto part still applies (moreso, even!) to broadcast over the airwaves. (Besides, I'm sure that this list has enough subscribers that are shelling out $200-$500/mo. for 56K/Frac T1/ISDN that they'd be interested in a less expensive alternative.) -- Steve(a)AZTech.Net

1 0

Why Net Censorship Doesn't Work
by Duncan Frissell 17 Dec '03

17 Dec '03

Sometimes in the day-to-day wrangling with the net censors, we forget the larger picture. There is an assumption here and in the media (see the Newsweek year-end piece on the nets by Steven Levy) that the prospect of 2 years in stir and $100,000 fines will quell net speech. This seems unlikely because of the nature of the medium. Thought control is a very difficult task. It always has been. The Inquisition, Nazi Germany, the Soviet Union, and the People's Republic of China tried but three of the four are no longer with us. Short of totalitarian controls, thought controls will be ineffective. And totalitarian controls are difficult to impose these days. It used to be said that no country would be allowed to move from Communism to Capitalism. It can now be said that it is inconceivable that a modern country will move from a Market to a Command Economy. Market discipline is strong. Since only totalitarians have a shot (for a short time) to enforce thought control, the OECD countries will not succeed at thought control. This used to be unimportant because one's thoughts were trapped in one's head. You could speak only to a few people and "mass media" from books to TV was expensive, centralized and somewhat easy to control. You were free in your mind but cut off from communicating your thoughts freely to others. Those conditions no longer exist. If you can think it (or even not think it) you can communicate it easily and cheaply to others. Since thought is free and communications is almost free, control by others is difficult. The net is a fair mapping of the consciousness of its participants onto a world spanning communications system. Large companies and even quite small businesses are concerned about legal hassles. They have an investment to lose and they are more likely to be prosecuted than ordinary individuals. Ordinary people rightly suspect that their risk of punishment is quite low. Particularly since if they are worried about it, they can take many easy steps to protect themselves. In the coming world in which millions of households have multitasking computers with full-time highspeed connections to the nets, Java-like applets running wild, etc; the opportunities to stash info in easily accessible but hard to trace forms expands without limit. I was trying to imagine over the weekend how the Feds would regulate the Net. Will Janet and her Storm troopers (wearing Nazi-style bucket helmets) smash into the next meeting of the Internet Engineering Task Force and lock everyone up or force them at gunpoint to adopt standards proposed by the government? And if they do, will their code be any good and will it be accepted by enough nodes to make a difference? Unlikely in the extreme. Where are the pressure points where regulation can be applied? To me, it looks like King Canute ordering back the tide. DCF

2 1