December 2003 - cypherpunks-legacy

Updated lists
by John Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- For those of you that use the Mixmaster type2.list and pubring.mix from vishnu.alias.net for your mixmaster clients, I have just made some changes to these files on vishnu. You may want to update accordingly. John Perry - KG5RG - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! Packet Radio - KG5RG(a)WA4IMZ.#SETX.TX.USA.NA WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBML9o2lOTpEThrthvAQGCTgP9F0kt6INVXFMZVg1Q+/yyoukhg8BJF8M7 PnGr8XoO0nc8oLWcNbQSG66oXQuDESNhMg6+/MoZzcmT6NKral1Gr7KCRqDuYX+/ O6JMmipO0NSqKwn7HPkDi7HSEc0g5gGsdp53y+3OXYi+KrYLcDjs5ov22D0ryTun jfksXFfEBrw= =cdZU -----END PGP SIGNATURE-----

1 0

Re: [NOISE] Barring access to Netscape
by Herb Sutter 17 Dec '03

17 Dec '03

At 14:26 12.01.1995 -0500, Robert A. Rosenberg wrote: >If you want to see one way of locking out Netscape users, check out this >URL which points at a Web Page that will not allow access by Netscape Users Just a personal note... while I am strongly in favour of security, this seems rather petulant and knee-jerkish. JeffW: Please add a configuration option to let users override the "Mozilla" ident, so that they can continue to use Netscape at all sites. I personally won't use the override, though; if a site is going to insist on trying to frivolously exlude me as a user based on nothing but the browser I choose to use, they aren't serious anyway. >(the guy is ticked off at them trying to establish their own standards) - The _market_ establishes standards (been proven time and time again). His reaction sounds pretty childish to me, but YMMV... Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

2 1

RE: digital receipts and cash
by Ali Bahreman 17 Dec '03

17 Dec '03

I have a paper on "Certified Electronic Mail" which I feel helps in your quest to create "digital receipts". See my home at www.eit.com/~ali for pointers. The paper was published at the 1994 ISOC Symposium jointly with my thesis advisor, Doug Tygar. Regards, Ali

1 0

Aware's radiation detector
by s1113645＠tesla.cc.uottawa.ca 17 Dec '03

17 Dec '03

This month's Scientific American has an ad by Aware for that serial port radiation detector we were discussing a while back. Upper right corner of page 109, I think. Sells for $149 US, 45 day money back guaranty.

2 1

The ecash protocol (for real)
by Ian Goldberg 17 Dec '03

17 Dec '03

Well, they did it. Probably quite a few people are sending something to this effect to CP right now, and we're crossing paths. Check out http://www.digicash.com/ecash/protpublish.html. Analysis is forthcoming (I'll probably have something useful to say by the December Bay Area meeting...). - Ian

1 0

Re: Netscape gives in to key escrow
by Jonathan Zamick 17 Dec '03

17 Dec '03

>And thus we return to my original point, which is that it will depend on >what is said/disclosed. If every copy of GAKscape had a banner, bigger >than the Netscape "N" which said, "The government can read every message >you send using this software no matter what you do" then I think >consumers will be hard pressed to say they weren't warned. I don't mean to be inflamatory, but it isn't much of a point. They aren't going to put such a banner up because that would limit their business. The goal of Netscape (though I don't single them out), any corporation that would profit from business of those who seek encryption while still allowing GAK, and the government, is to limit the public's awareness of the size of the hole. If they let people know the extent of the hole, then they'll use products w/out it which blows profits from companies involved, and doesn't benefit the government who want it in common use. >I disagree. Almost nobody read the fine print on the back of a note you >sign when you buy a car or otherwise take out a loan, but the provisions >are generally enforceable ... Ignorance is not necessarily an excuse. The question is whether there was false representation of the security of the product. 1. The general knowledge of encryption and secure electronic financial transactions is significantly lower than that of more standard transactions. 2. Applying for a loan or buying a car involve actively going out, negotiating, signing contracts, etc. It will be much simpler to simply stick your vital info into a 'secure' browser. 3. The choice of browser to use will be done, based on representations by companies about the security of their product. If Netscape doesn't explicitly state in direct terms when accessing the browser that the GAK is a potential security risk, then they will be sued. Simply because someone will get blamed. Since they (or again any company that incorporates GAK.. I really don't want to target Netscape in specific) will make the threat sound as insignificant as possible, and not bring it to people's attention (and they can't afford to do so) when (not if) it is breached they will be taken to court repeatedly. > >EBD Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

2 1

Attribution: GAK, Netscape, CyberDog, and you.
by rah＠shipwright.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In the heat of the moment, I failed to attribute something to someone who you all should know about: Tim May, one of the founders of cypherpunks, and the person who used a greatly expanded form of this argument yesterday on that list. While I'm not a journalist, I did violate the rules of "News 101", and did not attribute the source of this excellent argument. Heavy lifting, indeed. Of course, that's nothing new. I don't believe I've ever had an original thought in my life... ;-). Cheers, Bob Hettinga P.S. Sorry, Rich, but I just had to do this one... >Netscape's Jim Clark has quite a tightrope act going. He has a stock price which gives Netscape a P/E ratio of something like 7,000 (the S&P average right now is about 14), which means he really ought to get some revenue in the door, or his investors are going to have his hide. The next thing is, the government is a *really* big customer, and *they* want GAK, in case you haven't noticed. ;-). Couple this with the fact that Netscape is pretty much replicable by concentrated developer effort because its underlying technology is an open standard, *and* the fact that any significant attempt by them to create any real proprietary standards on the internet is practically impossible in the long run, unless they get a whole lot of very big customers in a hurry. > >Now, it looks like that's what happened already, because a lot of very large companies have signed on to using Netscape servers, but you can also see how really weak Netscape's position is when Uncle Sam knocks on their door and asks for a key escrow "bug" in every "secure" Netscape web session. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBML92Q/gyLN8bw6ZVAQF1KQQAkqsgQJ/u9123iqLzYuduTbz6uQJtUuSQ q5DQY/3mwGMqwoXHgWnKkx3gsT0kAZwYWIUTaKB81S7GNsgrTtqabhAy+WlemACT 7bw1TbxRL80GKXSiSfeb1BdCyUyi/yfFO6zB3m8wWB4632Bpo5RqQEd1+jCHmDgw JHo6plE8oQ0= =/Kd2 -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/ >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: GAK, Netscape, CyberDog, and you.
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 12:45 PM 12/1/95, Rich Salz wrote: >And my god, >five lists this time, at least some of which have over a thousand readers? Ouch! Actually, semper.fi has many times that many readers... ;-). Rich, you must be the *only* person, (besides myself), who's subscribed to *all* of those lists. I think if you check it out, that post was germaine to every single one of the lists in question. However, I'm sorry to bury you in a snowstorm. Getting 6 copies of the same thing must have pissed you off, and for that, I apologise. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/ >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Draft agenda for 12/5 Key Escrow Workshop
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

To: Key Escrow Distribution List From: Ed Roback, NIST Subject: Tent. Agenda for 12/5 Meeting Following for your information is the tentative agenda for the meeting next Tuesday. Attachment --------------------- D R A F T Proposed 64-bit Software Key Escrow Encryption Export Criteria Meeting Red Auditorium National Institute of Standards and Technology December 5, 1995 9:00 Welcome Ed Roback, NIST 9:10 Perspectives, Objectives of Criteria, and Future Plans Michael Nelson, Co-Chairman Interagency Working Group on Encryption and Telecommunications (IWG/ET) 9:30 Exportability Criteria Discussion Clint Brooks National Security Agency 10:45 Break 11:00 Draft Key Escrow Agent Characteristics Geoff Greiveldinger U.S. Department of Justice 12:00 Lunch (on your own, NIST cafeteria available) 1:00 Industry Perspectives Bill Sweet & Ken Mendelson, TIS Dorothy Denning, Georgetown University Melanie Janin, U.S. Council for International Business Ed Scheidt, Tecsec Jerry Berman & Daniel Weitzner, Center for Democracy and Technology Paul Lambert, Oracle David Sobol, Electronic Privacy Information Center Padgett Petersen, Lockheed-Martin Robert Holleyman, Business Software Alliance Alex McIntosh, PC Security Limited (UK) Doug Miller, Software Publishers Association (time permitting:) Randy Sabett, Spyrus Shabir Safdar, Voters Telecommunications Watch Viktor Hampel, Hampel Consulting 2:30 Break 2:45 Cont. (as necessary) 3:45 Wrapup & Adjourn Ed Appel, Co-Chairman, IWG/ET ***************************************************** Elaine Frye Computer Security Division National Institute of Standards and Technology Bldg. 820, M.S. Room 426 Gaithersburg, MD 20899-0001 Voice: 301/975-2819 Fax: 301/948-1233 ***************************************************** [Note that the planned breakout sessions originally appear to have been axed, and the meet has dwindled to a vent for industry reps who've already publicized their positions. Now watch brute key escrow spread covertly for "public security."]

1 0

Re: "Got a subpoena?"
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>On Thu, 30 Nov 1995, sameer wrote: > >> > >> > What about a court order to (a) start comprehensive logging, and (b) not >> > tell anyone under penalty of ______ . > >I am unaware of any authority for such an order. >> >> Aren't court orders part of the public record? I don't quite > >Yes, but court orders can be sealed pending further order of the court. Okay, maybe with your qualifications you can answer this. It has always mystified me why "the authorities" think they can engage in wiretapping without informing the person wiretapped that this has occurred, despite the fact that there was apparently never any precedent for this practice before the "wiretap era." In addition, I would like to be able to figure out a method to allow the de-facto disclosure of such activities, and to in fact force the phone company to do so, if they are asked to tap my or anyone else's phone. It occurred to me that even if there was a prohibition on explicitly revealing that such a tap exists, it should be possible to require the telephone company to certify that no tap exists, and to require that this certification will be followed by an explicit and immediate de-certification message the moment the phone company is unable to maintain such certification. The receipt of such a letter/fax/email will indicate that a tap has been placed, despite the fact that it will not say so. >EBD > >Not a lawyer on the Net, although I play one in real life. >

2 1